user manual
Table Of Contents
- Cisco Active Network Abstraction Fault Management User Guide Version 3.6 Service Pack 1
- Contents
- About This Guide
- Fault Management Overview
- Fault Detection and Isolation
- CiscoANA Event Correlation and Suppression
- Advanced Correlation Scenarios
- Device Unreachable Alarm
- IP Interface Failure Scenarios
- Multi Route Correlation
- Generic Routing Encapsulation (GRE) Tunnel Down/Up
- BGP Process Down Alarm
- MPLS Interface Removed Alarm
- LDP Neighbor Down Alarm
- Correlation Over Unmanaged Segments
- Event and Alarm Configuration Parameters
- Impact Analysis
- Supported Service Alarms
- Event and Alarm Correlation Flow
1-7
Cisco Active Network Abstraction Fault Management User Guide, Version 3.6 Service Pack 1
OL-14284-01
Chapter 1 Fault Management Overview
Event Processing Overview
The propagated severity of the alarm (the whole event sequence) is always determined by the last event
in the sequence. In the above example, when the link-down alarm is open it will have critical severity;
when it clears it moves to normal severity. An exception to this rule is the informational event (severity
level of info) such as user acknowledge event, which does not change the propagated severity of the
sequence (the alarm).
Each ticket assumes the propagated severity of the alarm with the topmost severity, within all the alarms
in the correlation hierarchy at any level.
Note Each alarm does not assume the propagated severity of the correlated alarms beneath it. Each alarm
assumes its severity only from its internal event sequence, as described above, while the ticket assumes
the highest severity among all the alarms in the correlation tree.
Event Processing Overview
Cisco ANA provides a customizable framework for identifying and processing raw events. The raw
events are collected into the Event Manager, forwarded to their respective VNE, and then processed as
follows:
Step 1 The event data is parsed to determine its source, type, and alarm-handling behavior.
Step 2 If the event type is configured to try and correlate, the VNE attempts to find a compliant cause alarm.
This is done in the VNE fabric.
Step 3 The event fields are looked up and completed.
Step 4 The event is sent to the Cisco ANA gateway, where:
• The event is written to the event database.
• If the event belongs to an alarm, it is attached to its respective event sequence and correlated to the
respective root-cause alarm within the ticket, or a new sequence and new ticket is opened.
• If the event is marked as ticketable, and it did not correlate to any other alarm, a new ticket will be
opened where the alarm that triggered the ticket will be the root cause of any alarms in the
correlation tree.