Alarm Detail Monitor

Use the Alarm Detail monitor to sort alarms, view an alarm in depth, and to assign a disposition to an alarm.

By clicking the Details icon, you can access the Alarm Detail monitor from any of the four alarm monitors available on the main page in Fault mode (Severity, Category, Current, or State). It is also available from the Current Active Monitors available from the Summary tab in Monitor mode.

This topic describes:

Finding Specific Alarms

Use the Alarm Detail monitor to locate a specific alarm, research the events causing the alarm, and to assign a disposition to the alarm. When an alarm is highlighted in the sorting sequence, the events contributing to the alarm are listed in Event Details and the variable settings are shown in Event Attribute Detail.

To locate an alarm and to assign a disposition to the alarm:

Sort the list using the Display list. Sorting choices vary depending on how you arrived here. View Sorting Alarms for details on sorting options.
Review the sorted list. Each entry shows a minimum of one to a maximum of nine fields. These fields are described in Table 1.
Examine the events and event attributes that contributed to sending the alarm. Events and event attributes are discussed in Reading Events and Investigating Event Attributes.

Table 1: Alarm Detail Fields
Field	Value	Shown in Detailed View by Default
Name	The alarm name.	Yes
ID	A system and sequentially-generated identification number.	No
Assigned To	If assigned to an individual, it shows the name of the person assigned; otherwise, it shows System to mark that the alarm is still unassigned.	Yes
Severity	The severity of the alarm. Severity levels are: Critical—A critical condition exists; immediate action is necessary. Major—A major error has occurred; escalate or notify as necessary. Minor—A minor error has occurred; notify or monitor the condition. Info—An informational message; no action is necessary. Warning—A message indicating a major error which can occur if necessary actions are not taken.	Yes
Acknowledged	Indicates if the alarm has been acknowledged.	Yes
Entity ID	The identification of the entity responsible for causing this alarm. The Entity ID is the key for correlation of events into an alarm. The Entity ID could be an IP address of the device.	Yes
Reporting Device IP	The IP address of the reporting device that generated the alarm.	Yes
Reporting Device Name	The hostname of the reporting device.	Yes
Creation Date	The date and time the alarm was first reported.	No
Last Updated	The date and time that the information for the alarm was last modified.	Yes
Updated By	Either the system or the last user who modified the alarm.	No

Note:

You can enter the alarm name, entity ID, or reporting device IP in the search field and press enter to perform searches and display only those searched alarms in the Alarm Detail table.

You can also use Searching Alarms in the Tasks pane to perform searches using multiple arguments. With multiple arguments, you can isolate a single alarm from a long alarm list. For more information, see Searching Alarms.

Sorting Alarms

Depending on the monitor you chose to access Alarm Detail, your sorting options change to reflect the summary monitor. The different sort options are listed in Table 2.

Table 2: Sort Options for Alarms
Alarms by Severity Sort	Alarms by Category Sort	Alarms by State and Current Active Alarms Sort
Info	BFD	Clear
Minor	BGP
Major	Chassis
Critical	ClientandUserSession
	Config
	CoS
	DHCP
	DOM
	FlowCollection
	GENERAL
	GenericEvent
	L2ALD
	L2CP
	MACFDB
	Misc.
	PassiveMonitoring
	Ping
	RMon
	SONET
	SONETAPS
	VirtualChassis
	VNetworkS

Reading Events

When you select an alarm in Alarm Detail, the Event Detail table updates with information about the events that are associated with the alarm. Table 3 lists the fields in Event Detail.

Table 3: Event Detail Fields
Field	Value
Name	The event name; also known as the SNMP trap name.
ID	A system-generated, hexadecimal code that uniquely identifies the event.
Description	If the event is an SNMP event, it is shown as a system-generated event.
Type	The type of event, either fault or system alert.
Category	The category of the event message. The category corresponds to the alarm categories shown in the Alarms by Category monitor and the Alarm Settings window. These categories are: General Chassis BFD Core Misc.
Source	The identification of the entity that is the cause of this event ; it is not necessarily the ID of the event that generated the event.
Originator	The identification of the entity that generated this event, for example, the switch IP address.
Time Updated	The date and time of the last update to the event.

Investigating Event Attributes

The Event Attribute Detail window reflects the variables set during the event. In SNMP terminology, these attributes are known as variable bindings or varbinds. These attributes can provide key information about triggers. For example, if a fan fails, the attribute field could indicate the location of the fan in the chassis.

Changing the Alarm State

When an alarm is first reported, it is considered an active alarm. To change the alarm state, to assign the alarm to a person, or simply to record notes about the alarm, use the buttons on Alarm Details. These buttons are:

Acknowledge—Use this button to acknowledge or record that the alarm is known and is being addressed.
Clear—Use this button to clear or remove the alarm. The clear state says that the issue sending the alarm has been resolved and no long requires attention.
Annotate—Use this button to record actions taken to resolve the alarm.
Assign—Use this button to assign active or acknowledged alarms to staff.

ON THIS PAGE