Cisco Prime Nerk 43 User Guide
Have a look at the manual Cisco Prime Nerk 43 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
![Page 1137
C-25
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-23 BGP Process Down Causes BGP Link Down Events
For the event [BGP Link Down, RR2 < > PE-North-West]:
Additional Collected Events: [BGP Process Down, RR2].
Root cause: Correlates to the event [BGP Process Down, RR2].
Figure C-24 displays the events identified by the system in this scenario.
Figure C-24 BGP Process Down Correlation
BGP process down
RR2-IOU-176
RR2-IOU-176 : 169.254.......](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1136.png "Page 1137
C-25
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-23 BGP Process Down Causes BGP Link Down Events
For the event [BGP Link Down, RR2 < > PE-North-West]:
Additional Collected Events: [BGP Process Down, RR2].
Root cause: Correlates to the event [BGP Process Down, RR2].
Figure C-24 displays the events identified by the system in this scenario.
Figure C-24 BGP Process Down Correlation
BGP process down
RR2-IOU-176
RR2-IOU-176 : 169.254.......")
![Page 1138
C-26
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Device Unreachable
For the event [BGP Link Down, RR2 < > PE-North-West]:
Additional Collected Events: [Device Unreachable, RR2].
Root cause: Correlates to [Device Unreachable, RR2].
In an unmanaged network core (as illustrated in Figure C-25), the following events might be identified
in addition to the BGP Link Down event:
BGP Process Down.
Device Unreachable.
Figure C-25 Lab Setup with...](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1137.png "Page 1138
C-26
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Device Unreachable
For the event [BGP Link Down, RR2 < > PE-North-West]:
Additional Collected Events: [Device Unreachable, RR2].
Root cause: Correlates to [Device Unreachable, RR2].
In an unmanaged network core (as illustrated in Figure C-25), the following events might be identified
in addition to the BGP Link Down event:
BGP Process Down.
Device Unreachable.
Figure C-25 Lab Setup with...")
![Page 1139
C-27
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
BGP Process Down
NoteThe BGP Process Down event occurs on the managed PE-South.
In Figure C-26, the BGP Process Down event on PE-South causes BGP Link Down events. The relevant
devices are PE-South, RR1, and RR2.
Figure C-26 BGP Process Down on PE-South Causes BGP Link Down Events
For the event [BGP Link Down, PE-South < > RR2]:
Additional Collected Events: [BGP Process Down, PE-South] and
[BGP...](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1138.png "Page 1139
C-27
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
BGP Process Down
NoteThe BGP Process Down event occurs on the managed PE-South.
In Figure C-26, the BGP Process Down event on PE-South causes BGP Link Down events. The relevant
devices are PE-South, RR1, and RR2.
Figure C-26 BGP Process Down on PE-South Causes BGP Link Down Events
For the event [BGP Link Down, PE-South < > RR2]:
Additional Collected Events: [BGP Process Down, PE-South] and
[BGP...")
![Page 1144
C-32
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-33 Example
In this case, the system provides the following report:
Root cause: [Link Down, Router 2 < > Switch 2]
Correlated events:
–[Primary HSRP Interface is Not Active, Router 2]
%HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Active -> Speak (source:
Router 2)
–[Secondary HSRP Interface is Active, Router 3]
%STANDBY-6-STATECHANGE: Ethernet0/0 Group 1 state Standby -> Active...](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1143.png "Page 1144
C-32
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-33 Example
In this case, the system provides the following report:
Root cause: [Link Down, Router 2 < > Switch 2]
Correlated events:
–[Primary HSRP Interface is Not Active, Router 2]
%HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Active -> Speak (source:
Router 2)
–[Secondary HSRP Interface is Active, Router 3]
%STANDBY-6-STATECHANGE: Ethernet0/0 Group 1 state Standby -> Active...")
C-29 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-30 Device Unreachable on CE EFP Down Correlation Scenarios An Ethernet Flow Point (EFP) is a forwarding decision point in the PE switch or router that gives network designers the flexibility to make many Layer 2 flow decisions at the interface level. Many EFPs can be configured on a single physical port. These EFPs can be configured on any Layer 2 traffic port (usually on the UNI port). Each EFP manipulates the frames that enter it in a different manner and makes different forwarding decisions. EFP Down Correlation Example 1 Figure C-31 provides an example of devices with EFP provisioning. Figure C-31 EFP Down Example 1 In this example, service instances 900 and 901 are configured on port Gi4/3. Route Reflector PEPE CE Device Unreachable Management 247293 7201-P1 10.56.101.1266504E-PE3 10.56.101.133 Fa0/0 Gi0/3Gi4/3
C-30 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios The physical link (Gi0/3 < > Gi4/3) is shut down. The expected alarm hierarchy: Link down –EFP down –Link down syslogs –Other related faults EFP Down Correlation Example 2 Figure C-32 provides an example of devices with EFPs and a pseudowire provisioned. Figure C-32 EFP Down Example 2 Service instances 900 and 901 are configured on port Gi4/3, and a local pseudowire is configured between Gi4/3 900 and Gi4/3 901 (local switching). Service instance 900 is shut down. The expected alarm hierarchy: EFP down due to administrative down –EFP down syslogs –Local switching down –Other related faults EFP Down Correlation Example 3 Example 3 also uses Figure C-32. Service instance 900 is configured on port Gi4/3 and connects to a pseudowire through a bridge domain. Service instance 900 is shut down. The expected alarm hierarchy: EFP down due to administrative down –EFP syslogs –Pseudowire tunnel down –Other related faults PW 247294 7201-P1 10.56.101.1266504E-PE3 10.56.101.133 Fa0/0 Gi0/3Gi4/3
C-31 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios EFP Down Correlation Example 4 Example 4 also uses Figure C-32. Service instance 900 is configured on port Gi4/3 and connects to a pseudowire through a bridge domain. Generate traffic to switch the service instance status to error disabled. The expected alarm hierarchy: EFP down due to error disabled –EFP syslogs –Pseudowire tunnel down –Other related faults HSRP Scenarios These topics describe scenarios that can generate HSRP alarms: HSRP Alarms, page C-31 HSRP Example, page C-31 HSRP Alarms When an active Hot Standby Router Protocol (HSRP) group’s status changes, a service alarm is generated and a syslog is sent. NoteHSRP group information can be viewed in the inventory window of Prime Network NetworkVision. HSRP Example In Figure C-33, the link between Router 2 and Switch 2 is shut down, causing the HSRP standby group on Router 3 to become active, and a Link Down service alarm to be generated. The primary HSRP group on Router 2 is no longer active. A service alarm is generated and correlated to the Link Down alarm. Router 2 also sends a syslog which is correlated to the Link Down alarm. The secondary HSRP group configured on Router 3 now changes from standby to active. This network event triggers an IP-based active flow with the destination being the virtual IP address configured in the HSRP group. When the flow reaches its destination, a service alarm is generated and correlated to the Link Down alarm. Router 3 also sends a syslog that is correlated to the Link Down alarm. Table C-1 HSRP Service Alarms Alarm Ticketable?Correlation allowed? Correlated to Severity Primary HSRP interface is not active/Primary HSRP interface is activeYes No Can be correlated to several other alarms; for example, link downMajor Secondary HSRP interface is active/Secondary HSRP interface is not activeYes No Can be correlated to several other alarms; for example, link downMajor
C-32 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-33 Example In this case, the system provides the following report: Root cause: [Link Down, Router 2 < > Switch 2] Correlated events: –[Primary HSRP Interface is Not Active, Router 2] %HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Active -> Speak (source: Router 2) –[Secondary HSRP Interface is Active, Router 3] %STANDBY-6-STATECHANGE: Ethernet0/0 Group 1 state Standby -> Active (source: Router 3) IP Interface Failure Scenarios These topics describe scenarios that can generate IP interface failures: Interface Status Down Alarm, page C-32 All IP Interfaces Down Alarm, page C-34 IP Interface Failure Examples, page C-34 Interface Status Down Alarm Alarms related to subinterfaces (for example, a Line Down trap or syslog) are reported on IP interfaces configured above the relevant subinterface. This means that in the system, subinterfaces are represented by the IP interfaces configured above them. All events sourcing from subinterfaces without a configured IP interface are reported on the underlying Layer 1. Router 5 10.222.1.5Router 10 10.222.1.10 Router 3 10.222.1.3Router 2 110.110.110.1100/0 10/200.2.5 Switch 3 10.200.2.6 Switch 5 10.200.2.7Switch 2 10.200.2.4 4/14/2 4/30/23 0/3 0/2 0/1 0/1 0/21 Ethernet0/0 10.200.2.2 0/0 10.200.2.30/0 10.200.1.22 10.200.1.21 0/2 HSRP10.222.1.2 Ser 0/0/100 10.222.1.1 Ser 0/0/55 10.222.1.2 Ser 0/0/101P-2 P-3P-1 Frame-Relay 0/0 MAR 10.222.1.1 192.168.2.99 to Network 2.2 180450
C-33 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios An Interface Status Down alarm is generated when the status of an IP interface (whether over an interface or a subinterface) changes from up to down or any other nonoperational state (seeTa b l e C - 2). All events sourced from the subinterfaces correlate to this alarm. In addition, an All IP Interfaces Status Down alarm is generated when all the IP interfaces above a physical port change state to down. The alarm’s description includes the full name of the IP interface, for example Serial0.2 (including the identifier for the subinterface if it is a subinterface), and the alarm source points to the IP interface (and not to Layer 1). All syslogs and traps indicating changes in subinterfaces (above which an IP address is configured) correlate to the Interface Status Down alarm. The source of these events is the IP interface. Syslogs and traps that indicate problems in Layer 1 (that do not have a subinterface qualifier in their description) are sourced to Layer 1. NoteIf a syslog or trap is received from a subinterface that does not have an IP interface configured above it, the source of the created alarm is the underlying Layer 1. For example: Line Down trap (for subinterface) Line Down syslogs (for subinterface) For events that occur on subinterfaces: When sending the information northbound, the system uses the full subinterface name in the interface name in the source field, as described in the ifDesc/ifName OID (for example, Serial0/0.1 and not Serial0/0 DLCI 50). The source of the alarm is the IP interface configured above the subinterface. If IP is not configured on the interface, the source is the underlying Layer 1. If the main interface goes down, all related subinterface traps and syslogs are correlated as child tickets to the main interface parent ticket. The following technologies are supported: Frame Relay/HSSI AT M Ethernet, Fast Ethernet, Gigabit Ethernet Packet over SONET (POS) Channelized Optical Carrier (CHOC) Table C-2 Interface Status Down Alarm Name Description Ticketable Correlation allowed Correlated to Severity Interface Status Down/UpSent when an IP interface changes operational status to down/upYes Yes Link Down/Device UnreachableMajor
C-34 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Correlation of Syslogs and Traps Upon receipt of a trap or syslog for the subinterface level, Cisco ANA immediately polls the status of the relevant IP interface and creates a polled parent event (such as Interface Status Down). The trap or syslog is correlated to this alarm. In a multipoint setup when only some circuits under an IP interface go down do not cause the state of the IP interface to change to down, Cisco ANA does not create an Interface Status Down alarm. All circuit down syslogs correlate by flow to the possible root cause, such as Device Unreachable on a CE device. All IP Interfaces Down Alarm When all IP interfaces configured above a physical interface change their state to down, the All IP Interfaces Down alarm is sent. When at least one of the IP interfaces changes its state to up, a clearing (Active IP Interface Found) alarm is sent. The Interface Status Down alarm for each of the failed IP interfaces is correlated to the All IP Interfaces Down alarm. NoteIf an All IP Interfaces Down alarm is cleared by the Active IP Interfaces Found alarm, but some correlated Interface Status Down alarms still exist for some IP interfaces, the severity of the parent ticket is the highest severity among all the correlated alarms. For example, if an Interface Status Down alarm is uncleared, the severity of the ticket remains major, despite the Active IP Interface Found alarm having a cleared severity. For more information, see Ta b l e C - 3. The All IP Interfaces Down alarm is sourced to the Layer 1 component. All alarms from the other side (such as Device Unreachable) correlate to the All IP Interfaces Down alarm. IP Interface Failure Examples NoteIn the following examples, it is assumed that the problems that result in the unmanaged cloud, or the problems that occurred on the other side of the cloud (such as an unreachable CE device from a PE device) cause the relevant IP interfaces’ state to change to down. This, in turn, causes the Interface Status Down alarm to be sent. If this is not the case, as in some Ethernet networks, and there is no change to the state of the IP interface, all the events on the subinterfaces that are capable of correlation flow will try to correlate to other possible root causes, including Cloud Problem. Table C-3 All IP Interfaces Down Name Description Ticketable Correlation allowed Correlated to Severity All IP Interfaces Down/Active IP Interfaces FoundSent when all IP interfaces configured above a physical port change their operational status to down.Yes Yes Link Down Major
C-35 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Interface Example 1 Figure C-34 represents an environment with multipoint connectivity between a PE and number of CEs through an unmanaged Frame Relay network. All CEs (Router2 and Router3) have logical connectivity to the PE through a multipoint subinterface on the PE (Router10). The keepalive option is enabled for all circuits. A link is disconnected inside the unmanaged network, causing all CEs to become unreachable. Figure C-34 Interface Example 1 The following failures are identified in the network: A Device Unreachable alarm is generated for each CE. An Interface Status Down alarm is generated for the multipoint IP interface on the PE. The following correlation information is provided: The root cause is Interface Status Down. All Device Unreachable alarms are correlated to the Interface Status Down alarm on the PE. Interface Example 2 Figure C-35 represents an environment with point-to-point connectivity between a PE and a CE through an unmanaged Frame Relay network. CE1 became unreachable, and the status of the IP interface on the other side (on PE1) changed to down. The keepalive option is enabled. The interface is shut down between the unmanaged network and CE1. Interface Serial0/0.100 point-to-point 10.200.1.2 Interface Serial0/0.101 point-to-point 10.200.1.3Interface Serial0/0.55 multipoint 10.200.1.10 Unreachable Router2 10.222.1.2 Unreachable Router2 10.222.1.3Frame Relay cloudMultipoint connectivity Router10 10.222.1.10 180434 Multipoint IP interface state down
C-36 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-35 Interface Example 2 The following failures are identified in the network: A Device Unreachable alarm is generated on the CE. An Interface Status Down alarm is generated on the PE. The following correlation information is provided: The root cause is Device Unreachable: –The Interface Status Down alarm is correlated to the Device Unreachable alarm. –The syslogs and traps for the related subinterfaces are correlated to the Interface Status Down alarm. Interface Example 3 Figure C-36 represents an environment in which the failure of multiple IP interfaces occurs above the same physical port (mixed point-to-point and multipoint Frame Relay connectivity). CE1 (Router2) has a point-to-point connection to PE1 (Router10). CE1 and CE2 (Router3) have multipoint connections to PE1. The IP interfaces on PE1 that are connected to CE1 and CE2 are all configured above Serial0/0. The keepalive option is enabled. A link is disconnected inside the unmanaged network, causing all CEs to become unreachable. Figure C-36 Interface Example 3 Interface Serial1/0.500 point-to-point 102.0.0.2 Interface Serial1/0.100 point-to-point 102.0.0.1 Unreachable CE1 60.60.60.4 Frame Relay cloud Point-to-point connectivity PE1 80.80.80.69 180435 Point-to-point IP interface state unknown Point-to-point IP interface state downRouting protocol neighbor down syslog (BGF, OSPF) Interface Serial0/0.100 point-to-point 10.200.1.2 Interface Serial0/0.100 point-to-point 10.200.3.3Interface Serial0/0.100 point-to-point 10.200.3.10 Interface Serial0/0.101 point-to-point 10.200.1.3Interface Serial0/0.55 multipoint 10.200.1.10 Unreachable Router2 10.222.1.2 CE-1 Unreachable Router3 10.222.1.3 CE-2Frame Relay cloud Mixed multipoint and point-to-point connectivity Router10 10.222.1.10 PE-1 180436 All IP interfaces above Serial0/0 change state to down
C-37 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios The following failures are identified in the network: All the CEs become unreachable. An Interface Status Down alarm is generated for each IP interface above Serial0/0 that has failed. The following correlation information is provided: The root cause is All IP Interfaces Down on Serial0/0 port: –The Interface Status Down alarms are correlated to the All IP Interfaces Down alarm. –The Device Unreachable alarms are correlated to the All IP Interfaces Down alarm. –The syslogs and traps for the related subinterfaces are correlated to the All IP Interfaces Down alarm. Interface Example 4 Figure C-37 represents an environment in which the failure of multiple IP interfaces occurs above the same physical port (mixed point-to-point and multipoint Frame Relay connectivity). CE1 (Router2) has a point-to-point connection to PE1 (Router10). CE1 and CE2 (Router3) have multipoint connections to PE1. The IP interfaces on PE1 that are connected to CE1 and CE2 are all configured above Serial0/0. The keepalive option is enabled. A link is disconnected inside the unmanaged network, causing all CEs to become unreachable. When a Link Down occurs, whether or not it involves a cloud, the link failure is considered to be the most probable root cause for any other failure. In this example, a link is disconnected between the unmanaged network and the PE. Figure C-37 Interface Example 4 The following failures are identified in the network: A Link Down alarm is generated on Serial0/0. A Device Unreachable alarm is generated for each CE. An Interface Status Down alarm is generated for each IP interface above Serial0/0. An All IP Interfaces Down alarm is generated on Serial0/0. The following correlation information is provided: The Device Unreachable alarms are correlated to the Link Down alarm. The Interface Status Down alarm is correlated to the Link Down alarm. Interface Serial0/0.100 point-to-point 10.200.1.2 Interface Serial0/0.101 point-to-point 10.200.1.3Interface Serial0/0.55 multipoint 10.200.1.10 Unreachable Router2 10.222.1.2 Unreachable Router3 10.222.1.3Frame Relay cloud Mixed multipoint and point-to-point connectivity Router10 10.222.1.10 180437 All IP interfaces above Serial0/0 change state to down Link is down
C-38 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios The All IP Interfaces Down alarm is correlated to the Link Down alarm. All the traps and syslogs for the subinterfaces are correlated to the Link Down alarm. Interface Example 5 Figure C-38 represents an environment in which a PE1 device has multipoint connectivity, one of the circuits under the IP interface has gone down, and the CE1 device has become unreachable. The status of the IP interface has not changed and other circuits are still operational. Figure C-38 General Interface Example The following failures are identified in the network: A Device Unreachable alarm is generated on CE1. A syslog alarm is generated, notifying the user about a circuit down. The following correlation information is provided: Device Unreachable on the CE—The syslog alarm is correlated by flow to the Device Unreachable alarm on CE1. ATM Failure Examples Examples involving ATM technology have the same result as the examples in IP Interface Failure Examples, page C-34, assuming that a failure in an unmanaged network causes the status of the IP interface to change to down (ILMI is enabled). Ethernet, Fast Ethernet, and Gigabit Ethernet Examples This section includes the following examples: A CE becomes unreachable due to a failure in the unmanaged network (see Interface Example 6, page C-39). A link down on a PE results in a CE becoming unreachable (see Interface Example 7, page C-39). PE1 180440 CE1 unreachable Circuit down syslog CE2 CE3Mixed multipoint and point-to-point connectivity Cloud