Solstice Enterprise Manager 4.1 Managing Your Network |
Managing Alarms
The Alarms window in Solstice Enterprise ManagerTM (Solstice EM) provides information about alarms received by the Management Information Server (MIS). An alarm notifies the network administrator that an unsolicited message has been received from an agent running on a network device. The message indicates a problem or condition detected on the device. These messages are known as event notifications (in CMIP terminology) or traps (in SNMP terminology).
This chapter comprises the following topics:
- Section 5.2 Getting Started With the Alarms Window
- Section 5.3 Viewing Alarms
- Section 5.4 Grouping Alarms Into Associations
- Section 5.5 Filtering Alarms
- Section 5.6 Performing Operations on Alarms
- Section 5.7 Deleting Alarms From the Log
- Section 5.8 Logging Alarms Management Activity
- Section 5.9 Graphing Alarm Data
- Section 5.10 Customizing the Alarms Window
- Section 5.11 Customizing the Tools Menu
5.1 Overview
Alarms originate as event notifications or SNMP traps are sent to the MIS from managed network components. Some types of event notifications and SNMP traps are translated into log records and collected by the AlarmLog. By default, the AlarmLog collects alarms for all events that provide a perceived severity attribute, such as the following default event types:
- communicationAlarm
- environmentalAlarm
- equipmentAlarm
- qualityofServiceAlarm
- processingErrorAlarm
- SNMP traps that are mapped to event notifications:
Event notifications for object creation and deletion, attribute value change, SNM alarm events, and state change are not logged to the AlarmLog. These types of events may be collected by another log, depending on how Event Logs is configured. See the Customizing Guide for information about Event Logs.
You use the Alarms window to monitor and manage alarms in Solstice EM's AlarmLog, by default. You can also use the Alarms window to manage alarms collected by other logs you may have created with Event Logs. In this chapter, the term alarms refers only to those alarms that are collected by the AlarmLog.
You can find more information about logs in Chapter 11."
5.1.1 Functions of the Alarms Window
- View summary information about all alarms or the details of an individual alarm.
- Change the state of an alarm as work progresses on resolving problems that trigger an alarm. Alarm states are explained in the next section, Section 5.1.3 Alarm States.
- Group alarms of a certain type into an association so that actions can be taken on the group as a whole. Alarm associations are explained in Section 5.1.4 Alarm Associations.
- Filter alarms to further refine the type of alarms you want to look at.
- Delete alarms from the AlarmLog.
- Graph alarm information.
Tip You can use Alarms to monitor alarm logs other than the AlarmLog, if any. See the Customizing Guide for information about creating other alarm logs.
5.1.2 Alarm Severities
The perceived severity is an attribute of each alarm, indicating the seriousness of the problem. Severity is indicated in the Alarms window by the Severity column and by the color shown in the first column in the Alarms window. The colors match the colors used to indicate severity in the Viewer window. The default color mapping is shown in the following table.
TABLE 5-1 Color Mapping for Alarm Severity Cleared Gray Indeterminate Blue Warning Yellow Minor Cyan Major Orange Critical Red
This table lists the severities from lowest to highest severity. Alarms with the highest severity -- critical, are shown in red.
Color mapping for severities cannot be changed in the Alarms tool.
5.1.3 Alarm States
The state of an alarm helps network operators keep track of the status of network problems. Alarms may exist in three possible states:
- Open - the alarm has been received by the MIS and added to the AlarmLog, but not yet acted upon by an operator.
- Acknowledged - the alarm has been seen by an operator who has marked it to indicate that the alarm is being investigated.
- Cleared - the problem causing the alarm has been fixed.
In the Alarms tool, an alarm may be marked Acknowledged or Cleared, or both. An Open alarm is neither acknowledged nor cleared.
See Section 5.1.7 Alarm Clearing for more information about clearing alarms.
5.1.4 Alarm Associations
Alarm associations are groupings of alarms with equivalent values for one or more selected attributes, such as event type and object instance. Associations make it easier to manage large numbers of alarms generated for the same network problem, or problems in related areas.
The Alarms window allows you to change your view of Alarms from an individual alarm view to an associations view, and vice versa. When you switch your view mode to Associations, an alarm listed in the table of alarms actually represents a group of similar alarms. The alarm selected to represent the group is either of the highest severity, or the most recent. You determine the criteria used to select the representative alarm when you specify the association rules.
Any action you take on an alarm while viewing associations applies to all the alarms in the group associated with that alarm. For example, if you acknowledge an alarm while viewing alarm associations, all alarms in the same association are changed to an acknowledged state. You cannot take action on any individual alarm within an association.
5.1.4.1 Attributes Used to Associate Alarms
Alarms have a number of attributes whose values are determined when the alarm is generated. You can use combinations of the following attributes to group alarms into associations:
- Object instance - the name of the device generating the alarm
- Event type - the class of the event, such as communicationAlarm, or nerveCenterAlarm
- Probable cause - the likely cause of the alarm, such as adapterError
- Specific problem - information more specific to the problem
- Additional Text - additional textual information provided in the notification
- Additional Information Identifier - indicator of the type of information included in the Additional Information attribute
- Additional Information- other additional information provided in the notification
Individual alarms are in the same association if they have the same values for the selected attributes. For example, if you select object instance as the attribute of association, all alarms for the same device are grouped into an association.
By default, when you enable associations, the Alarms tool uses all the available parameters to group alarms. Alarms may have null values for the attributes for Specific Problem, Additional Text, Additional Information Identifier, and Additional Information. Generally, Object Instance, Event Type, and Probable Cause are the attributes most likely to create meaningful associations. You can experiment with different association criteria to determine what best suits your needs.
5.1.4.2 Alarm That Represents the Association
When you view associations in the Alarms window, you are actually viewing data for one alarm that is chosen to represent each alarm association. You can specify in the Association Rules whether the representative alarm should be the one of highest severity or the most recent. If you use the highest severity, you realize one important advantage to grouping alarms into associations: to quickly convey the highest severity alarm that is related to a single problem area.
5.1.5 Alarm Views
You can choose to view alarms in several ways:
- By summary or all individual instances
- By Associations
An important difference between grouping alarms by associations and by summary is that associations are a means to view and manage groups of alarms, while summary view is a means to view groups of alarms or groups of associations that have only their severity or object instance in common.
5.1.5.1 Summary View of Alarms
The Alarms window allows you to choose between a summary view of alarms, or viewing all alarms at once. The summary view shows a table of alarms grouped either by severity or by object instance, depending on your preference. You can specify how to summarize in the Summary Rules dialog.
If you summarize by severity, the main Alarms window displays one row for each of the severity levels: critical, major, minor, warning, and indeterminate. If there are no alarms of a given severity, no row exists for that severity. Each row indicates how many alarms exist for each severity.
If you summarize by object instance, the main Alarms window displays one row for each device that has generated an alarm. Each row indicates how many alarms exist for each object instance.
5.1.5.2 Association View of Alarms
Associations share a common severity or object instance.
The main Alarms window, by default, has both Summary and Associations turned on; the main window shows a summary of associations.
The following table may help you understand the relationship between associations and summary view in the Alarms main window.
Associations and summary view can be toggled easily in the Alarms window, as explained in Section 5.3 Viewing Alarms.
5.1.6 Alarm Filters
To further refine your view of alarms, you can filter alarms to select only those that match criteria you specify. You might, for example, use filtering to find all acknowledged alarms or all alarms that were generated on a certain date.
You can define up to eleven filters, using the following attributes:
- Managed object instance - device triggering the alarm
- Managed object class - type of device or resource generating alarms
- Alarm state - whether the alarm is in an open, acknowledged, or cleared state
- Alarm severity - alarm's perceived severity (critical, major, minor, warning, indeterminate, normal)
- Event type - type of event, such as communications, Internet, Nerve Center
- Date and time - occurring on the current day at a specific time, or after a certain date and time
- Acknowledgment operator - user name of the operator who acknowledged an alarm
- Acknowledgment date - date when an alarm was acknowledged
- Clear operator - user name of the operator who cleared an alarm
- Clear date - date when an alarm was cleared
- Problem code - numeric or textual ID of the probable cause of an alarm
Filters are cumulative, therefore all specified filters are used in selecting alarms.
5.1.7 Alarm Clearing
Similar alarms are defined as those alarms that are identical in all respects except for the log ID and the date/time stamp. For example, if you received 150 identical alarms from the same network device about the same problem, these alarms would be considered similar. If you cleared one of the alarms, all 150 would be cleared. However, if some of the alarms were related to the same problem on the same device, but the value of the probableCause attribute was different, the alarms having the different value for probableCause would not be cleared automatically.
To look at it another way, suppose you have ten linkDown alarms from two different hosts (five identical alarms from each host). If you select all ten alarms with the mouse and clear them at once, you can expect to receive two cleared-severity alarms. Of the ten alarms selected, two were unique and the rest were essentially duplicates of one of the two.
If you select a large number of dissimilar alarms and clear them, you can expect to receive a potentially large number of cleared-severity alarms in response.
Note If you clear the alarm representing an association, thus clearing all the alarms in the association, Solstice EM does not generate cleared-severity events for the cleared alarms.
If you do not want this alarm-clearing functionality, deselect the Clear Event Required option in the Alarms Properties. Only the selected alarms will be cleared, and Solstice EM will not generate cleared-severity events.
5.1.7.1 Manually Cleared Alarms
Once a network problem has been resolved, you can clear the alarm(s) associated with the problem. You can clear alarms one at a time, or clear multiple events at once. You can clear multiple events in the following ways:
- Select multiple alarms with the mouse in the Alarms window and choose
Actions -> Clear.- Clear one alarm while Associations are on - this clears all the alarms in the association. See Section5.6.2 Clearing Alarms for more information about clearing alarms.
- Clear one alarm and let Solstice EM clear all similar alarms - this action causes Solstice EM to generate a new alarm with severity specified as cleared. Section 5.1.7.2 Automatically Cleared Alarms and Cleared Severity Events explains more about this feature.
5.1.7.2 Automatically Cleared Alarms and Cleared Severity Events
By default, Solstice EM is set up with the Clear Event Required option enabled in the Alarms Properties dialog. This causes Solstice EM to do the following:
- Clear similar events automatically.
- Generate an event (and subsequently an alarm, by default) with severity specified as cleared. The purpose of the alarm is to notify operators that multiple alarms were automatically cleared.
5.1.8 Related Tasks
5.1.9 Related Files
Alarms configuration files, see Section5.13 Configuration Files.
5.1.10 Further Reading
You may find it helpful to read about the Alarm Service in;
5.2 Getting Started With the Alarms Window
This section describes how to start and exit the Alarms window.
To Use the Alarms Window
1. Start Alarms in one of the following ways:
- From the Network Tools window, double-click Alarms.
- From the Viewer window, click Tools -> Alarms.
- From the Viewer window, select a network component, right-click, and select Alarms.
- This shows alarms specific to the device.
- From an operating system prompt, execute:
em_alarmmgr
- See Section 5.12.1 The em_alarmmgr Command for a list of options to be used with the em_alarmmgr command.
2. Perform any of the tasks discussed in this chapter.3. Click File -> Exit when you have finished your tasks.See Also: The em_alarmmgr Command.
5.3 Viewing Alarms
The Alarms window provides flexibility in viewing information about alarms. The default view is a summary view of alarms. You can change your initial view of alarms to use your preferred view. Section5.3.2 Viewing Alarm Associations and Alarm Instances describes how the Associations and Summary settings change the view of alarms.
You can quickly switch your view of alarms between instance and association, and between details and summary, as explained in the following procedures.
Tip When you exit Alarms, you can save your Alarms properties so your preferred view is the one you see when first starting the Alarms window.
5.3.1 Viewing Alarms in Summary View
The main Alarms window view can be toggled to show alarms in summary view.
In summary view, the main window shows a subset of the available information about alarms, and groups alarms by severity or by the device generating the alarm. When summary is off, the main window shows more information about the individual alarms, or alarm associations if associations are on. Section5.3.2 Viewing Alarm Associations and Alarm Instances explains the effects of toggling Associations and Summary in the main window.
You can determine what attributes are shown in the more detailed non-summary view, as well as their order of appearance, using the Alarm Summary Rules dialog. See Section 5.10 Customizing the Alarms Window for more information.
To View Alarms in Summary View
- Click View -> Summary to toggle the view of the main Alarms window between detailed and summary format.
If you are viewing details, the view changes to show a summary. If you are viewing a summary, the view changes to show more details.
Note If both summary view and associations are off, the main window shows all alarm instances.
5.3.2 Viewing Alarm Associations and Alarm Instances
The main Alarms window view can be toggled to alternately display alarm associations and alarm instances.
To View Alarm Associations or Instances
- Click View -> Associations to toggle the view in the main Alarms window.
If you are viewing associations, the view changes to show alarm instances. If you are viewing instances, the view changes to show alarm associations. See Section5.4 Grouping Alarms Into Associations for information about creating associations.
Note If both summary and associations are off, the main window shows all alarm instances.
To View Alarm Instances in an Association When Summary is On
1. Open the Alarm Associations window from the main Alarms window in one of the following ways:
- Double-click the association summary you are interested in.
- Select the association summary you are interested in and click Actions -> Alarm Associations.
2. From the Alarm Associations window, open the Alarm Instances window in one of the following ways:
- Double-click the association you are interested in.
- Select the association you are interested in and click Actions -> Alarm Instances.
To View Alarm Instances in an Association When Summary is Off
- Open the Alarm Instances window from the main Alarms window in one of the following ways:
- Double-click the association you are interested in.
- Select the association you are interested in and click Actions -> Alarm Instances.
To View Details of an Alarm
1. Open the Alarm Instances window, as explained in the two previous procedures.
- If you have turned off summary and associations, you are already viewing alarm instances.
2. Open the Alarm Details window in one of the following ways:
- Double-click the alarm in the table.
- Select the alarm and click Actions -> Alarm Details.
To View Details of the Alarm Representing an Association
- With associations turned on, open the Alarm Details window in one of the following ways:
- Double-click the alarm in the table.
- Select the alarm and click Actions -> Alarm Details.
5.3.3 Viewing Alarms for a Specific Network Component
If you are interested in seeing only the alarms for one specific network component, you can either use filtering, as described in Section5.5 Filtering Alarms, or you can use the Viewer window to do this quickly and easily, as described in the following procedure.
To View Alarms for a Specific Network Component
1. In the Viewer, select the network component whose alarms you want to see.2. Right-click to open the pop-up menu, and select Alarms.
- The Alarms window is displayed, showing the alarms (or associations) for the selected device.
5.3.4 Viewing Alarms on a Remote MIS
You can view alarms on a remote MIS instead of the local MIS if you modify the Alarms Properties as described in the following procedure.
To View Alarms on a Remote MIS
1. Set up a trusted host relationship between your host and the remote MIS host.
- See Chapter 6" for information about trusted host relationships.
2. On the local MIS, click File -> Customize -> Properties to open the Alarms Properties dialog.3. In the MIS field near the center of the dialog, type the name of the MIS whose alarms you want to view.4. In Available Alarm Logs, select AlarmLog and click Display.
- Display Alarm Logs lists the remote-MIS-name: AlarmLog.
5. (Optional) In Display Alarm Logs, select local-MIS-name:AlarmLo g and click Remove.
- This removes from view the alarms from the local MIS.
6. Click OK or Apply.5.3.5 Viewing a Non-default Alarm Log
If the MIS is collecting alarms in a log other than the default AlarmLog, you can use the Alarms Properties dialog to select the log that contains the alarms you want to view. (The Event Logs tool is used to create logs and determine what objects are collected in the log.)
To View a Log Other than AlarmLog
1. Click File -> Customize -> Properties to open the Alarms Properties dialog.2. In the lower half of the dialog, select the log you want to view from the list of Available Alarm Logs.3. Click Display to move the log name to the Display Alarm Logs list.
- The Alarms window will display alarms from all logs listed in Display Alarm Logs.
4. If you do not want to view a log listed in Display Alarm Logs, select the log name and click Remove to move the log name to the Available Alarm Logs list.5. Click OK.5.3.6 Printing a List of Alarms
You can print the list of alarms currently displayed in the Alarms window as described in the following procedure.
To Print a List of Alarms
1. In the Alarms window, click File -> Print to open the Print window2. Select the appropriate print options:
- Print to file - Select this and type a file name for printing to a file. The file is created in the directory from which you started Solstice EM or the Alarms tool. You can also browse to another directory.
- Printer - Select this and type or select a printer name.
- Copies - Select the number of copies to print. This option is available only when printing to a printer.
- Banner Page Title - Type an optional title to print on the title page of the printout. This option is available only when printing to a printer.
- Text/Table - select Text to print the alarms in ASCII text, or select Table to print a PostScript version that looks similar to the table shown in the Alarms window.
3. Click Print.5.4 Grouping Alarms Into Associations
The Alarms tool allows you to group alarms with similar attributes into associations, which are described in Alarm Associations. This section describes how to set association rules to:
- Select the alarm for the association
- Specify attributes to associate alarms
- Save association rules
- Load association rules
By setting rules for alarm associations, you determine which attributes will be used to group alarms into associations. You also specify whether to use the highest priority alarm or the most recent alarm as a representative for the group to display in the Alarms window. The following procedures show you how to do this.
To Select the Alarm to Represent the Association
1. Click View -> Association Rules to display the Alarm Association Rules dialog.2. For the setting Get Alarm Data From, select an option as follows:
- Select Highest Severity Alarm if you want the alarm with highest severity to be displayed as the representative alarm for the association. Making this choice ensures that the highest severity alarm for a single problem area is conveyed quickly to the operator.
- Select Most Recent Alarm if you want the most recent alarm to represent the association.
3. Click OK.
To Specify Attributes Used to Associate Alarms
1. Click View -> Association Rules to display the Alarm Association Rules dialog.2. For the setting Associate By, select the attributes that should be used to group alarms into associations.3. Click OK or Apply.
- When you exit Alarms, you are prompted to save properties. If you are logged in as root and you save properties, the alarm association rules will be saved in the file em_alarmmgr_ap.cf in the / (root) directory. If you are logged in as another user, properties are saved in .em_alarmmgr_ap.cf in your home directory. The rules will be used each time you start Alarms, until you change the rules.
To Save Association Rules to a File
1. Click View -> Association Rules to display the Alarm Association Rules dialog.2. Make your selections.3. Click Save to open a Select File dialog and specify the name of the file in which to save the association rules.
- You can provide any name to the file. You can load this file to use these association rules again as explained in the following procedure.
To Load Existing Association Rules
1. Click View -> Association Rules to display the Alarm Association Rules dialog.2. Click Load to open a Select File dialog and select the file containing association rules you want to use.3. Click OK in the Select File dialog to load a rules file.4. Click OK or Apply in the Alarm Association Rules dialog to put the association rules into effect.5.5 Filtering Alarms
You can select particular attributes of alarms you want to view, thereby creating a subset of alarms relevant to you. You specify the attributes you are interested in by setting alarm filtering rules. See Section 5.1.6 Alarm Filters for information about filters.
5.5.1 Setting Alarm Filtering Rules
This section tells you how to specify rules for filtering alarms and how to deselect a rule for a filter.
To Set Alarm Filtering Rules
1. Click View -> Filtering Rules to display the Alarm Filtering Rules dialog.2. At the first Include list, select a filter attribute to include.
- Options allow you to specify the value of the attributes for which you want to filter alarms.
3. Specify values for the filter attribute.
- For example, the Only Object Instances filter allows you to type the instance names you are interested in and click Add.
4. If you want to specify additional filters, scroll down to the next Include list and select another filter attribute.
- As you define filters, additional Include lists are added to the dialog.
5. Click OK when you have defined all the filters you want to use.
- The Alarms window is updated to display the filtered alarms.
To Deselect a Filter Rule
1. Click View -> Filtering Rules to display the Alarm Filtering Rules dialog.2. At the Include list for the filter you no longer want to use, select the blank item at the top of the list.3. Click OK or Apply.5.5.2 Using Filtering Rules Files
If you want to use combinations of filters at various times to select filters having different attributes, you can save filtering rules to a file and reuse them at another time. You can also print filtering rules. The following tasks describe these options.
To Save Alarm Filtering Rules
1. Click View -> Filtering Rules to display the Alarm Filter Rules dialog.2. Make your selections.3. Click Save to open a Select File dialog and specify the name of the file in which to save the filtering rules.
- You can name the file any name you like. You can load this file to use these filtering rules again as explained in the following procedure.
To Load Existing Filtering Rules Files
1. Click View -> Filtering Rules to display the Alarm Filtering Rules dialog.2. Click Load to open a Select File dialog and select the file containing filtering rules you want to use.3. Click OK in the Select File dialog to load a rules file.4. Click OK in the Alarm Filtering Rules dialog to put the filtering rules into effect.
To Print Filtering Rules
1. Click View -> Filtering Rules to display the Alarm Filtering Rules dialog.2. Set the filters you want to use, or load an existing filter rules file.3. Click Print.
- The Print dialog is displayed, allowing you to print to a file or a specific printer and, optionally, specify a banner title.
- The printout shows which filters have been selected and their assigned values.
5.6 Performing Operations on Alarms
You can perform the following operations on alarms:
- Acknowledge an alarm - Mark the alarm to indicate that you have seen it.
- Undo an acknowledgment - Remove the acknowledgment from an alarm.
- Clear an alarm - Mark the alarm to indicate that the problem is fixed.
- Undo a clear - Remove the clear indication from an alarm.
- Hide an alarm from the display - Make an alarm disappear from the Alarms window, although the alarm is still contained in the log.
- Annotate an alarm - Add to an alarm text that will be displayed with the alarm in the Alarms window.
You can perform operations on individual alarms or alarm associations.
Note If you have associations on, and are looking at alarm instances within an association, you cannot perform any actions on an alarm instance in that association. Actions can be taken against individual alarms only when associations are off.
5.6.1 Acknowledging Alarms
When an operator acknowledges an alarm, the implication is that the operator is taking care of the problem. The Ack Opr and Ack Date fields are updated to indicate the user ID for the operator acknowledging the alarm and the time that it was acknowledged. Acknowledging changes the state of the alarm.
To Acknowledge an Alarm
1. In the main window, select the alarm you want to acknowledge.2. Do one of the following:
- Click the Ack check box in the alarm row.
- or
- Click Actions -> Acknowledge.
- The user ID of the person who acknowledges the alarm is listed in the Ack Opr column in the row for the alarm. The timestamp of the acknowledgment is displayed in the Ack Date column. You may have to use the horizontal scroll bar to see these fields in the Alarms window.
- If you have associations on, all alarms in the association are marked acknowledged. If you have associations off, only the alarm instance is marked acknowledged.
To Undo an Alarm Acknowledgment
1. In the main window, select the alarm you do not want to acknowledge.2. Do one of the following:
- Click the Ack check box in the alarm row.
- or
- Click Actions -> Undo Acknowledge.
- If you have associations on, all alarms in the association are no longer marked acknowledged. If you have associations off, only the alarm instance is no longer marked acknowledged.
5.6.2 Clearing Alarms
When you clear an alarm, the implication is that the network problem that caused the alarm to be generated has been fixed. You can clear one alarm at a time, select multiple alarms and clear them, or set up Solstice EM to clear multiple related alarms when you clear only one. In the latter case, Solstice EM generates a new event to indicate that several related alarms have been cleared. See Section 5.1.7.2 Automatically Cleared Alarms and Cleared Severity Events for more information about this feature.
To Clear Alarms
1. In the main window, select the alarm(s) you want to clear.2. Do one of the following:
- Click the Clear check box in the alarm row.
- or
- Click Actions -> Clear.
- The user ID of the person who clears the alarm is listed in the Clear Opr column in the row for the alarm. The timestamp of the clear is displayed in the Clear Date column.
- If you have associations on, all alarms in the association are marked cleared. If you have associations off, only the alarm instance is marked cleared.
To Undo an Alarm Clear
1. In the main window, select the alarm you do not want to clear.2. Do one of the following:
- Click the Clear check box in the alarm row.
- or
- Click Actions -> Clear.
- If you have associations on, all alarms in the association are no longer marked cleared. If you have associations off, only the alarm instance is no longer marked cleared.
To Automatically Clear Similar Alarms
1. Click File -> Customize -> Properties to open the Alarm Properties dialog.2. Select Clear Event Required.3. Click OK in the Alarm Properties dialog.4. In the Alarms window, select an alarm you want to clear.5. Do one of the following:
- Click the Clear check box in the alarm row.
- or
- Click Actions -> Clear.
- The alarm and all similar alarms are marked cleared. Similar alarms are those that are identical in all attribute values except time and log record ID. Solstice EM then generates an event having the same attribute values as the cleared alarms, except for the severity attribute, which is Cleared. The event is displayed as an alarm in the Alarms window.
5.6.3 Hiding an Alarm in the Alarms Window
If you want an alarm or association to be displayed in the Alarms window, but you do not want to delete the alarm, you can hide it from view.
Note Once an alarm or alarm association is hidden from the Alarms display, you cannot get it to redisplay unless you use the MIS Objects tool to modify the displayState attribute of the alarm's log record. See the Customizing Guide for more information about the MIS Objects tool.
To Hide an Alarm in the Alarms Window
1. In the main window, select the alarm(s) you want to remove from the display.2. Click Actions -> Hide.
- The selected alarm is removed from the display, but it remains in the log.
5.6.4 Annotating Alarms
You can annotate an alarm to add notes or comments to provide additional information about the alarm. The annotation, or display text attribute, can only be seen through the Alarm Details window. See Section5.3.2 Viewing Alarm Associations and Alarm Instances for more information about viewing alarm details.
To Annotate an Alarm
1. In the main Alarms window, select the alarm you want to annotate.2. Click Actions -> Annotate to open the Display Text dialog.3. In the Display Text box, type the text you want to be displayed with the alarm.
- Useful annotations include the status of the problem, when it might be fixed, who is working on it, and so on.
- If associations are on, all alarms in the selected association are annotated.
5.7 Deleting Alarms From the Log
You can delete alarms from the log in several ways.
- Manually - Select an alarm or alarm association in the Alarms main window, and delete it. See Section5.7.1 Deleting Alarms Manually for more information.
- Automatically - Have alarms deleted once they have been cleared by an operator and meet specified criteria (such as a certain severity level) or once they have been in the log for a specified period of time. See Section5.7.2 Selecting Alarms for Automatic Deletion After Clearing for more information.
- Using Alarm Deletion Controllers - Set up filters to select alarms to delete. See Section 5.7.3 Filtering Alarms for Deletion for more information.
5.7.1 Deleting Alarms Manually
In the Alarms window, you can delete from the alarm log specific alarm instances or alarm associations.
To Delete an Alarm From the Log Manually
1. In the main window, select the alarm or association you want to delete.2. Click Actions -> Delete to remove the alarm from the log permanently.
- Deleted alarms cannot be retrieved.
5.7.2 Selecting Alarms for Automatic Deletion After Clearing
You can set up Alarms to automatically delete from the log an alarm that has been cleared. You can select only alarms that meet certain criteria to be deleted in this fashion. For instance, you can specify that only alarms having minor severity or less, and which are older than five days be deleted automatically. The Alarm Properties dialog allows you to do this, as explained in the following procedure.
To Select Alarms for Automatic Deletion After Clearing
1. Click File -> Customize -> Properties to open the Alarm Properties dialog.2. Select Delete on Manual Clear.3. For the setting Alarms of Severity or Below, select the highest severity level alarm that you want to be automatically deleted after being cleared.
- For example, if you choose critical, the highest severity, alarms of any severity will be deleted. If you choose minor, only alarms having severity levels of minor, warning, or indeterminate will be deleted.
4. For the setting Alarms Older Than, select the number of days, hours, and minutes an alarm must exist before being deleted.
- Alarms must meet both the severity level and time criteria before being deleted after being cleared.
5. Click OK or Apply.5.7.3 Filtering Alarms for Deletion
The Alarm Deletion Controllers window allows you to create controllers used to select alarms to delete from the MIS. The alarm deletion controllers can be used to delete alarms from any log in the MIS, including the AlarmLog. This section describes creating controllers for deleting alarms from the AlarmLog.
Note Before alarms can be deleted using controllers, the purge daemon (em_purged) must be running. To start the purge daemon, you must set the EM_ENABLEPURGE environment variable to TRUE and restart the MIS with the em_services -start command.
To Create Alarm Deletion Controllers for Deleting Alarms Automatically
1. Open the Alarm Deletion Controllers window in one of the following ways:
- Click Tools -> Alarm Deletion Controllers in the Alarms window.
- From a command line, type the following command:
- em_purgemgr [-host hostname]
- where hostname is the name of a remote MIS.
2. In the Alarm Deletion Controllers window, click Actions -> Create to open the Alarm Deletion Controllers Create dialog.3. In the MIS field, specify the MIS on which you want to delete alarms.
- By default, the local MIS is displayed, but you can specify a remote MIS instead. The system from which you are running Solstice EM must have a trusted host relationship with the remote MIS.
4. In the Controller Name field, type a name for the filter you are creating.5. At the Deletion item, select Enabled to enable this controller.6. In the Log Name field, select AlarmLog.
- If you use another log to collect alarms, you can select it from the list.
7. In the Conditions area, make selections for the following options:
- Alarm Severity - Select the severities of alarms that you want to delete.
- Alarm State - Select the cleared and acknowledged status of alarms you want to delete.
- State Unchanged Since - Specify the amount of time that an alarm must not have had a change in state (clear/acknowledge) before deleting.
8. Click OK.
- The controller is displayed in the table in the Alarm Deletion Controllers window.
To Modify an Existing Alarm Deletion Controller
1. In the Alarm Deletion Controllers window, select the filter you want to change, and click Actions -> Properties.
- You can also double-click the filter to open the Properties dialog.
2. Make the modifications to the filter.3. Click OK or Apply.
To Disable an Alarm Deletion Controller
1. In the Alarm Deletion Controllers window, select the filter you want to disable, and click Actions -> Properties.
- You can also double-click the filter to open the Properties dialog.
2. At the Deletion field, click Disabled.3. Click OK or Apply.
- The controller is marked Disabled in the Alarm Deletion Controller window. The controller will not be used for deleting alarms unless you enable it.
To Delete an Alarm Deletion Controller
1. In the Alarm Deletion Controllers window, select the controller you want to delete, and click Actions -> Delete.2. Click OK.
To Display Alarm Deletion Controllers on a Remote MIS
1. In the Alarm Deletion Controllers window, click View -> Controller Selection.2. In the MIS field, type the name of a MIS whose alarm deletion controllers you want to display.
- You can enter more than one MIS if you want to connect to more than one MIS at a time to view their alarm deletion controllers.
3. In the Available Controllers field, select one or more MIS names and click the Show button to move the MIS name to the Shown Controllers field.4. Click OK or Apply.5.8 Logging Alarms Management Activity
The actions taken by network operators can be logged to a file. You can determine whether to log activity, and which activities to log using the Alarms Security dialog. The information is logged in a text file, located in the directory from which the Alarms tool was started.
To Log Alarms Management Activity
1. Click File -> Customize -> Security to open the Alarms Security dialog.2. In the MIS field, type the name of the MIS whose alarms activity you want to monitor.3. Click Log the Operators Actions.4. Select the activities you want to log.5. Click OK.5.9 Graphing Alarm Data
You can represent alarm data in graphical form to observe trends in areas of your network that are generating alarms. You can use alarm summary data or alarms from specific devices, and plot the alarm type or severity of alarms. You can also choose to do a static plot of current alarms in the log, or do a dynamic plot of data polled at an interval you specify.
To Graph Alarm Data
1. Select Tools -> Grapher to open the Graph dialog.2. Specify a name for your graph.3. Select options for Input, Plot, and Type.4. Click OK.
- The Grapher window opens, displaying the name of your graph.
5. Double-click the name of the graph to view it.See also Chapter 10 Graphing Collected Data."
5.10 Customizing the Alarms Window
The organization and format of the information displayed in Alarms can be customized according to your preferences. Most of the settings you can change are contained in the Alarm Summary Rules dialog, although many of the settings apply only when summary view is off.
You can save the customization settings to a file and load them at a later time. If you save properties when you exit Alarms, the settings you choose in the Alarm Summary Rules dialog are saved in the .em_alarmmgr_vp.cf configuration file in your home directory and used by default each time you start Alarms. If you run Solstice EM as root and save properties, the settings are saved in em_alarmmgr.vp.cf in the / (root) directory.
The settings you can customize in the Alarm Summary Rules dialog include:
- Show duplicate alarms
- Scroll to the newest alarms automatically
- Display object name as fully distinguished name or system name
- Apply alarm color to entire row or only the first column
- Display attribute name using default name or one you define
- Show or hide selected attributes
- Display column order
- Sort order
To Customize the Alarms Window Display
1. Click View -> Summary Rules to open the Alarm Summary Rules dialog.2. Make your selections for displaying the alarm attributes.3. Click OK.
To Specify Alarm Attributes to Display
1. Click View -> Summary Rules to open the Alarm Summary Rules dialog.2. In the Hidden Attributes list, select the attributes you want to display.
- You can select multiple attributes by pressing the Control key while you click, or select a range of attributes by pressing the Shift key while clicking the first and last attribute in the range.
3. Click Show to move the selected attributes to the Shown Attributes list.4. In the Shown Attributes list, select any attributes you do not want to display.
- You can select multiple attributes by pressing the Control key while you click, or select a range of attributes by pressing the Shift key while clicking the first and last attribute in the range.
5. Click Hide to move the selected attributes to the Hidden Attributes list.6. Select attributes in the Shown Attributes list and use the Move Up and Move Down buttons to place the attributes in the order in which you want the attribute columns displayed in the Alarms window.
- The attribute at the top of the list is displayed in the left most column and the attribute at the bottom of the list is displayed in the right most column.
7. Click OK.
To Change Attribute Labels
1. Click View -> Summary Rules to open the Alarm Summary Rules dialog.2. In the Display Attribute Names item, select User Defined Name.3. Click Label Names to open the Alarm Label Names dialog.4. In the User Defined column, select the row of the attribute you want to change.5. Type the name you want displayed for the selected attribute in the Alarms window.6. Click OK.
To Change the Alarm Sort Order
1. Click View -> Summary Rules to open the Alarm Summary Rules dialog.2. Click Sort Order, located between the attribute lists in the lower half of the dialog.
- The Sort Order dialog is displayed.
3. In the All Attributes list, select the attributes you want to use for sorting alarms.
- You can select multiple attributes by pressing the Control key while you click, or, select a range of attributes by pressing the Shift key while clicking the first and last attributes in the range.
4. Click Add to move the attributes to the Sort Order list.5. In the Sort Order list, select any attributes you do not want to use for sorting alarms.
- You can select multiple attributes by pressing the Control key while you click, or, select a range of attributes by pressing the Shift key while clicking the first and last attributes in the range.
6. Click Remove to move the attributes to the All Attributes list.7. Select attributes in the Sort Order list and use the Move Up and Move Down buttons to place the attributes in the order you want them used for sorting.
- For example, suppose you have chosen the attributes Received On, Severity, and From. If you want to sort by severity first, date received second, and object instance third, you must list the attributes in the order Severity, Received On, and From.
8. Click OK.5.11 Customizing the Tools Menu
The Tools menu enables you to start other tools from the Alarms window. You can add, modify, and remove names of Solstice EM tools on the Tools menu. By default, only Grapher and Alarm Deletion Controller are listed in the menu. You can add other tools that you might find useful to access from the Alarms window, such as Log Entries and Event Logs.
You can save the customization settings to a file and load them at a later time. If you save properties when you exit Alarms, the settings you make in the Customize Tools dialog are saved in the .em_alarmmgr_tp.cf configuration file in your home directory and used by default each time you start Alarms. If you run Alarms as root and save properties, the settings are saved in em_alarmmgr_tp.cf in the / (root) directory.
Note You cannot remove Grapher from the Tools menu.
To Add or Change a Tool on the Tools Menu
1. Click File -> Customize -> Tools Menu in the Alarms main window to open the Configure Tools Menu dialog.2. If you want to change an existing entry on the Tools menu, select the tool in the Applications list.3. In the Application Name field, type or edit the name you want to appear in the Tools menu.4. In the Absolute Path to Executable field, type or edit the complete path to the command used to start the application.
- For Event Logs, the default path is /opt/SUNWconn/em/bin/em_logmgr. For Log Entries, the default path is /opt/SUNWconn/em/bin/em_logview.
5. In the Arguments field, type the options you want to use with the command line.
- See the appropriate chapter for information on command line options for starting the tool.
6. Do one of the following:
- Click Add to add the tool to the list of applications on the Tools menu.
- Click Change to modify an existing entry.
7. Click OK.
To Remove a Tool From the Tools Menu
1. Click File > Customize -> Tools Menu in the Alarms main window to open the Configure Tools Menu dialog.2. In the Applications list, select the tool you want to remove.3. Click Delete.4. Click OK.5.12 Reference
This section provides technical reference information about command-line options for working with alarms.
For detailed information about dialogs, menus, and other user interface elements, refer to the Solstice EM Online Help. To access Online Help, Click the Help button on any dialog box or select options from the Help menu located in the upper right corner of each Solstice EM tool window.
5.12.1 The em_alarmmgr Command
The em_alarmmgr command starts the Alarms tool. Before using this command, you must set appropriate environment variables by running one of the environment scripts in /opt/SUNWconn/em/bin.
If you use the Bourne shell, type:
source /opt/SUNWconn/em/bin/emenv.sh
source /opt/SUNWconn/em/bin/emenv.csh
The em_alarmmgr command uses the following syntax:
- If you start Alarm Manager from the command line, and you are a non-root user, you are required to supply a password if password authentication is turned on.
Access to Alarms functions depends on the permissions granted to you through Security.
The optional parameters for the em_alarmmgr command are described in the following table.
TABLE 5-3 em_alarmmgr Command-Line Options -help Displays a list of options (with descriptions) for the em_alarmmgr command. -host hostname td> Host name of a remote MIS; you can also specify an IP address as the host name. -device device-name Device name for which you want to view alarms. For a host, the device name is the systemId name, such as platinum. The device name is the name you would use to ping a network node of any kind. -device_fdn device-fdn Fully distinguished name of the device, for example systemId=name:"zirconium"/agentTableType="CMIP "/agentId=id:"platinum" -refresh refresh-rate Screen refresh rate in milliseconds. -log MIS-name:log-name Log name, which must include the MIS name, for example silicon:AlarmLog. -file config-file Path to the .em_alarmmgr_fp.cf filter configuration file. -id MIS-name:toponodeId ID of the topology node, which must include the MIS name; for example, silicon:25. See Chapter 4 Viewing Network Components" for information about determining a device's topology node ID.
5.13 Configuration Files
The Alarms tool creates configuration files if you save properties when you exit the Alarms window. The table lists the configuration files and the names of the dialogs used to set the values within the files.
When the Alarms tool starts, it looks for the configuration files in your home directory, or in the / (root) directory if you use Solstice EM as root. If the files do not exist, the Alarms tool looks in the $EM_HOME/config directory. (The file names used in the config directory do not include an initial dot.) If the configuration files are not found in either location, the default properties are used.
Manual editing of these files (except the em_alarmmgr_i18n.cf file) is not recommended. You should use the Alarms dialogs to change the properties..
The information displayed in the alarms data table changes dynamically, and cannot be internationalized by the operating system localization facility. However, you can use the internationalization properties configuration file to explicitly define localized aliases for certain strings that might display in the table. The file contains the replacement strings for these items.
The i18n Properties Configuration file (.em_alarmmgr_i18n.cf) has the following format:
"major" "majeur""minor" "mineur""critical" "critique"Each line in the file consists of a pair of strings. For each pair, the first string is the string to be replaced, and the second string is the user-defined replacement. To define a replacement string, edit or add the appropriate pair in this file.
The characters in each line must begin at the left edge, and each statement must begin on a separate line.
Sun Microsystems, Inc. Copyright information. All rights reserved. |
Doc Set | Contents | Previous | Next | Index |