Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Best Practices Tour for the Incident Management Workspace

This Best Practices Tour describes how to use the Incident Management workspace to take action on incidents assigned to you and your team. The views in this workspace display any information that the NNMi administrator allows you to see.

The Incident Management workspace, contains the following views:

Open Key Incidents table view

By default this table view lists the types of incidents described in the following table and is filtered to show only those incidents with a Severity that is not Normal ( Critical, Major, Minor, or Warning). You can change the Severity Filter (or any column filter) by right-clicking the column of interest.

Incident Correlation Nature	Description
Info	This Correlation Nature is meant to be informational.
None	Indicates there is no incident correlation for this incident.
Rate Stream Correlation	Indicates the incident tracks incident patterns based on the number of incident reoccurrences within a specified time period. After the count within the specified time period is reached, NNMi emits a Rate Correlation incident and continues to update the Correlation Notes with the number of occurrences within that rate.
Root Cause	Indicates an incident that NNMi's Causal Engine determined to be the root cause of a problem.
User Root Cause	Indicates that your NNMi administrator configured NNMi to always treat this Incident as Correlation Nature: Root Cause.
Key Incidents do not include Incidents with following Correlation Natures because they are not considered to be Key Incidents: Dedup Stream Correlation Secondary Root Cause Symptom

Unassigned Open Key Incidents table view

This view displays all incidents that do not have any owner. To own an incident, click the incident row of interest, and then select Actions → Assign → Own Incident. To assign the incident to someone else, select Actions → Assign Incident. In the Assign Incident dialog select the name of the User Account to which you want to assign the incident and click OK.
My Open Incidents table view

NNMi displays the incidents assigned to your User Account. These incidents are the incidents that likely require the most immediate attention from you.

Incidents originate from a variety of sources:
- SNMP Traps generated from SNMP agents on managed devices in your network environment. Note that many SNMP traps never become incidents (the NNMi administrator must configure that to happen for each trap definition).
- Incidents that your NNMi Administrator configured so that NNMi notifies the team when a specific issue is detected.
- Incidents generated as a result of other incidents. NNMi analyzed the available data and arrived at a Conclusionthat indicates some problem needs to be addressed. See Help → Help for Operators, and use Search to find the following text string including quotes "outstanding status conclusions" to find the complete list of all conclusions for each managed object.

Solve Network Problems

Start by accessing the available information for the Source Object and Source Node for the incident. To access all known information about the Source Object, access the incident's Source Object form . NNMi monitors the following object types:
- Node and its Node Sensors (such as CPU and memory)
- Interface
- IP Address
- Chassis and its Physical Sensors (such as backplane and fan)
- Card
- SNMP Agent
- Node Group
- Card Redundancy Group
- Router Redundancy Group
Select an incident. Then, select Actions → Source Object. NNMi displays the form for the object associated with the incident.

A wealth of information about that object is available.
- The object's form is displayed in the top half of the display window. Use the Conclusions tab to display a history of any problems that led to the object's current Status.
- The Analysis Pane is displayed in the bottom half of the display window. It provides a quick summary of available information. For example, the Details tab also lists the available Conclusions.
To explore the information about the object, use the browse buttons:
- to display a list of all available tabs. Select any tab name from the list to display that tab.
- to display the next subset of tabs (depending on the current width of your NNMi window).
You will find the object's State, Status (No Status, Normal, Warning, Minor, Major, Critical, Disabled, or Unknown), Conclusions, and any related incidents.
If the Source Object is not a node, you can access the form for the node on which the object is hosted by selecting Open using the Lookup icon from the Hosted on Node attribute.

Once again, information about the State, Status, and Conclusions can assist yow with identifying the problem.
Select the Actions menu to explore additional troubleshooting choices:
Access to these commands depends on the NNMi RoleDetermined by your membership in one of four special NNMi User Groups (NNMi Administrators, NNMi Level 2 Operators, NNMi Level 1 Operators, or NNMi Guest Users). This membership determines what you can see and do within the NNMi console. and Object Access Privileges to which you are assigned. If you are unable to access an action, contact your NNMi administrator.
- Use Maps to see the location of the node, and its connections to (communication channels with) other devices.
  Maps are a quick way to determine the nodes that have a Status other than Normal. Maps are also a valuable tool that helps you determine the scope of a problem. For example, a map can indicate whether the problem affects an entire site or only a small subset of devices. The map view you select depends on the types of information you want to view.
  - Maps → Node Group map displays the group of nodes, if any, to which the selected node belongs. Your NNMi administrator can configure Node Groups that group nodes together according to selected criteria. For example, nodes grouped by location, importance, or device type.
  - Maps → Path View is a flow diagram rather than a connection diagram. It displays the flow of network traffic between two devices, rather than all of the available connections. Path View calculates the route that data flows between two nodes, and provides a map of that information. The two nodes can be any combination of end nodes or routers.
- Use the Graphs submenu to monitor one or more devices in real-time. For example, if you receive a call that email is slow, you might want to view a line graph that monitors the utilization of the interfaces on the email server. To select a graph, first select the MIB file that contains the types of information you want to display.
- Use the Node Access submenu when you want to check whether a node is reachable or to log on to the device.
- Select either Node Actions, Interface Actions, or IP Address Actions and then use the Polling submenu when you suspect that NNMi is incorrectly reporting the status or configuration for a device:
  - Polling → Status Poll to force NNMi to repoll the device so that NNMi updates its Status and Discovery State (for example, NNMi reports that an interface is down, but you believe it is up).
  - Polling → Configuration Poll to force a re-discovery of the device (for example, if you suspect that NNMi is missing an interface for the node).
- Select either Node Actions, Interface Actions, or IP Address Actions and then use the Configuration Details submenu when you want to check a device’s Communication Configuration settings or Monitoring Configuration settings. Communication Configuration information includes SNMP and ICMP configuration values. Monitoring Configuration information includes the types of polling enabled, the fault and performance polling intervals, as well as the Management Mode for the selected node.
- Select Node Actions and then use the MIB Information submenu when you want to see the results of List Supported MIBs or to use the MIB Browser for determining more details about the object (by issuing SNMP MIB Walk or SNMP MIB Set commands).
- Select Node Actions and then use Show Attached End Nodes to determine the end nodes, if any, attached to a switch.
As another best practice, check the timing of the incident to determine whether the incidents coincides with a known network episode.

See Best Practices Tour for the Incident Browsing Workspace when you want to filter on more possible patterns related to incidents.

Send Help Center feedback