|
|
This chapter describes how to configure the Event Manager.
All components of the Cisco ICS 7750, the System Manager, and the Windows 2000 operating system create system messages to inform, warn, or alert the system administrator about system status. These messages are stored in a database called the Event Log, controlled by the Event Manager.
The Event Manager can be configured to initiate one of several actions when specific types of events are received. This is done by defining Event Manager rules.
Using the Event Manager, you can do the following:
The Event Manager page is shown in Figure 5-1.
The Live Viewer page displays system messages as they are received by the Event Manager. It contains a table that displays each message as a single row. You can sort the messages by field by clicking the field name at the top of the column. The Live Viewer page is shown in Figure 5-2.
To start receiving events, do the following:
Step 2 Click RcvLiveEvents (at the bottom of the viewer page). To stop receiving events, click StopLiveEvents.
The fields in the Live Viewer page are described in Table 5-1.
| Field Name | Description |
|---|---|
Date | Date the system message was received. |
Time | Time the system message was received. |
Facility | A code consisting of two or more uppercase letters that indicates the facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software. |
Severity | Severity of the message. This is a number from 0 to 7 that is translated into a textual description. The lower the number, the greater the severity of the message. |
From | IP address of the device sending the message. |
Body | Text of the message. |
Sent Date | Date the message was sent (optional). |
Sent Time | Time the message was sent (optional). |
Cisco Facility | A code consisting of two or more uppercase letters that indicates the facility to which the message refers (optional). A facility can be a hardware device, a protocol, or a module of the system software. |
Cisco Subfacility | A code consisting of two or more uppercase letters that indicates the subfacility for Channel Interface Processor (CIP) messages (optional). |
Cisco severity | Severity of the message (optional). This is a number from 0 to 5 that is translated into a textual description. The lower the number, the greater the severity of the message. |
Cisco mnemonic | A code that uniquely identifies the error message (optional). |
The severity field and Cisco severity field values are described in Table 5-2.
| Severity Value | Description |
|---|---|
0 | Emergency |
1 | Alert |
2 | Critical |
3 | Error |
4 | Warning |
5 | Notice |
Use the General Policy page, shown in Figure 5-3, to define the maximum size of the event log. You can also use this page to view the event log space usage.
To modify the general policy information, do the following:
Step 2 Enter the data as described in Table 5-3.
| Field Name | Description |
|---|---|
Maximum Log Size | Maximum size, in kilobytes, of the event log. This option limits the size of the event log, but it cannot be set larger than 5 Mb. The maximum number of messages that the event log can store is limited by the maximum kilobyte size entered. |
Current Log Space Usage | Event log space expressed as a percentage of the maximum size. |
From | E-mail address of the person generating the report. |
From Name | Name that corresponds to the e-mail address of the person generating the report. |
Email Server | Name of the e-mail server for the person generating the report. |
Email Forward Setting | Selection for either the hostname or the IP address of the Syslog server to receive the message. |
Page Setting | Phone number to be paged. |
Syslog Message Information | Fields displayed in reports. |
Delimiter Setting for Exporting Report | Reports exported to a text file are delimited by character the selected. If the standard delimiting character is not acceptable, enter a character in the Other field. |
Event Manager rules consist of two parts: conditions and operations. When the Event Manager receives a system message, the message is compared to the conditions defined in the rules. An event rule executes an action (operation) when the conditions of that rule are met.
For example, you might want the system to send you e-mail for a message with the severity of `ALERT' or lower (more urgent). You would define a condition that says, "if severity <= ALERT, send a page."
To display the custom rules under Rules, click the Custom link. The Custom Rules page appears, as shown in Figure 5-4.
Each row in the table represents one rule. The fields are defined in Table 5-4:
| Field | Description |
|---|---|
Title | Names of the rules. |
Conditions | Conditions that define each rule. |
Operation | Action to be taken with the rule conditions are met. |
Edit link | Displays the Edit a Rule page that you can use to edit a specific rule. |
Delete link | Deletes the rule from the table. |
Rules are resolved to create a true or false flag. When the flag is true, an operation, such as sending an e-mail message, is executed.
To add a custom rule, do the following:
Step 2 Click Add a Rule to display the Add a Rule page, as shown in Figure 5-5.
Step 3 In the Please enter a rule name field, enter the name of the rule.
Step 4 Click Submit to display the Rule Conditions page, as shown in Figure 5-6.
Step 5 Select the field on which this rule is based from the drop-down Field list. The available options are the same as those listed in Table 5-1.
Step 6 Select the operator from the drop-down Operator list. Operator compares the field value to the parameter listed in the Value column. Possible operators are as follows:
Step 7 Click Click to display the values that apply to the selected field, and select a parameter.
 |
Note In some cases, such as when the condition involves the Body field, the Click button is inactive, and you must enter the value in the Value field. |
Step 8 Click Submit to establish the condition. The Rule Operation page appears, as shown in Figure 5-7.
Step 9 Optionally, click Add a Condition to add another condition.
Step 10 If this is the second condition entered, click the And or Or radio button for this rule to appear under the Operator heading.
When you add a second condition, an option to And or Or the conditions for this rule appears. If you And the conditions, all the conditions must be true before the operation is executed. If you Or the conditions, only one of the conditions must be true to execute the operation.
Step 11 Select the operation to be executed when the conditions of the rule are met from the drop-down Operation list. Possible actions are
Step 12 Click Configure to choose the parameters for the operation, such as e-mail address information or a telephone number to page. Figure 5-8 through Figure 5-10 show the configuration windows. Note that Drop does not have a configuration window associated with the parameter.
The Email Address page, shown in Figure 5-8, lets you configure e-mail parameters to send e-mail when the conditions of a rule are met by a system message.
The Email page contains the following fields:
Field Name | Description |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Use the Page page, shown in Figure 5-9, to configure paging parameters to send a page when a system message meets the conditions of a rule.
The Page page contains the following fields:
Field Name | Description |
|---|---|
|
|
|
|
Use the Forward page, shown in Figure 5-10, to configure parameters to forward a system message to another syslog server when the rule conditions are met.
The Forward page contains the following fields:
Field Name | Description |
|---|---|
|
|
|
|
|
|
Step 13 Click Submit to establish the condition.
Step 14 Click Submit to establish the rule.
The conditions of a rule can be edited or deleted.
To edit the conditions of a rule, do the following:
Step 2 Click Edit to display the Edit a Rule page.
Step 3 Click Edit to edit a condition, click Delete to remove a condition, select a new operation from the Operations list, or click Click to modify the parameters of an operation.
Step 4 Configure the rule, as described in the "Adding a Custom Rule" section above.
We would like to receive information on the performance of this system to better understand product performance in customer environments. This product has a built-in routine that can send performance information to Cisco Quality when an event that affects availability or reliability occurs. You are not required to enable this feature.
We can use this feature to improve the hardware and software performance of our products and is a key part of our ongoing commitment to the improvement of your network. This information is not used for anything other than the performance evaluation of Cisco products.
Under the Rules list, to accept the Consent to Availability agreement, select Availability. The Availability Rules page appears, as shown in Figure 5-11.
If you accept this option now, you can easily change your selection by modifying the Preferences menu settings. If you would like more information on this feature, please visit www.cisco.com/gershwin/docs/availability.
To accept the Consent to Availability agreement, do the following:
Step 2 Click User consent to availability agreement to display the agreement.
Step 3 Read the agreement, scrolling to the bottom of the window if necessary.
Step 4 Click the Yes, I accept radio button.
Step 5 Click Submit. You are returned to the Availability Rules page.
To display the Availability Conditions page, do the following:
Step 2 In the Action column, click View to display the conditions.
The Event Manager maintains a database of all events received up to the maximum number allowed by the General Policy page. Lists of messages can be combine to create reports. When the report is run, all system messages that meet the report conditions are listed.
You can use the Custom Report page, shown in Figure 5-13, to do the following:
Each report consists of one or more conditions to which system messages are compared. Those messages that satisfy the conditions of the report are included.
To add a custom report, do the following:
Step 2 In the Report Name field, enter the name of the report.
Step 3 Click Submit to add a condition to the report. The Add a Row page is shown in Figure 5-15.
Step 4 From the drop-down Field list, select the field on which this rule is based. The options available are the same as those listed in Table 5-1.
Step 5 From the drop-down Operator list, select the operator. Operator compares the field value to the parameter listed in the Value column. Possible operators are as follows:
Step 6 Click Options to display the values that apply to the selected field, and select a parameter.
|
Note In some cases, such as when the condition involved the Body field, the Options button is inactive, and you must enter the value in the Value field. |
Step 7 Click Submit to establish the condition. You are returned to the Add a Custom Report page.
Step 8 Optionally, click Add a Condition to add another condition.
Step 9 If this is the second condition entered, select the And or Or radio buttons for this rule to appear under the Operator heading.
When you add a second condition, an option to And or Or the conditions for this report appears. If you And the conditions, all the conditions must be true before the entry is included in the report. If you Or the conditions, only one of the conditions must be true before the entry is included in the report.
Step 10 Click Submit to establish the condition. You are returned to the Custom Reports page.
To view a custom report, click View in the Actions column for the report. An example is shown in Figure 5-16.
Reports are edited by adding, modifying, or deleting conditions.
To edit an existing custom report, do the following:
Step 2 In the Actions column, click Edit for the condition that you want to modify, or click Add a Condition to add a condition.
Step 3 Follow the procedure for adding a condition, as described in Step 9 of the "Adding a Custom Report" section.
In the Action column , click Delete for the report you want to remove.
In the Actions column, click Save As to display a Save As window.
To display the Predefined Reports page, do the following:
Step 2 In the Action column, click View to display the report.
Posted: Mon Oct 2 13:38:14 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.