cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1385
Views
0
Helpful
5
Replies

Cisco Works unexplainable alerts LMS 3.1

tagee
Level 1
Level 1

Start are job to change something on a device Like SNMP Community Strings. I create a Netconfig job to make the change, the change happens and I start to receive a bunch of alerts from device. I will enter a few here for reference.

EVENT ID = 0001H7C

ALERT ID = 000025B

TIME = Wed 15-Apr-2009 10:37:27 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = 10.1.32.1

MANAGED OBJECT TYPE = Routers

EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/1 [0] [c2851 Motherboard with 2GE and integrated VPN];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=c2851 Motherboard with 2GE and integrated VPN;StandbyStat

EVENT ID = 0001H7E

ALERT ID = 000025B

TIME = Wed 15-Apr-2009 10:37:27 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = 10.1.32.1

MANAGED OBJECT TYPE = Routers

EVENT DESCRIPTION = OperationallyDown::Component=CARD-10.1.32.1/3 [0/1] [2nd generation two port FXO voice interface daughtercard];ComponentClass=Card;ComponentEventCode=1073;SystemName=10.1.32.1;Status=NOTPRESENT;Description=2nd generation two port FXO voice interface

This looks like the hardware on the router is there. But the device is working correctly. PLease provide assistance.

5 Replies 5

Joe Clarke
Cisco Employee
Cisco Employee

It looks like for at least one polling cycle, the device reported that these cards were no longer present in the device. Are these events still active now?

Ciscoworks geneates the alerts and they are sent to email and when I go look at the alert on the portal under Network I see the alert for the device and when I open the alert all of the operationally down or other alerts are there I acknowledge or clear them and it goes away.

But if you see 20 or 30 alerts for the same device because it looks like every card or interface show not available for a time? Is that a correct assumption?

It appears that for whatever reason, the device responded with an SNMP value that made DFM think the module was no longer present. We have seen these things from time to time, but they are generally transient, and the events clear on their own. If the events are still active, then could be an SNMP issue on the device.

If you've manually cleared these events, do they come back?

They go away but we are making some mast changes on devices in the network and we were getting 20 or so alerts for each device. This first started to happen when we updated the snmp community strings on all devices. So we where seeing hundreds of alerts.

If you can reproduce, it would be useful to see a sniffer trace of SNMP traffic between the server and device when DFM throws these events.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: