DFM basic queries

[gautamzone]

Dear friends,

Just a few queries on DFM:

1.

There is a 7600 router with 40 interfaces (all are managed by default) and 5 interfaces connected and remaining 35 interfaces whos admin / oper status is down / down.  Will DFM continue to alert on 35 interfaces?

If yes, will it generate a summary alert email for that 7600 router that there are 35 down interfaces or will it generate one email per interface or rather 35 emails?

2. Also among the IP component classes, i noticed that some IP's only were in managed state for the 7600 router. The managed IP's were the loopback IP's and the ten gig interface ip's. I did not see any alarms on other 1Gig interface ip addresses and  the vlan ip addresses and i later realized that they were not in managed state.

is this the default behaviour that only loopback and ten gig ip addresses will be managed?

3. What exactly is the difference between acknowledging and clearing an alert? Both the acknowledged and cleared alerts can become active again right? And both of them suspend the alert from showing up in the AAD view. Right? Please clarify.

4. I noticed some snmp get requests from LMS to one loopback ip address of a device. But that was not the ip address that i used to discover the device. My understanding is that LMS only issues snmpget request on the device IP that was discovered right?

Thanks a lot

Gautam

[Joe Clarke · Accepted solution]

1. No, DFM does not alert on down/down interfaces.  It will only alert on up/down interfaces.

2. No, all IPs on all managed interfaces will be managed by default.

3. Acknowledged alerts are still active.  All you are saying is that you recognize there is a problem, and you are working on it.  A manually cleared alert says that the problem is not really a problem (i.e. a false positive).  ACK alerts will still show in AAD.  Cleared alerts will eventually time out.

4. Yes, but DFM will also ping all managed IP addresses on all devices.

[gautamzone]

Thanks a lot Jason.

I have rated your replies as always.

Do the acknowledged alerts suspend further email notifications?

Also, i read from the user guide that all events are summarized into one alert when sent by email. So i guess i got the answer that one device generates only one alert and one email message per polling cycle (4 mins by default).

On the DFM, i also see "View" and "preview" in the Managing polling parameters and Managing Thresholds screen.

I dont understand the difference between both. In the user guide, it mentions that preview lets you see the changes before they are applied.

But thats the same case as with view also.

[Joe Clarke · Accepted solution]

No, ackowledged alerts will still generate notifications if a new event is generated for that alert.  DFM will roll up all events pertaining to one device into an alert for that device.  As long as one event in an alert is active, the alert will remain active.

The View option allows you to view threshold parameters.  The Preview option allows you to see what devices will match a given threshold group if the priority is adjusted, and changes are applied.

[gautamzone]

Thanks a lot Jason for the great explanation again.