How to reduce number of alerts in DFM?

Unanswered Question
Nov 21st, 2006
User Badges:

Hello! I have a large network for monitoring by CiscoWorks and great amount of alerts is killing me. How to reduce number of Unresponsive alerts? DFM finds, that InterfaceOperStatus is UP and InterfaceAdminStatus is UP, but IPStatus is TIMEDOUT. As I think this happens because some interfaces of network nodes are unreachable by ICMP (there is no routing from DFM to those interfaces), but I only need to know up or down status of interfaces, not the ip connectivity. May be it is possible to disable some kind of polling, ICMP for example?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
Loading.
Joe Clarke Tue, 11/21/2006 - 09:16
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Unfortunately, ICMP polling cannot be disabled in DFM 2.0 as it could in DFM 1.2. See CSCsb48643 for more details. However, if you open a TAC Service Request, a script can be provided to you that will allow you to get around this limitation. Reference the above bug in your SR.

miheg Tue, 11/21/2006 - 22:44
User Badges:
  • Gold, 750 points or more

This script talks about putting interfaces to unmanaged state.


Normaly this means the interface is no longer monitored. What we want however is that it is no longer pinged but still monitored for being up.


Can you provide some more info on what it actually does?


The "smarts" people in my organisation say if DFM can't ping it won't manage.


Cheers,


Michel

Joe Clarke Tue, 11/21/2006 - 23:51
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The script sets the managed state of the IP address to UNMANAGED. The device itself will still be managed, and all other events will still be processed by DFM. You will just not receive Unreachable events for those IP addresses.

Ulenspiegel Wed, 11/22/2006 - 00:59
User Badges:

Thanks. And yet another question. What script do you mean? Is it placed in Detailed Device View, and can change managed state of interface to "false" or "true"? If IP address in UNMANAGED state, will DFM alert when some interface go to DOWN state?

miheg Wed, 11/22/2006 - 05:09
User Badges:
  • Gold, 750 points or more

When you place an interface in unmanaged in the detailed device view it is no longer monitored via ICMP and SNMP.


Whatever happens no alerts are raised for that interfaces.


Cheers,


Michel

Ulenspiegel Wed, 11/22/2006 - 05:56
User Badges:

Yeah, I've test this ability of DDV today and got such answer, but what script was discussed above?

Joe Clarke Wed, 11/22/2006 - 09:24
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

I said the IP address is unmanaged, not the interface. The interface is still managed. The IP address, however, will not be pinged.

Ulenspiegel Wed, 11/22/2006 - 22:15
User Badges:

When I test it, I choose "false" in DDV for interface. Then state of Unresponsive event became Cleared, and then this event disappeared. But when I switch interface in DOWN state there was no alert about it in DFM. Why?

Joe Clarke Wed, 11/22/2006 - 22:22
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

If you unmanage the INTERFACE, then you will lose all events for that interface. If you open a Service Request with the TAC and reference the bug I mentioned in my original reply, they can provide you a script that will unmanage the IP address only. This will effectively disable the ICMP polling of the unreachable interfaces while keeping the underlying INTERFACE in a managed state.

achrich Tue, 11/28/2006 - 12:18
User Badges:

Do you think that would ever become a feature rather then a TAC case ?


As we use a lot of firewall`s between segments we have this issue quite a lot.



Joe Clarke Tue, 11/28/2006 - 12:28
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes, DFM 3.0 will have a fix for this.

fmoore Wed, 11/29/2006 - 05:15
User Badges:

When is DFM 3.0 scheduled to ship?

jtissot Fri, 12/14/2007 - 00:50
User Badges:

where is finally the feature in DFM 3.0 ? I am experiencing the exact same problem. Thanks.

Joe Clarke Fri, 12/14/2007 - 09:40
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The ability to unmanage IP addresses in DFM 3.0 can be found under the Detailed Device View for a given device.

GERARD PUOPLO Fri, 12/14/2007 - 17:19
User Badges:

Even for DFM 3.0, I think your choices are the following:


1. "Manually" unmanage IP addresses that are not pingable.


2. use an asl script to unmanage all IP Addresses that are NOT pingable.


3. Define a filter that ignores all IP unresponse events.


Right ?


Joe Clarke Sat, 12/15/2007 - 08:51
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes. However, only the last option was available prior to 3.0. But in 2.0.10, we added the ASL and shell scripts to unmanage non-pingable interfaces in bulk.

jtissot Mon, 12/17/2007 - 00:26
User Badges:

ok thanks a lot

so according to the information I found in Detailed Device View I have to use the provided scripts to manage managed/unmanaged state.


There is no GUI anywhere in DFM/LMS that could make the "manage device management" easier ? Script may be quite an issue for the final end user (customer).


Thanks

Joe Clarke Mon, 12/17/2007 - 10:19
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

DDV does offer you a UI to unmanage IP address (i.e. stop pinging those addresses) in DFM 3.0. Beyond that, there is no bulk management UI, only the scripts.

jtissot Tue, 12/18/2007 - 00:20
User Badges:

Well, in Device Detail View I have a chart with System name, IP address etc, and it's all blank, except for Current State:Suspended. That's weird because the device is actually managed and doesn't appear suspended elsewhere.

Then I have some buttons and a link to Bulk Manage/Unmanage Instructions there I found information about script use.

Actions

This Discussion