Event in Cisco Unified Operations Manager makes no sense

[pwenger]

Hi

The ennvironement is as follows:

3 CCM 4.x Cluster and lot of h323 Gateways. All is controlled by a gatekeeper.

For monitoring purposes I'm running a Cisco Unified Operations Manager 2.0.2. From a h323 gateway I recieve an event, that there happend packet loss and that the MOS was below the critical MOS threshold. As destination I see another h323 gateway in the same cluster. What does this mean? For me there is never voice between these 2 gateways. For me this event makes no sense. On the gateways everything looks fine, there are no drops or errors neither on the interface nor on the service-policy.

Any idea why it's generating this event?

Regards

Peter

[sadbulali]

Service Monitor sends a trap when MOS falls below the threshold configured on Service Monitor. You can configure an event setting on Operations Manager that specifies a lower MOS threshold than the one configured on Service Monitor. When Operations Manager receives a trap with MOS less than or equal to the event setting, Operations Manager generates a CriticalServiceQualityIssue event. When Operations Manager receives a trap with MOS greater than the event setting, Operations

Manager generates a ServiceQualityIssue event.

[pwenger]

Okay, I see. But can you tell me why it generates this trap? There is never voice between 2 h323 gateways and so this trap makes no sense.

Cheers

Peter

[spaladug]

Hi Peter,

Can you send a screenshot of the service quality alert that you are referring to? Also include a screenshot of the corresponding record from the CUSM report. Thanks.

[pwenger]

Hi

I will send them to you next monday, when I'm at customer site. Thanks for your patience.

Regards

Peter

[pwenger]

Hi Sri

find attached the alerts I see in CUOM.

Cheers

Peter

[spaladug]

Hi Peter,

I think it would be best if you could get a packet capture (at the point of the 1040 sensor) during the times of one of these low MOS scores and then open a TAC case. The TAC engineer will need to contact the 1040 sensor developers to understand how exactly they are calculating packet loss and the packet capture will help greatly in finding the root cause. There are two components to packet loss for a 1040 sensor.

1) Actual network packet loss (i.e. based on missing sequence numbers).

2) Packets lost in the jitter buffer emulation (packet discards). This will

count as a packet loss for any packet that arrives 20ms past its expected

arrival time OR any "out of order" packet. Since the packets for a G711 are

sent at a 20ms rate, a packet which is delayed 20ms may arrive out of order and

be counted as lost.

--

Sri