Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Incident Configurations Provided by NNMi > Syslog Message Incident Configurations Provided by NNMi
Syslog Message Incident Configurations Provided by NNMi
Caution If a Syslog Message Incident configuration's Author value is Network Node Manager, it can be overwritten by NNMi. See Author form for important information.
NNMi provides the Syslog Message incident configurations described in the following tables. Each of the tables is organized by vendor.
You might also choose to create your own configurations for additional Syslog Messages that are important to you.
Syslog Message Configurations Provided by NNMi - CISCO
| Incident Configuration Name | Description |
|---|---|
| BGP-5-ADJCHANGE | Indicates a Border Gateway Protocol (BGP) neighbor has either come up or gone down. This informational message normally appears as routers and BGP neighbors go up or down. However, unexpected neighbor loss might indicate high error rates or high packet loss in the network and should be investigated. |
| CDP-4-DUPLEX_MISMATCH | Indicates that Cisco Discovery Protocol (CDP) has discovered a mismatch of duplex configuration. The recommended action is to configure the interfaces to the same duplex (full or half). |
| DTP-3-NONTRUNKPORTFAIL | Indicates that the port failed to become nontrunked. |
| DTP-3-TRUNKPORTFAIL | Indicates that the port failed to become trunked. |
| DTP-5-NONTRUNKPORTON | Indicates that the port is nontrunked. |
| DTP-5-TRUNKPORTCHG | Indicates that the encapsulation type of the trunk has changed. |
| DTP-5-TRUNKPORTON | Indicates that the port is trunked. |
| FR-5-DLCICHANGE | Indicates that a Frame-Relay Data Link Connection Identifier (DLCI) changes state. For states other than ACTIVE, such as INACTIVE and DELETED, check the Frame-Relay switch configuration to make sure its configuration matches the configuration of the router acting as the Frame-Relay Data Terminal Equipment device. |
| LINEPROTO-5-UPDOWN | Indicates the data link level line protocol changed state. |
| LINK-3-UPDOWN | Indicates the interface hardware went either up or down. The recommended action is to confirm the configuration settings for the interface, if the state change was unexpected. |
| LINK-4-ERROR | Indicates excessive errors have occurred on the interface. The recommended action is to check for duplex mismatches between both ends of the link. |
| OSPF-5-ADJCHG | Indicates an Open Shortest Path First (OSPF) neighbor has changed state. |
| PAGP-5-PORTFROMSTP | The switch has detected a loss of a link on a switch port, indicating the removal of a port from the Spanning Tree (via Spanning-Tree Protocol). |
| PAGP-5-PORTTOSTP | The switch has detected a link on a switch port, indicating the addition of a port to the Spanning Tree (via Spanning-Tree Protocol). |
| PORT_SECURITY-2-PSECURE_VIOLATION_VLAN | An unauthorized device attempted to connect on a secure trunk port. |
| SNMP-5-MODULETRAP | Indicates the SNMP agent has sent the Module Up or Module Down trap to the engine ID of the remote agent (or SNMP manager) because the corresponding module is up or down. |
| SPANTREE-5-PORTLISTEN | Indicates that the specified port in the VLAN state has changed to listening. |
| SPANTREE-5-ROOTCHANGE | Indicates that a new root port or a new root bridge has been selected for a specified Spanning Tree instance (via Spanning-Tree Protocol). |
| SPANTREE-6-PORTFWD | Indicates the port state in the VLAN changed to forwarding. |
| SPANTREE-6-PORTLISTEN | Indicates the port state in the VLAN changed to listening. |
| STACKMGR-6-MASTER_ELECTED | Indicates that the specified switch has been selected as the active switch. |
| STACKMGR-6-MASTER_READY | Indicates that the active switch is ready for use. |
| STACKMGR-6-STACK_LINK_CHANGE | Indicates that the status of the specified stack port has changed to active or inactive (up or down). |
| STANDBY-3-DUPADDR | Indicates that the router has received a Hot Standby Router Protocol (HSRP) message on the interface. The IP address in the HSRP message is the same as the IP address of the router. This condition may be caused by a network loop, a misconfiguration, or a malfunctioning switch. |
| STANDBY-6-STATECHANGE | Indicates that the Hot Standby Router Protocol (HSRP) state is changed. |
| SYS-3-MOD_CFGMISMATCH1 | Indicates that a module was inserted into a slot that has been configured for another module type. |
| SYS-3-MOD_CFGMISMATCH2 | Indicates that a module was inserted into a slot that has been configured for another module type. |
| SYS-3-MOD_CFGMISMATCH3 | Indicates that a module was inserted into a slot that has been configured for another module type. |
| SYS-3-MOD_CFGMISMATCH4 | Indicates that a module was inserted into a slot that has been configured for another module type. |
| SYS-3-PKTBUFBAD | Indicates that the packet buffer test detected a corrupted packet buffer on a module port. |
| SYS-3-PORT_COLL | Indicates that excessive or late collisions on the port are being logged. |
| SYS-3-PORT_COLLDIS | Indicates that the threshold values for late or excessive collisions on a port have been exceeded. |
| SYS-3-PORT_IN_ERRORS | Indicates that a port has experienced an input packet error. |
| SYS-3-PORT_RUNTS | Indicates that the switch has detected a runt frame (a frame that is less than 64 bytes). These errors are typically caused by physical layer issues or a speed/duplex mode mismatch with the remote device. |
| SYS-4-SYS_LCPERR4 | Indicates a transient Application-Specific Integrated Circuit (ASIC) packet buffer problem. |
| SYS-5-MOD_INSERT | Indicates that the module was inserted. |
| SYS-5-MOD_OK | Indicates that the module passed diagnostic self-test and is online. |
| SYS-5-MOD_REMOVE | Indicates that module was removed. |
| SYS-5-MOD_RESET | Indicates that the system was reset from the specified console number or IP address. |
| SYS-5-RELOAD | Indicates that a reload was requested. |
| SYS-5-RESTART | Indicates that a restart was requested. |
| SYS-5-SYS_LCPERR5 | Indicate an error or a significant condition for a specified port. |
Syslog Message Configurations Provided by NNMi - HC3
| Incident Configuration Name | Description |
|---|---|
| ARP/3/ROUTECONFLICT | Indicates that the device returned a route conflict when an Address Resolution Protocol (ARP) entry was added to the device. |
| ARP/5/ARP_DUPVRRPIP | Indicates that a virtual IP address in a Router Redundancy Group using the Virtual Router Redundancy Protocol (VRRP) conflict was detected. |
| BFD/5/BFD_CHANGE_FSM | Indicates that the finite state machine (FSM) of a Brute Force Detection (BFD) session has been changed. |
| BGP/5/BGP_RECHED_THRESHOLD | Indicates that the warning threshold of prefixes that can be received from a peer or peer group has been reached. |
| CFM/5/CFM_SAVECONFIG_SUCCESSFULLY | Indicates that the save configuration was successful. |
| DEV/4/BOARD_LOADING | Indicates that the specified board is loading a file. |
| DEV/4/FAN_FAILED | Indicates that the fan failed to run. |
| DEV/4/FAN_RECOVERED | Indicates that the fan state changed from failed or absent to normal. |
| DEV/4/LOAD_FINISHED | Indicates that the board has finished loading a file. |
| DEV/4/POWER_ABSENT | Indicates that the power has been removed. |
| DEV/4/POWER_FAILED | Indicates that the power state changed to failed. |
| DEV/4/POWER_RECOVERED | Indicates that the power state changed from failed or absent to normal. |
| DEV/4/SYSTEM_REBOOT | Indicates that the system is rebooting. |
| DEVM/2/BOARD_STATE_FAULT | Indicates that an Input/Output or slave boards state changed to fault. |
| DEVM/2/POWER_FAILED | Indicates that the power state changed to failed. |
| DEVM/3/BOARD_REMOVED | Indicates that an Input/Output or slave board has been removed from a slot. |
| DEVM/3/RPS_ABSENT | Indicates that the redundant power system (RPS) is removed. |
| DEVM/5/POWER_RECOVERED | Indicates that the power state changed from failed or absent to OK. |
| DEVM/5/RPS_NORMAL | Indicates that the Redundant Power System (RPS) state changed to normal. |
| DEVM/5/SYSTEM_REBOOT | Indicates that the system is rebooting. |
| LDP/5/LDP_SESSION_DOWN | Indicates that the sessions state changed to down. |
| MSTP/5/MSTP_BPDU_RECEIVE_EXPIRY | Indicates that a non-designated port did not receive a Bridge Protocol Data Unit (BPDU) within the rcvdInfoWhile interval, thus aging out the information of the port. |
| NTP/5/NTP_SOURCE_LOST | Indicates that there was a system synchronization source lost. |
| OPTMOD/3/TYPE_ERR | Indicates that the transceiver type is not supported by the port hardware. |
| OPTMOD/4/MODULE_IN |
Indicates that the module on this port is plugged in to the interface. |
| OPTMOD/4/MODULE_OUT | Indicates that the module on this port is not plugged in. |
| OPTMOD/5/CHKSUM_ERR | Indicates that the checksum of transceiver information is bad. |
| OPTMOD/5/IO_ERR | Indicates that the transceiver information Input/Output failed. |
| OPTMOD/5/MOD_ALM_OFF | Indicates that a module fault is gone, and the module on the port has recovered to normal. |
| OPTMOD/5/MOD_ALM_ON | Indicates that a module not ready fault of the module is detected, and the module on the port has some fault. |
| OSPF/5/OSPF_NBR_CHG | Indicates that an important neighbor state change event has occurred. |
| OSPF/6/OSPF_LAST_NBR_DOWN | Indicates a record of the last Open Shortest Path First (OSPF) neighbor down event. |
| PIM/5/PIM_NBR_DOWN | Indicates that a Protocol Independent Multicast (PIM) neighbor state changed to down. |
| STM/3/STM_LINK_STATUS_DOWN | Indicates that the link status of an Intelligent Resilient Framework (IRF) port is down. |
| STM/4/LINK_STATUS_CHANGE | Indicates that the link status of an Intelligent Resilient Framework (IRF) port changed to up or down. |
| STM/6/STM_LINK_STATUS_UP | Indicates that the link status of an Intelligent Resilient Framework (IRF) port is up. |
| VRRP/6/VRRP_STATUS_CHANGE | Indicates that the status of the virtual router has changed. |
Syslog Message Configurations Provided by NNMi - Procurve
| Incident Configuration Name | Description |
|---|---|
| ProCurve-RMON_BOOT_CRASH_RECORD0 | Indicates that the specified management module was rebooted. |
| ProCurve-RMON_BOOT_CRASH_RECORD1 | Indicates a text message was generated explaining the reasons for a system failure, which may include the type of failure (out of resources or bus error), task name, file name and line number (bus address). |
| ProCurve-RMON_BOOT_NO_CRASH_RECORD | Indicates that the specified management module failed without saving a failure record. |
| ProCurve-RMON_BOOT_SELFTEST_FAILURE | Indicates that the Self test failed while the switch was booting up. |
| ProCurve-RMON_CHASSIS_FAN_STATUS | A fan has failed or a failed fan is no longer failing. The fan state is indicated by failure or OK. The number of times that the fan failed is also displayed. |
| ProCurve-RMON_CHASSIS_HEARTBEAT_FAILURE | Indicates that communication with the specified slot was lost. |
| ProCurve-RMON_CHASSIS_POWER_STATUS |
Indicates that the one of the following power conditions exists:
The state of the main or RPS power supply is indicated as failure or OK. The number of times that the power supply failed is also displayed. |
| ProCurve-RMON_LACP_DYNAMIC_TRUNK_OFF_LINE | Indicates that the trunk is now off-line. |
| ProCurve-RMON_LACP_DYNAMIC_TRUNK_ON_LINE | Indicates that the trunk is now online. |
| ProCurve-RMON_LACP_ERROR_CONDITION_BLOCK | Indicates that an error condition occurred on the specified trunk port and that the port is blocked. |
| ProCurve-RMON_PMGR_PORT_UP | Indicates that the specified port is now online. |
| ProCurve-RMON_POEMGR_INTERNAL_50V_FAULT | Indicates that the internal power supply has faulted or a faulted power supply is now operational. The power supply state is indicated as faulted or OK. |
| ProCurve-RMON_POEMGR_PD_DENIED_POWER | Indicates that there is insufficient power available to power the Powered Device (PD) on the port and the port does not have sufficient PoE priority to take power from another active PoE port. |
| ProCurve-RMON_POEMGR_PD_OVERCURRENT | Indicates that the Powered Device (PD) connected to the port has requested more than 15.4 watts of power. This may indicate a short-circuit or other problem in the PD. |
| ProCurve-RMON_SSH_DISABLED | Indicates that the Secure Shell (SSH) server has been disabled. |
| ProCurve-RMON_SSH_ENABLED | Indicates that the Secure Shell (SSH) server has been enabled. |
| ProCurve-RMON_STP_NEW_ROOT | Indicates that the Spanning-Tree Protocol (STP) root MAC address has changed for the specified STP priority level. |
To see or modify these Syslog Message Incident configurations:
-
Navigate to the Syslog Message Configurations form.
- In the Workspace navigation panel, select the Configuration workspace.
- Expand the Incidents folder.
- Select Syslog Message Configurations
- Select a row and click the
Open icon. - When you finish, click
Save and Close.