Chapter 10: Notification and Action Settings...Administration of Cisco Prime LAN Management Solution 4.2 OL-25947-01 Chapter 10 Notification and Action Settings Customizing LMS Events

Administratio

OL-25947-01

C H A P T E R 10
Notification and Action Settings
The Notification and Action Settings groups all the administrative tasks involved in setting up notification, syslog settings. You can also customize the names and event severity, create and activate a notification subscriptions, and setup up automated actions for Change Audit tasks and syslogs.

This section contains:

• Understanding Notifications and Subscriptions

• Customizing LMS Events

• Configuring Event Sets and Notification Groups for Subscriptions

• Managing Fault SNMP Trap Notifications

• Managing Fault E-Mail Configurations

• Managing Fault Syslog Notifications

• Configuring Fault SNMP Trap Receiving and Forwarding

• Performance SNMP Trap Notification Groups

• Performance Syslog Notification Groups

• Defining Automated Actions

• Defining Syslog Message Filters

• Inventory and Config Collection Failure Notification

• IPSLA Syslog Configuration

10-1n of Cisco Prime LAN Management Solution 4.2

Chapter 10 Notification and Action Settings Understanding Notifications and Subscriptions

Understanding Notifications and SubscriptionsTo use Notification Services, you must create and activate a notification subscription. The subscription requires a Notification group component. This component specifies the notification criteria (the devices to monitor, how severe an event must be to be reported, and so forth).

Optionally the notification group can also contain an Event set listing the events you want to monitor; this is useful when you do not want to monitor all events that occur on a device. Notification groups can be static or dynamic. The Fault Management module in LMS 4. 0 can be set up to have either static notification groups or dynamic notification groups.

• If you work with static groups, no further devices can be added to those groups.

• If you set up dynamic groups, then any device that fits the criteria for the groups will be added to those groups.

After you have configured your subscription, you can name it according to your needs. Regardless of whether you configure SNMP Trap, E-Mail, or Syslog notifications, you must always create a subscription containing a notification group. The final step in configuring your notification subscription is specifying the notification recipients.

Note If a subscription is monitoring all events on a device (by not using an event set), and another subscription is monitoring only specific events on a device, you will receive duplicate notifications.

Notification Services tracks events on device types, not on device components.

For details on Notifications and Subscriptions, see the following topics:

• Creating a Notification Subscription

• Notification Types

• Notification Replay

• Subscriptions

• Events

Creating a Notification Subscription

To create a notification subscription, perform the following steps:

1. If you want to monitor a specific set of events, create an event set that contains the events you want to monitor. Otherwise, all events will be monitored.

2. Create a notification group that specifies the criteria the Fault Management module should use when generating notifications:

• One or more event sets (if no event set is specified, all events are monitored)

• Devices, event severity and status

You can specify the notification group name, along with entering identifying information (using the Customer ID and Customer Revision fields).

10-2Administration of Cisco Prime LAN Management Solution 4.2

OL-25947-01


3. Create a subscription by doing the following:

a. Select the notification type (SNMP Trap, E-Mail, or Syslog).

b. Name the subscription and apply a notification group to it.

c. Specify the recipients (hostname, e-mail address).

d. Save the subscription. It will automatically start running.

4. Customize the subject of the e-mail by doing the following:

a. Select the subject from the available list

b. Add to the selected list

c. Arrange the order of the subjects

d. Save the customization of the e-mail subject

Notification Types

The Fault Management module in LMS 4.2 provides three types of notifications:

• SNMP Trap Notification—Fault Management module generates traps with information about the events that caused it. CISCO-EPM-NOTIFICATION-MIB defines the trap message format. For more information, see Notification MIB in Monitoring and Troubleshooting Online Help. LMS can also generate SNMP trap notifications for specified events.

Using SNMP trap notification is different from forwarding raw traps to another server before they have been processed by LMS.

• E-mail Notification—LMS generates e-mail messages containing information about the events that caused it. CISCO-EPM-NOTIFICATION-MIB defines the message, which is included in the e-mail in text format. You can specify that you want the e-mail to only contain an informational subject line or can customize the e-mail subject. For information on the customizing the e-mail subject, see Managing Fault E-Mail Subject Customization.

• Syslog Notification—LMS generates Syslog messages that can be forwarded to Syslog daemons on remote systems.

All notifications have a default maximum message size of 250 characters. You can reset this variable to any value between 250 and 1024 characters by editing the notification properties file.

To do this:

Procedure

Step 1 Open the configuration file NMSROOT/objects/nos/config/nos.properties.

Step 2 Locate the following lines and change the value to any value up to 1024 characters:

MAX_TRAP_DES=250MAX_EMAIL_DES=250MAX_SYSLOG_DES=250


OL-25947-01


Step 3 Stop and restart the Cisco Prime daemon manager on the LMS server.

a. Stop the daemon manager:

On Windows:

net stop crmdmgmt

On Solaris/Soft Appliance:

/etc/init.d/dmgtd stop

b. Restart the daemon manager:

On Windows:

net start crmdmgmt

On Solaris/Soft Appliance:

/etc/init.d/dmgtd stop

Notification Replay

You can configure LMS to replay notifications in the event that LMS has to be restarted. Edit the file /opt/CSCOpx/objects/nos/config/nos.properties as follows:

To do this, set the value SEND_NOTIF_ON_START=1 to enable this feature. When the value is set to the default value (0), the notifications will not be replayed.

Subscriptions

LMS sends notifications based on user-defined subscriptions. You can create up to 32 notification subscriptions. A subscription for SNMP trap notification or e-mail notification includes the following common elements, as determined by the CISCO-EPM-NOTIFICATION-MIB:

• Devices—The devices or device groups of importance to the recipients.

• Event severity and status—One or more event severity levels and status. You can also customize the names of the events used by Notification Services, and Fault History. See Customizing LMS Events.

• Recipients—One or more hosts to receive SNMP traps or users to receive e-mail. For Syslog notifications, the recipient would be the remote host containing a Syslog daemon configured to listen for Syslog messages.

• Name—A user-defined name to identify the subscription.

Subscriptions are based on user-configured event sets and notification groups. See Configuring Event Sets and Notification Groups for Subscriptions for more information.

Events

LMS sends notifications whenever an event occurs that matches a subscription. For each event, LMS compares the device, severity, and state against subscriptions and sends a notification when there is a match. Matches can be determined by user-configured event sets and notification groups.

The procedure for configuring notification groups is described in Configuring Event Sets and Notification Groups for Subscriptions.


OL-25947-01

Chapter 10 Notification and Action Settings Customizing LMS Events

LMS assigns one severity to each event and changes the state of an event over time, responding to user input and changes on the device. Table 10-1 lists values for severity and explains how the state of an event changes over time.

Note You can change event names to names that are more meaningful to you. See Customizing LMS Events.

Customizing LMS EventsNotification Services allows you to customize the names and event severity in LMS.

• Customizing Names: When you customize an event name, that name is reflected in all notifications, and in Fault History. The new event name is used for all instances of an event, regardless of the component on which the event occurs. You can easily revert to the default event names as needed. The Notification Customization page also lists the new name and default name, so you can easily check which names have been changed.

• Customizing Event Severity: The event severity can be customized using the New Event Severity feature. You can select Critical or Warning or Informational from the drop-down list.

To customize names and event severity:

Step 1 Select Admin > Network > Notification and Action Settings > Fault Notification Customization.

The Notification Customization page appears.

Step 2 Select the event names you want to customize by clicking the check box beside each event name.

Step 3 Enter your new names in the New Event Description fields.

Step 4 Select the event severity from the New Event Severity drop-down list.

You can select Critical or Informational.

Step 5 Enter any notes for information in the Troubleshooting Information field.

Step 6 Click Save to save your changes locally.

Step 7 Click Apply for the saved settings to take effect.

The confirmation window appears.

Table 10-1 Event Severity and Status

LMS categorizes events by severity and status…

Severity Critical

Informational

Status • Active—The event is live.

• ACK—A user has manually acknowledged the event. A user can acknowledge only active events.

• Cleared—The event is no longer active.

• Events that have been cleared either expire or, if associated with a suspended device, remain in LMS until a user resumes or deletes the device.


OL-25947-01

Chapter 10 Notification and Action Settings Configuring Event Sets and Notification Groups for Subscriptions

Step 8 Click Yes.

The changes are applied to LMS.

To revert to default event names:

a. From the Notification Customization page, select the events you want to restore to their default names, and click Restore factory settings.

b. Apply your changes by clicking Yes when the confirmation window appears.

Configuring Event Sets and Notification Groups for Subscriptions

Before you can create an SNMP trap or an e-mail or Syslog notification subscription, you must create a notification group. Creating event sets is optional.

• Event sets list the events you want monitored for notifications

• Notification groups contain the criteria that LMS should use when generating a notification:

– One or more event sets, or all events

– Devices

– Event status and severity

– Fields for user-specified additional information you want to include with the subscription

Creating event sets and notification groups are described in the following topics:

• Configuring Event Sets

• Configuring Fault Notification Groups

Configuring Event Sets

Event sets are groups of the events you want to monitor. You can create up to nine event sets, labeled A through I.

After you have created an event set, you can apply as many of them as you want to a notification group, thereby tracking the specific events in which you are interested. If you do not specify an event set, LMS will monitor all events for notifications.

Note If a subscription is monitoring all events on a device (by not using an event set), and another subscription is monitoring only specific events on a device, you will receive duplicate notifications.


OL-25947-01


To configure event sets:

Step 1 Select Admin > Network > Notification and Action Settings > Event Sets:

The Event Sets page appears. The page contains the following information:

Step 2 For each event set you want to configure, select events by doing either of the following:

• Select specific events by clicking the editable field under the label, and selecting X.

• Select or deselect all events for an event set using the Select or the Deselect button.

Step 3 Click Apply.

If you want to create a notification subscription, first create a notification group that uses your event set. See Configuring Fault Notification Groups.

Configuring Fault Notification Groups

When you set up a subscription, LMS lets you choose from existing notification groups. You can then configure an SNMP trap or an e-mail or Syslog notification to use a specific notification group. The notification groups contains the following information:

• One or more event sets, if desired (otherwise, the notification group will contain all events)

• Devices

• Event status and severity

• Fields for user-specified additional information you want to include with the subscription

• Whether the group is static or dynamic

You can configure a maximum of 64 notification groups.

Notification Services will not refilter the devices if there is a change in the device list you may access. This section contains: Setting Up a Fault Notification Group as Static or Dynamic

Note You cannot delete a notification group that is being used by a running subscription.

Field Description

Select/Unselect All for Event Set Select an Event Set from the drop-down list.

Event Code Notification Services code for the event. This number cannot be changed and is used to map default names to customized names.

Description Event description (user-defined or default).

Severity Event severity.

A - I Event set label. If an X appears in this column, the corresponding event belongs to that event set.


OL-25947-01


To configure Fault Notification groups:

Step 1 Select Admin > Network > Notification and Action Settings > Fault Notification Group.

Step 2 Click Add to create a notification group.

The Notification Group Save: Add page appears. (If you want to edit or delete a notification group, click the appropriate button and follow the instructions.)

Step 3 Specify the devices, event sets (if desired), and event severity and status. Click Next.

If a subscription is monitoring all events on a device (by not using an event set), and another subscription is monitoring only specific events on a device, you will receive duplicate notifications.

With many devices in LMS, it can sometimes be difficult to locate the devices you are interested in. To assist you in locating devices, use the search option in the mega menu.

Step 4 Specify the notification group name, and enter any desired identifying information in the Customer ID and Customer Revision fields.

• For e-mail and Syslog notifications, if you leave these fields blank, they are left blank in the notification.

• For SNMP trap notifications, if you leave these fields blank, they are displayed as followed in any notifications:

Customer ID: -

Customer Revision: *

Step 5 Click Next.

Step 6 Create the notification group by clicking Finish.

Step 7 To create a notification subscription, follow the instructions in one of these topics:

• Adding an SNMP Trap Notification Subscription

• Adding and Editing an E-Mail Notification Subscription

• Adding a Syslog Notification Subscription

Setting Up a Fault Notification Group as Static or Dynamic

Fault Notification groups in LMS can be static or dynamic. If you set up LMS to include static groups, mappings between the list of the devices and the notification events for those devices are generated. You cannot add devices to or delete devices from a static group.

If you set up LMS to have dynamic groups, then any device that fits the criteria for a group will be added to that group. You can also delete devices from a dynamic group.

When a device is added to a group, all similar devices are also added. For example, if you have ten routers in the network and create a dynamic group that contains five of these routers, when you add an eleventh router, that router is added to the group along with the other five routers. The group would then contain all eleven routers.

Note Notification groups can be static or dynamic; you cannot have a mix of group types.


OL-25947-01

Chapter 10 Notification and Action Settings Managing Fault SNMP Trap Notifications

To set up LMS to include dynamic groups, edit the file /opt/CSCOpx/objects/nos/config/nos.properties and set the following value:

DYNAMIC_NOTIF_GROUPS=1

For additional information, see the following topics:

• Customizing LMS Events

• Configuring Event Sets

Managing Fault SNMP Trap NotificationsThe SNMP Trap Notifications page displays the following information:

• Subscription—The name of the user-defined request for notification.

• Status—The subscription status; can be either of the following:

– Running—LMS is using the subscription while monitoring events to determine when to send a notification.

– Suspended—LMS will not use the subscription unless you resume it.

• Notification Group—The name of notification group that is applied to the subscription.

You are completely in control of subscriptions. LMS does not delete subscriptions under any circumstances.

From the SNMP Trap Notifications page, you can perform the tasks listed in Table 10-2.

Table 10-2 SNMP Trap Notification Subscriptions

Task Sample Usage Reference

Add • Add a subscription that will send SNMP trap notification for one device with an event of any severity (critical or informational) and any status (active, acknowledged, or cleared).

Adding an SNMP Trap Notification Subscription

Edit • View the notification group and hosts that comprise the subscription.

• Change the trap recipients/notification groups that comprise the subscription.

Editing an SNMP Trap Notification Subscription

Suspend • Temporarily stop sending SNMP trap notifications to a host.

• Temporarily stop sending SNMP trap notifications about a device group.

Suspending an SNMP Trap Notification Subscription

Resume • Start sending SNMP trap notifications to a host again.

• Start sending SNMP trap notifications about a device group using a previously suspended subscription.

Resuming an SNMP Trap Notification Subscription

Delete • Remove SNMP trap notification subscriptions that are no longer useful.

• Remove redundant SNMP trap notification subscriptions.

Deleting an SNMP Trap Notification Subscription


OL-25947-01


Adding an SNMP Trap Notification Subscription

After you add a subscription for SNMP trap notification, generated SNMP traps are forwarded to the hosts you specify until you change, suspend, or delete the subscription.

Note Adding a subscription is a multi-step process. Your changes are not saved until you click the Finish button on the final page.

Before You Begin

You must create a notification group before you can create an SNMP trap notification subscription. Refer to Configuring Fault Notification Groups.

To add an SNMP trap notification subscription:

Step 1 Select Admin > Network > Notification and Action Settings > Fault - SNMP trap notification.

The SNMP Trap Notification Subscriptions page appears.

Step 2 Click Add.

Step 3 Complete the Trap Subscription Save: Add window:

a. Enter a subscription name.

b. Select a notification group.

If you are upgrading LMS and want to use the trap recipients from an earlier configuration, activate the Recipients from Upgrade check box. (This choice is only available for systems that have been upgraded from earlier versions of LMS.)

c. Click Next.

Step 4 Enter one or more hosts as recipients for traps:

a. For each host, enter:

• An IP address or DNS name for the hostname.

Restart the NOSServer to pick up the change in the host name when host name is used for the trap server and there is a change in that host name.

• A port number on which the host can receive traps. If the port number is unspecified (empty), the port defaults to 162. (You can verify this in Step 5.)

• A comment. (This is optional).

b. Click Next.

Step 5 Review the information that you entered and click Finish.

The SNMP Trap Notifications page is displayed, showing the new subscription.

Note No information is saved until you complete Step 5.


OL-25947-01


Editing an SNMP Trap Notification Subscription

You can edit an SNMP trap notification subscription regardless of its status (Running or Suspended).

After you edit an SNMP trap notification subscription, if the subscription status is Running, traps are forwarded as specified until you edit, suspend, or delete the subscription. Editing a suspended subscription automatically resumes it.

Note Editing a subscription is a multi-step process. Your changes are not saved until you click the Finish button on the final page.



Step 2 Select the subscription you want to edit by clicking the radio button beside it.

Step 3 Click Edit.

No information is saved until you complete Step 5.

Step 4 Edit the Trap Subscription Save: Edit window:

a. Change the subscription name.

b. Select another notification group.

If you are upgrading LMS and want to use the trap recipients from an earlier configuration, activate the Recipients from Upgrade check box. (This choice is only available for systems that have been upgraded from earlier versions of LMS.)

c. Click Next.

Step 5 Add or delete a recipient host or change the port number for a host:

a. To add one or more recipients, for each host, enter:


• A port number on which the host can receive traps. If the port number is unspecified (empty), the port defaults to 162. (You can verify this in Step 6.)

• A comment. This is optional.

b. To delete a recipient, delete the hostname, port number, and comment, if any.

c. Click Next.

Step 6 Review the information that you entered and click the Finish.

The SNMP Trap Notifications page is displayed.

Suspending an SNMP Trap Notification Subscription

After you suspend an SNMP trap notification subscription, LMS stops using the subscription to select and forward traps. The subscription status changes to Suspended.

To do this:


OL-25947-01




Step 2 Select the subscription you want to suspend by clicking the radio button beside it.

Step 3 Click Suspend.

Step 4 Click OK in the confirmation dialog box.

The SNMP Trap Notification Subscriptions page is displayed. The subscription status is Suspended.

Resuming an SNMP Trap Notification Subscription

You can resume an SNMP trap notification subscription only when the subscription status is Suspended. After you resume a subscription, LMS starts using it to identify events for which to forward traps. The subscription status changes to Running.

To do this:



Step 2 Select the subscription you want to resume by clicking the radio button beside it.

Step 3 Click Resume.


The SNMP Trap Notification Subscriptions page is displayed. The subscription status is Running.

Deleting an SNMP Trap Notification Subscription

You can delete an SNMP trap notification subscription regardless of the subscription status. Deleting a subscription removes it permanently from LMS.

Note You can also suspend a subscription. Suspending a subscription causes the subscription to not be used until a user resumes it.

To delete an SNMP trap notification subscription:


Step 2 Select the subscription you want to delete by clicking the radio button beside it.

Step 3 Click Delete.


The SNMP Trap Subscriptions page appears. The subscription is no longer displayed.


OL-25947-01

Chapter 10 Notification and Action Settings Managing Fault E-Mail Configurations

Managing Fault E-Mail ConfigurationsThis section contains the following topics:

• Managing Fault E-Mail Notification Subscriptions

• Managing Fault E-Mail Subject Customization

You can use the E-Mail Configuration page to configure E-mail notification subscription and to customize the E-mail subject.

The E-Mail Configuration page displays the following information:

• E-Mail Notification: Forwards events as e-mail to specified e-mail recipients. Forwarded traps are based on Notification Groups.

• E-Mail Subject Customization: Customizes the e-mail subject for forwarded events.

Note You may not be able to use some of these functions if you do not have the required privileges.

Managing Fault E-Mail Notification Subscriptions

The E-Mail Notification Subscription page displays the following information:



– Running—LMS is using the subscription while monitoring events to determine when to send a notification.

– Suspended—LMS will not use the subscription unless you resume it.


You are completely in control of subscriptions. LMS does not delete subscriptions under any circumstances. From the E-Mail Notifications page, you can perform the tasks listed in Table 10-3.

Table 10-3 E-Mail Notification Subscriptions

Task Sample Usage

Add Add a subscription that will send e-mail notification to a user for one device with an event of any severity (critical or informational) and any status (active, acknowledged, or cleared).

See Adding and Editing an E-Mail Notification Subscription for more information.

Edit • View the notification group and e-mail recipients that comprise the subscription.

• Change the e-mail recipients/notification group that comprise the subscription.

Suspend • Temporarily stop sending e-mail notifications to a user.

• Temporarily stop sending e-mail notifications about a device group.


OL-25947-01


Adding and Editing an E-Mail Notification Subscription

After you add or edit a subscription for e-mail notification, LMS sends e-mail to the users you specify whenever an event occurs that matches the subscription.

Note Adding a subscription is a multistep process. Your changes are not saved until you click the Finish button on the final page.

Before You Begin

You must create a notification group before you can create an E-Mail Notification subscription. Refer to Configuring Fault Notification Groups.

To add or edit a subscription for e-mail notification:

Step 1 Select Admin > Network > Notification and Action Settings > Fault - Email notification.

The E-Mail Notification Subscriptions page appears.

Step 2 You can do one of the following:

• Click Add.

• Click Edit.

You can edit an e-mail notification subscription regardless of its status (Running or Suspended).

After you edit an e-mail notification subscription, if the subscription status is Running, e-mail is forwarded as specified until you change, suspend, or delete the subscription. Editing a suspended subscription automatically resumes it.

• Click Delete.

Click OK in the confirmation dialog box.

The E-Mail Subscriptions page appears. The subscription is no longer displayed.

• Select the subscription you want to suspend by clicking the radio button beside it and click Suspend.


The E-Mail Notification Subscriptions page is displayed. The subscription status is Suspended. After you suspend an e-mail notification subscription, LMS stops using the subscription to send e-mail notification.

• Select the subscription you want to resume by clicking the radio button beside it and click Resume.


Resume • Start sending e-mail notifications to a user again.

• Start sending e-mail notifications about a device group using a previously suspended subscription.

Delete • Remove e-mail notification subscriptions that are no longer useful.

• Remove redundant e-mail notification subscriptions.

Table 10-3 E-Mail Notification Subscriptions (continued)

Task Sample Usage


OL-25947-01


The E-Mail Notification Subscriptions page is displayed. The subscription status is Running. After you resume an e-mail notification subscription, LMS starts using the subscription to determine when e-mail notification should be sent in response to an event.

Step 3 When you add or edit a subscription for e-mail notification, a page appears with the following fields:

Step 4 Click Next.

Step 5 Enter the following e-mail information:

Step 6 Click the Next button located at the bottom of the page.


The E-Mail Notification Subscriptions page is displayed, showing the new subscription.


Field Description

Subscription Name Enter a subscription names.

Notification Group Select a notification group.

If you are upgrading LMS and want to use the e-mail recipients from an earlier configuration, activate the Recipients from Upgrade check box. (This choice is only available for systems that have been upgraded from earlier versions of LMS.)

Field Description

SMTP Server The name of the default Simple Mail Transfer Protocol (SMTP) server may already be displayed. The server is specified using Admin > System > SMTP Default Server. You may also enter a fully qualified DNS name or IP address for an SMTP server.

To select from any non-default SMTP servers in use by existing subscriptions, click the SMTP Servers button.

Sender Address Enter the e-mail address that notifications should be sent from. If the sender’s e-mail service is hosted on the SMTP server specified, you need enter only the username. You do not need to enter the domain name.

Recipient Addresses Enter one or more e-mail addresses that notifications should be sent to, separating multiple addresses with either a comma or a semicolon. If a recipient’s e-mail service is hosted on the SMTP server specified, you need to enter only the username. You do not need to enter the domain name.

Headers Only (check box) By default, e-mail notification supplies a fully detailed e-mail message. To omit the message body and send only a subject line, select the Headers Only check box.


OL-25947-01


Managing Fault E-Mail Subject Customization

You can use the E-Mail Subject Customization page to customize the e-mail subject for forwarded events. You need to select the subject attributes and the order in which they are to be displayed. When you apply and save the selections, the e-mails are sent in the customized order.

The E-Mail Subject Customization page displays the following information:

• Available Subjects for E-mail: The additional subjects that are fetched from the LMS database. You can use these subjects along with the default available subjects while sending e-mail notifications.

By default, following list of e-mail subject attributes are displayed in the Available Subjects for E-Mail box:

– ifAlias

– sysLocation

– sysContact

– user_defined_field_0




When you import devices from DCR, the subject information gets updated into LMS database and they are displayed as available subjects for e-mails.

• Selected Subjects for E-mail: The selected subjects including the default ones in the selected order displayed by the side of the available subjects.

To customize the e-mail subject:

Step 1 Select Admin > Network > Notification and Action Settings > Fault - Email subject customization.

The available and selected lists of the subject attributes for e-mail are displayed.

To customize the e-mail subject, you can add and remove subjects from the current e-mail subjects list. By default, following list of e-mail subject attributes are displayed in the Selected Subjects for E-Mail box.

• Event ID

• Device Name

• Time

• Severity

• Event Name

• Status

To add a subject:

a. Select the subject attribute from Available Subjects for E-Mail.

b. Click Add.

The selected subject attribute is added to the Selected Subjects for E-Mail list.

You can add a subject attribute only from the Available Subjects list to the Selected Subjects list. You cannot add a subject attribute from the Selected subject list to the Available Subject list.


OL-25947-01

Chapter 10 Notification and Action Settings Managing Fault Syslog Notifications

To remove a subject attribute:

a. Select the subject attribute from Selected Subjects for E-Mail.

b. Click Remove.

The selected subject attribute is removed from the Selected list and added to the Available subjects for E-Mail list.

You can remove a subject attribute only from the Selected Subjects list and not from the Available Subjects list.

Step 2 Click Up or Down to rearrange the order of the selected e-mail subject attributes.

Step 3 Click Apply to save the customized e-mail subject attributes.

Managing Fault Syslog NotificationsThe Syslog Notifications page displays the following information:




– Running—Fault Management module is using the subscription while monitoring events to determine when to send a notification.

– Suspended—Fault Management module will not use the subscription unless you resume it.

You are completely in control of subscriptions. Fault Management module does not change or delete subscriptions under any circumstances. From the Syslog Notifications page, you can perform the tasks listed in Table 10-4.

Table 10-4 Syslog Notification Subscriptions


Add • Add a subscription that will send a Syslog notification to a remote machine for one device with an event of any severity (critical or informational) and any status (active, acknowledged, or cleared).

Adding a Syslog Notification Subscription

Edit • View the notification group and Syslog recipient that comprise the subscription.

• Change the Syslog recipients/notification group that comprise the subscription.

Editing a Syslog Notification Subscription

Suspend • Temporarily stop sending Syslog notifications to a remote host.

• Temporarily stop sending Syslog notifications about a device group.

Suspending a Syslog Notification Subscription


OL-25947-01


Adding a Syslog Notification Subscription

After you add a subscription for Syslog notification, LMS sends a Syslog message to the specified remote hosts whenever an event occurs that matches the subscription.

Note Adding a subscription is a multistep process. Your changes are not saved until you click the Finish button on the final page.

Before You Begin

• You must create a notification group before you can create a Syslog Notification subscription. Refer to Configuring Fault Notification Groups.

• A remote machine’s Syslog daemon must be configured to listen on a specified port, and you must enter this information in Step 3 of the following procedure. LMS uses the default port 514.

Step 1 Select Admin > Network > Notification and Action Settings > Fault - Syslog notification.

The Syslog Notification Subscriptions page appears.

Step 2 Click Add.

a. Enter a subscription name.

b. Select a notification group.

c. Select a facility from the drop-down list (the default is Local Use 0). The Facility field and the event severity are used for the PRI portion of the Syslog message, as follows:

[Facility*8][Severity]

Event severity values are as follows:

• Critical = 2

• Information = 6

You can enter location information (up to 29 characters). This information will be populated in the Syslog message. This is optional.

d. Click Next.

Step 3 Enter one or more hosts as recipients for Syslog notifications.

a. For each host, enter:


Resume • Start sending Syslog notifications to a remote host again.

• Start sending Syslog notifications about a device group using a previously suspended subscription.

Resuming a Syslog Notification Subscription

Delete • Remove Syslog notification subscriptions that are no longer useful.

• Remove redundant Syslog notification subscriptions.

Deleting a Syslog Notification Subscription

Table 10-4 Syslog Notification Subscriptions (continued)



OL-25947-01


• A port number on which the Syslog daemon is listening. If the port number is unspecified (empty), the port defaults to 514. (You can verify this in Step 5.)


b. Click Next.

Step 4 Enter the name of the subscription in the Save As field and click Next.


The Syslog Notification Subscriptions page is displayed with the new subscription.


Editing a Syslog Notification Subscription

You can edit a Syslog notification subscription regardless of its status (Running or Suspended).

After you edit a Syslog notification subscription, if the subscription status is Running, Syslog messages are forwarded as specified until you change, suspend, or delete the subscription. Editing a suspended subscription automatically resumes it.

Note Editing a subscription is a multistep process. Your changes are not saved until you click the Finish button on the final page.



Step 2 Select the subscription you want to edit by clicking the radio button beside it.

Step 3 Click Edit.

Step 4 Edit the Syslog Subscription Save: Edit window:

a. Change the subscription name.

b. Select a different notification group.

c. Select a Facility from the drop-down list (the default is Local Use 0). The Facility field and the event severity is used for the PRI portion of the Syslog message, as follows:

[Facility*8][Severity]

Event severity values are as follows:

• Critical = 2

• Informational = 6

You can enter location information (up to 29 characters). This information will be populated in the Syslog message. This is optional.

d. Click Next.

Step 5 Add or delete a recipient host or change the port number for a host:

a. To add one or more recipients, for each host, enter:


OL-25947-01



• A port number on which the Syslog daemon is listening. If the port number is unspecified (empty), the port defaults to 514. (You can verify this in Step 7.)


b. To delete a recipient, delete the hostname, port number, and comment, if any.

c. Click Next.

Step 6 Click the Next button located at the bottom of the page.


The Syslog Notification Subscriptions page is displayed.

Suspending a Syslog Notification Subscription

After you suspend a Syslog notification subscription, LMS stops using the subscription to send Syslog notifications. The subscription status changes to Suspended.



Step 2 Select the subscription you want to suspend by clicking the radio button beside it.

Step 3 Click Suspend.


The Syslog Notification Subscriptions page is displayed. The subscription status is Suspended.

Resuming a Syslog Notification Subscription

After you resume a Syslog notification subscription, LMS starts using the subscription to determine when Syslog notifications should be sent in response to an event. The subscription status changes to Running.

To resume a syslog notification subscription:



Step 2 Select the subscription you want to resume by clicking the radio button beside it.

Step 3 Click Resume.


The Syslog Notification Subscriptions page is displayed. The subscription status is Running.


OL-25947-01

Chapter 10 Notification and Action Settings Configuring Fault SNMP Trap Receiving and Forwarding

Deleting a Syslog Notification Subscription

You can delete a Syslog notification subscription regardless of the subscription status. Deleting a subscription removes it permanently from LMS.

Note You can also suspend a subscription. Doing so causes the subscription to not be used until a user resumes it.

To delete a syslog notification subscription:


Step 2 Select the subscription you want to delete by clicking the radio button beside it.



The Syslog Subscriptions page appears. The subscription is no longer displayed.

Configuring Fault SNMP Trap Receiving and ForwardingLMS can receive traps on any available port and forward them to a list of devices and ports. This capability enables LMS to work with other trap processing applications.

This section contains the following topics:

• Enabling Devices to Send Traps to LMS

• Enabling Cisco IOS-Based Devices to Send Traps to LMS

• Enabling Catalyst Devices to Send SNMP Traps to LMS

• Integrating SNMP Trap Receiving with Other Trap Daemons or NMSs

• Updating the SNMP Trap Receiving Port

• Configuring SNMP Trap Forwarding

LMS will only forward SNMP traps from devices in the LMS inventory.

It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:

• Configure SNMP to send traps directly to LMS

• Integrate SNMP trap receiving with an NMS or a trap daemon

Note The ports and protocols used by Cisco Prime are listed in Installing and Migrating to Cisco Prime LAN Management Solution 4.2.


OL-25947-01


Enabling Devices to Send Traps to LMS

Note If your devices send SNMP traps to a Network Management System (NMS) or a trap daemon, see Integrating SNMP Trap Receiving with Other Trap Daemons or NMSs.

Since LMS uses SNMP MIB variables and traps to determine device health, you must configure your devices to provide this information. For any Cisco device that you want LMS to monitor, SNMP must be enabled and the device must be configured to send SNMP traps to the LMS server.

Make sure your devices are enabled to send traps to LMS by using the command line or GUI interface appropriate for your device:

• Enabling Cisco IOS-Based Devices to Send Traps to LMS

• Enabling Catalyst Devices to Send SNMP Traps to LMS


OL-25947-01


Enabling Cisco IOS-Based Devices to Send Traps to LMS

For devices running Cisco IOS software, enter the following commands:

(config)# snmp-server [community string] ro(config)# snmp-server enable traps(config)# snmp-server host [a.b.c.d] traps [community string]

where [community string] indicates an SNMP read-only community string and [a.b.c.d] indicates the SNMP trap receiving host (the LMS server).

For more information, see the appropriate command reference guide.

To enable Cisco IOS-Based devices to send traps to LMS:

Step 1 Log into Cisco.com.

Step 2 Select Products & Services > Cisco IOS Software.

Step 3 Select the Cisco IOS software release version used by your IOS-based devices.

Step 4 Select Technical Documentation and select the appropriate command reference guide.

Enabling Catalyst Devices to Send SNMP Traps to LMS

For devices running Catalyst software, provide the following commands:

(enable)# set snmp community read-only [community string](enable)# set snmp trap enable all(enable)# set snmp trap [a.b.c.d] [community string]

where [community string] indicates an SNMP read-only community string and [a.b.c.d] indicates the SNMP trap receiving host (the LMS server).

For more information, see the appropriate command reference guide.

Step 1 Log into Cisco.com.

Step 2 Select Products & Services > Cisco Switches.

Step 3 Select the appropriate Cisco Catalyst series switch.

Step 4 Select Technical Documentation and select the appropriate command reference guide.


OL-25947-01


Integrating SNMP Trap Receiving with Other Trap Daemons or NMSs

You might need to complete one or more of the following steps to integrate SNMP trap receiving with other trap daemons and other Network Management Systems (NMSs):

• If you are integrating LMS with a remote version of HP OpenView or NetView, you must install the appropriate adapter on the remote HP OpenView or NetView (see Installing and Migrating to Cisco Prime LAN Management Solution 4.2. This guide also provides information on supported versions). You do not need to install any adapters if HP OpenView or NetView is installed locally.

• Add the host where LMS is running to the list of trap destinations in your network devices. See Enabling Devices to Send Traps to LMS. Specify port 162 as the destination trap port. (If another NMS is already listening for traps on the standard UDP trap port (162), use port 9000, which LMS will use by default.)

• If your network devices are already sending traps to another management application, configure that application to forward traps to LMS.

Table 10-5 describes scenarios for SNMP trap receiving and lists the advantages of each.

Updating the SNMP Trap Receiving Port

By default, LMS receives SNMP traps on port 162 (or, if port 162 is occupied, port 9000). If you need to change the port, you can do so. LMS supports SNMP V1, V2, and V3 traps for trap receiving.

Step 1 Select Admin > Network > Notification and Action Settings > Fault - SNMP trap receiving settings.

Step 2 Enter the port number in the Receiving Port text box.

Step 3 Click Apply.

For a list of ports that are already in use, see Installing and Migrating to Cisco Prime LAN Management Solution 4.2. If you have two instances of the DfmServer process running, traps will be forwarded from the first instance to the second instance.

Table 10-5 Configuration Scenarios for Trap Receiving

Scenario Advantages

Network devices send traps to port 162 of the host where LMS is running. LMS receives the traps and forwards them to the NMS.

• No reconfiguration of the NMS is required.

• No reconfiguration of network devices is required.

• LMS provides a reliable trap reception and forwarding mechanism.

• NMS continues to receive traps on port 162.

• Network devices continue to send traps to port 162.

NMS receives traps on default port 162 and forwards them to port 162 on the host where LMS is running.

• No reconfiguration of the NMS is required.

• No reconfiguration of network devices is required.

• LMS does not receive traps dropped by the NMS.


OL-25947-01

Chapter 10 Notification and Action Settings Performance SNMP Trap Notification Groups

Configuring SNMP Trap Forwarding

Note Your login determines whether or not you can perform this task. View the Cisco Prime Permission Report (Reports > System > Users > Permission) to determine which tasks are permitted for each user role.

LMS will only forward SNMP traps from devices in the LMS inventory. LMS will not change the trap format—it will forward the raw trap in the format in which it was received from the device. All traps are forwarded in V1 (SNMP Version) format. In LMS 4.2, trap support is provided for SNMPv3 configured devices, unknown devices and non-Cisco devices.

Step 1 Select Admin > Network > Notification and Action Settings > Fault - SNMP trap forwarding.

Step 2 For each host, enter:


• A port number on which the host can receive traps.

Step 3 Click Apply.

Performance SNMP Trap Notification GroupsCisco Prime LMS allows you to create SNMP Trap Receiver Groups using the Trap Receiver Groups option.This is group of hosts that receives specified trap notifications, when any TrendWatch or Threshold violation occurs in LMS.

The Trap destination is defined by the IP address or it can be a host name. From the Trap Receiver Groups page, you can create a Trap Receiver Group, modify the configuration of a Trap Receiver Group, and delete a Trap Receiver Group.

To access the Trap Receiver Group page, Admin > Network > Notification and Action Settings > Performance - SNMP Trap notification. The Trap Receiver Groups page appears.

Table 10-6 describes the fields in the Trap Receiver Groups.

Table 10-6 Trap Receiver Groups Fields

Field Description

Trap Group Name Name of the Trap Receiver Group.

Click on the Name hyperlink to view the details of the Trap Receiver Group created.

Number of Receivers Number of Trap Receivers added to the Trap Receiver Group.

Create

(button)

Creates a Trap Receiver Group. See Creating a Trap Receiver Group.

Edit

(button)

Modifies an existing Trap Receiver group. See Editing a Trap Receiver Group.


OL-25947-01


You can perform the following tasks from the Trap Receiver Groups dialog box:

• Creating a Trap Receiver Group

• Editing a Trap Receiver Group

• Deleting a Trap Receiver Group

• Filtering Trap Receiver Groups

Creating a Trap Receiver Group

To create a Trap Receiver group

Step 1 Select Admin > Network > Notification and Action Settings > Performance - SNMP Trap notification.

The Trap Receiver Groups page appears.

Step 2 Click Create.

The Create Trap Receiver Group page appears, displaying the Trap Group Configuration dialog box.

Table 10-7 describes the fields in the Trap Group Configuration dialog box.

Delete

(button)

Deletes an existing Trap Receiver Group. See Deleting a Trap Receiver Group.

Filter

(button)

Filters information based on the criteria that you select from the drop-down

list. The drop-down list contains the following criteria:

• All

• Group Name

See Filtering Trap Receiver Groups

Table 10-6 Trap Receiver Groups Fields

Field Description

Table 10-7 Trap Group Configuration

Field Description

Group Name Enter the name of the Trap Receiver Group. For example, Trap Receiver Group 1.

The name can contain a mix of alphabets, numerals, and some special characters (such as - _ . # @ $ &).

Receiver Details

Host Enter the host name or IP address. For example 10.77.201.52

Enter the IP address or hostname of the destination to which the trap message should be delivered.

Port Enter the Port Number on which Trap Receiver is listening for traps.

The default port value is 162. This field is optional.


OL-25947-01


Step 3 Enter a descriptive name for the Trap Group name in the GroupName field.

Step 4 Enter the IP address or hostname of the destination to which the trap should be delivered in the Host field.

Step 5 Enter the Port Number on which Trap Receiver is listening for traps in the Port field.

Step 6 Enter the community string that appears in the trap message in Community field.

The community string will be displayed as asterisks.

Note You can add as many as five hosts or devices to the Trap Group by default.

To add more than five hosts to the Trap Group,

Step 1 Click Add More to add another host information to the Trap Group. Go to Step 4 to continue.

Step 2 Click Create to create the Trap Group.

Or

Click Cancel to cancel the operation.

The Trap Receiver Group dialog box appears, displaying the Trap Groups.

Editing a Trap Receiver Group

You can edit a Trap Receiver Group to update or change the hosts, ports and community string of the selected Trap Receiver Group using the Edit button in the List of Trap Receiver Groups.

You can edit only one Trap Receiver Group at a time. If you select multiple Trap Receiver Groups using the check box, the Edit button is disabled. You cannot edit the Trap Receiver Group Name field.

To edit a Trap Receiver Group:

Community Enter the community string that appears in the trap message.

The default community string is public. This field is optional.

Create

(button)

Creates the Trap Receiver Group.

Add More

(button)

Adds more hosts to the present Group.

Cancel

(Button)

Cancels the creation of Trap Receiver Group.


Field Description


OL-25947-01



The Trap Receiver Groups dialog box appears.

Step 2 Select the Trap Receiver Group by checking the corresponding check box against the Trap Receiver Group Name.

Step 3 Click Edit.

The Edit Trap Receiver Group dialog box appears, displaying the earlier settings.

Table 10-8 describes the fields in the Trap Group Configuration dialog box.

Step 4 Make the necessary changes to the Receiver Details.

To add more receivers to the present configuration,

Step 1 Click AddMore in the Trap Group Configuration dialog box.

Step 2 Make necessary changes to the Receiver Details.

Step 3 Click Update in the Trap Group Configuration dialog box to complete updating the Trap Receiver Group.

Or


The Trap Receiver Group dialog box appears, displaying the Trap Groups.


Field Description

Group Name Name of the Trap Receiver Group.

For example, Trap Receiver

Receiver Details


Enter the IP address or hostname of the destination to which the trap message should be delivered.

Port Enter the Port Number on which Trap Receiver is listening for traps.

For example, 162

Community Enter the community string that appears in the trap message.

The default community string is public.

Update

(button)

Updates the Trap Receiver Group.

Add More

(button)


Cancel

(Button)

Cancels the modification of the Trap Receiver Group.


OL-25947-01


Deleting a Trap Receiver Group

You can delete one or more Trap Receiver Groups using the Delete button on the List of Trap Receiver Groups dialog box.

You cannot delete a Trap Receiver Group that is associated with any Threshold or TrendWatch. If you want to delete such Trap Receiver Groups, first remove the Trap Receiver Group from the associated Threshold or TrendWatch.

Before a Trap Receiver Group is deleted, you are prompted to confirm the deletion because you cannot restore a Trap Receiver Group that you have deleted from the database.

To delete a Trap Receiver Group:


The List of Trap Receiver Groups dialog box appears.

Step 2 Select the Trap Group Name by checking the appropriate check box.

You can select multiple Trap Receiver Groups by checking their respective check boxes.


A message appears, prompting you to confirm the deletion,

Step 4 Click OK to delete the Trap Receiver Groups.

Or


If you choose to click OK, a message appears that the Trap Receiver Group is deleted successfully.

The Trap Receiver Groups dialog box appears.

Filtering Trap Receiver Groups

This section describes how you can use the filter option to display the Trap Receiver Group information based on a specific criteria.

To filter a Trap Receiver Groups:


The List of Trap Receiver Group dialog box appears.

Step 2 Select a criteria for filtering from the drop-down list.

Step 3 Enter the data to be filtered.

Step 4 Click Show.

The List of Trap Receiver Groups dialog box appears, displaying the Trap Receiver Group information based on the filter criteria.

Table 10-9 describes the criteria to filter.


OL-25947-01


Table 10-9 Trap Receiver Groups Field Description

Filter Criteria Description

Group Name Select Group Name and enter the data. You can use either of the following methods to filter by entering:

• Complete Group name

• Any wildcard characters of the Trap Receiver Group name (such as *trap, trap*)


OL-25947-01

Chapter 10 Notification and Action Settings Performance Syslog Notification Groups

Performance Syslog Notification GroupsCisco Prime LMS allows you to create Syslog Receiver Groups using the Syslog Receiver Groups option. Syslog Receiver Groups is a group of hosts that receives Syslog messages when any TrendWatch or Threshold violation occurs in LMS.

From the Syslog Receiver Groups page you can create a Syslog Receiver Group, modify the configuration of a Syslog Receiver Group, and delete a Syslog Receiver Group.

To access the Syslog Receiver Group page, select Admin > Network > Notification and Action Settings > Performance - Syslog notification. The List of Syslog Receiver Groups dialog appears.

Table 10-10 describes the fields in the Syslog Receiver Groups.

Table 10-10 Syslog Receiver Groups Fields

Field Description

Syslog Group Name Name of the Syslog Receiver Group.

For example, Syslog Group

Number of Receivers Number of Syslog Receivers added to the Syslog Receiver Group.

Create

(button)

Creates a Syslog Receiver Group. See Creating a Syslog Receiver Group.

Edit

(button)

Modifies an existing Syslog Receiver group. See Editing a Syslog Receiver Group.

Delete

(button)

Deletes an existing Syslog Receiver Group. See Deleting a Syslog Receiver Group.

Filter

(button)

Filters information based on the criteria that you select from the drop-down

list. The drop-down list contains the following criteria:

• All

• Group Name

See Filtering Trap Receiver Groups

Update Facility

(button)

Sends the Syslog message to the receiver, based on the facility level selected in the drop-down list. The drop-down list contains the following criteria:

• local 0

• local 1

• local 2

• local 3

• local 4

• local 5

• local 6

• local 7


OL-25947-01


You can perform the following tasks from the Syslog Receiver Groups dialog box:

• Creating a Syslog Receiver Group

• Editing a Syslog Receiver Group

• Deleting a Syslog Receiver Group

• Filtering Syslog Receiver Groups

Creating a Syslog Receiver Group

To create a Syslog Receiver group:

Step 1 Select Admin > Network > Notification and Action Settings > Performance - Syslog notification.

The Syslog Receiver Groups dialog appears.


The Create Syslog Receiver Group page appears, displaying the Syslog Group Configuration dialog box.

Table 10-11 describes the fields in the Syslog Group Configuration dialog box.

Step 3 Enter a descriptive name for the Syslog Group name in the GroupName field.

Step 4 Enter the IP address or hostname of the destination to which the Syslog messages should be delivered in the Host field.

Step 5 Enter the Port Number on which Syslog Receiver is listening for Syslog Messages in the Port field.

Table 10-11 Syslog Groups Configuration

Field Description

Group Name Enter the name of the Syslog Group name. For example, Syslog Group.

The name can contain a mix of alphabets, numerals, and some special characters (such as - _ . # @ $ &).

Receiver Details


Enter the IP address or hostname of the destination to which the syslog message should be delivered. This IP address should be DNS resolvable.

Port Enter the Port Number on which Syslog Receiver is listening for syslog messages.

The default port value is 514. This field is optional.

Create

(button)

Creates the Syslog Receiver Group

Add More

(button)

Adds more hosts to the present Group

Cancel

(Button)

Cancels the creation of Syslog Receiver Group


OL-25947-01


Note You can add as many as five hosts or devices to the Syslog Group by default.

To add more than five hosts to the Syslog Group,

Step 1 Click AddMore to add another host information to the Syslog Group. Go to Step 4 to continue.

Step 2 Click Create to create the Syslog Group.

Or


The Syslog Receiver Group dialog box appears, displaying the Syslog Groups.

Editing a Syslog Receiver Group

You can edit a Syslog Receiver Group to update or change the hosts and ports of the selected Syslog Receiver Group using the Edit button in the List of Syslog Receiver Groups.

You can edit only one Syslog Receiver Group at a time. If you select multiple Syslog Receiver Groups using the check box, the Edit button is disabled. You cannot edit the Syslog Receiver Group Name field.

To edit a Syslog Receiver Group:


The Syslog Receiver Groups dialog box appears.

Step 2 Select the Syslog Receiver Group by checking the corresponding check box against the Syslog Receiver Group Name.

Step 3 Click Edit.

The Edit Syslog Receiver Group dialog box appears, displaying the earlier settings.

Table 10-11 describes the fields in the Syslog Group Configuration dialog box.


Field Description

Group Name Name of the Syslog Group name.

For example, Syslog Group.

Receiver Details

Host Enter the host name or IP address. for example 10.77.201.52

Enter the IP address or hostname of the destination to which the Syslog message should be delivered.

Port Enter the Port Number on which Syslog Receiver is listening for Syslog messages.

The default port number is 512.


OL-25947-01



To add more receivers to the current configuration:

Step 1 Click AddMore in the Syslog Group Configuration dialog box.


Step 3 Click Update in the Syslog Group Configuration dialog box to complete updating the Syslog Receiver Group.

Or


The Syslog Receiver Group dialog box appears, displaying the Syslog Groups.

Deleting a Syslog Receiver Group

You can delete one or more Syslog Receiver Groups using the Delete button on the List of Syslog Receiver Groups dialog box.

You cannot delete a Syslog Receiver Group which is associated with any Threshold or TrendWatch. If you want to delete such Syslog Receiver Groups, first remove the Syslog Receiver Group from the associated Threshold or TrendWatch.

Before a Syslog Receiver Group is deleted, you are prompted to confirm the deletion because you cannot restore a Syslog Receiver Group that you have deleted from the database.

To delete a Syslog Receiver Group:



Step 2 Select the Syslog Group Name by checking the appropriate check box.

You can select multiple Syslog Receiver Groups by checking their respective check boxes.


A message appears, prompting you to confirm the deletion.

Step 4 Click OK to delete the Syslog Receiver Groups.

Or

Update

(button)

Updates the Syslog Receiver Group.

Add More

(button)


Cancel

(Button)

Cancels the modification of the Syslog Receiver Group.


Field Description


OL-25947-01



If you choose to click OK, a message appears that the Syslog Receiver Group is deleted successfully.


Filtering Syslog Receiver Groups

You can use the Filter option to display the Syslog Receiver Group information based on a specific criteria.

To filter a Syslog Receiver Groups:


The List of Syslog Receiver Group dialog box appears.

Step 2 Select a criteria for filtering from the drop-down list.

Step 3 Enter the data to be filtered.

Step 4 Click Show.

The Syslog Receiver Groups dialog box appears, displaying the Syslog Receiver Group information based on the filter criteria.

Table 10-13 describes the criteria to filter.

Table 10-13 Syslog Receiver Groups Field Description

Filter Criteria Description

Group Name Select Group Name and enter the data. You can use any of the following methods to filter by entering:

• Complete Group name

• Any wildcard characters of the Syslog Receiver Group name (such as *Syslog, Syslog*)


OL-25947-01

Chapter 10 Notification and Action Settings Defining Automated Actions

Defining Automated ActionsYou can create automated actions to be executed automatically whenever Syslog Analyzer receives a specific message type.

This section contains:

• Creating an Automated Action

• Editing an Automated Action

• Guidelines for Writing Automated Script

• Enabling or Disabling an Automated Action

• Exporting or Importing an Automated Action

• Deleting an Automated Action

• Automated Action: An Example

When you select Admin > Network > Notification and Action Settings > Syslog Automated Actions, a list of automated actions appears in the dialog box on the Automated Actions page. Of these, there are two system-defined automated actions (the rest are user-defined). The system-defined automated actions are:

• Inventory Fetch—To fetch inventory from the device.

• Config Fetch—To fetch configuration from the device.

You can edit these system-defined automated actions, but you cannot delete them. These actions are enabled by default. You can choose to disable them by selecting them and clicking Enable/Disable.

Config Fetch might loop if SYS-6-CFG_CHG-*SNMP* message is received from a Catalyst operating system device. You can then edit Config Fetch automated action and you can delete SYS-6-CFG_CHG-*SNMP* message type.

In the Automated Actions dialog box, you can choose whether to include interfaces of selected devices or not.

The columns in the Automated Actions dialog box are:

Note View the Permission Report (Reports > System > Users > Permission) to check if you have the required privileges to perform this task.

Column Description

Name Name of the automated action.

Status Status of the automated action at creation time—Enabled, or disabled

Type Type of automated action—E-mail, script or URL.


OL-25947-01


Using the automated actions dialog box, you can do the following tasks:

If you are creating an automated action, see the example (Automated Action: An Example) of how to set up an automated action that sends an e-mail when a specific Syslog message is received.

On Windows, you cannot set up an automated action to execute an.exe file that interacts with the Windows desktop. For example, you cannot make a window pop up on the desktop.

Related Topics

• Defining Automated Actions

• Creating an Automated Action

• Editing an Automated Action

• Enabling or Disabling an Automated Action

• Exporting or Importing an Automated Action

• Deleting an Automated Action

• Automated Action: An Example

• Guidelines for Writing Automated Script

Creating an Automated Action

To create an automated action:

Step 1 Select Admin > Network > Notification and Action Settings > Syslog Automated Actions.

A dialog box, with a list of automated actions, appears in the Automated Actions page. Here, you can choose whether to include interfaces of selected devices or not. For the description of the columns in the Automated Actions dialog box, see Defining Automated Actions.


A dialog box appears for device selection.

Step 3 Select All Managed Devices or Choose Devices.

If you select the All Managed Devices option:

• You cannot select the individual devices or device categories from the device selector.

• All managed devices are considered.

• The syslog messages from the various device interfaces are considered for creating automated actions.

Task Button

Create an automated action (see Creating an Automated Action). Create

Edit an automated action (see Editing an Automated Action). Edit

Enable or Disable an automated action (see Enabling or Disabling an Automated Action) Enable/Disable

Import or Export an automated action (see Exporting or Importing an Automated Action) Import/Export

Delete an automated action (see Deleting an Automated Action). Delete


OL-25947-01


If you select Choose Devices option, you must select the required devices.

Step 4 Click Next.

A dialog box appears in the Define Message Type page.

Step 5 Enter a unique name for the automated action that you are creating.

Step 6 Select either Enabled or Disabled as the status for the action at creation time.

Step 7 Select the Syslog message types for which you want to trigger the automated action from the Define New Message Type section of the dialog box.

Step 8 Click Next.

The Automated Action Type dialog box appears.

Step 9 Select a type of action (E-mail, URL, or Script) from the Select a type of action drop-down list box.

• If you select E-mail, enter the following information in the Automated Action Type dialog box:

• If you select URL, enter the URL to be invoked, in the URL to Invoke field of the Automated Action type dialog box. In the URL, you can use the following parameters:

– $D (for the device)

– $M (for the complete syslog message).

When the URL is invoked, If you have specified $D or $M, then, $D is substituted with the device hostname or IP address and $M is substituted with the syslog message.

For example, if the URL is

http://hostname/script.pl?device=$D&mesg=$M

When invoked, $D is replaced with 10.68.12.2 and $M is replaced with the URL-encoded syslog message.

• If you select Script, enter the script to be used, in the Script to execute field of the Automated Action type dialog box.

Either enter or select the script file. You can run only shell scripts (*.sh) on Unix and batch files (*.bat) on Windows. The shell script or batch file should have only write/execute permissions for casuser:casusers in UNIX and casuser/Administrator in Windows.

The other users should have only read permission. You must ensure that the scripts contained in the file have permissions to execute from within the casuser account.

The script files must be available at this location:

On Windows:

NMSROOT/files/scripts/syslog

On UNIX:

/var/adm/CSCOpx/files/scripts/syslog

Field Description

Send to List of comma separated e-mail addresses. Mandatory field.

Subject Subject of the e-mail.

Content Content that you want the e-mail to contain.


OL-25947-01


To select the script file:

a. Click Browse.

The Server Side File Browser dialog box appears.

b. Select the file (*.sh on Unix and *.bat on Windows).

Step 10 Click OK.

Step 11 Click Finish.

If the executable program produces any errors or writes to the console, the errors will be logged as Info messages in the SyslogAnalyzer.log.

This file is available at:

On UNIX,

/opt/CSCOpx/log directory

On Windows,

NMSROOT\log directory (where NMSROOT is the root directory of the LMS Server).

Editing an Automated Action

To edit an automated action:


A dialog box, displaying the list of automated actions, appears in the Automated Actions page.

For the description of the columns in the Automated Actions dialog box, see Defining Automated Actions.

Step 2 Select an automated action from the drop-down list and click Edit.

The Select Devices dialog box appears.

Step 3 Select the required devices and click Next.


This dialog box allows you to:

• Change the Message Filter Type—From Enabled to Disabled, or vice, versa.

• Add a message type

• Edit a message type

• Delete a message type

• Select a message type from system-defined message types

Step 4 Click Next.

Step 5 The Automated Action Type dialog box appears.

This dialog box allows you to change the type of action. For example, you can change from E-mail to URL or Script.

• For E-mail, enter or change the following information in the Automated Action type dialog box:


OL-25947-01


Configure the SMTP server to send e-mails in the View / Edit System Preferences dialog box (Admin > System > System Preferences).

We recommend that you configure the E-mail ID in the View / Edit System Preferences dialog box (Admin > System > System Preferences). When the job completes, an e-mail is sent with the E-mail ID as the sender's address

• For URL, enter or change the URL to be invoked, in the Automated Action type dialog box. If you select URL, enter the URL to be invoked, in the URL to Invoke field of the Automated Action type dialog box. In the URL, you can use the following parameters:



When the URL is invoked, If you have specified $D or $M, then, $D is substituted with the device hostname or IP address and $M is substituted with the syslog message.



When invoked, $D is replaced with 10.68.12.2 and $M is replaced with the URL-encoded syslog message.

• If you select Script, enter the script to be used, in the Script to execute field of the Automated Action type dialog box.

Either enter or select the script file. You can run only shell scripts (*.sh) on Unix and batch files (*.bat) on Windows. The shell script or batch file should have only write/execute permissions for casuser:casusers in UNIX and casuser/Administrator in Windows.

The other users should have only read permission. You must ensure that the scripts contained in the file have permissions to execute from within the casuser account.

The script files must be available at this location:

On Windows:

NMSROOT/files/scripts/syslog

On UNIX:

/var/adm/CSCOpx/files/scripts/syslog

To select the script file:

a. Click Browse.

The External Config Selector dialog box appears.

b. Select the file (*.sh on Unix and *.bat on Windows).


The edited automated action appears in the dialog box on the Automated Action page.

Field Description

Send to List of comma separated e-mail addresses.

Subject Subject of the e-mail (optional).



OL-25947-01


Guidelines for Writing Automated Script

To write an automated script:

Step 1 Copy the sampleEmailScript.pl from RME 3.5 or older to the new LMS 4.2 server and put this file in:

For Solaris/Soft Appliance:

/var/adm/CSCOpx/files/scripts/syslog directory

For Windows:

NSMROOT/files/scripts/syslog

Step 2 Write a shell script for Solaris/Soft Appliance or .bat file for Windows in the same directory.

Here is an example shell script (called syslog-email.sh) for UNIX:

#!/bin/sh

/opt/CSCOpx/bin/perl /var/adm/CSCOpx/files/scripts/syslog/sampleEmailScript.pl -text_message "MEssage:

$2 from device: $1" -email_ids [email protected] -subject "Syslog Message: $2" -from [email protected] -smtp mail-server-name.nowhere.com

For Windows, replace $1 and $2 with %1 and %2 and change the directory accordingly.

Enabling or Disabling an Automated Action

To enable or disable an automated action:


A dialog box, displaying the list of automated actions, appears in the Automated Action page. For the description of the columns in the Automated Actions dialog box, see Defining Automated Actions.

Step 2 Select the required automated action from the list in the dialog box.

Step 3 Click Enable/Disable to toggle its status.

The dialog box in the Automated Action page is refreshed and it displays the changed state for the specified automated action.

Exporting or Importing an Automated Action

You can export an automated action to a flat file and use this file on any Syslog Analyzer, using the import option.

To export or import an automated action:


A dialog box, displaying the list of automated actions, appears in the Automated Action page.


OL-25947-01



Step 2 Select an automated action. You can select more than one automated action.

If you do not select an automated action before clicking the Export/Import button, then only the Import option will be available. The Export option will be disabled

Step 3 Click Export/Import.

The Export/Import Automated Actions dialog box appears with the Export or Import options.

Step 4 Select either Export or Import.

Step 5 Either:

• Enter the location of the file to be exported or imported.

Or

• Click Browse.

The Server Side File Browser appears. You can select a valid file, and click OK.

The file location appears in the Export/Import dialog box.

Step 6 Click OK.

Deleting an Automated Action

To delete an automated action:


A dialog box, displaying the list of automated actions, appears in the Automated Action page.


Step 2 Select the required automated action from the list in the dialog box.


You will be asked to confirm the deletion. If you confirm the deletion, the action will be deleted.

Automated Action: An Example

This is an example of how to set up an automated action that sends an e-mail when a specific Syslog message is received. This example assumes that devices have been imported and are sending Syslog messages to the LMS Server.



OL-25947-01



A dialog box, with a list of automated actions, appears in the Automated Action page. For the description of the columns in the Automated Actions dialog box, see Defining Automated Actions.


The Devices Selection dialog box appears.


The Define Message Type dialog box appears.

Step 4 Enter a unique name for the automated action that you are creating.

Step 5 Select either Enabled, or Disabled as the status for the action at creation time.

Step 6 Click Select.

The Select System Defined Message Types dialog box appears.

Step 7 Select the SYS folder, then select the SYS-*-5-CONFIG_I message from the Select System Defined Message Types list, and click OK.

The dialog box on the Define Message Type page appears.

Step 8 Click Next.

The Automated Action Type dialog box appears.

Step 9 Select the type of action—E-mail, Script, or URL.

If you had selected Email in Step 9: Enter the following information:

Configure the SMTP server to send e-mails in the View/Edit System Preferences dialog box (Admin > System > System Preferences).

We recommend that you configure the E-mail ID in the View / Edit System Preferences dialog box (Admin > System > System Preferences). If a syslog is found with the matching type for managed (normal) devices, an e-mail is sent with the E-mail ID as the sender's address. Then go to Step 10.

If you had selected Script in Step 9: Choose the appropriate bat file for Windows, or shell script for Solaris, from the File Selector. For details about these files, see the topic Creating an Automated Action. Then go to Step 10.

If you had selected URL in Step 9: Enter the URL to be invoked. If you select URL, enter the URL to be invoked, in the URL to Invoke field of the Automated Action type dialog box. In the URL, you can use the following parameters:



When the URL is invoked, if you have specified $D or $M, then, $D is substituted with the device hostname or IP address and $M is substituted with the syslog message.


Field Description

Send to List of comma-separated e-mail addresses.

Subject Subject of the e-mail (optional).



OL-25947-01

Chapter 10 Notification and Action Settings Defining Syslog Message Filters


When invoked, $D is replaced with 10.68.12.2 (where 10.68.12.2 is the IP address of the device) and $M is replaced with the URL-encoded syslog message.


Also see Verifying the Automated Action.

Verifying the Automated Action

To verify the automated action:

Step 1 Select a managed router that is already sending Syslog messages to the LMS server and generate a SYS-5-CONFIG_I message by changing the message-of-the-day banner as follows:

a. Connect to the managed router using Telnet and log in.

b. In enable mode enter enable, then enter a password.

c. At the config prompt enter configure terminal.

d. Change the banner by entering:

banner motd zThis is a test banner zend

e. Exit the Telnet session.

Step 2 Make sure that the SYS-5_CONFIG_I message is sent to the LMS Server as follows:

• On UNIX systems, open the syslog_info file located in the /var/log directory, or whichever file has been configured to receive Syslog messages.

• On Windows systems, open the syslog.log file located in the NMSROOT\log\ directory.

Where NMSROOT is the LMS installation directory.

Step 3 Verify that there is a message from the managed router whose banner-of-the-day was changed.

This message appears at the bottom of the log.

• If the message is in the file, an e-mail is mailed to the e-mail ID specified.

• If the message is not in the file, the router has not been configured properly to send Syslog messages to the LMS Server.

Defining Syslog Message FiltersThis section contains:

• Creating a Filter

• Editing a Filter

• Enabling or Disabling a Filter

• Exporting or Importing a Filter


OL-25947-01


• Deleting a Filter

You can exclude messages from Syslog Analyzer by creating filters.


To launch the message filters dialog box:

Step 1 Select Admin > Network > Notification and Action Settings > Syslog Message Filters.

A dialog box appears in the Message Filters page.

A list of all message filters is displayed in this dialog box, along with the names, and the status of each filter—Enabled, or Disabled.

Step 2 Specify whether the filters are for dropping the Syslog messages or for keeping them, by selecting either Drop or Keep.

• If you select Drop, the Common Syslog Collector drops the syslogs that match any of the Drop filters from further processing.

• If you select Keep, Collector allows only the syslogs that match any of the “Keep” filters, for further processing.

Note The Drop or Keep options apply to all message filters. They do not apply to individual filters.

Step 3 Specify whether interfaces of selected devices should be included.

In the dialog box that displays the message filters, you can do the following tasks:

Creating a Filter

You can create a filter for Syslog messages by:


A dialog box with a list of filters, appears in the Message Filter page.

Step 2 Specify whether the filter should be a dropped or kept, by selecting either Drop or Keep.

Task Button

Create a filter (see Creating a Filter). Create

Edit a filter (see Editing a Filter). Edit

Enable or disable a filter (see Enabling or Disabling a Filter). Enable/Disable

Export or import a filter. (see Exporting or Importing a Filter). Export/Import

Delete a filter (see Deleting a Filter). Delete


OL-25947-01


• If you select Drop, the Common Syslog Collector drops the Syslogs that match any of the Drop filters from further processing.

• If you select Keep, Collector allows only the Syslogs that match any of the Keep filters, for further processing.

Note The Drop or Keep options apply to all message filters. They do not apply to individual filters.


The dialog box appears for device selection.

Step 4 Select All Managed Devices or Choose Devices.

If you select the All Managed Devices option:

• You cannot select the individual devices or device categories from the device selector.

• All managed devices are considered.

• The syslog messages from the various device interfaces are considered for creating message filters.

If you select the Choose Devices option, you must select the required devices.

Step 5 Click Next.

.A dialog box appears in the Define Message Type page.

Step 6 Enter a unique name for the filter.

Step 7 Select either the Enabled, or the Disabled status for the filter at creation time.

Step 8 Select the Syslog message types for which you want to apply the filter.


The list of filters in the message filter dialog box on the Message Filters page is refreshed.

Editing a Filter

To edit a filter:


A dialog box, displaying the list of filters, appears in the Message Filter page.

Step 2 Select a filter by clicking on its check box, and click Edit.

The Select Devices dialog box appears.



This dialog box allows you to:

• Change the filter Status—From Enabled to Disabled, or vice, versa.

• Add a message type

• Edit a message type

• Delete a message type


OL-25947-01


• Select a message type from system-defined message types

Step 4 Click Finish after you make all your changes.

The edited filter appears in the dialog box on the Message Filter page.

Enabling or Disabling a Filter

To enable or disable a filter:


A dialog box, with the list of filters, appears in the Message Filter page.

Step 2 Select the required filter from the list in the dialog box.

Step 3 Click Enable/Disable to toggle its status.

The dialog box in the Message Filter page is refreshed and it displays the changed state for the specified filter.

Exporting or Importing a Filter

You can export a filter to a flat file and use this file on any Syslog Analyzer, using the import option.

To export or import a filter:


A dialog box, with the list of filters, appears in the Message Filter page.

Step 2 Select a filter. You can select more than one filter.

Step 3 Click Export/Import.

The Export/Import dialog box appears with the Export or Import options.

Step 4 Select either Export or Import.


OL-25947-01

Chapter 10 Notification and Action Settings Inventory and Config Collection Failure Notification

Step 5 Either:

• Enter the location of the file to be exported or imported.

Or

a. Click Browse.

The Server Side File Browser appears.

b. Select a valid file location, and click OK.

The file location appears in the Export/Import dialog box.

Step 6 Click OK.

Deleting a Filter

To delete a filter:


A dialog box, displaying the list of filters, appears in the Message Filter page.

Step 2 Select the required filter from the list in the dialog box.


When you confirm the deletion, the filter is deleted.

Inventory and Config Collection Failure NotificationThis section contains:

• Configuring Trap Notification Messages

• Examples for Collection Failure Notification

• Fields in a Trap Notification Message

You can use the Collection Failure Notification option to configure the destination Server and Port to receive trap notification on Inventory Collection or Config Fetch failure. This failure trap is sent per device from the LMS server whenever the collection does not happen.

Other network management stations can use this trap to know about LMS Inventory or Config collection failure status. You can check or uncheck the options available in this page to enable or disable the sending of trap notifications to other servers on Inventory Collection or Config Fetch failure.


OL-25947-01


Table 10-14 lists the various fields and buttons available in the Notification on Failure Window:

Table 10-14 Collection Failure Notification

Field Description

All Check this option, if you require both the Config Fetch Failure and Inventory Collection Failure trap notification to be sent to the listed servers.

The listed servers are those servers that you have configured to receive trap notifications. See the description for List of Destination field for more information.

Config Collection Check this option, if you require the Config Fetch Failure trap notification to be sent to the listed servers.

Uncheck this option if you do not want the Config Fetch Failure trap notification to be sent to the listed servers.


Inventory Collection

Check this option, if you require the Inventory Collection Failure trap notification to be sent to the listed servers.

Uncheck this option if you do not want the Inventory Collection Failure trap notification to be sent to the listed servers.


Trap Destination Information

Server The name or IP address of the destination server.

Port The port number of the destination server.

List of Destinations

The names of the destination servers along with their ports which are configured to receive the trap notifications.

Buttons

Add Use the Add button to add the destination server and port information. On clicking Add, the server and port information get reflected in the List of Destinations list.

Delete Use the Delete button to remove server and port information from the List of Destinations. To do so, select one or more server and port entry from the list of Destinations list and click on Delete to remove the entries from the list.

Apply Click to accept the changes made.


OL-25947-01


Configuring Trap Notification Messages

To configure the distribution of trap notification messages from LMS to the connected hosts:

Step 1 Select Admin > Network > Notification and Action Settings > Inventory and Config collection failure notification.

The Notification on Failure dialog box appears. Refer to to further complete the selection in this dialog box.

Step 2 Click Apply to accept the changes made.

Examples for Collection Failure Notification

Example for Config Fetch Failure

You are providing the following information in the Collection Failure Notification screen:

Destination Server: 10.77.153.47

Destination Port: 162

You are also enabling the Send Notification on Config Fetch Failure option. By enabling this option you are allowing trap notifications to be sent to the specified destination server on Config Fetch Failure using the specified port.

After that you add few new devices to LMS and schedule a job to fetch the configurations for all the devices. There is a Config Fetch Failure as the scheduled job is unable to fetch the configurations for the new devices. The server 10.77.153.47 receives trap notifications for each Config Fetch Failure per device.

Example for Inventory Collection Failure

You are providing the following information in the Collection Failure Notification screen:

Destination Server: 10.77.153.47

Destination Port: 162

You are also enabling the Inventory Collection option. By enabling this option you are allowing trap notifications to be sent to the specified destination server on Inventory Collection Failure using the specified port.

After that you add few new devices to LMS and schedule a job to fetch the inventory information for all devices. There is a Inventory Collection Failure as the scheduled job is unable to fetch the inventory details for the new devices. The server 10.77.153.47 receives trap notifications for each Inventory Collection Failure per device.

Fields in a Trap Notification Message

Table 10-15 lists the various fields that constitute a Configuration Fetch or Inventory Collection Failure trap notification message.


OL-25947-01

Chapter 10 Notification and Action Settings IPSLA Syslog Configuration

IPSLA Syslog ConfigurationSyslog is a trap message that is sent from the device if any changes occur to the device. You can either enable or disable the IPSLA Syslog. However the IPSLA Syslog can be configured only by a Network Administrator or System Administrator.

The Device Selector will display only the Source devices that are IPSLA enabled. It does not display any Target devices.

To enable or disable IPSLA Syslog:

Step 1 Select Admin > Network > Notification and Action Settings > IPSLA Syslog Configuration.

The IPSLA Syslog Configuration page appears.

Step 2 Click Enable

If you click Enable, LMS will run the IPSLA CLI Command on the selected device, through the config job on the LMS server. This enables the generation of the IPSLAs specific traps through the system logging (Syslog process). Immediate job will be created in LMS and the Job ID link appears. Clicking the link will display the Syslog details.

Or

If you click Disable, LMS will run the IPSLA CLI Command on the selected device, through the config job on the LMS server.

(LMS will run the IPSLA CLI Command on the selected device, through the config job on the LMS server). Immediate job will be created in LMS and the Job ID link appears. Clicking the link will display the Syslog details.

Note In a Multi-server setup among different versions, IPSLA Syslog enables supported version will be greater than LMS 4.2

Table 10-15 Fields in a Trap Notification Message

Field Description

Application Name LMS application that caused this change or identified the change and generated the notification.

Device Name Network device for which the inventory or configuration collection has failed.

Collection Failure Time

Time at which the inventory or configuration collection job failed.

Error Message The message that describes the reason for the collection failure. Some examples of trap error messages:

Inventory Collection Failed due to SNMP TimeOut Exception.

Config Collection Failed due to authentication failure.


OL-25947-01

Chapter 10 Notification and Action Settings IPSLA Syslog Configuration


OL-25947-01

Documents

Chapter 10: Notification and Action Settings...Administration of Cisco Prime LAN Management Solution 4.2 OL-25947-01 Chapter 10 Notification and Action Settings Customizing LMS Events