Managing the Alarm Management System

The ZfS management console provides a central location for monitoring critical events on your network. You can manage the events and traps forwarded to the AMS by controlling which events are monitored and which traps are considered important. You can configure AMS to alert you to errors on critical systems and noteworthy events to assist you in maintaining the health of your network.

This section contains the following information:

• Recognizing Alarm Indicators
• Viewing Alarms
• Enabling and Disabling Alarms
• Resolving Alarms
• Deleting Alarms
• Performing Actions on Alarms

Recognizing Alarm Indicators

You can monitor the network for alarm-triggering events by observing nodes on topology maps or Atlas views and in the server/node summary, Active Alarm, and Alarm History views. The following table lists the alarm indicators and explains the type of alarm to which each indicator applies.

Viewing Alarms

Access to both active and historical alarm data is available from any management console. As administrator, you can define access restrictions to alarm data and management functions through the role-based services to further define the data presented based on the roles in your organization.

You can modify the presentation of the alarm data displayed in the Active Alarms and Alarm History view by filtering the displayed data, changing the column layout, and changing the sorting order. All options for changing the presentation are under the View menu in the management console.

The following sections describe the various ways you can view and use alarms:

• Viewing Active Alarms
• Viewing Historical Alarms
• Interpreting Alarms
• Sorting Alarms
• Filtering Alarms

Viewing Active Alarms

The ZfS management console Active Alarm view displays alarm statistics for all current alarms received from segments or devices, per management domain. You can see alarms specific to a server or node by displaying the Summary view on a selected server or node object. The Summary view shows a list of all active alarms for that server or node.

The Active Alarms view and Server Summary view display a table of detailed information about active alarms. These views are updated whenever a new alarm occurs and is archived on your network. New alarms are appended to the list.

To display the Active Alarm view:

1. Click the ZENworks for Servers site object in the left frame of ConsoleOne.

2. Click View > Active Alarms.

   The Active Alarm view is displayed. You can perform the following alarm handling activities from this view:

   • Assigning Alarms
   • Owning Alarms
   • Handling Alarms

Viewing Historical Alarms

The Alarm History view displays information about all archived alarms, including the handling status of each alarm. You can access the Alarm History view only if you have been granted access through the role-based services.

To display the Alarm History view:

1. Click the ZENworks for Servers site object in the left frame of ConsoleOne.

2. Click View > Alarm History.

   The Active Alarm view is displayed. You can perform the following alarm handling activities from this view:

   • Assigning Alarms
   • Owning Alarms
   • Deleting Alarms

Interpreting Alarms

The Active Alarm and Alarm History views display lists of alarms that have been archived to the alarm manager database. The alarms are displayed on a tabular list. The following table lists and describes the types of data displayed in each column.

You can filter the data displayed in the alarm views based on criteria from statistics displayed in each view; see Filtering Alarms for details. After selecting one or more alarm entries in an alarm view, you can perform operations by right-clicking them.

Sorting Alarms

You can modify the order in which the alarms are displayed on the Active Alarm or Alarm History views by sorting the alarms. By default, the alarms are sorted in ascending order by received time.

To edit the sort settings:

1. Click View > Settings > Sort.

2. Select the criteria by which you want the alarms sorted. You can sort by

   • Type
   • Severity
   • Category
   • Received time

3. Indicate whether you want the alarms sorted in ascending (oldest first) or descending (the most recent alarms first) order by selecting the appropriate radio button from the Sort Order box.

4. Click OK.

   The alarms are now sorted according to the criteria you specified.

Filtering Alarms

You can limit the number of alarms displayed in the Active Alarm and Alarm History views by setting up a filter. You can use the filter to generate lists for export to HTML or other popular formats or to aid in troubleshooting a fault. The alarm filter only applies to the current management session; exiting the management console clears the filter selections.

You set up a filter by selecting criteria from four drop-down lists. You can set up simple filters that require only one line. Or, you can set up more complex filters composed of multiple lines or groups of lines. If you set up a filter using more than one line, you must also specify the logical relationship between the line and or group of lines. For example, you must specify whether all of the filter lines must be true in order for an alarm to be displayed or if only one of the lines must be true.

To set up a filter:

1. Go to the view you want to filter.

2. Click View > Settings > Filter.

   The Alarm Filter screen is displayed.

3. Select the column by which you want AMS to filter alarms from the first drop-down list. You can filter alarms using the following columns:

   • Severity: Filters the alarms based on the alarm severity. Alarm severity is assigned to an alarm type.
   • Type: Filters alarms based on the alarm type. The alarm type is set by the SNMP trap-type defined in the MIB or the proprietary alarm definition.
   • Category: Filters alarms based on the category of the alarm. Alarm categories are based on the MIB that defines the trap-type objects.
   • Generator Type: Filters alarms based on the type of agent or system generating the alarms.

4. Select an operator from the second drop-down list.

   The operator defines how to constrain the column you've selected to a value. For example, you can specify that the selected category must be equal to, not equal to, greater than, less than, greater than or equal to, less than or equal to, contain, or start with the value you select in the third drop-down list in order for an alarm to be displayed. Keep in mind that the list of available operators depends on what column you've selected.

5. Select a value from the third drop-down list.

6. Specify how this filter statement relates to other statements you plan to define by selecting a value from the fourth drop-down list.

   • If this is the only filter statement or if it is the last statement in a group, select End.
   • If you want to add a line below the current filter statement, select New Row. A new line is added. You must then go back and define the logical relationship between the previous line and the new line by selecting another option from the fourth drop-down list of the preceding line. If both of the filter statements must be met in order for an alarm to be displayed, select And. If one of the filter statements must be met in order for an alarm to be displayed, select Or.
   • If you want to add one or more lines that are unrelated to the preceding line(s), select New Group. A new line is added, separated from the preceding line(s) by an additional drop-down list. You must specify how the groups of filter statements are to be related by selecting a value from this additional menu. If the filter statements in both groups must be satisfied in order for an alarm to be displayed, select And. If the filter statements in one of the groups must be satisfied in order for an alarm to be displayed, select Or. Keep in mind that when you add a new group, you must go back to the last line in the preceding group and select End from the fourth drop-down list.

7. When you have finished setting up filter statements, click OK.

   The alarm list is updated to display only those alarms that meet the filter criteria you defined.

Enabling and Disabling Alarms

ZfS provides default threshold values for managed NetWare and Windows* NT* servers and network segments hosting the traffic analysis agents for NetWare or Windows NT on a station connected to a segment. If any value is exceeded, an alarm is generated. Server threshold alarms are enabled by default; segment threshold alarms are not. You will need to enable the threshold alarms to receive network alarms.

IMPORTANT:  You must have the traffic analysis agents for NetWare or Windows NT hosted on a station connected to the segment in order to modify the segment properties.

To enable or disable segment threshold alarms:

1. Right-click the segment object > click Properties.

2. If it's not already displayed, select the Segment Alarms tab.

3. Select the alarm you want to enable or disable > click Edit.

4. Enter the threshold value after which an alarm should be generated in the Value field.

5. Enter the amount of time (in seconds) that the threshold value must be exceeded in order to generate an alarm in the Sampling Interval field.

6. Check the Enable check box.

7. Click OK.

Resolving Alarms

Alarms that occur on segments and devices on your network are added to the alarm manager database and are presented in the Active Alarms and Alarm History views. Entries in the alarm manager database remain in the database until the alarm is deleted. The database records the status of the alarm from first acknowledging the alarm, assigning it to a group or user, owning the alarm, and finally deleting it from the database once the owner has resolved the problem.

Resolution operations for alarms are displayed when you right-click a single entry or multiple entries in an alarm view and click any of the following actions:

• Assigning Alarms
• Owning Alarms
• Handling Alarms

You can also access the alarm action menu items from the View menu in the management console.

The order in which you perform the handling, assigning, and owning of an alarm or multiple alarms depends on your organization. Keep in mind that once you handle an alarm, it is removed from the Active Alarms list and only appears in the Alarm History list. A suggested course for resolving an alarm is for you to first assign the alarm to a group or team member, then have someone from the group take ownership of the alarm. When the network problem or event has been resolved, the team member can handle the alarm to remove it from the Active Alarms list. By following this process, you can track the alarm status through resolution, and finally delete the alarm from the Alarm History list.

Assigning Alarms

You can specify the group or user that is assigned to handle an alarm. This allows you to use any team assignments you already have within your organization. For example, you may have a group or team member assigned to handle all alarms relating to NetWare servers. You can assign one or more alarms to a group or user. Note, however, that you must have been granted access to assign alarms through the role-based services. You can use an alarm filter to help you determine groups based on certain filtering criteria. See Filtering Alarms for information on filtering options.

HINT:  This is optional and is provided for tracking the status of alarm resolution.

To assign an alarm:

1. Select the alarm you want to assign from the Active Alarm or Alarm History list.

2. Click View > Assign.

3. Enter the name of the person or group to which you want to assign the alarm in the User Name field.

   The name you enter does not correlate to users in NDS^® and can represent the organization structure you already have in place.

4. Click OK.

Owning Alarms

A user can take ownership of one or more alarms. If a user is a member of a group assigned to resolve a network problem, the team member can take ownership of the alarm and finally delete the alarm to remove it from the alarm manager database.

HINT:  This is optional and is provided for tracking the status of alarm resolution.

To take ownership of an alarm:

1. Select the alarm from the Active Alarm or Alarm History view.

2. Click View > Own.

   The value in the Owner field changes to the NDS name you are logged in as. Note that you cannot customize this option; the user logged in to ConsoleOne will always become the owner of the alarm when this action is used.

Handling Alarms

Alarms displayed in the Active Alarm view have not been handled by anyone. After the alarm is handled, it is removed from the Active Alarm list, and any alarm indicators shown in other views in the management console are removed. See Recognizing Alarm Indicators for information on different types of alarm indicators. Note that the alarm is still displayed in the Alarm History view.

To handle an alarm:

1. Select the alarm from the Active Alarm list.

2. Click View > Handle.

   The alarm is removed from the Active Alarm list. You can still display information about the alarm by switching to the Alarm History view.

Deleting Alarms

Alarms displayed in the Alarm History view can be deleted from the alarm list after problem resolution. You can delete one or more alarm entries to remove the alarm from the list. Note that to delete an alarm, you must have been granted access to view alarm history and to delete alarms through the role-based services.

There are two ways to delete alarms:

• You can delete alarms manually from the Alarm History view. See Deleting Alarms from the Management Console.
• You can delete alarms automatically using the AMS purge utility. See Deleting Alarms Using the Purge Utility.

IMPORTANT:  The alarm manager database, located on the management server, records the status of every alarm instance received by the AMS. You must be diligent in deleting alarms once a problem is resolved in order to keep the database from taking up excessive disk space. Currently, the alarm manager database uses the Alarm purge utility (on by default) to automatically trim entries after a period of time or based on the size of the database.

Deleting Alarms from the Management Console

You can manually delete alarms one at a time from the management console.

To delete an alarm:

1. Select the alarm you want to delete from the Alarm History list.

2. Click View > Delete.

   The alarm is removed from the Alarm History view.

Deleting Alarms Using the Purge Utility

You can delete alarms automatically using the AMS purge utility. Before you can use this utility, you must set up the utility's configuration file, AMPURGE.PROPERTIES, which is located in the properties directory on the server and volume where you installed the alarm manager database. Then you can schedule the utility to run automatically at a specified time of day. Or, you can run the utility manually from the server console. The following sections describe how to set up and use the AMS purge utility:

• Setting Up the Purge Utility Configuration File
• Setting up the Purge Utility to Run Automatically
• Running the Purge Utility from the Server Console

Setting Up the Purge Utility Configuration File

The AMS purge utility configuration file, AMPURGE.PROPERTIES, defines the criteria for selecting the alarms to be purged as well as the time of day the process should run. This file is located in the properties directory on the server and volume where you installed the alarm manager database. Before you can run the purge utility, you must set up the configuration file as follows:

1. Open the AMPURGE.PROPERTIES file using a text editor.

2. Set the criteria for purging alarms by editing the values of the following lines in the file:

   • SeverityInformationalPurgeWait: The number of days before informational alarms will be purged.
   • SeverityMinorPurgeWait: The number of days before minor alarms will be purged.
   • SeverityMajorPurgeWait: The number of days before major alarms will be purged.
   • SeverityCriticalPurgeWait: The number of days before critical alarms will be purged.
   • SeverityUnknownPurgeWait: The number of days before unknown alarms will be purged.

   By default, alarms of all severity levels are purged after seven days.

3. Save the configuration file.

Setting up the Purge Utility to Run Automatically

You can schedule the purge utility to run daily to ensure that the alarm manager database does not consume excessive disk space. Before you can set up the utility to run automatically, you must make sure to set up the file with your preferences for deleting alarms of various severities. See Setting Up the Purge Utility Configuration File.

To set up the utility to run automatically:

1. Open the AMPURGE.PROPERTIES file using a text editor.

2. Set the time of day you want the utility to run by editing the PurgeStartTime entry.

   Valid values are 0 to 23, where 0 is midnight and 23 is 11:00 p.m. Keep in mind that the purge utility is memory intensive and can occupy the server for several minutes. Therefore, you should set the utility to run during off-peak hours.

3. Save and close the file.

4. Open the ALARMMANAGER.PROPERTIES file and verify that the following line exists:

   AlarmPurgeService=yes

   If the line does not exist, add it to the end of the file.

5. Save and close the file.

6. Restart the server.

Running the Purge Utility from the Server Console

You can run the purge utility from the server console to force an immediate purge of the alarm manager database. Before you can run the utility, you must set up the AMPURGE.PROPERTIES configuration file as described in Setting Up the Purge Utility Configuration File. Keep in mind that the purge utility is memory intensive and can occupy the server for some time, especially if there are many alarms to be purged. Therefore, you should only run this utility during off-peak hours.

To run the utility:

1. Go to the server console on the NetWare server where the alarm manager database is installed and execute the following command:

   ampurge.ncf

Performing Actions on Alarms

You can configure an alarm to automatically perform an action when an alarm occurs. You do this by editing the alarm dispositions associated with each alarm template. Alarm dispositions are created for each alarm template in the Alarm Manager database and default settings are assigned. You can edit the alarm dispositions to enable the following actions:

• Sending SMTP Mail Notification
• Launching an External Program
• Forwarding SNMP Traps to Other Management Systems
• Forwarding Alarms to Other Management Servers
• Displaying a Ticker-Tape Message
• Making an Audible Beep
• Archiving Alarm Statistics

Sending SMTP Mail Notification

You can send SMTP messages to recipients who are specified to receive e-mail notification.

To modify an alarm disposition to automatically send SMTP mail notification:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the SMTP Mail Notification tab.

5. Check the Notify through SMTP Mail check box.

6. Enter the IP address of the SMTP host server that handles incoming and outgoing e-mail in the SMTP Host field.

7. Enter the name of the person sending the notification in the From field.

8. Enter the names of the e-mail recipients in the To field.

9. Enter the subject of the e-mail in the Subject field.

10. Enter a message for the e-mail, if any, in the Message field.

11. Click OK.

Note that the subject and message text strings can contain any of the variables listed in the following table. These variables allow you to add details to your message about the segment or device generating the fault or event. All variables must be preceded by a percent sign (%). For example, the subject line could include the %v variable to display the severity of the alarm.

Launching an External Program

As part of editing the disposition of an alarm, you can set options to launch an NLM^TM automatically when an alarm is received. For example, you might want an alarm to launch a program that sends a message to the system administrator's pager.

In addition to specifying the program to launch, you can also specify arguments and variables to be passed to the program.

HINT:  Although ZfS provides the capability to launch applications, the product does not supply any predefined programs. However, you can launch an NLM and run scripting routines or use third-party programs.

To set up automatic application launching:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the Launching Application tab.

5. Check the Launch Application check box.

6. Enter the path and name of the application in the Application Name field.

7. Enter any necessary execution arguments or script variables in the Argument field > click OK.

   Arguments are passed directly to the program; text is not parsed, but is read as literal text strings. Variables must be preceded with a percent sign (%). The percent sign can be followed by an optional length field that limits the length to which the parameter can expand.

   Keep in mind that total length of the Program field cannot exceed 126 characters. The total length of the Parameters field cannot exceed 119 characters after replacement. The combined total of the Program and Parameter fields cannot exceed 139 characters before replacement.

   The following table lists the variables you can use when launching a program.

   Variable	Name	Description
   a	Alarm ID	Identification number of the alarm as it is stored in the database.
   c	Affected class	Class of equipment that sent the alarm. This can be any portion of the network and is categorized in the database for indexing.
   o	Affected object number	Identification number of the node that generated the alarm as it is stored in the database.
   s	Alarm summary string	Message describing the alarm. (This is the same as the status bar ticker-tape message.)
   t	Alarm type string	Description of the alarm. This matches the description in the Alarm Type column in the Alarm Summary window.
   v	Severity number	Alarm severity can be 1 = critical 2 = major 3 = minor 4 = informational All others are unknown.

Forwarding SNMP Traps to Other Management Systems

AMS can be configured to forward an unmodified SNMP trap. Specify the IP address of the target management station or server in the alarm disposition and the trap is automatically forwarded.

To forward SNMP traps:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the SNMP Trap Forwarding tab.

5. Enter the IP address of the server to which you want to forward traps in the SNMP Target Address field > click Add.

   The server is added to the List of Targets. Repeat this step for all servers you want to receive the traps.

6. Click OK.

Forwarding Alarms to Other Management Servers

AMS can be configured to forward a processed alarm to other ZfS management servers. You specify the IP address or server name of the target management server in the alarm disposition and the alarm is automatically forwarded.

To forward alarms:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the Alarm Forwarding tab.

5. To add a target server to receive the alarms:

   1. Select the ZfS site to which you want to forward alarms in the Site Name field.

   2. Select the ZfS host to which you want to forward alarms in the Site Host field.

   3. Click Add.

   The server is added to the List of Targets. Repeat this step for all servers to which you want to forward alarms.

6. Click OK.

Displaying a Ticker-Tape Message

The alarm disposition includes other configuration settings that include displaying a ticker-tape message in the status bar of the management console. The message provides a summary of the most recent alarm or network event.

This option is enabled by default. You may want to edit your alarm dispositions so that only important alarms that you want to monitor display a ticker-tape message.

To disable or enable a ticker-tape message:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the Other Configuration tab.

5. To disable the ticker-tape message, uncheck the Show on Ticker Bar check box.

   or

   To enable the ticker-tape message, check the Show on Ticker Bar check box.

6. Click OK.

Making an Audible Beep

The alarm disposition includes other configuration settings that include making an audible beep at the management console. The sound alerts the user of an occurrence of an alarm. Useful applications of this function include:

• Server abend
• System: Server downed by user
• File system full

This option is disabled by default. You should enable this option for important alarms that you wish to monitor.

To enable or disable an audible beep:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the Other Configuration tab.

5. To enable the audible beep function, check the Beep on Console check box.

   or

   To disable the audible beep function, uncheck the Beep on Console check box.

6. Click OK.

Archiving Alarm Statistics

The AMS system provides data to the reporting tools to generate detailed reports on alarms and network events. Enabling the Archive option stores the statistical data for the alarm instance in the alarm manager database on the management server. This option is enabled by default. You should disable this option only on the types of alarms that you do not want to track and analyze.

To enable or disable alarm archiving:

1. Right-click the ZENworks for Servers site object in the left frame of ConsoleOne > click Properties.

2. Click the Alarm Disposition tab.

3. Select the alarm that you want to edit from the Alarm Templates list > click Edit.

   The Edit Alarm Disposition screen is displayed.

4. Click the Other Configuration tab.

5. To disable alarm archiving, uncheck the Archive check box.

   or

   To enable alarm archiving, check the Archive check box.

6. Click OK.