Event Browser

The Event Browser provides a tool to manage the network efficiently; you can list, query, and sort all or some events according to how you want to manage the network. Services can be invoked on events so faults can be attended to from the window that shows the event.

Note You can also view events on Cisco EMF maps, however, only the most severe fault on a managed object is shown on the map icon.

More than one Event Browser session can be open to a user at any one time, if they have different queries specified. All users can see any event. In the Event Browser window, you can acknowledge that a particular event is one that you are going to deal with and all other users will see that the event is being handled. When the event is cleared, it is shown in the Event Browser window, so other users know that the event requires no further attention.

When an event is received, it is shown as active and unacknowledged (the two indicators are shown as grey). At this stage, no one has taken responsibility to deal with it. You may not want to receive all events on the system, so a query can be set up using the Cisco EMF Query Editor to view specific events.

Access to the Event Browser is set up in Access Control (refer to "User Access Control," for more information.)

Launching the Event Browser

The Event Browser application is launched using the
icon in the Cisco EMF Launchpad window. The Query Editor window is displayed.
Refer to the "Query Configuration" section. Set your query (the Event Browser will display events that match the query criteria), or from the pop up menu available when you right click on one or more objects in the Map Viewer (the Event Browser will display only the events associated with the selected objects), or from other Cisco EMF applications, select the Event Browser option from the pop up menu available when you right click a selected object.

Note It is a good working practice to set up one or more Event Browsers to monitor the network during a work period. For example, you may want to set up different queries to look at particular devices on the network. Minimize the windows when using other applications in Cisco EMF; this maintains any Event Browser configuration and ensures an overall view of the network is maintained.

The Event Browser Window

The main panel in the Event Browser window displays a list of events including:

Object name (this is the managed device's name)
Time the event was raised
Severity of the event (color-coded), refer to the "Severity Colors" section
Description of the event.

Two indicators, color coded to the severity of the event, are available to the left of the object name:

Clear (an indicator to show if an event is active or cleared)
Ack (an indicator to show if an event is acknowledged or unacknowledged).

You click the Ack button to indicate to other users that the fault is being worked on. The button changes to the color of the severity, in this case, red. If for any reason you cannot clear the problem, this button can be de-selected so the event can be re-assigned. The Clear button is selected when the fault has been rectified to indicate the event requires no further attention.

Note The option to unacknowledge an event is only available to an administrator or the user who acknowledged the event initially.

Figure 6-2: Event Browser Window

Menus are available which provide you options for modifying the way the information is displayed. From the Edit menu, you can:

Set up the Event State (Clear Events, Acknowledge or Unacknowledge Events)
Set up queries to specify the events you want to see
Set up sort options to present the events in the order you desire.

From the View menu you have the following options to manage the way events are viewed on each object:

Use Auto or Manual Update
Set the Color Coding
View the Event History window
Refresh the Event Browser window
Display the Full Object Name
Select Full Name Options.

The Full Event Description window allows you to view the status of a selected event. For more information, refer to the "Full Event Description" section.

Clicking on an event severity, name, time, or description selects that event. One or more events can be selected; this gives the opportunity to perform bulk operations. With one or more events selected, clicking the right mouse button displays a pop up menu which shows the common services available on those events.

The Event Browser window also displays other information in the status bar:

Progress bar (indicates events are being added to the display)
Current Update status (this can be auto or manual)
Current query
Current sort order, for example, sort by time
Total number of events displayed (this number is shown in blue until it is acknowledged by the user by clicking on the number).

In the Event Browser, you can use Print to save the contents of all or part of the browser to a file or to print a paper copy.

Query Configuration

The Event Browser monitors all events on all devices. To work efficiently, you may want to specify the objects on the network you are concerned with. The Event Browser gives you the option to do this through queries which can be configured to match your requirements. With queries you can choose to include or exclude devices or criteria. For example, you could choose to monitor a particular device, specify a time period, and choose to look only at events which are warnings or critical. You define a query so that the Event Browser only displays the events that meet the criteria you defined. Refer to "Managing Objects in Cisco EMF," for more information.

Note Any changes made to the queries are not stored after exiting the Event Browser.

Opening the Query Editor

To define a query, click on the
icon in the Cisco EMF Launchpad window, or

in the Event Browser, select the Edit menu's Query Setup option, or

click the Query Filter icon
from the Toolbar.

The Query Editor window, similar to Figure 6-3, is displayed. The criteria which can be used to specify a query are available on individual tabs. Values or criteria can be selected on each tab. A dark gray tab is active (On) and its query is used in the Event Browser. A light gray tab is inactive (Off), its query is not used.

Figure 6-3: Query Editor Window

The Query Editor is split into tabbed sections. Scroll through the tabs to see the following options:

Severity
Time
Event Status
Source Domain
Mgmt Domain
User
Event Class
Object Scope
Object Class
Object Attribute Presence
Object Attribute Value.

The Query Editor is described fully in "Managing Objects in Cisco EMF."

The Event Browser is updated with events that match the query criteria. A progress bar indicates Cisco EMF is querying for events and the window is being updated. The total number of events displayed is shown in blue until you acknowledge it by clicking on the number.

Sorting Options

Query Editor configuration allows you to specify the events you want to see. Sorting gives you options to change the order in which you view the events which match your query criteria.

Setting up Sort Options

From the Edit menu, select Sorting Options. A drop down menu is displayed listing the available sorting options. An indicator shows which option is selected. Selecting an option causes the Event Browser display to change to show the appropriate information. The sort option selected is shown in the status bar. You can sort by:

Time---shows the most recent event first
Event Class---allows you to sort event classes
Event State---if the query is set up to show all states, this option shows events in the following order:
- Unacknowledged/Active
- Acknowledged/Active
- Cleared/Unacknowledged
- Cleared/Acknowledged.
User---sorts by the user who cleared the event or the user who acknowledged the event
Managed Object---sorts by the name of the managed object on the network

Note

Severity
--- if the query was set up to show all severities, this option shows events in the following order:
- Critical
- Major
- Minor
- Warning
- Normal
- Decommission
- Informational.
Source Domain---is a unique name which represents the physical domain on the network an event comes from
Mgmt Domain---Management Domain is a sub-division within a Source Domain.

Managing Events

When the Event Browser shows a sorted list of events which match the query criteria set, you can start to manage those events. This is the place to acknowledge an event, which shows you have taken responsibility for managing that event. If you cannot continue to manage an event, it can be unacknowledged and then becomes available to other users.

Note The option to unacknowledge an event is only available to an administrator or the user who acknowledged the event initially.

When the fault has been rectified and the event requires no further attention, clear the event. It is then removed from the Event Browser.

Three methods are available for managing events:

1. Two indicators (Clear and Ack) are available to the left of the object name. Select or deselect the indicator associated with an event in the Event Browser window.

2. Use the Edit menu.

3. Right click on a selected event(s) to display a pop up menu of options available on that event(s).

Clicking on an event severity, name, time, or description selects that event. One or more events can be selected; this gives you the opportunity to perform bulk operations.

Managing an Event from the Window

Step 1 To clear the event, select the indicator associated with the event or select the object and click the Clear Events icon
on the Toolbar. This displays the

Events Clearing window. Enter the reason for clearing the event, then click Apply to save or Cancel to exit the window without saving. The indicator changes to the new color of the severity of the event.

Step 2 Select the Ack indicator to Acknowledge an event. The indicator changes to the color of the severity of the event. To Unacknowledge an event, select the Ack indicator which is then shown as deselected.

Note

"User Access Control."

Managing an Event from the Menu Bar

From the Edit menu you can select the Edit Event State option. A drop down menu is displayed, which provides options to manage the events.

Clear Events---allows you to clear the event. When you select this option, the Events Clearing window is displayed. Enter a reason then click Apply to save the details or Cancel to exit without saving.
Acknowledge Events---allows you to acknowledge an event
Acknowledge Events with comment---allows you to record a reason for acknowledging an event. When you select this option, the Acknowledge Events window is displayed. Enter a reason then click Apply to save the details or Cancel to exit without saving.
Unacknowledge Events---allows you to unacknowledge an event.

Note This option is only available to the user who acknowledged the event or a user with administrator access (refer to "User Access Control.")

Auto or Manual Update

Auto Update is the default state and allows you to view incoming events which are automatically updated in the window.

The status box displays the current update state; either Auto or Manual. If Auto Update is enabled, the status box displays Auto Update.

When the update state is Manual (Auto Update is disabled) you should refresh the window at regular intervals using the View menu's Refresh option or the Refresh icon
so that new events are displayed.

Enabling Auto Update

From the View menu, select Enable Auto Update. The message in the status box changes to Auto Update.

Note If an indicator is displayed on the pull down menu, to the left of Enable Auto Update, the Auto Update application is enabled.

Enabling Manual Update

From the View menu, de-select Enable Auto Update.

Note The message in the status box changes to Manual Update.

Setting Color Coding

Three color coding options are available to you. The color you choose depends on the severity of the event (refer to the "Severity Colors" section.) The options are as follows:

Full Color Coding---when this option is selected, the severity information displayed has text on a colored background
Partial Color Coding---when this option is selected, the Severity column is colored. The color of the column depends on the severity of the event
No Color Coding---when this option is selected, text only is displayed in the Severity column.

Selecting the Type of Color Coding to be Used

Step 1 From the View menu, select Set Color Coding.

Step 2 From the menu that appears, select one of the options.

The selected option is implemented immediately.

Event History

Event history allows you to display any events that match the current query criteria and have had their state changed, either acknowledged, cleared, or unacknowledged. This is disabled by default. To view this information, select the View menu's Event History option.