Caution If a Management Event configuration's Author value is Network Node Manager, it can be overwritten by NNMi. See Author form for important information.
Deduplication is not configured for out-of-the-box management events. See Correlate Duplicate Incidents (Deduplication Configuration) for information about how to configure deduplication.
NNMi provides the incident configurations for management events. Click here for more information.
To see or modify these management event incident configurations:
-
Navigate to the Management Event Configurations view.
- In the workspace navigation panel, select the Configuration workspace.
- Expand the Incidents folder.
- Select Management Event Configurations.
-
Double-click the row representing the configuration you want to see or modify:
- When you finish, click
Save and Close.
| Incident Configuration Name | Description |
|---|---|
| AddressNotResponding |
Indicate an address is not responding to ICMP. Reasons an address might not respond include:
|
| AggregatorDegraded | (NNMi Advanced) Indicates one or more (but not all) physical interfaces that are part of the Aggregator Interface are not operational. (Link AggregationProtocols used on Switches to configure multiple Interfaces (Aggregation Member Interfaces) to function as if they were one (an Aggregator Interface). When two Aggregator Interfaces establish a connection, that connection is an Aggregator Layer 2 Connection. The Aggregator Layer 2 Connection appears on Layer 2 Neighbor View maps as a thick line with an Interface icon at each end (representing the Aggregator Interface). or Split Link AggregationLink Aggregation with more than two endpoints. Some vendors refer to this as Multi-Chassis Link Aggregation, SLAG, MLAG, or MC-LAG.) |
| AggregatorDown | (NNMi Advanced) Indicates the operational status of the Aggregator Interface is down (if monitored), or all of the corresponding physical interfaces are Down. (Link AggregationProtocols used on Switches to configure multiple Interfaces (Aggregation Member Interfaces) to function as if they were one (an Aggregator Interface). When two Aggregator Interfaces establish a connection, that connection is an Aggregator Layer 2 Connection. The Aggregator Layer 2 Connection appears on Layer 2 Neighbor View maps as a thick line with an Interface icon at each end (representing the Aggregator Interface). or Split Link AggregationLink Aggregation with more than two endpoints. Some vendors refer to this as Multi-Chassis Link Aggregation, SLAG, MLAG, or MC-LAG.) |
| AggregatorLinkDegraded | (NNMi Advanced) Indicates any Aggregation Member Interface is operationally down on either node, when there is a connection between two Aggregator Interfaces. (Link AggregationProtocols used on Switches to configure multiple Interfaces (Aggregation Member Interfaces) to function as if they were one (an Aggregator Interface). When two Aggregator Interfaces establish a connection, that connection is an Aggregator Layer 2 Connection. The Aggregator Layer 2 Connection appears on Layer 2 Neighbor View maps as a thick line with an Interface icon at each end (representing the Aggregator Interface). or Split Link AggregationLink Aggregation with more than two endpoints. Some vendors refer to this as Multi-Chassis Link Aggregation, SLAG, MLAG, or MC-LAG.) |
| AggregatorLinkDown | (NNMi Advanced) Indicates the Aggregator Interface on either side of an Aggregator Layer 2 Connection is down. (Link AggregationProtocols used on Switches to configure multiple Interfaces (Aggregation Member Interfaces) to function as if they were one (an Aggregator Interface). When two Aggregator Interfaces establish a connection, that connection is an Aggregator Layer 2 Connection. The Aggregator Layer 2 Connection appears on Layer 2 Neighbor View maps as a thick line with an Interface icon at each end (representing the Aggregator Interface). or Split Link AggregationLink Aggregation with more than two endpoints. Some vendors refer to this as Multi-Chassis Link Aggregation, SLAG, MLAG, or MC-LAG.) |
| BufferOutOfRangeOrMalfunctioning | Indicates the buffer pool is exhausted or cannot meet demand. |
| CardDisabled | Indicates that the card has been disabled by the device administrator. |
| CardDown | Indicates the card is not responding to polls. |
| CardRemoved | Indicates the card was removed from a device. |
| CardInserted | Indicates a card was inserted into a device. |
| CardUndeterminedState | Indicates the card reported a non-normal state for some unspecified reason. |
| ConnectionDown | Indicate that both (or all) ends of a connection are not responding to SNMP queries. |
| CpuOutOfRangeOrMalfunctioning | Indicates any of 5 second, 1 minute, or 5 minute utilization averages is too high. |
| CrgFailover | Indicates the primary card (for example, Card Active) has moved from one card to the other in a Card Redundancy Group. The Card Redundancy Group is routing packets properly. |
| CrgMultiplePrimary | Indicates NNMi has identified multiple primary cards (for example, Card Active ) in the Card Redundancy Group. This typically indicates the communication between the cards in the group is malfunctioning. |
| CrgNoPrimary |
Indicates NNMi is unable to identify a primary card (for example, Card Active) in the Card Redundancy Group. This typically indicates one of the following:
|
| CrgNoSecondary |
Indicates NNMi cannot identify a secondard card (for example Card Standby) in the Card Redundancy Group. This typically indicates the following:
|
| CustomPollCritical | Indicates that a Polling Instance associated with the Custom Poller Collection is in a Critical State. |
| CustomPolledInstanceOutOfRange | Indicates that a Custom Polled Instance has reached or exceeded a Comparison Map value or Threshold configured for the associated Custom Node Collection. |
| CustomPollMajor | Indicates that a Polling Instance associated with the Custom Poller Collection is in a Major State. |
| CustomPollMinor | Indicates that a Polling Instance associated with the Custom Poller Collection is in a Minor State. |
| CustomPollWarning | Indicates that a Polling Instance associated with the Custom Poller Collection is in a Warning State. |
| DuplicateCorrelation |
Provided as a template for configuring deduplication for an incident to specify which attribute values NNMi must match to verify that an incident is a duplicate Note The DuplicateCorrelation incident configuration does not support Suppression, Enrichment or Dampening. |
| FanOutOfRangeOrMalfunctioning | Physical Sensor object incident: Indicates the specified fan is not operating correctly. |
| ForwardIncidentRateExceeded | (NNMi Advanced) Indicates that the volume of messages entering a Regional Manager's Global Network Management message queue has exceeded the configured rate limits. |
| HostedObjectTrapStorm | Indicates the trap rate threshold for a hosted object has been exceeded. |
| InterfaceDisabled | Indicates the interface has been explicitly disabled by the device administrator. |
| InterfaceDown | Indicates that the operational status of the interface is down. |
| IpSubnetContainsIpWithNewMac |
Indicates the MAC Address corresponding to a particular IP Address has changed. Possible causes include a duplicate IP Address on this subnet. |
| IslandGroupDown |
Indicates all nodes in a group of Layer 2 connected nodes do not respond to monitoring polls (for example, ICMP or SNMP). These groups are automatically discovered and contain all of the nodes that can be connected through NNMi topology. Typically, these are groups on one side of a WAN (wide area network) connection. |
| LicenseExpired | Indicates that the expiration date has passed for an instant-on or temporary NNMi license key. See Extend a Licensed Capacity. |
| LicenseMismatch |
Indicates that the licensed capacity for NNMi does not match the licensed capacity for one of the i Smart Plug in products in your network environment. See Purchase Network Node Manager i Smart Plug-ins and More. Note The licensed capacity count is cumulative for each licensed product (across all installed license keys for that licensed product). |
| LicenseNodeCountExceeded | Indicates that the number of discovered nodes exceeds the licensed capacity for managed node count. See Extend a Licensed Capacity. |
| ManagementAddressICMPResponseTimeAbnormal | Indicates an abnormal Internet Control Message Protocol (ICMP) response time from the NNMi management server to the selected node. ICMP messages are typically used for diagnostic or routing purposes for determining whether a host or router could not be reached. The incident is generated when NNMi detects a higher than configured ICMP response time between the NNMi management server and the selected node. |
| ManagementAddressICMPResponseTimeHigh | Indicates a high Internet Control Message Protocol (ICMP) response time from the management server to the selected node. ICMP messages are typically used for diagnostic or routing purposes for determining whether a host or router could not be reached. The incident is generated when NNMi detects a higher than configured ICMP response time between the NNMi management server and the selected node. |
| MemoryQueueIncidentRateExceeded | (NNMi Advanced) Indicates the rate at which NNMi forwards incidents to the Global Manager has exceeded the maximum allowed. NNMi no longer forwards incidents generated from SNMP traps. |
| MessageQueueSizeExceeded | Indicates one of the queues connecting the stages for the Event Pipeline is above the configured limits. NNMi determines queue size limits based on memory size. |
| ModifiedConnectionDown | Indicates a connection has been disconnected, moved, or both and is not responding to SNMP queries. |
| NnmClusterFailover | Indicates the NNMi cluster detected a failure of the active server. NNMi services were started on the standby server. |
| NnmClusterLostStandby | Indicates the NNMi cluster active server lost its communication to the standby server. |
| NnmClusterStartUp | Indicates the NNMi cluster was started in a state where no active server was already present. Therefore the server was started in the active state. |
| NnmClusterTransfer | Indicates the system administrator moved the active state from one server to another. The NNMi services will then start on the new active server. |
| NodeDeleted | Indicates that the specified node was deleted from the NNMi topology. |
| NodeDown |
Indicates that the NNMi Causal Engine has determined the node is down based on the following analysis: 100% of the addresses assigned to this node are unreachable. NNMi is communicating with at least two of the neighboring devices. And at least two neighboring devices report problems with connectivity to this node. |
| NodeOrConnectionDown | Indicate a node is not responding to an ICMP or SNMP query. It also indicates that only one neighbor is down so that the NNMi Causal Engine cannot determine whether the node or the connection is down. |
| PowerSupplyOutOfRangeOrMalfunctioning | Physical Sensor object incident: Indicates a power supply for the Source Node is not operating correctly. |
| RateCorrelation |
Provided as a template to measure the number of incoming incidents within a defined time period. Note The rateCorrelation incident configuration does not support Suppression, Enrichment, or Dampening. |
| RrgDegraded |
This incident occurs only in Router Redundancy Groups with more than two routers. Indicates the following:
Typically, the protocol-specific communication between routers is malfunctioning. However, the group is routing packets properly. |
| RrgFailover |
Indicates a primary role moved from one device to another in a Router Redundancy Group (for example, HSRP Active or VRRP Master). Reasons for this incident include one or more of the following:
Even though a fail-over occurred, the group is routing packets properly. |
| RrgMultiplePrimary |
Indicates that multiple primary devices are identified in a Router Redundancy Group (for example, HSRP Active or VRRP Master). Typically, the protocol-specific communication between routers in the group is malfunctioning. |
| RrgMultipleSecondary |
Indicates that more than one secondary device is identified in a Router Redundancy Group (for example, HSRP Standby). Note This incident applies only to Router Redundancy Groups that allow only one secondary member. Typically, the protocol-specific communication between routers in the group is malfunctioning. Typically, the protocol-specific communication between routers in the group is malfunctioning. |
| RrgNoPrimary |
Indicates that no primary device is identified in a Router Redundancy group (for example, HSRP Active or VRRP Master) . This incident typically indicates one of the following:
|
| RrgNoSecondary |
Indicates that no secondary device is identified in a Router Redundancy Group (for example, HSRP Standby or VRRP Backup). This incident typically indicates the following:
|
| SNMPAgentNotResponding | The SNMP agent is not responding to SNMP queries on the selected Node. |
| SNMPTrapLimitCritical | Indicates the number of SNMP traps persisted in the NNMi database is approaching the maximum allowed limit. After the maximum allowed limit is reached, NNM no longer accepts SNMP traps until the number of SNMP traps within the database is reduced using the nnmtrimincidents.ovpl command. |
| SNMPTrapLimitMajor | Indicates the number of SNMP traps persisted in the NNMi database has reached or exceeded 95% of the maximum limit. After the maximum limit is reached, NNMi only accepts traps required for Causal Engine analysis until the number of SNMP traps within the database has been reduced using the nnmtrimincidents.ovpl command. |
| SNMPTrapLimitWarning | Indicates the number of SNMP traps persisted in the NNMi database has reached or exceeded 90% of the maximum limit. After the maximum limit is reached, NNMi no longer accepts SNMP traps until the number of SNMP traps within the database is reduced using the nnmtrimincidents.ovpl command. |
| TemperatureOutOfRangeOrMalfunctioning | Physical Sensor object incident: Indicates the specified temperature sensor on the Source Node is too hot or too cold. |
| TrapStorm | Indicates a trap storm has occurred. |
| VoltageOutOfRangeOrMalfunctioning | Physical Sensor object incident: Indicates the specified voltage on one of the Source Node's power supplies is out of range. |
Click here for more information.
The Node Sensor performance threshold events have a Category value of Performance a Family value of Node Sensor, and a Nature of Root Cause.
The Interface performance threshold events have a Category value of Performance a Family value of Interface, and a Nature of Root Cause.
| Incident Configuration Name | Description |
|---|---|
|
Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS). |
|
| BackplaneAbnormal | Indicates the backplane utilization is abnormal based on the computed baseline. |
| BackplaneOutOfRange | Indicates the backplane utilization has gone above or below a threshold setting. |
| BufferAbnormal |
Indicates the buffer utilization is abnormal based on the computed baseline. |
| CpuAbnormal |
Indicates the CPU utilization is abnormal based on the computed baseline for one of the following:
|
| DiskSpaceAbnormal | Indicates disk space utilization is abnormal based on the computed baseline. |
| DiskSpaceOutOfRange | Indicates disk space utilization has gone above or below a threshold setting. |
| InterfaceFCSLANErrorRateHigh |
Local Area Network. Indicates a Frame Check Sequence (FCS) error rate on the interface has gone above a threshold setting. The error rate is based on the number of frames that were received with a bad checksum (CRCCyclic Redundancy Check value). Possible causes include collisions at half-duplex, a duplex mismatch, bad hardware (NICNetwork Interface Controller, cable, or port), or a connected device generating frames with bad FCS. |
| InterfaceFCSWLANErrorRateHigh |
Wireless Local Area Network. Indicates a Frame Check Sequence (FCS) error rate on the interface has gone above a threshold setting. The error rate is based on the number of frames that were received with a bad checksum (CRCCyclic Redundancy Check value). Possible causes include collisions at half-duplex, a duplex mismatch, bad hardware (NIC, cable, or port), or a connected device generating frames with bad FCS. |
| InterfaceInputDiscardRateHigh | Indicates the input discard rate on the interface has exceeded a threshold setting. This rate is based on the reported change in the number of input packets on the interface and the discarded packet count. |
| InterfaceInputErrorRateAbnormal |
Indicates the input error rate on the interface is abnormal based on the computed baseline. This range is based on the reported change in the number of input packets on the interface and the packet error count. Possible causes include bad packet checksums, incorrect header information, and small packets. |
| IntefaceInputErrorRateHigh | Indicates the input error rate on the interface crossed a High threshold setting. This rate is based on the reported change in the number of input packets on the interface and the packet error count. |
| InterfaceInputQueueDropsHigh |
Indicates the number of input queue drops on the interfacecrossed a High threshold setting. This range is based on the number of packets dropped because of a full queue. Possible causes include that the number of packet buffers allocated to the interface is exhausted or has reached its maximum threshold. |
| InterfaceInputUtilizationAbnormal |
Indicates the input utilization on the interface is abnormal based on the computed baseline. This range is based on the interface speed and the reported change in the number of input bytes on the interface. |
| InterfaceInputUtilizationHigh | Indicates the input utilization on the interface crossed a High threshold setting. This percentage is based on the interface speed and the reported change in the number of input bytes on the interface. |
| InterfaceInputUtilizationLow | Indicates the input utilization on the interface crossed a Low threshold setting. This percentage is based on the interface speed and the reported change in the number of input bytes on the interface. |
| InterfaceInputUtilizationNone | Indicates there is no input utilization on the interface. This value is based on the interface speed and the reported change in the number of input bytes on the interface. |
| InterfaceOutputDiscardRateHigh | Indicates the output discard rate on the interface crossed a High threshold setting. This rate is based on the reported change in the number of input packets on the interface and the discarded packet count. |
| InterfaceOutputErrorRateHigh | Indicates the output error rate on the interface crossed a High threshold setting. This rate is based on the reported change in the number of output packets on the interface and the packet error count. |
| InterfaceOutputQueueDropsHigh |
Indicates the number of output queue drops on the interface crossed a High threshold setting. This number is based on the number of packets dropped because of a full queue. Possible causes include a congested interface. |
| InterfaceOutputUtilizationAbnormal | Indicates the output utilization on the interface is abnormal based on the computed baseline. This range is based on the interface speed, and the reported change in the number of output bytes on the interface. |
| InterfaceOutputUtilizationHigh | Indicates the output utilization on the interface crossed a High threshold setting. This percentage is based on the interface speed and the reported change in the number of output bytes on the interface. |
| InterfaceOutputUtilizationLow | Indicates the output utilization on the interface crossed a Low threshold setting. This percentage is based on the interface speed and the reported change in the number of output bytes on the interface. |
| InterfaceOutputUtilizationNone | Indicates there is no output utilization on the interface. This value is based on the interface speed and the reported change in the number of output bytes on the interface. |
| InterfacePerformanceCritical | Indicates the interface performance has reached a Critical severity. |
| InterfacePerformanceWarning | Indicates that the interface performance has reached a Warning severity. |
| MemoryOutOfRangeOrMalfunctioning | Indicates the Source Node's memory pool is exhausted or cannot meet the demand for use. |
| MemoryAbnormal | Indicates the memory utilization is abnormal based on the computed baseline. |