CiscoWorks LMS 3.2 - many email notifications at reload

Unanswered Question
Oct 4th, 2010

Hello fellows,

I have noticed that each time I reboot my CW LMS 3.2 server, after the reboot, hundreds of email notifications are being sent to my email. Below are a sample of these notifications:

===================================================================

EVENT ID                = 0002ORL

ALERT ID                = 0000NRR

TIME                    = Mon 04-Oct-2010 14:48:14 BST

STATUS                  = Active

SEVERITY                = Critical

MANAGED OBJECT          = 81.89.140.200

MANAGED OBJECT TYPE     = Security and VPN

EVENT DESCRIPTION       = Unresponsive::Component=10.200.73.1 [81.89.140.200];ComponentClass=IP;ComponentEventCode=1098;InterfaceName=IF-81.89.140.200/19 [VLAN0073] [10.200.73.1];InterfaceAdminStatus=UP;Address=10.200.73.1;IPStatus=TIMEDOUT;InterfaceType=L2VLAN;NetworkNumber=

===================================================================

I've been wondering if anyone besides me has been through this and how he/she fixed this undesirable behaviour.

Thanks in advance.

Moath.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Nael Mohammad Tue, 10/05/2010 - 00:08

Go to CSCOpx/objects/smarts/conf/notifier, modify mail-notify.conf, and change initialEventDelay = 0 to initialEventDelay = 1. Then restart CiscoWorks daemon manager for changes to take effect and should prevent the initial flooding of emails.

Mo'ath Al Rawashdeh Tue, 10/05/2010 - 01:43

Hi Nael,

I changed initialEventDelay to 1 and even to 1200. Rebooted the server and had the same flooding problem. I wonder what could it be.

Moath,

Nael Mohammad Tue, 10/05/2010 - 16:57

In that same file from the previous step, look for "eventSmoothingInterval = 0" and change  "eventSmoothingInterval = 300". This basically says if the event must remain active before a notification is sent. If the notification is cleared before the event smoothing interval expires, notifications are not sent. The default value in seconds is 0 and 300 is equal to 5 minutes.

After making the change, save the file, and restart LMS Daemon Manager.  No need to reboot the server.

Mo'ath Al Rawashdeh Wed, 10/06/2010 - 06:00

Hello Nael,

I have changed "eventSmoothingInterval" to 300, restarted  Daemon Manager, but yet with no luck; still recieving floods of email notifications when server rebooted. The changes that you suggested really make sense. I wonder what are we missing here.

Many thanks for the help.

Moath

Nael Mohammad Thu, 10/07/2010 - 23:38

DFM will always notify you if the problem still exists so you must clear the issue up and acknowledge the alert by clearing it.  Do you get notifications on issues thats been resolved or unresolved issues?

Goto Common Services ---> Software Center ---> Software update and post screenshot of page here.

I suggest you resolve the outstanding alerts and see if the problem persists. In DFM goto ---> Notification Services ---> Notification Group ---> and select group you want to modify ---> unselect the Alert Severity and Alert Status checkboxes.  This should prent the duplicate alerts and flooding. Afterwards, restart daemon manager and let me know the results.

Actions

This Discussion