Maintenance Manual

Chapter 7 Support Facilities
SNMP Feed
7-8
Cisco ICM Enterprise Edition Administrator Guide Release 6.0(0)
Event Feed Process
Alarms are derived from the event message stream continually being generated by
the various Cisco processes throughout the system. These processes report events
of interest to the central database or SDDSN as they occur. Just before being
placed in the central database, the event stream is intercepted by a process (CSFS)
that watches for events of significant interest which should be treated as alarms.
The CSFS process generates an event feed to the Cisco SNMP Extension agent
(AlarmEx), which has an interface to the Windows SNMP agent. The Windows
agent generates an SNMP feed that sends SNMP traps over an IP connection,
where the NMS receives and processes alarm data (Figure 1-1).
The AlarmEx feed has a heartbeat mechanism that generates a periodic trap to
indicate that the ICM Event Feed to the SNMP trap agent is functional.
Figure 7-3 Figure 1-1 ICM Alarm Process
ICM/SDDSN SNMP Extension Agent
The ICM/SDDN SNMP extension agent is AlarmEx.dll. This DLL is installed on
the ICM Logger and/or the SDDSN server.
This extension agent closely matches the alarm model that is used by
AlarmTracker. It receives an EMS event feed from the CSFS process and
interfaces to the Windows SNMP agent to generate SNMP traps when
“alarmable” events occur. These events are “statefull”, meaning that there is an
object associated with a set of events. The object’s state can indicate a failure
(Raise) or a non-failure (Clear), depending on the current event associated with