Cisco Acs 57 User Guide

							7   
Monitoring and Reporting in ACS
Configuring Tabs in the Dashboard
The tab appears with the new name.
Changing the Dashboard Layout
You can change the look and feel of the Dashboard. ACS provides you with nine different in-built layouts. To choose a 
different layout:
1.From the Monitoring and Report Viewer, choose Monitoring and Reports > Dashboard.
The Dashboard page appears.
2.Select the tab whose layout you wish to change.
3.Click the Configure drop-down list at the upper-right corner of the Dashboard page.
A list of layout options appears.
4.Click the radio button the layout style that you want for this tab.
5.Click Save to change the layout.
Deleting Tabs from the Dashboard
To delete tabs from the Dashboard:
1.From the Monitoring and Report Viewer, choose Monitoring and Reports > Dashboard.
The Dashboard page appears.
2.Click the Configure drop-down list at the upper-right corner of the Dashboard page.
3.Click Manage Pages.
4.Select the tab that you want to delete in the Page Display Order list box.
5.Click   to delete the tab that you have selected.
Note: Alternatively, when you hover the mouse over the name of the tab that you want to delete, the following icon 
appears: . Click this icon to delete the tab. 
						

							8
Monitoring and Reporting in ACS
 
Configuring Tabs in the Dashboard 
						

							1
Cisco Systems, Inc.www.cisco.com
 
Managing Alarms
The Monitoring feature in ACS generates alarms to notify you of critical system conditions. The monitoring component 
retrieves data from ACS. You can configure thresholds and rules on this data to manage alarms. 
Alarm notifications are displayed in the web interface and you can get a notification of events through e-mail and Syslog 
messages. ACS filters duplicate alarms by default.
This chapter contains the following sections:
Understanding Alarms, page 1
Viewing and Editing Alarms in Your Inbox, page 3
Understanding Alarm Schedules, page 8
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Deleting Alarm Thresholds, page 36
Configuring System Alarm Settings, page 36
Understanding Alarm Syslog Targets, page 37
Understanding Alarms
There are two types of alarms in ACS:
Threshold Alarms, page 1
System Alarms, page 1
Threshold Alarms
Threshold alarms are defined on log data collected from ACS servers that notify you of certain events. For example, you 
can configure threshold alarms to notify you of ACS system health, ACS process status, authentication activity or 
inactivity, and so on.
You define threshold conditions on these data sets. When a threshold condition is met, an alarm is triggered. While 
defining the threshold, you also define when the threshold should be applied (the time period), the severity of the alarm, 
and how the notifications should be sent. 
Fifteen categories of available alarm thresholds allow you to monitor many different facets of ACS system behavior. See 
Creating, Editing, and Duplicating Alarm Thresholds, page 10 for more information on threshold alarms.
System Alarms
System alarms notify you of critical conditions encountered during the execution of the ACS Monitoring and Reporting 
viewer. System alarms also provide informational status of system activities, such as data purge events or failure of the 
log collector to populate the View database. 
You cannot configure system alarms, which are predefined. However, you do have the option to disable system alarms 
or decide how you want to be notified if you have enabled them. 
						

							2
Managing Alarms
 
Understanding Alarms
This section contains the following topics:
Evaluating Alarm Thresholds, page 2
Notifying Users of Events, page 2
Evaluating Alarm Thresholds
ACS evaluates the threshold conditions based on a schedule. You define these schedules and, while creating a threshold, 
you assign a schedule to it. A schedule consists of one or more continuous or noncontinuous periods of time during the 
week.
For example, you can create a schedule that is active from 8:00 a.m. to 5:00 p.m., Monday through Friday. See 
Understanding Alarm Schedules, page 8 for more information. When you assign this schedule to a threshold, ACS 
evaluates the threshold and generates alarms only during the active period.
ACS evaluates the thresholds periodically depending on the number of thresholds that are currently enabled.
Table 111 on page 2 provides the length of the evaluation cycle for a given number of thresholds.
When an evaluation cycle begins, ACS evaluates each enabled threshold one after another. If the schedule associated 
with the threshold allows the threshold to be executed, ACS evaluates the threshold conditions. An alarm is triggered if 
the condition is met. See Creating, Editing, and Duplicating Alarm Thresholds, page 10 for more information.
Note: System alarms do not have an associated schedule and are sent immediately after they occur. You can only enable 
or disable system alarms as a whole.
Notifying Users of Events
When a threshold is reached or a system alarm is generated, the alarm appears in the Alarms Inbox of the web interface. 
From this page, you can view the alarm details, add a comment about the alarm, and change its status to indicate that it 
is Acknowledged or Closed. 
The alarm details in this page, wherever applicable, include one or more links to the relevant reports to help you 
investigate the event that triggered the alarm.
The Dashboard also displays the five most recent alarms. Alarms that you acknowledge or close are removed from this 
list in the Dashboard.
ACS provides you the option to receive notifications in the following formats:
E-mail—Contains all the information that is present in the alarm details page. You can configure a list of recipients to 
whom this e-mail must be sent. ACS 5.7 provides you the option to receive notification of events through e-mail in 
HTML format.
Syslog message—Sent to the Linux or Windows machines that you have configured as alarm syslog targets. You can 
configure up to two alarm syslog targets.
Table 111 Evaluation Cycle of Alarm Thresholds
Number of Enabled Thresholds Evaluation Cycle1
1. If the time taken to evaluate the thresholds increase, then the evaluation cycle increases from 2 to 
3 minutes, 3 to 5 minutes, and from 5 to 15 minutes. The evaluation cycle time is reset to 2, 3, and 
5 minutes every 12 hours.
1 to 20 Every 2 minutes
21 to 50 Every 3 minutes
51 to 100 Every 5 minutes 
						

							3   
Managing Alarms
Viewing and Editing Alarms in Your Inbox
Viewing and Editing Alarms in Your Inbox
You can view alarms that ACS generates based on a threshold configuration or a rule on a set of data collected from ACS 
servers. Alarms that have met the configured thresholds are sent to you r i nb ox. After you view an alarm, you  can edi t the 
status of the alarm, assign the alarm to an administrator, and add notes to track the event.
To view an alarm in your Inbox, select Monitoring and Reports > Alarms > Inbox.
The Inbox page appears with a list of alarms that ACS triggered. Table 112 on page 3 describes the fields on the Alarms 
page. Table 113 on page 4 lists the system alarms in ACS 5.7 and its severity. 
Table 112 Alarms Page
Option Description
SeverityDisplay only. Indicates the severity of the associated alarm. Options are:
Critical
Warning
Info
Name Indicates the name of the alarm. Click to display the Alarms: Properties page and edit the alarm.
Ti m e  Display only. Indicates the time of the associated alarm generation in the format Ddd Mmm dd 
hh:mm:ss timezone yyyy, where:
Ddd = Sun, Mon, Tue, Wed, Thu, Fri, Sat.
Mmm = Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec.
dd = A two-digit numeric representation of the day of the month, from 01 to 31.
hh = A two-digit numeric representation of the hour of the day, from 00 to 23.
mm = A two-digit numeric representation of the minute of the hour, from 00 to 59.
ss = A two-digit numeric representation of the second of the minute, from 00 to 59.
timezone = The time zone.
yyyy = A four-digit representation of the year.
CauseDisplay only. Indicates the cause of the alarm.
Assigned ToDisplay only. Indicates who is assigned to investigate the alarm.
StatusDisplay only. Indicates the status of the alarm. Options are:
New—The alarm is new.
Acknowledged—The alarm is known.
Closed—The alarm is closed.
Edit Check the check box the alarm that you want to edit, and click Edit to edit the status of the alarm and 
view the corresponding report.
Close Check the check box the alarm that you want to close, and click Close to close the alarm. You can 
enter closing notes before you close an alarm.
Closing an alarm only removes the alarm from the dashboard. It does not delete the alarm.
Delete Check the check box the alarm that you want to delete, and click Delete to delete the alarm. 
						

							4
Managing Alarms
 
Viewing and Editing Alarms in Your Inbox
Table 113 System Alarms in ACS 5.7
AlarmSeverity
Purge Related Alarms
Backup failed. Backup failed before Database Purge. Critical
Backup successful. Backup failed before Database Purge. Info
Database Purge for Daily Tables failed. Exception Details. Critical
Database Purge for Monthly Tables failed. Exception Details. Critical
Database Purge for Yearly Tables failed. Exception Details. Critical
Incremental backup is not configured. Configuring incremental backup is necessary to make the 
database purge successful. This will help to avoid disk space issues. View database Size is file 
size in GB and size it occupies on the hard disk is actual db size in GB.Warning
Configure Incremental Backup Data Repository as Remote Repository otherwise backup will fail 
and Incremental backup mode will be changed to off.Warning
Configure Remote Repository under Purge Configuration which is used to take a backup of data 
before purge.Warning
View database size exceeds the maximum limit of maxLimit GB. View database Size is file size 
GB and size it occupies on the hard disk is actualDBSize GB. View database size exceeds the 
max limit of maxlimit GB.Critical
View database size exceeds the upper limit of upperLimit GB. View database Size is file size 
GB and size it occupies on the hard disk is actualDBSize GB. View database size exceeds the 
upper limit of upperLimit GB.Critical
ACS View DB Size exceeds the lower limit lowerLimit G B .  Vi e w  d a t a b a s e  S i z e  i s  f i l e  s i z e  G B  a n d  
size it occupies on the hard disk is actualDBSize GB. View database size exceeds the lower limit 
of lowerLimit GB.Warning
DB Purge. Database Start Purging. Info
Disk Space Limit Exceeded - Window at : Disk Space Limit Exceeded recommended threshold 
at one month data. Now Purging week data till it reaches lower limit.Warning
ACS view Application Exceeded its Maximum Allowed Disk size. Disk Space Exceeded 
recommended threshold, extra monthsinnumber month(s) data purged.Warning
ACS view Application Exceeded its Maximum Allowed Disk size. Disk Space Exceeded 
recommended threshold monthsinnumber month(s) data purged.Info
Purge is successful. The size of records present in view data base is actualsizeinGB GB. The 
physical size of the view data base on the disk sizeinGB GB. If you want to reduce the physical 
size of the view data base, run acsview-db-compress command from acs-config mode 
through command line.Warning
Purge process removed week week(s) data to reach lower limit Info
Purge process was tried to remove maximum data to reach lower limit by purging last three 
weeks data but still acsview database size is having greater than lower limit. Currently we are 
keeping only last 1 week data.Warning
The number of incoming log messages is reaching threshold value: GB's. Make sure that you 
configured ACS to send only the important category of messages to Log collector.Warning
Incremental Backup
On-demand Full Backup failed: Exception Details. Critical
Full Database Backup failed. Exception Details. Critical
Full Database Purge Backup failed. Exception Details. Critical
Incremental Backup Failed. Exception Details. Critical 
						

							5   
Managing Alarms
Viewing and Editing Alarms in Your Inbox
Incremental Restore Successful. Info
Incremental Restore failed. Reason: Exception Details Critical
On-demand Full Backup failed: Exception Details Critical
Full Database Backup failed: Exception Details. Critical
Full Database Purge Backup failed: Exception Details Critical
Incremental Backup Failed: Exception Details Critical
Log Recovery
Log Message Recovery failed: Exception Details Critical
View Compress
Database rebuild operation has started. The Log collector services would be shut down during 
this operation and they would be made up after rebuild operation is completed. If log recovery 
option is enabled already, any log messages that may be received during the rebuild operation 
would be recovered after log collector services are up.Critical
The database reload operation completed. Info
System detects a need to compress the database. Run the view database compress operation 
manually during maintenance window, otherwise, automatic database rebuild would be 
triggered to avoid disk space issue.Warning
Automatic database rebuild operation has started. The Log collector services would be shut 
down during this operation and they would be made up after rebuild operation is completed. If 
log recovery option is enabled already, any log messages that may be received during the 
rebuild operation would be recovered after log collector services are up.Critical
The database reload operation completed. Info
Automatic database rebuild operation would be triggered as the size of the database exceeds 
the limit to avoid disk space issue. Enable log recovery feature to recover missed log messages 
during database rebuild operation. Database re-build operation will not continue till log 
recovery feature enabled.Warning
Threshold Executor
Could not complete executing all thresholds in the allocated thresholdEvaluationInterval minute 
interval. Thresholds will be evaluated again in the next interval. This error could have happened 
because: The system is under heavy load (example: During Purging) There might be too many 
thresholds active at this time.Info
Session Monitor
Active sessions are over limit. Session is over 250000. Warning
Syslog Collector Failure
Please see Collector log for details. Critical
Scheduled ACS Backup
Scheduled backup of ACS configuration db failed to start due to invalid character in backup 
name.Critical
Scheduled backup of ACS configuration db failed to start due to invalid repository. Please verify 
that repository exists.Critical
Unable to get hostname. Scheduled backup of ACS configuration db failed. Please check 
ADE.log for more details.Critical
Table 113 System Alarms in ACS 5.7 (continued)
AlarmSeverity 
						

							6
Managing Alarms
 
Viewing and Editing Alarms in Your Inbox
Failed to load backup library. Scheduled backup of ACS configuration db failed. Please check 
ADE.log for more details.Critical
Symbol lookup error. Scheduled backup of ACS configuration db failed. Please check ADE.log 
for more details.Critical
Failed to perform ACS backup due to internal error. Please check ADE.log for more details. Critical
System Diagnostics
Secondary node stopped from processing replications. Critical
Secondary node cannot establish communication channel against Primary node on 
Heartbeat/Replication/Replay topic.Warning
Primary node cannot establish communication channel against secondary node on 
Heartbeat/Replication/Replay topic.Warning
Heartbeat from Primary/Secondary indicates that Secondary is not synchronized with Primary 
for long time.Warning
No heartbeat status is received from the secondary node for certain amount of time.  Warning
No heartbeat status is received from the primary node for certain amount of time. Warning
Disk Size Check
Backup of size directorySize M exceeds the allowed quota of MaxSize M. This will not prohibit 
backup process as long as there is enough disk space. Please note that this indicates you 
should consider moving ACS to a higher disk space machine.Critical
Patch of size directorySize M exceeds the allowed quota of MaxSize M. This will not prohibit 
patch installation process as long as there is enough disk space. Please note that this indicates 
you should consider moving ACS to a higher disk space machine.Critical
Support bundle of size directorySize M exceeds the allowed quota of MaxSize M. This will not 
prohibit support bundle collection process as long as there is enough disk space. Please note 
that this indicates you should consider moving ACS to a higher disk space machine.Critical
Backup of size directorySize M exceeds the allowed quota of MaxSize M. This will not prohibit 
restore process as long as there is enough disk space. Please note that this indicates you 
should consider moving ACS to a higher disk space machine.Critical
Disk Quota
ACS DB size has exceeded allowed quota. Critical
ACS View DB size has exceeded allowed quota. Critical
View Data Upgrade
Database conversion has successfully completed. The View newVersion database has been 
upgraded to installedVersion and is ready for activation.Warning
Database conversion did not complete successfully. The View newVersion upgrade process 
encountered errors and was not able to complete. The upgrade log contains detailed 
information.Critical
Others
Aggregator is busy. Dropping syslog. Critical
Collector is busy. Dropping syslog. Critical
Unregistered ACS Server servername. Warning
Unknown Message code received. Critical
Table 113 System Alarms in ACS 5.7 (continued)
AlarmSeverity 
						

							7   
Managing Alarms
Viewing and Editing Alarms in Your Inbox
Note: The Alarm for ACS database exceeding the quota is sent only when the total size of the ACS database exceeds 
the quota. Total size of ACS database = acs*.log + acs.db where acs*.log is the ACS database log file. Both the acs*.log 
and acs.db files are present under /opt/CSCOacs/db. 
Note: ACS cannot be used as a remote syslog server. But, you can use an external server as a syslog server. If you use 
an external server as a syslog server, no alarms can be generated in the ACS view as the syslog messages are sent to 
the external syslog server. If you want to generate the alarms in ACS view, set the logging option as localhost using CLI.
To edit an alarm:
1.Select Monitoring and Reports > Alarms > Inbox.
The Inbox page appears with a list of alarms that ACS triggered.
2.Check the check box the alarm that you want to edit and click Edit.
The Inbox - Edit page appears with the following tabs:
Alarm—This tab provides more information on the event that triggered the alarm. Table 114 on page 7 describes the 
fields in the Alarm tab. You cannot edit any of the fields in the Alarm tab.
Status—This tab allows you to edit the status of the alarm and add a description to track the event.
3.Modify the fields in the Status tab as required. Table 115 on page 7 describes the fields.
4.Click Submit to save the changes.
The Alarms page appears with the changes you made.
Related Topics
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Table 114 Inbox - Alarm Tab
Option Description
Occurred At Date and time when the alarm was triggered.
Cause The event that triggered the alarm.
Detail Additional details about the event that triggered the alarm. ACS usually lists the counts of items 
that exceeded the specified threshold.
Report Links Wherever applicable, one or more hyperlinks are provided to the relevant reports that allow you 
to further investigate the event.
Threshold Information on the threshold configuration.
Table 115 Inbox - Status Tab
Option Description
Status Status of the alarm. When an alarm is generated, its status is New. After you view the alarm, change 
the status of the alarm to Acknowledged or Closed to indicate the current status of the alarm.
Assigned To (Optional) Specify the name of the user to whom this alarm is assigned.
Notes (Optional) Enter any additional information about the alarm that you want to record. 
						

							8
Managing Alarms
 
Understanding Alarm Schedules
Deleting Alarm Thresholds, page 36
Understanding Alarm Schedules
You can create alarm schedules to specify when a particular alarm threshold is run. You can create, edit, and delete alarm 
schedules. You can create alarm schedules to be run at different times of the day during the course of a seven-day week.
By default, ACS comes with the non-stop alarm schedule. This schedule monitors events 24 hours a day, seven days a 
week.
To view a list of alarm schedules, choose Monitoring and Reports > Alarms > Schedules. The Alarm Schedules page 
appears. Table 116 on page 8 lists the fields in the Alarm Schedules page.
This section contains the following topics:
Creating and Editing Alarm Schedules, page 8
Assigning Alarm Schedules to Thresholds, page 9
Deleting Alarm Schedules, page 9
Creating and Editing Alarm Schedules
To create or edit an alarm schedule:
1.Choose Monitoring and Reports > Alarms > Schedules.
The Alarm Schedules page appears.
2.Do either of the following:
Click Create.
Check the check box the alarm schedule that you want to edit, then click Edit.
The Alarm Schedules - Create or Edit page appears. Table 117 on page 9 lists the fields in the Alarms Schedules - 
Create or Edit page.
Table 116 Alarm Schedules Page
Option Description
Filter Enter a search criterion to filter the alarm schedules based on your search criterion.
Go Click Go to begin the search.
Clear Filter Click Clear Filter to clear the search results and list all the alarm schedules.
Name The name of the alarm schedule.
Description (Optional) A brief description of the alarm schedule.