Cisco Prime Nerk 43 User Guide

							  
12-7
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
NoteThe Events client global options that can affect filter behavior, such whether filtered content should be 
saved when you move between tabs. These settings are described in Setting Up Your Events View, 
page 6-4.
These topics explain how to create new and change existing filters:
Creating a New Filter and Saving It, page 12-7
Modifying Saved Filters and Managing the Filter List, page 12-12
Creating a New Filter and Saving It
Use this procedure to create filters in the Vision client and Events client. 
Before You Begin
When you consider a filter name, remember that filters are listed alphabetically. Space is limited, so use 
concise names.
Step 1Make sure you are working from the desired filter category. The filters you can create and the devices 
you can choose depend on your user account permissions.)
Client To find: On: ...Start from:
Vision clientTickets All or specified 
devicesTickets tab from 
map
Only a specific device Tickets tab from 
inventory window
Upgraded trap events, Syslog events, and 
Service events (upgraded events are 
events Prime Network recognizes and 
attempts to correlate)All or a group of 
devicesLatest Events tab 
from map
Only a specific device Network Events 
tab from inventory 
window
Device configuration changes For a specific device Provisioning tab 
from inventory 
window 
						

							  
12-8
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
Step 2Open the filter dialog.
Step 3Configure your filter. Links to topics that describe the filter options are provided after this procedure.
In this example, a ticket filter is created to find unacknowledged Critical, Major, Minor, and Warning 
tickets created in a 24-hour period. This particular filter is launched from the Events client (the Vision 
client does not support the Archive criteria for tickets).
Events clientEvents related to the Prime Network 
systemN/A System tab
Events related to Prime Network security Security tab
Active and archived events that are 
generated by Prime NetworkAll or specified 
devicesService tab
All syslogs and traps handled by Prime 
NetworkAll or specified 
devicesSyslog tab
Traps tabs
Trap events and Syslog events that Prime 
Network cannot match with any of the 
rules that define events of interest (no 
further processing is performed)All or specified 
devicesStandard tab
Device configuration changes on 
managed devicesAll or specified 
devicesProvisioning tab
Users that executed device configuration 
changes on managed devicesAll devices Audit tab
Filter Name and DescriptionLaunch by:
Choosing Clicking
Filter—Finds events in the display that match the filter criteria. 
Events client only: You can also find archived network events.Edit > 
Filter
Find in Database—Finds events in the database that match the criteria. You 
can also find archived events.
NoteThis choice is only available on the Events client. Specify a date range 
for best performance.Edit > 
Find Client To find: On: ...Start from: 
						

							  
12-9
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
Figure 12-3 Ticket Filter Example
Step 4
Click Save and do the following in the Save Filter dialog box:
a.Enter a name (for example, Unacknowledged-24hours).
b.Check Share to make the filter available to other users of the same client (filters created in the Vision 
client cannot be used from the Events client). If you share a filter, users with the same or higher 
privileges will be permitted to edit your filter.
c.Click OK to close the Save Filter dialog box.
d.In the Filter or Find dialog box, click OK to apply your filter to the current display. The filter name 
is displayed under the table; for example, Filter Enabled: Unacknowledged-24hours.
If you move to another tab in the client, the filter is still enabled when you return to the Tickets tab. (You 
can change this and other filter behaviors by choosing Tools > Options. See Setting Up Your Events 
View, page 6-4.)
Step 5To clear a filter, choose Edit > Clear Filter (or click  ).
When log out and log back into the client, your filter will be available from the Filter drop-down list, as 
shown in the following figure.  
						

							  
12-10
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
Figure 12-4 Filter Drop-Down List
Figure 12-4 shows the new filter along with these pre-existing filters:
ASR500-new (created by the current user, JSBach).
Affects5+Devices, a shared filter created by user FLiszt.
CriticalMajor-Last24Hours, a shared filter created by FChopin.
Any filters created by other users but not shared are not displayed. Only the filter creators can see those 
filters.
For information on the different filter criteria you can use, see:
Viewing Network Events (Service, Trap, and Syslog Events), page 12-13
Viewing Tickets, page 12-17
Viewing Non-Network Events (Audit, Provisioning, System and Security Events), page 12-17
Viewing Standard Traps and Syslogs Not Recognized by Prime Network, page 12-19
Determining Whether a Filter Is On and Turning It Off
If the   icon appears above a table, a filter is enabled. To turn the filter off, click the icon or choose 
Edit > Clear Filter or Edit > Clear Find.
If a basic filter is applied, the client displays Filter Enabled at the bottom of the events table. If the 
display is using a saved filter, the filter name is also displayed, as in Figure 12-7. In this example, a user 
has applied a saved filter named Unacknowledged-24Hours to the display.
Figure 12-5 Basic Filter—Saved Filter Applied to Display 
						

							  
12-11
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Creating and Saving Filters for Tickets and Events
If the display is using a basic filter that was not saved, the client displays Filter Enabled: Untitled, as 
illustrated in Figure 12-6.
Figure 12-6 Basic Filter—(Unsaved) Filter Applied to Display
If a Find in Database filter is applied to an Events client display, the client displays Find Results at the 
bottom of the events table as illustrated in Figure 12-7.
Figure 12-7 Find in Database—Filter Applied (Events Client Only) 
						

							  
12-12
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Finding Archived Tickets, Service Events, Syslogs, and Traps
To disable any type of filter, do the following:
To clear the Find in Database filter, click the Find in Database filter icon in the toolbar and choose Clear.
Modifying Saved Filters and Managing the Filter List
To manage existing filters, open a filter dialog and click Manage Filters. In addition to filters created 
by the user, the Edit Filter List dialog provides an alphabetical lists of all shared filters. You can only 
rename or delete a filter you are the filter creator or if you have the same or higher permissions as the 
filter creator. If a filter is shared, the name of the filter creator is also displayed.
In this example, the current user has lesser permissions than the filter creators, so the user can employ 
the filters, but cannot edit or delete the filters. However, the user could create a similar filter by saving 
it under another name.
Figure 12-8 Managing Saved Filters
Finding Archived Tickets, Service Events, Syslogs, and Traps
The Prime Network database contains active and archive partitions. When a ticket or event is archived, 
it is moved to the archive database partition and is considered inactive, which means Prime Network will 
not perform any more actions on the ticket or event. In most cases, once a ticket is archived, you need to 
use a filter to view it and its associated events. Tickets are normally archived if they have been clear for  Filter TypeDisable by:
Choosing Clicking
Basic filterEdit > Clear Filter
Find in Database filter (Events client only)Edit > Clear Find 
						

							  
12-13
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Viewing Network Events (Service, Trap, and Syslog Events)
1 hour (no new events have been associated to the ticket). Cleared tickets can be archived sooner using 
the remove operation. For detail about the Prime Network clearing and archiving mechanism, see 
Clearing, Archiving, and Purging and the Oracle Database, page 10-12.
Some archived events are displayed in the clients, but only if those events fall within the GUI client’s 
display parameters (by default, the last 2 hours for the Events client and the last 6 hours for the Vision 
client).
Standard events—Standard events are events for which Prime Network only performs basic parsing; 
they are not processed for correlation. Standard events are archived as soon as they are received but 
are displayed in the Standard tab in the Events client, and in the Network Events tab in the Vision 
client map (or list view). If enabled, standard events are also shown in the Latest Events tab in the 
Vision client NE inventory window.
Events associated with recently archived tickets—Tickets are normally archived after being cleared 
for 1 hour, but the Vision client reflects events from the past 6 hours. For this reason, some archived 
events may appear in the Network Events tab in the Vision client map or list view, and in Latest 
Events tab in the Vision client NE inventory window. 
Events that were not correlated to other events—These events are archived and displayed in the 
Latest Events tab in the Vision client NE inventory window.
Archived events that fall outside of the Events client and Vision client display parameters can only be 
viewed from the Events client using a filter. To find an archived ticket or network events, use the standard 
filters and set the Archive setting to true. See these topics for more information:
Creating and Saving Filters for Tickets and Events, page 12-6 for a description of how to create 
filters using these tools
Viewing Network Events (Service, Trap, and Syslog Events), page 12-13
Viewing Tickets, page 12-17
Viewing Non-Network Events (Audit, Provisioning, System and Security Events), page 12-17
Viewing Tickets, page 12-17
Viewing Network Events (Service, Trap, and Syslog Events)
You can view all active and archived Service, Trap, and Syslog events using Events client filters. All 
network events provide the following information (other information is also supplied but those fields are 
self-explanatory). You can use this and other criteria for event filters as described in Creating and Saving 
Filters for Tickets and Events, page 12-6. 
						

							  
12-14
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Viewing Network Events (Service, Trap, and Syslog Events)
For information on the other fields that are displayed, see:
Service Events, page 12-14
Syslogs and Traps, page 12-15
Service Events
Service events are generated by the Prime Network system in response to changes in the network. In 
response to these events, Prime Network will generate Service events, such as BGP Neighbor Loss, 
MPLS TP Tunnel Down, Link Down, Adaptive Polling (for high CPU issues), and so forth.
Table 12-2 Common Information Provided for Service, Trap, Syslog, and Ticket Events
Tab Description
Details tab
Detection Type—How the event was detected: V1 Trap, V2 Trap, V3 Trap, Syslogs, 
or Service event.
Alarm ID and Ticket ID—Identifier for alarms and ticket that the event is 
associated with (if applicable).
Causing Event—Event that caused the network event (if applicable)
Category—Fault category, one of the following: Communications, Quality of 
Service, Processing error, Environmental, Equipment, or Undetermined.
Nature—Whether the event will automatically clear:
–ADAC (Automatically Detected Automatically Cleared)—Clearing is 
automatically detected and performed by the system (for example, Link Down).
–ADMC (Automatically Detected Manually Cleared)—Clearing requires 
manual intervention (for example, a fatal error).
Affected 
PartiesService resources (pairs) that are affected by the event. It lists of all the endpoints that 
are affected. See Viewing a Ticket’s Affected Parties Tab (Resource Pairs), page 11-15. 
(This tab is only provided for events that calculate impact analysis. It has no relation to 
the Affected Devices count.)
Advanced
Duplication Count—(For flapping) Total number of event duplications in the 
flapping alarm. (This number is always 1 for regular non-flapping events.) For 
example, this Link Down Flapping alarm would have a duplication count of 3:
link down -> link up -> link down -> link up -> link down -> link up
For tickets, this number is the sum of the duplication counts for all events and 
alarms in the ticket.
Reduction Count—(For flapping) Total number of event instances in the flapping 
alarm. (This number is always 1 for regular non-flapping events.).
Using the previous example, the Link Down Flapping alarm would have a reduction 
count of 6 (with 6 events listed in the History tab).
For tickets, this number is the sum of the reduction counts for all events and alarms 
in the ticket.
Alarm Count—Total number of alarms associated with the ticket.
Affected Devices—Total number of NEs affected by the ticket. (You can view the 
devices in a Vision client map) 
						

							  
12-15
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Viewing Network Events (Service, Trap, and Syslog Events)
If you are looking for specific Service events, use the Events filters. You can search for events based on 
location (devices), a string included (or not included) in the description, and other common filter criteria 
(severity, description, and so forth). Once you create the filter, you can search for recent events or all 
events that are stored in the Oracle database. To create a filter, see Creating and Saving Filters for Tickets 
and Events, page 12-6. To find archived Service events, see Finding Archived Tickets, Service Events, 
Syslogs, and Traps, page 12-12.
Refer to these documents for extensive explanations about supported Service events, descriptions, 
whether they are ticketable, whether they auto-clear, and so forth, Cisco Prime Network 4.2.2 Supported 
Service Alarms.
Syslogs and Traps
When a device generates a syslog or trap, Prime Network attempts to match it to a predefined set of rules 
to determine if it is of interest to Prime Network. If it is of interest, Prime Network generates a syslog 
or a trap event. If not, it is saved to the database. These are other ways to view traps:
Syslogs and traps handled by Prime Network but not processed for correlation—Click the Standard 
tab. (See Viewing Standard Traps and Syslogs Not Recognized by Prime Network, page 12-19).
Archived syslogs and traps—Create a filter and set the Archive field to true. 
In Prime Network, all syslogs and traps are configured to clear automatically, except: 
Syslogs and traps that are ticketable.
A few important syslogs and traps that do not have a corresponding Service event. For example, a 
device that suddenly loses power does not send a Down event. Instead, it sends a cold start trap when 
it subsequently recovers. This trap is not cleared automatically because no corresponding Down 
event exists. If the cold start trap is automatically cleared, the device-recovery notification will be 
lost.
When you double-click a trap event, the Events client displays the Details, Affected Parties, and 
Advanced Tabs. These details provide the same information that is provided for tickets (see Getting a 
Ticket’s Troubleshooting Tips And Basic Information, page 11-13). 
Trap events also display a Tr a p tab with the following information (depending on the trap version):
Field Description
V1, V2, 
and V3 
Tr a p sVersion SNMP version: version 1, version 2c, or version-3.
Community 
StringCommunity that the device sends in the Protocol Data Unit (PDU).
Error Status Error status: No Error, Too Big, No Such Name, Bad Value, Read Only, and 
General Error. 
						

							  
12-16
Cisco Prime Network 4.3.2 User Guide
Chapter 12      Viewing All Event Types in Prime Network
  Viewing Network Events (Service, Trap, and Syslog Events)
NoteIf a SNMP agent is enabled in a VM, then all the traps that are generated from the VM should be 
associated to IManagedElement node of the VNE.
If you are looking for specific traps, create a trap filter as described in Creating and Saving Filters for 
Tickets and Events, page 12-6. 
NoteFor IPv6, we need to configure device to send events on specific ports (1514,1162 and 1161). For 
example, to configure on device: snmp-server host 10.105.39.217 version 2c public udp-port 1162
Refer to these documents for extensive explanations about supported traps and syslogs, including their 
descriptions, whether they are ticketable, whether they auto-clear, whether they are considered flapping 
events, and so forth:
Cisco Prime Network Supported Syslogs
Cisco Prime Network Supported Traps
V1 and 
V2 TrapsValues Table 
Translated 
OIDString representation of the OID. For example, 1.3.6 is translated into 
iso.org.dod where: 
1 represents iso. 
3 represents org.
6 represents dod.
Translated 
Va l u eString representation of the OID value. For example, 1.3 is translated to 
iso(1).org.10, or a specific value, such as “down” or “4 days, 20 hours, 32 
minutes, 11 seconds.” 
OID OID that is not translated. It is a dot notation representation of the OID, such 
as 1.3.6.1.4.1.9.
Value Value that is not translated. 
V3 Traps Values Table
Trap Type 
OIDTrap object identifier. 
Translated 
EnterpriseTranslation of the OID using the MIB. For example, an enterprise OID of 
.1.3.6.1.2.1.88.2 is displayed in this column as 
.iso.org.dod.internet.mgmt.mib-2.dismanEventMIB.dismanEventMIBNotifica
tionPrefix.
Enterprise Enterprise OID for the trap, representing the company or organization that is 
associated with the trap.  Field Description