|
|
Cisco Info Center is a fault management system that provides a consolidated view of enterprise-wide events and status information. It collects event streams or messages from many different data sources and presents a single, consistent view of the current state of all Cisco Info Center managed systems. It distributes the event information to the operators and administrators responsible for monitoring service levels.
This information can then be:
Cisco Info Center is an OEM product jointly developed by Cisco Systems, Inc. and Micromuse, Inc. Cisco Info Center 2.0 is compatible with Release 3.4 of Micromuse Netcool/Omnibus.
Cisco Info Center comes with a set of network event views that allow you to monitor a variety of Cisco hardware and software:
In addition, by adding customized processing rules files and data probes (Info Mediators) you can monitor other devices as required by the needs of your enterprise.
Cisco Info Center allows diverse management platforms, applications, and Internet protocols to be brought together to provide the administrator a single point of monitoring those platforms and applications. Cisco Info Center does not replace the management platforms. It instead compliments them by providing an enterprise wide event/fault and status exchange. Cisco Info Center can also tie together domain limited network management platforms in remote locations.
Cisco Info Center manages network events by collecting them in a high performance distributed database and presenting event information to users through customized filters and views. Once a view has been defined, the Cisco Info Center software consolidates all events that match a defined filter into one single event. This process is called event deduplication. Using deduplication, events from single or multiple Cisco WAN Manager hosts, for example, can be consolidated into one unified event.
By consolidating multiple events that represent symptoms of the same or related network faults into one event, Cisco Info Center reduces the volume of network and alarm messages. This frees network operators from having to look at masses of SNMP messages and other events to analyze the network.
Once an event is received, it is broken down into data fields and the CIC interface allows the operators to view the events that have been consolidated into a unified event.
Events can be received from existing network management systems and relayed to other systems. This allows CIC to utilize existing management skills and minimizes deployment time and also allows state information from existing management systems to be disseminated to staff across the enterprise.
Utilizing a rules file scripting language, users can create their own customized views of network data. Custom views can organize events according to the type of hardware generating the event, network or geographical location, type of fault, or any other criteria that they wish to use.
The main interface for Cisco Info Center provides an easy to use event list display that can be customized to display events in different colors or display attributes depending on severity or on other characteristics. In addition, an optional Java based Event List is available that provides a Web-based view of events
Cisco Info Center allows you to set up multiple servers (Cisco Information Servers) and multiple administrative desktops. Events can be transmitted to multiple sources through gateways, called Information Gateways. Thus if one server of administrative desktop goes down, operators back-up servers and admin desktops ensure that network monitoring can continue without interruption.
Cisco Info Center includes administrative features that allow you to control what users and user groups can access different parts of the system and view specified events. This improves network security and prevents unauthorized monitoring of the network.
In addition, Cisco Info Center includes a journal facility that allows you to maintain an audit trail of actions taken to correct network faults.
Cisco Info Center is supported on the following platforms:
Sun Microsystems SPARC-based Solaris 2.6 or Solaris 2.7.
Cisco Info Center supports the following user interface environments:
This section describes the components that comprise the Cisco Info Center architecture. Typical Cisco Info Center components are:
The Cisco Info Server is an active, main-memory database. It consolidates, associates, and normalizes event data from the probes and monitors, assigning events to tables and fields. Repeated events are automatically de-duplicated using an identifier field. All application functions are active threads that run within the database engine.
The Cisco Info Server transforms events, such as faults, alarms, and warning messages, into alerts that can be easily manipulated by operator-driven correlations, associations, and filters. This also allows the creation of logical service groups, which can include end-to-end applications, VPNs, departments, or business units. This process produces accessible, meaningful information on the status of any component or group within the network. Another key advantage of the Cisco Info Server is that it allows all events throughout the enterprise to be simultaneously viewed by multiple authenticated network operators and users.
The Cisco Info Server is optimized for the handling of large volumes of faults, which is essential for networks where thousands of alarms may arrive each second. It currently runs on Solaris. Wherever possible, the Cisco Info Server exploits the underlying operating system's ability to support parallel processing or multi-threading.
The Cisco Info Server obtains alarms and events from isolated management environments. It then isolates the fault, allowing actions to be taken by technicians, help desk systems, or other applications. It also allows an SNMP trap to be created from the fault information that can then be forwarded to an SNMP management platform (for example, HP OpenView).
Upon receiving a record of a fault in a device in the network, the Cisco Info Server automatically applies a sequence of rules to determine the impact of the fault. The impact is calculated in the context of all information that has been collected on the network, including other faults and connectivity information. The configuration of the rules system within the Cisco Info Server is achieved with the implementation of SQL as a declarative language. A suite of graphical drag-and-drop configuration tools hide the SQL for non-technical operators. In addition, the rules engine isolates the events of immediate concern within the network. When combined with the Cisco Info Admin Desktop tools, this allows for the managing of faults to meet business objectives.
The Cisco Info Server can, with the Automation subsystem enabled, automatically start up processes to respond to specific events. This mechanism is controlled by database triggers and actions.
The triggers and actions are configured through a GUI tool. Triggers call actions when there are state changes or when specific events occur. The action may be a change to the in-memory status table or the running of external processes. The Automation subsystem uses Cisco Info Center SQL to allow for correlations of events.
The types of tools linked into the Cisco Info Center menus include:
Future tools provided by Cisco can be added into the existing management environment without recompilation or reinstallation. Tools developed by users can also be easily integrated into a number of menus through the GUI.
Info Mediators are non-intrusive software listeners that identify and collect SNMP MIB and non-SNMP events and data. The events are normalized into a common alert format. Then, using a connection-oriented transport protocol, the data is forwarded into the Cisco Info Server.
Info Mediators allow operators to collect and interpret information from disparate network management consoles, transmission infrastructure, telephony devices, data networks, LANs and WANs, and applications.
The Info Mediators supplied with Cisco Info Center can collect events and traps from:
Info Mediators are also available that can collect MIB information from switches and routers from vendors, including Bay Networks, Cabletron, and N.E.T. There are also Info Mediators for CMIP, ASCII, TL1, and industry-standard UNIX. For a complete list of the Info Mediators that are available with Cisco Info Center 2.0, refer to Appendix A of the Cisco Info Center Mediator and Gateway Reference, "Additional Info Mediators."
 |
Note For detailed information on the Info Mediators and data sources used with Cisco Info Center, refer to Chapter 3, "Info Center Mediators and Event Receivers," in the Cisco Info Center Mediator and Gateway Reference. |
Info Mediators collect network and system events using rules and look-up tables to define, categorize, and add information to events. They also have standard system properties that control how and where to store data. Info Mediators have a different superset of executable functions depending upon which network management platform they are designed for.
The design of the Info Mediator mechanism allows the software to be installed quickly and to become operational immediately. It is based on the exclusive management paradigm, which enables Info Mediators to recognize all faults from the managed system without requiring user configuration. It also allows user customization of the Info Mediator behavior. Info Mediators can also be configured, using a sophisticated rules engine, to filter and translate certain data.
The Syslog Trap Generator (STG) is a Cisco Info Center component that receives Syslog messages from IOS devices, converts them to SNMP traps, and forwards them to Cisco Info Center through the RTtrapd Info Mediator. Once you have installed the STG, you can monitor layer-3 routing events in addition to the layer-2 switching events monitored by CIC.
You must install the STG component if you will use the Cisco Info Center Policy Manager application to monitor events from the Cisco MPLS VPN Solution product. You may also install it to receive layer-3 routing events from devices such as the Cisco 3810 multiservice access concentrator.
You can install the STG on the same host with the Cisco Info Server, or on a separate host.
|
Note If you are using Cisco WAN Manager, do not install the version of the STG that comes with Cisco Info Center. Cisco WAN Manager uses an internal version of the STG and does not require installation of the STG through the CIC installation program. |
Cisco Info Center 2.0 includes an option called Policy Manager that acts as a data source for Cisco Info Center. Policy Manager queries Cisco's MPLS VPN Solution product, an application that allows service providers to define and monitor virtual private networks (VPNs), for VPN and customer network information and uses this information to supplement events that are received from IOS devices to indicate the state of routers used to manage the VPN.
A VPN is a network in which two sites communicate over the service provider's network in a private manner---no site outside of the VPN can receive or transmit packets on the "private" route. This allows service providers to provide specialized, secure intranet and extranet services to customers.
Service Providers use Cisco MPLS VPN Solution to configure two types of routers that enable deployment of VPNs:
By establishing and maintaining unique routes between CEs and PEs, service providers can provide hundreds of thousands of VPNs to their customers.
Figure 1-1 shows the general network topology for VPNs created using PEs and CEs.
You should run Policy Manager on the same host as the Cisco Info Server. Before you can use Policy Manager, you must install the Cisco MPLS VPN Solution product on one or more hosts.
|
Note For more detailed information on how Policy Manager works with Info Mediators, refer to the "Policy Manager" section in Chapter 3 of the Cisco Info Center Mediator and Gateway Reference. |
One of the most significant functions of an Info Gateway in network partitioning is its ability to support the real-time filtering and distribution of faults and events. The discriminators within the Info Gateways facilitate the creation of customized views of the network, whether for VPN or CNM applications. Events relevant to a specified partition can be passed through an Info Gateway to another Cisco Info Server, thus allowing operators or customers a view of what they're allowed to see, as defined by an administrator. Graphical views reflecting the state of services and/or resources defined within the partition help to present a more concrete picture.
Cisco Info Gateways only distribute partitioned event and alarm information; the Cisco Info Gateways cannot be used to distribute performance or accounting statistics.
An unlimited number of Cisco Info Servers can be connected together using Info Gateways, providing a scalable SLM environment. Cisco Info Server Info Gateways can monitor the changes within other Cisco Info Servers, sending appropriate updates to the central application.
Cisco Info Servers can be linked as follows:
An example of an RDBMS gateway deployment is the Info Gateway to Sybase. This gateway allows historical reporting using a two-phase-commit function, which ensures data integrity between the Cisco Info Server and the Sybase RDBMS. Statistical analysis of Cisco Info Center event archives can then be carried out directly from the RDBMS. This allows operators to create detailed reports on the availability of the network or services over a period of time.
Examples of trouble ticketing and help desk gateway deployment are the Peregrine Service Center and Remedy AR systems. The Service Center and AR gateways are bidirectional gateways that allow trouble-tickets to be created. Trouble-ticket creation is controlled from the Cisco Info Center Desktop tools. Faults can be consolidated, filtered, correlated, and isolated, then created as trouble-tickets that are sent to the counterpart systems. The Info Gateways create records within the counterpart systems and add the ticket number to the event record. The event can then be acted upon by the help desk operators. This allows fault reporting without direct access to Cisco Info Center. The trouble-ticket number is returned to the Cisco Info Server to update the creation record. Trouble-ticket status can be updated in Cisco Info Center when it has changed in the counterpart system. When the fault is closed in either the counterpart system or Cisco Info Center, it closes in both databases.
The Process Control system elements allow for a single point of control and administration of distributed systems. The Process Control agents cooperate automatically and have memory for their configuration. Process Control agents start remote processes and are capable of keeping those processes running. When a managed host is restarted, the Process Control agent restarts local components automatically. Any changes to the configuration are automatically replicated to all hosts in the configuration.
Cisco Info Admin Desktop information can be viewed from a UNIX/Motif front-end or a Java-driven Web browser. Event information is delivered in a format that allows operators to quickly determine the availability of services on a network. When an event cause has been identified, vendor-specific configuration tools allow operators to resolve problems quickly.
Cisco Info Admin Desktops provide two ways to view events: color-coded Event Lists and an Objective View mapping facility. The available graphical tools eliminate the need to manipulate text files to perform tasks. It is also possible to define tools that launch other commands.
Three categories of Cisco Info Admin Desktops exist. They are:
Tools available to all operators are the Filter Builder, View Builder, and Browsers. The tools available only to administrators and super-users are the Configuration Tool, the Objective View map editor, and the Automation Builder.
For normal operators, desktops act as the point of access to the event information stored in the Cisco Info Server. For administrators, the Cisco Info Admin Desktop functionality allows for the visual configuration of the Cisco Info Server, and operator desktops. Administrators also have access to graphical configuration editors. Through the configuration editors, complete Cisco Info Center configurations and components can be designed and deployed. They can implement the Cisco Info Center high-availability process control and multi-tiered security access.
Cisco Wave is a set of HTML pages and Java applications that allow you to create Web pages, event views, and Web-based map pages for Cisco Info Center users. Cisco Wave includes the following features:
For detailed information on the Cisco Wave application, refer to the Cisco Info Server Administrator Reference.
There are three standard client desktop applications for Cisco Info Center: the Conductor, the View Builder, and the Event List. These applications attach to a Cisco Info Server and allow you to view the current state of the in-memory database, which in turn, reflects the status of the objects being managed.
These tools can be used by normal users, administrators, and super-users.
The Conductor is the desktop entry point for the Cisco Info Center system. It allows you to open the other client applications and to display configurations. Example configurations include filter or view files for the Event List or map files for the Objective View, as shown in Figure 1-2.
The buttons at the top of the window provide quick access to the other tools; the Event List, Filter Builder, View Builder, Browser, Map Editor, Automation, Configuration, Interfaces, and Properties tabs. The two left-most buttons in the figure shown above, allow automatic start-up of the files that are present. The Personal Library region displays icons of your own configuration files.
This tool displays a filtered view of alerts. The color-coded alerts are displayed in a scrolling list. You can set up multiple Event List clients, each with different priorities and filters. You can also use the Event List to re prioritize events and to assign or reassign problems to other users. When an alert has been assigned to a user, they can acknowledge they are working on it, or conversely, de-acknowledge it so it can be picked up by another user, as shown in Figure 1-3.
Instant summaries of alert states are provided through Monitor boxes. With a single click, you can display full details.
Configurable views and filters provide the information you need in an easy-to-use Event List, shown in Figure 1-4.
The Filter Builder allows you to create complex graphical queries on the state of managed objects, as shown in Figure 1-5.
The top pane displays the query in a graphical tree display. Immediately below the tree are the Filter buttons. The bottom pane shows the SQL query and the Metric buttons below the query provide summary information associated with each filter.
The View Builder allows you to create graphical views of the state of managed objects, as shown in Figure 1-6.
Modifications to the view are instantly visible in the Display Columns pane near the top of the window. The Column Details region in the center of the window shows width justification and title. The Sort Columns controls at the bottom of the window allow you to sort any column, including columns that are not displayed.
The Objective View is a point and click tool for browsing through the managed objects. It allows you to browse managed objects in a hierarchical fashion and see alerts or state changes. The Objective View can also launch other applications, such as the Event List or the console of an underlying management system, as shown in Figure 1-7.
The Objective View Map editor displays a library of available maps through the Map Page window, as shown in Figure 1-8.
Graphical maps also provide access to third party tools. Advanced entity mapping allows for service level maps as well as device level maps.
Triggers, represented by icons on the left, detect states in the system and call actions. Actions, represented by the icons on the right, can modify the internal alert database, or run programs on other machines in the system, to respond to events.
Associations between triggers and actions are shown graphically, by arrows.
For ease of configuration, the following administrator client applications are provided with Cisco Info Center:
The following sections provide a brief overview of several of the administration interfaces. For detailed information about how to use the interfaces, see the Cisco Info Center Administrator Reference.
The Configuration Manager window (shown in Figure 1-9) allows the administrator to define graphically how the Cisco Info Center system should be configured. The Configuration Manager then updates the Cisco Info Server, distributing the information to Cisco Info Center nodes.
Windows are used for selecting icons and images; no editing of hidden command files, only scroll and select.
The Configuration Window includes the following tabs, which allow administrators to perform a variety of administrative tasks:
The Automations tab on the Configuration Manager Window displays the automations that are provided with Cisco Info Center and allows the administrator to modify existing automations or add new ones. For example, and automation can be set up to delete all events from the system that have a severity of clear and have been in the system for longer than a specified period of time.
The Users tab simplifies the management of users and groups that have access to the Cisco Info Center system, and allows the administrator to define what privileges those users have. The Users tab also provides a reference list of all the known users in the system, as shown in Figure 1-11.
The Objective View allows for a wide range of visual objects and filter interaction. To make the development of these maps easier, the Objective View editor allows the administrator to create these maps as if they were using a structured drawing package, as shown in Figure 1-12.
You can use the Map Editor to create new maps. You can use the Symbol Inspector (shown in Figure 1-13) to allows you to select individual components to be added to your map.
You can create multi-layered maps with a wide range of supported graphics. Figure 1-14 shows an example of a map displayed by the Map Editor.
All Cisco Info Center tools have a Help menu with a standard set of options. Table 1-1 shows the Help menu options.
| Menu Items | Short-cut | Action |
On Context | Shift+F1 or Shift + Help | Changes the mouse pointer to a question mark. You can then click on any element of the tool you are interested in. The tool then calls the Help system and provides appropriate Help. |
On Help |
| Calls the Help system to display Help about using the Help system. |
On Keys |
| Calls the Help system to display information on the keyboard short-cuts available for the tool. |
Index |
| Calls the Help system to display an index of Help pages available for the current tool. |
On Version |
| Displays an About window with information on the version number and other relevant details. |
Throughout the system, Help buttons are available on most windows. These buttons display a relevant overview of the current window.
The Java Event List for Cisco Info Center allows for the distribution and management of Cisco Info Center events through the World-Wide Web (WWW). With the backend process installed, Java applets can connect to the Cisco Info Server. These applets are configured in the HTML page by the administrator, providing you a range of facilities. Any operation which requires traceability also requires authentication, which is validated against the Cisco Info Center user database, as shown in Figure 1-15.
Users of the Java Event List can, when the Web administrator allows them, do the following:
The following sections contain some examples of how Cisco Info Center component configurations can be designed and deployed.
The following section describes each of these configurations.
This architecture includes the Cisco Network Node Manager (NNM) Mediator and RTTrapd Info Mediator (installed on single or multiple CWM hosts) collecting data from the HP Network Node Manager application and the CWM application. The connectivity between the architecture components is shown in Figure 1-16.
This architecture includes the Syslog Trap Generator and the RTtrapd Info Mediator running on one or more UNIX hosts to collect information from IOS devices on the network. Figure 1-17 shows this configuration.
Use this architecture for layer-3 devices such as the Cisco 3180, the DSL 6xxx series, and the Cisco 7200 series.
This architecture includes the Policy Manager application running on the same host as the Cisco Info Server, the Syslog Trap Generator and the RTTrapd Info Mediator running on a separate host, and the Cisco MPLS VPN Solution application running on another host. Figure 1-18 shows this architecture.
Cisco Info Center allows configurations where two or more Cisco Info Servers communicate through an Info Gateway, with the Cisco Info Admin Desktop tools viewing system activity on either side. The connections between the architecture components are shown in Figure 1-19.
The enterprise-wide array of tools may require you to integrate more than just management platforms. The architecture of Cisco Info Center allows for this. In the example shown in Figure 1-20, the system is extended and its functionality includes supporting help desk users, other SNMP systems, and network management reporting. The connections between the architecture components are shown in Figure 1-20.
When patterns of behavior and appropriate actions have been identified, an Cisco Info Server's built-in Automation system can be configured to detect those patterns and execute the required actions. These actions may include automatically updating the Cisco Info Server (for example, when a critical object has an alert cleared, clear all associated alerts) or sending messages to the Process Control system which will then attempt to run a task on a specific target machine or machines. The tasks executed can include paging system operators, generating logs, running software to correct faults, or triggering audible alerts on appropriate stations. The connections between the architecture components are shown in Figure 1-21.
In the busiest enterprise networks, the Cisco Info Center architecture allows the arrangement of a number of Cisco Info Servers to act as a single entity. Figure 1-22 shows three Cisco Info Servers connected through an Info Gateway configuration. Each Cisco Info Server is connected with a bidirectional Info Gateway to the other Cisco Info Servers. The same Info Gateway allows for the historical logging of alerts to a Sybase database system.
Figure 1-22 shows a geographically distributed system and is one example of the distributed management configurations that can be designed and deployed using Cisco Info Center.
Figure 1-23 illustrates multiple Cisco Info Servers deployed at the Service Provider and customer sites, supporting the CNM capability. Figure 1-23 also provides an example of some CNM desktops developed with the Cisco Info Center system. The Administrative tools allow for custom creation of maps to reflect service-oriented views, which can then be distributed using the architecture shown in the example. The maps are developed using the Objective View editor.
Posted: Tue Jun 13 16:33:00 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.
