CiscoWorks LMS 3.2 - many email notifications at reload

Mo'ath Al Rawashdeh · ‎10-04-2010

Hello fellows,

I have noticed that each time I reboot my CW LMS 3.2 server, after the reboot, hundreds of email notifications are being sent to my email. Below are a sample of these notifications:

===================================================================

EVENT ID = 0002ORL

ALERT ID = 0000NRR

TIME = Mon 04-Oct-2010 14:48:14 BST

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = 81.89.140.200

MANAGED OBJECT TYPE = Security and VPN

EVENT DESCRIPTION = Unresponsive::Component=10.200.73.1 [81.89.140.200];ComponentClass=IP;ComponentEventCode=1098;InterfaceName=IF-81.89.140.200/19 [VLAN0073] [10.200.73.1];InterfaceAdminStatus=UP;Address=10.200.73.1;IPStatus=TIMEDOUT;InterfaceType=L2VLAN;NetworkNumber=

===================================================================

I've been wondering if anyone besides me has been through this and how he/she fixed this undesirable behaviour.

Thanks in advance.

Moath.

Nael Mohammad · ‎10-05-2010

Go to CSCOpx/objects/smarts/conf/notifier, modify mail-notify.conf, and change initialEventDelay = 0 to initialEventDelay = 1. Then restart CiscoWorks daemon manager for changes to take effect and should prevent the initial flooding of emails.

Mo'ath Al Rawashdeh · ‎10-05-2010

Hi Nael,

I changed initialEventDelay to 1 and even to 1200. Rebooted the server and had the same flooding problem. I wonder what could it be.

Moath,

Nael Mohammad · ‎10-05-2010

In that same file from the previous step, look for "eventSmoothingInterval = 0" and change "eventSmoothingInterval = 300". This basically says if the event must remain active before a notification is sent. If the notification is cleared before the event smoothing interval expires, notifications are not sent. The default value in seconds is 0 and 300 is equal to 5 minutes.

After making the change, save the file, and restart LMS Daemon Manager. No need to reboot the server.

Mo'ath Al Rawashdeh · ‎10-06-2010

Hello Nael,

I have changed "eventSmoothingInterval" to 300, restarted Daemon Manager, but yet with no luck; still recieving floods of email notifications when server rebooted. The changes that you suggested really make sense. I wonder what are we missing here.

Many thanks for the help.

Moath

Nael Mohammad · ‎10-07-2010

DFM will always notify you if the problem still exists so you must clear the issue up and acknowledge the alert by clearing it. Do you get notifications on issues thats been resolved or unresolved issues?

Goto Common Services ---> Software Center ---> Software update and post screenshot of page here.

I suggest you resolve the outstanding alerts and see if the problem persists. In DFM goto ---> Notification Services ---> Notification Group ---> and select group you want to modify ---> unselect the Alert Severity and Alert Status checkboxes. This should prent the duplicate alerts and flooding. Afterwards, restart daemon manager and let me know the results.