cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1335
Views
9
Helpful
20
Replies

How to reduce number of alerts in DFM?

Ulenspiegel
Level 1
Level 1

Hello! I have a large network for monitoring by CiscoWorks and great amount of alerts is killing me. How to reduce number of Unresponsive alerts? DFM finds, that InterfaceOperStatus is UP and InterfaceAdminStatus is UP, but IPStatus is TIMEDOUT. As I think this happens because some interfaces of network nodes are unreachable by ICMP (there is no routing from DFM to those interfaces), but I only need to know up or down status of interfaces, not the ip connectivity. May be it is possible to disable some kind of polling, ICMP for example?

20 Replies 20

Joe Clarke
Cisco Employee
Cisco Employee

Unfortunately, ICMP polling cannot be disabled in DFM 2.0 as it could in DFM 1.2. See CSCsb48643 for more details. However, if you open a TAC Service Request, a script can be provided to you that will allow you to get around this limitation. Reference the above bug in your SR.

This script talks about putting interfaces to unmanaged state.

Normaly this means the interface is no longer monitored. What we want however is that it is no longer pinged but still monitored for being up.

Can you provide some more info on what it actually does?

The "smarts" people in my organisation say if DFM can't ping it won't manage.

Cheers,

Michel

The script sets the managed state of the IP address to UNMANAGED. The device itself will still be managed, and all other events will still be processed by DFM. You will just not receive Unreachable events for those IP addresses.

Thanks. And yet another question. What script do you mean? Is it placed in Detailed Device View, and can change managed state of interface to "false" or "true"? If IP address in UNMANAGED state, will DFM alert when some interface go to DOWN state?

When you place an interface in unmanaged in the detailed device view it is no longer monitored via ICMP and SNMP.

Whatever happens no alerts are raised for that interfaces.

Cheers,

Michel

Yeah, I've test this ability of DDV today and got such answer, but what script was discussed above?

I said the IP address is unmanaged, not the interface. The interface is still managed. The IP address, however, will not be pinged.

When I test it, I choose "false" in DDV for interface. Then state of Unresponsive event became Cleared, and then this event disappeared. But when I switch interface in DOWN state there was no alert about it in DFM. Why?

If you unmanage the INTERFACE, then you will lose all events for that interface. If you open a Service Request with the TAC and reference the bug I mentioned in my original reply, they can provide you a script that will unmanage the IP address only. This will effectively disable the ICMP polling of the unreachable interfaces while keeping the underlying INTERFACE in a managed state.

OK. Thank you.

Do you think that would ever become a feature rather then a TAC case ?

As we use a lot of firewall`s between segments we have this issue quite a lot.

Yes, DFM 3.0 will have a fix for this.

When is DFM 3.0 scheduled to ship?

where is finally the feature in DFM 3.0 ? I am experiencing the exact same problem. Thanks.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: