Events - Cisco User Guide for Cisco Unified Operations Manager 8.6 OL-26364-01 APPENDIX E Events...

User GuiOL-26364-01

A
P P E N D I X E Events Processed
This section covers the following topics:

• Event Information, page E-1

• Supported Events, page E-3

• Renamed Events, page E-72

• Suppressing or Unsuppressing Events, page E-73

• Understanding Event Flooding Control, page E-76

• Customizing Events, page E-77

• Activating Events in Operations Manager, page E-82

Event InformationCisco Prime UOM is now configured as a Cisco Unified Communications Manager (Unified CM) remote syslog receiver for Cisco CallManager (referred to in later releases as Unified Communications Manager), Call Detail Records (CDRs), Disaster Recovery Framework (DRF), and AONS Management Console (AMC) services.

Table E-2 lists all possible events in Cisco Prime UOM. The following are the some of the details associated with the events:

• Description —A summary of the event, including typical causes (if known).

• Default Polling Interval—How often this data will be monitored.

• Default Threshold—The set place or point at which monitoring will begin.

• Trigger—How Cisco Prime UOM learns of the event: from normal polling, RTMT, a syslog that was received, a threshold that was exceeded, a diagnostic test result, a trap that was received, or an event received from Windows Event Manager. For a list of thresholds and events that they trigger, see Table 19-16.

• Severity —The severity that Cisco Prime UOM assigns to the event: critical, warning, or informational. For details on how Cisco Prime UOM maps Unified CM syslog-based events, see Syslog-Based Event Mapping, page E-2.

• Device Type —The devices, as classified in Cisco Prime UOM, on which the event can occur.

E-1de for Cisco Unified Operations Manager 8.6

Appendix E Events Processed Event Information

• Clear Interval—The interval at which Cisco Prime UOM clears the event from the Event Detail View. Some syslog-based events have a predetermined clear interval. Upon reaching the expiry of the clear interval, Operations Manager moves the events from Active to Cleared. (For more information, see Accessing the Events Details Page, page 4-23.)

• Event Code —The code used by Notifications to track changes to default Cisco Prime UOM event names using the event customization feature. (For more information, see Appendix E, “Customizing Events”.)

• Recommended Action—An action or actions to take to resolve the problem which caused the event to be displayed.

Some events are renamed. See Table E-3 on page E-72 for a list.

Events listed in Table E-2 are displayed on:

• Diagnostics portlets

• The Events page—Shows all the event for the selected device.

• Fault Monitor—Shows events generated as a result of traps received from Service Monitor. The Service Quality Issue event causes activity to be displayed on the Service Quality Events module.

Note The SensorDown event is also generated as a result of traps received from Service Monitor. However, SensorDown appears under Unidentified Trap in Fault Monitor under Unmanaged Devices.

Syslog-Based Event MappingCisco Prime UOM maps syslog-based events from Unified CM according to version. For 8.0 and above, new severity levels include critical, alert, and notice. Table E-1 describes the mapping from Unified CM events to Cisco Prime UOM event displays.

Table E-1 Event Severity Mapping

Unified CM Event Level Cisco Prime UOM Severity Level

Critical, Error, and Alert Critical

Informational and Notice Used to process the In Service notifications which are used to clear the events in Cisco Prime UOM after a fault is rectified.

E-2User Guide for Cisco Unified Operations Manager 8.6

OL-26364-01

Appendix E Events Processed Supported Events

Supported EventsTable E-2 lists the events supported by Cisco Prime UOM.

• When Cisco Prime UOM displays event information in event displays, Fault History reports, and notifications, it replaces a single quote with a space.

Table E-2 Events that Cisco Prime UOM Supports

Event Description, Cause, Severity and Event Code

Authentication Failed Description: Occurs when there is authentication failure in a login attempt. This event is generated by monitoring the syslog messages received from Unified Communications Manager.

Trigger: Syslog.

Severity: Warning.

Device Type: Unified Communications Manager version 6.x or later.

Clear Interval: Time-based auto-clear in Event Promulgation Module (EPM) after 30 minutes.

Event Code: 7006.

Recommended Action: Check for gateway port unavailability or an out-of-service issue. Check security logs for further details.

AutoFailbackFailed Description: The automatic failback has failed. The possible reasons for the failure include: loss of network connectivity between servers or the original primary server is not ready or inactive.

Trigger: RTMT Syslog.

Severity: Warning.

Device Type: Unity Connection.

Clear Interval: Cleared if Auto Failback or Manual Failback happens successfully and the respective syslog (AutoFailBackSucceeded or ManualFailBackSucceeded ) is emitted from the Publisher Unity Connection in the cluster. Otherwise, the event is autocleared in a day.

Event Code: 7034.

Recommended Action: Check connectivity between servers (primary and secondary). If secondary server is active, check if all critical services are up in primary server to make failover happen. Until then, the system may not be able to provide all services. If the failback was not desirable, change the system settings to disable the automatic failback.


OL-26364-01


AutoFailbackSucceeded Description: The automatic failback was successful. The automatic failback is only attempted if the failover was caused by the reboot of the primary server.

Trigger: Syslog.

Severity: Informational.


Clear Interval: Auto cleared in one hour.

Event Code: 7033.

Recommended Action: None.

AutoFailoverFailed Description: The automatic failover has failed due to one of the following reasons: a loss of network connectivity between servers or the secondary server is not ready or inactive.


Severity: Critical.


Clear Interval: Cleared if Auto Failover or Manual Failover happens successfully and the respective syslog (AutoFailOverSucceeded or ManualFailOverSucceeded) is emitted from the Subscriber Unity Connection in the cluster. Otherwise, the event is autocleared in a day.

Event Code: 7025.

Recommended Action: Check connectivity between servers (primary and secondary). If secondary server is active, check if all critical services are up in primary server to make failover happen. Until then, the system may not be able to provide all services.

AutoFailoverSucceeded Description: The automatic failover was successful. The possible reasons for the failover include: loss of network connectivity to the primary server or critical service down on the primary server.

Trigger: Syslog.

Severity: Warning.


Clear Interval: Auto cleared in one hour.

Event Code: 7032.

Recommended Action: Perform the corrective action within 30 days to mitigate the problem that caused the failover.

Table E-2 Events that Cisco Prime UOM Supports (continued)

Event Description, Cause, Severity and Event Code (continued)


OL-26364-01


AverageLatency_ThresholdExceeded Description: There is a violation in the latency threshold for a node-to-node UDP Jitter for a VoIP test that the user has configured. This will result in poor voice quality.

Trigger: Node-to-node test initiated polling.

Severity: Warning.

Device Type: Router or Switch.

Event Code: 4004.

Recommended Action: Check the connectivity between the source and destination with which the test was configured. Check QoS settings that may impact latency in the intermediate routers. This may be a result of a heavy load or crash on a node in the path.

CCMEDown Description: Indicates that the telephony configuration is disabled on the Cisco Communications Manager Express (now referred to as Unified Communications Manager Express or UCM Express). In this case, no SCCP-based calls go though the UCM Express.

Trigger: Polling.

Severity: Critical.

Device Type: UCM Express.

Event Code: 2038.

Recommended Action: Check the telephony configuration on the UCM Express.

CCMEEphoneDeceased Description: The state of an ephone registered to UCM Express changed to deceased.

Trigger: Processed trap (see Processed SNMP Traps, page C-1).

Severity: Warning.


Event Code: 2076.

Recommended Action: Check the connectivity between phone, access switch, and UCM Express-hosted router.

CCMEEphoneLoginFailed Description: Login through the web or TAPI to the UCM Express failed.


Severity: Warning.


Event Code: 2078.

Recommended Action: Check and validate why the login was rejected or failed.




OL-26364-01


CCMEEphoneRegistrationFailed Description: An ephone attempt to register with Cisco UCM Express failed.


Severity: Warning.


Event Code: 2077.

Recommended Action: For SCCP phones:

Use the show ephone command to display the status of SCCP phones that are not registered or are trying to register.

For SIP phones:

Use the show voice register all command to display configuration and registration information for SIP phones in UCM Express.

Typically, an individual Cisco Unified IP Phone fails to successfully complete registration for any of the following reasons:

• The configuration file for this IP phone is incorrect or empty.

• The IP phone cannot download its configuration file.

• Auto-register is disabled and an individual phone is not explicitly configured.

• Auto-assign is enabled and there are more IP phones than there are available telephone or extension numbers.

• The appropriate Cisco IP Phone firmware is not or cannot be installed on this IP phone.




OL-26364-01


CCMEEphoneUnregistrationsExceeded Description: Number of ephones unregistered to UCM Express was exceeded.


Default Threshold: NA.

Severity: Critical.


Event Code: 2075.

Recommended Action: You may have to check the connectivity between phone, switch, and UCM Express.

If this is a newly installed and configured UCM Express and all of the phones fail to register, the configuration is incorrect or unavailable. If all IP phones have lost their registration, the network interface is the most likely source of the failure.

All Cisco Unified IP phones of a particular type can fail to register for one of the following reasons:

• The wrong or incorrect Cisco phone firmware filename is specified for a particular phone type.

• The phones cannot download the correct Cisco phone firmware file from the TFTP server.

• Auto-assign for a specified phone type is enabled and there are more phones of that type than there are available telephone or extension numbers.

• Check if the unregistered threshold configured on the UCM Express is large enough. If not, increase the threshold.

• Check if any instances of the UCM Express are redundant.

CCMEKeyEphoneRegistrationChange Description: Registration status changed for a key IP ephone with respect to UCM Express.


Severity: Warning.


Event Code: 2080.

Recommended Action: Check if the indicated key IP ephone is unregistered and investigate the root causes.




OL-26364-01


CCMELivefeedMOHFailed Description: Music on hold (MOH) live feed failed on UCM Express.


Severity: Warning.


Event Code: 2074.

Recommended Action: You may need to check if the live-feed source is shut down or broken for any reason. Check the MOH configurations on the UCM Express. Check the port to which the MOH feed is connected.

CCMEMaximumConferencesExceeded Description: Maximum number of simultaneous three-party conferences supported was exceeded on UCM Express.



Severity: Warning.


Event Code: 2073.

Recommended Action: The maximum number of simultaneous conferences is platform-specific to the type of UCM Express router. Try adjusting the configuration based on the support limit.

CCMENightServiceChange Description: Night service status change UCM Express.



Severity: Critical.


Event Code: 2079.

Recommended Action: You may need to check the event description for the appropriate reason. Run show running-config to verify the night-service parameters. Ensure that any changes are authorized changes.

CCMEStatusChange Description: Cisco UCM Express enabled state has changed.


Severity: Warning.


Event Code: 2072.

Recommended Action: Check if UCM Express is enabled on the device and if the status change is expected.




OL-26364-01


CDR Agent Send File Failed

Supports Unified Communications Manager version 5.x or later in Syslog/RTMT.

Description: The CDR Agent cannot send CDR files from a Unified Communications Manager node to the CDR Repository node within the Communications Manager cluster.

Trigger: Syslog.

Severity: Critical.

Device Type: Cisco Unified Communications Manager.

Clear Interval: Time-based auto-clear in EPM after 60 minutes.

Event Code: 7010.

Recommended Action: Do the following:

1. Check network link status.

2. Verify that the CDR Repository node (first node in the cluster) is running.

3. Verify that the CDR Repository Manager is activated on the first node.

4. Check the CDR configuration using Serviceability > Tools.

5. Check the CDR agent trace on the specific node where the error occurred.

6. Check the CDR Repository Manager trace.

7. Check to determine whether the Publisher is being upgraded. If the CDRAgentSendFileFailureContinues event is no longer present, the condition is corrected.

Cisco DRF Failure

Supported for UCM 5.x and later.

Description: The DRF backup or restore process has encountered errors.

Trigger: Syslog.

Severity: Critical.

Device Type: Unified Communications Manager.

Clear Interval: Time-based auto-clear in EPM after 4 days.

Event Code: 7007.

Recommended Action: Verify that /common/drf has the required permission and enough disk space for the DRF user. Check the application logs for further details.




OL-26364-01


CDR File Delivery Failed


Description: The FTP delivery of CDR files to the outside billing server failed.

Trigger: Syslog.

Severity: Warning.



Event Code: 7011.

Recommended Action: Perform the following checks:


2. Verify that the billing server is running.

3. Verify that the SFTP Server on the billing server is running and accepting requests.

4. Verify that the CDR configuration is correct, under Serviceability > Tools.

5. Check the CDR Repository Manager trace.

CDR High Water Mark Exceeded

Supports Unified Communications Manager version 5.1.3 or later in Syslog/RTMT.

Description: The high water mark for CDR files has been reached, and some successfully delivered CDR files have been deleted.

Trigger: Syslog.

Severity: Warning.


Clear Interval: Time-based auto-clear after 30 minutes.

Event Code: 7014.


1. Check for too many undelivered CDR files accumulated due to some condition.


3. Verify that the billing server is operational.


5. Verify that the CDRM Configuration for billing servers is correct using Serviceability > Tools.

6. Check to determine if CDR files maximum disk allocation is too low using Serviceability > Tools.

7. Check the CDR Repository Manager trace in /var/log/active/cm/trace/cdrrep/log4j.




OL-26364-01


CDR Maximum Disk Space Exceeded


Description: The CDR files disk usage exceeded the maximum allocation. Some undelivered files have been deleted.

The CDR files disk usage has exceeded the maximum disk allocation. Some undelivered files have been deleted.

Trigger: Syslog.

Severity: Critical.



Event Code: 7008.


1. Check for too many undelivered CDR files accumulated due to some condition.


3. Verify that the billing server is operational.


5. Verify that the CDRM Configuration for billing servers is correct using Serviceability > Tools.

6. Check to determine if CDR files maximum disk allocation is too low using Serviceability > Tools.

7. Check the CDR Repository Manager trace in /var/log/active/cm/trace/cdrrep/log4j.




OL-26364-01


Code Red Description: Indicates that Cisco Unified Communications Manager has remained in a Code Yellow state for an extended period and cannot recover.

This event is generated by monitoring the syslog messages received from Unified Communications Manager.

Trigger: Syslog.

Severity: Critical.


Clear Interval: Time-based auto-clear in Event Promulgation Module (EPM) after 4 days.

Event Code: 2048.

Recommended Action: When Cisco Unified Communications Manager enters a Code Red state, the Communications Manager service restarts, which also produces a memory dump that may be helpful for analyzing the failure.

Generally, repeated call throttling events require assistance from your support team. Cisco Communications Manager SDI and SDL trace files record call-throttling events and can provide useful information. Your support team may request these trace files for closer examination.




OL-26364-01


Code Yellow Description: This event is generated when Communications Manager has entered a Code Yellow state (call throttling) due to an unacceptably high delay in handling incoming calls.


Trigger: Syslog.

Severity: Critical.


Clear Interval: Clears based on CodeYellowExit or CodeRedEntry syslog.

Event Code: 2049.

Recommended Action: While this event generates, check process CPU usage and memory usage. Check for call bursts and an increased number of registered devices (phones, gateways, and so on) generated.

Continuously monitor to see if Communications Manager is out of the Code Yellow state. You can launch synthetic tests such as the Dial Tone Test to check for any impact on call processing.

To try to circumvent the possibility of a Code Yellow event, consider the possible causes of a system overload, such as heavy call activity, low CPU availability to Cisco Unified Communications Manager, routing loops, disk I/O limitations, disk fragmentation, and so on, and investigate those possibilities.

For more information, go to the following URL:

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/5_1_3/ccmfeat/fsclthrt.html.




OL-26364-01

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/5_1_3/ccmfeat/fsclthrt.html

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/5_1_3/ccmfeat/fsclthrt.html


ComponentDown Description: A component within Cisco Unified Contact Center (what used to be referred to as IPCC) is down. There are different Contact Center components: Router, Logger, CG, and Distributor. Each individual component is affected differently:

• Router down—Call Center call routing will be impacted.

• Logger down—Copying configuration to Administrative workstation will be impacted.

• CG down—Computer Telephony Integration (CTI) Gateway down would impact CTI integration with agent desktop and contact center servers.

• Distributor down—Contact Center administration through web view is impacted.

Trigger: Polling.

Severity: Critical.

Device Type: Unified Contact Center Enterprise.

Event Code: 2039.

Recommended Action:

1. Check the component name and check the corresponding service status on the Contact Center device. Try starting the service if it is stopped.

2. If the service does not start, contact your Contact Center support team.

Core Dump File Found


Description: A core dump file has been found in the system, which indicates a service crash.


Severity: Critical.



Event Code: 7009.

Recommended Action:

1. Use RTMT Trace and Log Central to collect the new core files and the last trace log files from the corresponding service. Run gdb to get the back trace of each core file for further debugging.

2. From the Communications Manager Service Control page, you can verify whether the service was restarted successfully. If not, start it manually.




OL-26364-01


CPALoginFailureThresholdExceeded Description: The attempts to log in to the web interface of the Cisco Personal Assistant (CPA) exceeds the threshold value.

Trigger: Polling.

Severity: Critical.

Device Type: Cisco Personal Assistant.

Event Code: 2086.

Recommended Action: Check the login access by trying to connect to Cisco Personal Assistant server.

CPATransferFailedThresholdExceeded Description: Cisco Personal Assistant fails to transfer the call after threshold number of attempts.

Trigger: Polling.

Severity: Critical.


Event Code: 2087.

Recommended Action: Check to see if the call transfer service is up and running.

CPAVoicemailThresholdExceeded Description: Attempts to log in to voicemail exceed the threshold value.

Trigger: Polling.

Severity: Critical.


Event Code: 2088.

Recommended Action: Check the login access by trying to connect to Cisco Personal Assistant server.




OL-26364-01


CPUPegging Description: The percentage of CPU load on a server is over the configured threshold.

Trigger: RTMT Polling.

Severity: Critical.


Event Code: 1013, 2126.

Recommended Action: Check the Communications Manager Windows Task Manager or Real Time Monitoring Tool (RTMT) to verify CPU high utilization.

The most common reason is that one or more processes are using excessive CPU space. The event has information on which process is using the most CPU. After the process is identified, you may want to take action, which could include restarting the process.

You can also check the trace setting for that process. Using detailed trace level can take up excessive CPU space.

Also check for events such as Code Yellow, and launch Cisco Prime UOM synthetic tests such as Dial Tone Test to see if there is any impact on call processing.

If so, you may want to take more drastic measures, such as stopping nonessential services.

For more details, go to the following links: http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00808ef0f4.shtml and http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00807f32e9.shtml.

For a video tutorial on troubleshooting the CPUPegging event, click on the E-Learning button in the online help.

CPUUtilizationExceeded Description: CPU utilization of individual voice services (Unity/CPA) or the whole system exceeds the threshold value.

TriggerRTMT Polling.

Severity: Warning.

Device Type: Unity, Cisco Personal Assistant.

Event Code: 2085.

Recommended Action: Identify the services and applications that are taking too much CPU and stop them.

Events are removed for Communications Manager only. You may need to manually clear these Communications Manager events after your upgrade is complete.




OL-26364-01

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00808ef0f4.shtml

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00808ef0f4.shtml

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00807f32e9.shtml

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00807f32e9.shtml


CTILinkDown Description: Communications Manager performance counter CcmLinkActive indicates that the total number of active links from CTI Manager to all active Cisco Unified Communications Managers in the cluster is zero.

This event indicates that CTI Manager has lost communication with all Communications Managers in the cluster.

Trigger: Polling.

Severity: Critical.


Event Code: 2096.

Recommended Action: CTI Manager maintains links to all active Communications Managers in the cluster. Investigate to determine the following:

• Is the CTI Manager service running?

• Is Communications Manager in the cluster running?

• Does a network problem exist between the CTI Manager and Communications Managers in the cluster?

ctpPeripheralCableError Description: Cisco Telepresence System (CTS) peripheral has a cable error problem. cableError indicates that a peripheral which requires a HDMI cable connection is not connected. Some possible reasons for this error include:

• The projector rs232 serial cable is not plugged into the port 1 of the ACU.

• The camera cable is loose or unplugged.

Default Polling Interval: 240 seconds.

Default Threshold: N/A.

Trigger: Polling or processed trap.

Severity: Critical.

Device Type: TelePresence.

Event Code: 2134.

Recommended Action: Check cable connectivity; the cable for this peripheral is either loose or unplugged.




OL-26364-01


ctpPeripheralConfigError Description: The expected peripheral device has a communications management system configuration issue or is connected, but not configured.




Severity: Warning.


Event Code: 2137.

Recommended Action: Peripheral is not configured properly in Cisco Unified Communications Manager. Check Communications Manager configuration.

ctpPeripheralDeviceError Description: This error is generated because of one of the following reasons:

• The phone cannot be reached using the CURL command or the phone load is lower than 8.2.2.

• The camera cannot be reached using the telnet command or the camera clock is bad.

• The main display's serial number and ID cannot be obtained using belSil command.

• The projector bulb is blown or the bulb life has exceeded 2,000 hours.




Severity: Warning.


Event Code: 2138.

Recommended Action: N/A.




OL-26364-01


ctpPeripheralInError Description: Raised when a ctpPeripheralErrorNotification trap is sent indicating a CTS peripheral error due to one of the following reasons:

• The TelePresence device is not managed in Cisco Prime UOM.

• The CTS component is not discovered in Cisco Prime UOM.

Default Polling Interval: N/A.


Trigger: Processed trap.

Severity: Critical.


Event Code: 2139.


ctpPeripheralLinkError Description: This error is generated because of one of the following reasons:

• A peripheral which requires an Ethernet connection is not connected.

• The expected peripheral device has a port level link issue. A possible cause may be that the TS_LEFT or TS_RIGHT codec cannot be reached using SSH.




Severity: Critical.


Event Code: 2136.

Recommended Action: Check if IP Connectivity is set properly and that the peripheral can be accessed using ICMP ping.

ctpPeripheralPowerError Description: The expected peripheral device has a power issue.




Severity: Critical.


Event Code: 2135.

Recommended Action: Check that the power cable is connected properly and the power switch in ON position.




OL-26364-01


ctpPeripheralSystemError Description: Telepresence system error.




Severity: Critical.


Event Code: 2140.


CUEApplicationStatusChange Description: An application on Cisco Unity Express has come online or gone offline.


Severity: Warning.

Device Type: Unity Express.

Event Code: 2063.

Recommended Action: Check the status of the reported application. Investigate the root cause if it is offline.

CUEBackupFailed Description: Cisco Unity Express voicemail backup failed.


Severity: Critical.


Event Code: 2068.

Recommended Action:

1. Verify IP connectivity between the Microsoft FTP Server and the Cisco Unity Express.

2. Verify that the Microsoft Windows user account has the appropriate read and write access to the Microsoft FTP Server site directory.

3. Verify that the FTP Publishing Service is started on the Microsoft FTP Server.

4. View the history.log file on the Microsoft FTP Server to determine why the FTP transfer failed.

For more details, go to the following link: http://www.cisco.com/en/US/docs/voice_ip_comm/unity_exp/design/CP_CIPExpress/cipce19.html#wp1015702.




OL-26364-01

http://www.cisco.com/en/US/docs/voice_ip_comm/unity_exp/design/CP_CIPExpress/cipce19.html#wp1015702

http://www.cisco.com/en/US/docs/voice_ip_comm/unity_exp/design/CP_CIPExpress/cipce19.html#wp1015702


CUECallAgentConnectionLost Description: Connection to the Communications Manager is lost. Communications Manager is integrated with Unity Express through JTAPI for voicemail and auto-attendant functionality.

If a connection to the Communications Manager is lost, playing a greeting, leaving a message, or interacting with the system through dual tone multifrequency (DTMF) tones may be impacted.


Severity: Critical.


Event Code: 2066.

Recommended Action:

1. From the Unity Express module, run show ccn status ccm-manager.

2. Verify IP connectivity between the Communications Manager and the Unity Express.

3. If IP reachability is working, check CTI Route Point and JTAPI configuration.

CUENTPIssue Description: Cisco Unity Express clock is managed entirely by NTP. If NTP has an issue, many Unity Express features, such as voicemail envelope information and trace logging are affected.


Severity: Warning.


Event Code: 2069.

Recommended Action: Many of the Cisco Unity Express features depend on a reliable clock.

You can verify the status of NTP and the location of the clock source with the show NTP status CLI command. Run trace NTP to debug NTP synchronization issues.

CUEResourceExhausted Description: Notification indicates that the Unity Express has run out of a certain type of resource. For example, when all JTAPI or SIP ports are in used and new incoming calls cannot be made, this notification is generated.



Severity: Critical.


Event Code: 2067.

Recommended Action: Install additional Cisco Unity Express resources, if needed.




OL-26364-01


CUESecurityIssue Description: A security violation occurred in accessing the Unity Express administration page. This can be due to a login or PIN security alert.


Severity: Warning.


Event Code: 2064.

Recommended Action: Check the event description for the reason for the security problem.

CUEStorageIssue Description: Cisco Unity Express has degradation issues with the Flash storage.



Severity: Warning.


Event Code: 2065.

Recommended Action: Check the event description for the appropriate reason and take action.

DataPhysicalDiskDown Description: Hard drive failure event detected on Compaq boxes.

Default Polling Interval: 4 minutes.


Trigger: Polling.

Severity: Critical.

Device Type: Media Server.

Event Code: 2060.

Recommended Action: Contact Cisco for hardware replacement.

Event Attribute compaq_DaPhyDrvStatus provides the status of the physical drive. The following values are valid for the physical drive status:

• other (1)—The instrument agent does not recognize the drive. You may need to upgrade your instrument agent and/or driver software.

• failed (3)—The drive is no longer operating and should be replaced.

• predictiveFailure(4)—The drive has a predictive failure error and should be replaced.




OL-26364-01


DBReplicationFailure

Supports Unified Communications Manager version 5.1.3 or later in RTMT polling (it is not applicable for Windows-based Communication Managers). For Communications Manager version 5.1 to 5.1.2, the event name is IDS Replication Failure.

Description: There is a Unified Communications Manager database replication failure.




Severity: Critical.



Event Code: 2091.

Recommended Action: Monitor syslog for IDSEngineCritical syslog messageClassID of 30-39, which indicates a replication problem. This message will have more detailed information on the cause of the event.

For a video tutorial on troubleshooting the DBReplicationFailure event, click on the E-Learning button in the online help.

D Channel Out of Service Description: Indicates that the MGCP D Channel is out of service. This event is generated by monitoring the syslog messages received from Unified Communications Manager.

Trigger: Syslog.

Severity: Critical.


Clear Interval: Clears based on DChannelISV syslog.

Event Code: 7021.

Recommended Action: Check the status of affected D channel in the affected gateway to verify out of service. Investigate the root cause.

DevicePartiallyMonitored Description: Occurs during discovery or rediscovery of the device due to incorrect HTTP or WMI credentials.

Trigger: Discovery or rediscovery.

Severity: Warning.

Device Type: Unified Communications Manager (HTTP), Unified Presence Server (HTTP), Unity Connection (HTTP), Unity (WMI), and Unified Contact Center. Enterprise (WMI).

Clear Interval: Clears based.

Event Code: 2115.

Recommended Action: Check the HTTP credentials or WMI credentials.




OL-26364-01


DeviceRestarted Description: Indicates the current SysUpTime value is less than the previously polled value.

There is no corresponding clear event for this event.

Trigger: Polling.


Device Type: Unified Communications Manager and Unified Presence.


Event Code: 2081.

DPAPortCallManagerLinkDown Description: Indicates that the physical port connection to the Communications Manager is down. This is not applicable to DPA ports connected to the digital PBX system.

Trigger: Polling.

Severity: Critical.

Device Type: Voice Mail Gateway.

Event Code: 2013.

Recommended Action: Contact your support team.

DPAPortTelephonyLinkDown Description: Indicates that the physical ports connected to Octel voicemail systems or digital PBX systems are down.

Trigger: Polling.

Severity: Critical.

Device Type: Voice Mail Gateway.

Event Code: 2014.


DSPFailure Description: Generated when the digital signaling processor (DSP) on the router experiences failure. Event attributes specify which DSP is affected as well as the operational state of the DSP (failed, shutdown, and so on).

At any given hour, there is only one DSPFailure event on a DSP (even if DSP failed multiple times during that hour).

Trigger: Trap

Severity: Critical.

Device Type: Router or Voice Gateway.

Clear Interval: Time-based auto-clear after 1 hour

Event Code: 2142

Recommended Action:

Contact Cisco TAC for assistance.




OL-26364-01


Duplicate IP Address Description: Same IP address is configured on multiple managed systems.

Trigger: Polling (often during rediscovery).

Severity: Critical.

Device Type: Host, Hub, Router, Optical Switch, or Switch.

Event Code: 1001.

Recommended Action: Check if any system is assigned a static IP that is present in the range of IP addresses assigned by the DHCP.

EndPointLostContact Description: This event is raised on a cluster. Active event indicates that an endpoint got unregistered with a cluster. End Point could be MGCP Trunk, Voice Mail Port, CTI Port, and CTI Route Point or Media Resource.

Trigger: Polling and Syslog Processing.

Severity: Critical.

Device Type: Cluster.

Event Code: 2036.

Recommended Action: Go to the Communications Manager to verify the registration status of the reported end point. Verify that IP connectivity exists between the cluster and the endpoint.

ExcessiveFragmentation Description: System memory is highly fragmented.

Trigger: Polling.

Severity: Critical.

Device Type: Host, Router, Switch, or Optical Switch.

Event Code: 1003.

ExchangeLoginFailed Description: One or more of Unity components failed to log on to the Exchange server.

Trigger: SNMP Trap (through Unity EMS integration).

Severity: Critical.

Device Type: Unity.

Event Code: 2118.

Recommended Action: Check the Exchange connectivity and login credentials to correct the error condition.




OL-26364-01


ExpertAdvisorSystemDown Description: Any of the subsystems of Expert Advisor are down. Sub-systems are Contact Manager, Media Platform Adapter, Business rule engine, and so on.

Trigger: Polling.

Severity: Critical.


Event Code: 2112.

Recommended Action:

1. Check the subsystems name and check the corresponding service status on the Expert Advisor device. Try starting the service if it is stopped.

2. If the service does not start, contact your Expert Advisor support center.

FanDegraded Description: This event indicates that an optional fan is not operating correctly. The event is based on polling or processing the SNMP trap cpqHeThermalSystemFanDegraded received from monitored Cisco Unified Communications Managers.


Trigger: Polling, or processed trap (see Processed SNMP Traps, page C-1).

Severity: Warning.

Device Type: Media Server or Voice Gateway.

Event Code: 2015.

Recommended Action: Check the status of the reported fan and monitor for recurrence.

System chassis temperature is high.

FanDown Description: Indicates that a required fan is not operating correctly. The event is based on processing the SNMP trap cpqHeThermalSystemFanFailed received from monitored Cisco Unified Communications Managers.



Severity: Critical.


Event Code: 2016.

Recommended Action: Check the status of the reported fan and contact Cisco for hardware replacement.




OL-26364-01


Flapping Description: Port or interface is repeatedly alternating between Up and Down states over a short period of time.

Cisco Prime UOM issues this event by monitoring the number of link downs received within the link window for a particular network adapter (using the Link threshold and Link Window parameters).

Trigger: Polling or processed trap (see Processed SNMP Traps, page C-1).

Severity: Critical.

Device Type: Host, Hub, Router, Optical Switch, or Switch.

Event Code: 1004.

Recommended Action: Reconfigure the Link Trap Threshold and Link Trap Window threshold parameters under Interface/Port Flapping Settings for the interface groups.

HardDiskError Description: Unity server hard disk has encountered error condition.

Trigger: SNMP Trap (Through Unity EMS integration)

Severity: Critical

Device Type: Unity.

Event Code: 2117.

Recommended Action: Check the disk drive and correct the error to proceed normally.

Hardware Failure Description: Indicates that a hardware failure has occurred in the Communications Manager. This event is generated by monitoring the syslog messages received from Unified Communications Manager.

By default this event is not enabled.

Trigger: Syslog.

Severity: Critical


Clear Interval: 4 days.

Event Code: 7022.

Recommended Action: Check the RTMT Syslog Viewer for further details. If you need to enable this event, see Activating Events in Operations Manager, page E-82.




OL-26364-01


HighAnalogPortUtilization Description: Percentage utilization of an analog port has exceeded one of the following:

• Cisco Unified Communications Manager Analog Port Utilization.

– FXS Port Utilization Threshold.

– FXO Port Utilization Threshold.

• MGCP Gateway Analog Port Utilization.



• H323 Gateway Analog Port Utilization.



– EM Port Utilization Threshold.

You must enable polling for Voice Utilization Settings to monitor this event.


Default Threshold: 90%.

Severity: Critical.

Device Type: Voice Gateway.

Event Code: 4100.

Recommended Action: Use this event to assess whether you should install additional resources. Check event details and identify which resource has exceeded the threshold.

Use the performance graph to monitor resource utilization in real time over the past 72 hours, which will help you determine if you need to add resources in the voice network infrastructure.

HighBackplaneUtilization Description: Utilization of the backplane bandwidth exceeds the backplane utilization threshold.

Trigger: Polling.

Severity: Critical.


Event Code: 1005.




OL-26364-01


HighBroadcastRate Description: Input packet broadcast percentage exceeds the broadcast threshold. The input packet broadcast percentage calculates the percentage of total capacity that was used to receive broadcast packets.

Trigger: Exceeded Broadcast Threshold.

Severity: Critical.


Event Code: 1006.

Recommended Action: Reconfigure the Broadcast Threshold parameter under Generic Interface/Port Performance Settings for the interface groups.

HighBufferMissRate Description: Rate of buffer misses exceeds the Memory Buffer Miss Threshold.

Trigger: Exceeded Memory Buffer Miss Threshold.

Severity: Critical.

Device Type: Host, Router, Switch or Optical Switch.

Event Code: 1007.

HighBufferUtilization Description: Number of buffers used exceeds the Memory Buffer Utilization Threshold.

Trigger: Exceeded Memory Buffer Utilization Threshold.

Severity: Critical.


Event Code: 1008.

HighCollisionRate Description: Rate of collisions exceeds the Collision Threshold.

Trigger: Exceeded Collision Threshold.

Severity: Critical.

Device Type: Host, Hub, Router, Switch, or Optical Switch.

Event Code: 1009.

Recommended Action: Reconfigure the threshold parameter Collision Threshold under Generic Interface/Port Performance Settings for the interface groups.




OL-26364-01


HighDigitalPortUtilization Description: Percentage utilization of a digital port has exceeded the threshold.

Trigger: Exceeded one of these thresholds:

o Cisco Unified Communications Manager Digital Port Utilization:

- BRI Channel Utilization Threshold.

- T1 PRI Channel Utilization Threshold.

- E1 PRI Channel Utilization Threshold.

- T1 CAS Channel Utilization Threshold.

o MGCP Gateway Digital Port Utilization:





o H323 Gateway Digital Port Utilization:





- E1 CAS Channel Utilization Threshold.

Note You must enable polling for Voice Utilization Settings to monitor this event.


Default Threshold: 90.

Severity: Critical.


Event Code: 4101.

Recommended Action: Use this event to assess whether additional resources need to be installed. When this event is generated, check event details and identify which resource has exceeded the threshold.

Use the performance graph to monitor the resource utilization in real time for the past 72 hours to verify high utilization. Then determine if you need to add additional resources in the voice network infrastructure.




OL-26364-01


HighDiscardRate Description: A HighDiscardRate event occurs when:

• The input packet queued rate is greater than the minimum packet rate, and the input packet discard percentage is greater than the discard threshold.

• The input packet queued rate is the rate of packets received without error. The input packet discard percentage is calculated by dividing the rate of input packets discarded by the rate of packets received.

• The output packet queued rate is greater than the minimum packet rate, and the output packet discard percentage is greater than the discard threshold.

The output packet queued rate is the rate of packets sent without error. The output packet discard percentage is calculated by dividing the rate of output packets discarded by the rate of packets sent.

Trigger: Exceeded Discard Threshold.

Severity: Critical.


Event Code: 1010.

Recommended Action: Reconfigure the Discard Threshold parameter under Generic Interface/Port Performance Settings for the interface groups.

HighErrorRate Description: A HighErrorRate event occurs for input or output packets when both of the following thresholds are exceeded:

• Error Threshold—Percentage of packets in error.

• Error Traffic Threshold—Percentage of bandwidth in use.

Trigger: Exceeded Error Threshold and Equaled or Exceeded Error Traffic Threshold.

Severity: Critical.


Event Code: 1011.

Recommended Action: Reconfigure the Error Threshold and Error Traffic Threshold parameters under Generic Interface/Port Performance Settings for the interface groups.




OL-26364-01


HighPortUtilization Description: Percentage of port utilization exceeds a threshold.



• Voice Mail Gateway Port Utilization:

– Voice Mail Port Utilization Threshold.

– PBX Port Utilization Threshold.

• Cisco Unity and Cisco Unity Connection Port Utilization:

– Active InBound Ports Threshold.

– Active OutBound Ports Threshold.

Severity: Critical.

Device Type: Media Server or Voice Mail Gateway.

Event Code: 4102.

Recommended Action: This event is generated when the percentage of Cisco Unity port utilization exceeds the Active InBound Ports Threshold (90%) or the Active OutBound Ports Threshold (90%).

After receiving this event, find out the percentage of active inbound/outbound ports by checking the Detailed Device View for the percentage of active inbound/outbound port.

Then determine if additional Unity ports need to be configured.




OL-26364-01


HighResourceUtilization Description: A hardware resource threshold has been exceeded.


• Cisco Unified Communications Manager Resource Utilization:

– MOH Multicast Resources Active Threshold.

– MOH Unicast Resources Active Threshold.

– MTP Resources Active Threshold.

– Transcoder Resources Active Threshold.

– Hardware Conference Resources Active Threshold.

– Software Conference Resources Active Threshold.

– Conference Streams Active Threshold.

– MOH Streams Active Threshold.

– MTP Streams Active Threshold.

– Location Bandwidth Available Threshold.

• H323 Gateway Resource Utilization:

– DSP Utilization Threshold.

• Gatekeeper Resource Utilization:

– Total Bandwidth Utilization for Local Zone Threshold.

– Interzone Bandwidth Utilization for Local Zone Threshold.

• Cisco Unified Communications Manager Express Utilization:

– Registered IP Phones Threshold.

– Registered Key IP Phones Threshold.

• Cisco Unity Express Utilization:

– Capacity Utilization Threshold.

– Session Utilization Threshold.

– Orphaned Mailboxes Threshold.

• Voice Gateway Utilization:

– MTP Session Utilization Threshold.

– Transcoder Session Utilization Threshold.

• Meeting Place Port Utilization:

– Audio Port Utilization Threshold.

– Video Port Utilization Threshold.







OL-26364-01


HighResourceUtilization (continued) Severity: Critical.

Device Type: Cisco Unified Communications Manager or cluster, gatekeeper, Media Server, Router, Voice Gateway, or Meeting Place.

Event Code: 4103.

Recommended Action: Assess whether you should install additional resources. While this event is generated, click the event ID to view event details and identify which resource has exceeded the threshold.

Use the performance graph or RTMT (for Communications Manager) to monitor the resource utilization in real time over the past 72 hours to verify high utilization and determine if you need to install additional resources.

HighTrunkUtilization Description: Trunk utilization is high and exceeded its configured threshold. This event is for T1/E1 CAS or PRI only.

Trigger: Polling.

Severity: Critical.

Event Code: 7035.


Source: GSU

Recommended Action: Use this event to assess whether additional resources need to be installed. When this event is generated, check event details and identify which resource has exceeded the threshold.

Use the performance graph to monitor the resource utilization in real time for the past 72 hours to verify high utilization. Then determine if you need to add additional resources in the voice network infrastructure.

HighUtilization Description: Current utilization exceeds the utilization threshold configured for this network adapter or processor. The most common reason for this event is that one or more processes are using excessive CPU space.


• Utilization Threshold.

• Processor Utilization Threshold.

Severity: Critical.

Device Type: Host, Media Server, Router, Switch, Optical Switch, or Voice gateway.

Event Code: 1013.

Recommended Action: Identify the processes using excessive CPU space. You may want to take action, which may include restarting the identified process or processes.




OL-26364-01


HTTPInaccessible Description: HTTP service cannot be used to communicate to all Communications Managers in the cluster. This might be due to one or both of the following:

• The Web Services for all Communications Managers in the cluster is down.

• The credentials (HTTP username, password) for at least one of the running Web Services were not found or are incorrect.



Trigger: Polling.

Severity: Critical.

Device Type: Cisco Unified Communications Manager Cluster.

Event Code: 2009.

Recommended Action: Verify that all Communications Managers are accessible via Web Service with the credentials provided in Cisco Prime UOM. Provide the correct username and password if the credentials are wrong.

You might need to restart the web server if Web Service is down. Make sure that Communications Managers are patched to protect against viruses.

IAJitterDS_ThresholdExceeded Description: There is a violation in the IAJitterDS threshold configured. This results in poor voice quality.This may be a result of any node in the path being heavily loaded or experiencing a failure.

Trigger: Node-to-node test polling.

Severity: Warning.


Event Code: 4010.

Recommended Action: Check the connectivity between the destination and source test configuration.

Check the QOS settings in intermediate routers which may impact Jitter.

IBMDiskTrapEvent Description: The IBM RAID Drive failure on the device or hard disk is removed from the slot.

This may degrade the performance of the disk drive and result in data loss in logical drives, depending on the RAID level.

Recommended Actions:

Depending on the RAID level, remedial actions to be taken vary:

• RAID recovery software may have to be used to recover/restore the data.

• Replace the failed drive.




OL-26364-01


ICT Call Throttling Start Description: Cisco Unified Communications Manager has detected a route loop over the H323 trunk. As a result, Communications Manager has temporarily stopped accepting calls for the indicated H323 device.


Trigger: Syslog.


Device Type: Communications Manager Cluster.

Clear Interval: Clears based on ICTCallThrottlingEnd syslog.

Recommended Action: Check the route pattern configured in the Communications Manager and remove the route loop.

IdeAtaDiskDown Description: The Compaq IDE/ATA hard disk drive is down.

Trigger: Polling.

Severity: Critical.


Event Code: 2062.

Recommended Action:

1. Check whether or not the hard disk can be seen by the hard disk controller. Usually on a hard disk failure, the disk will not be detectable by the controller (but this is not always the case).

2. If you can see the hard disk when you auto-detect, the problem is more likely to be software than hardware.

3. If the drive is detected in the BIOS setup but cannot be booted or accessed when booting from a floppy disk, the disk itself may be faulty.

IDS Replication Failure

Supports Unified Communications Manager version 5.1.1, and 5.1.2 (Not for Windows- based Communications Managers) in Syslog/RTMT.

Description: A subscriber in a Cisco Unified Communications Manager cluster experienced a failure while replicating the data to the publisher database. This event needs to be manually cleared to delete it.


Severity: Critical.

Device Type: Unified Communications Manager or Cluster.


Event Code: 2091.

Recommended Action: Monitor syslog for IDSEngineCritical syslog messageClassID of 30-39, which indicates a replication problem. This message will have more detailed information on the cause of the event.




OL-26364-01


InformAlarm Description: Critical event generated from processed traps.

Trigger: SNMP trap (see Processed SNMP Traps, page C-1).


Event Code: 1014.

InsufficientFreeHardDisk Description: Free Hard Disk Memory available is insufficient. This may degrade the performance of the device.

Trigger: Exceeded Free Hard Disk Threshold.

Severity: Critical.


Event Code: 2020.

Recommended Action:

1. Uninstall unnecessary applications.

2. Free up disk space by deleting temporary files.

3. Cleanup unnecessary files.

See also InsufficientFreeMemory and InsufficientFreeVirtualMemory.

Events are removed for Unified Communications Manager only. You may need to manually clear these UCM events after your upgrade is complete.

InsufficientFreeMemory Description: System is running out of memory resources or there has been a failure to allocate a buffer due to lack of memory.

Trigger: Exceeded Free Memory Threshold.

Severity: Critical.

Device Type: Host, Media Server, Router, Switch, or Optical Switch.

Event Code: 1015.

Recommended Action: On Cisco IOS devices, run show memory to check memory utilization. Sometimes high memory utilization is indicative of a memory leak. Identify which process is using excessive memory and take action (including restarting the process).

On the other devices, do the following:

1. Close any unnecessary applications.

2. Stop the services that are not being used or are not required.

See also InsufficientFreeHardDisk and InsufficientFreeVirtualMemory.

Events are removed for UCM only. You may need to manually clear these UCM events after your upgrade is complete.




OL-26364-01


InsufficientFreeVirtualMemory Description: System is running out of virtual memory resources. This may degrade the performance of the device.

Trigger: Exceeded Free Virtual Memory Threshold.

Severity: Critical.


Event Code: 2022.

Recommended Action:

1. Stop the services which are not used or that are not required to be running.

2. Increase the virtual memory on the device.

See also InsufficientFreeHardDisk and InsufficientFreeMemory.

Events are removed for UCM only. You may need to manually clear these UCM events after your upgrade is complete.

IPCCDualStateNotification Description: The Unified Contact Center sent a notification with a value of cccaEventState in the trap details.


Severity: Warning.


Event Code: 2070.

Recommended Action: See the event details page, which provides information on any actions that need to be taken.

IPCCSingleStateNotification Description: The Unified Contact Center sent a notification with a value of singleStateRaise for ccaEventState in the trap details.


Severity: Warning.


Event Code: 2070.

Recommended Action: See the event details page, which provides information on any actions that need to be taken.




OL-26364-01


JitterDS_ThresholdExceeded Description: There is a violation in the JitterDS threshold. This results in poor voice quality.

Trigger: Node-to-node test.

Severity: Warning.


Event Code: 4007.

Recommended Action: Check the connectivity between the destination and source (DS) on which the test is configured.

Check the QoS settings that may impact latency in the intermediate routers. This may be the result of a heavy load or crash on a node in the path.

For more information, see Using Node-To-Node Tests, page 14-1.

JitterSD_ThresholdExceeded Description: There is a violation in the JitterSD threshold. This results in poor voice quality.


Severity: Warning.


Event Code: 4006.

Recommended Action: Check the connectivity between the source and destination (SD) on which the test is configured.

Check the QoS settings that may impact latency in the intermediate routers. This may be the result of a heavy load or crash on a node in the path.


LicenseExpired Description: The License file has expired and they system will run in license violation mode for 30 days.

Trigger: Syslog.

Severity: Critical.


Clear Interval: 24 hours.

Event Code: 7027.

Recommended Action: Install the new valid license to avoid system shut down before the license violation mode for 30 days expires.




OL-26364-01


LicenseExpirationWarning Description: A License tag in the license file has expired.

Trigger: Syslog.



Clear Interval: 60 minutes.

Event Code: 7028.

Recommended Action: Update the license file with valid tags.

LocationBWOutOfResources Description: A call through a Communications Manager location failed due to lack of bandwidth in the cluster.

Polling must be enabled for Voice Utilization Settings to monitor this event.

Trigger: Polling.

Severity: Critical.

Device Type: Unified Communications Manager Cluster.

Event Code: 2094.

Recommended Action: Indicates location CAC issue and is useful for ensuring that Voice over IP trunk sizing is adequate. Check event details to identify the location that has the CAC issue.

Check the Detailed Device View to find out the available bandwidth for the location and determine if additional bandwidth needs to be configured.

LogPartitionHighWatermarkExceeded


Description: The percentage of used disk space in the log partition has exceeded the configured high-water mark.




Event Code: 2132.

Recommended Action: Log partition usage can be monitored from the RTMT Disk Usage page. It shows up as Common Partition. Check for trace settings and core dump files. Note that core dump files are fairly large. Typically, a core dump file is 200 to 300 MB in size, but it can be as large as 1 to 2 GB.

After the log partition disk usage goes above the high-water mark threshold, Cisco Log Partition Monitoring Tool (LPM) will start deleting files to put log partition disk usage under the low-water mark threshold.

Since LPM may delete the trace, log, or core dump files you want may want to keep, it is very important to act when you receive a LogPartitionLowWaterMarkExceeded event.

You can use Trace & Log Central (TLC) to download files and delete them from the server.




OL-26364-01


LogPartitionLowWatermarkExceeded


Description: Free disk space is low. The percentage of used disk space in the log partition has exceeded the configured low water mark. There are no files to be purged under such a situation.






Event Code: 2131.

Recommended Action: Log partition usage can be monitored from the RTMT Disk Usage page. It shows up as Common Partition. Check for trace settings and for core dump files. Note that core dump files are fairly large. Typically, a core dump file is 200 to 300 MB in size, but it can be as large as 1 to 2 GB.

After the log partition disk usage hits the low-water mark threshold, Cisco Log Partition Monitoring Tool (LPM) will start deleting files to put log partition disk usage under the low-water mark threshold.

Since LPM may delete the trace, log, or core dump files you want may want to keep, it is very important to act when you receive a LogPartitionLowWaterMarkExceeded event.

You can use Trace & Log Central (TLC) to download files and delete them from the server.

See also LogPartitionHighWatermarkExceeded and LowInactivePartitionAvailableDiskSpace.

LowActivePartitionAvailableDiskSpace

Supports Unified Communications Manager version 5.x or later.

Description: The percentage of available disk space on the active partition is lower than the configured value.




Severity: Critical.


Recommended Action: Some of the symptoms of low active disk space include:

• Communications Manager Admin page does not operate correctly.

• BAT does not operate correctly.

• RTMT does not operate correctly.

Since there are no user-manageable files in the Active Partition, check the event threshold. If the event threshold is at the Cisco default, then contact your support team for guidance.




OL-26364-01


LowAvailableDiskSpace

Supports Unified Communications Manager version 6.0 or later.

Description: The percentage of available disk space is lower than the configured value.




Severity: Critical.


Recommended Action: Check available disk space percentage and deleted unnecessary files.

LowAvailableInboxLicenses Description: Number of available Unity inbox licenses is lower than the configured Unity Inbox License Threshold. Cisco Unity Subscriber Feature - Unity Inbox licenses allow you to enable subscribers for the add-on feature called Unity Inbox.

Each subscriber enabled for this feature uses one of these licenses.

Trigger: Polling.

Severity: Critical.

Device Type: Unity and Unity Connection.

Recommended Action: Check to see if you need additional Unity inbox licenses.

LowAvailableSubscriberLicenses Description: Number of available Unity licenses is lower than the threshold. Cisco Unity Subscriber licenses allow you to add basic voicemail subscribers to the system. Each subscriber uses one license.

Trigger: Polling.

Severity: Critical.

Device Type: Unity and Unity Connection.

Event Code: 2104.

Recommended Action: Check to see if additional subscriber licenses are needed.




OL-26364-01


LowAvailableVirtualMemory Description: The percentage of available virtual memory is lower than the configured value. This event indicates that the available Virtual Memory is running low.




Severity: Critical.


Event Code: 2022.

Recommended Action: Check Cisco Unified Communications Manager Windows Task Manager or the RTMT tool to verify insufficient memory. This event may be due to a memory leak. It is important to identify which process is using excessive memory.

After the process is identified, if you suspect a memory leak (for example, if the memory usage for a process increases continually, or a process is using more memory than it should), you may want to contact your support team.

LowInactivePartitionAvailableDiskSpace


Description: The percentage of available disk space of the inactive partition is lower than the configured value. This event is generated based on polling RTMT precanned counters.


Default Threshold: N/A


Severity: Critical.


Event Code: 2020.

Recommended Action: Since there are no user-manageable files in Inactive Partition, check the event threshold. If the threshold is at the Cisco default, then contact your support team for guidance.




OL-26364-01


LowSwapPartitionAvailableDiskSpace


Description: The percentage of available disk space of the swap partition is lower than the configured value.

The swap partition is part of virtual memory. Therefore, low available swap partition disk space also means low virtual memory.


Default Threshold: N/A


Severity: Critical.


Event Code: 2121.

Recommended Action: Find out how much swap space and virtual memory are still available. Also find out which process is using the most memory. This event may be due to a memory leak.

After you determine that there is a memory leak and virtual memory is running low, you may want to restart the service after saving the necessary troubleshooting information.

Please consult your support team for further information.

MajorAlarm Description: Critical event generated from processed traps.



Event Code: 1016.


Media List Exhausted


Description: All available media resources defined in the media list are busy.

Trigger: Syslog.

Severity: Critical.



Event Code: 2056, 4103, 2052, 2053, 2057 and SNMP trap.

Recommended Action: Install additional resources to the indicated media resource list. This event indicates a network failure or device failure.

MinorAlarm Description: Critical event generated from processed traps.



Event Code: 1017.




OL-26364-01


MosCQDS_ThresholdExceeded Description: There is a violation in the configured MosCQDS threshold. This results in poor voice quality. This may be a result of any node in the path being heavily loaded or experiencing a failure.


Severity: Warning.


Event Code: 4012.

Recommended Action: Check the connectivity between the destination and source (DS) test configuration.

Check the QOS settings in intermediate routers which may impact Jitter, Packet loss, or delay which may impact the MOS.

MosLQDS_ThresholdExceeded Description: There is a violation in the configured MosLQDS threshold. This results in poor voice quality. This may be a result of any node in the path being heavily loaded or experiencing a failure.


Severity: Warning.


Event Code: 4013.


Check the QOS settings in intermediate routers which may impact Jitter, Packet loss, or delay which may impact the MOS.

MWIOnTimeExceeded Description: This threshold is related to Message Wait Indicator (MWI) synthetic test and provides information on the VoiceMail lamp of the phone.

MWIOnTime threshold is the difference between the timestamp when MWI (voicemail) message is left and timestamp when the MWI light goes ON. If the time taken is more than this threshold, then the MWIOnTime event is raised.


Severity: Warning.

Device Type: Unity, Unity Connection, and Unity Express.

Event Code: 2024.

Recommended Action: The network administrator should check the load on the Unity server.




OL-26364-01


NicDown Description: A Network Interface Controller on a Cisco Unified Contact Center system is down. This impacts TDM telephony services.

Trigger: Polling.

Severity: Critical.

Device Type: Unified Contact Center.

Event Code: 2040.

Recommended Action:

1. Check if NIC service is running. Try starting the service if it is stopped.

2. If the service does not start, contact the Cisco Unified Contact Center support team.

NoConnectionToPeer Description: Lost communication with the peer server in the cluster due to heartbeat not being received for at least 30 seconds.


Severity: Critical.


Clear Interval: No auto-clear. This event is cleared by the RegainedPeerCommunication event.

Event Code: 7026.

Recommended Action: Make sure secondary server is active or/and connected to primary.

NodeToNodeTestFailed Description: The configured IPSLA test has failed on the source device. The reason for failure is indicated based on the error code.


Severity: Warning.


Event Code: 4000.

Recommended Action: Take action based on the error code. If the error code indicates there is a timeout or a problem with reaching the destination, then repair the problem in the path or the destination.




OL-26364-01


Number Of Registered Phones Dropped


Description: Number of registered phones in the cluster dropped more than the configured percentage between consecutive polls.


Severity: Warning.



Event Code: 7016.

Recommended Action: Phone registration status must be monitored for sudden changes. If the registration status changes slightly and readjusts quickly over a short time frame, it could indicate a phone move, addition, or change.

A sudden smaller drop in the phone registration counter could indicate a localized outage; for instance, an access switch or a WAN circuit outage or malfunction.

A significant drop in registered phone level requires immediate attention from the administrator.

Number Of Registered Gateways Decreased1


Description: Number of registered gateways decreases between two consecutive RTMT polls.


Severity: Warning.



Number Of Registered Gateways Increased1


Description: Number of registered gateways increases between two consecutive RTMT polls.





Recommended Action: Ensure these events are enabled in the sysLogConfig.xml file. For details, see Activating Events in Operations Manager, page E-82.

Number Of Registered MediaDevices Decreased1


Description: A registered media device count decreases between two consecutive RTMT polls.





Event Code: 7018.




OL-26364-01


Number Of Registered MediaDevices Increased1


Description: A registered media device count increases between two consecutive RTMT polls.





Event Code: 7017.

OperationallyDown Description: Interface card or network adapter operational state is not normal.


For interfaces, Cisco Prime UOM will only generate an OperationallyDown clear event if the card is reinserted into the same slot, and if the module index is the same before and after the card is reinserted.

Severity: Critical.


Event Code: 1018.

Recommended Action: Check the status of indicated interface, port, or card and investigate the root cause.

For interfaces, Cisco Prime UOM generates an OperationallyDown clear event only if the card is reinserted into the same slot, and if the module index is the same before and after the card is reinserted.

OutOfDiskSpace Description: Unity is running out of disk space.

Trigger: SNMP Trap (through Unity EMS integration).

Severity: Critical.

Device Type: Unity.

Event Code: 2114.

Recommended Action: Make more space available on the disk.

OutofRange Description: Device temperature or voltage is outside the normal operating range. When an OutofRange event is generated, you will normally also see fan, power supply, or temperature events.

Trigger: Polling.

Severity: Critical.


Event Code: 1019.




OL-26364-01


PacketLossDS_ThresholdExceeded Description: The configured value for the PacketLossDS threshold was violated. This results in poor voice quality. This may be a result of any node in the path being heavily loaded or crashed.


Severity: Warning.


Event Code: 4005.


Check the QOS settings in intermediate routers which may impact Packet loss. Revisit the queue sizes of the nodes in the path and the drop policy if the problem persists.


PacketLossSD_ThresholdExceeded Description: The configured value for the PacketLossSD threshold was violated. This results in poor voice quality. This may be a result of any node in the path being heavily loaded or crashed.


Severity: Warning.


Event Code: 4005.


Check the QOS settings in intermediate routers which may impact Packet loss. Revisit the queue sizes of the nodes in the path and the drop policy if the problem persists.


PerformancePollingStopped Description: Occurs when the GSU data collection for a device has an issue. The probable reason can be found in the event properties.

Default Polling Interval: 4 minutes

Trigger: Polling.

Severity: Critical.

Device Type: All voice devices.

Clear Interval: System clears after polling resumes for the device.

Event Code: 4108.

Recommended Action: Check the event properties for details about the reason.




OL-26364-01


PhoneReachabilityTestFailed Description: Cisco Prime UOM cannot reach an IP phone. The IP phone has not responded to three or more successive pings from Cisco Prime UOM or the IP SLA device.

Trigger: Polling.

Severity: Critical.

Device Type: IP Phone.

Event Code: 9002.

Recommended Action: Check the connectivity between the phone and the IPSLA device.

PhoneUnregThresholdExceeded Description: Number of unregistered phones within a device pool of a cluster or a Unified Communications Manager Express that has exceeded the threshold set. The count does not include soft phones when calculating the unregistered threshold.

Phones unregistered due to Energywise Power Save Plus mode are not an issue, and are not accounted for when calculating the threshold for PhoneUnregThresholdExceeded Event at the device pool level.

Severity: Critical

Device Type: Cluster/CME level irrespective of the Unified Communications Manager version.

Clear Interval: Cleared automatically in the next cycle (5 minutes) when the unregistered phones are reduced to within the threshold limits.

Event Code: 5000.

Recommended Action: Need to check the registration status of phones within that device pool/CME on which the event is raised.

PimDown Description: Cisco Unified Contact Center Peripheral Interface Manager (PIM) module acts as a gateway to a peripheral device (Communications Manager/IVR/CTI Agents).

This event indicates that the PIM is down on the Cisco Unified Contact Center device and connectivity to these peripheral devices is lost.

Trigger: Polling.

Severity: Critical.


Event Code: 2041.

Recommended Action:

1. Check if PIM service is running. Try starting the service if it is stopped.

2. If the service does not start, contact your Cisco Unified Contact Center support team.

3. Check network connectivity across the peripheral devices and Cisco Unified Contact Center.




OL-26364-01


PowerSupplyDegraded Description: Power supply state is degraded.



Trigger: Polling.

Severity: Warning.


Event Code: 2026.

Recommended Action: Check the status of reported power supply and monitor for recurrence.

PowerSupplyDown Description: Power supply state is down.



Trigger: Trap and polling.

Severity: Critical.


Event Code: 2027.

Recommended Action: Check the status of reported power supply and contact Cisco for hardware replacement if the primary power supply is down.

Quality Dropped Below Threshold Description: The voice quality expectation defined by the MOS score has not been met. This results in poor voice quality based on the delay, latency, packet loss, and jitter in the network.


Severity: Warning.


Event Code: 4009.

Recommended Action: Check the connectivity and QoS settings of routers configured as part of the test. Fix problems with the delay, latency, packet loss, or jitter parameters in the network that may result in poor voice quality.





OL-26364-01


RegistrationResponseTime_ThresholdExceeded Description: The registration response time threshold configured as part of the gatekeeper registration test has been violated.

The endpoints trying to register with the gatekeeper may experience a delay which results in some voice calls not being established properly.


Severity: Warning.


Event Code: 4003.

Recommended Action: Check the network performance path to the gatekeeper from the endpoints. Check if the gatekeeper is heavily loaded. This may result in some delay in accepting the registration requests from the endpoints.


RepeatedRestarts Description: System repeatedly restarts over a short period of time. Device Fault Manager issues this event. It does this by monitoring the number of system cold and warm starts received within the restart window.

Trigger: Exceeded Restart Trap Threshold for Restart Trap Window; or processed trap (see Processed SNMP Traps, page C-1).

Severity: Critical.


Event Code: 1020.

Recommended Action: Reconfigure the Restart Trap Threshold and Restart Trap Windows parameters under Reachability Settings > Data Settings.

ReplicationStopped Description: Replication between redundant servers stopped.

Trigger: Syslog.

Severity: Warning.


Clear Interval: 60 minutes.

Event Code: 7024.

Recommended Action: DBreplication queue must be emptied. One method is to delete voicemail messages to empty ER queues.




OL-26364-01


RFactorDS_ThresholdExceeded Description: The configured value for RFactorDS threshold was violated. This results in poor voice quality.


Severity: Warning.


Event Code: 4011.

Recommended Action: Check the QoS settings and network issues which affect the voice quality between the source and destination.

RingBackResponseTime_ThresholdExceeded Description: Ring-back response time exceeds the node-to-node test threshold.


Severity: Warning.


Event Code: 4002.

Recommended Action: Verify that there is a CPU load issue in the gatekeeper. The delay may be the network delay between the endpoint and the gatekeeper.


RoundTripResponseTime_ThresholdExceeded Description: Round-trip response time fallen below the node-to-node test threshold.


Severity: Warning.


Event Code: 4001.

Recommended Action: Verify that there is a CPU load issue in the gatekeeper. The delay may be the network delay between the endpoint and the gatekeeper.


Route List Exhausted


Description: This indicates that all available channels defined in the route list are busy.

Trigger: Syslog.

Severity: Critical.



Event Code: 4104, 4106, and 4107.

Recommended Action: Check the RTMT Syslog Viewer for verification and further details. Assess whether additional resources should be added in the indicated route.




OL-26364-01


RTMTDataMissingUnified Description: This event is generated based on polling RTMT precanned counters and is raised when Cisco Prime UOM is unable to collect RTMT data for RTMT polling supported devices.

RTMT data collection can fail if there are HTTP communication failures or network issues or if the RTMT application on the device has issues and is unable to provide the data to Cisco Prime UOM.


Trigger: Polling.


Device Type: Unified Communications Manager and Cisco Unified Presence Server.

Recommended Action:

1. Check for any HTTP communication or network failures from Cisco Prime UOM to the device.

2. Check whether Cisco RIS Data Collector network service is up and running on the device.

For Unified Communications Manager, this service should be up and running in all the nodes of the cluster.

RTPPacketLossDS_ThresholdExceeded Description: The configured value for the RTPPacketLossDS was violated. This results in poor voice quality.


Severity: Warning.


Event Code: 4014.

Recommended Action: Check the QoS settings and network issues which affect the voice quality between the destination and source.




OL-26364-01


SCSIControllerDown Description: Indicates that the bridge between a hard disk drive's low-level interface and a host computer, which needed to read blocks of data, is down.

Trigger: Polling.

Severity: Critical.


Event Code: 2101.

Recommended Action: If the event attribute compaq_ScsiCtrlStatus is other(1) and failed(3), then for:

other(1)

• The controller is not operational due to reasons other than hardware failure. The controller may be intentionally disabled.

• The controller configuration may be in conflict with the configuration of other hardware or software in the system. Reconfigure any conflicts.

• The controller may have failed initialization. Corrective action is Operating System dependent. Check for diagnostic messages which may have occurred at system boot time.

failed(3)

The controller has failed and is no longer operating. Run Compaq Diagnostics on the computer system to help identify the problem.




OL-26364-01


SCSIDriveDown Description: Compaq SCSI hard disk drive is down. SCSI controller may be unable to communicate with the device hard disk.

Trigger: Polling.

Severity: Critical.


Event Code: 2061.

Recommended Action:

The physical drive can be in one of the following states. The event attribute compaq_ScsiPhyDrvStatus indicates the following states:

• other(1)—The drive is in a state other than one of those listed below.

• failed(3)—The physical drive has failed and can no longer return data. When convenient, you should bring down the server and run Compaq Diagnostics to help identify the problem. The drive may need to be replaced.

• notConfigured(4)—The physical drive is not configured. You need to insure all of the drive's switches are properly set and that the Compaq Configuration Utility has been run.

• badCable(5)—IA physical drive is not responding. You should check the cables connected to it. You can bring down the server and run Compaq Diagnostics to help identify the problem.

• missingWasOk(6)—A physical drive had a status of OK and is no longer present. The drive has been removed.

• missingWasFailed(7)—A physical drive had a status of FAILED and is no longer present. The drive has been removed.

• predictiveFailure(8)—The physical drive has exceeded a threshold value for one of it's predictive indicators. When convenient, you should bring down the server and run Compaq Diagnostics to help identify the problem. The drive may need to be replaced.

• missingWasPredictiveFailure(9)—A physical drive had a status of PREDICTIVE FAILURE and is no longer present. The drive has been removed.

• offline(10)—The physical drive is offline and can no longer return data. No further status is available.

• missingWasOffline(11)—A physical drive had a status of OFFLINE and is no longer present. The drive has been removed.




OL-26364-01


SDL Link Out Of Service Description: This event indicates that the local Cisco Unified Communications Manager has lost communication with the remote Communications Manager.

Trigger: Syslog.

Severity: Warning.


Clear Interval: Clears based on SDLLinkISV syslog.

Event Code: 7002.

Recommended Action: Investigate why the remote Communications Manager is not running or whether a network problem exists.

Sensor Down Description: A Cisco 1040 or NAM has stopped responding to keepalives from Service Monitor. This event appears on the Event Details page and can be generated only when you have a licensed copy of Service Monitor.


Severity: Critical.

Device Type: Unidentified Trap (because Cisco Prime UOM does not monitor Cisco 1040 or NAM).

Event Code: 8004.




OL-26364-01


ServiceDown

Supports Unified Communications Manager (UCM) version 4.x and below. For UCM 5.x and above, if a service is stopped/deactivated by the UCM admin user, the ServiceDown event is not generated in Cisco Prime UOM.

Also supports Unity Connection and Unified Presence Server.

Description: One of the critical services (any of the services in the Detailed Device View) is not running. The problem may be due to someone manually stopping the service (not applicable for Unified CM).

If you intend to stop the service for a long period of time, disabling monitoring for the service is highly recommended and is required to avoid this event. See recommended actions.



Triggers:

Polling/Syslog—For Unified CM and Unity Connection, Cisco Prime UOM generates ServiceDown events based on RTMT polling or ServiceStopped/ServiceStarted syslog emitted to remote server from this device.

RTMT Polling—For Unified Presence, Cisco Prime UOM generates ServiceDown events based on RTMT polling.

Severity: Critical (dependent on service).

Device Type: Unified Communications Manager, Unity, Expert Advisor, Emergency Responder, Unified Contact Center Express (All IPT Applications).

Event Code: 2007.

Recommended Action: Identify which services are not running. You can start the service manually from the Administrator Service Control page. To disable monitoring for a specific service, go to the device’s Detailed Device View, select the specific service, and change the managed state to False.

Check to see if there are any core files. Download the core files, if any, as well as service trace files.

Events are removed for Unified CM only. You may need to manually clear these Unified CM events after your upgrade is complete.

Service Quality Issue Description: Cisco Prime UOM has received a MOS violation trap from Service Monitor. This indicates that MOS has dropped below a threshold that is set in Service Monitor.


Severity: Critical.

Device Type: Service Quality events pertain to the call destination, which might be a device (voice gateway) or a phone.

Event Code: 8001.

(See Using Fault Monitor, page 4-1.) This event can be generated only when you have a licensed copy of Service Monitor.




OL-26364-01


ServiceQualityThresholdCrossed Description: This event is a result of Service Quality Aggregation. Service quality event aggregation is performed on service quality events coming from phones that belong to a device pool or CME. An active ServiceQualityThresholdCrossed event is generated when the impacted endpoints, (for example, phones experiencing service quality issues) reach the configured threshold for the device pool or CME. The event is cleared when the impacted endpoints go below the configured threshold for the device pool or CME.

Severity: Critical.

Event Code: 8003

Properties for this event include:

• Impacted Endpoints at the time event was raised

• Threshold Percentage at the time event was raised

• Registered Phone Count at the time event was raised

• Current value of impacted Endpoints

• Current value of Threshold Percentage

• Current value of Registered Phone Count

For more details, see Service Quality Events Aggregation, page 6-9.

ServerUnreachable Description: Host is not reachable through RTMT polling. This event is generated based on polling RTMT precanned counters.



Recommended Action: Investigate if the indicated host is running and whether a network problem exists.

SIP Trunk Out Of Service Description: All remote peers for this SIP trunk are out of service and it is unable to handle calls. This event provides a list of unavailable remote peers along with the reason code received by the SIP trunk in response to an Options request sent to that remote peer.

Each peer in the list is separated by a semi-colon. This event is raised based on incoming SIPTrunkOOS syslog.

Trigger: Syslog

Severity: Critical

Device Type: Unified Communications Manager

Clear Interval: Cleared based on SIPTrunkPartiallyISV or SIPTrunkISV Syslog

Event Code: 7029

Recommended Action: For each unavailable remote peer, perform the steps outlined in the UCM Alarm documentation based on the reason code provided in the event.




OL-26364-01


SIP Trunk Partially In Service Description: Some of the remote peers are not available to handle calls for this SIP trunk. This event provides a list of available remote peers and a list of unavailable remote peers along with the reason code received by the SIP trunk in response to an Options request sent to that remote peer.

Each peer in the list is separated by semi-colon. This event is raised based on incoming SIPTrunkPartiallyISV syslog.

Trigger: Syslog

Severity: Warning

Device Type: Cisco Unified Communications Manager

Clear Interval: Cleared based on SIPTrunkOOS or SIPTrunkISV Syslog

Event Code: 7030

Recommended Action: No action is required. The available remote peer list provided in the event is for notification purpose only. For each unavailable remote peer, perform the steps in the UCM Alarm documentation based on the reason code provided in the event.

SoftwareAlarm Description: Event indicates alarm generated from Windows Event Log trap processing.

Default Polling Interval: N/A.



Severity: Critical.

Device Type: MediaServer.

Event Code: 2141.


SRSTEntered Description: An IP telephony router is functioning in Survivable Remote Site Telephony (SRST) mode, performing call management for phones in place of the central Cisco Unified Communications Manager.

The event is generated when a WAN link is down, preventing IP phone TCP keepalive messages from reaching the Communications Manager.

Trigger: Polling (See also Table 10-1 on page 10-3).

Severity: Critical.

Device Type: Router and Voice Gateway.

Event Code: 9000.

Recommended Action: Check the connectivity between the phone and the Communications Manager to which it is registered.




OL-26364-01


SRSTRouterFailure Description: There is a SRST router failure. This trap comes with a notification reason (csrstSysNotifReason) which describes the failure. The SRST feature will probably not work on the branch site when this condition occurs.


Severity: Warning.

Device Type: Router or VoiceGateway.

Event Code: 2071.

Recommended Action:

1. Check the event attributes to find out the cause of the failure.

2. Telnet to the router console port address and type reload at the router prompt.

SRSTSuspected Description: IP Phone Information Facility reports that all phones associated with the SRST router are unregistered, but the WAN link between phones and the central Cisco Unified Communications Manager is up.

Trigger: Polling.

Severity: Critical.

Device Type: Router and Voice Gateway.

Event Code: 9001.

Recommended Action: Check the connectivity between the phone and the SRST router.

StateNotNormal Description: A fan, power supply, temperature sensor, or voltage sensor is not acting normally. When an OutofRange event is generated, you will also see a fan, power supply, or temperature event.

Trigger: Polling.

Severity: Critical.


Event Code: 1021.





OL-26364-01


Subscriber License Violated Description: An insufficient license violation has occurred for subscribers. For details, open the Licensing screens on the Cisco Unity Connection administration web pages.

You cannot add new subscribers until you resolve the violation. If you licensing violation has not been resolved, system operation will be suspended in the number of day(s) indicated.

Trigger: Syslog.

Severity: Critical.

Device Type: Cisco Unity Connection.

Clear Interval: Time-based auto-clear after 23 hours.

Event Code: 7031.

Recommended Action:

Reduce the usage limit in violation so that it is less than the licensed limit for subscribers. You can accomplish this by either acquiring an additional license to increase the limit or by performing administrative changes that reduce the number of subscribers.

SyntheticTestFailed Description: Synthetic tests are CPU intensive. There is a threshold set for high-CPU utilization which ensures that tests will not run when system CPU utilization is more than 80%.

When the high-CPU Utilization threshold of 80% is reached, synthetic tests are stopped and a SyntheticTestFailed event is created. This signifies a failure in execution of the synthetic text due to high CPU, and not a failure in its result.

This event is also raised when the synthetic test fails for other reasons.

Trigger: Polling.

Severity: Critical.

Device Type: Unified Cisco Communication Manager, Unified Communications Manager Express, Unity, Unity Connection, Unity Express, Emergency Responders, and Conference Connection.

Event Code: 2011.

Recommended Action: The network administrator should ensure that the CPU utilization of the system is below 80%. Check the event properties for details of the failure.




OL-26364-01


SyntheticTestThresholdExceeded Description: Raised when a synthetic test exceeds some threshold value. The following are thresholds based on the type of synthetic tests:

• RegistrationTimeThreshold—Time limit for phone registration exceeded.

• DialtoneTimeThreshold—Time limit for dial-tone test exceeds.

• EndToEndCallSetupTimeThreshold—Time limit for setting up an end-to-end call exceeded.

Trigger: Polling.

Severity: Warning.


Event Code: 9003.

Recommended Action: The network administrator should check the connectivity between the Communications Manager, the calling phone, and the called phone, depending on the type of synthetic test (MWI, End-to-end, phone registration, CER, or off-hook).

For the MWI test, check the Unity configuration. For the CER test, check the configuration of the PSAP server, OSAN server, and CER server.

SystemVersionMismatched

Supports Unified Communications Manager version 6.0.x in Syslog/RTMT.

Description: There is a mismatch in the system version among all servers in the cluster.

Trigger: Syslog.



Recommended Action: Ensure that all servers in the cluster are running the same system version.

TemperatureHigh Description: Current temperature of temperature sensor exceeds the Relative Temperature threshold.



Trigger: Exceeded Relative Temperature Threshold.

Severity: Critical.

Device Type: Media Server, Router, or Switch.

Event Code: 2029.

Recommended Action: Verify that environmental temperatures are set up optimally.

Check other events, such as FanDown or FanDegraded, to verify that fans are operating normally. If fans are not operating normally, you should contact Cisco for hardware replacement.

See also OutofRange.




OL-26364-01


TemperatureSensorDegraded Description: The server temperature is outside of the normal operating range. The event is based on polling or processing the cpqHeThermalTempDegraded SNMP traps received from monitored Cisco Unified Communications Managers.



Severity: Warning.


Event Code: 2030.

Recommended Action: Identify the reported temperature sensor location (ioboard/cpu) and verify status.

Check other events, such as FanDown or FanDegraded, to verify that system fans are operating normally. Contact Cisco for hardware replacement, if needed.

TemperatureSensorDown Description: Indicates that the server temperature is outside of the normal operating range and the system will be shut down. The event is based on processing the cpqHeThermalTempFailed SNMP trap received from monitored Cisco Unified Communications Managers.

Fault Condition Event Details



Severity: Critical.


Event Code: 2031.

Recommended Action: Verify that environmental temperatures are set up correctly. Identify the reported temperature sensor location (ioboard/cpu) and verify status.

Check other events, such as FanDown or FanDegraded, to verify that system fans are operating normally. Contact Cisco for hardware replacement, if needed.




OL-26364-01


Thread Counter Update Stopped


Description: Total number of processes and/or threads exceeded the maximum number of tasks. This situation could indicate that some process is leaking or has thread leaking.

System Access must stop thread counter update to avoid CPU pegging, and only provide process counter information for up to the maximum number of processes.

Trigger: Syslog.




Event Code: 7023.

Recommended Action: Check the event detail for the process which has the highest number of threads and the process which has the most instances.

If the process has an unusual number of threads or instances, save the trace for the service and try restarting the service. Make sure to download trace files associated with the service.

TotalTimeUsedThresholdExceeded Description: Indicates that the Cisco Unity Express has reached maximum allocated voicemail capacity. This impacts the voicemail features for users serviced by this Unity Express.

Trigger: Polling.

Severity: Critical.


Event Code: 2047.

Recommended Action:

1. Delete old voicemail messages to increase available capacity.

2. On the router, run show voicemail usage to get overall usage information.

3. On the router in enable mode, run show voicemail mailboxes to see mailboxes for all users. Delete invalid user voicemail accounts.

4. Set default message expiry to 30 days. Set the expiry time individually for each mailbox to a shorter duration.

To check this expiry period, run show voicemail limit and check the Default Message Age value.

5. Check if a license for more voicemail capacity can be purchased. On the router in enable mode, run show software licenses to get details of licenses applied.




OL-26364-01


UMRCommunicationError Description: This event is based on WMI. It indicates that the Cisco Unity Message Repository (UMR) cannot communicate with the Partner Mail Server to deliver messages. Messages will be held in the temporary store until the mail server is available.

Trigger: WMI event.

Severity: Critical.


Event Code: 2106.

Recommended Action:

On-Box Exchange Troubleshooting:

Verify that the required services related to MS Exchange are up and running, Try to Access Exchange Mail store using the system manager tool. Ensure that there is no red X there.

1. Review the Windows event log for any events related to Exchange Messaging application failure or Exchange-related service failure (System attendant, Information Store, MTA, and so on).

2. Check to see if the CuMdbStoreMonitor service is running on the Cisco Unity Server. Try to restart this service and see if Unity can communicate with the Exchange server.

3. Verify Active Directory (AD) and Global Catalog server functionality on the same system.

4. Verify that the DNS is configured properly and working on the same system for AD to work properly; the exchange relies on AD.

• If all of the previous checks are good, then reboot the Unity server, if permitted.

• If the problem still persists, then contact your customer support case.

Off-Box Exchange Troubleshooting

Perform the on-box troubleshooting, then complete the following steps:

1. From the Unity server try to ping the Exchange server by both IP address and hostname.

2. Check to see if Virus Scan is blocking mail delivery to the Partner Mail Server.

3. Ensure that no firewall changes have taken place to block any higher layer communications between the Cisco Unity and the Exchange server.




OL-26364-01


UnknownPublisher Description: The publisher in the cluster is unknown to Cisco Prime UOM.


Severity: Critical.


Recommended Action: Check if the Publisher is DNS resolvable from CUOM server.

UnityFailOverOrRestart Description: One of the following has occurred:

• In standalone Cisco Unity configuration—The Cisco Unity system has restarted.

• In Cisco Unity failover configuration—A failover between the primary and secondary Unity servers has occurred.

UnityFailOverOrRestart is automatically cleared after 30 minutes. Clearing of this event does not indicate that failback has occurred.

When failback does occur from secondary to primary, you will see the UnityFailOverOrRestart event on the primary Unity server.

Trigger: WMI event.

Severity: Critical.

Device Type: Unity.

Event Code: 2105.

Recommended Action: Check the Cisco Unity event view for any error messages related to failover or restart. When a failover occurs, the changes made to the data in the SQL Database (UnityDb) are replicated from the primary server to the secondary server.

However, there may be instances when these changes are not replicated from the primary to the secondary server. For more details, go to the following URL: http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_tech_note09186a0080837de4.shtml.




OL-26364-01

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_tech_note09186a0080837de4.shtml

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_tech_note09186a0080837de4.shtml


Unresponsive Description: Device does not respond to ICMP or SNMP requests. Probable causes are:

• On a system: ICMP ping requests and SNMP queries to the device timeout received no response.

• On an SNMP Agent: Device ICMP ping requests are successful, but SNMP requests time out with no response.

A system might also be reported as unresponsive if the only link (for example, an interface) to the system goes down. Cisco Prime UOM performs root cause analysis for any unresponsive events.

If Cisco Prime UOM receives a device unresponsive event, it will clear any interface unresponsive events from that device until the device is recognized as responsive.

Polling Interval: 4 minutes

Clear Interval: Clears only after the device responds to SNMP or ICMP requests. There is no specific clear interval.

Trigger: Polling.

Severity: Critical.

Device Type: Host, Hub, Router, Switch, Optical Switch, Media Server, Phone Access Switch, Voice Mail Gateway, or Voice Gateway.

Event Code: 1022.

Recommended Action: Check if the device is reachable from Cisco Prime UOM.

VoicePortOperationallyDown Description: Voice port’s operational state is not normal.

Trigger: Polling.

Severity: Critical.


Event Code: 2037.

Note This event only applies to switch ports, not voice gateway ports.




OL-26364-01


AdjacencyDetached Description: This notification is generated when an adjacency is detached from the SBC.

Clear Interval: This event is cleared when the adjacency is attached back to the SBC, and the corresponding clear trap is processed in Cisco Prime UOM.


Severity: Critical.

Device Type: Voice Gateway—Border Element.

Event Code: 7037.

Recommended Action: Mitigate the problem that caused the adjacency to become detached.

MOSCQEReachedCriticalThreshold Description: This event is raised when the QOS metric for the Mean Opinion Score Conversational Quality, Estimated (MOSCQE) value crosses the configured threshold and reaches Critical level, resulting in poor voice quality


Severity: Critical.

Device Type: VoiceGateway—Border Element.

Event Code: 7040.

Clear Interval: This event is cleared either if the MOS value returns to normal and a clear trap is received in Operations Manager, or if the MOS score moves to Major or Minor and a trap is received indicating this.

At any point in time, only one of the following events will be active:

• MOSCQEReachedCriticalThreshold

• MOSCQEReachedMajorThreshold

• MOSCQEReachedMinorThreshold

Recommended Action: Check the connectivity and settings in the intermediate routers to rule out the occurrence of jitter, packet loss, or delay, which may impact the MOS.




OL-26364-01


MOSCQEReachedMajorThreshold Description: This event is raised when the QOS metric for the Mean Opinion Score Conversational Quality, Estimated (MOSCQE) value crosses the configured threshold and reaches Major level, resulting in poor voice quality.


Severity: Warning.


Event Code: 7038.

Clear Interval: This event is cleared either if the MOS value returns to normal and a clear trap is received in Operations Manager, or if the MOS score moves to Critical or Minor and a trap is received indicating this.


MOSCQEReachedMinorThreshold Description: This event is raised when the QOS metric for Mean Opinion Score Conversational Quality, Estimated (MOSCQE) value crosses the configured threshold and reaches Minor level, resulting in poor voice quality.




Event Code: 7038.

Clear Interval: This event is cleared either if the MOS value returns to normal and a clear trap is received in Operations Manager, or if the MOS score moves to Critical or Major and a trap is received indicating this.





OL-26364-01


MeetingPlaceMajorSwAlarm Description: Alarms reported by the MeetingPlace Enterprise application.

Trigger: Trap-Based Event.

Traps Processed: All traps received with Major severity.

Severity: Critical.

Device Type: MeetingPlace.

Event Code: 2113.

Clear Interval: Auto-cleared in one hour.

Recommended Action: Each notification includes an integer exception code and an error string which indicates the software module and server reporting the alarm.

For more details on each alarm, see the MeetingPlace alarm and exception documentation for your specific release available at http://www.cisco.com/en/US/products/sw/ps5664/ps5669/prod_technical_reference_list.html




OL-26364-01

http://www.cisco.com/en/US/products/sw/ps5664/ps5669/prod_technical_reference_list.html

Appendix E Events Processed Renamed Events

Renamed EventsTable E-3 contains a list of events renamed in the Monitoring Dashboard in Cisco Prime UOM. Also listed are the old names of the renamed events.

MeetingPlaceMinorSwAlarm Description: Alarms reported by the MeetingPlace Enterprise application.

Trigger: Trap-based event.


Device Type: Meeting Place.

Event Code: 7036.

Clear Interval: Auto-cleared in one hour.

Recommended Action: Each notification includes an integer exception code and an error string which indicate the software module and server reporting the alarm. See the MeetingPlace alarms documentation to find out more about the issue.

ServiceStopped Description: This event is raised when one of the critical services (any of the services in the Detailed Device View) is stopped by the administrator. This event is applicable only for Cisco Unified Communications Manager, Cisco Unified Communications Manager Business edition, Cisco Unified Presence Server, and Cisco Unity Connection.


Trigger: RTMT polling.


Device Type: Cisco Unified Communications Manager, Cisco Unified Presence Server, and Cisco Unity Connection.

Event Code: 7041.

Recommended Action: Identify which services are stopped. You can start the service manually from the Administrator Service Control page. To disable monitoring for a specific service, go to the Detailed Device View, select the specific service, and change the managed state to False.

1. This event is not available out of the box. To activate this pair of events, perform the following steps: (a) Open the NMSROOT\conf\seg\sysLogConfig.xml file. (b) Uncomment the Syslog by removing the lines marked. (c) Restart the SEGServer process.



Table E-3 Cisco Prime UOM Renamed Events

Old Event Names New Event Names

LostContactWithCluster EndPointLostContact, page E-25

StoppedGsuPerformancePolling PerformancePollingStopped, page E-49

MeetingPlaceSwAlarm MeetingPlaceMajorSwAlarm, page E-71


OL-26364-01

Appendix E Events Processed Suppressing or Unsuppressing Events

Suppressing or Unsuppressing EventsYou can suppress the events that you do not want to monitor at the device or global levels. You must use the default event names for suppression.

You can suppress or unsuppress events using the following methods:

• Suppressing or Unsuppressing Events from the User Interface, page E-73

• Suppressing or Unsuppressing Events from the Command Line, page E-76

Cisco Prime UOM has event flood control that reduces the number of events processed until after event flooding has stopped. When Cisco Prime UOM detects a flood of events, it activates event flood control. After the flooding stops, events are processed normally.

For more details on how Cisco Prime UOM manages flooding, see Understanding Event Flooding Control, page E-76.

Note In 8.0, Service Quality event suppression is supported. If you enable service quality events, all service quality events from managed devices other than phones are suppressed.

Suppressing or Unsuppressing Events from the User InterfaceIf you have installed Operations Manager in a directory other than the default installation directory (C:\PROGRA~1\CSCOpx), then you must edit the \bin\suppressevent.bat file to set NMSROOT to the directory where you installed Operations Manager. For example, set NMSROOT=F:\CSCOpx.

To configure events by suppressing or unsuppressing them:

Step 1 Open a command prompt and run NMSROOT\bin\suppressevent.bat.

A list of options appears.

Step 2 Type the letter corresponding to the task you wish to perform. To suppress an event, type A.

A new list of options appears. See Table E-4.


OL-26364-01


Step 3 Enter the managed device name and default event name you want to suppress, if applicable. See Table E-4 for details.

Step 4 Restart the daemon manager from the command line for changes to take effect. Enter:

net stop crmdmgtd net start crmdmgtd

Step 5 To unsuppress an event, type B.

A list of options appears. See Table E-4.

Table E-4 Event Suppression Script Details

Required Data Description

Managed Device Name Enter the Managed Device Name as shown in the Detailed Device View or events displays. To suppress or unsuppress a particular event for all the devices, type ALL.

Event Name Enter the default event name that you want to suppress or unsuppress. Be sure to enter uppercase and lowercase characters exactly as they appear in the event name.

If default event names have spaces in them, enter the event name inside double quotes.

If the default event name is misspelled or capitalization is incorrect, the event will not be suppressed/unsuppressed.

Customized event names cannot be used for suppression. See Table E-2 on page E-3 for the list of event names.

If you enter the event name correctly, future events are suppressed or unsuppressed for the device indicated.


OL-26364-01


Step 6 Restart the daemon manager from the command line for changes to take effect. Enter:

net stop crmdmgtd net start crmdmgtd

Step 7 To view the list of suppressed events, type C.

The list of all of the events that are being suppressed by Cisco Prime UOM is displayed.


OL-26364-01

Appendix E Events Processed Understanding Event Flooding Control

Step 8 To quit the script, type Q.

The command window closes.

Suppressing or Unsuppressing Events from the Command LineYou can suppress or unsuppress events from the command line as follows. Change the default directory based on where you installed Operations Manager.

C:\PROGRA~1\CSCOpx\bin\suppressevent.bat [suppress/unsuppress] DeviceName DefaultEventName

To list the current suppressed events, enter:

C:\PROGRA~1\CSCOpx\bin\suppressevent.bat List

Note Default event names must be used. Event names with spaces in them require double quotes around them.

Understanding Event Flooding ControlWhen Cisco Prime UOM detects a flood of active events, it can reduce the number of active events processed by enabling event flood control. After event flooding stops, the events that were temporarily not monitored are again processed by Cisco Prime UOM.

To understand more about event flood control, see the following topics:

• Event Flooding Rules, page E-76

• Viewing Event Flood Logs, page E-77

Event Flooding Rules

Cisco Prime UOM detects flooding using the following rules. If any of the following occurs, it is considered a flood.

• For a specific device, the same event occurs X number of times in Y number of minutes. The X and Y values are preconfigured in the system and stored in the database. Each event name has its own values.

For example, if an OperationallyDown event occurs for device 10.1.20.2 for Interface I/0 16 times in 2 minutes, then it is considered an event flood.

• For a specific device, the same type of event occurs X number of times in Y number of minutes. The X and Y values are preconfigured in the system and stored in the database. Each event name has its own values.

For example, if an OperationallyDown event occurs for device 10.1.20.2 800 times in 4 minutes, then it is considered an event flood.

• For a specific device, different types of events occur X number of times in Y number of minutes. The X and Y values are preconfigured in the system and stored in the database. The global setting for all devices is 1,000 events in 4 minutes.


OL-26364-01

Appendix E Events Processed Customizing Events

After an event flood is detected for a given event, the subsequent events are not monitored until the device rule indicates that the event flood has stopped. Flood control is performed only for active events. The other event states (Cleared, UserCleared, and Acknowledged) are not considered flooding.

When the event flood is detected in Operations Manager, events get dropped and are logged in to the CSCOpx\log\CUOM\EPM\FloodDroppedEvents.log file. An example of an event that violates the event flood rule appears below:

2009|11:36:18.437|ERROR|Flood|EventBinder|EventFloodController|checkFlood|null|Minute:20762286 Received 28 in last 16 minutes. To suppress la-ccm-11.cisco.com^#!$la-ccm-11.cisco.comServerUnreachable23 Jun 2009|11:36:18.437|ERROR|Flood|EventBinder|EPMPluginImpl|processEventFilteration|null|Flood has occurred for device = la-ccm-11.cisco.com, component= la-ccm-11.cisco.com, eventName= ServerUnreachable, state= Active

An example of a dropped event appears below:

2009|12:16:03.984|ERROR|Event|EventBinder|EventBinder|processNormalizedEvent|null| Event Dropped for component: 172.25.109.221 ; Reason :-> Exceeded limit for eventStatus = Active

For more details about how Cisco Prime UOM handles events during high CPU utilization, see Event Processing for the Events Display During High CPU Utilization, page 4-23.

Viewing Event Flood Logs

During event flooding, check the following files in CSCOpx\log\cuom\EPM for event details:

1. FloodDroppedEvents.log—When events violate the flood control rules an entry appears in this file.

2. EPMDroppedEvents.log—When the events are huge in number and exceed the product limits an entry appears in this file.

3. ClearedDroppedEvents.log—When the events are huge in number, exceed the product limits, and are Cleared events that can't be processed, an entry appears in this file.

For more details on EPM logs update notification, see Notifying Users About EPM Log Updates, page 15-26.

Customizing EventsYou can customize the event description and event severity for any event that is displayed in Cisco Prime UOM. Events that occur after customization will be customized; any events that already appear in displays before event customization took place will continue to use the default event name that was in effect when the event was passed to Cisco Prime UOM.

You

Customizing events is described in the following sections:

• Customizing Event Description and Severity, page E-78

• Restoring Default Event Descriptions and Severities, page E-80

• Customizing Service Quality Event Auto Clear Timing, page E-81

• Viewing Event Customization Log, page E-82


OL-26364-01


Where Customized Event Descriptions Are DisplayedWhen you customize event description, Cisco Prime UOM uses the customized description to process new events.When you customize an event description, the new description is reflected in all notifications—e-mail, SNMP traps, and syslog—and on all user interfaces such as Fault Monitor, Event History, and Personalized Report pages.

Where Customized Event Severity Is DisplayedWhen you customize event severity, Cisco Prime UOM uses the customized severity to process new events. The customized severity is reflected in all notifications—e-mail, SNMP traps, and syslog—and on all user interfaces, such as Fault Monitor, Event History, and Personalized Report pages. Cisco Prime UOM uses only the event severity levels in Table E-5.

When generating traps, the severity level you specify for the event is stored in the CISCO-EPM-NOTIFICATION-MIB and is sent in all notifications.

To restore the default name and severity for any and all events, see Restoring Default Event Descriptions and Severities, page E-80 for instructions.

Customizing Event Description and Severity

Note Default event names and default event severity are displayed on the Event Customization page. However, you can find the same information in Supported Events, page E-3.

To customize event description and severity:

Step 1 Select Administration > System Settings > Event Customization.

The Event Customization page appears, displaying the information shown in the following table.

Table E-5 Event Severity Levels and Values for Notifications

Severity Level

Value that Operations Manager Defines

Value That Operations Manager Writes to Notifications

E-Mail and SNMP Traps Syslog Messages

Critical 3 3 2

Warning 2 2 4

Informational 1 1 6

GUI Element Description/Action

Number column Numbers events serially from one.

Check box column Select to customize an event.


OL-26364-01


Event Code column Code number for the event. This number cannot be changed and is used to map default names to customized names. Sort order

Default Event Name column

Default description for the event. This description is not editable.

User-Defined Event Name column

This is an editable field. For more information, see Where Customized Event Descriptions Are Displayed, page E-78.

Default Severity Default severity for the event. This severity is not editable.

User-Defined Severity column

Select a severity for the event. For more information, see Where Customized Event Severity Is Displayed, page E-78.

Note For default event severity levels, locate the event in Events Processed, page E-1.



OL-26364-01


Step 2 For each event that you want to customize:

a. Select the check box.

b. Enter any changes in the following fields:

• User-Defined Event Name—Enter a new description for the event.

• User-Defined Severity—Select a new severity level.

Step 3 Click Apply to save your changes and apply them.

Restoring Default Event Descriptions and SeveritiesTo restore default event descriptions and severities:

Step 1 Select Administration > System Settings> Event Customization.

The Event Customization page appears, displaying the information shown in the following table.

Step 2 Select the check box for all events or select multiple check boxes for the events that you want to restore to default description and severity.

Step 3 Click Restore Defaults.

Step 4 Click OK when the notification window appears.


Number column Numbers events serially from one.

Check box column Select:

• The topmost check box to restore default description and severity to all events.

• One or more check boxes in rows with events that you want restored to default description and default severity.

Event Code column Code number for the event. This number cannot be changed and is used to map default names to customized names.

Default Event Name column

Default description for the event. This description is not editable.

User-Defined Event Name column

This is an editable field. However, you do not need to enter any changes to restore the default description.

Default Severity column Default severity for the event. This severity is not editable.

User-Defined Severity column

This is an editable field. However, you do not need to select a value to restore the default severity.

For default event severity levels, locate the event in Events Processed, page E-1.


OL-26364-01


Customizing Service Quality Event Auto Clear TimingTo change the auto clear time for all service quality events, use the batch file, changeSQEventAutoClearTime.bat to set the number in minutes.

The batch file is located in C:\Program Files\CSCOpx\bin. Use the following command:

C:\Program Files\CSCOpx\bin> changeSQEventAutoClearTime.bat #

For example:

C:\Program Files\CSCOpx\bin> changeSQEventAutoClearTime.bat 30

changes the service quality events auto clear to update every 30 minutes.

If Cisco Prime UOM is installed in a directory other than C:\Program Files\CSCOpx, you must edit the changeSQEventAutoClearTime.bat file and replace the installed location, in the line 'set NMSROOT=C:\PROGRA~1\CSCOpx'.


OL-26364-01

Appendix E Events Processed Activating Events in Operations Manager

Viewing Event Customization LogAfter you perform event customization using Administration > System Setting > Event Customization, the customizations are logged into the EventCustomizationsAudit.log under NMSROOT\log\CUOM\EPM. You can view the event customization log to review your changes or you can view changes on the Event Customization page.

The format of the log is:

Old event name, old event severity has been customized to new event name, new event severity.

For example:

15 Sep 2010|19:02:48.343|DEBUG|EventCustomization|Thread-10|HighBroadcastRate,Critical has been customized to HighBroadcastRate_new,Critical by admin

You can view more information about this log in Table 20-8, Operations Manager Log Files by Module.

Activating Events in Operations ManagerMost device events are displayed in the user interface after the device has been added to the Cisco Prime UOM database. However, several events are not displayed in Cisco Prime UOM out of the box. You must activate the following events to enable Cisco Prime UOM to display them:

• Hardware Failure

• Number Of Registered Gateways Increased

• Number Of Registered Gateways Decreased

• Number Of Registered MediaDevices Increased

• Number Of Registered MediaDevices Decreased

To activate these events:

Step 1 Open the NMSROOT\conf\seg\sysLogConfig.xml file.

Step 2 Delete the commented lines in this file that appear around the event information that you want to enable:



Step 3 Save the file and restart the SEGServer process.

Adding new SyslogsCisco Prime UOM 8.7 enables you to add unsupported syslogs. You must provide the exact syslog name. You need to get the exact syslog details from the device before you use it in Cisco Prime UOM.


OL-26364-01


You can set the severity and the time by which the syslog must be cleared.

We recommend that you do not add syslogs that are likely to create an excessive load on Cisco Prime UOM due to a possible flood of syslogs.

The syslog name you enter is taken as the event name.

We recommend that do not add not more than twenty syslogs.

To add syslogs:

Step 1 Go to Administration > System Settings > Syslog Support.

The Syslog Support Summary window is displayed.

Step 2 Click Add.

The Add Syslog Support window opens. Enter the following:

• Syslog Name

• Event Severity

• Event Clear Interval

Step 3 (Optional) Check the Raise an event for each syslog occurrence check box.

Caution Use this option judiciously. Cisco Prime UOM raises an event for each syslog. If syslogs are raised with unique details each time, this will be a feasible option.

Step 4 Click Add.

You can:

• Use the Edit option to change the Event Clear interval.

• Customize the syslog name or event severity. To do this, go to the Event Customization page. See Customizing Events, page E-77 for details.

• Use the Delete option to remove the syslog you added.


OL-26364-01



OL-26364-01

Date post:	13-Mar-2018
Category:	Documents
Upload:	vongoc
View:	255 times
Download:	7 times

Events - Cisco User Guide for Cisco Unified Operations Manager 8.6 OL-26364-01 APPENDIX E Events...

Documents