Cisco Prime Nerk 43 User Guide

							  
11-25
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Letting Others Know What is Being Done to Fix a Ticket
Letting Others Know What is Being Done to Fix a Ticket
Update the ticket notes to advise others of any actions you performed towards fixing the ticket. When 
you add a note, a note icon appears next to the ticket so that other users can see that a note is available. 
If a ticket affects several devices, you must have sufficient permissions on the device that contains the 
ticket’s root alarm.
NoteYou cannot remove notes once you have added them to a ticket.
When you update a ticket’s notes, earlier content is moved to the Previous Notes section (with the name 
of the user who added the note and the time it was added). If the user is an external user (for example, a 
Netcool user), the username will be displayed in the following format:
Added by prime-networkUserName (as externalUserName)
Letting Others Know the Problem Was Fixed (Clearing a Ticket)
Tickets can be cleared manually or automatically, as described in the following topics. Once a ticket is 
cleared, it remains active for 1 hour (default). If any incoming events are correlated to the ticket during 
this time, the ticket is reopened. If no incoming events are correlated to it, the ticket is removed from the 
display and archived. (The optional ticket locking mechanism can also affect whether new events can be 
associated with a ticket; see How Events and Tickets are Purged from the Oracle Database, page 10-14.) 
Once a ticket is archived, it is considered to be inactive. Archived tickets cannot be reopened; if an event 
recurs, a new ticket is opened
For more details about these actions, see Clearing, Archiving, and Purging and the Oracle Database, 
page 10-12.
Manually Clearing Tickets
You can manually clear a ticket by right-clicking it and choosing Clear. The ticket description changes 
to Cleared due to Force Clear and all events are marked as acknowledged. The ticket’s User Audit tab 
will display the name of the user who cleared the ticket. Whether you can manually clear a ticket depends 
on your permissions; see Permissions for Business Tags and Business Elements (Vision and Events 
Clients), page B-9.
NoteDo not choose Clear and Remove unless you are sure you want to archive the ticket. The remove 
operation cannot be reversed.
By default, cleared tickets are removed from the display (and archived) if no new events have associated 
to the tickets for 1 hour. This archive setting is not overriden by the ticket locking mechanism (which, if 
enabled, specifies at how many minutes a cleared ticket will be locked, meaning no new events can 
associate to it—for example, 20 minutes). Choosing Clear and Remove does override the 60-minute 
auto-archive setting. If you remove the ticket and one of its events recur, Prime Network will open a new 
ticket. See Removing a Ticket from the Vision Client Display (Archiving a Ticket), page 11-26.  
						

							  
11-26
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Removing a Ticket from the Vision Client Display (Archiving a Ticket)
Automatically Clearing Tickets
Every 60 seconds, a clearing mechanism checks all tickets to see if the ticket’s root cause is cleared. If 
the root cause and all of the ticket’s associated events are cleared, the mechanism clears (and 
acknowledges) the entire ticket.
Situations can occur in which a ticket’s root cause is cleared, but one of the ticket’s associated events is 
not cleared—for example, because of a missed syslog or a device reachability problem. For this reason, 
events have an auto-cleared registry setting. (The registry contains configuration settings for 
Prime Network components and features.) If the uncleared event’s auto-cleared setting is true, the 
mechanism clears the event. Then the entire ticket can be cleared.
Prime Network has an additional ticket auto-clear mechanism, but it is disabled by default. It clears 
tickets depending on their severity. This mechanism is controlled from the Administration client and is 
described in the Cisco Prime Network 4.3 Administrator Guide.
Removing a Ticket from the Vision Client Display (Archiving a 
Ticket)
When a cleared ticket is removed from the Vision client, it is archived and is no longer considered active. 
Archiving means the ticket and all of its associated events are moved from an active partition to an 
archive partition in the database. Once a ticket is archived, if any of the archived ticket’s associated 
events recur, a new ticket is opened. Archived tickets are never reopened. Details about the 
Prime Network archiving and purging mechanism are provided in Clearing, Archiving, and Purging and 
the Oracle Database, page 10-12.
Automatically Archiving Tickets
By default, cleared tickets are automatically removed from the Vision client when they have remained 
clear (no new events have associated to them) for 1 hour. Prime Network has an auto-archiving 
mechanism that runs every 60 seconds and archives any tickets that meet any of the following criteria.
Auto-Archive Based On: Ticket is archived if:
Age of ticket No new events were associated to the cleared ticket in the past 1 hour.
NoteManually removing a ticket overrides this setting and archives the 
ticket immediately. However, the ticket locking mechanism does 
not override this setting. The locking mechanism specifies the 
interval at which new events can no longer associate to a cleared 
ticket (for example, if the ticket has been cleared for 20 minutes) 
The locking mechanism is disabled by default. See How Events 
and Tickets are Purged from the Oracle Database, page 10-14. 
Size of ticket The ticket has more than 150 events associated with one of its alarms. 
(Prime Network also generates a System event 15 minutes before it 
archives the ticket.)
Prime Network found more than 1500 large tickets. (Prime Network also 
generates a System event as it approaches this number.)
Total of tickets in Oracle 
database active partitionThe total number of tickets exceeds 16,000. 
						

							  
11-27
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Changing the Vision Client Behavior
Manually Removing Tickets
NoteDo not choose Remove unless you are sure you want to archive the ticket. The remove operation cannot 
be reversed.
You can manually remove cleared tickets from the display by right-clicking a ticket and choosing 
Remove. This removes the ticket and all of its associated events, and archives them. This operation 
overrides the 60-minute auto-archive setting described in the previous topic.
Remember that if you remove a ticket: 
The remove operation cannot be reversed. 
If any of the ticket’s associated events recur, Prime Network will open a new ticket instead of 
updating the ticket your removed. 
Whether you can manually remove a ticket depends on your permissions; see Permissions for Business 
Tags and Business Elements (Vision and Events Clients), page B-9.
Changing the Vision Client Behavior
All users can change their Vision client defaults. The defaults apply only to the client machines—that 
is, the machine from which you launch the Vision client. You can change the following ticket-related 
behavior:
Enabling audio alerts and sounds
Adjusting the ticket severity information that is displayed with an NE icon
Controlling the age of tickets that are displayed in the Vision client
To change these settings, see Changing Vision Client Default Settings (Sound, Display, Events Age), 
page 4-15.
If Prime Network is being used with Prime Central, it is possible to disable ticket management 
operations from the Vision client. When these operations are disallowed, users can only manage the 
ticket lifecycle through BQL or the external OSS. For more information, see the discussion about setting 
up event monitoring in the Cisco Prime Network 4.3.2 Administrator Guide. 
						

							  
11-28
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Changing the Vision Client Behavior 
						

							CH A P T E R
  
12-1
Cisco Prime Network 4.3.2 User Guide
12
Viewing All Event Types in Prime Network
An event is a distinct incident that occurs at a specific point in time. Some events can indicate an error, 
failure, or exceptional condition in the network. How Prime Network responds to fault events is 
described in How Prime Network Correlates Incoming Events, page 10-4. Prime Network also provides 
extensive details about other events it receives—device configuration changes, activations, and changes 
in Prime Network components. Advanced users can use the Events client to view all event types—Traps, 
Syslogs, Tickets, Service events, Provisioning and Audit events, and System and Security events.
These topics explain how to view all of the event types in Prime Network:
Who Can Launch the Events Client, page 12-1
Ways You Can View Events, page 12-2
Interpreting Event Severity Indicators, page 12-5
Creating and Saving Filters for Tickets and Events, page 12-6
Determining Whether a Filter Is On and Turning It Off, page 12-10
Viewing Network Events (Service, Trap, and Syslog Events), page 12-13
Viewing Tickets, page 12-17
Viewing Non-Network Events (Audit, Provisioning, System and Security Events), page 12-17
Changing How Often Event Information is Refreshed, page 12-19
Exporting Events Data, page 12-20
Changing the Events Client Defaults, page 12-20
Who Can Launch the Events Client
By default, only users with Administrator privileges can use the Events client. Users with lesser 
privileges can log into the Events client only if the required privileges have been reset from the 
Administration client. For more information, see the description of the Registry Controller in the 
Cisco Prime Network 4.3.2 Administrator Guide.
Events are sorted by date, with the newest item displayed first. Ti cke ts are listed according to their 
modification time, with the most recently modified ticket listed first. Events are stored in the database 
in Greenwich Mean Time (GMT) but are converted to match the time zone of the client location.
By default, the Events client displays events from the past 2 hours. This is controlled from the Events 
client Options dialog. To protect performance, do not change the display time frame to more than 
2 hours. For information on this and other client options, see Setting Up Your Events View, page 6-4. 
						

							  
12-2
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Ways You Can View Events
Figure 12-1 provides an overview of the Events client window.
Figure 12-1 Events Client Window
Ways You Can View Events
Events are displayed according to event categories, which are represented by tabs in the Events client. 
By default, the Events client displays events that occurred in the last 2 hours (or up to 50 events per 
table). 
The following table provides some examples of the ways you can use the Events client.1Main menu—Create filters, export data, client 
options, online help, icon reference, and so forth.4Events details pane—Shows the selected 
ticket details at the bottom of the Vision 
client window (View > Details).
2Toolbar—Tools for finding events in the 
database, creating and saving customized filters, 
and navigating through tables with multiple 
pages.5Status bar (shows commands sent to 
gateway, memory used by client, and 
gateway connection status)
3Table panel—Lists events according to tab 
selected.6Event categories, one per tab 
						

							  
12-3
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Ways You Can View Events
.
To view: Do this in the Events client:
Traps and syslogs received from devices, which 
Prime Network attempts to correlate (upgraded 
events)Choose the Syslogs, V1 Trap, V2 Trap, and V3 Trap 
tabs.
Archived tickets and events that are no longer 
displayed in the clientsUse the Find in Database tool (specify a data range 
for best performance).
Events by the devices on which they occurred Choose the event type tab, then create a filter that 
uses the Location, Severity, Description, or other 
criteria to fine-tune your search.
All events by the devices on which they occurred Choose File > Open All Tab to display the All tab, 
then create a filter that uses the Location criteria.
Tickets by: Choose the Tickets tab, then create a filter that uses:
When the ticket’s root cause was detected.Root Event Time criteria
When the ticket was modifiedModification Time criteria
When the ticket were createdCreation Time criteria
Tickets by how many alarms they contain Choose the Tickets tab, then create a filter that uses 
the Alarm Count criteria.
Tickets that were cleared or acknowledged by 
specific usersChoose the Tickets tab, then create a filter that uses 
the Acknowledged By and Cleared By criteria.
Tickets that have or have not been acknowledged Choose the Tickets tab, then create a filter that uses 
the Acknowledged criteria.
Network events by: Choose the events tab, then create a filter that uses:
How many events are still a problem 
(uncleared).Duplication Count criteria
How many times the event has occurred
(Many criteria choices are supported.)Reduction Count criteria
Tickets by how many devices they affect Choose the Tickets tab, then create a filter that uses 
the Affected Devices Count criteria.
Traps and syslogs for which Prime Network can 
only perform basic parsing (they are not 
processed for correlation)Choose the Standard tab.
CCM configuration commands executed on 
gatewayChoose the Audit tab.
Configurations performed on devices Choose the Provisioning tab.
Prime Network client login and user activities Choose the Security tab.
Events that occurred on Prime Network 
componentsChoose the System tab. 
						

							  
12-4
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Ways You Can View Events
Event Types and Categories
Each event tab displays basic information, including severity, event ID, time, and description. In 
addition, most event tabs show the Location parameter, which indicates the entity that triggered the 
event, with a hyperlink to the entity’s properties. The following table describes the event categories in 
the Events client.
You can also open the optional All tab that displays a flat list of all events and tickets by choosing 
File > Open All Tab).
Table 12-1 Event Categories in Events client
General Event 
CategoryEvents Client 
Tab Contains events related to:For more 
information:
TicketsTicket An attention-worthy root cause alarm handled by 
Prime Network.Viewing Tickets, 
page 12-17
Network 
EventsService Events that are generated by Prime Network. Viewing Network 
Events (Service, 
Trap, and Syslog 
Events), page 12-13 Syslog Syslogs received from devices (IOS syslogs, ACE 
syslogs, Nexus syslogs, ASR syslogs, UCS 
syslogs, and so forth) and handled by 
Prime Network. These syslogs are parsed and 
Prime Network attempts to correlate them.
V1 Trap SNMPv1, v2, and v3 traps received from devices 
(ASR traps, IOS, traps, MIB 2 traps, Nexus traps, 
CPT traps, and so forth). These traps are parsed 
and Prime Network attempts to correlate them. V2 Trap
V3 Trap
Standard Traps and syslogs that Prime Network cannot 
match with any of the rules that define events of 
interest; they are not processed for correlation.Viewing Tickets, 
page 12-17
Non-Network 
EventsAudit Configuration commands that are executed on the 
Prime Network gateway (NE right-click 
commands, CCM and Compliance Audit 
operations, and so forth).Viewing 
Non-Network 
Events (Audit, 
Provisioning, 
System and 
Security Events), 
page 12-17 Provisioning Configuration and provisioning activities, 
including CCM, Command Manager, and 
Transaction Manager.
Security Client login and user activities related to manage 
the system and the environment (user accounts, 
device scopes, logging in and out, password 
issues, unit changes. 
System Prime Network and its components (for example, 
reachability events, database-related events, 
system overload prevention steps, and so forth.  
						

							  
12-5
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Interpreting Event Severity Indicators
Interpreting Event Severity Indicators
Prime Network clients use the same indicators and colors to signal events and tickets in the network. The 
following example shows a Service events table in the Events client. The colors and badges in the 
Severity column indicate the seriousness of the event.
Figure 12-2 Events Client with Event Severity Indicators 
						

							  
12-6
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
The following table shows the event severity indicators. The same colors and indicators are used for all 
event types—System, Audit, Tickets, Syslogs, and so forth.
Creating and Saving Filters for Tickets and Events
These topics explain how to create and manage filters:
Creating a New Filter and Saving It, page 12-7
Determining Whether a Filter Is On and Turning It Off, page 12-10
Modifying Saved Filters and Managing the Filter List, page 12-12
Both the Events client and Vision client provide a robust framework for creating filters that can be 
applied against ticket and event data. Filters are applied to the current display (the defaults are 6 hours 
for the Vision client and 2 hours for the Events client), but you can specify a different date range using 
the filter settings. 
Filters apply only to their event category. In other words, if you create a filter for Service events, it cannot 
be used for Ticket events. In addition, filters apply only to their client. Filters created in the Vision client 
cannot be used in the Events client, and vice versa. 
When you apply a filter to a display and then navigate to another part of the client, the filter remains 
enabled when you return to the original display (by default). Unless you save a filter, it is discarded when 
you log out of the client.
You can also save your filters for later use and, if desired, make them public so that other client users 
can apply them. If a filter is not shared, only the creator can use it. Shared filters can be accessed by all 
client users, regardless of their user privileges, but can only be edited or deleted by the filter creator, or 
users that have the same (or higher) user privileges as the filter creator. If users with lesser privileges 
want to create a similar filter, then can save a copy of the filter under a different name. Icon Color Severity Notes
Critical Red
Critical, Major, Minor, and Warning events 
are considered flagging events because they 
may require attention Major Orange
Minor Yellow
Warning Light Blue
Cleared, Normal, or OK Green
Information Medium Blue
Indeterminate Dark Blue