Viewing and Managing Alarms

In the Network Monitoring workspace, events refer to any changes detected in the network. Network Monitoring allows you configure an event as an alarm by adding the <alarm-data> element to the event in the event configuration file. There are two categories of alarms: acknowledged and outstanding.

Note:

An alarm that is cleared is removed from the Alarms page.

To search for and view information about alarms:

On the Junos Space Network Management Platform UI, select Network Monitoring > Alarms.

The Alarms page appears.
(Optional) To view detailed information about an alarm:
1. In the Alarm ID text box (in the Alarm Queries section), enter the ID for the alarm.
2. Click Get Details or press Enter.
  - If the alarm ID that you entered matches an existing alarm, the subsequent page displays information about the alarm. For more information, see Viewing Details of an Alarm and Acting on an Alarm.
  - If the alarm ID that you entered does not match an existing alarm, the subsequent page displays a message to this effect.
(Optional) To view the list of all outstanding alarms:
- Click the All alarms (summary) link (in the Alarm Queries section) to view a summarized list of alarms.
  
  The Alarms (List) page displays a summarized list of alarms in a table. For more information, see Viewing Alarms in Summary and Detailed Views.
- Click the All alarms (detail) link (in the Alarm Queries section) to view a detailed list of alarms.
  
  The Alarms (List) page displays a detailed list of alarms in a table. For more information, see Viewing Alarms in Summary and Detailed Views.
(Optional) To search for alarms by specifying one or more search criteria, click the Advanced Search link (in the alarm Queries section).

The Advanced Alarm Search page appears. For more information, see Searching for Alarms (Advanced Alarms Search).
(Optional) To view the list of Network Communication Services (NCS) alarms, click the NCS Alarm List link.

The Alarms (List) page appears with the search constraint componentType=”Service” applied. For more information, see Viewing NCS Alarms.
(Optional) If alarm filter favorites were previously created, you can perform the following tasks in the Alarm Filter Favorites section:

Note:
You can view and delete only the alarm filter favorites that you created.
- View the constraints that are part of a filter by mousing over the information icon corresponding to a filter.
  
  The constraints are displayed in a window.
- View the alarms that match a filter by clicking the filter name link.
  
  The alarms (List) page where the list of alarms is displayed in a table. For more information, see Viewing Alarms in Summary and Detailed Views.
- Delete an alarm filter favorite by clicking the X link corresponding to the filter.
  
  The favorite is deleted and a message indicating that the favorite is deleted is displayed.

This topic has the following sections:

Viewing Details of an Alarm and Acting on an Alarm

On the Alarm Alarm-ID page, the details of an alarm, as shown in Table 1, are displayed. You can perform the following tasks on an alarm:

Note:

The background color for the fields on this page is the same color as the severity level of the alarm.

Acknowledge the alarm—If an alarm has not been acknowledged, click the Acknowledge button (in the Acknowledgment and Severity Actions section) at the bottom of the page.

The alarm is acknowledged and the details of the acknowledgment are displayed, as indicated in Table 1.
Unacknowledge the alarm—If an alarm has been acknowledged but you want to unacknowledge it, click the Unacknowledge button (in the Acknowledgment and Severity Actions section) at the bottom of the page.

The alarm is unacknowledged and the details of the unacknowledgment are displayed, as indicated in Table 1.
Escalate the severity level of the alarm—Select Escalate this alarm from the list (in the Acknowledgment and Severity Actions section) at the bottom of the page and click Go.

The alarm’s severity level is escalated and the background color of the fields changes to match the severity level.
Clear the alarm—Select Clear this alarm from the list (in the Acknowledgment and Severity Actions section) at the bottom of the page and click Go.

The alarm’s severity level is set to Cleared and the background color of the fields changes to match this severity level. When an alarm is marked to be cleared, the system removes the alarm after some time after which it is no longer available on the Alarms page.

Table 1: Details of an Alarm
Field	Description
Severity	Severity level of the alarm For details of the alarm severity levels, click the Severity Legend link on the Alarms (List) page.
Node	Node on which the alarm occurred You can click the node name link to view details about the node. Click the (+) icon to view the alarms only for this node on the Alarms page. Click the (–) icon to remove the alarms for this node from the Alarms page. The appropriate search constraint is applied when you click the (+) or (–) icon. Click the (–) icon in the Search Constraints field (top-left corner of the page) to remove the search constraint.
Last Event	Date and time of the last event for which the alarm was raised You can click the `date and time` link to view the details of the event.
Interface	Interface on which the alarm occurred You can click the `Interface` link to view details about the interface.
First Event	Date and time of the first event for which the alarm was raised
Service	Service for which the alarm was raised You can click the `Service` link to view details about the service.
Count	Number of times that the alarm was raised
UEI	Unique event identifier (UEI) associated with the alarm
Ticket ID	If configured by the user, the ID of ticket in the third-party ticket-based tracking system
Ticket State	If configured by the user, the state of the ticket in the third-party ticket-based tracking system
Reduction Key	Reduction key for the event If an alarm was raised for a previous event with the same reduction key, then a new alarm is not generated; only the alarm count is incremented.
Log Message	Message that was logged for the event for which the alarm was raised
Acknowledged By	If the alarm was acknowledged or unacknowledged, the username of the user who acknowledged or unacknowledged the alarm is displayed Note: If a remote user has cleared, acknowledged, escalated, or unacknowledged an alarm, the detailed alarm view displays admin instead of the actual remote user in the Acknowledged By field.
Acknowledged Type	Indicates whether the alarm was acknowledged or unacknowledged
Time Acknowledged	Date and time when the alarm was acknowledged or unacknowledged
Description	Detailed description of the event for which the alarm was raised.
Related Events	Events received against the interface IP addresses for the generated alarms.
Alarm History	If the alarm count is greater than 1 and the alarms have the same UEI, the alarm history is displayed in a table with the following information for each alarm: Event ID—ID of the event associated with the alarm Alarm ID—ID of the alarm Creation Time—Date and time when the alarm was created Severity—Severity of the alarm Operation Time—Date and time when the operation occurred User—Username of the user who performed the operation Operation—Type of operation performed (Escalate, Acknowledge, or Clear)
Sticky Memo	If a sticky memo already exists, it is displayed in the text box. Below the text box, the author who created the memo, the date and time when the memo was last updated, and the date and time when the memo was created are displayed. To add or modify a sticky memo, enter the note in the text box and click Save. The sticky memo is saved. To delete a sticky memo, click Delete. The sticky memo is deleted. Note: A sticky memo is a user-defined note for a specific alarm; deleting an alarm also deletes the sticky memo.
Journal Memo	If a journal memo already exists, it is displayed in the text box. Below the text box, the author who created the memo, the date and time when the memo was last updated, and the date and time when the memo was created are displayed. To add or modify a journal memo, enter the note in the text box and click Save. The journal memo is saved and applied to all alarms that share the same resolved reduction key as the alarm for which the journal memo was created. To delete a journal memo, click Delete. The journal memo is deleted from all alarms that have the same resolved reduction key. Note: A journal memo is a user-defined note that is applicable to alarms that share the same resolved reduction key. Therefore, unlike in the case of a sticky memo, deleting an alarm does not delete the journal memo.
Operator Instructions	Instructions for the operator of the node on which the alarm occurred

Viewing Alarms in Summary and Detailed Views

By default, the Alarms (List) page displays the list of outstanding alarms in a table. However, depending on whether you used Advanced Search or applied a favorite filter, the list of alarms displayed might be different. For each alarm, the information shown in Table 2 is displayed.

You can filter and sort the list of alarms displayed based on various criteria:

(Optional) To apply an existing favorite alarm filter, select the name of the filter from the Filter Name list.
The alarms are displayed based on the filter that you applied.
(Optional) If you applied a favorite alarm filter, you can remove it by clicking the Remove Filter button.
All outstanding alarms are displayed on the Alarms (List) page.
(Optional) To search for alarms:
Note:
You must specify one of the search criteria.
1. Enter the text (non-case-sensitive) in the Alarm Text field to search for alarms based on the text in the alarm log message.
2. From the Time list, select the period for which you want to view the alarms.
3. Click Search.
  The outstanding alarms that match the search criteria are displayed. The search criteria is displayed in the Search constraints field.
(Optional) To view a specified number of alarms per page, select the required number from the list next to the Results field.
By default, the number of alarms listed on the View Alarms page is 20. You can select the number of alarms you want to view per page from the Show list. You can choose to view 10, 20, 50, 100, 250, 500, or 1000 alarms.

Note:
The number of alarms selected is set as user preference and the selected number of alarms are listed beginning from the next login.
(Optional) To sort the alarms displayed:
- In descending order, click the column name link in the table once.
- In ascending order, click the column name link in the table twice.
The alarms are sorted based on the column that you clicked.
(Optional) To filter alarms based on different constraints:
- To filter alarms on the basis of UEI, severity, node, interface, or service, click the plus (+) icon to view alarms only for the corresponding parameter or click the minus (–) icon to exclude alarms for the corresponding parameter.
- To filter alarms on the basis of the date and time when the first event or last event for which the alarm was raised occurred, click the back arrow icon to view alarms that occurred after the corresponding date and time or click the forward arrow icon to view alarms that began before the corresponding date and time.
- To filter alarms on the basis of the node from which they are triggered, click the (+) icon in the Node column. The Alarms page is filtered accordingly.
  
  Click the (–) icon to remove the alarms from a node on the Alarms page.
The alarms in the table are displayed based on the constraints that you applied. In addition, the constraints that you applied are displayed in the Search constraints field.
(Optional) You can remove existing search constraints by clicking the minus (–) icon corresponding to a constraint in the Search Constraints field.
Note:
The Alarms(s) outstanding constraint is applied by default and cannot be removed. You can toggle this constraint with the Alarm(s) acknowledged constraint, which displays the list of acknowledged alarms, by clicking the minus (–) icon.
(Optional) To save a filter as a favorite:
Note:
You can save a filter as a favorite only if the filter contains search constraints other than Alarm(s) outstanding or Alarm(s) acknowledged.
1. Click the Save Filter button in the Search Constraints field.
  A window is displayed instructing you to enter the name of the favorite filter.
2. Enter a unique name (up to 30 alphanumeric characters except %, &, or #) for the filter in the text box.
3. Click OK.
  - If an existing favorite filter has the same name, a warning message is displayed on the Alarms (List) page. You must enter a unique name to save the filter.
  - If the filter name that you specified is unique, the filter is saved and the Alarms (List) page appears. The Filter Names list displays the name of the filter.
    
    Note:
    Previously saved alarm filter favorites are accessible from the Alarm Filter Favorites section of the Alarms page.
(Optional) To view all outstanding alarms, click the View all alarms link at the top of the page.
The Alarms (List) page displays the outstanding alarms.
(Optional) To search for alarms based on multiple criteria, click the Advanced Search link at the top of the page.
The Advanced Alarm Search page appears. For more information, see Searching for Alarms (Advanced Alarms Search)
(Optional) To toggle between the summary and detailed views on the Alarms (List) page:
- Click the Long Listing link to view the detailed view.
- Click the Short Listing link to view the summary view.
(Optional) To view the alarm severity levels, their color-coding, and explanation, click the Severity Legend link at the top of the page.
The severity levels are displayed in a pop-up window. Click the Close (x) button to close the window.
(Optional) To acknowledge, unacknowledge, clear, or escalate one or more alarms:
1. Select one or more alarms by selecting the check box corresponding to the alarm.
  Note:
  You can select all alarms on the page by clicking the Select All button or clear the check boxes by clicking the Reset button; both buttons appear at the bottom of the page.
2. To perform an action on the alarms selected:
  1. Do one of the following:
    - To acknowledge alarms, select Acknowledge Alarms from the list at the bottom of the page.
      
      Note:
      This option is visible on the list only if one of the search constraints is Alarm(s) outstanding.
    - To unacknowledge alarms, select Unacknowledge Alarms from the list at the bottom of the page.
      
      Note:
      This option is visible on the list only if one of the search constraints is Alarm(s) acknowledged.
    - To clear alarms, select Clear Alarms from the list.
    - To escalate alarms by one severity level, select Escalate Alarms from the list.
  2. Click the Go button.
    
    The action that you selected is performed.
To acknowledge the entire list of outstanding alarms, click the Acknowledge entire search link.
The alarms are processed in a batch and the Acknowledged By, Acknowledged Type, Time Acknowledged fields are updated for each alarm.

Note:
This link is displayed only when outstanding alarms are displayed.

Note:

If the list of alarms displayed runs across multiple pages, you can use the navigation links in the Results field near the top of the page to view the events.

Table 2: Fields Displayed on the Alarms (List) Page
Field	Description	Displayed In
Ack	Check box to select an alarm or clear a previously selected alarm When you select an alarm using the Ack check box, the possible actions are acknowledging, clearing, or escalating the alarm. Note: This check box is displayed when outstanding alarms are displayed on the Alarms (List) page.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Unack	Check box to select an alarm or clear a previously selected alarm When you select an alarm using the Ack check box, the possible actions are acknowledging, clearing, or escalating the alarm. Note: This check box is displayed when previously acknowledged alarms are displayed on the Alarms (List) page.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
ID	Alarm ID You can click the `ID` link to view details of the alarm.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Severity	Severity level of the alarm Note: The severity level of the alarm is displayed on a colored bar in the row. For information about the color-coding, click the Severity Legend link at the top of the page.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
UEI	Note: Only the UEI label is displayed on this page with options to filter based on the UEI.	Alarms (List) page (Long Listing)
Sticky Memo (Icon)	If a sticky memo exists for an alarm, an icon is displayed in the ID column. Mouse over the icon to view the memo.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Journal Memo (Icon)	If a journal memo exists for an alarm, an icon is displayed in the ID column. Mouse over the icon to view the memo.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Node	Node on which the alarm occurred You can click the node name link to view details about the node.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Interface	Interface on which the alarm occurred You can click the interface link to view details about the interface.	Alarms (List) page (Long Listing)
Service	Service for which the alarm was raised You can click the `Service` link to view details about the service.	Alarms (List) page (Long Listing)
Count	Number of times that the alarm was raised You can click the count link to view the list of events for which the alarm was raised.	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Last Event Time	Date and time of the last event for which the alarm was raised You can click the `date and time` link to view the details of the event.	Alarms (List) page (Short Listing)
First Event Time	Date and time of the first event for which the alarm was raised	Alarms (List) page (Long Listing)
Acknowledged By	If the alarm was acknowledged or unacknowledged, the username of the user who acknowledged or unacknowledged the alarm is displayed.	Alarms (List) page (Long Listing)
Description	Detailed description of the alarm	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)
Log Message	Message that was logged for the alarm	Alarms (List) page (Short Listing) Alarms (List) page (Long Listing)

Viewing NCS Alarms

The Alarms (List) page with the search constraint componentType=”Service” applied displays the list of NCS alarms in a table, as shown in Table 3. For more information about the actions that you can take on this page, see Viewing Alarms in Summary and Detailed Views.

Table 3: Fields in the NCS Alarms (List) Page
Field	Description
Ack	Refer to Table 2 for an explanation of this field.
Unack	Refer to Table 2 for an explanation of this field.
ID	Refer to Table 2 for an explanation of this field.
Severity	Refer to Table 2 for an explanation of this field.
Component Type	Type of component affected by the event (service, service element, or service element component)
Component Name	Name of the service for which the NCS alarm was raised
Related	Related services or component names (for example, VPN or Connectivity Fault Management Maintenance Endpoint [CFM-MEP]) impacted due to the event
Cause	Details of the event for which the NCS alarm was raised
Node	Refer to Table 2 for an explanation of this field
Last Event Time	Refer to Table 2 for an explanation of this field
Log Message	Refer to Table 2 for an explanation of this field

Searching for Alarms (Advanced Alarms Search)

On the Advanced Alarm Search page, you can search for alarms using several criteria.

To search for alarms:

(Optional) In the Alarm Text Contains field, enter the text (partial or full) that you want to search for.
The text that you entered is matched against the Log Message field of the alarm.
(Optional) In the TCP/IP Address Like field, enter the interface IP address in the *.*.*.* format for IPv4 addresses and *:*:*:*:*:*:*:* for IPv6 addresses.
(Optional) In the Node Label Contains field, enter the name of the node (partial or full).
(Optional) Specify the severity of the alarm using the Severity list.
(Optional) Select the service for which the alarm was raised from the Service list.
(Optional) To search for alarms for which the first event occurred after a specified date and time, specify the date and time in the Alarm First Event After field.
Note:
If you want to search for alarms within a certain date and time range, you can use a combination of the Alarm First Event After, Alarm First Event Before, Alarm Last Event After, and Alarm Last Event Before fields.
(Optional) To search for alarms for which the first event occurred before a specified date and time, specify the date and time in the Alarm First Event Before field.
(Optional) To search for alarms for which the last event occurred after a specified date and time, specify the date and time in the Alarm Last Event After field.
(Optional) To search for alarms for which the last event occurred before a specified date and time, specify the date and time in the Alarm Last Event Before field.
(Optional) Specify a sorting order for the search results using the Sort By list.
By default, search results are sorted in descending order of alarm ID.
(Optional) Specify the number of alarms to display per page using the Number of Alarms Per Page list.
Click Search or press Enter when your cursor is inside one of the text boxes.
The Alarms (List) page appears displaying the alarms that match your search parameters are displayed. For more information, see Viewing Alarms in Summary and Detailed Views

ON THIS PAGE

Viewing and Managing Alarms

Viewing Details of an Alarm and Acting on an Alarm

Viewing Alarms in Summary and Detailed Views

Viewing NCS Alarms

Searching for Alarms (Advanced Alarms Search)

Related Documentation