Interpret Threshold Incidents

The following tables describe some of the thresholds for which the NNMi administrator can enable incidents. For more information: See Also

• Backplane Incidents (NNM iSPI Performance for Metrics)
• Buffer Incidents (NNM iSPI Performance for Metrics)
• CPU Incidents (NNM iSPI Performance for Metrics)
• Disk Incidents (NNM iSPI Performance for Metrics)
• Interface Frame Check Sequence (FCS) Error Rate Incidents (NNM iSPI Performance for Metrics)
• Interface Input and Output Discard Rate Incidents (NNM iSPI Performance for Metrics)
• Interface Input and Output Error Rate Incidents (NNM iSPI Performance for Metrics)
• Input and Output Queue Drop Incidents (NNM iSPI Performance for Metrics)
• Interface Input and Output Utilization Incidents (NNM iSPI Performance for Metrics)
• Management Address ICMP Response Time Incidents
• Interpret Threshold Incidents

Fault Threshold Incidents

Threshold Being Monitored	Incidents
Management Address ICMP Response Time Threshold based on elapsed time (in milliseconds) for receiving a node's reply to an Internet Control Message Protocol (ICMP) echo request. The address queried is the node's Management Address attribute value. See the node's Node form, Basic Attributes section for the currently configured address.	See Management Address ICMP Response Time Incidents

(NNM iSPI Performance for Metrics) Performance thresholds can affect the status of an interface, connection, or node. For example, if an interface error rate is high, the interface status becomes Critical. NNMi's Causal Engine returns the node status of Warning for any nodes that have interfaces outside one or more threshold boundaries.

Performance Threshold Incidents (NNM iSPI Performance for Metrics)

Threshold Being Monitored	Incidents
Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).
Backplane Utilization Threshold based on the percentage of backplane usage compared to the total amount of available backplane resources.	See Backplane Incidents ()
Buffer monitoring: Buffer Failure Rate Threshold based on the percentage of a node's buffer failures compared to the total number of attempts to create new buffers. These failures are caused by insufficient memory when the device tried to create new buffers. Buffer Miss Rate Threshold based on the percentage of a Node's buffer misses compared to the total attempts at buffer access. Crossing this threshold indicates the number of available buffers are dropping below a minimum level required for successful operation. Buffer Utilization Threshold based on the percentage of a Node's buffers that are currently in use, compared to the total number of available buffers. Nodes have multiple buffers and potentially multiple buffer types (various sizes and manufacturers). This threshold provides results for each buffer type that the Node's SNMP agent is capable of detecting. Therefore, the Node Sensor form might show multiple Buffer Utilization result entries for each polling cycle (one for each group of buffers comprised of a specific buffer type).	See Buffer Incidents ()
CPU monitoring: CPU 5Sec Utilization Threshold based on the percentage of a node's CPU usage compared to the total amount of available CPU capacity. This percentage is the average CPU utilization over the prior 5-seconds. CPU 1Min Utilization Threshold based on the percentage of a node's CPU usage compared to the total amount of available CPU capacity. This percentage is the average CPU utilization over the prior 1-minute. CPU 5Min Utilization Threshold based on the percentage of a node's CPU usage compared to the total amount of available CPU capacity. This percentage is the average CPU utilization over the prior 5-minutes.	See CPU Incidents ():
Disk Space Utilization Threshold based on the percentage of a node's disk space usage compared to the total amount of available disk space.	See Disk Incidents ()
Interface Frame Check Sequence (FCS) monitoring: FCS LAN Error Rate Local Area Network interfaces only.Threshold based on the percentage of incoming frames with a bad checksum (CRCCyclic Redundancy Check value) compared to the total number of incoming frames. Possible causes include collisions at half-duplex, a duplex mismatch, bad hardware (NICNetwork Interface Controller, cable, or port), or a connected device generating frames with bad Frame Check Sequence. FCS WLAN Error Rate Wireless Local Area Network Interfaces only. Threshold based on the percentage of incoming frames with a bad checksum (CRCCyclic Redundancy Check value) compared to the total number of incoming frames. Possible causes include wireless communication interference, bad hardware (NICNetwork Interface Controller, cable or port), or a connected device generating frames with bad Frame Check Sequence.	See Interface Frame Check Sequence (FCS) Error Rate Incidents ()
Interface Discard Rate monitoring: Input Discard Rate Threshold based on the percentage of the interface's discarded input packet count compared to the total number of packets received. Packets might be discarded because of a variety of issues, including receive-buffer overflows, congestion, or system specific issues. Output Discard Rate Threshold based on the percentage of the interface's discarded output packet count compared to the total number of outgoing packets. Packets might be discarded because of a variety of issues, including transmission buffer overflows, congestion, or system specific issues.	See Interface Input and Output Discard Rate Incidents ().
Interface Error Rate monitoring: Input Error Rate Threshold based on the percentage of the interface's input packet error count compared to the total number of packets received. What constitutes an error is system specific, but likely includes such issues as bad packet checksums, incorrect header information, and packets that are too small. Output Error Rate Threshold based on the percentage of the interface's output packet error count compared to the total number of outgoing packets. What constitutes an error is system specific, but likely includes such issues as as collisions and buffer errors.	See Interface Input and Output Error Rate Incidents ().
Interface Queue monitoring: Input Queue Drops Rate Threshold based on the percentage of the interface's dropped input packets compared to the total number of packets received. Possible causes include the input queue being full. Output Queue Drops Rate Threshold based on the percentage of the interface's dropped output packets compared to the total number of outgoing packets. Possible causes include all buffers allocated to the interface being full.	See Input and Output Queue Drop Incidents ().
Interface Utilization monitoring: Input Utilization Threshold based on the percentage of the interface's total incoming octets compared to the maximum number of octets possible (determined by the MIB being used to query ifSpeed of the device and whether the host system supports high-speed counters for interfaces). Sometimes the ifSpeed value returned by the device's SNMP agent is not accurate and causes problems with thresholds. If your NNMi role allows, you can override the ifSpeed reported by the SNMP agent: Open the problem interface's Interface form. Select the General Tab. Locate the Input/Output Speed section. Change the Input Speed or Output Speed setting. Output Utilization Threshold based on the percentage of the interface's total outgoing octets compared to the maximum number of octets possible (determined by the MIB being used to query ifSpeed of the device and whether the host system supports high-speed counters for interfaces). Sometimes the ifSpeed value returned by the device's SNMP agent is not accurate and causes problems with thresholds. If your NNMi role allows, you can override the ifSpeed reported by the SNMP agent: Open the problem interface's Interface form. Select the General Tab. Locate the Input/Output Speed section. Change the Input Speed or Output Speed setting.	See Interface Input and Output Utilization Incidents ().
Memory Utilization Threshold based on the percentage of a node's memory usage compared to the total amount of available memory.	See Memory Incidents ()

Backplane Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Backplane incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your NNMi administrator configured performance measurement thresholds. For more information: See Also

Backplane incidents identify nodes that are over-used or under-used.

You receive backplane incidents when performance is not within the allowable range set by your NNMi administrator in Monitoring Configuration. Reasons for setting backplane thresholds include:

• Monitor for under-utilization which wastes money
• Monitor for over-utilization, which might result in performance bottlenecks or service provider surcharges (over a pre-specified percentage)

The following tables describes the possible results.

Backplane Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	Memory on <NodeName> is abnormal. Incident Name: BackplaneAbnormal	Physical Sensor measured an abnormal value according to Baseline Limits set by your NNMi administrator. This occurs when any backplane related metric is abnormal.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

Backplane Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Low	Backplane on <NodeName> is out of configured range. Incident Name: BackplaneOutOfRangeOrMalfunctioning	Physical Sensor measured a value less than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group. See also Backplane is Out of Configured Range	Minor
None
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	Backplane on <NodeName> is out of configured range. Incident Name: BackplaneOutOfRangeOrMalfunctioning	Physical Sensor measured a value more than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group.	Critical

When backplane Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Physical Sensor measurement is within the allowable range, NNMi updates the following attributes:

• The Physical Sensor Status is changed to Normal
• The Physical Sensor Conclusion is changed to one of the following:

Backplane Incident's Close Sequence

Physical Sensor Conclusion Initiating the Incident	Physical Sensor Conclusion Closing the Incident	Physical Sensor Status Changes To:
BackplaneAbnormal	BackplaneNormal	Normal
BackplaneOutOfRangeOrMalfunctioning	BackplaneInRangeAndFunctioning	Normal

This Physical Sensor Conclusion propagates to the following:

• Card Form: Conclusions Tab
• Chassis Form: Conclusions Tab
• Node Form: Conclusions Tab

Buffer Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Buffer incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your NNMi administrator configured performance measurement thresholds. For more information: See Also

Buffer incidents identify nodes that are over-used or under-used.

You receive buffer incidents when performance is not within the allowable range set by your NNMi administrator in Monitoring Configuration. Reasons for setting buffer thresholds include:

• Monitor for under-utilization which wastes money
• Monitor for over-utilization, which might result in performance bottlenecks or service provider surcharges (over a pre-specified percentage)

The following tables describe the possible results.

Buffer Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	Buffer on <NodeName> is abnormal. Incident Name: BufferAbnormal	Node Sensor measured an abnormal value according to Baseline Limits set by your NNMi administrator. This occurs when any Buffer related metric is abnormal.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

Buffer Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Low	Buffer on <NodeName> has insufficient capacity or is malfunctioning. Incident Name: BufferOutOfRangeOrMalfunctioning	Node Sensor measured a value less than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group.	Minor
None
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	Buffer on <NodeName> has insufficient capacity or is malfunctioning. Incident Name: BufferOutOfRangeOrMalfunctioning	Node Sensor measured a value more than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group. This occurs when the buffer pool is exhausted or cannot meet demand.	Critical

When buffer Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Node Sensor measurement is within the allowable range, NNMi updates the following attributes:

• The Node Sensor Status is changed to Normal
• The Node Sensor Conclusion is changed to one of the following:

Buffer Incident's Close Sequence

Node Sensor Conclusion Initiating the Incident	Node Sensor Conclusion Closing the Incident	Node Sensor Status Changes To:
BufferAbnormal	BufferNormal	Normal
BufferOutOfRangeOrMalfunctioning	BufferInRangeAndFunctioning	Normal

This Node Sensor Conclusion propagates to the following:

• Node Form: Conclusions Tab

CPU Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

CPU incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

CPU incidents identify nodes that are over-used or under-used.

You receive CPU incidents when performance is not within the allowable range set by your administrator. Reasons for setting CPU thresholds include:

• Monitor for under-utilization which wastes money
• Monitor for over-utilization, which might result in performance bottlenecks or service provider surcharges (over a pre-specified percentage)

The following tables describe the possible results.

CPU Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	CPU on <NodeName> is abnormal. Incident Name: CPUAbnormal	Node Sensor measured an abnormal value according to Baseline Limits set by your NNMi administrator. Occurs when any CPU related metric is abnormal.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

CPU Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Low	CPU on <NodeName> utilization is too high. Incident Name: CpuOutOfRangeOrMalfunctioning	Node Sensor measured a value less than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group.	Minor
None
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	CPU on <NodeName> utilization is too high. Incident Name: CpuOutOfRangeOrMalfunctioning	Occurs when any of 5 second, 1 minute, or 5 minute utilization averages is too high.	Critical

When CPU Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Node Sensor is within the allowable range, NNMi updates the following attributes:

• The Node Sensor Status is changed to Normal
• The Node Sensor Conclusion is changed to one of the following:

CPU Incident's Close Sequence

Node Sensor Conclusion Initiating the Incident	Node Sensor Conclusion Closing the Incident	Node Sensor Status Changes To:
CPUAbnormal	CPUNormal	Normal
CPUOutOfRangeOrMalfunctioning	CPUInRangeAndFunctioning	Normal

This Node Sensor Conclusion propagates to the following:

• Node Form: Conclusions Tab

Disk Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Disk incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Disk incidents identify nodes that are over-used or under-used.

You receive disk incidents when performance is not within the allowable range set by your NNMi administrator in Monitoring Configuration. Reasons for setting disk thresholds include:

• Monitor for under-utilization which wastes money
• Monitor for over-utilization, which might result in performance bottlenecks or service provider surcharges (over a pre-specified percentage)

The following tables describe the possible results.

Disk Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	Disk on <NodeName> is abnormal. Incident Name: DiskAbnormal	Node Sensor measured an abnormal value according to Baseline Limits set by your NNMi administrator.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

Disk Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Low	Disk on <NodeName> is out of configured range. Incident Name: DiskOutOfRangeOrMalfunctioning	Node Sensor measured a value less than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group. This occurs when the disk monitored attributes are out of range.	Minor
None
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents	Not applicable
High	Disk on <NodeName> is out of configured range. Incident Name: DiskOutOfRangeOrMalfunctioning	Node Sensor measured a value more than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group. This occurs when the disk monitored attributes are out of range.	Critical

When disk Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Node Sensor is within the allowable range, NNMi updates the following attributes:

• The Node Sensor Status is changed to Normal
• The Node Sensor Conclusion is changed to one of the following:

Disk Incident's Close Sequence

Node Sensor Conclusion Initiating the Incident	Node Sensor Conclusion Closing the Incident	Node Sensor Status Changes To:
DiskAbnormal	DiskNormal	Normal
DiskOutOfRangeOrMalfunctioning	DiskInRangeAndFunctioning	Normal

This Node Sensor Conclusion propagates to the following:

• Node Form: Conclusions Tab

Interface Frame Check Sequence (FCS) Error Rate Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Interface Frame Check Sequence (FCS) error rate incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

FCS error rate incidents identify interfaces that are dropping data.

You receive FCS error rate incidents when error rate threshold is not within the allowable range set by your administrator. Reasons for setting  FCS error rate thresholds include:

• Check for corrupted data packets
• Detect configuration mismatches
• Detect faulty hardware

The status of FCS error rate incidents depends on whether the measured value is over or under the allowable range.

The following tables describe the possible results.

FCS LAN or FCS WLAN Error Rate Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	High FCS LAN or FCS WLAN error rate on interface <ObjectName>. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is above the configured high value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceFCSLANErrorRateHigh InterfaceFCSWLANErrorRateHigh	Indicates high Frame Check Sequence (FCS) LAN or WLAN error rate, based on the the number of frames that were received with a bad checksum (CRC value). What constitutes an error is system specific, but likely includes such issues as collisions at half-duplex, a duplex mismatch, bad hardware (NIC, cable, or port), or a connected device generating frames with bad FCS.	Critical

When Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the FCS LAN Interface Error Rate or FCS WLAN Interface Error Rate is within the allowable range, NNMi updates the following attributes:

• The Interface Status is changed to Normal.
• The Interface Conclusion is changed as shown in the following table:

FCS LAN or FCS WLAN Error Rate Threshold Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceFCSLANErrorRateHigh	InterfaceFCSLANErrorRateInRange	Normal
InterfaceFCSWLANErrorRateHigh	InterfaceFCSWLANErrorRateInRange	Normal

This Interface Conclusion propagates to the following:

• Layer 2 Connection Form: Conclusions Tab
• Node Form: Conclusions Tab

Interface Input and Output Discard Rate Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Interface input and output discard rate incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Interface input and output discard rate incidents enable you to identify interfaces that have transmission buffer overflows or are bottlenecks.

You receive interface input and output discard rate incidents when a discard rate is not within the allowable range set by your administrator. For example, the discard rate must not exceed 10 percent. Reasons for setting  discard rate thresholds include:

• Check for large data packets
• Monitor bottlenecks
• Detect faulty hardware

Only discard rates that exceed the allowable range generate an incident.

The following tables describe the possible results.

Interface Input and Output Discard Rate Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	High input or output discard rate on interface $sourceObjectName. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the configured low value of $cia.thresholdLowerBound and the configured high value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputDiscardRateHigh InterfaceOutputDiscardRateHigh	Indicates high input or output discard rate, based on the reported change in the number of output packets on the interface and the discarded packet count. Packets may be discarded because of a variety of issues, including receive buffer overflows, congestion, or system specific issues.	Major

When Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Interface Input or Output Discard Rate is within the allowable range, NNMi updates the following attributes:

• The Interface Status is changed to Normal.
• The Interface Conclusion is changed as shown in the following table:

Interface Input and Output Discard Rate Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceInputDiscardRateHigh	InterfaceInputDiscardRateNominal	Normal
InterfaceOutputDiscardRateHigh	InterfaceOutputDiscardRateNominal	Normal

This Interface Conclusion propagates to the following:

• Layer 2 Connection Form: Conclusions Tab
• Node Form: Conclusions Tab

Interface Input and Output Error Rate Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Interface input and output error rate incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Interface input and output error rate incidents identify interfaces that are dropping data.

You receive interface input and output error rate incidents when an error rate threshold is not within the allowable range set by your administrator. For example, the error rate must not exceed 10 percent. Reasons for setting  error rate thresholds include:

• Check for corrupted data packets
• Detect configuration mismatches
• Detect faulty hardware

Only error rates that exceed the allowable range generate an incident.

The following tables describe the possible results.

Interface Input and Output Error Rate Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Nominal	No incident is generated	The measured value is within the allowable range. NNMi closes any related High incidents.	Not applicable
High	High input or output error rate on interface <ObjectName>. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the configured low value of $cia.thresholdLowerBound and the configured high value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputErrorRateHigh InterfaceOutputErrorRateHigh	Indicates high input or output error rate, based on the reported change in the number of input or output packets on the interface and the packet error count. What constitutes an error is system specific, but likely includes such issues as bad packet checksums, incorrect header information, runt packets, etc.	Critical

When Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Interface Input or Output Error Rate is within the allowable range, NNMi updates the following attributes:

• The Interface Status is changed to Normal.
• The Interface Conclusion is changed to one of the following:

Interface Input and Output Error Rate Threshold Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceInputErrorRateHigh	InterfaceInputErrorRateNominal	Normal
InterfaceOutputErrorRateHigh	InterfaceOutputErrorRateNominal	Normal

This Interface Conclusion propagates to the following:

• Layer 2 Connection Form: Conclusions Tab
• Node Form: Conclusions Tab

Input and Output Queue Drop Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Input Queue Drop and Output Queue Drop incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Interface input and output queue drop incidents enable you to identify interfaces that have transmission buffer overflows or are bottlenecks.

You receive input and output queue drop incidents when a discard rate is not within the allowable range set by your administrator. For example, the queue drop rate must not exceed 10 percent. Reasons for setting  queue drop rate thresholds include:

• Check for large data packets
• Monitor bottlenecks
• Detect faulty hardware

The status of input and output queue drop incidents depends on whether the measured value is over the allowable range.

The following tables describe the possible results.

Interface Input and Output Queue Drop Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Nominal	No incident is generated	The measured value is within the allowable range. NNMi closes any related High incidents.	Not applicable
High	High input or output queue drops rate on interface $sourceObjectName. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the configured low value of $cia.thresholdLowerBound and the configured high value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputQueueDropsRateHigh InterfaceOutputQueueDropsRateHigh	Indicates high input or output queue drops rate, based on the number of packets dropped because of a full queue. What constitutes an error is system specific, but likely includes such issues as the number of packet buffers allocated to the interface is exhausted or reaches its maximum threshold.	Major

When Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Queue Drops are within the allowable range, NNMi updates the following attributes:

• The Interface Status is changed to Normal.
• The Interface, Connection, or Node Conclusion is changed as shown in the following table:

Interface Input and Output Queue Drop Threshold Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceInputQueueDropsHigh	InterfaceInputQueueDropsRateInRange	Normal
InterfaceOutputQueueDropsHigh	InterfaceOutputQueueDropsRateInRange	Normal

Potential propagation influence on other objects as follows:

• Layer 2 Connection Form: Conclusions Tab
• Node Form: Conclusions Tab

Interface Input and Output Utilization Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Input and output utilization incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Input and output utilization incidents identify interfaces that are over-used or under-used.

You receive input and output utilization incidents when performance is not within the allowable range set by your administrator. Reasons for setting  utilization thresholds include:

• Monitor for under-utilization which wastes money
• Monitor for over-utilization, which might result in performance bottlenecks or service provider surcharges (over a pre-specified percentage)

The status of input and output utilization incidents depends on whether the measured value is over or under the allowable range.

The following tables describe the possible results.

Interface Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	Abnormal input or output utilization on interface <ObjectName>. Incident Name: InterfaceInputUtilizationAbnormal InterfaceOutputUtilizationAbnormal	Indicates abnormal input or output utilization, based on the interface speed, and the reported change in the number of input or output bytes on the interface. The exact MIB values queried varies based on the speed of the interface and whether the system supports the high speed counters for interfaces.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

The following table describes the meaning of the threshold range measurements of None, Low, Nominal, and High:

Interface Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
None	Zero input or output utilization on interface <ObjectName>. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputUtilizationLow InterfaceOutputUtilizationLow	Indicates zero input or output utilization, based on the interface speed, and the reported change in the number of input or output bytes on the interface. The exact MIB values queried varies based on the speed of the interface and whether the system supports the high speed counters for interfaces.	Minor
Low	Low input or output utilization on interface <ObjectName>. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the minimum allowed value of $cia.thresholdLowerBound and the configured low value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputUtilizationNone InterfaceOutputUtilizationNone	Indicates low input utilization, based on the interface speed, and the reported change in the number of input or output bytes on the interface. The exact MIB values queried varies based on the speed of the interface and whether the system supports the high speed counters for interfaces.	Major
Nominal	No incident is generated	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Normal
High	High input or output utilization on interface $sourceObjectName. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the configured high value of $cia.thresholdLowerBound and the maximum allowed value of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: InterfaceInputUtilizationHigh InterfaceOutputUtilizationHigh	Indicates high input or output utilization, based on the interface speed, and the reported change in the number of input or output bytes on the interface. The exact MIB values queried varies based on the speed of the interface and whether the system supports the high speed counters for interfaces.	Major

When Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Interface Input or Output Utilization Rate is within the allowable range, NNMi updates the following attributes:

• The Interface Status is changed to Normal.
• The Interface Conclusion is changed to one of the following:

Interface Baseline Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceInputUtilizationAbnormal	InterfaceOutputUtilizationNormal	Normal
InterfaceOutputUtilizationAbnormal	InterfaceOutputUtilizationNormal	Normal

Interface Threshold Incident's Close Sequence

Interface Conclusion Initiating the Incident	Interface Conclusion Closing the Incident	Interface Status Changes To:
InterfaceInputUtilizationNone	InterfaceInputUtilizationNominal	Normal
InterfaceInputUtilizationLow	InterfaceInputUtilizationNominal	Normal
InterfaceInputUtilizationHigh	InterfaceOutputUtilizationNominal	Normal
InterfaceOutpuUtilizationNone	InterfaceOutputUtilizationNominal	Normal
InterfaceOutputUtilizationLow	InterfaceOutputUtilizationNominal	Normal
InterfaceOutputUtilizationHigh	InterfaceOutputUtilizationNominal	Normal

This Interface Conclusion propagates to the following:

• Layer 2 Connection Form: Conclusions Tab
• Node Form: Conclusions Tab

Management Address ICMP Response Time Incidents

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Management Address ICMP Response Time incidents are available if your administrator configured performance measurement thresholds (Network Node Manager iSPI Performance for Metrics Software is not required for this threshold). For more information: See Also).

Management address Internet Control Message Protocol (ICMP) response time incidents enable you to identify high or abnormal ICMP response time from the NNMi management server to the selected node.

You receive response time incidents when the ICMP response time for the selected management address is not within the allowable range set by your administrator. Reasons for setting  ICMP response time rate thresholds include identifying changes in network performance from the management server to the selected node.

The State value returned for the node depends on whether the measured value is over the allowable range or outside of the configured baseline settings.

The following tables describe the possible results.

Management Address ICMP Response Time Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal	Abnormal ICMP response time from the management server to node <NodeName>. Incident Name: ManagementAddressICMPResponseTimeAbnormal	Indicates abnormal Internet Control Message Protocol (ICMP) response time from the management server to the target node. ICMP messages are typically used for diagnostic or routing purposes for determining whether a host or router could not be reached. The incident is generated when NNMi detects a higher than configured ICMP response time between the management server and the target node.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

Management Address ICMP Response Time Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High incidents.	Not applicable
High	High ICMP response time from the management server to node <NodeName>. The $cia.thresholdParameter transitioned from $cia.thresholdPreviousValue to $cia.thresholdCurrentValue due to a measured value of $cia.thresholdMeasuredValue, which is between the lower bound of $cia.thresholdLowerBound and the upper bound of $cia.thresholdUpperBound. The date and time of the measurement is $cia.thresholdMeasurementTime. Incident Name: ManagementAddressICMPResponseTimeHigh	Indicates high Internet Control Message Protocol (ICMP) response time from the management server to the target node. ICMP messages are typically used for diagnostic or routing purposes for determining whether a host or router could not be reached. The incident is generated when NNMi detects a higher than configured ICMP response time between the management server and the target node.	Warning

When management address ICMP response time threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the management address ICMP response time is within the allowable range, NNMi updates the following attributes:

• The SNMP Agent Status is changed to Normal.
• The SNMP Agent Conclusion is changed to one of the following:

Management Address ICMP Response Time Incident's Close Sequence

SNMP Agent Conclusion Initiating the Incident	SNMP Agent Conclusion Closing the Incident	SNMP Agent Status Changes To:
ManagementAddressICMPResponseTimeAbnormal	ManagementAddressICMPResponseTimeNormal	Normal
ManagementAddressICMPResponseTimeHigh	ManagementAddressICMPResponseTimeNominal	Normal

This SNMP Agent Conclusion propagates to the following:

• Node Form: Conclusions Tab

Memory Incidents (NNM iSPI Performance for Metrics)

Requires Network Node Manager iSPI Performance for Metrics Software (NNM iSPI Performance for Metrics). To populate performance data in the dashboard views or enhance NNM iSPI Performance for Metrics reports by sharing NNMi configuration settings, install the optional Network Performance Server (NPS).

Memory incidents are available if the Network Node Manager iSPI Performance for Metrics Software is installed and your administrator configured performance measurement thresholds. For more information: See Also

Memory incidents identify nodes that are over-used or under-used. You receive memory incidents when performance is not within the allowable range set by your administrator. The status of memory incidents depends on whether the measured value is over or under the allowable range.

The following tables describes the possible results.

Memory Baseline Incidents

Baseline State Value	Incident	Incident Description	Incident Severity
Abnormal Range	Memory on <NodeName> is abnormal. Incident Name: MemoryAbnormal	Node Sensor measured an abnormal value according to Baseline Limits set by your NNMi administrator. This occurs when any Memory related metric is abnormal.	Warning
Normal	No incident is generated	The measured value is within the allowable range. NNMi closes any related Abnormal Range incidents.	Normal

Memory Threshold Incidents

Threshold State Value	Incident	Incident Description	Incident Severity
Low	Memory on <NodeName> has insufficient capacity or is malfunctioning. Incident Name: MemoryOutOfRangeOrMalfunctioning	Node Sensor measured a value less than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group.	Minor
None
Nominal	No incident is generated, and current incident changes to Lifecycle State: Closed.	The measured value is within the allowable range. NNMi closes any related High, Low, or None incidents.	Not applicable
High	Memory on <NodeName> has insufficient capacity or is malfunctioning. Incident Name: MemoryOutOfRangeOrMalfunctioning	Node Sensor measured a value more than the allowable range according to the Threshold configured by your NNMi administrator and applied to members of a Node Group. This occurs when the memory pool is exhausted or cannot meet demand.	Critical

When memory Threshold State changes, NNMi updates to the information on the following Incident form tabs:

• Correlated Parents
• Correlated Children
• Custom Attributes

When NNMi determines that the Node Sensor is within the allowable range, NNMi updates the following attributes:

• The Node Sensor Status is changed to Normal.
• The Node Sensor Conclusion is changed to one of the following:

Memory Incident's Close Sequence

Node Sensor Conclusion Initiating the Incident	Node Sensor Conclusion Closing the Incident	Node Sensor Status Changes To:
MemoryAbnormal	MemoryDiskNormal	Normal
MemoryOutOfRangeOrMalfunctioning	MemoryInRangeAndFunctioning	Normal

This Node Sensor Conclusion propagates to the following:

• Node Form: Conclusions Tab