user manual
Table Of Contents
- Cisco Active Network Abstraction Fault Management User Guide Version 3.6 Service Pack 1
- Contents
- About This Guide
- Fault Management Overview
- Fault Detection and Isolation
- CiscoANA Event Correlation and Suppression
- Advanced Correlation Scenarios
- Device Unreachable Alarm
- IP Interface Failure Scenarios
- Multi Route Correlation
- Generic Routing Encapsulation (GRE) Tunnel Down/Up
- BGP Process Down Alarm
- MPLS Interface Removed Alarm
- LDP Neighbor Down Alarm
- Correlation Over Unmanaged Segments
- Event and Alarm Configuration Parameters
- Impact Analysis
- Supported Service Alarms
- Event and Alarm Correlation Flow
B-3
Cisco Active Network Abstraction Fault Management User Guide, Version 3.6 Service Pack 1
OL-14284-01
Appendix B Event and Alarm Correlation Flow
Event Correlation Flow
Event Correlation Flow
Event Creation (VNE level)
An event (EventCorrelationData) is created in the VNE level by three different sources:
• Device Component (DC)—When processing service alarms.
• EventProcessor—After parsing Syslog and SNMP trap.
• TCA Extension—After identifying a change in a property in the IMO.
The EventCorrelationData holds the following information:
Event Correlation
Local Correlation (Event Correlator)
Local correlation will be performed if the correlate flag is set true and after waiting the time specified
by the correlation-delay value.
The event correlation key is used to extract alarms that were waiting for correlation on that specific key.
If alarms with the same correlation key exist the correlation logic is invoked to determine the best
candidate of the locally available alarms. If the event did not find an alarm to correlate to, it will be put
into the waiting for correlation event queue with its respective correlation key.
Network Correlation (Event Correlator, Flow)
Network correlation will be performed if the event has the activate_flow flag set to true. The following
actions will be executed:
1. The Event Correlation application receives an event and it checks the correlation delay depending
on whether it is box-level or flow-level correlation.
Table B-1 Event Correlation Data Parameters
Name Description Type
Event Type The type of the event. Alarms with the same Source and
Event Type will be considered as a single alarm.
String
Event Sub Type The sub type of the event (identifies the exact event
definition that needs to be loaded).
String
Source The OID of the IMO on which the event occurred on. Oid
Correlation key The object used for correlation Correlation key
array
iFlowForwardData All forwarding data for the flow (if activate-flow is
enabled).
iFlowForwardData
Event time The time the event occurred (as determined in the VNE). Long
Description A description of the event. String