user manual

Table Of Contents

3-2

Cisco Active Network Abstraction Fault Management User Guide, Version 3.6 Service Pack 1

OL-14284-01

Chapter 3 Cisco ANA Event Correlation and Suppression

Root-Cause Correlation Process

Root-cause correlation is implemented in various stages within the Cisco ANA VNEs. Initially, the

system tries to find the root-cause alarm. When a VNE detects a fault and opens an alarm, it attempts to

find another open alarm within the same device, which qualifies as the root-cause of the new alarm. For

example, in the case of a “link-down syslog” alarm , the VNE will look for a root-cause alarm within the

device, for example, “link down”. When such a root cause is found and qualified, the correlation

relationship is set in the alarm database. This process is correlation by key.

A more complex scenario is finding the root cause in a different device, which could be many network

hops away. In the above example, the link-down alarm could cause multiple BGP Neighbor Down events

throughout the network. In such cases, the BGP Neighbor Down is configured by default to actively go

and search for a root cause in other VNEs, by initiating correlation by flow. In this example, the VNE

that detected the BGP Neighbor Down uses the network topology model maintained in the Cisco ANA

fabric to trace the path to its lost neighbor. During this trace it will encounter the faulty link, and qualify

it as the BGP Neighbor Down root cause.

The following figure illustrates the local and active correlation processes.

Figure 3-1 Root-Cause Correlation Process

The correlation mechanisms are highly configurable (per alarm), as described in the following sections.

Alarm Database

Card out

Link down

BGP lost

Due to

Link 1-2

down

1.2.3.4

Cisco ANA - Virtual NE

Cisco ANA

Network A

Network B

Unmanaged

cloud

Card out

BGP Neighbor

lost (in IP 1.2.3.4)

Two devices share

the same IP!

154392

Cisco ANA

Gateway

Network

Segment