You are on page 1of 186

USER GUIDE

Using EYE Events
Eye of the Storm® Enterprise Edition
Version 2012

Entuity was founded to develop intelligent network management solutions. Eye of the Storm (EYE) delivers the best value in infrastructure and network management by integrating into a single solution Performance Management, Availability Management and Resource Management.

North America Headquarters
4 Mount Royal Avenue Suite 340 Marlborough, MA 01752 Tel: +1 508 357 6344 Fax: +1 508 357 6358

EMEA Headquarters
9a Devonshire Square London, EC2M 4YN Tel: +44 (0)20 7444 4800 Fax: +44 (0)20 7444 4808

www.entuity.com

0000-2012-PD006 eye_core_events.rev1.fm

Copyright © 2000 - 2012 Entuity. All rights reserved.

Entuity The Entuity product and its related documentation are protected by copyright and distributed under licenses restricting use, copying, distribution, and decompilation. Unless you have negotiated with Entuity specific terms and conditions for using its product and associated documentation, such use shall be governed by Entuity's standard licence terms, a copy of which is distributed with the product. Entuity may make improvements and/or changes to the product(s) and/or program(s) described in this publication at any time. These changes will be incorporated into new editions of the relevant publication.
Entuity® , Eye of the Storm® , InSight Center® , Green IT Perspective™, Network Delivery Perspective™ and Service Delivery Perspective™ are registered trademarks of Entuity. All other trademarks are the property of their respective owners.

License terms and conditions of use for Eye of the Storm (EYE) and included third party software can be found on the EYE server at entuity_home/licenseTerms/. A listing of these third party trademarks, references and software included with EYE is available through its web UI.

Entuity

Contents
1 EYE Events
AP Antenna Host Count High ...................................................................................1 AP Antenna Host Count High Cleared .....................................................................1 AP Antenna Host Count Low ....................................................................................1 AP Antenna Host Count Low Cleared ......................................................................2 AP Antenna Channel Change Frequency High ........................................................2 AP Antenna Channel Change Frequency High Cleared ..........................................2 AP Antenna Offline ....................................................................................................3 AP Antenna Online ....................................................................................................3 AP Antenna Power Change Frequency High ...........................................................3 AP Antenna Power Change Frequency High Cleared .............................................3 AP Associated With Controller ..................................................................................4 AP Host Count High ..................................................................................................4 AP Host Count High Cleared ....................................................................................4 AP Host Count Low ...................................................................................................5 AP Host Count Low Cleared .....................................................................................5 AP Not Associated With Controller ...........................................................................5 ATM VCC High Inbound Utilization ..........................................................................5 ATM VCC High Inbound Utilization Cleared .............................................................6 ATM VCC High Outbound Utilization ........................................................................6 ATM VCC High Outbound Utilization Cleared ..........................................................6 ATM VCC Link Down ................................................................................................7 ATM VCC Link Up ....................................................................................................7 ATM VCC Low Inbound Utilization ...........................................................................7 ATM VCC Low Inbound Utilization Cleared ..............................................................8 ATM VCC Low Outbound Utilization .........................................................................8 ATM VCC Low Outbound Utilization Cleared ...........................................................8 AvailMonitor Application Available ...........................................................................9 AvailMonitor Application Unavailable .......................................................................9 AvailMonitor Falling Average Latency ......................................................................9 AvailMonitor High Latency ........................................................................................9 AvailMonitor High Latency Reaching Application ..................................................10 AvailMonitor High Latency Reaching Application Cleared ....................................10

EYE Events Guide

iii

................................10 AvailMonitor Normal View Device Reachability ...................................................................................................................................................................14 Backplane Bus C High Utilization ........................16 BGP Peer Established .................................................16 BGP Peer Not Established ............................................................................................................................................................................22 EYE Events Guide iv .............25V Rail Low Voltage Cleared .................20 BladeCenter Blade +12V Rail High Voltage Cleared .....................16 BGP Peer Newly Discovered ......................................25V Rail Low Voltage ...................................5V Rail High Voltage .......20 BladeCenter Blade +12V Rail Low Voltage .................................................................................12 AWAP Host Count High Cleared ..........................................................................................................................................................13 Backplane Bus B High Utilization ...12 Backplane Bus A High Utilization ...............13 Backplane Bus A High Utilization Cleared ............17 BladeCenter Blade +1......14 Backplane System Bus High Utilization .................5V Rail Low Voltage Cleared ............................18 BladeCenter Blade +1.......5V Rail High Voltage Cleared ..................................................................................................................................................................21 BladeCenter Blade +2................................................................................................................18 BladeCenter Blade +1........................21 BladeCenter Blade +12V Rail Low Voltage Cleared .........................................16 BGP Peer Disappeared .....5V Rail High Voltage ................................13 Backplane Bus B High Utilization Cleared ........................................................................10 AvailMonitor Normal Latency .........................................................................................................................25V Rail High Voltage ...15 BGP Peer Briefly Not Established ....18 BladeCenter Blade +1..............................................Entuity AvailMonitor Low View Device Reachability .......17 BladeCenter Blade +1.........................................................21 BladeCenter Blade +2......................................................................................14 Backplane Bus C High Utilization Cleared ...................................................................25V Rail High Voltage Cleared ..........................................................................20 BladeCenter Blade +12V Rail High Voltage ........................................................................................................................11 AWAP Host Count High ................11 AvailMonitor Rising Average Latency ...........................................................................................19 BladeCenter Blade +1..5V Rail High Voltage Cleared .............................................15 Backplane System Bus High Utilization Cleared .....5V Rail Low Voltage ............................11 AvailMonitor Rising Trend in Average Latency .....................................12 AWAP Host Count Low ..............................12 AWAP Host Count Low Cleared ..........................................................15 BGP Peer Briefly Established ...........................................................................17 BladeCenter Blade +1..........................................................19 BladeCenter Blade +1................................

...................................22 BladeCenter Blade +3...............................32 BladeCenter Chassis +3.....30 BladeCenter Chassis +2......24 BladeCenter Blade +5V Rail High Voltage ........................................3V Rail High Voltage ............................................................33 BladeCenter Chassis +5V Rail High Voltage .................................5V Rail Low Voltage Cleared ..............................................................................................................23 BladeCenter Blade +3.....................................................30 BladeCenter Chassis +2............5V Rail High Voltage Cleared .....................................................................................................................29 BladeCenter Chassis +12V Rail Low Voltage Cleared ......................................................................25 BladeCenter Blade +5V Rail Low Voltage Cleared ......................26 BladeCenter Blade Powered On .............................................................29 BladeCenter Chassis +12V Rail Low Voltage ..........................25 BladeCenter Blade Powered Off ................................8V Rail High Voltage Cleared ..29 BladeCenter Chassis +12V Rail High Voltage Cleared .........5V Rail High Voltage ................8V Rail Low Voltage ..3V Rail High Voltage Cleared ...............5V Rail Low Voltage .............................................26 BladeCenter Blower Ok ...............................................................................................32 BladeCenter Chassis +3..........................28 BladeCenter Chassis +1..............34 BladeCenter Chassis -5V Rail High Voltage ....................3V Rail Low Voltage Cleared ..............23 BladeCenter Blade +3...........................23 BladeCenter Blade +3.....................................................................................................................................5V Rail Low Voltage ...........................................................35 EYE Events Guide v .................26 BladeCenter Blower Failed ..................................................................................27 BladeCenter Chassis +1.............3V Rail High Voltage Cleared ....3V Rail Low Voltage .....25 BladeCenter Blade +5V Rail Low Voltage .....22 BladeCenter Blade +2..31 BladeCenter Chassis +2.........................33 BladeCenter Chassis +5V Rail Low Voltage ..........................................3V Rail High Voltage ........................3V Rail Low Voltage Cleared ................31 BladeCenter Chassis +3.............31 BladeCenter Chassis +3.................................................34 BladeCenter Chassis -5V Rail High Voltage Cleared ...................................34 BladeCenter Chassis +5V Rail Low Voltage Cleared ............................................................Entuity BladeCenter Blade +2...............................................................24 BladeCenter Blade +5V Rail High Voltage Cleared ...............33 BladeCenter Chassis +5V Rail High Voltage Cleared ....................................27 BladeCenter Chassis +1.....28 BladeCenter Chassis +1............................26 BladeCenter Blower Slow ..........................................................................3V Rail Low Voltage ..........................................................................................30 BladeCenter Chassis +2..............5V Rail Low Voltage Cleared .....................8V Rail Low Voltage Cleared .....................................................28 BladeCenter Chassis +12V Rail High Voltage ..8V Rail High Voltage ............................................

......................................38 BladeCenter Front Panel High Temperature Cleared ................40 Chassis Major Alarm .45 CPU High Utilization Cleared .........................................................37 BladeCenter DASD1 High Temperature ............................................................................................................46 CUCM CPU High Utilization Cleared ............................................................................................................37 BladeCenter Front Panel High Temperature ....................................................................................................................................................................................................................................................................................................36 BladeCenter CPU2 High Temperature Cleared .................................................................43 CM Running Configuration Changed ......................43 CM Previously Unsaved Configuration Saved ........................................41 Chassis Temperature Critical Alarm .41 Chassis Minor Alarm Cleared ...................................................................................................................................................................41 Chassis Temperature Alarm Cleared ...................................................................................................................................................................................................................46 CUCM CPU High Utilization ....................................................................36 BladeCenter CPU1 High Temperature Cleared .41 Chassis Temperature Alarm .................................................................................................................................47 EYE Events Guide vi ................................................40 Chassis Fan Status Unknown .................................................45 CPU High Utilization .........Entuity BladeCenter Chassis -5V Rail Low Voltage .....................39 Chassis Fan OK ...................................42 CM Configuration Missing Policy Mandated Statement ................................................................................................................................................42 CM Firmware Version Changed .......................................................40 Chassis Major Alarm Cleared ..........39 Chassis Fan Major Fault ....................................................................................................38 BladeCenter Management Module High Temperature .45 CM Unsaved Configuration .......................................................................................................40 Chassis Minor Alarm ..............43 CM Running Configuration Retrieval Failed .46 CUCM CTI Device Not Registered .............................................37 BladeCenter DASD1 High Temperature Cleared ....................................................................................................36 BladeCenter CPU2 High Temperature .........................................................................................44 CM Startup Configuration Retrieval Failed ...................................................................................................................................................................................................................................................44 CM Startup Configuration Changed .......................................38 BladeCenter Management Module High Temperature Cleared .............................42 CM Configuration Includes Policy Exclusion ...........................................39 Chassis Fan Minor Fault ...................35 BladeCenter CPU1 High Temperature .....................35 BladeCenter Chassis -5V Rail Low Voltage Cleared ...........

........................................................................................................................................49 CUCM H........59 Enterprise Trap ..................................................................................................................................................................................................................................................................................................................................50 CUCM Phone Not Registered ..............................................................................................................................................................................51 CUCM Process Memory High Utilization Cleared ..............................52 CUCM Voicemail Device Registered ........................323 Device Registered ..................................................................................................................................................................................................................................................................................................................................58 EIGRP Peer Briefly Not Established ...........................................57 EGP Neighbor Loss ....................................................................................................................................................................................................................................................................................56 Device Name Resolution Failure Cleared ...............47 CUCM Gatekeeper Not Registered ...............56 Device Port(s) Utilization Accuracy Lost ......................................48 CUCM Gateway Registered ..............................48 CUCM Gatekeeper Registered ..............53 Device Clock Inconsistency ................................323 Device Not Registered ....................................................................................................50 CUCM Phone Registered ...............................................Entuity CUCM CTI Device Registered ................................................51 CUCM Process Memory High Utilization ...........................55 Device Name Resolution Failure ..............57 Device Warm Reboot .....................56 Device Port(s) Utilization Accuracy at Risk .....................................................................54 Device High Temperature ...........................53 Device Cold Reboot .....57 Device Reboot Detected .....................................................................................................................................54 Device High Temperature Cleared ..................................59 EYE Events Guide vii ...............................49 CUCM H...........58 EIGRP Peer Disappeared ...............................48 CUCM Gateway Not Registered ..................................................55 Device Low Total Memory Cleared .............53 Device Fan Failure Cleared .........52 CUCM Voicemail Device Not Registered ..................................................................................58 EIGRP Peer Newly Discovered ........................................49 CUCM Media Device Registered ...............................................................................................................................................................................56 Device Port(s) Utilization Missed Due to Slow Response ................................49 CUCM Media Device Not Registered ..........................................................................................................................................................................................................................54 Device Low Disk Space ..................................54 Device Low Disk Space Cleared ....................................................55 Device Low Total Memory ...............53 Device Fan Failed ..........................................................................

.......68 Firewall URL Alerts High ...................................................................................................................................................................................66 Firewall Overflow and Intrusion Violations High .....................................................................67 Firewall Packet Rate High ....................70 FR DLCI High FECN ......................................................65 Firewall High Avail User Set Oper State Non Compliant ..............................60 EYE License Successfully Updated by License Server .........................................................................................................69 FR DLCI High BECN Cleared ..............................61 EYE Server Automated Shutdown .......................................................67 Firewall Peak Connections High ............62 EYE Server Explicit Shutdown Initiated ..61 EYE Server Component Restarting After Failure .....................................................................................................................71 EYE Events Guide viii .....................................................71 FR DLCI High Inbound Utilization Cleared ..............................................................60 EYE License on Remote Server Successfully Updated .............................60 EYE License on Remote Server Expired and No Longer Operational ...............................................................................................................................64 Firewall Access Control Violations High ........62 EYE Server Critical Component Restarting After Failure .................................64 EYE Server Started ..........................61 EYE License Was Not Updated by License Server and Will Expire .................64 Firewall Access Control Violations High Cleared ..............63 EYE Server Permanent Component Failure ..................................................................................................................................................................................................................................................70 FR DLCI High DE Cleared ....................................70 FR DLCI High Inbound Utilization ................................................Entuity EYE License Expired and This EYE Server is No Longer Operational ............................................................................................................................................................................................................................................................65 Firewall High Avail User Set Oper State Compliant ....................................................................................................................................................................................................68 Firewall URL Alerts High Cleared .................68 Firewall Peak Connections High Cleared .................................................62 EYE Server Disk Space Alert ..64 EYE Server Shutdown Forced By Critical Failure To Restart .......................................................................................71 FR DLCI High Outbound Utilization .......69 FR DLCI High BECN .................70 FR DLCI High FECN Cleared .....................63 EYE Server Internal Event ...........................................................................................................63 EYE Server License Alert ..........67 Firewall Packet Rate High Cleared ........................................59 EYE License on Remote Server Could Not be Updated ...............................................................................................................................................................69 FR DLCI High DE ......................66 Firewall Overflow and Intrusion Violations High Cleared ....

.................78 Load Balancer High Client Hw Accel Connections Cleared ......................................................................................................................................................81 Load Balancer High Non Syn Denied Pkt Rate Cleared ......................................................................................................73 IP SLA High ICPIF Cleared ..........................................................................................................................................73 IP SLA High ICPIF ......................................................................79 Load Balancer High License Denied Pkt Rate .................74 IP SLA Test High Latency ...74 IP SLA Low MOS ......................................................................72 FR DLCI Link UP ......................................................79 Load Balancer High Inbound Error Rate Cleared ..........................77 Load Balancer High Client Connections Cleared ......................................................................................................................................................................................................................77 LAP Antenna Host Count Low ....................................................................................................................73 IP SLA Creation Failure Cleared .........................77 Load Balancer High Client Connections .......................79 Load Balancer High Inbound Error Rate ..............................................................................................................................................................................................................71 FR DLCI Link Down ............................................................................................................................................................................................................................................75 IP SLA Test Succeeded ...........74 IP SLA Low MOS Cleared ........................76 KPI Port Duplex Suspected Mismatch (FCS) Cleared ........................................78 Load Balancer High Client Connection Limit Pkt Drop Rate .....................78 Load Balancer High Client Hw Accel Connections ..................................81 EYE Events Guide ix ...........Entuity FR DLCI High Outbound Utilization Cleared .............................................81 Load Balancer High No Handler Denied Pkt Rate Cleared ..79 Load Balancer High License Denied Pkt Rate Cleared .......................................................................................................77 LAP Antenna Host Count Low Cleared ...................................................................80 Load Balancer High No Handler Denied Pkt Rate .............75 IP SLA Test High Latency Cleared ....................................................................................................................80 Load Balancer High Memory Error Pkt Rate ........................80 Load Balancer High Memory Error Pkt Rate Cleared ....72 HSRP Port Group Activated .................72 HSRP Port Group Deactivated .................74 IP SLA Test Failed .............................................................................................72 IP SLA Creation Failure ..........................................................................76 LAP Antenna Host Count High Cleared .....................................................75 KPI Port Duplex Suspected Mismatch (FCS) ................................................................................................................................................76 LAP Antenna Host Count High ..................................81 Load Balancer High Non Syn Denied Pkt Rate ......................78 Load Balancer High Client Connection Limit Pkt Drop Rate Cleared ....

.........................................................................................................................82 Load Balancer High Packet Drop Rate Cleared ...........................................................86 Load Balancer Nortel High Real Server Max Sessions .............86 Load Balancer Nortel High SLB SP Current Sessions ..........................................................................................................................82 Load Balancer High Outbound Error Rate Cleared ..91 MAC Address Port Change ........................................................................................................83 Load Balancer High Server Hw Accel Connections Cleared ..90 MAC Address High Port Count Cleared ......................................................................................................................................90 MAC Address High Port Count .......................85 Load Balancer Nortel High Real Server Current Sessions ........................82 Load Balancer High Packet Drop Rate ............................93 EYE Events Guide x ..........................87 Load Balancer Pool Critical Member Availability Cleared ..........88 Load Balancer Virtual Server High Connection Request Rate ....83 Load Balancer High Server Hw Accel Connections .................87 Load Balancer Pool Critical Member Availability .84 Load Balancer Nortel High MP CPU 1sec Utilization ............................................................84 Load Balancer Nortel High MP CPU 4sec Utilization Cleared .....................86 Load Balancer Nortel High Real Server Max Sessions Cleared ...................88 Load Balancer Pool Low Member Availability Cleared ..........82 Load Balancer High Server Connections ............84 Load Balancer Nortel High MP CPU 1sec Utilization Cleared ..85 Load Balancer Nortel High MP CPU 64sec Utilization Cleared ...92 Missing Events ......................90 Load Balancer Virtual Server High Hw Accel Connections Cleared ...................................................89 Load Balancer Virtual Server High Ephemeral Connections ...........................89 Load Balancer Virtual Server High Hw Accel Connections ........87 Load Balancer Pool Low Member Availability ....................................Entuity Load Balancer High Outbound Error Rate ....................................................................................................................................84 Load Balancer Nortel High MP CPU 4sec Utilization ...................................................................................89 Load Balancer Virtual Server High Connection Request Rate Cleared ......................88 Load Balancer Virtual Server High Average Connection Duration Cleared ..............................................................................................83 Load Balancer High Server Connections Cleared .............91 MAC Address New .......................................................................................................................................................................................87 Load Balancer Nortel High SLB SP Current Sessions Cleared ..88 Load Balancer Virtual Server High Average Connection Duration ..........................................85 Load Balancer Nortel High MP CPU 64sec Utilization ............................................................85 Load Balancer Nortel High Real Server Current Sessions Cleared ................................................89 Load Balancer Virtual Server High Ephemeral Connections Cleared ..................

.....................................................................93 Module Down ...........................100 MPLS LSR Interface High Error Free Discard Rate (RX) ............................................................102 MPLS LSR Interface Low Buffer Space .........101 MPLS LSR Interface High Error Free Discard Rate (TX) Cleared .................................................................................................................................................................................................................................................................94 Module Minor Fault ................................................................................................98 MPLS LDP Peer Operational .............................................................................................................................................................................................98 MPLS LDP Peer Non-operational ..............98 MPLS LDP Peer Disappeared ......................................97 MPLS LDP Entity Shutdown Notifications Received Cleared .......................................................................................95 MPLS LDP Entity Operational .......................................................................................94 Module OK .............................................................................................................95 MPLS LDP Entity Non-operational .......................................................................93 Module Discovered .......................................................................................................................99 MPLS LDP Peer Unknown Message Types .............Entuity Module Disappeared ..............................102 MPLS LSR Interface Low Bandwidth ........................102 MPLS LSR Interface Low Bandwidth Cleared .................103 MPLS LSR Interface Low Buffer Space Cleared ........................................99 MPLS LDP Peer TLV Errors ..................................................................................97 MPLS LDP Entity Shutdown Notifications Sent Cleared ..............................................................102 MPLS LSR Interface High Fragmentation Rate Cleared ...........................................99 MPLS LDP Peer TLV Errors Cleared ..............................................................................................................................94 Module Status Unknown ............96 MPLS LDP Entity Rejected Sessions ............................................................................................97 MPLS LDP Entity Shutdown Notifications Sent .....................................................................100 MPLS LSR Interface High Discard Rate (Lookup Failure) Cleared ...............103 EYE Events Guide xi ..........100 MPLS LSR Interface High Discard Rate (Lookup Failure) .......95 MPLS LDP Entity Errors Cleared ...................................100 MPLS LDP Peer Unknown Message Types Cleared ....96 MPLS LDP Entity Shutdown Notifications Received ...........................................................101 MPLS LSR Interface High Error Free Discard Rate (RX) Cleared .....................................................................................................96 MPLS LDP Entity Rejected Sessions Cleared .......................................98 MPLS LDP Peer Newly Discovered ......................................................................101 MPLS LSR Interface High Error Free Discard Rate (TX) .........................................................................93 Module Major Fault ................................101 MPLS LSR Interface High Fragmentation Rate ..........................................................................................94 MPLS LDP Entity Errors ......

...........115 Port Inbound Discards High (Device Congestion) ..........106 MPLS VRF Non-operational ......................111 Port High Inbound Discards (Dynamic) Cleared ...............................................................................................................................................114 Port High Outbound Utilization (Dynamic) Cleared ................105 MPLS VRF High Illegal Label Rate ........................................................107 Network Outage Cleared ...................................................................111 Port High Inbound Discards (Dynamic) .........................................................................................107 Network Outage ..................................103 MPLS LSR Platform High Discard Rate (Lookup Failure) Cleared ..........109 OSPF Peer Newly Discovered ....................................................................................................................................................................................110 Port Error Disable Alarm Cleared .......................113 Port High Outbound Fault (Dynamic) ..................105 MPLS LSR Platform High Fragmentation Rate Cleared ...........................................................................................................115 EYE Events Guide xii ................110 OSPF Peer Not Established ...............................................................................................110 Port Error Disable Alarm ..............................106 MPLS VRF Interface BGP Neighbor Disappeared ...............................112 Port High Inbound Fault (Dynamic) Cleared .................................................Entuity MPLS LSR Platform High Discard Rate (Lookup Failure) ..........................................................................................................................................................................................................104 MPLS LSR Platform High Error Free Discard Rate (TX) ............................104 MPLS LSR Platform High Error Free Discard Rate (TX) Cleared .....................................................109 OSPF Peer Established ..............................114 Port High Outbound Fault (Dynamic) Cleared ....................................................................................................................................................................111 Port High Inbound Fault (Dynamic) ............................................................112 Port High Inbound Utilization (Dynamic) Cleared .......113 Port High Outbound Discards (Dynamic) Cleared ..........................113 Port High Outbound Discards (Dynamic) ...............................................................................................107 MPLS VRF Operational ..............104 MPLS LSR Platform High Error Free Discard Rate (RX) Cleared ........................................................105 MPLS VRF High Illegal Label Rate Cleared ................................................................................................................105 MPLS LSR Platform High Fragmentation Rate ........114 Port High Outbound Utilization (Dynamic) .............................................................................109 OSPF Peer Disappeared .......................................................................................................................108 OSPF Peer Briefly Not Established .106 MPLS VRF Interface BGP Neighbor Newly Discovered .......112 Port High Inbound Utilization (Dynamic) .............104 MPLS LSR Platform High Error Free Discard Rate (RX) ...........................110 Port Duplex Change ..................................................................................................................................

......................115 Port Inbound Fault High (Packet Corruption) ..................122 Port Utilization Low Cleared ........................................................................122 Port Utilization Low .......................................................125 QoS Class Drop Bit Rate High Cleared ....................................124 QoS Class Bit Rate High ................................................................................................................................................................................................................................................121 Port Utilization High Cleared .........................................................................Entuity Port Inbound Discards High Cleared (No Device Congestion) .............................................................116 Port Inbound Fault High (No Packet Corruption) Cleared ..................................................................................................120 Port Utilization Decreased ...127 EYE Events Guide xiii ..126 QoS Queue Drop Bit Rate High Cleared .................................................118 Port Operationally Down Cleared ........................116 Port Link Down ...............................................................................................120 Port Speed Change ............................................................................125 QoS Class Drop Packet Rate (Buffer Shortage) High ......................................................................................................................................................................................................................................117 Port Low Inbound Utilization (Dynamic) ......................................................126 QoS Queue Drop Bit Rate High .......................................................119 Port Outbound Fault High (Transmit Errors) ..............................................................................................................................................126 QoS Class Drop Packet Rate (Buffer Shortage) High Cleared .121 Port Utilization Increased ..................................................................119 Port Outbound Discards High (No Port Congestion) Cleared .....................................................................................118 Port Operationally Down ........................................................................................................123 Power Supply Unknown State ..................................................................122 Power Supply Minor Fault ..............117 Port Low Inbound Utilization (Dynamic) Cleared ...............................................................................124 QoS At Bandwidth Limit ...........................................125 QoS Class Drop Bit Rate High ...........................................................................................118 Port Low Outbound Utilization (Dynamic) Cleared ....................120 Port Outbound Fault High Cleared (No Transmit Errors) ........................................................................................................................................................................................................123 QoS Above Bandwidth Limit .....................................................................................................................................................................122 Power Supply Major Fault .119 Port Outbound Discards High (Port Congestion) ....................................................................................................................................................................................117 Port Low Outbound Utilization (Dynamic) ....116 Port Link Up ..124 QoS Class Bit Rate High Cleared ......................127 QoS Under Bandwidth Limit ......................123 Power Supply OK ......121 Port Utilization High .................

.....................................................................................................................132 SLB SP 1 Second CPU Utilization High ........................................................................................................................136 SSL Proxy Service Operational Available to SNMP Poll ....................130 Routing Low Processor Contiguous Memory Cleared .......................................................................................................................................128 Routing High No Routes to IP Destination Cleared ................137 STP New Root Device ...........135 SNMP Agent Restart Detected .......................................................................................................................................................................................................129 Routing Low I/O Contiguous Memory Cleared ...........128 Routing High No Routes to IP Destination .......................................................................................................................129 Routing ICMP High TTL Exceeds Cleared ...133 SLB SP 4 Second CPU Utilization Cleared ......132 SLB SP 1 Second CPU Utilization Cleared .............................................135 SNMP Authentication Failure ........................................................................................133 SLB SP 4 Second CPU Utilization High ..................................131 Service Down ..........................................127 Routing Broadcast Traffic High Cleared .................................................................133 SLB SP 64 Second CPU Utilization Cleared ..129 Routing Low I/O Contiguous Memory ...........................................................................................................................................................136 SSL Proxy Service Operational Unavailable to SNMP Poll ...............................................136 SSL Proxy Service Administrative Unavailable to SNMP Poll ............................................................................128 Routing ICMP High Redirects Cleared ........................................................................137 STP VLAN Topology Change ......................................................................................................................................130 Routing Low I/O Total Memory Cleared .....................................129 Routing ICMP High TTL Exceeds .........135 SSL Certificate Expired ..........132 Service Up ............................................................................................................................................................................................................................................................................................................................................130 Routing Low I/O Total Memory .....Entuity Routing Broadcast Traffic High ..................................135 SSL Certificate Expiring ................................................136 SSL Proxy Service Administrative Available to SNMP Poll ........133 SLB SP 64 Second CPU Utilization High ..............................131 Routing Low Processor Total Memory ...................................................130 Routing Low Processor Contiguous Memory .................................137 EYE Events Guide xiv ........132 Service State Unknown .....................................................128 Routing ICMP High Redirects ............134 SNMP Agent Not Responding ............................................................134 SNMP Agent Responding ............................131 Routing Low Processor Total Memory Cleared ...................................................................................................................................................................................

...............................................148 WAN Port Low Outbound Utilization ...................................................................145 WAN Port High Inbound Utilization Cleared ........................................................................................................139 Syslog Emergency Event ...............................................................................................................................................144 WAN Port High Inbound Discards ....................................................145 WAN Port High Inbound Errors Cleared ....................................149 Event Groups.....................143 VPN Network Port Utilization High .........................................................................140 Syslog Notice Events .......................................................................................................................................................................................................................................................................................................................................................................................144 WAN Port High Inbound Errors ...................................................................................147 WAN Port High Outbound Utilization .................................................................141 Syslog Warning Events ..................................................138 Syslog Critical Events .......................................................................145 WAN Port High Inbound Utilization ................................................................................. A-1 Listing of EYE Events .............142 VPN Load Average High Cleared ..........................................148 WAN Port Low Inbound Utilization Cleared .................................................................................................................................................................................................................. A-16 EYE Events Guide xv ...................................................142 VPN Load Average High ...............................140 Syslog Information Events ...................143 VPN Network Port Utilization High Cleared ........... IDs and Severity EYE Event Groups .....................................144 WAN Port High Inbound Discards Cleared ........................................................................................................142 Virtualization Connection Success .148 WAN Port Low Inbound Utilization ..............................138 Syslog Debug Events .......................................................................146 WAN Port High Outbound Discards Cleared ....................................................146 WAN Port High Outbound Errors .................................147 WAN Port High Outbound Errors Cleared ................................................................................................................................................................................................................................ A-2 Custom Poller Event Identifiers ........................................................................................................................141 Virtualization Connection Failed ........................................................................................................... A-1 EYE Event Severity .................143 VPN Tunnel Usage High .........................................148 WAN Port Low Outbound Utilization Cleared ........................................147 WAN Port High Outbound Utilization Cleared ........................Entuity Syslog Alert Event ......................143 VPN Tunnel Usage High Cleared ..........................................................139 Syslog Error Events ..............146 WAN Port High Outbound Discards ................................................................

When the historic record indicates a rising usage trend you may want to extend the capabilities of your wireless network. Actions Through Component Viewer you can check the Interface Host Count tab. AP Antenna Host Count High For each AWAP antenna you can set the number of hosts that when attached to an antenna would impact performance. AP Antenna Host Count High Cleared Raised when the number of hosts attached to the AWAP antenna has returned to an acceptable level. reviewing the hourly and daily mean and maximum attached host values. AP Antenna Host Count Low The number of hosts attached to the antenna has fallen below the set threshold. Typical Causes Changes in wireless usage have occurred since the network was designed. Actions No action required. and disabled. Default severity level: minor. Typical Causes The managed object’s performance is now within the set thresholds. color code: green. This information is also available through the online help. color code: yellow.1 EYE Events Events are shown in Event Viewer. color code: yellow. reviewing the hourly and daily mean and maximum attached host values. Typical Causes Changes in wireless usage have occurred since the network was designed. When the historic record EYE Events Guide 1-1 . AWAP and antenna level. Actions Through Component Viewer you can check the AWAP Host Count tab. This section contains event descriptions. Default severity level: minor. You can set the threshold hierarchy at the global. By default the threshold is set to 0. causes and possible actions to take. AWAP and antenna levels. Default severity level: information. You can set this at the global.

Default severity level: minor. AP Antenna Host Count Low Cleared The number of hosts attached to the AWAP antenna has returned to an acceptable level.11b or 802. for example reviewing the antenna’s current physical channel number and its history. Actions No action required.Entuity AP Antenna Host Count Low Cleared indicates a falling usage trend you may want to adjust the capabilities of your wireless network. Default severity level: information. Typical Causes A high frequency of channel change indicates a transmission problem. Typical Causes Automatic configuration change volatility that indicated a trouble spot location has been resolved. AP Antenna Channel Change Frequency High Automatic configuration change volatility indicates a trouble spot location. Practically any appliance that operates on the same frequency level (2.4 GHz) as 802. Typical Causes The managed object’s performance is now within the set thresholds. Actions There are a number of factors that can cause the signal of your access point to deteriorate and the performance of your network to fall under par. color code: yellow. Default severity level: information. other electrical equipment at least one metre away from the access point. EYE Events Guide 1-2 . causing it to switch to another channel. color code: green. Through Component Viewer you can check the WAP’s Status. AP Antenna Channel Change Frequency High Cleared The clearing correlation event for WAP’s AP Antenna Channel Change Frequency High event. Be sure to keep cordless phones. color code: green.11g can cause interference with your wireless network. Actions No action required. A change in the antenna’s local environment impacts its effectiveness on the current channel.

By default the frequency is set to three and enabled. frequent changes may indicate an unstable local environment. Typical Causes A problem has occurred on the antenna. Actions No action required. Default severity level: minor. Typical Causes The number of hosts attached to the antenna has returned to an acceptable level. color code: green. Typical Causes Automatic configuration is set to too an interval. AP Antenna Power Change Frequency High Cleared The clearing correlation event for WAP Antenna Power Change Frequency High event. AP Antenna Power Change Frequency High WAP antenna power changes more frequently than the set threshold during the polling interval. Actions Investigate the history of the antenna’s performance.Entuity AP Antenna Offline AP Antenna Offline A WAP that was administratively up and operationally up EYE has observed to transition into the administratively up and operationally down state. Typical Causes A WAP that was administratively up and operationally down EYE has observed to transition into the administratively up and operationally up state. color code: yellow. EYE Events Guide 1-3 . AP Antenna Online The clearing correlation event for WAP’s AP Antenna Offline event. Default severity level: minor. Default severity level: information. Default severity level: information. color code: green. color code: yellow. Actions Review the WAP antenna power change history.

When the historic record indicates a rising usage trend you may want to extend the capabilities of your wireless network. Actions Investigate the status of the wireless controller. Actions No action required. color code: green. Typical Causes The wireless controller has gone down and been automatically. Typical Causes Changes in wireless usage have occurred since the network was designed. Default severity level: minor. wireless controller and WAP levels and will be disabled but set to 0 by default. Default severity level: information. The threshold hierarchy will cover the global. EYE Events Guide 1-4 . color code: yellow. Actions Through Component Viewer you can check the WAP’s Interface Host Count tab. Default severity level: minor. AP Host Count High The combined count of hosts that are wirelessly associated with all the antennas on a WAP has dropped below a selectable threshold. AP Host Count High Cleared The clearing correlation event for WAP Host Count High event. Typical Causes The sum number of hosts attached to the WAP’s antennas has returned to an acceptable level. reviewing the hourly and daily mean and maximum attached host values. the WAP has been manually reassigned. AP Associated With Controller Indicates the WAP has transitioned to another wireless controller.Entuity AP Associated With Controller Actions No action required. color code: yellow.

 Source identifies the router. Typical Causes Changes in wireless usage have occurred since the network was designed. Default severity level: major. Actions Through Component Viewer you can check the Interface Host Count tab. color code: amber. When the historic record indicates a falling usage trend you may want to adjust the capabilities of your wireless network. port and AAL5 VPI/VCI. AP Host Count Low Cleared The clearing correlation event for WAP Host Count Low event. Typical Causes The wireless controller has gone down and been automatically. EYE Events Guide 1-5 . Actions Investigate the status of the wireless controller. color code: yellow. ATM VCC High Inbound Utilization Indicates the Virtual Channel’s inbound utilization has crossed its high threshold level. the WAP has been manually reassigned. AP Not Associated With Controller Indicates the WAP has transitioned to another wireless controller. Typical Causes The sum number of hosts attached to the WAP’s antennas has returned to an acceptable level.Entuity AP Host Count Low AP Host Count Low The sum number of hosts attached to the WAP’s antennas has fallen below the set threshold. Actions No action required. Default severity level: information.  Impacted identifies the impacted peer router. color code: green. Default severity level: minor. color code: yellow. Default severity level: minor. port (ifDescr) and AAL5 VPI/VCI. reviewing the hourly and daily mean and maximum attached host values. When the impacted routers are not identified then Entuity displays peer not known.

Actions Generate ATM utilization reports to monitor the situation. utilization values. EYE Events Guide 1-6 . Typical Causes Virtual Channel’s utilization is higher than the high utilization threshold for the port due to increased traffic. Default severity level: information. Actions Generate ATM utilization reports to monitor the situation. where:  Source identifies the router. and threshold. and threshold. Default severity level: information. port and AAL5 VPI/VCI.Entuity ATM VCC High Inbound Utilization Cleared  Details displays the channel’s both actual.  Impacted identifies the impacted peer router. utilization values.  Details displays the channel’s both actual. Typical Causes Reduced usage. Actions None. When the impacted routers are not identified then Entuity displays peer not known. ATM VCC High Inbound Utilization Cleared Indicates a previous High ATM Inbound Utilization event for the Virtual Channel has been cleared. port (ifDescr) and AAL5 VPI/VCI. color code: amber. ATM VCC High Outbound Utilization Cleared Indicates a previous High ATM Outbound Utilization event for the Virtual Channel has been cleared. color code: green. color code: green. Typical Causes Virtual Channel’s utilization is higher than the high utilization threshold for the port due to increased traffic. Default severity level: major. ATM VCC High Outbound Utilization Indicates the Virtual Channel’s outbound utilization has crossed its high threshold level.

Typical Causes Route changes. Actions Check the ATM connection first by pinging the port. ATM VCC Low Inbound Utilization Indicates the Virtual Channel’s inbound utilization has crossed its low threshold level. color code: orange.  Impacted identifies the impacted peer router. utilization values. WAN link CSU/DSU equipment re-establishing carrier detection. color code: green. where:  Source identifies the router. ATM VCC Link Up Indicates that an ATM VCC has transitioned to the up state.  Details displays the channel’s both actual. re-booting the PC or server attached to a switch port. and threshold. color code: amber.Entuity ATM VCC Link Down Typical Causes Reduced usage. Typical Causes The virtual channel is not functional because either the PVC is disabled or a port (on this switch) used by the PVC is down. outages upstream of the link. Typical Causes Connecting a PC or server to a switch port. Default severity level: severe. port (ifDescr) and AAL5 VPI/VCI. When the impacted routers are not identified then Entuity displays peer not known. Actions None. EYE Events Guide 1-7 . Actions None. server problems. port and AAL5 VPI/VCI. Default severity level: major. ATM VCC Link Down Indicates that an ATM virtual channel has transitioned to the down state. If the port responds contact your ATM service provider. Default severity level: information.

ATM VCC Low Outbound Utilization Cleared Indicates a previous ATM VCC Low Outbound Utilization alarm has been cleared. Actions This problem may be symptomatic of an issue elsewhere in the network. color code: green.  Impacted identifies the impacted peer router.  Details displays the channel’s both actual. Typical Causes Route changes. color code: green.  Source identifies the router. color code: amber. Check through other events that have recently been reported if excessively low levels of utilization persist. ATM VCC Low Inbound Utilization Cleared Indicates a previous ATM VCC Low Inbound Utilization alarm has been cleared. and low threshold.Entuity ATM VCC Low Inbound Utilization Cleared Actions This problem may be symptomatic of an issue elsewhere in the network. port (ifDescr) and AAL5 VPI/VCI. ATM VCC Low Outbound Utilization Indicates the Virtual Channel’s outbound utilization has crossed its low threshold level. Default severity level: information. Check through other events that have recently been reported if excessively low levels of utilization persist. server problems. Typical Causes Indicates previously low outbound utilization for the ATM VCC is now within the set thresholds. port and AAL5 VPI/VCI. EYE Events Guide 1-8 . Generate ATM utilization reports to monitor the situation. Generate ATM utilization reports to monitor the situation. Typical Causes Indicates previously low inbound utilization for the ATM VCC is now within the set thresholds. outbound utilization values. Actions None. Actions None. Default severity level: major. Default severity level: information. outages upstream of the link. When the impacted routers are not identified then Entuity displays peer not known.

e. Default severity level: minor. color code: yellow. Default severity level: severe. then the most recent setting is used in the comparison. Actions Check the server for the application. Typical Causes Application is now available. EYE Events Guide 1-9 . This threshold is in milliseconds. application bug or shutdown. Actions None. Application Unavailable. If the threshold has been changed during the preceding hour. Actions Investigate network resources. Typical Causes Decrease in network traffic. color code: orange. Typical Causes Problem with server resources causing the application to crash. Typical Causes Increase in network traffic. AvailMonitor Application Unavailable Indicates a monitored application did not respond to the Application Monitor. color code: orange.Entuity AvailMonitor Application Available AvailMonitor Application Available Indicates a previous alarm has been cleared. AvailMonitor Falling Average Latency Indicates the average real-time latency value for the hour falls short of the previous hourly value by the set percentage. Default severity level: information. color code: green. Default severity level: severe. AvailMonitor High Latency Indicates the average real-time latency value for the hour exceeds the set threshold.g.

and a historical graph of port utilization reveals that. Default severity level: severe. Typical Causes High utilization of the area of the network where the devices within the view are.Entuity AvailMonitor High Latency Reaching Application Actions Investigate network resources. AvailMonitor High Latency Reaching Application Cleared Indicates that an application that was responding slowly is now responding normally. Actions None. Actions Investigate the devices within the view. AvailMonitor Normal Latency Indicates the average real-time latency value for the hour is within the set threshold. If the device reporting the event is a router. AvailMonitor Low View Device Reachability EYE raises this event when the cumulative reachability of all components within the view is less than or equal to the user defined threshold. using ICMP Ping. the application is slow to respond. Typical Causes Reduced traffic. If this is high. Typical Causes Insufficient application resource or network congestion. then more bandwidth may be needed. Default severity level: severe. If the threshold has been changed during the preceding hour. the link is highly utilized. i. Default severity level: information. then the most recent setting is used in the comparison. AvailMonitor High Latency Reaching Application Indicates the Application latency threshold is passed.e. This threshold is in milliseconds. color code: green. Actions Use the Ticker tool in Component Viewer to check the current application port utilization. in general. color code: orange. then Telnet to the router to ascertain possible causes for the outage. color code: orange. EYE Events Guide 1-10 .

color code: green.Entuity AvailMonitor Normal View Device Reachability Default severity level: information. color code: orange. Typical Causes Increase in network traffic. Typical Causes Increase in network traffic. Actions Investigate network resources. EYE Events Guide 1-11 . color code: green. AvailMonitor Rising Trend in Average Latency Indicates the average real-time latency value for the previous hour exceeds the trend for the same hour of the week by the set percentage. color code: orange. Actions Investigate network resources. Typical Causes Correlated event to AvailMonitor High Latency. Default severity level: information. network latency has returned to within set boundaries. Default severity level: severe. AvailMonitor Normal View Device Reachability Indicates device reachability within the view has returned to acceptable levels. Actions None. Typical Causes Device reachability within the view has transitioned to be within the set threshold Actions None. AvailMonitor Rising Average Latency Indicates the average real-time latency value for the previous hour exceeds the trend for the same hour of the week by the set percentage. Default severity level: severe.

You can set the threshold hierarchy at the global and antenna levels. AWAP Host Count Low The combined count of hosts that are wirelessly associated with the AWAP has fallen below the set threshold. reviewing the hourly and daily mean and maximum attached host values. Default severity level: information. For all AWAPs the default threshold is set to 0. color code: green. When the historic record indicates a rising usage trend you may want to extend the capabilities of your wireless network. AWAP Host Count Low Cleared The number of hosts attached to the AWAP has returned to an acceptable level. By default the threshold is enabled and set to 512. color code: yellow. Default severity level: minor. and disabled. Default severity level: minor.Entuity AWAP Host Count High AWAP Host Count High For each AWAP you can set the number of hosts that when attached to the AWAP would impact performance (this equates to the sum of the hosts each antenna can handle). Actions No action required. Typical Causes Changes in wireless usage have occurred since the network was designed. Typical Causes The managed object’s performance is now within the set thresholds. When the historic record indicates a falling usage trend you may want to adjust the capabilities of your wireless network. Actions Through Component Viewer you can check the AWAP Interface Host Count tab. reviewing the hourly and daily mean and maximum attached host values. Actions Through Component Viewer you can check the AWAP Interface Host Count tab. AWAP Host Count High Cleared The number of hosts attached to the AWAP has returned to an acceptable level. color code: yellow. Typical Causes Changes in wireless usage have occurred since the network was designed. EYE Events Guide 1-12 .

Typical Causes Insufficient backplane resources. which then leads to re-transmission and so more traffic. color code: yellow. Default severity level: minor. color code: green. Actions None. which then leads to re-transmission and so more traffic. Default severity level: minor. When backplane utilization is over 50% it may also indicate port queuing or dropped traffic. Backplane Bus A High Utilization With some devices this indicate a major issue when the port speed and density is higher than the available backplane capabilities. possible backplane upgrade. Bus B. Bus B. Actions Consider reassigning links to under utilized backplanes. Actions No action required. There are separate backplane utilization events for Bus A. Typical Causes Reduced utilization. EYE Events Guide 1-13 . Backplane Bus B High Utilization With some devices this indicate a major issue when the port speed and density is higher than the available backplane capabilities. Bus C and System Bus against each can be set a threshold value. There are separate backplane utilization events for Bus A. color code: green. When backplane utilization is over 50% it may also indicate port queuing or dropped traffic. color code: yellow. Default severity level: information. Bus C and System Bus against each can be set a threshold value. Typical Causes The managed object’s performance is now within the set thresholds.Entuity Backplane Bus A High Utilization Default severity level: information. Backplane Bus A High Utilization Cleared Indicates that backplane utilization is now responding normally.

possible backplane upgrade. When backplane utilization is over 50% it may also indicate port queuing or dropped traffic. which then leads to re-transmission and so more traffic. Actions None. Bus C and System Bus against each can be set a threshold value. Backplane Bus B High Utilization Cleared Indicates that backplane utilization is now responding normally. possible backplane upgrade. Backplane Bus C High Utilization With some devices this indicate a major issue when the port speed and density is higher than the available backplane capabilities. Actions None. color code: green. Bus B. Default severity level: information. There are separate backplane utilization events for Bus A. EYE Events Guide 1-14 . color code: yellow. Default severity level: minor. Typical Causes Insufficient backplane resources.Entuity Backplane Bus B High Utilization Cleared Typical Causes Insufficient backplane resources. Actions Consider reassigning links to under utilized backplanes. color code: green. Typical Causes Reduced utilization. Actions Consider reassigning links to under utilized backplanes. Typical Causes Reduced utilization. Backplane Bus C High Utilization Cleared Indicates that backplane utilization is now responding normally. Default severity level: information.

color code: red. so the local router terminates the connection and then successfully attempt to reestablish it. traffic shaping limitations. Typical Causes BGP keep-alives may be lost. Bus B. Typical Causes Reduced utilization. EYE Events Guide 1-15 . There are separate backplane utilization events for Bus A. which then leads to re-transmission and so more traffic. Actions Consider reassigning links to under utilized backplanes. Default severity level: critical. Bus C and System Bus against each can be set a threshold value. Default severity level: minor. EYE identifies a recent bounce as the peer transition count is greater than zero. possible backplane upgrade. BGP Peer Briefly Established Indicates to administrators that virtual links between BGP speakers are not established but bounced recently.Entuity Backplane System Bus High Utilization Backplane System Bus High Utilization With some devices this indicate a major issue when the port speed and density is higher than the available backplane capabilities. Backplane System Bus High Utilization Cleared Indicates that backplane utilization is now responding normally. Default severity level: information. Use the logs to investigate error messages. Actions None. When backplane utilization is over 50% it may also indicate port queuing or dropped traffic. color code: green. Other causes maybe an unstable remote router. Actions Check logs are activated on the device. Typical Causes Insufficient backplane resources. color code: yellow.

so the local router terminates the connection and then successfully attempt to reestablish it. BGP Peer Newly Discovered Indicates EYE’s. color code: yellow. color code: yellow. traffic shaping limitations. Typical Causes BGP keep-alives may be lost. Use the logs to investigate error messages. Actions Investigate the cause of router disappearance. Typical Causes Update of router configuration.Entuity BGP Peer Briefly Not Established BGP Peer Briefly Not Established Indicates to administrators that virtual links between BGP speakers are now established but bounced recently. Actions Check logs are activated on the device. BGP Peer Established Indicates to administrators that virtual links between BGP peer have just become well established. Default severity level: minor. Administrator’s should be aware of this change to be able to detect rogue configuration updates.discovery of a new BGP peer. Default severity level: critical. Default severity level: critical. BGP Peer Disappeared Indicates a former adjacent peer has been removed from router’s configuration. EYE identifies a recent bounce as the up time is lower than in the previous poll. EYE Events Guide 1-16 . Default severity level: minor. color code: red. color code: red. Actions None. Typical Causes BGP peer established. Other causes maybe an unstable remote router.

Entuity BGP Peer Not Established Typical Causes Configuration of a new BGP peer. BladeCenter Blade +1. Default severity level: information. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Details identifies the rail’s correct voltage. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: critical. Event only available with the BladeCenter module. You can use the show log messages command to look for errors relating to the peer.25v rail has crossed the maximum voltage threshold for that rail. Actions At the router’s command line interface use the ping and show route commands to verify network connectivity to the BGP peer. Typical Causes Surge in BladeCenter power supply. BGP Peer Not Established Indicates to administrators that a former adjacent peer is no longer in reach. color code: red.25V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared. Voltage readings are given in millivolts. poorly seated or malfunctioning blade. 3) Replace blade server. Default severity level: severe. BladeCenter Blade +1.25V Rail High Voltage Indicates that the voltage reading for the +1. Actions 1) Check BladeCenter power. 2) Reseat blade server. color code: green. color code: orange. Actions None. Typical Causes Problems with IP reachability or incorrect BGP configuration. EYE Events Guide 1-17 .

25V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. BladeCenter Blade +1. 2) Reseat blade server. h Entuity recommend always consulting the BladeCenter documentation.25V Rail Low Voltage Indicates that the voltage reading for the +1.25v rail has crossed the minimum voltage threshold for that rail. BladeCenter Blade +1. Default severity level: severe. Actions None.Entuity BladeCenter Blade +1. 3) Replace blade server. Details identifies the rail’s correct voltage. Actions None. poorly seated or malfunctioning blade. BladeCenter Blade +1. Actions 1) Check BladeCenter power. Voltage readings are given in millivolts. color code: orange. Typical Causes Previous problem with the rail voltage has cleared. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Default severity level: severe. Default severity level: information. Details identifies the rail’s correct voltage. EYE Events Guide 1-18 . color code: orange.25V Rail Low Voltage Typical Causes Previous problem with the rail voltage has cleared.5V Rail High Voltage Indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail. Voltage readings are given in millivolts. Event only available with the BladeCenter module. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). color code: green. Typical Causes A drop in BladeCenter power supply.

Actions 1) Check BladeCenter power. h Entuity recommend always consulting the BladeCenter documentation. h Entuity recommend always consulting the BladeCenter documentation. BladeCenter Blade +1. color code: green. Default severity level: information. 2) Reseat blade server. poorly seated or malfunctioning blade. Typical Causes Surge in BladeCenter power supply. 3) Replace blade server. 3) Replace blade server. Event only available with the BladeCenter module. 2) Reseat blade server. BladeCenter Blade +1. Details identifies the rail’s correct voltage.Entuity BladeCenter Blade +1.5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared.5V Rail High Voltage Cleared Event only available with the BladeCenter module. Typical Causes Previous problem with the rail voltage has cleared. Default severity level: severe. Actions 1) Check BladeCenter power.5V Rail Low Voltage Indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). EYE Events Guide 1-19 . Voltage readings are given in millivolts. poorly seated or malfunctioning blade. Actions None. color code: orange. Typical Causes A drop in BladeCenter power supply.

BladeCenter Blade +12V Rail High Voltage Indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail. Default severity level: severe. Actions None. 3) Replace blade server. Typical Causes Previous problem with the rail voltage has cleared. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). poorly seated or malfunctioning blade. Default severity level: information.Entuity BladeCenter Blade +1. Typical Causes Surge in BladeCenter power supply. Voltage readings are given in millivolts. color code: green.5V Rail Low Voltage Cleared BladeCenter Blade +1. 2) Reseat blade server. color code: orange. Typical Causes Previous problem with the rail voltage has cleared. Actions 1) Check BladeCenter power. color code: green. BladeCenter Blade +12V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared. Details identifies the rail’s correct voltage.5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. h Entuity recommend always consulting the BladeCenter documentation. Actions None. Default severity level: information. EYE Events Guide 1-20 . Event only available with the BladeCenter module.

Default severity level: severe. BladeCenter Blade +2. BladeCenter Blade +12V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. EYE Events Guide 1-21 . Details identifies the rail’s correct voltage.Entuity BladeCenter Blade +12V Rail Low Voltage BladeCenter Blade +12V Rail Low Voltage Indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. Actions 1) Check BladeCenter power. color code: green. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Details identifies the rail’s correct voltage. Event only available with the BladeCenter module. Default severity level: information. Default severity level: severe. 2) Reseat blade server. color code: orange. Typical Causes Previous problem with the rail voltage has cleared. color code: orange. Voltage readings are given in millivolts. Typical Causes Surge in BladeCenter power supply. Voltage readings are given in millivolts. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). poorly seated or malfunctioning blade.5V Rail High Voltage Indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail. h Entuity recommend always consulting the BladeCenter documentation. Actions None. 3) Replace blade server. Event only available with the BladeCenter module. poorly seated or malfunctioning blade. Typical Causes A drop in BladeCenter power supply.

Event only available with the BladeCenter module. poorly seated or malfunctioning blade. BladeCenter Blade +2. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage).5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. 2) Reseat blade server. Actions None.5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared. Actions 1) Check BladeCenter power. Typical Causes A drop in BladeCenter power supply.5V Rail High Voltage Cleared Actions 1) Check BladeCenter power. Typical Causes Previous problem with the rail voltage has cleared. 3) Replace blade server. EYE Events Guide 1-22 . Details identifies the rail’s correct voltage. BladeCenter Blade +2. color code: orange. 3) Replace blade server.Entuity BladeCenter Blade +2. 2) Reseat blade server. Default severity level: information. BladeCenter Blade +2. h Entuity recommend always consulting the BladeCenter documentation.5V Rail Low Voltage Indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. Default severity level: severe. color code: green. h Entuity recommend always consulting the BladeCenter documentation. Voltage readings are given in millivolts.

3V Rail High Voltage Indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail.3V Rail Low Voltage Indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. 2) Reseat blade server. Actions 1) Check BladeCenter power. Event only available with the BladeCenter module. 3) Replace blade server.3V Rail High Voltage Default severity level: information. h Entuity recommend always consulting the BladeCenter documentation. BladeCenter Blade +3.Entuity BladeCenter Blade +3.3V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared. Default severity level: severe. color code: green. Details identifies the rail’s correct voltage. poorly seated or malfunctioning blade. Typical Causes Surge in BladeCenter power supply. color code: green. Details identifies the rail’s correct voltage. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts. Default severity level: information. Actions None. BladeCenter Blade +3. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Typical Causes Previous problem with the rail voltage has cleared. EYE Events Guide 1-23 . BladeCenter Blade +3. Typical Causes Previous problem with the rail voltage has cleared. color code: orange. Actions None. Voltage readings are given in millivolts.

poorly seated or malfunctioning blade. Typical Causes Previous problem with the rail voltage has cleared. 3) Replace blade server. Actions None. 2) Reseat blade server. Actions 1) Check BladeCenter power. Event only available with the BladeCenter module. h Entuity recommend always consulting the BladeCenter documentation. color code: orange. poorly seated or malfunctioning blade.3V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. Actions 1) Check BladeCenter power. Event only available with the BladeCenter module.Entuity BladeCenter Blade +3. EYE Events Guide 1-24 . color code: orange.3V Rail Low Voltage Cleared Default severity level: severe. Default severity level: information. 2) Reseat blade server. BladeCenter Blade +3. Details identifies the rail’s correct voltage. Typical Causes A drop in BladeCenter power supply. color code: green. 3) Replace blade server. Voltage readings are given in millivolts. Typical Causes Surge in BladeCenter power supply. BladeCenter Blade +5V Rail High Voltage Indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Default severity level: severe.

Typical Causes A drop in BladeCenter power supply. Event only available with the BladeCenter module. BladeCenter Blade +5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the rail has been cleared. color code: green. Default severity level: information. 2) Reseat blade server. BladeCenter Blade +5V Rail Low Voltage Indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage).Entuity h BladeCenter Blade +5V Rail High Voltage Cleared Entuity recommend always consulting the BladeCenter documentation. Typical Causes Previous problem with the rail voltage has cleared. Actions 1) Check BladeCenter power. color code: orange. Default severity level: information. Typical Causes Previous problem with the rail voltage has cleared. poorly seated or malfunctioning blade. h Entuity recommend always consulting the BladeCenter documentation. Details identifies the rail’s correct voltage. Actions None. Actions None. color code: green. EYE Events Guide 1-25 . Voltage readings are given in millivolts. BladeCenter Blade +5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the rail has been cleared. Default severity level: severe. 3) Replace blade server.

Typical Causes Blade switched on. Default severity level: major.Entuity BladeCenter Blade Powered Off BladeCenter Blade Powered Off Indicates that a blade has been switched off. color code: green. BladeCenter Blower Ok Indicates that a BladeCenter blower has transitioned from a failed. Default severity level: information. This is identified through monitoring the voltage on the blade. Typical Causes Blower failure. Event only available with the BladeCenter module. Actions Replace the blower. EYE Events Guide 1-26 . Actions None. color code: orange. color code: amber. BladeCenter Blade Powered On Indicates that a blade has been switched on. Actions None. color code: green. BladeCenter’s built-in redundancy allows the remaining blower to successfully cool the BladeCenter. Default severity level: severe. BladeCenter Blower Failed Indicates that a blower has failed. Typical Causes Blade switched off. or blower slow. Event only available with the BladeCenter module. Event only available with the BladeCenter module. The failed blower module must be replaced within two minutes during service. This is identified through monitoring the voltage on the blade. Default severity level: information. state. This is identified through monitoring the voltage on the blade.

has cleared. either slow performance or failure. Event only available with the BladeCenter module.8V Rail High Voltage Indicates that the voltage reading for the +1. 2) Reseat blade server. Typical Causes Previous problem with the blower. BladeCenter Blower Slow Indicates that a blower is running at less than twenty percent (default threshold) of its maximum rotational speed.Entuity BladeCenter Blower Slow Event only available with the BladeCenter module. the exact speed depending upon the ambient temperature. poorly seated or malfunctioning blade. Default severity level: severe. Voltage readings are given in millivolts. Typical Causes Blower engine failure. Actions Replace the blower. Typical Causes Surge in BladeCenter power supply. h Entuity recommend always consulting the BladeCenter documentation. Actions 1) Check BladeCenter power. Default severity level: minor. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). BladeCenter blowers usually operate at thirty percent or above of their maximum rotational speed.8v rail has crossed the maximum voltage threshold for that rail. Event only available with the BladeCenter module. BladeCenter Chassis +1. Details identifies the rail’s correct voltage. 3) Replace blade server. Default color code: yellow. color code: orange. EYE Events Guide 1-27 . Actions None.

8v rail has been cleared.8v rail has been cleared. Typical Causes Previous problem with the rail voltage has cleared.8V Rail Low Voltage Indicates that the voltage reading for the +1. 2) Reseat blade server. poorly seated or malfunctioning blade. color code: orange. color code: green. Default severity level: information.8v rail has crossed the minimum voltage threshold for that rail. Default severity level: information. Typical Causes A drop in BladeCenter power supply. Actions 1) Check BladeCenter power.8V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the +1. Actions None. Default severity level: severe. Event only available with the BladeCenter module. BladeCenter Chassis +1.8V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the +1.Entuity BladeCenter Chassis +1. EYE Events Guide 1-28 . Details identifies the rail’s correct voltage. Voltage readings are given in millivolts. 3) Replace blade server. color code: green. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage).8V Rail High Voltage Cleared BladeCenter Chassis +1. BladeCenter Chassis +1. Actions None. Typical Causes Previous problem with the rail voltage has cleared. h Entuity recommend always consulting the BladeCenter documentation.

color code: orange.Entuity BladeCenter Chassis +12V Rail High Voltage BladeCenter Chassis +12V Rail High Voltage Indicates that the voltage reading for the +12v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage. BladeCenter Chassis +12V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the +12v rail has been cleared. Typical Causes Previous problem with the rail voltage has cleared. BladeCenter Chassis +12V Rail Low Voltage Indicates that the voltage reading for the +12v rail has crossed the minimum voltage threshold for that rail. Voltage readings are given in millivolts. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: information. color code: orange. color code: green. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). poorly seated or malfunctioning blade. poorly seated or malfunctioning blade. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). 3) Replace blade server. Event only available with the BladeCenter module. Typical Causes A drop in BladeCenter power supply. Event only available with the BladeCenter module. Details identifies the rail’s correct voltage. Actions 1) Check BladeCenter power. Voltage readings are given in millivolts. Typical Causes Surge in BladeCenter power supply. Default severity level: severe. Default severity level: severe. Actions None. EYE Events Guide 1-29 . 2) Reseat blade server.

5v rail has been cleared. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Default severity level: information. BladeCenter Chassis +2. Actions 1) Check BladeCenter power. Typical Causes Previous problem with the rail voltage has cleared. EYE Events Guide 1-30 . poorly seated or malfunctioning blade. 3) Replace blade server.5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the +2. Details identifies the rail’s correct voltage.5V Rail High Voltage Indicates that the voltage reading for the +2. h Entuity recommend always consulting the BladeCenter documentation.5v rail has crossed the maximum voltage threshold for that rail. Voltage readings are given in millivolts.Entuity BladeCenter Chassis +12V Rail Low Voltage Cleared Actions 1) Check BladeCenter power. Typical Causes Surge in BladeCenter power supply. 3) Replace blade server. BladeCenter Chassis +12V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the +12v rail has been cleared. color code: green. 2) Reseat blade server. Default severity level: severe. Event only available with the BladeCenter module. color code: orange. Actions None. 2) Reseat blade server. h Entuity recommend always consulting the BladeCenter documentation. BladeCenter Chassis +2.

color code: orange. poorly seated or malfunctioning blade. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). 3) Replace blade server. color code: green. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage).5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the +2.5V Rail Low Voltage Default severity level: information.5v rail has crossed the minimum voltage threshold for that rail. Actions None.Entuity BladeCenter Chassis +2. Details identifies the rail’s correct voltage. BladeCenter Chassis +2. Default severity level: severe. color code: green. Voltage readings are given in millivolts. Typical Causes A drop in BladeCenter power supply. EYE Events Guide 1-31 . Details identifies the rail’s correct voltage.3v rail has crossed the maximum voltage threshold for that rail. Typical Causes Previous problem with the rail voltage has cleared. Actions None. Voltage readings are given in millivolts. 2) Reseat blade server. Actions 1) Check BladeCenter power.5v rail has been cleared. Event only available with the BladeCenter module.3V Rail High Voltage Indicates that the voltage reading for the +3. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: information.5V Rail Low Voltage Indicates that the voltage reading for the +2. BladeCenter Chassis +3. Typical Causes Previous problem with the rail voltage has cleared. BladeCenter Chassis +2.

Details identifies the rail’s correct voltage.Entuity BladeCenter Chassis +3. color code: orange. color code: green.3V Rail Low Voltage Indicates that the voltage reading for the +3. BladeCenter Chassis +3. poorly seated or malfunctioning blade.3v rail has crossed the minimum voltage threshold for that rail. 2) Reseat blade server. BladeCenter Chassis +3. Default severity level: information. h Entuity recommend always consulting the BladeCenter documentation.3v rail has been cleared. Typical Causes Surge in BladeCenter power supply. Default severity level: severe. EYE Events Guide 1-32 . Voltage readings are given in millivolts. Actions None. Event only available with the BladeCenter module. Event only available with the BladeCenter module. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Actions 1) Check BladeCenter power. Typical Causes A drop in BladeCenter power supply.3V Rail High Voltage Cleared Default severity level: severe. Typical Causes Previous problem with the rail voltage has cleared. 3) Replace blade server. Actions 1) Check BladeCenter power. 3) Replace blade server. color code: orange. 2) Reseat blade server. poorly seated or malfunctioning blade.3V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the +3.

the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Actions None. Event only available with the BladeCenter module.Entuity h BladeCenter Chassis +3.3V Rail Low Voltage Cleared Entuity recommend always consulting the BladeCenter documentation. color code: green. 3) Replace blade server. Typical Causes Previous problem with the rail voltage has cleared. color code: green. color code: orange. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: severe. Default severity level: information.3v rail has been cleared.3V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the +3. Details identifies the rail’s correct voltage. Typical Causes Surge in BladeCenter power supply. poorly seated or malfunctioning blade. Voltage readings are given in millivolts. BladeCenter Chassis +3. BladeCenter Chassis +5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the +5v rail has been cleared. 2) Reseat blade server. Actions 1) Check BladeCenter power. BladeCenter Chassis +5V Rail High Voltage Indicates that the voltage reading for the +5v rail has crossed the maximum voltage threshold for that rail. Typical Causes Previous problem with the rail voltage has cleared. Actions None. EYE Events Guide 1-33 . Default severity level: information.

color code: orange. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts. EYE Events Guide 1-34 . Typical Causes Surge in BladeCenter power supply. Typical Causes A drop in BladeCenter power supply. Event only available with the BladeCenter module. 3) Replace blade server. 2) Reseat blade server. poorly seated or malfunctioning blade. Actions 1) Check BladeCenter power. color code: green. Voltage readings are given in millivolts. Default severity level: information. Details identifies the rail’s correct voltage.Entuity BladeCenter Chassis +5V Rail Low Voltage BladeCenter Chassis +5V Rail Low Voltage Indicates that the voltage reading for the +5v rail has crossed the minimum voltage threshold for that rail. Default severity level: severe. Default severity level: severe. h Entuity recommend always consulting the BladeCenter documentation. BladeCenter Chassis -5V Rail High Voltage Indicates that the voltage reading for the -5v rail has crossed the maximum voltage threshold for that rail. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). color code: orange. Details identifies the rail’s correct voltage. Event only available with the BladeCenter module. Actions None. poorly seated or malfunctioning blade. Typical Causes Previous problem with the rail voltage has cleared. BladeCenter Chassis +5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the +5v rail has been cleared.

Typical Causes A drop in BladeCenter power supply. 2) Reseat blade server. h Entuity recommend always consulting the BladeCenter documentation. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: information. the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Default severity level: severe. 2) Reseat blade server. Actions None. color code: orange. BladeCenter Chassis -5V Rail Low Voltage Cleared Indicates a previous low voltage alarm raised against the -5v rail has been cleared. 3) Replace blade server. Details identifies the rail’s correct voltage. poorly seated or malfunctioning blade.Entuity BladeCenter Chassis -5V Rail High Voltage Cleared Actions 1) Check BladeCenter power. Actions 1) Check BladeCenter power. EYE Events Guide 1-35 . BladeCenter Chassis -5V Rail High Voltage Cleared Indicates a previous high voltage alarm raised against the -5v rail has been cleared. 3) Replace blade server. Event only available with the BladeCenter module. color code: green. BladeCenter Chassis -5V Rail Low Voltage Indicates that the voltage reading for the -5v rail has crossed the minimum voltage threshold for that rail. Typical Causes Previous problem with the rail voltage has cleared. Voltage readings are given in millivolts.

checking blower performance. Details identifies the actual temperature and the temperature threshold. Typical Causes Previous problem with the CPU temperature has cleared. Typical Causes Previous problem with the rail voltage has cleared. BladeCenter CPU1 High Temperature Cleared Indicates a previous high temperature alarm raised against the CPU has been cleared. color code: orange. EYE Events Guide 1-36 . that impact the cooling of the BladeCenter. Default severity level: severe. color code: green. Actions None. Details identifies the actual temperature and the temperature threshold. Event only available with the BladeCenter module. ambient temperature and missing components. Default severity level: information. BladeCenter CPU1 High Temperature Indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. Event only available with the BladeCenter module. Temperature readings are given in degrees celsius. Typical Causes A rise in the ambient temperature. Temperature readings are given in degrees celsius. color code: green. a blade. Actions None. blower failure or missing components. Actions Ensure the BladeCenter is properly cooled. color code: orange. BladeCenter CPU2 High Temperature Indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. h Entuity recommend always consulting the BladeCenter documentation. Default severity level: severe. e.g.Entuity BladeCenter CPU1 High Temperature Default severity level: information.

Default severity level: severe. BladeCenter DASD1 High Temperature Cleared Indicates a previous high temperature alarm raised against the DASD1 has been cleared. checking blower performance. ambient temperature and missing components.g. h Entuity recommend always consulting the BladeCenter documentation. Typical Causes A rise in the ambient temperature. ambient temperature and missing components. color code: green. e. a blade. Details identifies the actual temperature and the temperature threshold. Actions None. color code: green. color code: orange. blower failure or missing components. Default severity level: information. BladeCenter DASD1 High Temperature Indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. Actions Ensure the BladeCenter is properly cooled. e. Default severity level: information. blower failure or missing components. that impact the cooling of the BladeCenter. a blade. that impact the cooling of the BladeCenter. checking blower performance. Temperature readings are given in degrees celsius. EYE Events Guide 1-37 . h Entuity recommend always consulting the BladeCenter documentation.g.Entuity BladeCenter CPU2 High Temperature Cleared Typical Causes A rise in the ambient temperature. BladeCenter CPU2 High Temperature Cleared Indicates a previous high temperature alarm raised against the CPU has been cleared. Actions Ensure the BladeCenter is properly cooled. Event only available with the BladeCenter module. Typical Causes Previous problem with the CPU temperature has cleared.

Typical Causes Previous problem with the CPU temperature has cleared. Details identifies the actual temperature and the temperature threshold. blower failure or missing components. Details identifies the actual temperature and the temperature threshold. BladeCenter Management Module High Temperature Indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. Default severity level: information. Event only available with the BladeCenter module. Event only available with the BladeCenter module. Temperature readings are given in degrees celsius.g. color code: green. that impact the cooling of the BladeCenter. EYE Events Guide 1-38 . BladeCenter Front Panel High Temperature Cleared Indicates a previous high temperature alarm raised against the Front Panel has been cleared.Entuity BladeCenter Front Panel High Temperature Typical Causes Previous problem with the CPU temperature has cleared. Temperature readings are given in degrees celsius. ambient temperature and missing components. Default severity level: severe. color code: orange. BladeCenter Front Panel High Temperature Indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. h Entuity recommend always consulting the BladeCenter documentation. Typical Causes A rise in the ambient temperature. Actions Ensure the BladeCenter is properly cooled. Actions None. Default severity level: severe. Actions None. a blade. checking blower performance. color code: orange. e.

blower failure or missing components. A hardware swap out may need to be scheduled depending on the type of problem. ambient temperature and missing components. h Entuity recommend always consulting the BladeCenter documentation. Typical Causes Faulty fan hardware. Chassis Fan Major Fault Indicates that a device has a major fan hardware problem. BladeCenter Management Module High Temperature Cleared Indicates a previous high temperature alarm raised against the management module has been cleared. EYE Events Guide 1-39 . A hardware swap out may need to be scheduled depending on the type of problem. Actions Ensure the BladeCenter is properly cooled. Default severity level: information. Default severity level: major. color code: amber. Typical Causes Faulty fan hardware. Actions None.Entuity BladeCenter Management Module High Temperature Cleared Typical Causes A rise in the ambient temperature. Chassis Fan Minor Fault Indicates that a device has a minor fan hardware problem. Actions Telnet to the device and check the system settings for an indication of what the problem is. that impact the cooling of the BladeCenter. e. a blade.g. color code: orange. Typical Causes Previous problem with the CPU temperature has cleared. faulty supervisor card. faulty environmental card. faulty supervisor card. Actions Telnet to the device and check the system settings for an indication of what the problem is. checking blower performance. color code: green. faulty environmental card. Default severity level: severe.

Actions Telnet to the device and check the system settings for an indication of what the problem is. module faults.g. Or. Actions None. e. Chassis Fan Status Unknown Indicates the status of the fan is not reportable or is unknown. Default severity level: critical. color code: red. Chassis Major Alarm Cleared Indicates a previous alarm has been cleared. fan failures. power supply problems. Default severity level: minor. EYE Events Guide 1-40 . temperature alarms. Default severity level: information.Entuity Chassis Fan OK Chassis Fan OK Indicates that a previous fan fault for a device has been cleared. Typical Causes The status of the fan is not reportable. the fan status is unknown. A hardware swap out may need to be scheduled depending on the type of problem. module faults has been corrected. temperature alarms. Typical Causes Faulty firmware has been swapped out. Actions Telnet to the device and check the current system settings. Typical Causes The original cause of the alarm. color code: yellow. Default severity level: information. color code: green. fan failures. Typical Causes Power supply problems. Chassis Major Alarm Indicates that a device is reporting a major hardware or firmware problem which is causing or may cause the device to fail. A hardware swap out may need to be scheduled depending on the type of problem. color code: green.

temperature alarms. Chassis Minor Alarm Indicates that a device is reporting a minor hardware or firmware problem. module faults has been corrected. color code: orange. A hardware swap out may need to be scheduled depending on the type of problem. fan failures. Default severity level: major. color code: green. A hardware swap out may need to be scheduled depending on the type of problem. Default severity level: severe. faulty environmental card. comms room problems. Typical Causes Power supply problems. e.Entuity Chassis Minor Alarm Actions No action required. module faults.g. Chassis Temperature Alarm Indicates that a device has measured a significant increase in ambient temperature. Default severity level: information. Typical Causes Faulty fan hardware. Actions No action required. temperature alarms. Actions Telnet to the device and check the system settings for an indication of what the problem is. color code: green. power supply problems. Default severity level: information. EYE Events Guide 1-41 . Typical Causes The original cause of the alarm. color code: amber. Actions Telnet to the device and check the current system settings. Chassis Temperature Alarm Cleared Indicates that a device temperature problem is resolved. fan failures. Chassis Minor Alarm Cleared Indicates a previous alarm has been cleared.

faulty environmental card. Default severity level: minor. color code: yellow. A hardware swap out may need to be scheduled depending on the type of problem. CM Configuration Missing Policy Mandated Statement Indicates EYE Configuration Monitor has identified that the device configuration does not include a setting required for the device to be configured according to good practice. View the events in History mode to view in the event’s Details the specific policy violation. Chassis Temperature Critical Alarm Indicates that a device has measured a potentially fatal increase in ambient temperature. Actions None. Typical Causes Poorly. with # identifying the number of events. or wrongly defined device configuration. EYE Events Guide 1-42 . Typical Causes Faulty fan hardware. Actions EYE raises an event for each policy violation. color code: red. Default severity level: critical. CM Configuration Includes Policy Exclusion Indicates EYE Configuration Monitor has identified a device configuration which includes a setting that violates good practice. or wrongly defined device configuration. Actions Telnet to the device and check the system settings for an indication of what the problem is. Correct the configuration on the device or amended your policy mandated statements file. In the Open view mode of Event Viewer these events are collapsed into one row. color code: yellow. Default severity level: minor. Typical Causes Poorly.Entuity Chassis Temperature Critical Alarm Typical Causes Hardware swap out to resolve a previous problem. comms room problems.

EYE raises this event and also retrieves the device configuration. EYE Events Guide 1-43 . configuration. has now been saved. Typical Causes A known configuration change to the device. Default severity level: severe. Default severity level: minor. CM Firmware Version Changed Indicates EYE has identified a change in the device firmware. Typical Causes A device configuration previously identified as not being saved. with # identifying the number of events. color code: yellow. Actions EYE Configuration Monitor initiates a retrieval of device configuration.Entuity CM Firmware Version Changed Actions EYE raises an event for each policy violation. This event expires in 24 hours. Default severity level: information. This new configuration is stored making it the new last-seen running-configuration. CM Running Configuration Changed Indicates EYE Configuration Monitor has retrieved a device running configuration that is significantly different from the previous running configuration retrieved from that device. CM Previously Unsaved Configuration Saved Indicates the current running and startup device configuration files are now the same. Correct the configuration on the device or amended your policy mandated statements file. which you can view in the archive directory. color code: orange. In the Open view mode of Event Viewer these events are collapsed into one row. color code: green. View the events in History mode to view in the event’s Details the specific policy violation. Typical Causes This would usually be an authorised change in the device firmware. Actions None required. however an unauthorized change may indicate a security issue.

to retrieve device running configuration. Default severity level: minor. If the server is not running the retrieval will fail. the name of the configuration file and the error code from the device. color code: orange. color code: yellow. This new configuration is stored making it the new last-seen startup-configuration.Entuity CM Running Configuration Retrieval Failed Actions From the event’s context menu you can compare the most recent running configurations. Typical Causes A known configuration change to the device. CM Startup Configuration Changed Indicates EYE Configuration Monitor has retrieved a device startup configuration that is significantly different from the previous startup configuration retrieved from that device. When the time out is a symptom of other problems with the network or the device itself. Default severity level: severe. Typical Causes Although EYE Configuration Monitor is configured to work with the specified TFTP and/or FTP server it does not check that the server is running when attempting a retrieval. When the attempted configuration retrieval times out. This event ages out in twenty-four hours. This event ages out in twenty-four hours. Check the transport server is running. From the web UI check the Explorer Configuration Monitor page of the device. for example the route to the device is not available. You can also compare configurations through the devices’s web UI EYE Configuration Monitor page. Actions From Event Viewer open the current and previous configurations and compare the difference. Since the first situation cannot correct itself and increasing network traffic can only make the second situation worse. EYE Events Guide 1-44 . but failed. other components of EYE should alert the user to the probable cause. EYE Configuration Monitor will only try twice to retrieve a configuration file from a device before setting a time out. the error code in the details is replaced with a “time out” message. CM Running Configuration Retrieval Failed Indicates EYE Configuration Monitor attempted. The target device is not available. Actions The details field contains the IP address of the device.

This applies EYE Events Guide 1-45 . color code: yellow. EYE allows suppression of this event according to simple n of m rules. EYE Configuration Monitor has found a significant difference between the two. which indicates an unsaved configuration change. This event ages out in twenty-four hours. to retrieve device startup configuration. Actions From Event Viewer open the current and previous configurations and compare the differences. Typical Causes Although EYE Configuration Monitor is configured to work with the specified TFTP and/or FTP server it does not check that the server is running when attempting a retrieval. i. CM Unsaved Configuration Indicates EYE Configuration Monitor has retrieved. When the time out is a symptom of other problems with the network or the device itself. Actions The details field contains the IP address of the device.e. Default severity level: minor. other components of EYE should alert the user to the probable cause. When the attempted configuration retrieval times out. Default severity level: minor. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. the current running and startup device configuration files. the name of the configuration file and the error code from the device. EYE Configuration Monitor will only try twice to retrieve a configuration file from a device before setting a time out. If the server is not running the retrieval will fail. but failed. The target device is not available. From the web UI check the Explorer Configuration Monitor page of the device. color code: yellow. Check the transport server is running. and compared. for example the route to the device is not available.Entuity CM Startup Configuration Retrieval Failed CM Startup Configuration Retrieval Failed Indicates EYE Configuration Monitor attempted. Typical Causes A configuration change to the device. the error code in the details is replaced with a “time out” message. CPU High Utilization Indicates the identified processor on the device has high CPU utilization. Since the first situation cannot correct itself and increasing network traffic can only make the second situation worse. When the processor cannot be identified EYE raises the event against single processor 1.

this weight should match the Cisco Unified Communications Manager server specification. Problems may occur when this is not the case. color code: green. EYE Events Guide 1-46 .cfg. a particular process using a lot of CPU resources. CUCM CPU High Utilization Cleared Indicates a previous alarm has been cleared. Each device type registered with the Cisco Unified Communications Manager has a weight. Also create reports. Default severity level: information only. Actions Use the managed host function to view current and historic levels of process usage. Default severity level: minor. Typical Causes Reduced usage. Administrators set n of m as a global setting through entuity. Typical Causes High CPU utilization due to interrupts. Actions Use Flex Reports to create a Cisco Unified Communications Manager CPU Report. CUCM CPU High Utilization Indicates a process on the Cisco Unified Communications Manager server has high CPU utilization. color code: orange. for example a Router Summary Report that runs every hour to monitor router CPU utilization. CPU High Utilization Cleared Indicates the processor on the device no longer has high CPU utilization. and directly against this event through sw_n_of_m_cpu.Entuity CPU High Utilization Cleared to all CPU High Utilization events raised on the device. for example one that runs every hour to monitor CPU utilization. color code: yellow.cfg. Default severity level: severe. color code: green. or a particular process using a lot of CPU resources. Typical Causes High Cisco Unified Communications Manager CPU utilization due to interrupts. Default severity level: information. Actions None.

5) If multiple device types are failing to register with the Cisco Unified Communications Manager check the Cisco Unified Communications Manager server has sufficient available CPU and memory resources to support additional devices. color code: green. CUCM CTI Device Registered Indicates the CTI device has successfully registered to the Cisco Unified Communications Manager. EYE monitors Cisco Unified Communications Manager CPU and Memory performance.Entuity CUCM CTI Device Not Registered Typical Causes Previous problem with the CPU utilization has cleared. or an illegal/ unknown device trying to attempt a connection. Actions 1) Check the event Details. 3) The alarm could also indicate a device misconfiguration. 4) For a Cisco Unified Communications Manager or CTI Manager failure the device attempts to re-register with the back up Cisco Unified Communications Manager or CTI Manager. CUCM CTI Device Not Registered Indicates the CTI device has not registered to the Cisco Unified Communications Manager. Typical Causes Cisco Unified Communications Manager or the CTI Manager may have failed. Check the Cisco Unified Communications Manager and CTI Manager for failures. color code: red. Actions None. Also run a Flex Report on these metrics. raising events when high utilization thresholds are crossed. Default severity level: information. Alternatively. Default severity level: critical. 2) Incomplete registration may indicate a device is re-homing in the middle of registration. database error. This indicates the particular cause of the event. EYE Events Guide 1-47 . Typical Causes Successful CTI device registration. EYE raises a successful device registration event. Consult the Cisco Unified Communications Manager documentation for details on device weighting. the Cisco Unified Communications Manager may have insufficient resources to handle additional devices.

If the gateway fails to recover consult the gateway documentation. 3) When there is a zone subnet defined on the gatekeeper. color code: red. Typical Causes Successful gatekeeper registration. CUCM Gatekeeper Not Registered Cisco Unified Communications Manager cannot register with the gatekeeper. Typical Causes Gatekeeper configuration problems. gateway software failure. Actions None. EYE details the specific error code. Default severity level: critical. Default severity level: critical. Default severity level: information. All gateways have a heartbeat LED that blinks one second on and one second off when the gateway software is running normally. EYE Events Guide 1-48 . e. After a registration failure the gateway attempts to recover. CUCM Gatekeeper Registered Indicates the gatekeeper has successfully registered to the Cisco Unified Communications Manager. which alters the LED blink pattern. verify that the subnet of the gateway is in the allowed subnets. color code: green. 2) Check gatekeeper status and verify that the gatekeeper state is up.g. color code: red. Actions 1) Check IP visibility from Cisco Unified Communications Manager to the gatekeeper. Typical Causes Gateway registration may fail for a number of reasons. Actions Check that the gateway is up and running. CUCM Gateway Not Registered Gateway registration may fail for a number of reasons.Entuity CUCM Gatekeeper Not Registered Actions None.

EYE Events Guide 1-49 . All gateways have a heartbeat LED that blinks one second on and one second off when the gateway software is running normally. CUCM H. Typical Causes Successful gateway registration. After a registration failure the gateway attempts to recover. CUCM Media Device Not Registered Indicates the media device has not registered to the Cisco Unified Communications Manager.323 Gateway device registration may fail for a number of reasons.323 registration may fail for a number of reasons. Actions Check that the gateway is up and running. color code: green. CUCM H. gateway software failure.323 Device Not Registered H. color code: red. If the gateway fails to recover consult the gateway documentation. e.Entuity CUCM Gateway Registered CUCM Gateway Registered Indicates the gateway has successfully registered to the Cisco Unified Communications Manager.g. Typical Causes Successful H232 device registration. Default severity level: information. which alters the LED blink pattern. color code: green. Actions None.323 Device Registered Indicates the H323 device has successfully registered to the CUCM. Typical Causes H. Actions None. Default severity level: critical. color code: red. Default severity level: critical. Default severity level: information.

database error. Automatic phone registration may be turned off (default state). the Cisco Unified Communications Manager may have insufficient resources to handle additional devices. 2) Incomplete registration may indicate a device is re-homing in the middle of registration. EYE raises a successful device registration event. Actions None. EYE Events Guide 1-50 . or an illegal/ unknown device trying to attempt a connection. This indicates the particular cause of the event. Consult the Cisco Unified Communications Manager documentation for details on device weighting. Default severity level: information. Default severity level: critical. Also run a Flex Report on these metrics. color code: green. raising events when high utilization thresholds are crossed. Typical Causes Cisco Unified Communications Manager may have failed. Alternatively. The Cisco Unified Communications Manager may have insufficient resources to handle additional devices. EYE monitors Cisco Unified Communications Manager CPU and Memory performance.Entuity CUCM Media Device Registered Typical Causes Cisco Unified Communications Manager may have failed or not recognized the device type. Actions 1) Check the event Details. color code: red. Typical Causes Successful media device registration. 5) If multiple device types are failing to register with the Cisco Unified Communications Manager check the Cisco Unified Communications Manager machine has sufficient available CPU and memory resources to support additional devices. CUCM Media Device Registered Indicates the media device has successfully registered to the Cisco Unified Communications Manager. 4) For a Cisco Unified Communications Manager failure the device attempts to re-register with the back up Cisco Unified Communications Manager. 3) The alarm could also indicate a device misconfiguration. CUCM Phone Not Registered Indicates the phone has not registered to the Cisco Unified Communications Manager. Check the Cisco Unified Communications Manager for failures.

Default severity level: information. CUCM Process Memory High Utilization Indicates the Cisco Unified Communications Manager has high process memory utilization. or an illegal/ unknown device trying to attempt a connection. 5) If multiple device types are failing to register with the Cisco Unified Communications Manager check the Cisco Unified Communications Manager machine has sufficient available CPU and memory resources to support additional devices. CUCM Phone Registered Indicates the phone has successfully registered to the Cisco Unified Communications Manager. EYE monitors Cisco Unified Communications Manager CPU and Memory performance. EYE raises a successful device registration event. Check the Cisco Unified Communications Manager for failure. Actions None. Problems may occur when this is not the case. this weight should match the Cisco Unified Communications Manager server specification. color code: orange. Each device type registered with the Cisco Unified Communications Manager has a weight. 2) Incomplete registration may indicate a device is re-homing in the middle of registration. database error. This indicates the particular cause of the event. Typical Causes High CUCM process memory utilization due to interrupts. EYE Events Guide 1-51 . color code: green. Typical Causes Successful phone registration. Default severity level: severe. Consult the Cisco Unified Communications Manager documentation for details on device weighting. raising events when high utilization thresholds are crossed. Also run a Flex Report on these metrics.Entuity CUCM Phone Registered Actions 1) Check the event Details. 4) For a Cisco Unified Communications Manager failure the device attempts to re-register with the back up Cisco Unified Communications Manager. 3) The alarm could also indicate a device misconfiguration. or a particular process using a lot of memory resources.

Alternatively. 2) Incomplete registration may indicate a device is re-homing in the middle of registration. EYE monitors Cisco Unified Communications Manager CPU and Memory performance. This indicates the particular cause of the event. color code: green. EYE Events Guide 1-52 . EYE raises a successful device registration event. raising events when high utilization thresholds are crossed. Typical Causes Cisco Unified Communications Manager may have failed or not recognized the device type. CUCM Voicemail Device Not Registered Indicates the voicemail device has not registered to the CUCM. the Cisco Unified Communications Manager may have insufficient resources to handle additional devices. 4) For a Cisco Unified Communications Manager failure the device attempts to re-register with the back up Cisco Unified Communications Manager. for example one that runs every hour to monitor Cisco Unified Communications Manager memory utilization. 5) If multiple device types are failing to register with the Cisco Unified Communications Manager check the Cisco Unified Communications Manager machine has sufficient available CPU and memory resources to support additional devices. Check the Cisco Unified Communications Manager for failure. or an illegal/ unknown device trying to attempt a connection. 3) The alarm could also indicate a device misconfiguration. CUCM Process Memory High Utilization Cleared Indicates a previous alarm has been cleared. database error. Also run a Flex Report on these metrics. color code: red.Entuity CUCM Process Memory High Utilization Cleared Actions Use Flex Reports to create a Cisco Unified Communications Manager memory report. Typical Causes Previous problem with high memory utilization has cleared. Actions 1) Check the event Details. Actions None. Consult the Cisco Unified Communications Manager documentation for details on device weighting. Default severity level: critical. Default severity level: Information.

color code: yellow. color code: red. Actions This event does not necessarily indicate a network problem. Typical Causes Successful voicemail device registration. Typical Causes Slow running network. EYE Events Guide 1-53 . Default severity level: information. Actions None. Tolerance values for this event may be adjusted via settings in entuity. Default severity level: critical. Default severity level: severe. This event is detected by the generation of an SNMP trap on the device. misconfigured device clock. power failures. color code: green. Actions Telnet to the device and check the system logs for an indication of what caused the device to reboot.cfg. Device Fan Failed Indicates the failure of a fan on the device. Device Clock Inconsistency Poll samples for the device have been discarded because of a too great discrepancy between the sample interval according to device sysUpTime and the sample interval according to EYE's clock. lack of memory on the device. Typical Causes Device configuration changes. color code: orange.Entuity CUCM Voicemail Device Registered CUCM Voicemail Device Registered Indicates the voicemail device has successfully registered to the Cisco Unified Communications Manager. Default severity level: minor. hardware/software/firmware faults. Device Cold Reboot Indicates that a device has just been rebooted or reset.

air conditioner failure in the room. color code: red. Actions The event includes the identifier of the failed fan. Default severity level: information. color code: green. with the event details including the device’s reported temperature. Typical Causes The fan may have restarted.Entuity Device Fan Failure Cleared Typical Causes Fan failure on the device. Actions None required. Typical Causes Overworked device. Device High Temperature Cleared Indicates a device that was reporting a high temperature is now returning a value within accepted boundaries. Device High Temperature Indicates a high temperature on the device. air blockage to cooling vents. Actions Consult your device documentation on investigating the device cooling system. Device Low Disk Space Indicates the device has low disk space. EYE Events Guide 1-54 . which you can use when investigating the failure and to locate it if you have to replace the fan. Actions None required. Device Fan Failure Cleared Indicates a fan that had failed on the device is once again working. or it may have been replaced with a new fan. fan failure. Default severity level: information. Default severity level: critical. color code: green. Typical Causes Resolution of original problem.

color code: orange. as a memory leak that has consumed a large amount of memory. Typical Causes Reduced usage.Entuity Device Low Disk Space Cleared Default severity level: severe. Device Low Total Memory Indicates the device has low memory. Default severity level: severe. color code: orange. Device Low Disk Space Cleared Indicates the device is no longer suffering from low disk space. color code: green. Default severity level: information. Actions Use the managed host function to view current and historic levels of disk space. for example firewalls can generate large log files. color code: green. Typical Causes Reduced usage. Actions None. EYE Events Guide 1-55 . Typical Causes Low memory may be caused through a combination of factors. Default severity level: information. Actions None. Typical Causes The cause of low disk space depends on the device. Actions Use the managed host function to view current and historic levels of memory Device Low Total Memory Cleared Indicates the device is no longer suffering from low memory. a network instability pushes the free memory to zero and the device does not have enough memory to begin with but the problem is discovered only during a rare network event.

check the EYE server load. color code: amber. Default severity level: minor. Actions Check the device for polling problems. Actions None. EYE Events Guide 1-56 . Typical Causes Correction of previous DNS problem. is being safely polled. Typical Causes A corruption or incorrect entry in the hosts file. This event indicates that a device was in danger of missing a counter wrap for. the exact steps depend upon your operating system and domain name system configuration. in which case the problem is with EYE.Entuity Device Name Resolution Failure Device Name Resolution Failure Indicates EYE (eyepoller) could reach the device using its IP address but not resolve its device host name. Actions Investigate domain name resolution. Device Port(s) Utilization Accuracy Lost eyepoller counter wrap margin allows EYE to identify devices for which it may miss counter wraps. for example as a result of SNMP timeouts. Default severity level: information. Otherwise this event may suggest that the polling load is beyond EYE's capacity. Typical Causes This event may be triggered if poll operations take longer. This event indicates that the traffic rate is being polled from 32 bit counters and that the combination of the poll rate and linespeed make the resulting measurement susceptible to inaccuracy and the polled data is therefore discarded. not with the network. Device Name Resolution Failure Cleared Indicates EYE can resolve the device hostname. Default severity level: major. Device Port(s) Utilization Accuracy at Risk eyepoller counter wrap margin allows EYE to identify devices for which it may miss counter wraps. An incorrect configuration of the Domain Name System server. color code: green. color code: yellow.

color code: amber. EYE Events Guide 1-57 . for example as a result of SNMP timeouts. Typical Causes Device configuration changes. gathering SysUpTime. power failures. Typical Causes A configuration change to EYE may mean the device is polled more frequently. hardware/software/firmware faults. This may be because the weakest link is now overloaded for some reason. This event is detected by the generation of an SNMP trap on the device. Device Reboot Detected Indicates that a device has recently been rebooted or reset. not with the network. lack of memory on the device. Actions Check the device for polling problems. EYE monitors device system uptime by polling the device every ten minutes. Through Flex Reports you can generate device system uptime reports. Device Port(s) Utilization Missed Due to Slow Response This event indicates that a device has responded too slowly to EYE polling and data has been lost. Typical Causes This event may be triggered if poll operations take longer. in which case the problem is with EYE. Default severity level: severe. color code: orange. Default severity level: major. color code: orange. check the EYE server load. If the polling frequency has not changed and there has been no significant change to the device configuration or loading then SNMP traffic may be being lost either in the device or between the EYE server and the device.Entuity Device Port(s) Utilization Missed Due to Slow Response Default severity level: minor. Default severity level: severe. Otherwise this event may suggest that the polling load is beyond EYE's capacity. color code: yellow. Device Warm Reboot Indicates that a device has just been rebooted or reset. Actions Monitor the polling of the device. Actions Telnet to the device and check the system logs for an indication of what caused the device to reboot.

Typical Causes Peer router has gone down. Actions Investigate the peer router. Actions Check logs are activated on the device. Default severity level: critical. EIGRP Peer Briefly Not Established Indicates to administrators that virtual links between EIGRP speakers are now well established but bounced recently. EIGRP Peer Disappeared Indicates a former adjacent peer has been removed from router’s configuration. color code: red. color code: red. Administrator’s should be aware of this change to be able to detect rogue configuration updates. Default severity level: critical. Actions Telnet to the device and check the system logs for an indication of what caused the device to reboot. hardware/software/firmware faults.Entuity EGP Neighbor Loss Typical Causes Device configuration changes. EYE identifies a recent bounce as the up time is lower than in the previous poll. color code: red. power failures. The SNMP trap includes the identity IP address of the peered router. Typical Causes Removal of an adjacent router. Other causes maybe an unstable remote router. EYE Events Guide 1-58 . Use the logs to investigate error messages. which EYE attempts to resolve to the host name. Default severity level: critical. Typical Causes EIGRP keep-alives may be lost. EGP Neighbor Loss Indicates that the device's peer relationship with an EGP (Extended Gateway Protocol) neighbor no longer exists. traffic shaping limitations. so the local router terminates the connection and then successfully attempt to reestablish it. lack of memory on the device.

Enterprise Trap Indicates Entuity received an enterprise trap for which a mapping has been included to the Entuity database. color code: yellow. EYE Events Guide 1-59 .discovery of a new EIGRP peer. EYE License Expired and This EYE Server is No Longer Operational Indicates the license on the central license server has expired. Typical Causes Entuity received an enterprise trap for which a mapping has been included to the Entuity database. The central license server provides the credits for the remote EYE license client to manage its network. Typical Causes The license installed on the central EYE license server has expired. Typical Causes Configuration of a new EIGRP peer. color code: red. Default severity level: critical. Default severity level: major.Entuity EIGRP Peer Newly Discovered Actions Investigate the cause of router disappearance. The local license determines the modules and integrations enabled on that EYE install. which can be determined from Details. Actions Contact your EYE representative for a new license. Actions Dependent upon the type of trap. EIGRP Peer Newly Discovered Indicates EYE’s. Actions None. this remote EYE server also requires a locally installed valid license. color code: amber. Default severity level: minor.

Default severity level: information. for example for maintenance. color code: yellow. by default seven days. EYE License on Remote Server Successfully Updated Indicates the EYE license server has restored contact to the remote client EYE server. do they indicate a general networking issue. This setting is configurable through entuity. by default two days. EYE License on Remote Server Expired and No Longer Operational Indicates the license for a remote client is no longer verified. without contact from its license server. a general network problem is preventing communication between the EYE servers. This event is raised after a set period of non-contact. but is now online. Default severity level: minor. The license server regularly contacts its remote clients to maintain and verify their license details. The license server provides the credits for the client server to manage its network. for example has it been taken down for scheduled maintenance? Review other raised events. These settings are configurable through entuity. Typical Causes The license server has not contacted its client for a minimum of seven days.cfg. An EYE server using a client license can only run for a limited time. color code: green. without contact from its license server. EYE Events Guide 1-60 .Entuity EYE License on Remote Server Could Not be Updated EYE License on Remote Server Could Not be Updated Indicates the central license server cannot contact one of its remote EYE servers. Typical Causes The central EYE license server was down. A remote server can only run for a limited time.cfg. color code: red. Typical Causes The remote EYE server is down. Actions Check the status of the remote EYE server.cfg. Default severity level: critical. for example has it been taken down for scheduled maintenance? Review other raised events. When running multiple EYE servers and using centralised licensing the local license determines the modules and integrations enabled on that EYE install. do they indicate a general networking issue. Actions Check the status of the remote EYE server. by default seven days. This setting is configurable through entuity.

These settings are configurable through entuity. but is now online. without contact from its license server. a general network problem is preventing communication between the EYE servers.Entuity EYE License Successfully Updated by License Server Actions No action required. Default severity level: minor. This event is raised after a set period of non-contact. color code: red. for example has it been taken down for scheduled maintenance? Review other raised events. by default two days. do they indicate a general networking issue. Actions No action required. Typical Causes The EYE central license server is down. by default seven days. color code: yellow. EYE License Was Not Updated by License Server and Will Expire Indicates the EYE license server cannot contact the remote EYE server. for example for maintenance. color code: yellow. if the space appears sufficient you can amend the diskMonitor threshold settings to values more appropriate to your system. This is a system wide event. The license server regularly contacts its remote clients to maintain and verify their license details. EYE Server Automated Shutdown Event generated by EYE warning it is shutting down. Actions Check the status of the license server.cfg. appearing in all views. Default severity level: critical. EYE License Successfully Updated by License Server Indicates the EYE license server has reestablished contact with this EYE server. Default severity level: minor. Typical Causes Low disk space. EYE Events Guide 1-61 . A remote server can only run for a limited time. This is raised by diskMonitor and indicates EYE is closing down to protect the database from possible corruption. Actions Check server for disk space. Typical Causes The remote EYE license server was down.

color code: red. configuring it inappropriately removes this safeguard. EYE Server Disk Space Alert Indicates the EYE server is running low on disk space. Default severity level: severe. You can view more details through systemcontrol. Typical Causes A component of the EYE server has failed. EYE Server Critical Component Restarting After Failure Indicates a critical EYE component has failed and that EYE is attempting to restart that component. whichever is the earlier. EYE Server Component Restarting After Failure Indicates a non-critical EYE component has failed. EYE Events Guide 1-62 .Entuity h EYE Server Component Restarting After Failure diskMonitor is intended to protect the EYE database from corrupting when the server runs out of disk space. Actions Use the Impacted and Details fields to identify the failed EYE component. Typical Causes A component key to EYE server performance has failed. This is a system wide event. You can view more details through systemcontrol. It persists in the logger pane for twenty-four hours or until the EYE server is restarted. raising an EYE Server Permanent Failure of Component event if it fails to restart the component.log in entuity_home\log. Actions Use the Impacted and Details fields to identify the failed EYE component. Default severity level: severe. color code: orange. This is a system wide event. appearing in all views. EYE will attempt to restart the component. This is a system wide event. appearing in all views. raising an EYE Server Permanent Failure of Component event if it fails to restart the component. for example in Windows an EYE service. It is generated by diskMonitor. color code: orange.log in entuity_home\log. and details the remaining disk space in megabytes. appearing in all views. Typical Causes Low disk space. EYE will attempt to restart the component. Default severity level: critical.

This is a system wide event. appearing in all views. Typical Causes Administrator has taken down the server. color code: yellow. Typical Causes License expiry. Default severity level: minor. Default severity level: critical. Actions Either unmanage objects to free up license credits or contact your Entuity representative and purchase additional credits. Actions Determined by event type. Typical Causes Addition of managed objects or approaching expiry date. EYE Server Internal Event Event generated by EYE.Entuity EYE Server Explicit Shutdown Initiated Actions Check server for disk space. Default severity level: severe. if the space appears sufficient you can amend the diskMonitor threshold settings to values more appropriate to your system. This is a system wide event. reporting on the status of an EYE service. EYE Server License Alert Indicates one or more of EYE’s licensable components is approaching or has reached either its limit of managed objects or expiry date. EYE Events Guide 1-63 . EYE process failure. h diskMonitor is intended to protect the Entuity database from corrupting when the server runs out of disk space. color code: red. Actions When the EYE server has shut itself down investigate available disk space on the server. color code: orange. The event description details the licensable component(s) and the number of free credits. configuring it inappropriately will remove this safeguard. EYE Server Explicit Shutdown Initiated Indicates EYE server has been instructed to shutdown. for example from the command line using stopeye or as a result of critical shortage of disc space. appearing in all views when the EYE server restarts.

The EYE server has then automatically shutdown. This is a system wide event. EYE Server Started Indicates the EYE server has successfully started.log in entuity_home\log. Actions None. Typical Causes Indicates a critical EYE component has failed repeatedly preventing the EYE server from performing normally. Actions Use the Impacted and Details fields to identify the failed EYE component.g. This may indicate an attack. available from entuity_home\log. Firewall Access Control Violations High Indicates the NetContinuum firewall is identifying a high number of access control violations by a managed application.log. or the EYE server is restarted. if possible. DsKernelStatic. Default severity level: critical. color code: green. This is a system wide event. e. Default severity level: critical. appearing in all views. systemcontrol. The component remains down until manually restarted. Actions Investigate the EYE log files.log. Typical Causes Failure to restart a failed EYE component. Typical Causes Indicates the EYE server has successfully started. color code: red. NetContinuum firewalls identify a series of access control type violations: EYE Events Guide 1-64 . but has been unable to do so. You can view more details through systemcontrol. appearing in all views. Default severity level: information. EYE Server Shutdown Forced By Critical Failure To Restart Indicates a critical EYE component has failed repeatedly preventing the EYE server from performing normally. appearing in all views when the EYE server restarts. or an inappropriate firewall configuration for a particular application. This is a system wide event. color code: red.Entuity EYE Server Permanent Component Failure EYE Server Permanent Component Failure Indicates the EYE server has attempted to restart the failed component.

Typical Causes An application is being inappropriately used. Typical Causes Reduced number of control violations. After investigation you may determine an attack has occurred. configurable but by default set to ten.Entuity Firewall Access Control Violations High Cleared       Denied HTTP Requests Blocked DAP Blacklisted Blocked Methods Robots Denied Robots Allowed. or the device state may have transitioned to be the same as User Set Oper State. Default severity level: information. Actions None. Typical Causes User Set Oper State may have been amended to match the state on the device. this may be because users are either consciously or inadvertently attempting to use an application beyond the configured constraints. or types of violation. causing concern. When the total number of access control violations exceeds the set threshold. color code: green. for example. Firewall High Avail User Set Oper State Compliant The High Availability module status on the device and the User Set Oper State set in EYE were different but are now the same. the URL Access Control Lists (ACLs) require adjustment. Default severity level: severe. EYE raises this event. Default severity level: information. from which you can identify the particular types. EYE Events Guide 1-65 . color code: green. Actions EYE includes to the event the source application and the breakdown of access control violations by type. by default EYE polls NetContinuum firewalls every five minutes. Firewall Access Control Violations High Cleared Indicates that the high number of access control violations rate has returned to within acceptable boundaries. color code: orange. or that. EYE sums the total number of violations that occurred during the last polling period.

configurable but by default set to ten. NetContinuum firewalls identify a series of overflow and intrusion type violations:        Keyword Intrusions Query Length Intrusions Cookie Overflow Intrusions Header Count Intrusions Content Overflow Intrusions Parameter Length Overflows Empty Valued. Typical Causes User Set Oper State may have been amended to a state different to that on the device. Firewall Overflow and Intrusion Violations High Indicates the NetContinuum firewall is identifying a high number of overflow and intrusion violations. Firewall High Avail User Set Oper State Non Compliant The High Availability module status on the device and the User Set Oper State set in EYE are different. Default severity level: severe. EYE Events Guide 1-66 . Default severity level: severe. color code: orange. amend the module’s User Set Oper State. or an inappropriate firewall configuration for a particular application. EYE raises this event. More significantly. When the total number of overflow and intrusion violations exceeds the set threshold. It may indicate a serious problem that could impact the performance of the firewall cluster. the device state may have transitioned to a different state to that of User Set Oper State. EYE sums the total number of violations that occurred during the last polling period. by default EYE polls NetContinuum firewalls every five minutes.Entuity Firewall High Avail User Set Oper State Non Compliant Actions None. investigate the cause of the change in module state. The type of disparity determines your action where the change in High Availability module was:  expected and permanent.  unexpected. This may indicate an attack. color code: orange. Actions In Event Viewer the event Details column displays both the User Set Oper State and the polled device state.

EYE Events Guide 1-67 . Firewall Packet Rate High Cleared Indicates that the high packet rate has returned to within acceptable boundaries.Entuity Firewall Overflow and Intrusion Violations High Cleared Typical Causes Forms tampering can modify the information sent from a particular field on a form. from which you can identify the particular types. color code: green. Default severity level: minor. Typical Causes High packet rates could be a sign of a denial-of-service attack. Default severity level: information. causing concern. especially when the system is called upon to carry a large volume of traffic. color code: yellow. Typical Causes Reduced number of overflow and intrusion violations. Actions None. or types of violation. specifically the available bandwidth at the time of transmission is not as great as can be supported by the sending terminal. Actions None. for example adding extra. Actions Identifying and resolving these issues can improve overall network performance. color code: green. Default severity level: information. Firewall Overflow and Intrusion Violations High Cleared Indicates that the high number of overflow and intrusion violations has returned to within acceptable boundaries. malicious instructions through a buffer overflow. Actions EYE includes to the event the source application and the breakdown of overflow and intrusion violations by type. Firewall Packet Rate High Indicates the firewall is encountering congestion. Typical Causes Reduced usage.

Firewall Peak Connections High Cleared Indicates that the high peak connection rate has returned to within acceptable boundaries. this would limit the rate at which people could connect to the site. by default EYE polls NetContinuum firewalls every five minutes. EYE Events Guide 1-68 . configurable but by default set to five hundred. The TCP connection rate is a performance measurement. Actions Identifying and resolving these issues can improve overall network performance. Typical Causes Reduced usage. Typical Causes High packet rates are usually could be a sign of a denial-of-service attack. Actions None. color code: orange.Entuity Firewall Peak Connections High Firewall Peak Connections High This is the rate of new connection setup and tear down. especially when the system is called upon to carry a large volume of traffic. When the total number of URL alerts exceeds the set threshold. For an e-commerce site. EYE raises this event. EYE sums the total number of alerts against the application that occurred during the last polling period. reported in connections per second. Default severity level: information. NetContinuum firewalls identify these types of violations:      URL Encoding Errors Slash Dot URLs Blocked Tilde in URL Blocked Character Set Encoding Errors Bad Certificates. Default severity level: severe. as it places an upper limit on the transaction rate that can be supported through the firewall. color code: yellow. as handled by the firewall. color code: green. Default severity level: minor. Firewall URL Alerts High Indicates the NetContinuum firewall is identifying a high number of URL alerts against a particular application.

hiding an attack within a different character set. Actions None. FR DLCI High BECN Cleared Indicates that the frame relay encountering congestion has returned to within acceptable boundaries. Default severity level: information. or types of URL violation. EYE Events Guide 1-69 . or portions of the system going down. heavy network traffic. specifically the available bandwidth at the time of transmission is not as great as can be supported by the sending terminal. causing concern. Typical Causes Inadequate network infrastructure. FR DLCI High BECN Indicates the frame relay is encountering congestion. Actions None. Default severity level: information. For example. Typical Causes Reduced number of URL alerts against the application. high levels of line noise. color code: green. color code: green. color code: amber. especially when the system is called upon to carry a large volume of traffic. Typical Causes Reduced usage. from which you can identify the particular types. Default severity level: major. The NetContinuum Controller can identify character set encoding schemes and identify attacks hidden within them. Firewall URL Alerts High Cleared Indicates that the number of URL alerts has returned to within acceptable boundaries. Actions EYE includes to the event the source application and the breakdown of URL alerts by type.Entuity Firewall URL Alerts High Cleared Typical Causes An attack can use different ploys based around how URLs are handled. Actions Identifying and resolving these issues can improve overall network performance.

the available bandwidth at the time of transmission is not as great as can be supported by the receiving terminal. i.e. Default severity level: information. traffic gets marked DE by the frame relay switch. if congestion is then detected these packets are dropped.Entuity FR DLCI High DE FR DLCI High DE Indicates that the Committed Information Rate (CIR) has been exceeded on inbound traffic on this PVC. Default severity level: information. Typical Causes Reduced usage. FR DLCI High DE Cleared Indicates that the Committed Information Rate (CIR) has returned to within acceptable boundaries on inbound traffic on this PVC. FR DLCI High FECN Indicates the WAN is encountering congestion forward of the packet. EYE Events Guide 1-70 . Typical Causes Inadequate network infrastructure. Actions Identify and resolve these issues can improve overall network performance. color code: green. high levels of line noise. or portions of the system going down. color code: amber. color code: amber. Actions None. FR DLCI High FECN Cleared Indicates that the Committed Information Rate (CIR) has returned to within acceptable boundaries on outbound traffic on this PVC. Typical Causes When the CIR is exceeded. Default severity level: major. Default severity level: major. especially when the system is called upon to carry a large volume of traffic. color code: green. Actions Use the PVC Utilization report to investigate further. heavy network traffic.

Typical Causes Reduced transmission. Default severity level: major. Actions None.Entuity FR DLCI High Inbound Utilization Typical Causes Reduced usage. Typical Causes PVC utilization is higher than PVC utilization threshold for the port due to increased traffic. color code: amber. FR DLCI High Inbound Utilization Indicates inbound utilization of the port is high and could impact performance. FR DLCI High Outbound Utilization Cleared Indicates PVC utilization in now below the high threshold value. FR DLCI High Inbound Utilization Cleared Indicates PVC utilization in now below the high threshold value. color code: amber. Actions Generate PVC utilization reports to monitor situation. Typical Causes Reduced transmission. Default severity level: information. color code: green. EYE Events Guide 1-71 . Typical Causes PVC utilization higher than PVC utilization threshold for the port due to increased traffic. Default severity level: major. Default severity level: information. FR DLCI High Outbound Utilization Indicates outbound utilization of the port is high and could impact performance. Actions None. Actions Generate PVC utilization reports to monitor situation. color code: green.

color code: green. Actions None. FR DLCI Link UP Indicates PVC is available. HSRP Port Group Activated Indicates the HSRP port is active. Actions Investigate whether the problem occurs on the public or private section of the network. PVC congestion indicated by CIR exceeded. color code: orange. color code: amber. Default severity level: information. color code: amber. Typical Causes When preemption is enabled the newly activated router has a higher priority than the previously active router. Actions None. Default severity level: major. EYE Events Guide 1-72 . FR DLCI Link Down Indicates PVC is unavailable. The previously active router has become unavailable. Typical Causes Problems with connection to router-CSU/DSU devices. Default severity level: major. run PVC reports. Typical Causes A PVC that was unavailable is now available. HSRP Port Group Deactivated Indicates the HSRP port group has transitioned from an active to a deactivated state.Entuity FR DLCI Link Down Actions None. Default severity level: severe. this router was the standby router and has now activated.

Actions Investigate the cause of the transition of the HSRP port group to deactivated when preemption is not enabled. Typical Causes Raised the first time the operation is successfully created on the device. EYE Events Guide 1-73 . Actions 1) Check the correct SNMP write community string is set on the device.Entuity IP SLA Creation Failure Typical Causes Indicates the HSRP port group has transitioned from an active state to one of n/a. there may be access restrictions to the device. Default severity level: critical. You can view the current state through the event details column. color code: red. Typical Causes Packet loss due to equipment impairment and latency due to increased traffic. snmpSet permission). Typical Causes The create command does not include the correct SNMP write community string. including any firewall allows through the appropriate commands (i. Listen. Learn. color code red. Speak. When EYE monitors the router it raises events indicating the cause of failure. Default severity level: critical. A high ICPIF value indicates high impairment. or Standby. Actions None. IP SLA Creation Failure Indicates the creation of an IP SLA operation has failed on the source device. IP SLA High ICPIF ICPIF attempts to quantify the key impairments to voice quality that are encountered in the network. Default severity level: information. Alternatively. but does not indicate that it is collecting data. IP SLA Creation Failure Cleared Indicates the operation was successfully created. 2) Check access is not restricted to the device. color code: green. Initial.e.

Entuity IP SLA High ICPIF Cleared Actions Run a Flex Report to investigate further. Typical Causes Packet loss due to equipment impairment and latency due to increased traffic. Typical Causes VoIP quality of service. Default severity level: information. EYE Events Guide 1-74 . on a scale of 1 (poor quality) to 5 (excellent quality). color code: amber. The opinion scores are averaged to provide the mean for each sample. Typical Causes VoIP quality of service. color code: green. IP SLA Low MOS Cleared Indicates a previous Low MOS alarm has been cleared. Actions Run a Flex Report to investigate further. as measured by MOS. Default severity level: information. IP SLA High ICPIF Cleared Indicates a previous High ICPIF alarm has been cleared. has returned to acceptable levels. Default severity level: critical. Actions No action required. as measured by ICPIF. A wide range of listeners have judged the quality of voice samples sent using particular codecs. has returned to acceptable levels. Actions No action required. IP SLA Test Failed Indicates the operation was successfully created but it failed to connect to the target device. Default severity level: major. color code red. IP SLA Low MOS MOS is a common benchmark used to determine the quality of sound produced by specific codecs. color code: green.

IP SLA Test High Latency Indicates the operation is reporting latency between the source and target device above the threshold settings for the operation. Typical Causes Packet loss due to equipment impairment and latency due to increased traffic. run the IP SLA Details report. 3) Check the target device’s destination port is IP SLA responsive. having previously been above. Default severity level: critical. This is achieved either by having the IP SLA responder enabled or having a process listening on that port. IP SLA Test Succeeded Indicates the operation is successfully collecting data. for example a high latency may only be reported at peak times.Entuity IP SLA Test High Latency Typical Causes There may be access restrictions to the device or a failure on the network. e. EYE Events Guide 1-75 . Default severity level: information. Actions 1) Check the target device is available. When using IP SLA responder’s control packets must also be used (and also allowed through the firewall). 2) Review latency over an extended period. color code: green. Typical Causes The cause of high latency on the network has been resolved. color code red. color code: green. IP SLA Test High Latency Cleared Indicates that the operation is reporting latency between the source and target device that has returned to below its threshold settings. 2) When communicating through a firewall check the IP SLA source port is set correctly. Actions 1) Check the performance of the target device. Default severity level: information. Actions None.g.

KPI Port Duplex Suspected Mismatch (FCS) Cleared This event is only available with the KPI Port Duplex addition to EYE's configuration (contact your Entuity support representative for details). Actions None. LAP Antenna Host Count High For each WAP antenna you can set a maximum number of hosts that they can handle. Typical Causes CRC Errors are generated by the port. color code: green. Default severity level: information. Actions Through Component Viewer you can check the Interface Host Count tab.Entuity KPI Port Duplex Suspected Mismatch (FCS) Typical Causes Raised the first time the operation collects data from a device. reviewing the hourly and daily mean and maximum attached host values. at a higher level than the CRC threshold. Actions None. Typical Causes CRC Errors are generated by the port. Typical Causes Changes in wireless usage have occurred since the network was designed. color code: amber. at a lower level than the CRC threshold. or after a failure in operation collection has been resolved and data is being collected again. Default severity level: major. KPI Port Duplex Suspected Mismatch (FCS) This event is only available with the KPI Port Duplex addition to EYE's configuration (contact your Entuity support representative for details). EYE Events Guide 1-76 . Default severity level: minor. When the historic record indicates a rising usage trend you may want to extend the capabilities of your wireless network. a number higher than the antenna can efficiently handle. color code: yellow. Actions Run the CRC Errors KPI Report and identify if this is a recurring problem.

color code: yellow. Typical Causes Changes in wireless usage have occurred since the network was designed. Actions No action required. Load Balancer High Client Connections The current connections from client-side to the system is higher than the set threshold.Entuity LAP Antenna Host Count High Cleared LAP Antenna Host Count High Cleared Raised when the number of hosts attached to the WAP antenna has returned to an acceptable level. color code: green. Default severity level: critical. color code: green. Default severity level: information. Default severity level: minor. Typical Causes Availability of load balancer servers is insufficient to meet demand. Actions Through Component Viewer you can check the Interface Host Count tab. inefficient assignment of clients to servers. When the historic record indicates a falling usage trend you may want to adjust the capabilities of your wireless network. EYE Events Guide 1-77 . Typical Causes The number of hosts attached to the antenna has returned to an acceptable level. LAP Antenna Host Count Low The combined count of hosts that are wirelessly associated with all of the antennas on a WAP has fallen below the set threshold. color code: red. Actions No action required. Default severity level: information. Typical Causes The number of hosts attached to the antenna has returned to an acceptable level. LAP Antenna Host Count Low Cleared The clearing correlation event for WAP Antenna Host Count Low event. reviewing the hourly and daily mean and maximum attached host values.

Default severity level: critical. Actions No action required. color code: green. Actions No action required. Actions Investigate hardware accelerator performance. Default severity level: information. Load Balancer High Client Hw Accel Connections The current hardware accelerated connections from client-side to the system is higher than the set threshold. Typical Causes Reduced demand on the load balancer. Default severity level: critical. Load Balancer High Client Hw Accel Connections Cleared The current number of hardware accelerated connections from client-side to the system is no longer higher than the set threshold. color code: red. color code: green. Load Balancer High Client Connections Cleared The current number of connections from client-side to the system is no longer higher than the set threshold. Typical Causes Availability of load balancer servers is insufficient to meet demand. EYE Events Guide 1-78 . color code: red. Default severity level: information.Entuity Load Balancer High Client Connections Cleared Actions Investigate availability of load balancers. Load Balancer High Client Connection Limit Pkt Drop Rate The connection requests rejected because they exceeded the connection limit for a virtual server (IP address:Port). inefficient assignment of clients to servers. Typical Causes Reduced demand on the load balancer hardware accelerator.

inefficient assignment of clients to servers.Entuity Load Balancer High Client Connection Limit Pkt Drop Rate Cleared Typical Causes Availability of load balancer servers is insufficient to meet demand. Actions Investigate the client connection history. Actions No action required. color code: red. Load Balancer High Inbound Error Rate Cleared The total incoming packet errors for the system is now within the set threshold. Load Balancer High Inbound Error Rate The total incoming packet errors for the system. Actions Investigate load balancer resourcing and configuration. Actions No action required. Load Balancer High License Denied Pkt Rate Packets were dropped due to exceeding licensing limitations. color code: green. Default severity level: information. Typical Causes Reduced demand on the load balancer hardware accelerator. Default severity level: information. Default severity level: critical. EYE Events Guide 1-79 . Load Balancer High Client Connection Limit Pkt Drop Rate Cleared The connection requests rejected because they exceeded the connection limit for a virtual server (IP address:Port) is now within the set threshold. Typical Causes Availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers. Typical Causes Reduced demand on the load balancer hardware accelerator. color code: green.

Actions No action required. Actions Investigate load balancer resourcing and configuration. Load Balancer High License Denied Pkt Rate Cleared Rate of dropped packets due to exceeding licensing limitations no longer exceeds the set threshold. Typical Causes Availability of load balancer servers is insufficient to meet demand. Default severity level: information.Entuity Load Balancer High License Denied Pkt Rate Cleared Default severity level: critical. color code: red. color code: green. availability of greater load balancer resource. availability of greater load balancer resource. inefficient assignment of clients to servers. Typical Causes Reduced traffic. Typical Causes Availability of load balancer servers is insufficient to meet demand. Default severity level: critical. Load Balancer High Memory Error Pkt Rate Cleared Indicates connection errors that were the result of insufficient available memory are resolved. inefficient assignment of clients to servers. Typical Causes Reduced traffic. color code: green. Actions Investigate load balancer resourcing and configuration. color code: red. Actions No action required. Load Balancer High Memory Error Pkt Rate Indicates connection errors were the result of insufficient available memory. Default severity level: information. EYE Events Guide 1-80 .

color code: green. Actions No action required. color code: red. color code: green. Default severity level: critical. Actions No action required. Typical Causes Availability of load balancer servers is insufficient to meet demand. NAT or SNAT is at a rate greater than the set threshold. Default severity level: information. EYE Events Guide 1-81 . Default severity level: critical. inefficient assignment of clients to servers. Typical Causes Reduced traffic. Actions Investigate client’s server address list. Typical Causes The packets that are not connection requests and are destined for a virtual server that has no connection for the client address. availability of greater load balancer resource. Load Balancer High Non Syn Denied Pkt Rate Cleared Indicates that the packets that are not connection requests and are destined for a virtual server that has no connection for the client address are now at a rate within than the set threshold.Entuity Load Balancer High No Handler Denied Pkt Rate Load Balancer High No Handler Denied Pkt Rate Indicates that the incoming packets that could not be processed by a virtual server. Load Balancer High No Handler Denied Pkt Rate Cleared Indicates that the incoming packets that could not be processed by a virtual server. NAT or SNAT is now at a rate within the set threshold. Load Balancer High Non Syn Denied Pkt Rate Indicates that the packets that are not connection requests and are destined for a virtual server that has no connection for the client address are at a rate greater than the set threshold. color code: red. Default severity level: information.

color code: green.Entuity Load Balancer High Outbound Error Rate Typical Causes Client now has access to the virtual server. color code: green. color code: red. inefficient assignment of clients to servers. Load Balancer High Packet Drop Rate Cleared The total number of dropped packets is within the set threshold. Load Balancer High Packet Drop Rate The total number of dropped packets is higher than the set threshold. Default severity level: information. Default severity level: critical. Typical Causes Availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers. Load Balancer High Outbound Error Rate The total outgoing packet errors for the system is greater than the set threshold. Typical Causes Reduced traffic. Actions Investigate load balancer resourcing and configuration. EYE Events Guide 1-82 . Default severity level: information. Typical Causes Availability of load balancer servers is insufficient to meet demand. Actions No action required. color code: red. Actions Investigate load balancer resourcing and configuration. availability of greater load balancer resource. Default severity level: critical. Load Balancer High Outbound Error Rate Cleared The total outgoing packet errors for the system is now within the set threshold. Actions No action required.

Typical Causes Availability of load balancer servers is insufficient to meet demand. Load Balancer High Server Connections The current connections from server-side to the system is higher than the set threshold. color code: green. Actions Investigate load balancer resourcing and configuration.Entuity Load Balancer High Server Connections Typical Causes Reduced traffic. Typical Causes Availability of load balancer servers is insufficient to meet demand. Default severity level: critical. inefficient assignment of clients to servers. color code: red. inefficient assignment of clients to servers. Actions No action required. Actions No action required. color code: red. Actions Investigate load balancer resourcing and configuration. EYE Events Guide 1-83 . Default severity level: critical. Typical Causes Reduced demand on the load balancer. Load Balancer High Server Hw Accel Connections The current hardware accelerated connections from server-side to the system is higher than the set threshold. Default severity level: information. Load Balancer High Server Connections Cleared The current number of connections from server-side to the system is no longer higher than the set threshold. availability of greater load balancer resource.

color code: green. Actions None. Default severity level: information. Default severity level: information. color code: red. Typical Causes CPU utilization is greater than the set threshold in the one second before the device is polled.Entuity Load Balancer High Server Hw Accel Connections Cleared Load Balancer High Server Hw Accel Connections Cleared The current number of hardware accelerated connections from server-side to the system is no longer higher than the set threshold. The device is polled every five minutes. Typical Causes CPU utilization has reverted to a value below the set threshold. EYE Events Guide 1-84 . color code: green. Default severity level: critical. color code: red. Load Balancer Nortel High MP CPU 4sec Utilization Raised against a snapshot of CPU utilization in the four seconds before the device is polled. Typical Causes CPU utilization is greater than the set threshold in the four seconds before the device is polled. Actions No action required. Default severity level: critical. The device is polled every five minutes. Load Balancer Nortel High MP CPU 1sec Utilization Cleared The one second CPU utilization value is within the set threshold. Typical Causes Reduced demand on the load balancer. Load Balancer Nortel High MP CPU 1sec Utilization Raised against a snapshot of CPU utilization in the one second before the device is polled. Actions Investigate the history of the CPU utilization for the load balancer.

Default severity level: information. Default severity level: critical. Default severity level: information. color code: green. color code: red. color code: green. Typical Causes CPU utilization has reverted to a value below the set threshold. Typical Causes CPU utilization is greater than the set threshold in the sixtyfour seconds before the device is polled. Default severity level: critical. The device is polled every five minutes. Actions None. Load Balancer Nortel High MP CPU 4sec Utilization Cleared The four second CPU utilization value is within the set threshold. Load Balancer Nortel High MP CPU 64sec Utilization Raised against a snapshot of CPU utilization in the sixtyfour seconds before the device is polled. Actions Investigate the history of the CPU utilization for the load balancer.Entuity Load Balancer Nortel High MP CPU 4sec Utilization Cleared Actions Investigate the history of the CPU utilization for the load balancer. Typical Causes CPU utilization has reverted to a value below the set threshold. Load Balancer Nortel High Real Server Current Sessions Raised against the number of sessions that are currently handled by the real server. Load Balancer Nortel High MP CPU 64sec Utilization Cleared The sixtyfour second CPU utilization value is within the set threshold. Actions None. EYE Events Guide 1-85 . color code: red.

Load Balancer Nortel High Real Server Max Sessions Raised against the highest sessions that have been handled by the real server. color code: green. color code: red. Actions Investigate the session history of the device. EYE Events Guide 1-86 . Default severity level: information. Typical Causes Highest number of current sessions is greater than the set threshold when the device is polled. Typical Causes A reduction in the number of real server sessions. Actions None. Load Balancer Nortel High Real Server Max Sessions Cleared The maximum number of real server sessions has transitioned to a value within the set threshold.Entuity Load Balancer Nortel High Real Server Current Sessions Cleared Typical Causes Number of current sessions is greater than the set threshold when the device is polled indicating an overutilized device. Load Balancer Nortel High Real Server Current Sessions Cleared The current number of real server sessions has transitioned to a value within the set threshold. Default severity level: information. color code: green. Typical Causes A reduction in the maximum number of real server sessions. Default severity level: critical. Actions Investigate the session history of the device. Actions None.

Typical Causes Number of available members is less than the set threshold when the device is polled. Typical Causes Highest number of current sessions is greater than the set threshold when the device is polled. Load Balancer Pool Critical Member Availability The number of members available to the pool is reduced to a critical level.Entuity Load Balancer Nortel High SLB SP Current Sessions Load Balancer Nortel High SLB SP Current Sessions Raised against the current number of SLB SP sessions when it is higher than the set threshold. color code: green. Load Balancer Pool Critical Member Availability Cleared The number of members available to the pool has transitioned to a value within the set threshold. Default severity level: information. Actions Investigate the session history of the device. color code: green. color code: red. Typical Causes A reduction in the number of real server sessions. Default severity level: information. Actions None. Load Balancer Nortel High SLB SP Current Sessions Cleared The number of SLB SP current sessions has transitioned to a value within the set threshold. color code: red. Default severity level: critical. Actions None. EYE Events Guide 1-87 . Typical Causes A reduction in the resources used for the load balancer pool. Default severity level: critical. Actions Investigate the history of member usage for the pool.

Typical Causes Number of available members is less than the set threshold when the device is polled. availability of greater load balancer resource. Typical Causes Reduced traffic. Default severity level: information. color code: green. Actions None. Typical Causes A reduction in the resources used for the load balancer pool. Default severity level: critical. Load Balancer Virtual Server High Average Connection Duration The mean connections in duration from client-side which is from the connection originated to a terminated period is greater than the set threshold. Default severity level: major. color code: green. color code: red. availability of greater load balancer resource. Load Balancer Virtual Server High Average Connection Duration Cleared The mean connections in duration from client-side which is from the connection originated to a terminated period is now within the set threshold. Actions No action required.Entuity Load Balancer Pool Low Member Availability Load Balancer Pool Low Member Availability The number of members available to the pool is reduced to a low level. EYE Events Guide 1-88 . Actions No action required. Actions None. Typical Causes Reduced traffic. Default severity level: information. color code: amber. Load Balancer Pool Low Member Availability Cleared The number of members available to the pool has transitioned to a value within the set threshold.

Actions No action required. color code: green. color code: green. Actions No action required. color code: red. Typical Causes Reduced traffic. EYE Events Guide 1-89 . Default severity level: information. Typical Causes Reduced traffic. availability of greater load balancer resource.Entuity Load Balancer Virtual Server High Connection Request Rate Load Balancer Virtual Server High Connection Request Rate The total number of requests going through the specified virtual server is greater than the set threshold. Default severity level: critical. Default severity level: information. Load Balancer Virtual Server High Ephemeral Connections The total number of ephemeral connections going through the specified virtual server is greater than the set threshold. Load Balancer Virtual Server High Connection Request Rate Cleared The total number of requests going through the specified virtual server is now within than the set threshold. Typical Causes Reduced traffic. Default severity level: critical. color code: red. availability of greater load balancer resource. availability of greater load balancer resource. Typical Causes Reduced traffic. Actions No action required. availability of greater load balancer resource. Load Balancer Virtual Server High Ephemeral Connections Cleared The total number of ephemeral connections going through the specified virtual server is within the set threshold.

Actions Investigate why the device is handling so many MAC addresses. Typical Causes Reduced traffic. Typical Causes Reduced traffic. color code: amber. availability of greater load balancer resource. by default set to three. color code: green. EYE does not raise this event against trunking ports. and monitor the impact on its performance. It can be enabled through Threshold Settings by setting the number of MAC addresses you consider is a high MAC address count. Actions No action required.Entuity Load Balancer Virtual Server High Hw Accel Connections Actions No action required. MAC Address High Port Count This is a threshold-based event and is disabled by default. If you judge the: EYE Events Guide 1-90 . color code: red. availability of greater load balancer resource. Default severity level: information. Default severity level: major. Typical Causes macman compares the number of MAC addresses discovered on a port against the EYE threshold set for that port. Actions No action required. Default severity level: critical. Load Balancer Virtual Server High Hw Accel Connections The current hardware accelerated connections going through the specified virtual server is greater than the set threshold. Load Balancer Virtual Server High Hw Accel Connections Cleared The current hardware accelerated connections going through the specified virtual server is within the set threshold.

h A twenty-four hour inhibit period allows provost scheduled macman to run and discover MAC addresses. which prevents EYE from raising a torrent of events caused by EYE discovering new devices. EYE considers a new MAC address as one not listed in the retained history of MAC addresses for the current port. Actions None. for all of the ports on the current port’s device or as a global change for all of the port’s managed by the server.  event is not appropriate for the port you can disable it for the individual port. color code: green. By default this inhibit time is twenty-four hours. By default EYE retains the last fifty MAC addresses discovered on a port. raising one event for all of the new MAC addresses on the port. and events are raised within that context.cfg. EYE checks for changes in port state every hour.  for the very first mac address(es) seen on a port. When macman is run through macScheduler then that baseline can be discovered earlier and EYE can ignore the inhibit time. EYE raises both events against this port.Entuity MAC Address High Port Count Cleared  threshold setting is too low you can amend it for the individual port. Typical Causes Number of MAC addresses associated with the port is now within the set thresholds. providing a base against which new and change events can be recognized. to avoid a blizzard of events when EYE manages new devices  for any mac addresses that recur on a port. h When the conditions of the new MAC address match the criteria of the MAC Address Port Change event. MAC Address New EYE discovers one or more new mac addresses on a port. Default severity level: information. MAC Address High Port Count Cleared Indicates a previous MAC Address High port Count alarm associated with this port has been cleared. although this is configurable through machistorylimit in entuity. EYE does not raise events:  for newly discovered ports within a defined inhibit time. for all of the ports on the current port’s device or as a global change for all of the port’s managed by the server. but it is configurable through the MAC Addresses threshold tab. EYE Events Guide 1-91 . This is a threshold-based event and is disabled by default.

g. together with the ports it was last seen on and the ports it is now seen on. MAC Address Port Change When EYE discovers a MAC address that is new to the current port. and events are raised within that context. it now discovers on an additional port. h When the conditions of the port change MAC address match the criteria of the MAC Address New event EYE also raises a MAC Address New event against this port. but which it has a record of occurring on one or more other ports. insufficient anti-virus protection which could allow access to malicious worms. is plugged into an access layer switch that EYE manages. Although the introduction of a new host might be a benign event it requires further investigation as it may:  indicate a personally owned device has connected to the network.Entuity MAC Address Port Change Default severity level: major. EYE raises a MAC Address New event. For example when a host. specifying the mac address. it raises a MAC Address Port Change event. is unplugged from one access layer switch that EYE manages and plugged into another. or ports. For example when a host. EYE raises a MAC Address Port Change event. which may be compromised. Typical Causes A MAC address macman previously discovered on one port. EYE raises the event against the first new port (in terms of lexicographic listing).  be the signature of the introduction of an unauthorized Wireless Access Point which might not have its security configuration enabled (they are unsecured by default) and would therefore invite intrusion to an otherwise secure network. adware. e. EYE Events Guide 1-92 . such as a PC. Actions May indicate a security concern that requires further investigation. This is a threshold-based event and is disabled by default. such as a PC. color code: amber. Typical Causes EYE discovers a new MAC address on a managed port. although this is configurable through machistorylimit in entuity. Actions When this event is not accompanied by a MAC Port Address Port Change event it is a warning to you that a new host has connected to your network. viruses and other infectious material. Default severity level: major. By default EYE retains the last fifty MAC addresses discovered on a port. EYE considers a change MAC address as one not listed in the retained history of MAC addresses for that port. EYE checks for changes in port state every hour. but listed in the retained history of MAC addresses for one or more other ports.cfg. color code: amber.

Typical Causes Addition of a module on the device. color code: red. Default severity level: minor. color code: red. Module Discovered Indicates discovery of a module (card) for a device EYE already manages. It may also be raised when a device is added to EYE. Typical Causes Removal of a module by an administrator. Actions None. color code: yellow. Default severity level: critical. This may happen. when creating an event through the Open Trap Receiver and the event being raised before Event Viewer has updated its tables to recognize the event. Default severity level: n/a Color code: white. the event has not been received by the client. Module Down Indicates a module (card) fault for a device. EYE Events Guide 1-93 . Actions When the module has failed the system administrator should investigate. A hardware swap out may need to be scheduled depending on the type of problem. Critical failure of a module on the device. this should be a temporary issue resolved when EYE’s tables and event caches are synchronized. for example. After the next refresh the event would be properly recognized.Entuity Missing Events Missing Events These are generated when EYE detects an event has occurred but cannot display it. Module Disappeared Indicates a module (card) is no longer on a device. Default severity level: critical. Typical Causes This indicates EYE has raised an event for which it does not have record for that type in its database.e. Actions None. You can Telnet to the device and check the system settings for an indication of what the problem is. i.

Module OK Indicates that a module (card) fault for a device has been cleared. A hardware swap out may need to be scheduled depending on the type of problem. color code: orange. Actions Telnet to the device and check the system settings for an indication of what the problem is. Module Minor Fault Indicates that a device has a minor module (line card) hardware or firmware problem. Default severity level: severe. Actions Telnet to the device and check the system settings for an indication of what the problem is. color code: red. Default severity level: information. Typical Causes Faulty card hardware or firmware. A hardware swap out may need to be scheduled depending on the type of problem. Module Status Unknown Indicates that Entuity cannot determine the status of the device. Typical Causes Faulty card hardware or firmware. Module Major Fault Indicates that a device has a major module (line card) hardware or firmware problem Default severity level: critical. Typical Causes Faulty module (card) has been swapped out. Actions Telnet to the device and check the system settings for an indication of what the problem is. color code: green. A hardware swap out may need to be scheduled depending on the type of problem. EYE Events Guide 1-94 .Entuity Module Major Fault Typical Causes Faulty module card hardware or firmware. Actions None.

Actions None. Actions Investigate the entity configuration. MPLS LDP Entity Errors Cleared The LDP entity no longer has associated errors. color code: green. Actions Telnet to the device and check the system settings for an indication of what the problem is. EYE Events Guide 1-95 . A hardware swap out may need to be scheduled depending on the type of problem. Typical Causes Entity errors may be:        Bad LDP Identifier Errors Bad PDU Length Errors Bad Message Length Errors Bad Message Length Errors Bad TLV Length Errors Malformed TLV Value Errors Keep Alive Timer Expiry Errors. Typical Causes Faulty card hardware or firmware. color code: amber. color code: red. Default severity level: critical. improvement in network performance. Default severity level: critical. Typical Causes A corrected configuration. MPLS LDP Entity Non-operational Indicates the LDP session state has transitioned from operational to a non-operational state.Entuity MPLS LDP Entity Errors Default severity level: major. Default severity level: information. MPLS LDP Entity Errors The LDP entity represents a label space that is targeted for distribution to an LDP peer. color code: red. The event includes the LDP entity device and associated LDP peer.

Entuity

MPLS LDP Entity Operational

Typical Causes
Indicates the LDP session state has transitioned from operational.

Actions
The event includes the LDP entity device and associated LDP peer. Investigate the entity configuration; the event includes the new state of the session:

    

Unknown Non existent Initialized Open Receive Open Sent.

MPLS LDP Entity Operational
Indicates the LDP session state has transitioned from a non-operational to an operational state. Default severity level: information, color code: green.

Typical Causes
The session is operational as the LSR has received acceptable initialization and keep alive messages.

Actions
None.

MPLS LDP Entity Rejected Sessions
LSR has received a session initialization message but has rejected the session. Default severity level: critical, color code: red.

Typical Causes
One or more of the session parameters, for example LDP protocol version, label distribution method, timer values are not acceptable. The LSR responds by sending a Session Rejected/ Parameters Error Notification message and closing the TCP connection.

Actions
Investigate the configuration of the LSR.

MPLS LDP Entity Rejected Sessions Cleared
The LDP entity has now accepted the session. Default severity level: information, color code: green.

EYE Events Guide

1-96

Entuity

MPLS LDP Entity Shutdown Notifications Received

Typical Causes
The LDP entity has now accepted the session.

Actions
None.

MPLS LDP Entity Shutdown Notifications Received
The LSR has received a shutdown notification message from the peered LSR. Default severity level: critical, color code: red.

Typical Causes
When the last Hello adjacency for a LDP session is deleted, the connected LSR terminates the LDP session. The peer may close the session when it concludes that the transport connection is bad or that the peer has failed, and it terminates the LDP session by closing the transport connection.

Actions
Investigate the network connection, the status of the LSR.

MPLS LDP Entity Shutdown Notifications Received Cleared
The integrity of the LDP session has been reestablished. Default severity level: information, color code: green.

Typical Causes
The peered LSR prematurely sent a session terminated notification message, which was subsequently followed by a Want To Reestablish session message.

Actions
None.

MPLS LDP Entity Shutdown Notifications Sent
When the last Hello adjacency for a LDP session is deleted, the LSR terminates the LDP session. Default severity level: critical, color code: red.

Typical Causes
The LSR may close the session when it concludes that the transport connection is bad or that the peer has failed, and it terminates the LDP session by closing the transport connection.

Actions
Investigate the network connection, the status of the LSR.

EYE Events Guide

1-97

Entuity

MPLS LDP Entity Shutdown Notifications Sent Cleared

MPLS LDP Entity Shutdown Notifications Sent Cleared
The integrity of the LDP session has been reestablished. Default severity level: information, color code: green.

Typical Causes
The LSR prematurely sent a session terminated notification message, which was subsequently followed by a Want To Reestablish session message.

Actions
None.

MPLS LDP Peer Disappeared
The LSR peer has disappeared, an Entity Shutdown Notification message may already have been raised. Default severity level: critical, color code: red.

Typical Causes
The session has been shutdown and so the peer has disappeared. The administrator may have reconfigured\removed the LSR. Alternatively the LSR may have encountered problems.

Actions
When the disappearance is unexpected EYE may have raised additional events that indicate the cause of the disappearance.

MPLS LDP Peer Newly Discovered
A newly discovered LDP peer indicates the establishment of a new LDP session. Default severity level: information, color code: green.

Typical Causes
Administrator has added a new LSR to your network.

Actions
Check that the newly discovered peer is an expected LSR, an unexpected LSR may indicate a security failure.

MPLS LDP Peer Non-operational
Indicates the LDP session state has transitioned from an operational to a non-operational state. Default severity level: critical, color code: red.

Typical Causes
The event associated LDP peer has a state other than operational:
EYE Events Guide 1-98

for example after the device has been rebooted. Actions None. MPLS LDP Peer TLV Errors Cleared A previous message from the peered LSR had corrupt content. the subsequent message was correctly formed. Default severity level: information.Entuity MPLS LDP Peer Operational      Unknown Non existent Initialized Open Receive Open Sent. EYE Events Guide 1-99 . has been resolved. color code: green. Default severity level: critical. color code: red. color code: green. MPLS LDP Peer TLV Errors The peer has received a packet of the correct type but of unknown content. Typical Causes Peer has returned to an operational state. for example transport problems. MPLS LDP Peer Operational Indicates the LDP peer state has transitioned from a non-operational to an operational state. Typical Causes The state that caused corrupt content. Default severity level: information. Actions The event includes the non-operational peer’s device name and advertised IP address that you can use to investigate the state of the peer. Actions Check the sending LSR configuration. Actions None. Typical Causes The content may have been corrupted during transmission across the network.

Default severity level: information. Actions None. Typical Causes The interface is receiving packets for which it has appropriate lookup table entries. color code: green. MPLS LDP Peer Unknown Message Types Cleared A previous message from the peered LSR was of a type this LSR did not recognize. Actions None. MPLS LSR Interface High Discard Rate (Lookup Failure) Cleared Indicates the interface’s discard rate caused by lookup failure has transitioned to below the set threshold. Typical Causes There were no forwarding rules for these received packets. Default severity level: severe. Actions Check the configuration of your forwarding tables. EYE Events Guide 1-100 . Typical Causes LSR’s support a defined set of message types.Entuity MPLS LDP Peer Unknown Message Types MPLS LDP Peer Unknown Message Types The LDP peer received a message of an unknown type. a packet that includes a message type not configured to the LSR cannot be processed. Default severity level: information. color code: orange. color code: green. color code: red. Actions Check the supports message types on the LSRs. Default severity level: critical. MPLS LSR Interface High Discard Rate (Lookup Failure) Indicates the number of labelled packets that have been received on this interface and were discarded because there were no matching entries found for them in mplsInSegmentTable. Typical Causes The most recent packet from the peer is of a supported message type.

Typical Causes The LSR may be short of buffer space. e. Default severity level: severe. Default severity level: information. has been resolved. color code: green. Default severity level: severe. or traffic to the LSR may have dropped. that the LSR discarded is above the set threshold. MPLS LSR Interface High Error Free Discard Rate (TX) The rate per second of outbound labelled packets. Actions None. color code: green.g. for which no error was detected. Actions Check the LSR configuration. e. Default severity level: information. low buffer space. Typical Causes The LSR may be short of buffer space. low buffer space. or traffic to the LSR may have dropped. there may also be low buffer events raised for the device. Typical Causes The initial reason for discarding packets.g. Actions Check the LSR configuration.Entuity MPLS LSR Interface High Error Free Discard Rate (RX) MPLS LSR Interface High Error Free Discard Rate (RX) The rate per second of inbound labelled packets. there may also be low buffer events raised for the device. MPLS LSR Interface High Error Free Discard Rate (TX) Cleared Indicates the interface’s discard rate of error free packets has transitioned to below the set threshold. color code: orange. color code: orange. that the LSR discarded is above the set threshold. EYE Events Guide 1-101 . has been resolved. MPLS LSR Interface High Error Free Discard Rate (RX) Cleared Indicates the interface’s discard rate of error free packets has transitioned to below the set threshold. Typical Causes The initial reason for discarding packets. for which no error was detected.

Entuity

MPLS LSR Interface High Fragmentation Rate

Actions
None.

MPLS LSR Interface High Fragmentation Rate
This event indicates the number of outgoing MPLS packets that required fragmentation before transmission on this interface is above the set threshold. Default severity level: severe, color code: orange.

Typical Causes
An interface capacity mismatch causes incoming packets to be fragmented before they can be transmitted. Fragmentation is a resource intensive process and can adversely affect LSR performance.

Actions
Configure the LSR to send and receive compatible sized packets.

MPLS LSR Interface High Fragmentation Rate Cleared
Indicates the interface’s fragmentation rate of has transitioned to below the set threshold. Default severity level: information, color code: green.

Typical Causes
A reconfiguration of the involved interfaces, a drop in traffic on the interface.

Actions
None.

MPLS LSR Interface Low Bandwidth
Indicates the total amount of available bandwidth available on this interface is below the set threshold. Available bandwidth is calculated as the difference between the amount of bandwidth currently in use and total bandwidth. Default severity level: severe, color code: orange.

Typical Causes
Overused interface.

Actions
For an interface showing consistently low bandwidth consider adjusting its load.

MPLS LSR Interface Low Bandwidth Cleared
Indicates the amount of free bandwidth on the interface has transitioned to below the low bandwidth threshold.

EYE Events Guide

1-102

Entuity

MPLS LSR Interface Low Buffer Space

Default severity level: information, color code: green.

Typical Causes
Reduced load on the interface.

Actions
None.

MPLS LSR Interface Low Buffer Space
Indicates the total amount of available buffer space available on this interface is below the set threshold. Available buffer space is calculated as the difference between the amount of buffer space currently in use and total buffer space. Default severity level: severe, color code: orange.

Typical Causes
Overused interface.

Actions
For an interface showing consistently low buffer space consider adjusting its load.

MPLS LSR Interface Low Buffer Space Cleared
Indicates the amount of free buffer space on the interface has transitioned to above the low buffer space threshold. Default severity level: information, color code: green.

Typical Causes
Reduced load on the interface.

Actions
None.

MPLS LSR Platform High Discard Rate (Lookup Failure)
Indicates the number of labelled packets that have been received on this platform and were discarded because there were no matching entries found for them in mplsInSegmentTable. Default severity level: severe, color code: orange.

Typical Causes
There were no forwarding rules for these received packets.

Actions
Check the configuration of your forwarding tables.

EYE Events Guide

1-103

Entuity

MPLS LSR Platform High Discard Rate (Lookup Failure) Cleared

MPLS LSR Platform High Discard Rate (Lookup Failure) Cleared
Indicates the platform’s discard rate caused by lookup failures has transitioned to below the set threshold. Default severity level: information, color code: green.

Typical Causes
The platform is receiving packets for which it has appropriate lookup table entries.

Actions
None.

MPLS LSR Platform High Error Free Discard Rate (RX)
The rate per second of inbound labelled packets, for which no error was detected, that the LSR discarded is above the set threshold. Default severity level: severe, color code: orange.

Typical Causes
The LSR may be short of buffer space.

Actions
Check the LSR configuration, there may also be low buffer events raised for the device.

MPLS LSR Platform High Error Free Discard Rate (RX) Cleared
Indicates the platform’s discard rate of error free packets has transitioned to below the set threshold. Default severity level: information, color code: green.

Typical Causes
The initial reason for discarding packets, e.g. low buffer space, has been resolved, or traffic to the LSR may have dropped.

Actions
None.

MPLS LSR Platform High Error Free Discard Rate (TX)
The rate per second of outbound labelled packets, for which no error was detected, that the LSR discarded is above the set threshold. Default severity level: severe, color code: orange.

Typical Causes
The LSR may be short of buffer space.

EYE Events Guide

1-104

or traffic to the LSR may have dropped. low buffer space. Actions None. Actions Configure the LSR to send and receive compatible sized packets. Typical Causes The initial reason for discarding packets. there may also be low buffer events raised for the device. color code: green. Default severity level: information. Actions None. e.g. has been resolved. MPLS LSR Platform High Fragmentation Rate This event indicates the number of outgoing MPLS packets that required fragmentation before transmission on this platform is above the set threshold. MPLS LSR Platform High Error Free Discard Rate (TX) Cleared Indicates the platform’s discard rate of error free packets has transitioned to below the set threshold. Default severity level: information. Typical Causes A reconfiguration of the involved interfaces.Entuity MPLS LSR Platform High Error Free Discard Rate (TX) Cleared Actions Check the LSR configuration. Fragmentation is a resource intensive process and can adversely affect LSR performance. color code: orange. MPLS LSR Platform High Fragmentation Rate Cleared Indicates the platform’s fragmentation rate has transitioned to below the set threshold. a drop in traffic on the platform. Default severity level: severe. MPLS VRF High Illegal Label Rate The VRF is receiving packets with labels for which it is not configured at a rate above the set threshold. color code: green. Typical Causes An interface capacity mismatch causes incoming packets to be fragmented before they can be transmitted. EYE Events Guide 1-105 .

color code: red. Default severity level: information. color code: green. MPLS VRF Interface BGP Neighbor Disappeared The interface has not received the BGP keep alive message within the set time. Default severity level: minor. This may indicate a misconfiguration or security problem. color code: orange. Typical Causes The VRF is receiving packets from an area of the network for which it is not configured. EYE Events Guide 1-106 . MPLS VRF High Illegal Label Rate Cleared The VRF is receiving packets with labels for which it is not configured at a rate below the set threshold.Entuity MPLS VRF High Illegal Label Rate Cleared Default severity level: severe. Typical Causes This may be. or the route to the router is down. Actions None. Default severity level: critical. MPLS VRF Interface BGP Neighbor Newly Discovered A new BGP neighbor has been added to the network. Actions Where you have concerns over security check the new neighbor is expected. Typical Causes A misconfiguration has been corrected. for example. color code: yellow. Actions When the involved devices are managed by EYE you view router status. because the router has gone. Actions Investigate the source of the illegal labels. Typical Causes The administrator has added a new BGP neighbor to the network.

EYE Events Guide 1-107 . MPLS VRF Operational Indicates the VRF has transitioned from a non-operational to an operational state. Actions Check the number of interfaces. Default severity level: information. This may be caused by a routing problem. Typical Causes VRF has returned to an operational state. color code: red. For router ports a filter ensures only ports with an associated IP address are included. and that its corresponding device is not managed by EYE. interface shutdown.  Port Unreachable: Indicates that a port is not responding to a ping. All of the IP addresses of a network node do not respond to ping.Entuity MPLS VRF Non-operational MPLS VRF Non-operational When the number of active interfaces associated with a VRF is zero.  Node Unreachable: Indicates that a node (typically a router or a switch) has transitioned to the down state. then the VRF is not operational. None.  Unmanaged IP Address Unreachable: Indicates that the device management IP address is not responding to ping. and check the configuration. or a change in configuration has removed all of the interfaces associated with the VRF. This may be caused by a routing problem. unreachability of a managed port. Typical Causes The Details column in Event Viewer indicates the particular cause of the outage:  Managed IP On Device Unreachable: Indicates that an IP address is not responding to ping. Network Outage Indicates an outage on your network. color code: green. caused for example by node failure. Typical Causes The interfaces associated with the VRF are down. color code: red. but the device is managed by EYE. The port for the IP address is not managed by EYE. Availability of ports that fail the criteria is handled through the Port Available to SNMP Poll events. Default severity level: critical. Actions None. interface shutdown. for example after the device has been rebooted. Default severity level: critical.

You can view the actual impacted components or at least those components for which you have permission to view .  Unmanaged IP Address Unreachable: Attempt to ping the device. then this event indicates that there may be a network problem. If the device reporting the event is a switch then check what is attached to the port. Typical Causes The Details column in Event Viewer indicates the particular network outage clearance:  Managed IP Address Reachable: Indicates that an IP address is once again responding to ping. then this event indicates that there may be a network problem.Entuity Network Outage Cleared  EYE Server disconnected from network. and that its corresponding device is not managed by EYE. If it is a trunk or a server port. indicates the connection of the EYE server to the network.  Port Reachable: Indicates that a port is once again responding to ping. Default severity level: information. unreachability of a managed port is now resolved.  Port Unreachable: Attempt to ping the device.  Node Unreachable: If the device reporting the event is a switch then check what is attached to the port. If the device reporting the event is a switch then check what is attached to the port. caused for example by node failure. then Telnet to the router to ascertain possible causes for the outage. then this event indicates that there may be a network problem. color code: green.  Node Reachable: Indicates that a node (typically a router or a switch) has transitioned to the up state. If the device reporting the event is a router. servers and applications impacted by the node failure.  EYE Server connected to the network. If it is a trunk or a server port. Network Outage Cleared Indicates an outage on your network.  Unmanaged IP Address Reachable: Indicates that the device management IP address is once again responding to ping. On raising of a network outage event the particular action to take depends upon the event type:  Managed IP On Device Unreachable: Attempt to ping the device. EYE Events Guide 1-108 . then this event indicates that there may be a network problem. If the device reporting the event is a switch then check what is attached to the port. but the device is managed by EYE. For router ports a filter ensures only ports with an associated IP address are included. indicates the disconnection of the EYE server from the network. If it is a trunk or a server port. If it is a trunk or a server port. The port for the IP address is not managed by EYE.by opening from the context sensitive menu the Impacted Items action. Actions In the Impacted column of Event Viewer EYE displays a count of the nodes. All of the IP addresses of a network node do not respond to ping.

EYE Events Guide 1-109 . Actions None. Default severity level: minor. Other causes maybe an unstable remote router. OSPF Peer Established Indicates to administrators that virtual links between OSPF peers are well established. Actions Check logs are activated on the device. Actions Investigate the cause of router disappearance. Default severity level: critical. color code: red. OSPF Peer Briefly Not Established Indicates to administrators that virtual links between OSPF speakers are now well established but bounced recently. color code: red. the state has just transitioned to Full. color code: yellow. Typical Causes Removal of an adjacent router. Use the logs to investigate error messages. Typical Causes OSPF peering established. Default severity level: critical. traffic shaping limitations.Entuity OSPF Peer Briefly Not Established Actions None. OSPF Peer Disappeared Indicates a former adjacent peer has been removed from router’s configuration. so the local router terminates the connection and then successfully attempt to reestablish it. Typical Causes OSPF keep-alives may be lost. EYE identifies a recent bounce as the up time is lower than in the previous poll. Administrator’s should be aware of this change to be able to detect rogue configuration updates.

Port Duplex Change Indicates that an Ethernet port has changed from half to full duplex or vice versa. Port Error Disable Alarm On Cisco Stack devices EYE identifies the additional port status. Actions Use the ping and show route commands to verify network connectivity to the OSPF peer. color code: red. The state has just transitioned out of the Full state. color code: red. color code: yellow. auto. Default severity level: information. Default severity level: critical. Contact your Entuity Support representative for details. h This event is only enabled through additions to EYE’s configuration. error disabled port. Typical Causes Configuration of a new OSPF peer.discovery of a new OSPF peer. Default severity level: minor. Typical Causes Configuration change. Typical Causes Problems with IP reachability or incorrect OSPF configuration. EYE Events Guide 1-110 .detection mechanism has detected a duplex change on the attached PC or server NIC card. You can use the show log messages command to look for errors relating to the peer.Entuity OSPF Peer Newly Discovered OSPF Peer Newly Discovered Indicates EYE’s. Actions None. color code: green. OSPF Peer Not Established Indicates to administrators that a former adjacent peer is no longer in reach. Actions None. Default severity level: critical.

Port High Inbound Discards (Dynamic) Indicates that a port is dropping some packets in its receive buffers. then more bandwidth may be needed. transmit buffer sizes too small. as applications timeout and re-transmit data intermittently. in general. Actions None. Actions A port in this state will not come up again unless manually re-enabled by the network administrator. color code: green. This only happens if sysErrDisableTimeoutEnable is set for the device. and a historical graph of port utilization reveals that. Typical Causes Lack of bandwidth on the port. Actions Use the Ticker tool in Component Viewer to check the current outbound port utilization. Default severity level: severe. Packet loss and transmission delays cause end to end application performance degradation. color code: orange. error disabled port. Contact your Entuity Support representative for details. Default severity level: information.Entuity Port Error Disable Alarm Cleared Typical Causes The port error disable state indicates that the port has been brought down by the device (even though its admin status is up) because of detected errors persisting for a configured errdisable timeout period. the link is highly utilized. h This event is only enabled through additions to EYE’s configuration. EYE Events Guide 1-111 . Port High Inbound Discards (Dynamic) Cleared Indicates that a port that was dropping enough packets in its receive buffers to cross the set dynamic threshold is no longer doing so. Port Error Disable Alarm Cleared On Cisco Stack devices EYE identifies the additional port status. The discard rate is higher than the active dynamic threshold. If this is high. Typical Causes Transition of port status to normal.

causing application layer timeouts and re. and the PC or server which is attached to the switch port. Port High Inbound Fault (Dynamic) Indicates that a port is receiving corrupted packets from the network (a brownout). This may cause users who are communicating over this area of the network to experience slow application response times. faulty cabling between PCs/servers and switch ports. Default severity level: severe. Giant packets may be caused by faulty firmware on switch devices or encapsulation mis-configuration on trunk ports. Network users may be complaining about slow application response times. color code: green. color code: orange. These packets will be thrown away by the switch or router that is reporting this problem. giants. faulty NIC cards on PCs and servers.Entuity Port High Inbound Fault (Dynamic) Default severity level: information. alignment errors. If this isn't the cause of the problem. move the PC or server to a different port and see if the corruption continues. and runt packets. Actions No action required. Typical Causes Duplex/Half Duplex configuration mismatches on switch and router ports. Typical Causes Reduction in traffic. faulty transceivers. Default severity level: information. swap out the NIC card on the PC or server. Port High Inbound Fault (Dynamic) Cleared Indicates that a port that was receiving corrupted packets from the network (a brownout) is no longer receiving those packets. Types of corrupted packets include CRC errors. color code: green. Actions Check the duplex settings on switch ports reporting this problem. Actions None. Typical Causes Inbound discards has returned to levels within the dynamic threshold. noise on WAN circuits. Port High Inbound Utilization (Dynamic) Indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). If so. EYE Events Guide 1-112 .transmissions.

Entuity

Port High Inbound Utilization (Dynamic) Cleared

Default severity level: severe, color code: orange.

Typical Causes
Excessive application traffic, configuration changes.

Actions
If high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

Port High Inbound Utilization (Dynamic) Cleared
Indicates that a port (link) that was experiencing high levels of utilization (bandwidth usage) is now operating within dynamic thresholds. Default severity level: information, color code: green.

Typical Causes
Utilization for the port has during the past hour is within the expected threshold.

Actions
None.

Port High Outbound Discards (Dynamic)
Indicates that a port is dropping some packets in its transmit buffers, and/or experiencing difficulties transmitting packets out onto the network. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently. The discard rate is higher than the active dynamic threshold. Default severity level: severe, color code: orange.

Typical Causes
Lack of bandwidth on the port, transmit buffer sizes too small.

Actions
Use the Ticker tool in Component Viewer to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

Port High Outbound Discards (Dynamic) Cleared
Indicates that a port that was dropping large numbers of packets in its transmit buffers, and or experiencing severe difficulties transmitting packets out onto the network is now performing normally. Default severity level: information, color code: green.

EYE Events Guide

1-113

Entuity

Port High Outbound Fault (Dynamic)

Typical Causes
Reduced traffic.

Actions
None.

Port High Outbound Fault (Dynamic)
Indicates that a port is failing to transmit some packets onto the network (a brownout). These packets will be thrown away by the switch or router that is reporting this problem, causing application layer timeouts and re-transmissions. Network users may be complaining about slow application response times. Types of transmit errors include late collisions, carrier loss, and SQE test errors. The outbound fault rate is higher than the active dynamic threshold. Default severity level: severe, color code: orange.

Typical Causes
Duplex/Half Duplex configuration mismatches on switch and router ports, faulty cabling between PCs/servers and switch ports, faulty NIC cards on PCs and servers, faulty transceivers.

Actions
Check the duplex settings on switch ports reporting this problem, and the PC or server which is attached to the switch port. If this is not the cause of the problem, move the PC or server to a different port and see if the corruption continues. If so, swap out the NIC card on the PC or server.

Port High Outbound Fault (Dynamic) Cleared
Indicates that a port that was failing to transmit some packets onto the network (a brownout), is now transmitting successfully. Default severity level: information, color code: green.

Typical Causes
Resolution of Duplex/Half Duplex configuration mismatches on switch and router ports, faulty cabling between PCs/servers and switch ports, faulty NIC cards on PCs and servers, faulty transceivers.

Actions
None

Port High Outbound Utilization (Dynamic)
Indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.
EYE Events Guide 1-114

Entuity

Port High Outbound Utilization (Dynamic) Cleared

Default severity level: severe, color code: orange.

Typical Causes
Excessive application traffic, configuration changes.

Actions
If high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

Port High Outbound Utilization (Dynamic) Cleared
Indicates that a port (link) that was experiencing high levels of utilization (bandwidth usage) is now operating within dynamic thresholds. Default severity level: information, color code: green.

Typical Causes
Utilization for the port has during the past hour is within the expected threshold.

Actions
None.

Port Inbound Discards High (Device Congestion)
Indicates that a port is dropping some packets in its receive buffers. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently. Default severity level: severe, color code: orange.

Typical Causes
Lack of bandwidth on the port, transmit buffer sizes too small.

Actions
Use the Ticker tool in Component Viewer to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

Port Inbound Discards High Cleared (No Device Congestion)
Indicates that a port that was dropping enough packets in its receive buffers to cross the set dynamic threshold is no longer doing so. Default severity level: information, color code: green.

Typical Causes
Inbound discards has returned to levels within the dynamic threshold.

EYE Events Guide

1-115

transmissions. color code: amber. Network users may be complaining about slow application response times. Port Inbound Fault High (Packet Corruption) Indicates that a port is receiving corrupted packets from the network (a brownout). These packets will be thrown away by the switch or router that is reporting this problem. Actions Check the duplex settings on switch ports reporting this problem. color code: green. and the PC or server which is attached to the switch port. Default severity level: critical. faulty transceivers. WAN link CSU/DSU has reported a carrier loss. If so. If this isn't the cause of the problem. device configuration changes. move the PC or server to a different port and see if the corruption continues. and runt packets.Entuity Port Inbound Fault High (Packet Corruption) Actions No action required. Typical Causes Duplex/Half Duplex configuration mismatches on switch and router ports. Default severity level: information. Actions None. causing application layer timeouts and re. EYE Events Guide 1-116 . faulty NIC card on the PC or server attached to a switch port. Default severity level: major. a subinterface on a managed device not responding. color code: red. Typical Causes Disconnecting a PC or server from a switch port. swap out the NIC card on the PC or server. alignment errors. giants. Types of corrupted packets include CRC errors. Port Inbound Fault High (No Packet Corruption) Cleared Indicates that a port that was receiving corrupted packets from the network (a brownout) is no longer receiving those packets. noise on WAN circuits. faulty cabling between PCs/servers and switch ports. Typical Causes Reduction in traffic. Port Link Down Indicates that a port has transitioned to the down state. faulty cabling. Giant packets may be caused by faulty firmware on switch devices or encapsulation mis-configuration on trunk ports. faulty NIC cards on PCs and servers. re-booting the PC or server attached to a switch port.

Typical Causes Utilization for the port has during the past hour is within the expected threshold. re-booting the PC or server attached to a switch port. Check through other events that have recently been reported if excessively low levels of utilization persist. Actions None. Typical Causes Connecting a PC or server to a switch port. WAN link CSU/DSU equipment re-establishing carrier detection. Actions None. outages upstream of the link. Default severity level: severe. color code: green. Port Low Inbound Utilization (Dynamic) Cleared Indicates that a port (link) that was experiencing low levels of utilization (bandwidth usage) is now operating within dynamic thresholds. If the device reporting the event is a router. color code: orange. If it is a trunk or a server port. Actions This problem may be symptomatic of an issue elsewhere in the network. server problems.Entuity Port Link Up Actions If the device reporting the event is a switch then check what is attached to the port. Default severity level: information. Typical Causes Route changes. then Telnet to the router to ascertain possible causes for the outage. then this event indicates that there may be a network problem. Default severity level: information. Port Low Inbound Utilization (Dynamic) Indicates that a port (link) is experiencing low levels of inbound utilization (bandwidth usage). The low inbound utilization is lower than the active dynamic threshold. EYE Events Guide 1-117 . Port Link Up Indicates that a port has transitioned to the up state. color code: green.

Through the web UI Explorer you can highlight a port and from the context menu select Polling > Status Events > Enable to activate this event on a non-core port. Default severity level: severe. Default severity level: information.e. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. color code: red. specifically:  WAN ports  administrative up ports which have a configured IP addresses (i. From the same menu you also have the option to deactivate this event on a port. Actions This problem may be symptomatic of an issue elsewhere in the network.e. i. Actions None. The low inbound utilization is lower than the active dynamic threshold. Typical Causes Route changes. By default this event is only enabled for core ports.cfg and directly against this event through sw_n_of_m_port_active_status. outages upstream of the link. server problems. color code: orange. EYE Events Guide 1-118 . color code: green. Typical Causes Routing problem. Typical Causes Utilization for the port has during the past hour is within the expected threshold. interface shutdown. Port Operationally Down Indicates that the port is not responding. Check through other events that have recently been reported if excessively low levels of utilization persist. Default severity level: critical. Port Low Outbound Utilization (Dynamic) Cleared Indicates that a port (link) that was experiencing low levels of utilization (bandwidth usage) is now operating within dynamic thresholds. layer 3 ports) on devices which are routers or have router capability  trunks and uplinks that are administrative up. Administrators set n of m as a global setting through entuity.cfg. EYE allows suppression of this event according to simple n of m rules.Entuity Port Low Outbound Utilization (Dynamic) Port Low Outbound Utilization (Dynamic) Indicates that a port (link) is experiencing low levels of inbound utilization (bandwidth usage). its administrative state is up but the operational status is down.

Typical Causes Reduction in traffic. Default severity level: information. Actions None. color code: green. Actions Use the Ticker tool in Component Viewer to check the current outbound port utilization. then this event indicates that there may be a network problem. is now either responding or its administrative state has been set to down. and or experiencing severe difficulties transmitting packets out onto the network is now performing normally. the link is highly utilized. Packet loss and transmission delays cause end to end application performance degradation. If it is a trunk or a server port. color code: green. If this is high. Default severity level: major. and/or experiencing difficulties transmitting packets out onto the network. EYE Events Guide 1-119 . Port Operationally Down Cleared Indicates that a port that was not responding. interface restarted. as applications timeout and re-transmit data intermittently. Typical Causes Routing problem corrected. then more bandwidth may be needed. Port Outbound Discards High (Port Congestion) Indicates that a port is dropping some packets in its transmit buffers. Port Outbound Discards High (No Port Congestion) Cleared Indicates that a port that was dropping large numbers of packets in its transmit buffers. color code: amber. transmit buffer sizes too small. Typical Causes Lack of bandwidth on the port. If the device reporting the event is a switch then check what is attached to the port. Actions None. and a historical graph of port utilization reveals that. Default severity level: information.Entuity Port Operationally Down Cleared Actions Attempt to ping the device. in general.

Default severity level: information. faulty NIC cards on PCs and servers. color code: green. EYE Events Guide 1-120 . Default severity level: information. faulty NIC cards on PCs and servers. swap out the NIC card on the PC or server. is now transmitting successfully. and SQE test errors. color code: amber. faulty transceivers. faulty cabling between PCs/servers and switch ports. If so. faulty transceivers. faulty cabling between PCs/servers and switch ports. Types of transmit errors include late collisions. Default severity level: major. causing application layer timeouts and re-transmissions. carrier loss. and the PC or server which is attached to the switch port. auto-detection mechanism has detected a speed change on the attached PC or server NIC card. color code: green. Typical Causes Resolution of Duplex/Half Duplex configuration mismatches on switch and router ports. Typical Causes Configuration change. Network users may be complaining about slow application response times. These packets will be thrown away by the switch or router that is reporting this problem. Actions None Port Speed Change Indicates that a port has changed its interface speed. If this is not the cause of the problem. Typical Causes Duplex/Half Duplex configuration mismatches on switch and router ports.Entuity Port Outbound Fault High (Transmit Errors) Port Outbound Fault High (Transmit Errors) Indicates that a port is failing to transmit some packets onto the network (a brownout). move the PC or server to a different port and see if the corruption continues. Actions Check the duplex settings on switch ports reporting this problem. Port Outbound Fault High Cleared (No Transmit Errors) Indicates that a port that was failing to transmit some packets onto the network (a brownout). Actions None.

Default severity level: information. then the link speed may need to be increased to accommodate the extra traffic levels.Entuity Port Utilization Decreased Port Utilization Decreased Indicates that a port (link) is has experienced a significant decrease in utilization (bandwidth usage). Administrators set n of m as a global setting through entuity. color code: green. Typical Causes Reduced application traffic Actions None. color code: orange. Typical Causes Excessive application traffic.cfg. color code: amber. server problems.cfg and directly against this event through sw_n_of_m_high_port_utilisation. Default severity level: major. Port Utilization High Cleared Indicates that a port (link) that was experiencing high levels of utilization is now transmitting lower traffic volumes. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. EYE Events Guide 1-121 . if the decrease persists. configuration changes. This may cause users who are communicating over this area of the network to experience slow application response times. Typical Causes Configuration changes. EYE allows suppression of this event according to simple n of m rules. Actions If high port level utilization persists.e. Port Utilization High Indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). then look through recent network configuration changes. which is outside the range of normal behaviour. i. Actions Depending on where in the network the problem is reported. Default severity level: severe.

Port Utilization Low Indicates that a port (link) is experiencing low levels of utilization (bandwidth usage). which is outside the range of normal behaviour. Typical Causes Route changes. Actions Depending on where in the network the problem is reported. backups or large file transfers). EYE allows suppression of this event according to simple n of m rules. Default severity level: severe. i. Default severity level: information. Default severity level: major. color code: orange.e. Check through other events that have recently been reported if excessively low levels of utilization persist. Default severity level: severe. EYE Events Guide 1-122 .g. Power Supply Major Fault Indicates that a device has a major power supply hardware problem. Typical Causes Increased application traffic. Actions This problem may be symptomatic of an issue elsewhere in the network. configuration changes. color code: green.Entuity Port Utilization Increased Port Utilization Increased Indicates that a port (link) is has experienced a significant increase in utilization (bandwidth usage). outages upstream of the link. Actions None. Port Utilization Low Cleared Indicates that a port (link) that was experiencing low levels of utilization is now transmitting higher traffic volumes. Administrators set n of m as a global setting through entuity. if the increase persists.cfg. Typical Causes Excessive application traffic (e. EYE only raises the event if the associated threshold is exceeded n times within the last m polls.cfg and directly against this event through sw_n_of_m_high_port_utilisation. then check on server backups or large file transfers. color code: orange. color code: amber. server problems.

Actions Telnet to the device and check the system settings for an indication of what the problem is. Power Supply Minor Fault Indicates that a device has a minor power supply hardware problem. or the power supply is not supported by the router. color code: orange. color code: green. color code: orange. A hardware swap out may need to be scheduled depending on the type of problem. Typical Causes Faulty power supply has been swapped out. Default severity level: severe. Actions None. A hardware swap out may need to be scheduled depending on the type of problem. Typical Causes The power supply type is unknown. Power Supply OK Indicates that the power supply fault for a device has been cleared. Default severity level: information. Actions Telnet to the device and check the system settings for an indication of what the problem is. Default severity level: severe. The ID EEPROM of the power supply has not been programmed or has been corrupted. Actions Telnet to the device and check the system settings for an indication of what the problem is. Typical Causes Faulty power supply hardware.Entuity Power Supply Minor Fault Typical Causes Faulty power supply hardware. Power Supply Unknown State Indicates that the state of the device’s power supply hardware is unknown. Refer to the device documentation for details on power supply unknown. EYE Events Guide 1-123 . A hardware swap out may need to be scheduled depending on the type of problem.

EYE Events Guide 1-124 . Typical Causes The port's traffic class state has transitioned from either At Bandwidth Limit or Under Bandwidth Limit. Default severity level: critical. Actions Run a Flex Report to investigate further. ensuring traffic conforms to the internal network policy. h This event is only enabled through additions to EYE's configuration that enable the Lucent Bandwidth Controller. color code: red. The event times out from Event Viewer's tracker after fifteen minutes. Typical Causes The port's traffic class state has transitioned from either Above Bandwidth Limit or Under Bandwidth Limit. QoS At Bandwidth Limit This traffic class has used its allocated bandwidth (as indicated by xtmClassRate). Contact your Entuity Support representative for details. Typical Causes The port's traffic for the class is greater than it is configured to handle. QoS Class Bit Rate High Classification and admission control are always performed at the network edge. which are used inside the network for QoS management. Packets can be marked with special flags (colors).Entuity QoS Above Bandwidth Limit QoS Above Bandwidth Limit This traffic class has used more than its allocated bandwidth (as indicated by xtmClassRate). color code red. Default severity level: critical. For each class EYE monitors bit rate. Default severity level: critical. h This event is only enabled through additions to EYE's configuration that enable the Lucent Bandwidth Controller. Contact your Entuity Support representative for details. color code red. Bit rate thresholds can be set at the individual interface class level. The event times out from Component Viewer's tracker after fifteen minutes. Actions Run a Flex Report to investigate further.

Typical Causes The port's traffic class is drop bit rate is above the set threshold. Default severity level: information. view pre and post policy attributes. or run a Flex Report to investigate further. and bit rate thresholds can be set at the individual class level. color code yellow. Typical Causes Traffic has returned to within limits defined through the policy configuration for the class. ensuring traffic conforms to the internal network policy.Entuity QoS Class Bit Rate High Cleared Actions Through Component Viewer view the Class Map Status tab. view pre and post policy attributes. Default severity level: information. and drop bit rate thresholds can be set at the individual class level. For each class EYE monitors drop bit rate. Actions None. Actions None. Packets can be marked with special flags (colors). color code green. Typical Causes Traffic has returned to within limits defined through the policy configuration for the class. Actions Through Component Viewer view the Class Map Status tab. EYE Events Guide 1-125 . or run a Flex Report to investigate further. You can view their history through Attribute Grapher. which are used inside the network for QoS management. QoS Class Drop Bit Rate High Cleared For each class EYE monitors drop bit rate. QoS Class Drop Bit Rate High Classification and admission control are always performed at the network edge. You can view their history through Attribute Grapher. Default severity level: minor. color code green. and the high drop bit rate thresholds can be set at the individual class level. QoS Class Bit Rate High Cleared For each class EYE monitors bit rate.

Default severity level: information. color code green.Entuity QoS Class Drop Packet Rate (Buffer Shortage) High QoS Class Drop Packet Rate (Buffer Shortage) High Classification and admission control are always performed at the network edge. Actions Through Component Viewer view the Class Map Status tab. Drop bit rate thresholds can be set at the individual queue level. ensuring traffic conforms to the internal network policy. EYE Events Guide 1-126 . indicating a buffer shortage. view pre and post policy attributes. or run a Flex Report to investigate further. Typical Causes Traffic running through the queue is greater than the assigned queue depth. which are used inside the network for QoS management. Actions Queue management is an important congestion tool. color code red. Consider whether the aggregate queue size for this class of traffic is large enough for the number of individual queues of that type. indicating a buffer shortage. Investigate the history of the class drop bit rate and whether the individual queue depth requires extending. QoS Class Drop Packet Rate (Buffer Shortage) High Cleared For each class EYE monitors drop packet rate. QoS Queue Drop Bit Rate High For each queue EYE monitors drop bit rate. Default severity level: minor. Actions None. color code yellow. Typical Causes The port's traffic class state has transitioned to above the drop packet rate threshold. Packets can be marked with special flags (colors). Default severity level: critical. Typical Causes The port's traffic class state has transitioned to above the drop packet rate threshold. and drop packet rate thresholds can be set at the individual class level. Bits are discarded when traffic exceeds the set maximum queue depth. with different classes of traffic assigned different queue depths. You can view their history through Attribute Grapher.

Default severity level: information. Typical Causes No action required. The event times out from Component Viewer's tracker after five minutes. Drop bit rate thresholds can be set at the individual queue level. h This event is only enabled through additions to EYE's configuration that enable the Lucent Bandwidth Controller. color code green. Routing Broadcast Traffic High Indicates an incorrect packet broadcast on a network that causes most hosts to respond all at once. Actions The port's traffic class state has transitioned from either At Bandwidth Limit or Above Bandwidth Limit. Typical Causes Traffic has returned to levels within the queue settings for this class. EYE Events Guide 1-127 . where electrical noise is a problem power down the failing device and disconnect from the cable. generating a broadcast storm Actions Check broadcast traffic domains.Entuity QoS Queue Drop Bit Rate High Cleared QoS Queue Drop Bit Rate High Cleared For each queue EYE monitors drop bit rate. typically with wrong answers that start the process over again. This may cause more broadcast traffic. Typical Causes Within a TCP/IP network is the use of ARP (Address Resolution Protocol) requests for address resolution. Contact your Entuity Support representative for details. Defective network adapter card or cable run may cause electrical noise to be sent along the cable causing broadcast packets to be unanswered. Default severity level: major. color code: amber. configure the network to block illegal broadcast messages. where the number of devices in a segment is too large. Default severity level: information. Actions None QoS Under Bandwidth Limit The traffic class has not used its allocated bandwidth (as indicated by xtmClassRate). color code green. Bits are discarded when traffic exceeds the set maximum queue depth.

Actions Locate the incorrectly configured device and correct. color code: green. Typical Causes Resolution of high broadcast problem.Entuity Routing Broadcast Traffic High Cleared Routing Broadcast Traffic High Cleared Sent by the router to the sender of a packet indicating that the route is now available. Typical Causes A network link is disconnected. color code: green. Actions None. Default severity level: information. the destination address does not exist. Default severity level: information. network connections. color code: yellow. EYE Events Guide 1-128 . Routing ICMP High Redirects Indicates routers handling packets with incorrect addresses. Default severity level: minor. where you feel it’s appropriate you can disable ICMP redirects. Actions Investigate destination address. Routing High No Routes to IP Destination Cleared Sent by the router to the sender of a packet indicating that the route is now available. Typical Causes Device configured with incorrect routing entries. Alternatively. Routing High No Routes to IP Destination Sent by the router to the sender of a packet indicating that there is no route available to deliver the packet to the intended receiver. Default severity level: minor. Typical Causes A network link is re-connected. Actions None. color code: yellow.

Entuity Routing ICMP High Redirects Cleared Routing ICMP High Redirects Cleared Indicates a reduction in incorrectly addressed packets. Actions None. Default severity level: information. color code: yellow. Routing Low I/O Contiguous Memory Indicates the number of unused contiguous bytes in the router’s input/output memory pool is low. Default severity level: information. The Router discards the IP Packet and an ICMP 'TTL Expired in transit' message is sent back to the sending IP Address. Typical Causes Under resource of processor compared to processing demands. Typical Causes Device reconfiguration. Default severity level: minor. Typical Causes Unreachable device. color code: yellow. Typical Causes Device now online. a routing loop. EYE Events Guide 1-129 . Actions None. color code: green. Routing ICMP High TTL Exceeds Cleared Indicates transmission to the device is now within TTL (Time To Live) value in the IP Packet. Routing ICMP High TTL Exceeds Indicates TTL (Time To Live) value in the IP Packet is decremented to zero. color code: green. Actions Locate the incorrectly configured sending device and correct. Default severity level: minor.

investigate possible imbalance between address space allocations for I/O memory and processor memory. Routing Low I/O Total Memory Indicates the total number of unused bytes in the router’s input/output memory pool is low. Routing Low Processor Contiguous Memory Indicates the number of unused contiguous bytes in the router’s processor memory pool is low. Actions Reboot router to free contiguous memory. Actions None. investigate possible imbalance between address space allocations for I/O memory and processor memory. Typical Causes Under resource of processor compared to processing demands. color code: green. Routing Low I/O Contiguous Memory Cleared Indicates the number of unused contiguous bytes in the router’s input/output memory pool is acceptable. color code: green. Actions None. Typical Causes Improved availability of total memory resources on the routing device. color code: yellow. Default severity level: information.Entuity Routing Low I/O Contiguous Memory Cleared Actions Reboot router to free contiguous memory. color code: yellow. increase memory resource. Default severity level: information. Default severity level: minor. EYE Events Guide 1-130 . Routing Low I/O Total Memory Cleared Indicates the total number of unused bytes in the router’s input/output memory pool is acceptable. increase memory resource. Typical Causes Improved availability of contiguous memory resources on the routing device. Default severity level: minor.

Typical Causes Improved availability of processor contiguous memory resources on the routing device. increase memory resource. Actions Reboot router to free contiguous memory. Default severity level: information. Actions None. increase memory resource. Default severity level: minor. investigate buffer usage. Routing Low Processor Contiguous Memory Cleared Indicates the total number of unused bytes in the router’s processor memory pool is acceptable. Routing Low Processor Total Memory Indicates the router’s processor memory is low. color code: green. Typical Causes Under resource of processor compared to processing demands. Typical Causes Improved availability of processor total memory resources on the routing device. investigate possible imbalance between address space allocations for I/O memory and processor memory. EYE Events Guide 1-131 . investigate possible imbalance between address space allocations for I/O memory and processor memory. color code: green.Entuity Routing Low Processor Contiguous Memory Cleared Typical Causes Under resource of processor compared to processing demands. Actions Reboot router to free contiguous memory. Routing Low Processor Total Memory Cleared Indicates the total number of unused bytes in the router’s processor memory pool is acceptable. Default severity level: information. Actions None. color code: yellow.

Typical Causes The number of components failing in the service is sufficient to cause the service to fail. Typical Causes The state of one or more of the components in the service is unknown. Typical Causes CPU utilization is greater than the set threshold in the one second before the device is polled. Default severity level: severe. Default severity level: critical. The device is polled every five minutes. Service Up Indicates the named service is up. Typical Causes The state of enough components in the service is up. Actions None SLB SP 1 Second CPU Utilization High Provides a snapshot of CPU utilization in the one second before the device is polled. so the service is now available. Default severity level: information. EYE Events Guide 1-132 . Actions From the web UI select Network Dashboards > Service Summary. Service State Unknown Indicates the state of the named service is unknown. You can view the current status of all services and then select the required service to drill down and view the status of its components. color code: red. its state having previously been Down or Unknown. Default severity level: critical. color code: orange. Actions From the web UI select Network Dashboards > Service Summary.Entuity Service Down Service Down Indicates the named service is down. color code: red. color code: green. You can view the current status of all services and then select the required service to drill down and view the status of its components.

Actions None. Default severity level: critical. SLB SP 64 Second CPU Utilization High Provides a snapshot of CPU utilization in the sixtyfour seconds before the device is polled. color code: green.Entuity SLB SP 1 Second CPU Utilization Cleared Actions Investigate the history of the CPU utilization for the load balancer. Default severity level: critical. Typical Causes CPU utilization has reverted to a value below the set threshold. color code: red. EYE Events Guide 1-133 . The device is polled every five minutes. SLB SP 1 Second CPU Utilization Cleared The one second CPU utilization value is within the set threshold. Typical Causes CPU utilization has reverted to a value below the set threshold. color code: red. Actions Investigate the history of the CPU utilization for the load balancer. Default severity level: information. SLB SP 4 Second CPU Utilization Cleared The four second CPU utilization value is within the set threshold. Default severity level: information. The device is polled every five minutes. SLB SP 4 Second CPU Utilization High Provides a snapshot of CPU utilization in the four seconds before the device is polled. Typical Causes CPU utilization is greater than the set threshold in the four seconds before the device is polled. Actions None. color code: green.

i. EYE Events Guide 1-134 . Default severity level: information. Availability Monitor pings IP addresses every two minutes. Actions Investigate the history of the CPU utilization for the load balancer.cfg. SNMP Agent Not Responding Indicates the device. color code: green. SNMP Agent Not Responding events are not raised when a device is down. EYE allows suppression of this event according to simple n of m rules. or device resource issues. or more specifically its SNMP agent. Administrators set n of m as a global setting through entuity. Typical Causes CPU utilization has reverted to a value below the set threshold.Entuity SLB SP 64 Second CPU Utilization Cleared Typical Causes CPU utilization is greater than the set threshold in the sixtyfour seconds before the device is polled. color code: red. e.cfg. EYE only raises the event if the associated threshold is exceeded n times within the last m polls.stickystate parameter in the entuity. You can configure how EYE manages noisy events through the nofmthreshold. potentially EYE could raise this event every two minutes. Actions None. Typical Causes Device configuration changes. Availability Monitor determines whether a device is up or down. The device is considered up when Availability Monitor receives one or more responses. is not responding to SNMP requests.e. Actions Check that the SNMP community string of the device in EYE is still configured correctly. Availability Monitor operates in one of two modes:  by ICMP ping to the management IP address only  by ICMP ping to all IP addresses on the device (default).g. Default severity level: critical.cfg and directly against this event through sw_n_of_m_NofMSNMPPoller. but was available when EYE last attempted to Ping it. to SNMP read community string or SNMP access lists. SLB SP 64 Second CPU Utilization Cleared The sixtyfour second CPU utilization value is within the set threshold.

Through Availability Monitor EYE pings devices every two minutes. color code: red. SNMP Authentication Failure Indicates that a request did not get proper authentication. Actions Ping the device to ensure that it is still contactable. usually the result of a bad community string. color code: green.Entuity SNMP Agent Responding SNMP Agent Responding Indicates the device is now responding to SNMP requests. Typical Causes The device restarted. a manual restart of the SNMP agent. color code: orange. SSL Certificate Expired Indicates the SSL certificate has expired. or device resource issues. It also indicates the SNMP counters polled by EYE for the managed host have been reset. SNMP Agent Restart Detected Indicates the SNMP service has restarted on the managed host. Actions None. color code: amber.g. Default severity level: information. If ping is successful then check that the IP address and SNMP community string of the device in Entuity are still configured correctly (although it may not be the EYE server that is issuing the SNMP requests that are failing). until the certificate is renewed or removed. but was unavailable when EYE last attempted to Ping it. every twenty-four hours. which may explain any unexpected data spikes. EYE Events Guide 1-135 . Typical Causes Device configuration changes. Typical Causes An invalid community was received in a message. since EYE last attempted to poll it. Default severity level: information. e. Default severity level: critical. to SNMP read community string or SNMP access lists. EYE continues to raise this event. Actions None. Default severity level: severe.

Typical Causes SSL certificate expiry date is within the set notification period. Actions None. as its administrative state is up. Actions Obtain a new SSL certificate. Default severity level: critical. SSL Proxy Service Operational Available to SNMP Poll Indicates that the device is responding to SNMP polling. SSL Proxy Service Administrative Available to SNMP Poll Indicates that the device is responding. EYE Events Guide 1-136 . SSL Proxy Service Administrative Unavailable to SNMP Poll Indicates that the device is not responding. Actions None. Typical Causes Administrator has configured the administrative state to up. Typical Causes Administrator has taken the module down. color code: red. as its operational state is up.Entuity SSL Certificate Expiring Typical Causes SSL certificate has passed its expiry date. Self signed certificates you can create yourself. You can amend the notification period against the device in Component Viewer. color code: green. EYE continues to raise this event. SSL Certificate Expiring Indicates the SSL certificate expiry date is within the set expiry notification period. otherwise obtain one from a recognized SSL certificate issuing authority. every twenty-four hours. until the certificate is renewed. color code: orange. as its administrative state is down. Default severity level: information. Actions Install a new SSL certificate. removed or expires. Default severity level: severe.

as its operational state is down. Typical Causes Device configuration changes. Typical Causes SSL certificate has passed its expiry date. Actions Telnet to the device and check the system logs for an indication of what caused the topology change. color code: red. Actions Contact your SSL authority for a valid certificate. This event is detected by the generation of an SNMP trap on the device. device or link failures. Actions Telnet to the device and check the system logs for an indication of what caused a new device to become the root switch. Default severity level: critical. Default severity level: major. EYE Events Guide 1-137 . color code: amber. SSL Proxy Service Operational Unavailable to SNMP Poll Indicates that the device is not responding to SNMP polling. Typical Causes The SSL Proxy service has been down but is now available. color code: green. color code: red. Default severity level: critical. Typical Causes Device configuration changes. STP VLAN Topology Change Indicates that a device reported a topology change for a spanning tree in which it participates. This event is detected by the generation of an SNMP trap on the device. Actions None. STP New Root Device Indicates that a device reported a new root switch for a spanning tree in which it participates. device or link failures.Entuity SSL Proxy Service Operational Unavailable to SNMP Poll Default severity level: information.

:  %PAGP-5-PORTFROMSTP. generate events displayed through Event Viewer (see the EYE System Administration Guide). e.g. a line up and down (layer 2)  message. a spanning tree messages  %LINK-3-UPDOWN. e. Default severity level: severe. Default severity level: severe. Actions Dependent on the syslog event raised. color code: orange.:  %PAGP-5-PORTFROMSTP. the content of the syslog message. the content of the syslog message. a link up and down (physical)  %LINEPROTO-5-UPDOWN. Syslog Critical Events Syslog can generate system messages for each of the defined facilities. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. a link up and down (physical)  %LINEPROTO-5-UPDOWN. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. color code: orange. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. generate events displayed through Event Viewer (see the EYE System Administration Guide). those defined by default and those defined locally.g. All of the system message can be prioritized. those defined by default and those defined locally. EYE Events Guide 1-138 . a spanning tree messages  %LINK-3-UPDOWN. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. a line up and down (layer 2)  message. All of the system message can be prioritized.Entuity Syslog Alert Event Syslog Alert Event Syslog can generate system messages for each of the defined facilities.

Syslog Debug Events Syslog can generate system messages for each of the defined facilities. a link up and down (physical)  %LINEPROTO-5-UPDOWN. e. a spanning tree messages  %LINK-3-UPDOWN. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. color code: red. those defined by default and those defined locally.Entuity Syslog Debug Events Actions Dependent on the syslog event raised. Actions None required.:  %PAGP-5-PORTFROMSTP. a line up and down (layer 2)  message. Default severity level: information. Syslog Emergency Event Syslog can generate system messages for each of the defined facilities. those defined by default and those defined locally. color code: green.g. EYE Events Guide 1-139 . e.:  %PAGP-5-PORTFROMSTP. a line up and down (layer 2)  message. a link up and down (physical)  %LINEPROTO-5-UPDOWN. the content of the syslog message.g. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. a spanning tree messages  %LINK-3-UPDOWN. generate events displayed through Event Viewer. All of the system message can be prioritized. the content of the syslog message. Default severity level: critical. All of the system message can be prioritized.

:  %PAGP-5-PORTFROMSTP. Syslog Information Events Syslog can generate system messages for each of the defined facilities. color code: amber. Default severity level: major. Actions Dependent on the syslog event raised. a line up and down (layer 2) EYE Events Guide 1-140 . e. generate events displayed through Event Viewer (see the EYE System Administration Guide).g. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. All of the system message can be prioritized. a link up and down (physical)  %LINEPROTO-5-UPDOWN. a line up and down (layer 2)  message. those defined by default and those defined locally. Actions Dependent on the syslog event raised. a link up and down (physical)  %LINEPROTO-5-UPDOWN. those defined by default and those defined locally.Entuity Syslog Error Events Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. generate events displayed through Event Viewer (see the EYE System Administration Guide).g. e. a spanning tree messages  %LINK-3-UPDOWN. All of the system message can be prioritized. the content of the syslog message. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. Syslog Error Events Syslog can generate system messages for each of the defined facilities. a spanning tree messages  %LINK-3-UPDOWN.:  %PAGP-5-PORTFROMSTP. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level.

Actions None required. e. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. those defined by default and those defined locally.:  %PAGP-5-PORTFROMSTP. All of the system message can be prioritized. All of the system message can be prioritized. Syslog Notice Events Syslog can generate system messages for each of the defined facilities. color code: yellow. a line up and down (layer 2)  message.g. Syslog event details has the format: tag:message where:  tag indicates the syslog message type. Syslog Warning Events Syslog can generate system messages for each of the defined facilities. Default severity level: minor. those defined by default and those defined locally.Entuity Syslog Notice Events  message. a spanning tree messages EYE Events Guide 1-141 . e. the content of the syslog message.:  %PAGP-5-PORTFROMSTP. generate events displayed through Event Viewer (see the EYE System Administration Guide). color code: green. generate events displayed through Event Viewer (see the EYE System Administration Guide). Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. Default severity level: information. a link up and down (physical)  %LINEPROTO-5-UPDOWN. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. a spanning tree messages  %LINK-3-UPDOWN. Actions None required.g. the content of the syslog message.

Default severity level: minor. Virtualization Connection Success EYE has successfully connected to the VM platform after a previous failure. Actions Confirm the connection details. EYE Events Guide 1-142 . color code green. color code yellow. Actions No action required. Actions Dependent on the syslog event raised. e. configuration changes. Typical Causes Excessive application traffic. Default severity level: severe. an aged out connection password. connection to a VM platform is through its SDK. an incorrect connection URL. Default severity level: information. generate events displayed through Event Viewer (see the EYE System Administration Guide). a line up and down (layer 2)  message. VPN Load Average High Load average is the average number of processes in the runqueue during the polling interval. color code: yellow. Typical Causes The EYE System Administrator determines which system messages from which facilities and at what priority level. Typical Causes Incorrect connection details. color code orange. Virtualization Connection Failed Indicates EYE has failed to connect to the identified VM platform. Default severity level: minor. the content of the syslog message.Entuity Virtualization Connection Failed  %LINK-3-UPDOWN.g. Typical Causes Corrected connection details. An unavailable VM platform. From the Administration > Inventory page you can view and modify connection details. a link up and down (physical)  %LINEPROTO-5-UPDOWN.

VPN Network Port Utilization High Cleared Indicates a previous VPN Load Average High alarm has been cleared. configuration changes. This may cause users who are communicating over this area of the network to experience slow application response times.Entuity VPN Load Average High Cleared Actions Run a Flex Report to identify long term utilization of tunnels on the VPN. Typical Causes Excessive application traffic. Typical Causes Average loading for the runqueue has returned to acceptable levels. VPN Network Port Utilization High Indicates that a VPN ethernet port (link) is experiencing high levels of utilization (bandwidth usage). Default severity level: minor. Default severity level: information. VPN Load Average High Cleared Indicates a previous VPN Load Average High alarm has been cleared. then the link speed may need to be increased to accommodate the extra traffic levels. color code yellow. EYE Events Guide 1-143 . Default severity level: minor. color code: green. color code: green. color code yellow. Typical Causes VPN port utilization has returned to acceptable levels. Actions No action required. Actions If high port level utilization persists. Actions No action required. VPN Tunnel Usage High Indicates high VPN tunnel usage. Default severity level: information.

Default severity level: information. telnet to the device and check system resources. Typical Causes When congestion occurs downstream in the network. EYE Events Guide 1-144 . Increasing the size of the receive buffers. and the device needs to free buffer space frames are discarded. Actions Run a Flex Report to identify long term utilization of tunnels on the VPN. color code: green. as applications timeout and re-transmit data intermittently. Default severity level: major. WAN Port High Inbound Discards Indicates that a WAN port (link) is discarding packets. configuration changes. WAN Port High Inbound Discards Cleared Indicates a High WAN Port Inbound Discards alarm has been cleared as the port discard rate is now below the high threshold value. Actions No action required. Default severity level: information. If this is not sufficient to relieve the congestion. color code: green. and/or upgrading the device hardware (CPU and memory) may be necessary. Typical Causes Reduced transmission. If broadcast traffic is light. This packet loss causes end to end application performance degradation. frames with DE bit clear will be dropped next.Entuity VPN Tunnel Usage High Cleared Typical Causes Excessive application traffic. Typical Causes VPN tunnel usage has returned to acceptable levels. Actions Use the Ticker tool in Component Viewer to check inbound broadcast traffic on the port reporting discards. color code: amber. For Frame Relay the switch dropping frames will select from its buffer the frames with the DE bit set first. VPN Tunnel Usage High Cleared Indicates a previous VPN Load Average High alarm has been cleared.

Entuity WAN Port High Inbound Errors Actions None. EYE Events Guide 1-145 . WAN Port High Inbound Errors Cleared An event correlated with WAN Port High Inbound Errors event. Types of corrupted packets include CRC errors. color code: amber. WAN Port High Inbound Errors Indicates that a port is receiving corrupted packets from the network (a brownout). Typical Causes Indicates a High WAN Port Inbound Errors alarm has been cleared as the port error rate is now below the high threshold value. color code: amber. alignment errors. These packets are thrown away by the port’s device. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. move the PC or server to a different port and see if the corruption continues. Network users may complain about slow application response times. WAN Port High Inbound Utilization Indicates that a WAN port (link) is experiencing high levels of utilization (bandwidth usage). faulty transceivers. swap out the NIC card on the PC or server. EYE allows suppression of this event according to simple n of m rules. Actions None. If so. Administrators set n of m as a global setting through entuity. This may cause users who are communicating over this area of the network to experience slow application response times. Default severity level: major. If this isn't the cause of the problem. and runt packets. noise on WAN circuits. causing application layer timeouts and re-transmissions. Default severity level: major.cfg. Typical Causes Duplex/Half Duplex configuration mismatches on switch and router ports. faulty NIC cards on PCs and servers. and the PC or server which is attached to the switch port. i. Actions Check the duplex settings on switch ports reporting this problem. color code: green. giants. Giant packets may be caused by faulty firmware on switch devices or encapsulation mis-configuration on trunk ports.e. faulty cabling between PCs/servers and switch ports. Default severity level: information.cfg and directly against this event through sw_n_of_m_high_port_utilisation.

Typical Causes Lack of bandwidth on the port. then the link speed may need to be increased to accommodate the extra traffic levels. WAN Port High Outbound Discards Indicates that a port is dropping some packets in its transmit buffers even though no errors had been detected to prevent their being transmitted. color code: amber. as applications timeout and re-transmit data intermittently. Default severity level: information. Actions If high port level utilization persists. Default severity level: information.Entuity WAN Port High Inbound Utilization Cleared Typical Causes Excessive application traffic. and a historical graph of port utilization reveals that. transmit buffer sizes too small. EYE Events Guide 1-146 . the link is highly utilized. Default severity level: major. Actions Use the Ticker tool in Component Viewer to check the current outbound port utilization. Packet loss and transmission delays cause end to end application performance degradation. WAN Port High Inbound Utilization Cleared The correlated clearing event for the WAN Port High Inbound Utilization event. configuration changes. in general. Actions None. then more bandwidth may be needed. Typical Causes Indicates a WAN Port High Outbound Discards alarm has been cleared as the port discard rate is now below the high threshold value. color code: green. color code: green. If this is high. WAN Port High Outbound Discards Cleared The correlated clearing event for the WAN Port High Outbound Discards event. Actions None. Typical Causes Indicates a WAN Port High Inbound Utilization alarm has been cleared as the port error rate is now below the high threshold value.

and a historical graph of port utilization reveals that. Actions Use the Ticker tool in Component Viewer to check the current outbound port utilization. If this is high. Typical Causes Excessive application traffic.Entuity WAN Port High Outbound Errors WAN Port High Outbound Errors Indicates that the WAN port is dropping large numbers of packets in its transmit buffers. Typical Causes Lack of bandwidth on the port. WAN Port High Outbound Errors Cleared The correlated clearing event for the WAN Port High Outbound Errors event. This may cause users who are communicating over this area of the network to experience slow application response times. in general. Default severity level: major. and or experiencing severe difficulties transmitting packets out onto the network. then more bandwidth may be needed. i. Default severity level: major. Administrators set n of m as a global setting through entuity.cfg. Typical Causes Indicates a WAN Port High Outbound Errors alarm has been cleared as the port error rate is now below the high threshold value. WAN Port High Outbound Utilization Indicates that a WAN port (link) is experiencing high levels of outbound utilization (bandwidth usage). EYE Events Guide 1-147 . color code: green.e. network congestion causing excessive/late collisions and carrier sense errors. the link is highly utilized. configuration changes. as applications timeout and re-transmit data intermittently. color code: amber. then the link speed may need to be increased to accommodate the extra traffic levels.cfg and directly against this event through sw_n_of_m_high_port_utilisation. transmit buffer sizes too small. Actions None. Actions If high port level utilization persists. Packet loss and transmission delays cause end to end application performance degradation. EYE allows suppression of this event according to simple n of m rules. Default severity level: information. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. color code: amber.

color code: green.Entuity WAN Port High Outbound Utilization Cleared WAN Port High Outbound Utilization Cleared The correlated clearing event for the WAN Port High Outbound Utilization event. color code: amber. EYE allows suppression of this event according to simple n of m rules. WAN Port Low Inbound Utilization Cleared Indicates that a WAN port (link) that was experiencing low levels of utilization is now receiving higher traffic volumes. Check through other events that have recently been reported if excessively low levels of utilization persist. Typical Causes Route changes. i. EYE Events Guide 1-148 .cfg. Default severity level: information. Typical Causes Increased application traffic. Typical Causes Indicates a High WAN Port Outbound Utilization alarm has been cleared as the port utilization is now below the high threshold value. color code: green.cfg and directly against this event through sw_n_of_m_high_port_utilisation. WAN Port Low Outbound Utilization Indicates that a WAN port (link) is experiencing low levels of outbound utilization (bandwidth usage). EYE only raises the event if the associated threshold is exceeded n times within the last m polls. Actions None. Administrators set n of m as a global setting through entuity. Default severity level: information. Default severity level: major. Actions None. WAN Port Low Inbound Utilization Indicates that a WAN port (link) is experiencing low levels of inbound utilization (bandwidth usage). outages upstream of the link.e. Actions This problem may be symptomatic of an issue elsewhere in the network. server problems.

Administrators set n of m as a global setting through entuity. Actions This problem may be symptomatic of an issue elsewhere in the network. EYE only raises the event if the associated threshold is exceeded n times within the last m polls. color code: green. Actions None. EYE Events Guide 1-149 .cfg and directly against this event through sw_n_of_m_high_port_utilisation. server problems. WAN Port Low Outbound Utilization Cleared Indicates that a WAN port (link) that was experiencing low levels of utilization is now transmitting higher traffic volumes.cfg. color code: amber. outages upstream of the link.Entuity WAN Port Low Outbound Utilization Cleared EYE allows suppression of this event according to simple n of m rules. Typical Causes Route changes. Check through other events that have recently been reported if excessively low levels of utilization persist. i. Typical Causes Increased application traffic. Default severity level: major. Default severity level: information.e.

EYE Event Groups The Event Groups table lists the available event groups. This may happen.Appendix A Event Groups. EYE has two event severity levels.PAPIEventGroup}. Missing Events. IDs and Severity In EYE events are uniquely identified by the combination of their event group. for example. and their own event identifier within that group. EYE also includes one event that does not have a severity level. when creating an event through the Open Trap Receiver and the event being raised before Event Viewer has updated its tables to recognize the event. This indicates EYE has raised an event for which it does not have record for that type in its database.PAPIEventID}. Display Severity 1 2 Table A-2 Event Severity EYE Events Guide A-1 Internal Severity 2 4 Color Code Green Yellow Minor Description Information or Cleared . and wanting to forward event severity. You only require the internal event severity level when forwarding events to third party software. Group ID 2 4 8 16 32 64 256 512 1024 2048 Port Module Device VLAN EYE Server Syslogger Availability Monitor Application Availability Monitor IP Address StormWorks Open Trap Receiver Event Type Groups Table A-1 Event Groups EYE Event Severity The Event Severity table matches the severity level to its description. ${event. the display event severity level and an internal severity level. ${event. EYE uses the event type group to populate event source information. After the next refresh the event would be properly recognized.

Event ID and internal severity level. Event Name AP Antenna Channel Change Frequency High AP Antenna Channel Change Frequency High Cleared AP Antenna Host Count High AP Antenna Host Count High Cleared AP Antenna Host Count Low AP Antenna Host Count Low Cleared AP Antenna Offline AP Antenna Online AP Antenna Power Change Frequency High AP Antenna Power Change Frequency High Cleared AP Associated With Controller AP Host Count High AP Host Count High Cleared AP Host Count Low AP Host Count Low Cleared AP Not Associated With Controller ATM VCC High Inbound Utilization ATM VCC High Inbound Utilization Cleared ATM VCC High Outbound Utilization ATM VCC High Outbound Utilization Cleared ATM VCC Link Down ATM VCC Link Up ATM VCC Low Inbound Utilization ATM VCC Low Inbound Utilization Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 842 843 804 805 806 807 846 847 840 841 845 832 833 834 835 844 46 47 50 51 54 55 48 49 Internal Severity 4 2 4 2 4 2 4 2 4 2 4 4 2 4 2 2 6 2 6 2 8 2 6 2 EYE Events Guide A-2 .Entuity Display Severity 3 4 5 Table A-2 Event Severity Internal Severity 6 8 10 Color Code Amber Orange Red Major Severe Critical Description Listing of EYE Events This table lists events by description and then details each event’s Group ID.

25V Rail High Voltage Cleared BladeCenter Blade +1.25V Rail High Voltage BladeCenter Blade +1.25V Rail Low Voltage Table A-3 Event Identifiers Group ID 1024 1024 256 256 1024 1024 256 256 1024 1024 1024 1024 1024 1024 1024 1024 1024 8 8 8 8 8 8 8 8 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 52 53 1 2 753 750 3 4 80 751 81 752 754 800 801 802 803 78 79 80 81 82 83 76 77 133 132 130 129 131 128 547 548 549 Internal Severity 6 2 2 8 4 8 8 2 8 4 4 8 8 4 2 4 2 4 2 4 2 4 2 4 2 10 10 10 4 4 10 8 2 8 EYE Events Guide A-3 .Entuity Event Name ATM VCC Low Outbound Utilization ATM VCC Low Outbound Utilization Cleared AvailMonitor Application Available AvailMonitor Application Unavailable AvailMonitor Falling Average Latency AvailMonitor High Latency AvailMonitor High Latency Reaching Application AvailMonitor High Latency Reaching Application Cleared AvailMonitor Low View Device Reachability AvailMonitor Normal Latency AvailMonitor Normal View Device Reachability AvailMonitor Rising Average Latency AvailMonitor Rising Trend in Average Latency AWAP Host Count High AWAP Host Count High Cleared AWAP Host Count Low AWAP Host Count Low Cleared Backplane Bus A High Utilization Backplane Bus A High Utilization Cleared Backplane Bus B High Utilization Backplane Bus B High Utilization Cleared Backplane Bus C High Utilization Backplane Bus C High Utilization Cleared Backplane System Bus High Utilization Backplane System Bus High Utilization Cleared BGP Peer Briefly Established BGP Peer Briefly Not Established BGP Peer Disappeared BGP Peer Established BGP Peer Newly Discovered BGP Peer Not Established BladeCenter Blade +1.

5V Rail High Voltage Cleared BladeCenter Blade +2.5V Rail Low Voltage Cleared BladeCenter Blade +12V Rail High Voltage BladeCenter Blade +12V Rail High Voltage Cleared BladeCenter Blade +12V Rail Low Voltage BladeCenter Blade +12V Rail Low Voltage Cleared BladeCenter Blade +2.8V Rail Low Voltage Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 550 543 544 545 546 535 536 537 538 539 540 541 542 531 532 533 534 527 528 529 530 519 520 514 513 512 571 572 573 574 567 568 569 570 Internal Severity 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 6 2 4 8 2 8 2 8 2 8 2 EYE Events Guide A-4 .8V Rail High Voltage BladeCenter Chassis +1.5V Rail High Voltage BladeCenter Blade +2.5V Rail High Voltage BladeCenter Blade +1.8V Rail High Voltage Cleared BladeCenter Chassis +1.3V Rail High Voltage Cleared BladeCenter Blade +3.Entuity Event Name BladeCenter Blade +1.5V Rail Low Voltage Cleared BladeCenter Blade +3.3V Rail High Voltage BladeCenter Blade +3.5V Rail Low Voltage BladeCenter Blade +1.8V Rail Low Voltage BladeCenter Chassis +1.25V Rail Low Voltage Cleared BladeCenter Blade +1.5V Rail Low Voltage BladeCenter Blade +2.3V Rail Low Voltage BladeCenter Blade +3.3V Rail Low Voltage Cleared BladeCenter Blade +5V Rail High Voltage BladeCenter Blade +5V Rail High Voltage Cleared BladeCenter Blade +5V Rail Low Voltage BladeCenter Blade +5V Rail Low Voltage Cleared BladeCenter Blade Powered Off BladeCenter Blade Powered On BladeCenter Blower Failed BladeCenter Blower OK BladeCenter Blower Slow BladeCenter Chassis -5V Rail High Voltage BladeCenter Chassis -5V Rail High Voltage Cleared BladeCenter Chassis -5V Rail Low Voltage BladeCenter Chassis -5V Rail Low Voltage Cleared BladeCenter Chassis +1.5V Rail High Voltage Cleared BladeCenter Blade +1.

5V Rail Low Voltage BladeCenter Chassis +2.Entuity Event Name BladeCenter Chassis +12V Rail High Voltage BladeCenter Chassis +12V Rail High Voltage Cleared BladeCenter Chassis +12V Rail Low Voltage BladeCenter Chassis +12V Rail Low Voltage Cleared BladeCenter Chassis +2.5V Rail Low Voltage Cleared BladeCenter Chassis +3.5V Rail High Voltage BladeCenter Chassis +2.3V Rail High Voltage Cleared BladeCenter Chassis +3.3V Rail High Voltage BladeCenter Chassis +3.3V Rail Low Voltage Cleared BladeCenter Chassis +5V Rail High Voltage BladeCenter Chassis +5V Rail High Voltage Cleared BladeCenter Chassis +5V Rail Low Voltage BladeCenter Chassis +5V Rail Low Voltage Cleared BladeCenter CPU1 High Temperature BladeCenter CPU1 High Temperature Cleared BladeCenter CPU2 High Temperature BladeCenter CPU2 High Temperature Cleared BladeCenter DASD1 High Temperature BladeCenter DASD1 High Temperature Cleared BladeCenter Front Panel High Temperature BladeCenter Front Panel High Temperature Cleared BladeCenter Management Module High Temperature BladeCenter Management Module High Temperature Cleared Chassis Fan Major Fault Chassis Fan Minor Fault Chassis Fan OK Chassis Fan Status Unknown Chassis Major Alarm Chassis Major Alarm Cleared Chassis Minor Alarm Chassis Minor Alarm Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 8 8 8 8 8 8 8 8 Event ID 559 560 561 562 563 564 565 566 555 556 557 558 551 552 553 554 521 522 523 524 525 526 517 518 515 516 33 32 30 31 37 38 35 36 Internal Severity 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 2 8 6 2 4 10 2 8 2 EYE Events Guide A-5 .5V Rail High Voltage Cleared BladeCenter Chassis +2.3V Rail Low Voltage BladeCenter Chassis +3.

Entuity Event Name Chassis Temperature Alarm Chassis Temperature Alarm Cleared Chassis Temperature Critical Alarm CM Configuration Includes Policy Exclusion CM Configuration Missing Policy Mandated Statement CM Firmware Version Changed CM Previously Unsaved Configuration Saved CM Running Configuration Changed CM Running Configuration Retrieval Failed CM Startup Configuration Changed CM Startup Configuration Retrieval Failed CM Unsaved Configuration CPU High Utilization CPU High Utilization Cleared CUCM CPU High Utilization CUCM CPU High Utilization Cleared CUCM CTI Device Not Registered CUCM CTI Device Registered CUCM Gatekeeper Not Registered CUCM Gatekeeper Registered CUCM Gateway Not Registered CUCM Gateway Registered CUCM H323 Device Not Registered CUCM H323 Device Registered CUCM Media Device Not Registered CUCM Media Device Registered CUCM Phone Not Registered CUCM Phone Registered CUCM Process Memory High Utilization CUCM Process Memory High Utilization Cleared CUCM Voicemail Device Not Registered CUCM Voicemail Device Registered Device Clock Inconsistency Device Cold Reboot Table A-3 Event Identifiers Group ID 8 8 8 1024 1024 1024 1024 1024 1024 1024 1024 1024 8 8 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 8 8 Event ID 50 51 52 346 345 350 344 342 348 341 349 343 60 61 416 417 402 403 404 405 410 411 406 407 408 409 400 401 418 419 412 413 84 1 Internal Severity 6 2 10 4 4 2 2 4 4 2 4 4 4 2 8 2 10 2 10 2 10 2 10 2 10 2 10 2 8 2 10 2 6 8 EYE Events Guide A-6 .

Entuity Event Name Device CPU High Utilization Device CPU High Utilization Cleared Device Fan Failure Device Fan Failure Cleared Device High Temperature Device High Temperature Cleared Device Low Disk Space Device Low Disk Space Cleared Device Low Total Memory Device Low Total Memory Cleared Device Name Resolution Failure Device Name Resolution Failure Cleared Device Port(s) Utilization Accuracy at Risk Device Port(s) Utilization Accuracy Lost Device Port(s) Utilization Missed Due to Slow Response Device Reboot Detected Device Warm Reboot EGP Neighbor Loss EIGRP Peer Briefly Not Established EIGRP Peer Disappeared EIGRP Peer Newly Discovered Enterprise Trap EYE License Expired and This EYE Server is No Longer Operational EYE License on Remote Server Could Not be Updated EYE License on Remote Server Expired and No Longer Operational EYE License on Remote Server Successfully Updated EYE License Successfully Updated by License Server EYE Server Automated Shutdown EYE Server Component Restarting After Failure EYE Server Critical Component Restarting After Failure EYE Server Disk Space Alert EYE Server Explicit Server Shutdown Initiated Table A-3 Event Identifiers EYE Events Guide Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 8 8 8 8 8 8 8 8 1024 1024 1024 8 32 32 32 32 32 32 32 32 32 32 Event ID 310 311 938 937 940 939 314 315 312 313 88 89 86 85 87 5 2 9 146 144 145 10 17 13 14 15 18 16 4 10 9 2 6 Internal Severity 8 2 10 2 10 2 8 2 8 2 4 2 4 6 6 8 8 10 8 10 4 6 10 4 10 2 4 4 10 8 8 10 8 EYE License Was Not Updated by License Server and Will Expire 32 A-7 .

Entuity Event Name EYE Server Internal Event EYE Server License Alert EYE Server Permanent Component Failure EYE Server Shutdown Forced by Critical Failure to Restart EYE Server Started Firewall Access Control Violations High Firewall Access Control Violations High Cleared Firewall High Avail User Set Oper State Compliant Firewall High Avail User Set Oper State Non Compliant Firewall Overflow and Intrusion Violations High Firewall Overflow and Intrusion Violations High Cleared Firewall Packet Rate High Firewall Packet Rate High Cleared Firewall Peak Connections High Firewall Peak Connections High Cleared Firewall URL Alerts High Firewall URL Alerts High Cleared FR DLCI High BECN FR DLCI High BECN Cleared FR DLCI High DE FR DLCI High DE Cleared FR DLCI High FECN FR DLCI High FECN Cleared FR DLCI High Inbound Utilization FR DLCI High Inbound Utilization Cleared FR DLCI High Outbound Utilization FR DLCI High Outbound Utilization Cleared FR DLCI Link Down FR DLCI Link Up HSRP Port Group Activated HSRP Port Group Deactivated IP SLA Creation Failure IP SLA Creation Failure Cleared IP SLA High ICPIF Table A-3 Event Identifiers Group ID 32 32 32 32 32 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 1 3 8 7 5 900 901 1017 1018 902 903 700 701 702 703 904 905 3 4 5 6 1 2 7 8 9 10 11 12 175 176 234 235 236 Internal Severity 4 10 10 10 2 8 2 2 8 8 2 4 2 4 2 4 4 6 2 6 2 6 2 6 2 6 2 8 2 6 6 10 2 10 EYE Events Guide A-8 .

Entuity Event Name IP SLA High ICPIF Cleared IP SLA Low MOS IP SLA Low MOS Cleared IP SLA Test Failed IP SLA Test High Latency IP SLA Test High Latency Cleared IP SLA Test Succeeded KPI Port Duplex Suspected Mismatch (FCS) KPI Port Duplex Suspected Mismatch (FCS) Cleared LAP Antenna Host Count High LAP Antenna Host Count High Cleared LAP Antenna Host Count Low LAP Antenna Host Count Low Cleared Load Balancer High Client Connection Limit Pkt Drop Rate Load Balancer High Client Connection Limit Pkt Drop Rate Cleared Load Balancer High Client Connections Load Balancer High Client Connections Cleared Load Balancer High Client Hw Accel Connections Load Balancer High Client Hw Accel Connections Cleared Load Balancer High Inbound Error Rate Load Balancer High Inbound Error Rate Cleared Load Balancer High License Denied Pkt Rate Load Balancer High License Denied Pkt Rate Cleared Load Balancer High Memory Error Pkt Rate Load Balancer High Memory Error Pkt Rate Cleared Load Balancer High No Handler Denied Pkt Rate Load Balancer High No Handler Denied Pkt Rate Cleared Load Balancer High Non Syn Denied Pkt Rate Load Balancer High Non Syn Denied Pkt Rate Cleared Load Balancer High Outbound Error Rate Load Balancer High Outbound Error Rate Cleared Load Balancer High Packet Drop Rate Load Balancer High Packet Drop Rate Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 2 2 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 237 238 239 230 232 233 231 38 39 836 837 838 839 972 973 956 957 958 959 976 977 968 969 970 971 966 967 964 965 978 979 974 975 Internal Severity 2 10 2 10 10 2 2 6 2 4 2 4 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 EYE Events Guide A-9 .

Entuity Event Name Load Balancer High Server Connections Load Balancer High Server Connections Cleared Load Balancer High Server Hw Accel Connections Load Balancer High Server Hw Accel Connections Cleared Load Balancer Nortel High MP CPU 1sec Utilization Load Balancer Nortel High MP CPU 1sec Utilization Cleared Load Balancer Nortel High MP CPU 4sec Utilization Load Balancer Nortel High MP CPU 4sec Utilization Cleared Load Balancer Nortel High MP CPU 64sec Utilization Load Balancer Nortel High MP CPU 64sec Utilization Cleared Load Balancer Nortel High Real Server Current Sessions Load Balancer Nortel High Real Server Max Sessions Load Balancer Nortel High Real Server Max Sessions Cleared Load Balancer Nortel High SLB SP Current Sessions Load Balancer Nortel High SLB SP Current Sessions Cleared Load Balancer Pool Critical Member Availability Load Balancer Pool Critical Member Availability Cleared Load Balancer Pool Low Member Availability Load Balancer Pool Low Member Availability Cleared Load Balancer Virtual Server High Average Connection Duration Load Balancer Virtual Server High Average Connection Duration Cleared Load Balancer Virtual Server High Connection Request Rate Load Balancer Virtual Server High Connection Request Rate Cleared Load Balancer Virtual Server High Ephemeral Connections Load Balancer Virtual Server High Ephemeral Connections Cleared Load Balancer Virtual Server High Hw Accel Connections MAC Address High Port Count MAC Address High Port Count Cleared MAC Address New MAC Address Port Changed Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 2 2 2 2 Event ID 960 961 962 963 989 988 991 990 993 992 1001 1000 1003 1002 1005 1004 1015 1013 1016 1014 982 983 980 981 984 985 986 987 48 49 26 44 Internal Severity 10 2 10 2 10 2 10 2 8 2 10 2 10 2 10 2 10 2 8 2 10 2 10 2 10 2 10 2 6 2 6 6 Load Balancer Nortel High Real Server Current Sessions Cleared 1024 Load Balancer Virtual Server High Hw Accel Connections Cleared 1024 EYE Events Guide A-10 .

Entuity Event Name Module Down Module Major Fault Module Minor Fault Module Status 'Unknown Module Status OK MPLS LDP Entity Errors MPLS LDP Entity Errors Cleared MPLS LDP Entity Non-operational MPLS LDP Entity Operational MPLS LDP Entity Rejected Sessions MPLS LDP Entity Rejected Sessions Cleared MPLS LDP Entity Shutdown Notifications Received MPLS LDP Entity Shutdown Notifications Received Cleared MPLS LDP Entity Shutdown Notifications Sent MPLS LDP Entity Shutdown Notifications Sent Cleared MPLS LDP Peer Disappeared MPLS LDP Peer Newly Discovered MPLS LDP Peer Non-operational MPLS LDP Peer Operational MPLS LDP Peer TLV Errors MPLS LDP Peer TLV Errors Cleared MPLS LDP Peer Unknown Message Types MPLS LDP Peer Unknown Message Types Cleared MPLS LSR Interface High Discard Rate (Lookup Failure) MPLS LSR Interface High Discard Rate (Lookup Failure) Cleared MPLS LSR Interface High Error Free Discard Rate (RX) MPLS LSR Interface High Error Free Discard Rate (RX) Cleared MPLS LSR Interface High Error Free Discard Rate (TX) MPLS LSR Interface High Error Free Discard Rate (TX) Cleared MPLS LSR Interface High Fragmentation Rate MPLS LSR Interface High Fragmentation Rate Cleared MPLS LSR Interface Low Bandwidth MPLS LSR Interface Low Bandwidth Cleared MPLS LSR Interface Low Buffer Space Table A-3 Event Identifiers Group ID 4 4 4 '4 4 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 24 23 22 21 20 192 193 182 183 190 191 194 195 196 197 184 185 180 181 188 189 186 187 206 207 202 203 204 205 208 209 198 199 200 Internal Severity 10 10 8 6 2 8 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 10 2 6 2 6 2 6 2 6 2 6 2 6 EYE Events Guide A-11 .

Entuity Event Name MPLS LSR Interface Low Buffer Space Cleared MPLS LSR Platform High Discard Rate (Lookup Failure) MPLS LSR Platform High Discard Rate (Lookup Failure) Cleared MPLS LSR Platform High Error Free Discard Rate (RX) MPLS LSR Platform High Error Free Discard Rate (RX) Cleared MPLS LSR Platform High Error Free Discard Rate (TX) MPLS LSR Platform High Error Free Discard Rate (TX) Cleared MPLS LSR Platform High Fragmentation Rate MPLS LSR Platform High Fragmentation Rate Cleared MPLS LSR Platform Low Bandwidth MPLS LSR Platform Low Bandwidth Cleared MPLS LSR Platform Low Buffer Space MPLS LSR Platform Low Buffer Space Cleared MPLS VRF High Illegal Label Rate MPLS VRF High Illegal Label Rate Cleared MPLS VRF Interface BGP Neighbor Disappeared MPLS VRF Interface BGP Neighbor Newly Discovered MPLS VRF Non-operational MPLS VRF Operational Network Outage Network Outage Cleared New Module Discovered OSPF Peer Briefly Disappeared OSPF Peer Briefly Not Established OSPF Peer Established OSPF Peer Newly Discovered OSPF Peer Not Established Port Duplex Change Port Error Disable Alarm Port Error Disable Alarm Cleared Port High Inbound Discards (Dynamic) Port High Inbound Discards (Dynamic) Cleared Port High Inbound Fault (Dynamic) Port High Inbound Fault (Dynamic) Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 512 512 1024 1024 1024 1024 1024 1024 2 2 2 1024 1024 1024 1024 Event ID 201 218 219 214 215 216 217 220 221 210 211 212 213 224 225 228 227 223 222 7 8 912 162 164 161 163 160 20 40 41 385 384 389 388 Internal Severity 2 6 2 6 2 6 2 6 2 6 2 6 2 6 2 10 4 10 2 10 2 4 10 10 4 4 10 2 8 2 6 2 6 2 EYE Events Guide A-12 .

Entuity

Event Name
Port High Inbound Utilization (Dynamic) Port High Inbound Utilization (Dynamic) Cleared Port High Outbound Discards (Dynamic) Port High Outbound Discards (Dynamic) Cleared Port High Outbound Fault (Dynamic) Port High Outbound Fault (Dynamic) Cleared Port High Outbound Utilization (Dynamic) Port High Outbound Utilization (Dynamic) Cleared Port Link Down Port Link Up Port Low Inbound Utilization (Dynamic) Port Low Inbound Utilization (Dynamic) Cleared Port Low Outbound Utilization (Dynamic) Port Low Outbound Utilization (Dynamic) Cleared Port Operationally Down Port Operationally Down Cleared Port Outbound Discards High (Port Congestion) Port Outbound Discards High Cleared (No Port Congestion) Port Outbound Fault High (Transmit Errors) Port Outbound Fault High Cleared (No Transmit Errors) Port Speed Change Port Utilization Decreased Port Utilization High Port Utilization High Cleared Port Utilization Increased Port Utilization Low Port Utilization Low Cleared Power Supply Major Fault Power Supply Minor Fault Power Supply OK Power Supply Unknown Status QoS Above Bandwidth Limit QoS At Bandwidth Limit QoS Class Bit Rate High Table A-3 Event Identifiers

Group ID
1024 1024 1024 1024 1024 1024 1024 1024 2 2 1024 1024 1024 1024 1024 1024 2 2 2 2 2 2 2 2 2 2 2 8 8 8 8 1024 1024 1024

Event ID
397 396 383 382 387 386 393 392 2 3 395 394 391 390 36 37 16 17 12 13 21 27 22 23 26 24 25 124 122 120 126 56 57 100

Internal Severity
6 2 6 2 6 2 6 2 10 2 6 2 6 2 10 2 6 8 6 8 2 6 8 2 6 8 2 8 8 2 8 8 4 4

EYE Events Guide

A-13

Entuity

Event Name
QoS Class Bit Rate High Cleared QoS Class Drop Bit Rate High QoS Class Drop Bit Rate High Cleared QoS Class Drop Packet Rate (Buffer Shortage) High QoS Class Drop Packet Rate (Buffer Shortage) High Cleared QoS Queue Drop Bit Rate High QoS Queue Drop Bit Rate High Cleared QoS Under Bandwidth Limit Routing Broadcast Traffic High Routing Broadcast Traffic High Cleared Routing High No Routes To IP Destination Routing High No Routes To IP Destination Cleared Routing ICMP High Redirects Routing ICMP High Redirects Cleared Routing ICMP High TTL Exceeds Routing ICMP High TTL Exceeds Cleared Routing Low I/O Contiguous Memory Routing Low I/O Contiguous Memory Cleared Routing Low I/O Total Memory Routing Low I/O Total Memory Cleared Routing Low Processor Contiguous Memory Routing Low Processor Contiguous Memory Cleared Routing Low Processor Total Memory Routing Low Processor Total Memory Cleared Service Down Service State Unknown Service Up SLB SP 1 Second CPU Utilization High SLB SP 1 Second CPU Utilization Cleared SLB SP 4 Second CPU Utilization High SLB SP 4 Second CPU Utilization Cleared SLB SP 64 Second CPU Utilization High SLB SP 64 Second CPU Utilization Cleared SNMP Agent Not Responding Table A-3 Event Identifiers

Group ID
1024 1024 1024 1024 1024 1024 1024 1024 2 2 8 8 8 8 8 8 8 8 8 8 8 8 8 8 1024 1024 1024 1024 1024 1024 1024 1024 1024 8

Event ID
101 102 103 104 105 106 107 58 34 35 72 73 74 75 70 71 68 69 66 67 64 65 62 63 919 920 921 995 994 997 996 999 998 3

Internal Severity
2 4 2 8 2 4 2 2 6 2 4 2 4 2 4 2 4 2 4 2 4 2 4 2 10 6 2 10 2 10 2 10 2 10

EYE Events Guide

A-14

Entuity

Event Name
SNMP Agent Responding SNMP Agent Restart Detected SNMP Authentication Failure SSL Certificate Expired SSL Certificate Expiring SSL Proxy Service Administrative Available to SNMP Poll SSL Proxy Service Administrative Unavailable to SNMP Poll SSL Proxy Service Operational Available to SNMP Poll SSL Proxy Service Operational Unavailable to SNMP Poll STP New Root Device STP VLAN Topology Change Syslog Alert Syslog Critical Syslog Debug Syslog Emergency Syslog Error Syslog Information Syslog Notice Syslog Warning Virtualization Connection Failed Virtualization Connection Success VPN Load Average High VPN Load Average High Cleared VPN Network Port Utilization High VPN Network Port Utilization High Cleared VPN Tunnel Usage High VPN Tunnel Usage High Cleared WAN Port High Inbound Discards WAN Port High Inbound Discards Cleared WAN Port High Inbound Errors WAN Port High Inbound Errors Cleared WAN Port High Inbound Utilization WAN Port High Inbound Utilization Cleared WAN Port High Outbound Discards Table A-3 Event Identifiers

Group ID
8 1024 8 1024 1024 1024 1024 1024 1024 16 16 64 64 64 64 64 64 64 64 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024 1024

Event ID
4 254 8 1023 1024 1021 1022 1019 1020 1 2 2 3 8 1 4 7 6 5 65 64 600 601 604 605 602 603 32 33 28 29 20 21 34

Internal Severity
2 8 6 10 8 2 10 2 10 10 6 8 8 2 10 6 2 4 4 8 2 4 2 4 2 4 2 6 2 6 2 6 2 6

EYE Events Guide

A-15

Information Only which is color coded green. You should backup amended help files as they are not currently maintained during EYE upgrades. you should only use event identifiers in the reserved range of 430 to 510. To ensure the events you define do not conflict with events supplied with EYE. Event Name User defined Group ID 1024 Event ID 430 to 510 Internal Severity 2 or 8 Table A-4 Reserved Events for Custom Poller For each event EYE includes a HTML help file. Severe which is color coded orange.Entuity Event Name WAN Port High Outbound Discards Cleared WAN Port High Outbound Errors WAN Port High Outbound Errors Cleared WAN Port High Outbound Utilization WAN Port High Outbound Utilization Cleared WAN Port Low Inbound Utilization WAN Port Low Inbound Utilization Cleared WAN Port Low Outbound Utilization WAN Port Low Outbound Utilization Cleared Table A-3 Event Identifiers Group ID 1024 1024 1024 1024 1024 1024 1024 1024 1024 Event ID 35 30 31 24 25 22 23 26 27 Internal Severity 2 6 2 6 2 6 2 6 2 Custom Poller Event Identifiers Custom Poller allows you to define events to raise against the data it polls. clearing events have a severity level of 2. Raising events have a severity level of 8. so the content meets your requirements. which is part of the context-sensitive help system. These events all belong to the event group 1024. Custom Poller help files are located in entuity_home\lib\httpd\EOS\help\WebHelp\ mergedProjects\EventsReserved\EYE_EventsReserved\eyeEventsReserved . You can amend the help file. EYE Events Guide A-16 .

1-31. 1-31. 1-23. 1-19. 1-146. 1-25 BladeCenter Blower failed 1-26 slow 1-27 BladeCenter Chassis rail high voltage 1-27. 1-33. 1-18. 1-32.323 Device Registered 1-49 CUCM Media Device Not Registered 1-49 CUCM Media Device Registered 1-50 CUCM Phone Not Registered 1-50 CUCM Phone Registered 1-51 CUCM Process Memory High Utilization 1-51 CUCM Process Memory High Utilization Cleared 1-52 CUCM Voicemail Device Not Registered 1-52 B Backplane utilization high 1-13. 1-21. 1-16 Peer Established 1-16 Peer Newly Discovered 1-16 Peer Not Established 1-17 BladeCenter Blade powered off 1-26 rail high voltage 1-17. 1-15 Bandwidth above limit 1-124 at limit 1-124 under limit 1-127 BGP Peer Briefly Disappeared 1-16 Peer Briefly Established 1-15. 1-147 CPU CUCM utilization high 1-46 high device utilization 1-45 CRC Errors 1-76 CUCM CPU Utilization High 1-46 CUCM CPU Utilization High Cleared 1-46 CUCM CTI Device Not Registered 1-47 CUCM CTI Device Registered 1-47 CUCM Gatekeeper Not Registered 1-48 CUCM Gatekeeper Registered 1-48 CUCM Gateway Not Registered 1-48 CUCM Gateway Registered 1-49 CUCM H. 1-24 rail low voltage 1-18.323 Device Not Registered 1-49 CUCM H. 1-34. 1-35 BladeCenter CPU temperature high 1-36 BladeCenter DASD1 temperature high 1-37 BladeCenter Front Panel temperature high 1-38 EYE Events Guide Index-1 . 1-29.Entuity Index A Application unavailable 1-9 Availability Monitor application high latency 1-10 application unavailable 1-9 BladeCenter Management Module temperature high 1-38 C Chassis fan major fault 1-39 fan minor fault 1-39 fan status unknown 1-40 major alarm 1-40 minor alarm 1-41 temperature alarm 1-41. 1-21. 1-22. 1-23. 1-14. 1-34 rail low voltage 1-28. 1-42 Community String authentication failure 1-135 Congestion port events 1-113. 1-29. 1-20. 1-30. 1-119.

1-66 Firewall Access Control Violations High 1-64. 1-64 Dynamic Thresholds high inbound faults 1-112 port high inbound discards 1-111. 1-115 Events group A-1 identifier A-1 missing 1-93 supported in EYE 1-1 EYE Server disk space 1-62. 1-63. 1-66. 1-67. 1-63. 1-64 internal event 1-63 shutdown 1-61 F Fan chassis major fault 1-39 chassis minor fault 1-39 chassis status unknown 1-40 Firewall High Availability events 1-65. 1-63. 1-14. 1-115 Inbound Faults dynamic threshold events 1-112 EYE Events Guide Index-2 . 1-69 Firewall Packet Rate High 1-67 Firewall Packet Rate High Cleared 1-67 Firewall Peak Connections High 1-68 Firewall Peak Connections High Cleared 1-68 Frame Relay BECNs high 1-69 DE high 1-70 DLCI link down 1-72 DLCI link up 1-72 FECN high 1-70 inbound utilization high 1-71 outbound utilization high 1-71 E EGP Neighbor Loss 1-58 EIGRP Peer Briefly Disappeared 1-58 Peer Briefly Established 1-58 Peer Newly Discovered 1-59 Enterprise Trap 1-59 entuity. 1-64 diskMonitor EYE server disk space 1-62. 1-123 power supply state 1-123 rebooted 1-57 STP new root 1-137 warm reboot 1-57 Discards events 1-144 Disk Space EYE server 1-62.Entuity CUCM Voicemail Device Registered 1-53 Custom Poller event help A-16 D Device CPU High Utilization n of m setting 1-45 Device Low Disk Space Cleared event 1-55 Device Low Disk Space event 1-54 Device Low Total Memory Cleared event 1-55 Device Low Total Memory event 1-55 Devices backplane high utilization 1-13.cfg stickystate 1-134 ICPIF high 1-73 I ICMP High Redirects 1-128 Inbound Discards port high 1-111. 1-15 cold reboot 1-53 CPU high utilization 1-45 EGP Neighbor Loss 1-58 low memory 1-55 name resolution failure 1-56 power supply fault 1-122. 1-68 Firewall Access Control Violations High Cleared 1-65.

1-43 Port Active Down MAC Addresses high port count 1-90 machistorylimit 1-91. 1-108 Policy Violations events bad practice violation 1-42 good practice violation 1-42. 1-145 Ping ports unavailable 1-107. 1-108 Memory device running low 1-55 Missing Events A-1 Module major fault 1-94 minor fault 1-94 status unknown 1-94 MOS low 1-74 N N of M Events sticky state 1-134 Node down 1-107. 1-108 L License Server contacted remote server 1-60 license expired 1-59 remote server license invalid 1-60 remote server uncontactable 1-60. 1-92 new 1-91 port change 1-92 macman machistorylimit 1-91. 1-116.Entuity Internal Event EYE server 1-63 IP Address high broadcast traffic 1-128 IP SLA Creation Failure 1-73 IP SLA Creation Failure Cleared 1-73 IP SLA High ICPIF 1-73 IP SLA High ICPIF Cleared 1-74 IP SLA Low MOS 1-74 IP SLA Low MOS Cleared 1-74 IP SLA Operations creation failure event 1-73 IP SLA Test Failed 1-74 IP SLA Test High Latency 1-75 IP SLA Test High Latency Cleared 1-75 IP SLA Test Succeeded 1-75 device low disk space cleared event 1-55 device low disk space event 1-54 device low total memory cleared event 1-55 device low total memory event 1-55 Managed Object down 1-107. 1-61 Licensing server alert 1-63 Link Down DLCI 1-72 ports 1-116 Link Up DLCI 1-72 ports 1-117 O Operations connection failed event 1-74 creation succeeded event 1-73 OSPF Peer Briefly Disappeared 1-109 Peer Briefly Established 1-109 Peer Established 1-109 Peer Newly Discovered 1-110 Peer Not Established 1-110 P M Packet Corruption events 1-112. 1-92 Managed Hosts EYE Events Guide Index-3 .

cfg Device CPU High Utilization 1-45 sw_n_of_m_high_port_utilisation. 1-122 VPN utilization high 1-143 WAN inbound discards 1-144.cfg Port Utilization High 1-121 Q QoS above bandwidth limit 1-124 at bandwidth limit 1-124 under bandwidth limit 1-127 R Routing broadcast traffic high 1-127 I/O contiguous memory low 1-129 I/O total memory low 1-130 EYE Events Guide Index-4 . 1-147 duplex change 1-110 error disable alarm 1-110 link down 1-116 link up 1-117 MAC addresses change 1-92 high port count 1-90 new 1-91 speed change 1-120 transmit errors 1-114. 1-117. 1-113. 1-145 WAN inbound utilization 1-145 WAN outbound discards 1-146 Power Supply major fault 1-122 minor fault 1-123 unknown state 1-123 ICMP high redirects 1-128 ICMP high TTL exceeded 1-129 no routes to IP destination 1-128 processor contiguous memory low 1-130 processor total memory low 1-131 Running Configuration change events 1-43 S Security MAC address change 1-92 Server Shutdown 1-61 Service Summary 1-132 Services events 1-132 SNMP Authentication Failure 1-135 not responding 1-134. 1-118. 1-121 utilization increased 1-122 utilization low 1-117. 1-115. 1-114. 1-108 utilization decreased 1-121 utilization high 1-112. 1-118. 1-120 unavailable to ping 1-107. 1-146. 1-135 SNMP Agent Not Responding n of m setting 1-134 stickystate 1-134 snmpSet firewall restrictions 1-73 SSL Proxy Service Administrative Available to SNMP Poll 1-136 SSL Proxy Service Administrative Unavailable to SNMP Poll 1-136 SSL Proxy Service Operational Available to SNMP Poll 1-136 SSL Proxy Service Operational Unavailable to SNMP Poll 1-137 Startup Configuration change events 1-44 Sticky Event Settings SNMP Agent Not Responding 1-134 STP New Root Device 1-137 STP VLAN Topology Change 1-137 sw_n_of_m_cpu. 1-119.Entuity n of m setting 1-118 Port Duplex Suspected Mismatch 1-76 Port Utilization High n of m setting 1-121 Port Utilization Low n of m setting 1-122 Ports change MAC addresses 1-92 congestion 1-113.

1-122 port. 1-117. 1-141 MOS low cleared 1-74 VPN excessive application traffic 1-142 VPN Load Average 1-142 VPN Load Average Cleared 1-143 VPN Network Port Utilization High 1-143 VPN Network Port Utilization High Cleared 1-143 VPN Tunnel Usage High 1-143 VPN Tunnel Usage High Cleared 1-144 T Transmit Errors ports 1-114.cfg Port Active Down 1-118 Syslog events 1-138.cfg SNMP Agent Not Responding 1-134 sw_n_of_m_port_active_status. 1-114. 1-121 port. increased 1-122 port. 1-139. 1-118.Entuity Port Utilization Low 1-122 WAN Port High Inbound Utilization 1-145 WAN Port High Outbound Utilization 1-147 WAN Port Low Inbound Utilization 1-148 WAN Port Low Outbound Utilization 1-149 sw_n_of_m_NofMSNMPPoller. high 1-112. 1-122 port. 1-118. 1-115. reduced 1-121 VCC high outbound 1-6 VCC low inbound 1-7 VCC low outbound 1-8 VPN network ports 1-143 WAN ports inbound 1-145 WAN ports inbound utilization 1-148 WAN ports outbound 1-147 WAN ports outbound utilization 1-148 Utilization CUCM process memory 1-51 V VCC link down 1-7 link up 1-7 VLANs STP topology change 1-137 VoIP ICPIF high 1-73 ICPIF high cleared 1-74 MOS low 1-74 EYE Events Guide Index-5 . low 1-117. 1-113. 1-120 W WAN Port High Inbound Utilization n of m setting 1-145 WAN Port High Outbound Utilization n of m setting 1-147 WAN Port Low Inbound Utilization n of m setting 1-148 WAN Port Low Outbound Utilization n of m setting 1-149 WAN Ports high inbound discards 1-144 high inbound discards cleared 1-144 high inbound errors 1-145 high inbound errors cleared 1-145 high inbound utilization 1-145 high inbound utilization cleared 1-146 high outbound discards 1-146 high outbound discards cleared 1-146 inbound utilization low 1-148 inbound utilization low cleared 1-148 outbound errors cleared 1-147 outbound errors high 1-147 outbound utilization high 1-147 outbound utilization high cleared 1-148 outbound utilization low 1-148 outbound utilization low cleared 1-149 U Utilization events 1-121. 1-140.

*223224* .