Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Event Browser

 

To access the Event Browser, open the live network from File > Open Live Network and select Fault > Event Browser > Live Event View. Alternatively, you can open the Event Browser through the Web interface via Fault Management > Launch Event Browser > Live.



Event Browser Settings



When accessing the Event Browser through the Web interface via Live Network > View Event Browser for the first time, a window will popup allowing you to set parameters for Web Server Access, JMS Server Access, and Task Manager Access, as shown in the figure below.

The default settings should work in most cases. Note that HTTP tunneling may be required for situations where access to the default web server port is blocked by a firewall.

Figure 1: Event Browser Access Settings
Event Browser Access Settings


Event Browser Window



Figure 2: Event Browser
Event Browser

In the Event Browser window, scroll the event table to the right to view all these fields. The fields of the table are described in the table below.

Column Header

Description

Type

This is supplied by the device sending the event, and is usually a terse description of the information represented by the event (eg. linkUp, mplsLspDown). Event types are defined in /u/wandl/db/config/eventtypes.store.

Element Type

This is the element associated with the event (eg. Interface, Tunnel, VPN).

Device ID

This is usually the hostname of the device. These names are tied to the network files created by the Live Network model, which are usually generated via a Scheduling Live Network Collection task in the Task Manager.

User Group

The group on the Standard topology map to which the device belongs, if any

Element Name

This is the name of the element. For example, if the element type is Interface, the element name might be fe-0/0/3.0.

Event State

This is the state of the event, which is set by user actions. If your have cleared an event, its status will be green (and viewable only through history view, explained later). If you have acknowledged an event, its status will be yellow. If you have not acknowledged or cleared an event, its status will be red. Events of type INFO can neither be acknowledged nor cleared, so their state is always blue.

Event ID

This is the unique ID of the event. If the row corresponds to an aggregate event, this is the ID of the most recent event in the aggregate event

Severity

The severity of the event can be INFO, UP, WARNING, MINOR, MAJOR, CRITICAL, or DOWN. These are automatically set by default for each event, but can also be customized.

Timestamp

This is the time the event occurred, using the server’s time zone. For aggregate events, this is the time the most recent event occurred.

Count

For aggregate events only, this is the number of events included in the aggregate event

Description

The event description is supplied by the device sending the event.

Source IP

This is the IP address of the device sending the event

Source ID

This is the ID of the device sending the event.

Ack’d On

This is the time the event was acknowledged

Ack’d By

This is the name of the user that acknowledged the event

Cleared On

This is the time the event was cleared

Cleared By

This is the name of the user that cleared the event

Comment

When acknowledging or clearing an event, you have the option of saving a comment, which is displayed here.

First Timestamp

For aggregate events, this is the timestamp of the first event.

First Event ID

For aggregate events, this is the event ID of the first event

Aggregate ID

For ID for the aggregate event.

Note that the number of rows in the events table may not be the same as the number of events due to aggregation of events. Events that share the same Event Type, Device ID, Element Type, and Element Name are grouped together into one row representing an aggregate event in order to reduce clutter in the Event Browser.

For example, if a link sends an event indicating its up/down status every five minutes, and for the past month the link has always been up, then instead of there being 8640 rows in the Event Browser for each of these events, there will only be 1 row for an aggregate event used to represent those 8640 events. An aggregate event contains all the information of the most recent event along with a count of all events, the timestamp of the last event, and the event ID of the first event.

Right click on any column header in the table for display, sort and grouping options.

  • The Select Columns option allows you to select which columns to display in the table. Double-click a property to select / deselect it, and use the Move Up and Move Down buttons to reorder columns.

  • The Group option can be used to group the events according to user specified settings

  • By default, the Sort Ascending and Sort Descending options will only sort events on the displayed page. To sort on all events, check the Sort Global option.

To save the events to a file, select the disk icon on the top toolbar to open the “Export Event Options” window. Click the “...” button to browse for the export file, and select the export format (csv, tab, or html) and event selection (Current view, All pages, or All events).



Event Details



The bottom Event Details pane displays the detail for the selected event, including the related MIB attributes and their values. As a short-cut to lookup a MIB attribute in the MIB browser, double-click on the name, for example, ifOperStatus, and then right-click and select Search with MIB Browser. Similarly, if there is an IP address, select the IP address and then right-click and select Search for IP Address. This should work even if the IP address is represented as a HEX string.



Edit Event Type Severities



Note that each row is color-coded according to severity. To edit the severities associated with each event type, select Live Network > Edit Event Type Severities from the main menu bar of the IP/MPLSView web (Tools > Launch Web). Select the severity for each event type by using the dropdown menu to the right of the event type name. Click the Apply button to save these changes.

Figure 3: Edit Event Type Severities
Edit Event Type Severities
  • To edit the severities associated with threshold crossing alerts, open the threshold editor as described in Fault Management: Threshold Crossing Alerts Overview.

  • To change the color displayed on the event browser for each severity, click Actions on the Event Browser window and select Options.

From the top half of the Event Browser Options window, the severity colors can be configured.

Figure 4: Event Browser Options
Event Browser Options