DFM False Alerts - unresponsive

[n.bowbridge]

Hi,

Has anyone resolved a problem with LMS 2.5.1 (DFM) creating false alerts for 'unreachable' interfaces. My switches have redundant 1 & 2 gig etherchannels running over a campus wide LAN. The network seems fine, our other monitoring software never picks up a problem. Yet DFM constantly sends alerts stating that an interface is unreachable. I have extended the polling parameters to 240 seconds with 1500 msec time-outs and although the fault has improved, alerts still appear. We have 400 stacks of 3750s.

Example:

Event_Description Unresponsive

Component 130.220.196.43 [dist-dist-xx-xx.DNS]

IPStatus TIMEDOUT

InterfaceName IF-dist-xx-xx.DNS/5011 [Po11] [xxx.xxx.xxx.xxx] [NAME]

InterfaceType PROPVIRTUAL

InterfaceOperStatus UP

NetworkNumber xxx.xxx.xxx.xxx

InterfaceMode NORMAL

InterfaceAdminStatus UP

Address xxx.xxx.xxx.xxx

Does this make sense? Any help would be appreciated.

[pradeepde]

It could be due t oa bug in the system.Ithink that the developers are working on it

[miheg]

Have you tried pinging that interface for the Ciscoworks server manually? It might just be some routing issue for that address.

I have several sites where not all interfaces are pingable sometimes due to routing sometimes due to firewall. All interfaces should be managed however.

I'm not sure how to do this. It seems to me it should be possible to get dfm to just talk SNMP to the interface I want and leave the ICMP ping in the closet.

Maybe this can be accomplished by putting the "Reachability settings" on disabled

Cheers,

Michel

[n.bowbridge]

It certainly seems like a bug. Pinging switch from the server is fine. That's why it's so annoying.

It hard for me to resolve our faults quickly because most are being ignored due to all the false alerts.

I raised a TAC case to investigate the fault and was informed to keep increasing the thresholds and test.

I'd luv to have a winge about the quality of LMS but it wont get me anywhere :(

[miheg]

That is a bit spooky. If it works for you on the console, why wouldn't it work for DFM. Can you make a trace to see what goes wrong? Is it Ciscoworks not getting a response or DFM not taking the response into account.

This would give you something to get cisco to open a case with SMARTS.

I guess another way to get rid of these alarms is to disable the "Reachability settings"

I think it will make DFM only SNMP poll the device interfaces via the management IP address, so you will get notified that an interface is down.

It's just a bit annoying that the scope of disabling this is a bit large. (All router, All switches, etc)

It would be great if DFM would only ping interfaces that were discovered to be reachable. That would help you ofcourse.

Cheers,

Michel

[n.bowbridge]

The problem with disabling "Reachability settings" is I have quite a lot of layer 3 switches with loopback addresses and redundant uplinks. If only one uplink interface fails the loopback will remain "up" and DFM wont flag the problem.

Nice idea though, it might work well on my access layer.

[miheg]

That remains to be seen.

Normaly he should also SNMP poll the interfaces status, All via the loopback interface, and notice the status change of the uplink interface and raise an alert.

Besides that he should also have received a trap about an interface going down.

But this remains to be tried first. I'm not 100% sure it works like that.

[swizzlestick]

is there maybe a patch or update for this? I have (I think) the same problem. He shows four distribution switches af unresponsive/unreachable. but I can Ping and reach them by SNMP.

I don't know what I have to do. It's annoying

Thanks