user manual
Table Of Contents
- Cisco Active Network Abstraction Fault Management User Guide Version 3.6 Service Pack 1
- Contents
- About This Guide
- Fault Management Overview
- Fault Detection and Isolation
- CiscoANA Event Correlation and Suppression
- Advanced Correlation Scenarios
- Device Unreachable Alarm
- IP Interface Failure Scenarios
- Multi Route Correlation
- Generic Routing Encapsulation (GRE) Tunnel Down/Up
- BGP Process Down Alarm
- MPLS Interface Removed Alarm
- LDP Neighbor Down Alarm
- Correlation Over Unmanaged Segments
- Event and Alarm Configuration Parameters
- Impact Analysis
- Supported Service Alarms
- Event and Alarm Correlation Flow
4-4
Cisco Active Network Abstraction Fault Management User Guide, Version 3.6 Service Pack 1
OL-14284-01
Chapter 4 Advanced Correlation Scenarios
IP Interface Failure Scenarios
The alarm’s description includes the full name of the IP interface, for example Serial0.2 (including the
identifier for the subinterface if it is a subinterface) and the source of the alarm source points to the IP
interface (and not to Layer1).
All syslogs and traps indicating changes in subinterfaces (above which an IP is configured) correlate to
the “ip interface status down” alarm (if this alarm was supposed to be issued). The source of these events
is the IP interface. Syslogs and traps that indicate problems in Layer1 (that do not have a subinterface
qualifier in their description) are sourced to Layer1.
Note In case a syslog or trap is received from a subinterface that does not have an IP configured above it, the
source of the created alarm is the underlying Layer 1.
For example:
• Line-down trap (for subinterface).
• Line-down syslogs (for subinterface).
For events that occur on subinterfaces:
• When sending the information northbound, the system uses the full subinterface name in the
interface name in the source field, as described in the ifDesc/ifName OID (for example Serial0/0.1
and not Serial0/0 DLCI 50).
• The source of the alarm is the IP interface configured above the subinterface.
• If there is no IP configured, the source is the underlying Layer 1.
In case the main interface goes down, all related subinterfaces’ traps and syslogs are correlated as child
tickets to the main interface parent ticket.
The following technologies are supported:
• Frame Relay/HSSI
• AT M
• Ethernet, Fast Ethernet, Gigabit Ethernet
• POS
• CHOC
Correlation of Syslogs and Traps
When receiving a trap or syslog for the subinterface level, immediate polling of the status of the relevant
IP interface occurs and a polled parent event (for example, ip interface status down) is created. The trap
or syslog is correlated to this alarm.
Table 4-1 IP Interface Status Down Alarm
Name Description Ticketable Correlation allowed Correlated to Severity
Interface
status
down/up
Sent when an IP interface
changes oper status to “down”
Yes Yes Link Down/Device
unreachable/Configuration
changed
Major