Configure basic settings for a Syslog message incident

The Basics settings for a Syslog Message incident specifies general information for an incident configuration, including the name, severity, and message.

In the Basics group of the Syslog Message Configuration form, verify that Enable is selected for each configuration you want to use.

To configure Basic settings for a Syslog Message incident:

Navigate to the Syslog Message Configuration form:

1. From the workspace navigation panel, select the Configuration workspace.
2. Expand the Incidents folder.
3. Select Syslog Message Configurations.
4. Do one of the following:
1. To create an incident configuration, click the New icon, and continue.
2. To edit an incident configuration, select a row, click the Open icon, and continue.
3. To delete an incident configuration, select a row, and click the  Delete icon.

5. Configure the required Basic settings (see the Basic Attributes table).

6. Click  Save and Close to save your changes and return to the previous form. NNMi uses the SNMP Object ID to enable forwarding of Management Events as SNMP traps. NNMi automatically assigns a unique SNMP Object ID to all Management Events provided by NNMi.

Basic Attributes for Syslog Message Configuration

Task	How
Specify the Incident Configuration Name (Syslog Messages)	Use the Basics pane of the Syslog Message Configuration form. Specify the value of the AdditionalDataValue mnemonic for the undefined trap as the Syslog Message name. In the following example LINK-3-UPDOWN is the AdditionalDataValue mnemonic value for the trap: additionalDataValue.1 .1.3.6.1.4.1.11937.1.42.1.3.1 LINK-3-UPDOWN Alpha-numeric, spaces, and the following special characters are permitted: - (dash), _ (underscore), : (colon), and / (slash). If the mnemonic value includes non-supported characters, replace each character with an underscore character (_) or space.
Specify whether you want to enable this configuration.	In the Basics group of the Syslog Message Configuration form, verify that Enable is selected for each configuration you want to use.
Specify Category and Family Attribute Values for Organizing Your Incidents (Syslog Message)	Use the Basics pane of the Syslog Message Configuration form. You can organize your incidents using Category and Family.
Specify the Incident Severity (Syslog Message)	Use the Basics pane of the Syslog Message Configuration form. Possible Severity values include: Normal, Warning, Minor, Major, and Critical. The incident severity represents the seriousness calculated for the incident. Use the severity attribute to specify the severity that should be assigned to the incident you are configuring. Here is a list of possible values: Normal: Indicates there are no known problems related to the associated object. This severity is meant to be informational. Generally, no action is needed for these incidents. Warning: Indicates there might be a problem related to the associated object. Minor: Indicates NNMi has detected problems related to the associated object that require further investigation. Major: Indicates NNMi has detected problems related to the associated object to be resolved before they become critical. Critical: Indicates NNMi has detected problems related to the associated object that require immediate attention.
Specify Your Incident Message Format (Syslog Message)	Use the Basics pane of the Syslog Message Configurationform. The message format determines the message to be displayed for the incident. When configuring an incident, specify the information you want NNMi to include in the incident's Message attribute value. You can use any combination of valid parameter strings and Custom Incident attributes to configure the Message. Note The incident Message limit is 1024 characters. If the returned values exceed this limit, NNMi truncates the value starting from the end of the returned text string.
Specify a Description for Your Incident Configuration (Syslog Messages)	Use the Basics pane of the Syslog Message Configuration form. Provide a meaningful description. NNMi provides the Description attribute to help you further identify the current incident configuration. Description Use the description field to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry. Type a maximum of 1024 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted.
Specify an Author for Your Incident Configuration (Management Events)	Use the Basics pane of the Syslog Message Configuration form to indicate who created or last modified the event. If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future. Click  Lookup and select  Show Analysis to display details about the currently selected Author. Click  Quick Find to access the list of existing Author values. Click  New to create an Author value.

After you complete the Basic Configuration, you can also choose to configure the information described in the following table.

Additional Incident Configurations

Task	How
Configure Interface Settings for a Syslog Message Incident	Select the Interface Settings tab to specify an Interface Group to which you want your incident configuration to apply.
Configure Node Settings for a Syslog Message Incident	Select the Node Settings tab to specify a Node Group to which you want your incident configuration to apply.
Configure Suppression Settings for a Syslog Message Incident	Select the Suppression tab to specify the criteria for discarding incidents that match the selected incident configuration.
Configure Enrichment Settings for a Syslog Message Incident	Select the Enrichment tab to specify enhancements for the selected incident configuration.
Configure Dampening Settings for a Syslog Message Incident	Select the Dampen tab to specify the time interval that must be met before the incident appears in an Incident view.
Configure Deduplication for a Syslog Message Incident	Select the Deduplication tab to specify duplicate incidents that you want to be suppressed.
Configure Rate (Time Period and Count) for a Syslog Message Incident	Select the Rate tab to specify a rate for duplicate incidents. After the rate limit is reached, NNMi generates an Incident to notify you of the problem.
Configure Actions for a Syslog Message Incident	Select the Actions tab to specify actions that should occur automatically when an incident changes its Lifecycle State.

Specify category and family attribute values for organizing your incidents

When configuring incidents, NNMi provides the Category and Family attributes to help you organize your incidents.

Preconfigured Categories
The Category attribute helps you organize your incidents. Select the category that you want to be associated with this type of incident when it appears in an incident view. Each of the possible Category values is described in the following table.

Incident Categories Provided by NNMi

Category	Description
Accounting	Used to indicate problems related to usage statistics and allocation of costs associated with the billing of time and services provided by devices. This category is not used by NNMi with default configurations, but it is available for incidents you define.
Application Status	Indicates there is a problem with the health of the NNMi software. Examples of these kinds of events include license expiration or that a certain NNMi process or service lost connection to the Process Status Manager.
Configuration	Indicates there is a problem with the configuration of a managed device. For example, there is a physical address mismatch.
Fault	Indicates a problem with the network, for example Node Down.
Performance	Indicates a Monitored Attribute value crossed a configured threshold. For example, Disk Space Utilization exceeds the configured threshold criteria for High Value = 90 percent .
Security	Indicates there is a problem related to authentication. For example, an SNMP authentication failure.
Status	Indicates some kind of status message. Examples of these kinds of incidents include "SNMP Link Up" or an "HSRP Group status Normal" message.

You can add your own Category entries to NNMi.

You can use Family attribute values to further categorize the types of incidents that might be generated. Each of the possible values are described in the following table.

Incident Family Attribute Values Provided by NNMi

Family	Description
Address	Indicates the incident is related to an address problem.
Aggregated Port	Indicates the incident is related to a Split Link Aggregation or Split Link Aggregation problem.
BGP	Indicates the incident is related to a problem with BGP (Border Gateway Protocol). This family is not used by NNMi with default configurations, but it is available for incidents you define.
Board	Indicates the incident is related to a board problem. This family is not used by NNMi with default configurations, but it is available for incidents you define.
Card	Indicates the incident is related to a card problem. This family is not used by NNMi with default configurations, but it is available for incidents you define.
Chassis	Indicates the incident is related to a chassis problem.
Component Health	Indicates the incident is related to Node Sensor or Physical Sensor data collected by NNMi.
Connection	Indicates the incident is related to a problem with one or more connections.
Correlation	Indicates the incident has additional incidents correlated beneath it. These incidents are associated with a duplicate count so that you can determine the number of correlated incidents associated with it.
Custom Poller	Indicates the incident is related to the NNMi Custom Poller feature.
HSRP	(NNMi Advanced) Indicates the incident is related to a problem with Hot Standby Router Protocol (HSRP).
Interface	Indicates the incident is related to a problem with one or more interfaces.
IP Subnet	Indicates the incident is related to a problem with the IP Subnet.
License	Indicates the incident is related to a licensing problem.
NNMi Health	Indicates the incident is related to NNMi Health.
Node	Indicates the incident is related to a node problem.
OSPF	Indicates the incident is related to an OSPF problem. This family is not used by NNMi with default configurations, but it is available for incidents you define.
RAMS	Indicates the incident is related to a Router Analytics Management System problem.
RMON	Indicates the incident is related to a Remote Monitor (IETF standard, RFC 1757) problem. This family is not used by NNMi with default configurations, but it is available for incidents you define.
RRP	(NNMi Advanced) Indicates the incident is related to a problem with a Router Redundancy Protocol configuration.
STP	Indicates the incident is related to Spanning-Tree Protocol problem. This family is not used by NNMi with default configurations, but it is available for incidents you define.
Syslog	NNMi does not use this Family with default configurations. It is available for incidents you define.
System and Applications	Indicates the incident is related to a problem with a system or application in your environment that is configured to send traps to the NNMi server, for example your corporate database application.
Trap Analysis	Requires Network Node Manager iSPI Network Engineering Toolset Software (NNM iSPI NET). Indicates the incident is related to an SNMP trap storm.
VLAN	Indicates the incident is related to a problem with a virtual local area network.
VRRP	(NNMi Advanced) Indicates the incident is related to a problem with Virtual Router Redundancy Protocol (VRRP).

You can add your own Family entries to NNMi.

Create an incident category

The Category attribute helps you organize your incidents. Create any Category that makes sense to you and your team.

To create a new incident Category:

1. Navigate to the Incident Category form.

   1. From the workspace navigation panel, select the Configuration workspace.
   2. Expand the Incidents folder.

   3. Select Syslog Message Configurations.

   4. Do one of the following:

      • To create an incident configuration, click the New icon, and continue.
      • To edit an incident configuration, select a row, click the Open icon, and continue.
      • To delete an incident configuration, select a row, and click the  Delete icon.
   5. In the configuration form, locate the Category attribute.
   6. Click the  Lookup icon, and select  New.
2. Provide the required information (see table).
3. Click  Save and Close to save your changes and return to the previous form.

Category Code Attributes

Name	Description
Label	Incident category name. For example, Hardware Faults, or Cisco Error. Maximum size is 255 characters. Alpha-numeric, spaces, and underline characters are permitted.
Unique Key	Caution: After you click  Save and Close, this value cannot be changed. Used as a unique identifier when exporting and importing configuration definitions. To ensure that the value you enter is unique, it is recommended that you use the Java name space convention when providing this value. It is also useful to include the label value as part of the unique key as shown in the following examples: com.<your_company_name>.nnm.trapConf.category.<category_label> com.<your_company_name>.nnm.eventConf.category.<category_label> com.<your_company_name>.nnm.inciConf.category.<category_label> The maximum length is 80 characters. Alpha-numeric characters and periods are permitted. Spaces are not permitted.

Create an incident family

The Family attribute helps you organize your incidents. Create any Family that makes sense to you and your team.

To create a new incident Family:

1. Navigate to the Incident Family form.

   1. From the workspace navigation panel, select the Configuration workspace.
   2. Expand the Incidents folder.

   3. Select Syslog Message Configurations .

   4. Do one of the following:

      • To create an incident configuration, click the New icon, and continue.
      • To edit an incident configuration, select a row, click the Open icon, and continue.
      • To delete an incident configuration, select a row, and click the  Delete icon.
   5. In the configuration form, locate the Family attribute.
   6. Click the  Lookup icon, and select  New.
2. Provide the required information (see table).
3. Click  Save and Close to save your changes and return to the previous form.

Family Attributes

Name	Description
Label	Family name. For example, Hardware Faults, or Cisco Error. Maximum size is 255 characters. Any character type is valid.
Unique Key	Caution: After you click  Save and Close, this value cannot be changed. Used as a unique identifier when exporting and importing configuration definitions. To ensure that the value you enter is unique, it is recommended that you use the Java name space convention when providing this value. It is also useful to include the label value as part of the unique key as shown in the following examples: com.<your_company_name>.nnm.trapConf.family.<family_label> com.<your_company_name>.nnm.eventConf.family.<family_label> com.<your_company_name>.nnm.inciConf.family.<family_label> The maximum length is 80 alpha-numeric characters, periods allowed, no spaces allowed.

Valid parameters for configuring incident messages

When configuring incident messages, consider using incident information as part of the message. NNMi provides the following parameter values. Use these parameters as variables when formatting an incident message.

NNMi stores varbind values as custom incident attributes (CIAs).

Parameter strings are available for the following:

See the following tables to view the valid parameters for incidents generated from Custom Polled Instances.

• Parameter strings for all incidents (Incident form attributes) (Click here for a list of choices.)

  Parameter Strings for all Incidents (Incident form attributes)

  Parameter String	Description
  $category, $cat	Value of the Category attribute in the Incident form.
  $count, $cnt	Value representing the number of Custom Incident Attributes that appear in the Incident form.
  $family, $fam	Value from the Family attribute in the Incident form.
  $firstOccurrenceTime, $fot	Value from the First Occurrence Time attribute in the incident form.
  $lastOccurrenceTime, $lot	Value from the Last Occurrence Time attribute in the incident form.
  $lifecycleState, $lcs	Value from the Lifecycle State attribute in the Incident form.
  $name	Value of the Name attribute from the incident configuration.
  $nature, $nat	Value from the Nature attribute in the Incident form.
  $origin, $ori	Value from the Origin attribute in the Incident form.
  $originOccurrenceTime, $oot	Value from the Origin Occurrence Time attribute in the incident form.
  $priority, $pri	Value from the Priority attribute in the Incident form.
  $sev, $severity	Value of the Severity attribute of the Incident form.

• Parameter Strings for Node Source Objects (Node form attributes) (Click here for a list of choices.)

  Parameter Strings for Node Source Objects (Node form attributes)

  Parameter String	Description
  $managementAddress, $mga	Value from the Management Address attribute of the incident's source Node's form or SNMP Agent form.
  $otherSideOfConnectionManagementAddress, $oma	If the incident's Source Node is part of a Layer 2 Connection, this attribute is the value of the Management Address of a node on the other side of the Layer 2 Connection.
  $sourceNodeLongName, $sln	The fully-qualified DNS name as displayed in the Hostname attribute of the incident's source Node's form.
  $sourceNodeName, $snn	Value from the Name attribute of the incident's source Node's form.
  $sysContact, $sct	Value from the System Contact attribute of the incident's source Node form: General tab.
  $sysLocation, $slc	Value from the System Location attribute of the incident's source Node form: General tab.

• Parameter Strings for Interface Source Objects (Interface form attributes) (Click here for a list of choices.)

  Parameter Strings for Interface Source Objects (Interface form attributes)

  Parameter String	Description
  $ifAlias, $ifa	Value from the IfAlias attribute for the interface that is the incident's source object.
  $ifConfigDupSetting, $icd	Configured Duplex Setting on the port associated with the interface that is the incident's source object.
  $ifDesc, $idc	Value from the ifDesc attribute for the interface that is the incident's source object.
  $ifIndex, $idx	Value from the ifIndex attribute for the interface that is the incident's source object.
  $ifIpAddr, $iia	IP Address values associated with the interface that is the incident's source object.   If multiple IP addresses are associated with the interface, this parameter returns a comma-separated list.
  $ifName, $ifn	Value from the ifName attribute for the interface that is the incident's source object.
  $ifPhysAddr, $ipa	Value from the Physical Address attribute for the interface that is the incident's source object.
  $ifSpeed, $isp	Value from the ifSpeed attribute for the interface that is the incident's souce object.
  $ifType, $itp	Value from the ifType attribute for the interface that is the incident's souce object.

• Parameter Strings for Layer 2 Connection Source Objects (Layer 2 Connection form attributes) (Click here for a list of choices.)

  Parameter Strings for Layer 2 Connection Source Objects (Layer 2 Connection form attributes)

  Parameter String	Description
  $otherSideOfConnectionConfigDupSetting, $ocd	If the incident's source Node is part of a Layer 2 Connection, this parameter contains the Configured Duplex Setting on the port associated with the interface on the other side of the connection.
  $otherSideOfConnectionIfAlias, $oia	If the incident's Source Node is part of a Layer 2 Connection, this parameter is the value of the ifAlias of one of the interfaces on the other side of the Layer 2 Connection.
  $otherSideOfConnectionIfDesc, $odc	If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifDescr attribute value for the interface on the other side of the Layer 2 Connection.
  $otherSideOfConnectionIfIndex, $odx	If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifIndex attribute value for the interface on the other side of the connection.
  $otherSideOfConnectionIfName, $ofn	If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifName attribute value for the interface on the other side of the connection.

• Parameter strings for VLAN Source Objects (VLAN form attributes) (Click here for a list of choices.)

  Parameter Strings for VLAN Source Objects (VLAN form attributes)

  Parameter String	Description
  $impVlanIds, $ivi	Value from the VLAN Id attribute associated with the interface that is the incident's source object. To access this information from an interface form, navigate to the VLAN Port tab and open the form for the VLAN of interest. If the interface is part of more than one VLAN, this parameter returns a comma-separated list.
  $impVlanNames, $ivn	Value from the VLAN Name attribute associated with the interface that is the incident's source object. To access this information from an interface form, navigate to the VLAN Ports tab of the Interface form. If the interface is part of more than one VLAN, this parameter returns a comma-separated list.

• Parameter Strings for all incidents (Additional information that is not visible in any form) (Click here for a list of choices.)

  Parameter Strings for all Incidents (Attributes not visible in any form)

  Parameter String	Description
  $firstOccurrenceTimeMs, $fms	Value from the First Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
  $lastOccurrenceTimeMs, $lms	Value from the Last Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
  $oid	Value of the unique object identifier (oid) for the incident configuration that originated from either an SNMP Trap, Syslog Message or Management Event.
  $otherSideOfConnection, $osc	If the incident's Source Node is part of a Layer 2 Connection, this attribute is the following combination of values for the node and one of its interfaces on the other side of the Layer 2 Connection: The fully-qualified DNS name of the node appended with the interface Name in the following format: <fully-qualified DNS name>[interface_name]
  $originOccurrenceTimeMs $oms	Value from the Origin Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
  $sourceNodeUuid, $snu	Universally Unique Object Identifier attribute value of the source node object for the incident (unique across all databases). This identifier distinguishes the source node object instance from all other node objects.
  $sourceObjectClass, $soc	Value of the object class for the object you want to include. Use this parameter to request more details of a class of objects through a web service. Examples of object classes include: com.hp.ov.nms.model.core.Interface and com.hp.ov.nms.model.snmp.SnmpAgent.
  $sourceObjectName, $son	Value from the Name attribute of the source object. For example, an interface object is named according to the MIB ifName. Each ifName varies according to the vendor's conventions. Using the name 4/1 as an example, 4 represents the board number and 1 represents the port number.
  $sourceObjectUuid, $sou	Universally Unique Object Identifier attribute value of the source object for the incident (unique across all databases). This identifier distinguishes the source object instance from all other similar object instances.
  $uuid	Universally Unique Object Identifier attribute value of the incident (unique across all databases). This identifier distinguishes the incident object instance from all other incident objects.

• Information established in Custom Incident Attributes (Click here for a list of choices.)

   

  Parameter Strings for Attributes Established in Custom Incident Attributes

  Parameter String	Description
  $<position _number>	Value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, to indicate you want to use the varbind in position 1, enter: $1 NNMi stores varbind values as Custom Incident Attributes. If you know the varbind position number, use this parameter.
  $<CIA_name>	Value of the name that is used for the custom incident attribute. For example, $mycompany.mycia. NNMi provides CIA values for configuring Management Events.
  $<CIA_oid>	Value of the object identifier for any custom incident attribute that originated as a varbind. For example, $.1.3.6.1.6.3.1.1.5.1. Use this parameter when you are not certain of a custom incident attribute (varbind) position number.
  $*	Used to indicate you want all of the custom incident attribute values originating as varbinds, to be passed to the action configuration. Each varbind is returned in the following format: $<CIA_name>:<CIA_value> in which the custom incident attribute name appears followed by the custom incident attribute value.

• Functions to generate values (Click here for a list of choices.)

  The function described in the following table replaces the specified numeric value with the associated text value stored in the CIA.

  The associated MIB must have been loaded using the nnmloadmib.ovpl command.

  Functions to Generate Values Within the Incident Message

  Function	Description
  $oidtext($<position_number>)	A <position_number> argument specifies the numeric value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, $oidtext($2). The position number you enter must represent a CIA that contains an Object Identifier (OID) value. NNMi returns the textual value of the OID for the CIA specified. Note the following: If the MIB is not loaded, NNMi returns the numeric OID value. If the OID has a MIB instance, the number representing the MIB instance is appended to the textual OID value.
  $oidtext($<CIA_oid>)	The <CIA_oid> argument specifies the Object Identifier (OID) for any custom incident attribute that originated as a varbind. For example, $oidtext($.1.3.6.1.6.3.1.1.5.1.) Use this argument to the $oidtext() function when you are not certain of a custom incident attribute (varbind) position number. NNMi replaces the numeric value with the textual value of the OID you specify. Note the following: If the MIB is not loaded, NNMi returns the numeric OID value. If the OID has a MIB instance, the number representing the MIB instance is appended to the textual OID value.
  $text($<position_number>)	The <position_number> argument specifies the numeric value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, to indicate you want to use the varbind in position 1, enter: $1. NNMi replaces the numeric value with the text value stored in the CIA. Note: If a text value is not available, NNMi returns the numeric value.
  $text($<CIA_oid>)	The <CIA_oid> argument specifies the object identifier for any custom incident attribute that originated as a varbind. For example, $.1.3.6.1.6.3.1.1.5.1. Use this argument to the $text function when you are not certain of a custom incident attribute (varbind) position number. NNMi replaces the numeric value with the text value stored in the CIA. If a text value is not available, NNMi returns the numeric value.

Include custom incident attributes in your message format

NNMi includes two categories of CIAs:

• SNMP trap varbinds identified by the Abstract Syntax Notation value (ASN.1). NNMi turns varbinds into CIAs and maintains each varbind's position number.

• Custom incident attributes provided by NNMi.

  You cannot create Custom Incident Attributes.

You can use CIAs in your message format to extend the amount of information presented. To determine which CIAs are available for any particular incident type, open an Incident view, locate the incident and open the Incident form. Navigate to the Custom Attributes tab. A complete list of available CIAs (for that incident type) appears in the table.

To include a CIA in your message format, type the dollar-sign character ($)plus any of the following:

• Varbind position number or asterisk (*) to include all varbind values
• Name of the CIA 
• Object identifier (oid) of the CIA (useful when the varbind position number is not consistent among vendors)

The following table presents some example formats with the subsequent output.

Example Incident Message Formats

Example Message Format	Output in Incident View
Possible trouble with $3	Possible trouble with <varbind 3>
Possible trouble with $11	Possible trouble with <varbind 11>
Possible trouble with $77 (where the varbind position 77 does not exist)	Possible trouble with <Invalid or unknown cia> 77
Possible trouble with $*	Possible trouble with <cia1_name: cia_value>, <cia2_name; cia_value>,< cian_name: cia_value>
Possible trouble with $3x	Possible trouble with <varbind 3>x
Possible trouble with $1.2.3.4.5	Possible trouble with <value of the CIA with oid of 1.2.3.4.5>
Possible trouble with $cia.sourceObject.UcmdbId	Possible trouble with <value of the CIA with name of cia.sourceObject.UcmdbId>