Avaya IX WEM V15 2 System Monitoring Messaging and Alarms Guide

Avaya Workforce Engagement
System Monitoring, Logs, and Alarms

Version 15.2
April 14, 2023

Revision 1.20
Third Party Components
Certain software programs or portions thereof included in the Software may contain
© 2023 Avaya Inc. software (including open source software) distributed under third party agreements
All Rights Reserved. ("Third Party Components"), which may contain terms that expand or limit rights to use
Notice certain portions of the Software ("Third Party Terms"). Information regarding distributed
While reasonable efforts have been made to ensure that the information in this document is Linux OS source code (for any Software that has distributed Linux OS source code) and
complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya identifying the copyright holders of the Third Party Components and the Third Party
reserves the right to make changes and corrections to the information in this document without Terms that apply is available in the Software, Documentation or on Avaya's website at:
the obligation to notify any person or organization of such changes. http://support.avaya.com/Copyright (or a successor site as designated by Avaya).
Documentation disclaimer The following applies only if the H.264 (AVC) codec is distributed with the product. THIS
"Documentation" means information published in varying mediums which may include product PRODUCT IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE FOR
information, operating instructions and performance specifications that are generally made THE PERSONAL USE OF A CONSUMER OR OTHER USES IN WHICH IT DOES NOT
available to users of products. Documentation does not include marketing materials. Avaya RECEIVE REMUNERATION TO (i) ENCODE VIDEO IN COMPLIANCE WITH THE
shall not be responsible for any modifications, additions, or deletions to the original published AVC STANDARD ("AVC VIDEO") AND/OR (ii) DECODE AVC VIDEO THAT WAS
version of Documentation unless such modifications, additions, or deletions were performed ENCODED BY A CONSUMER ENGAGED IN A PERSONAL ACTIVITY AND/OR WAS
by Avaya. You agree to indemnify and hold harmless Avaya, Avaya's agents, servants and OBTAINED FROM A VIDEO PROVIDER LICENSED TO PROVIDE AVC VIDEO. NO
employees against all claims, lawsuits, demands and judgments arising out of, or in LICENSE IS GRANTED OR SHALL BE IMPLIED FOR ANY OTHER USE.
connection with, subsequent modifications, additions or deletions to this documentation, to the ADDITIONAL INFORMATION MAY BE OBTAINED FROM MPEG LA, L.L.C. SEE
extent made by You. HTTP://WWW.MPEGLA.COM
Link disclaimer Service Provider
Avaya is not responsible for the contents or reliability of any linked websites referenced within THE FOLLOWING APPLIES TO AVAYA CHANNEL PARTNER'S HOSTING OF
this site or documentation provided by Avaya. Avaya is not responsible for the accuracy of any AVAYA PRODUCTS OR SERVICES. THE PRODUCT OR HOSTED SERVICE MAY
information, statement or content provided on these sites and does not necessarily endorse USE THIRD PARTY COMPONENTS SUBJECT TO THIRD PARTY TERMS AND
the products, services, or information described or offered within them. Avaya does not REQUIRE A SERVICE PROVIDER TO BE INDEPENDENTLY LICENSED DIRECTLY
guarantee that these links will work all the time and has no control over the availability of the FROM THE THIRD PARTY SUPPLIER. AN AVAYA CHANNEL PARTNER'S HOSTING
linked pages. OF AVAYA PRODUCTS MUST BE AUTHORIZED IN WRITING BY AVAYA AND IF
Warranty THOSE HOSTED PRODUCTS USE OR EMBED CERTAIN THIRD PARTY
Avaya provides a limited warranty on Avaya hardware and software. Refer to your sales SOFTWARE, INCLUDING BUT NOT LIMITED TO MICROSOFT SOFTWARE OR
agreement to establish the terms of the limited warranty. In addition, Avaya's standard CODECS, THE AVAYA CHANNEL PARTNER IS REQUIRED TO INDEPENDENTLY
warranty language, as well as information regarding support for this product while under OBTAIN ANY APPLICABLE LICENSE AGREEMENTS, AT THE AVAYA CHANNEL
warranty is available to Avaya customers and other parties through the Avaya Support PARTNER'S EXPENSE, DIRECTLY FROM THE APPLICABLE THIRD PARTY
website: SUPPLIER.
http://support.avaya.com/helpcenter/getGenericDetails?detailId=C20091120112456651010 WITH RESPECT TO CODECS, IF THE AVAYA CHANNEL PARTNER IS HOSTING
under the link "Warranty & Product Lifecycle" or such successor site as designated by Avaya. ANY PRODUCTS THAT USE OR EMBED THE G.729 CODEC, H.264 CODEC, OR
Please note that if You acquired the product(s) from an authorized Avaya Channel Partner H.265 CODEC, THE AVAYA CHANNEL PARTNER ACKNOWLEDGES AND AGREES
outside of the United States and Canada, the warranty is provided to You by said Avaya THE AVAYA CHANNEL PARTNER IS RESPONSIBLE FOR ANY AND ALL RELATED
Channel Partner and not by Avaya. FEES AND/OR ROYALTIES. THE G.729 CODEC IS LICENSED BY SIPRO LAB
"Hosted Service" means an Avaya hosted service subscription that You acquire from either TELECOM INC. SEE WWW.SIPRO.COM/CONTACT.HTML. THE H.264 (AVC)
Avaya or an authorized Avaya Channel Partner (as applicable) and which is described further CODEC IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE FOR THE
in Hosted SAS or other service description documentation regarding the applicable hosted PERSONAL USE OF A CONSUMER OR OTHER USES IN WHICH IT DOES NOT
service. If You purchase a Hosted Service subscription, the foregoing limited warranty may RECEIVE REMUNERATION TO: (I) ENCODE VIDEO IN COMPLIANCE WITH THE
not apply but You may be entitled to support services in connection with the Hosted Service as AVC STANDARD ("AVC VIDEO") AND/OR (II) DECODE AVC VIDEO THAT WAS
described further in your service description documents for the applicable Hosted Service. ENCODED BY A CONSUMER ENGAGED IN A PERSONAL ACTIVITY AND/OR WAS
Contact Avaya or Avaya Channel Partner (as applicable) for more information. OBTAINED FROM A VIDEO PROVIDER LICENSED TO PROVIDE AVC VIDEO. NO
Hosted Service LICENSE IS GRANTED OR SHALL BE IMPLIED FOR ANY OTHER USE.
THE FOLLOWING APPLIES ONLY IF YOU PURCHASE AN AVAYA HOSTED SERVICE ADDITIONAL INFORMATION FOR H.264 (AVC) AND H.265 (HEVC) CODECS MAY
SUBSCRIPTION FROM AVAYA OR AN AVAYA CHANNEL PARTNER (AS APPLICABLE), BE OBTAINED FROM MPEG LA, L.L.C. SEE HTTP://WWW.MPEGLA.COM.
THE TERMS OF USE FOR HOSTED SERVICES ARE AVAILABLE ON THE AVAYA Compliance with Laws
WEBSITE, HTTP://SUPPORT.AVAYA.COM/LICENSEINFO UNDER THE LINK "Avaya You acknowledge and agree that it is Your responsibility for complying with any
Terms of Use for Hosted Services" OR SUCH SUCCESSOR SITE AS DESIGNATED BY applicable laws and regulations, including, but not limited to laws and regulations related
AVAYA, AND ARE APPLICABLE TO ANYONE WHO ACCESSES OR USES THE HOSTED to call recording, data privacy, intellectual property, trade secret, fraud, and music
SERVICE. BY ACCESSING OR USING THE HOSTED SERVICE, OR AUTHORIZING performance rights, in the country or territory where the Software is used.
OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM Preventing Toll Fraud
YOU ARE DOING SO (HEREINAFTER REFERRED TO INTERCHANGEABLY AS "YOU" "Toll Fraud" is the unauthorized use of your telecommunications system by an
AND "END USER"), AGREE TO THE TERMS OF USE. IF YOU ARE ACCEPTING THE unauthorized party (for example, a person who is not a corporate employee, agent,
TERMS OF USE ON BEHALF A COMPANY OR OTHER LEGAL ENTITY, YOU subcontractor, or is not working on your company's behalf). Be aware that there can be
REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY TO THESE a risk of Toll Fraud associated with your system and that, if Toll Fraud occurs, it can
TERMS OF USE. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT WISH result in substantial additional charges for your telecommunications services.
TO ACCEPT THESE TERMS OF USE, YOU MUST NOT ACCESS OR USE THE HOSTED Avaya Toll Fraud Intervention
SERVICE OR AUTHORIZE ANYONE TO ACCESS OR USE THE HOSTED SERVICE. If You suspect that You are being victimized by Toll Fraud and You need technical
Licenses assistance or support, call Technical Service Center Toll Fraud Intervention Hotline at
THE AVAYA GLOBAL SOFTWARE LICENSE TERMS FOR VERINT SOFTWARE +1-800-643-2353 for the United States and Canada. For additional support telephone
PRODUCTS AVAILABLE ON THE AVAYA WEBSITE, numbers, see the Avaya Support website: http://support.avaya.com, or such successor
HTTP://SUPPORT.AVAYA.COM/LICENSEINFO, OR SUCH SUCCESSOR SITE AS site as designated by Avaya.
DESIGNATED BY AVAYA, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES Security Vulnerabilities
AND/OR INSTALLS THE SOFTWARE (AS DEFINED IN THE AVAYA GLOBAL SOFTWARE Information about Avaya's security support policies can be found in the Security Policies
LICENSE TERMS FOR VERINT SOFTWARE PRODUCTS), AND WHO PURCHASED THE and Support section of https://support.avaya.com/security Suspected Avaya product
LICENSE FROM AVAYA OR AN AVAYA CHANNEL PARTNER (AS APPLICABLE) UNDER security vulnerabilities are handled per the Avaya Product Security Support Flow
A COMMERCIAL AGREEMENT WITH AVAYA OR AN AVAYA CHANNEL PARTNER. (https://support.avaya.com/css/P8/documents/100161515).
REFER TO THE AVAYA SOFTWARE LICENSE TERMS FOR VERINT SOFTWARE Trademarks
PRODUCTS FOR INFORMATION REGARDING THE APPLICABLE LICENSE TYPES The trademarks, logos and service marks ("Marks") displayed in this site, the
PERTAINING TO THE SOFTWARE. Documentation, any Hosted Service(s), and product(s) provided by Avaya are the
All Rights Reserved registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are
Avaya and/or its licensors retain title to and ownership of the Software, Documentation, and not permitted to use such Marks without prior written consent from Avaya or such third
any modifications or copies thereof. Except for the limited license rights expressly granted in party which may own the Mark. Nothing contained in this site, the Documentation,
the applicable Avaya Global Software License Terms for Verint Software Products, Avaya Hosted Service(s) and product(s) should be construed as granting, by implication,
and/or its licensors reserve all rights, including without limitation copyright, patent, trade estoppel, or otherwise, any license or right in and to the Marks without the express
secret, and all other intellectual property rights, in and to the Software and Documentation and written permission of Avaya or the applicable third party.
any modifications or copies thereof. The Software contains trade secrets of Avaya and/or its Avaya is a registered trademark of Avaya Inc. All non-Avaya trademarks are the
licensors, including but not limited to the specific design, structure and logic of individual property of their respective owners.
Software programs, their interactions with other portions of the Software, both internal and Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.
external, and the programming techniques employed. Downloading Documentation
Virtualization For the most current versions of Documentation, see the Avaya Support website:
The following applies if the product is deployed on a virtual machine. Each product has its own http://support.avaya.com, or such successor site as designated by Avaya.
ordering code and license types. Note that each Instance of a product must be separately Contact Avaya Support
See the Avaya Support website: http://support.avaya.com for product or Hosted Service
licensed and ordered. For example, if the end user customer or Avaya Channel Partner would
notices and articles, or to report a problem with your Avaya product or Hosted Service.
like to install two Instances of the same type of products, then two products of that type must
For a list of support telephone numbers and contact addresses, go to the Avaya Support
be ordered.
website: http://support.avaya.com (or such successor site as designated by Avaya),
scroll to the bottom of the page, and select Contact Avaya Support.
C o n t e n t s
About this guide 7

Active alarms and the Alarm Dashboard 11
Alarm Dashboard overview 12
Alarm priorities 15
View a list of active alarms in the enterprise 16
Enterprise Alarms pane reference 17
Customize the Enterprise Alarms pane column display 21
Filtering the list of active alarms 22
Filter the list of active alarms 23
Filter pane reference 24
Viewing all instances of an active alarm 29
View all instances of an active alarm 29
Instances pane reference 30
View a list of servers on which an alarm is active 33
Servers pane reference 34
View the active alarms for Desktops 37
Desktops pane reference 37
View active alarm details and corrective actions 40
Details pane reference 41
Acknowledging active alarms 43
Acknowledge an active alarm 43
Export active alarms to a text file 45
Open Recorder Manager or Enterprise Manager Agent from the Alarm Dashboard 46
Alarms in Enterprise Manager Agent and Recorder Manager 47
View active alarms from EMA or RM 48
Active Alarms screen reference 49
Active Alarm Details screen reference 51
View the corrective action for an alarm 53
Acknowledge an alarm from EMA or RM 54
Acknowledge multiple alarms simultaneously from EMA or RM 55
View alarms in Alarm History 56
Alarm History screen reference 57
Clear alarms in Alarm History 59
Recorder Health Summary 60
Recorder Health Summary overview 61
Health assessment based on alarm thresholds 62
Set the scope for the Recorder Health Summary 64
Recorder Health Summary reference 65
Alarm notification profiles 67
Alarm notification profile overview 68
Standard notification profiles 69
Make the standard notification profiles operational 71
Test and acknowledge alarms from the Alarm Testing notification profile 73
Viewing the list of alarm notification profiles 75
View the list of alarm notification profiles 75
Notification Profiles List screen reference 76
Changing the email addresses and SNMP nodes assigned to a notification profile 78
Editing notification profiles at different nodes of the Installations tree 78
Example: Editing notification profiles at different nodes of the Installations tree 78
Change the email address and SNMP node assignments 80
Notification Profile configuration screen reference 81
Custom notification profiles 84
Example: Custom notification profile usage 84
Workflow: Custom notification profile configuration 85
Create a custom notification profile 85
Delete an alarm notification profile 87
Alarm configuration options 88
Configure Global Alarm Settings 89
Configure Audible Notifications for all alarms 89
Enable E-Mail and SNMP Notifications for notification profiles 90
Configure how long acknowledged alarms display in the Alarm History tab 90
Change or create an alarm priority 91
Add v1/v2c SNMP nodes for notification profiles 91
Add v3 SNMP nodes for notification profiles 92
Global Alarm Settings screen reference 94
Configuring individual alarm settings 99
Installation tree hierarchy and alarm configuration 99
View the list of alarms for each Installations node 101
Configure Alarms screen reference 102
Enable an alarm 104
Configure Audible Notification for an individual alarm 105
Change the Priority assigned to an alarm 106
Schedule an alarm 107
Change the notification profiles assigned to an alarm 108
Configure Alarm screen reference 110
Edit multiple alarms simultaneously 115
Avaya Workforce Engagement System Monitoring, Logs, and Alarms 4
Confidential and Proprietary Information of Verint Systems Inc.

Configuring alarm filters 117
Create an alarm filter 117
Create Filter screen reference 118
Edit an alarm filter 119
Delete an alarm filter 120
Reset alarms to their default settings 121
SNMP MIB files 122
Deploy the MIB files 123
Locate the MIB files 123
Copy the MIB files 123
Enable the SNMP configuration tool to use the MIB files 124
Compile the MIB files 124
Configure the Event Filter 126
SNMP MIB structure 133
SNMPv3 discovery 135
SNMPv3 queries 136
Alarms Spreadsheet 138
Alarms Spreadsheet Contents 139
Alarm attributes 140
Advanced Corrective Actions Are For Certified Support Personnel Only 143
System logs 144
Using WFO Log Manager to Activate Log Files 145
WFO Log Viewer Configuration 146
Viewing Log Files 147
Customizing the Log Viewer Display 148
Using the Customize Window 149
Log file storage 150
Log file types and storage directories 150
Active log files 151
Zipped log files 151
Log file zipping process 152
Automatic deletion of zipped log files 152
Configure log file storage for application, EMA, and RM logs 153
Configure log file storage for WFO Logs 155
Log Viewer configuration and log configuration files 155
Configure log file storage for WFO logs 156
View stored log files 158
HTTP access logs 159
Audit trail 160
Using the system Audit Viewer 161

Specifying the Audit Viewer search criteria 161
Audit Viewer search screen reference 163
Viewing the audit trail 167
Audit Viewer search results screen reference 170
Export the audit trail 172
Actions that can be audited for each module 175
Interactions Audit Trails 195
Interactions Audit Trail information 195
Form Fillout Audit Trail information 199
Form Designer Audit Trail information 202
Project Rules Manager Audit Trail information 204
Assignment Manager Audit Trail information 204
DAS API Audit Trail information 205
Analytics Audit Trails 207
Speech Analytics Portal Audit Trail information 207
Speech Analytics Search Activity Audit Trail information 208
Speech Analytics Search Activity logged information 209
Examples of user search Audit Trail logs 210
Speech Analytics System Audit Trail 211
Text Analytics System Audit Trail 214
Audit Trail file viewing 216
View Audit Trail files in a Text Editor 216
View Audit Trail files in Microsoft Excel 216
Troubleshooting 217
Troubleshooting procedures 218
Email notifications are not sent when an alarm is triggered 218
Preventing the “Error Retrieving Performance Counter” alarm in mixed language server
configurations 218
What is a mixed language server configuration? 219
Windows Performance Counter and the Error Retrieving Performance Counter Alarm 219
Preventing the alarm from being raised 220

P r e f a c e
About this guide
This guide explains how to view, configure, and acknowledge system alarms. Alarms alert
you to conditions on the servers that can adversely affect server performance. Alarms also
provide important information about the status of servers in the enterprise.
This guide also discusses the logging and auditing features of the system.
Intended audience
This guide is designed to be used by:
 Verint and Business Partner professional services staff responsible for the configuration,
operation, or maintenance of systems.
 Customers’ IT staff responsible for system maintenance.
 Enterprise administrators and system integrators
Document revision history
Revision Description of changes
1.20 Minor editorial revisions.
1.19 In Actions that can be audited for each module, added new
audited events for the Project Rules manager.
1.18  In Actions that can be audited for each module, removed

Automated Verification actions.
1.17  In the topic "Using the system Audit Viewer", removed a list of
suite applications that generate audit trails.
About this guide
1.16 Updates for V15.2 2021R1:

 In the Notification Profiles chapter, added documentation for
the new Testing Alarms notification profile. This notification
profile allows you to test that the alarm system is working.
 In the Actions that can be audited for each module topic,
added audited actions for Legal Hold.
1.15 Updates for V15.2 2020R1:

 Removed reference to the Detach icon on the Details pane of
the Alarm Dashboard.
 In the topic "Actions that can be audited for each module", in
the Data Access Services module section, changed "Get
redaction sequences" to "Get data masking sequences."
1.14 Aligned audited activity for Identity Authentication and Fraud

Detection and Risk Management.
1.13 Removed references to ema.error log, ema.debug.log, rm.error

log, and rm.debug log.
1.12 Updates for V15.2 HFR7:

 In the "Specifying the Audit Viewer search criteria" topic, the
new Details: Name and Details: Value search filters are
described.

 On the Audit Viewer screen, the "View" button is changed to
the "Search" button.
 On the Audit Viewer search results screen, the "Restart"
button is changed to "Rerun Search", and the "Configure"
button is changed to "Back to Search".
 From the "Audit trail" topic, removed a sentence indicating
audit actions for the Framework Application are logged in the
BPMAIN database.
 Updated the Modules and Actions listed in the table in the
"Actions that can be audited for each module" topic.
1.10 Noted that when the Text Search field is not used in the Audit
Viewer, a maximum of 10000 audit entries are returned.
1.09 Noted that when the Text Search field is used in the Audit Viewer,
a maximum of 5000 audit entries are returned.

About this guide

 Section Actions that can be audited for each module: Updated
table with list of actions audited for Text Analytics and
Interactions.
 Section Text Analytics System Audit Trail: New section describing
actions audited in the Text Analytics Portal.
 Removed sections Speech Analytics Portal Audit Trail
information, Speech Analytics Search Activity Audit Trail
information, Speech Analytics Search Activity logged information,
as all Speech Analytics actions are now audited in the Audit
Viewer.
 Removed section Interactions and Analytics Audit Trails
overview. Moved information to Interactions Audit Trails, as this
information is now only relevant for the Interactions
application.
 Added a new chapter for the Recorder Health Summary.
 Documented the new "Text Search" feature of the Audit
Viewer.
1.07 Sections Actions that can be audited for each module and Speech
Analytics Portal System Audits: Added list of events audited in the
Tune Transcript workspace.

 Under "HTTP access logs", updated the log details for the
Secure Gateway component.
 Removed text indicating the Community setting is optional
when configuring SNMP nodes. Community is a required
setting.
1.05  This book is renamed from System Monitoring, Messaging, and

Alarms Guide to System Monitoring, Logs, and Alarms Guide.
 A new "Audit Trail" chapter is added.
 A new "System Logs" chapter is added.
 "System Logs" chapter includes details of FIS logs.
 Updated with new Verint branding (logo and colors).
1.04 All references to TAS are removed from the guide.

Adding the SNMPv3 Discovery and SNMPv3 queries topics.
1.03 New for HRF1:

 New chapter: TAS SNMP Alarms

About this guide
1.02 Adding text indicating the audible notification feature is not

available for Windows Performance Counter alarms.
1.01 Adding the Alarms Spreadsheet as an attachment to the PDF

version of this document.
1.00 The following changes are new for this release:

 Documentation added explaining how to export all active
alarms to a tab-delimited text file.

C h a p t e r 1
Active alarms and the Alarm

Dashboard
Use the Alarm Dashboard to view or acknowledge any active alarm on servers in the
enterprise.
Topics
Alarm Dashboard overview 12

Alarm priorities 15
View a list of active alarms in the enterprise 16
Filtering the list of active alarms 22
Viewing all instances of an active alarm 29
View a list of servers on which an alarm is active 33
View the active alarms for Desktops 37
View active alarm details and corrective actions 40
Acknowledging active alarms 43
Export active alarms to a text file 45
Open Recorder Manager or Enterprise Manager Agent from the Alarm Dashboard 46
Active alarms and the Alarm Dashboard Alarm Dashboard overview
Alarm Dashboard overview

Use the Alarm Dashboard to view or acknowledge any active alarm on any server in the enterprise.
Alarms alert you to conditions on a server that can adversely affect server performance. Alarms also
provide important information about the status of servers in the enterprise.
You can also use the Alarm Dashboard to view alarms on remote desktop systems that have
registered to display alarms in the Alarm Dashboard.
The Alarm Dashboard displays all active alarms on all servers or desktops in the system. This
dashboard provides a variety of ways to filter the alarms and view information about them. You can
also acknowledge alarms from the alarm dashboard.
Alarm Dashboard panes

The Alarm Dashboard contains these five panes that you use to work with active alarms:
 Filter - Use options in this pane to control the active alarms that display in the dashboard. You can
display all active alarms in the enterprise, or only active alarms that meet specific criteria. By default,
every active alarm in the enterprise displays.
 Enterprise Alarms - This pane displays a list of all active alarms that meet the criteria specified in
the Filter pane. Select an alarm to view information about that alarm in the other panes of the
dashboard.
 Instances - This pane displays all instances of the active alarm selected in the Enterprise Alarms
pane. Multiple instances of an alarm occur when the same alarm is triggered on more than one
server, or when the same alarm is triggered multiple times on a single server.
 Servers - This pane displays a list of all servers on which the alarm selected in the Enterprise Alarms
pane is active. You acknowledge an active alarm from this pane. This pane is replaced by the
Desktops pane when the Show Desktop Alarms filter option is selected.

 Desktops - This pane displays a list of all desktops on which the alarm selected in the Enterprise
Alarms pane is active. The Desktops pane displays only when the Show Desktop Alarms filter
option is selected.
 Details - This pane provides detailed information about the active alarm selected in the Enterprise
Alarms pane, including the alarm corrective action.
User security privileges required

The two security privileges that enable you to view and acknowledge active alarms from the Alarm
Dashboard:
 Enterprise Manager > System Monitor > View Alarms - This privilege enables a user to view
alarms in the Alarm Dashboard, but not acknowledge them.
 Enterprise Manager > System Monitor > Acknowledge Alarms - This privilege enables a user to
acknowledge active alarms from the Alarm Dashboard.
The Alarms Dashboard also includes an Installations tree in the left pane. The Installation Scope
security settings assigned to a user on the User Access Rights screen determine the specific
Installation tree nodes that the user can access. A user can only view active alarms associated with
the Installation tree nodes to which they have access.
 Security privileges are assigned to users from the User Management options of the enterprise
portal. For details about user security roles and privileges, see the Workforce Optimization User
Management Guide.
Other ways to work with active alarms

You can also work with active alarms from the Enterprise Manager Agent (EMA) application or the
Recorder Manager (RM) application that resides on an individual server.
The EMA and RM applications enable you to work only with the active alarms that exist on one server
(the server that hosts the EMA or RM application that you access).
Export a list of active alarms

You can export a list of active alarms to a tab-delimited text file. You can open this text file in
Microsoft Excel to view a list of every active alarm in the system. This capability is useful in
troubleshooting or other scenarios where it is useful to capture every currently active alarm in the
system in a spreadsheet.
Related topics
Alarm priorities, page 15
View a list of active alarms in the enterprise, page 16
Filtering the list of active alarms, page 22
Viewing all instances of an active alarm, page 29
View a list of servers on which an alarm is active, page 33
View active alarm details and corrective actions, page 40
Acknowledging active alarms, page 43

Alarms in Enterprise Manager Agent and Recorder Manager, page 47

Export active alarms to a text file, page 45

Active alarms and the Alarm Dashboard Alarm priorities
Alarm priorities
Each active alarm has a priority level. The priority level of an alarm determines the severity of the
alarm and the urgency with which you must correct the condition causing the alarm. The default
alarm priorities include:
 Major - Address these alarms immediately. If a major alarm is not addressed, the system fails
either partially or completely.
 Minor - Review these alarms and take action if necessary. Minor alarms often indicate problems
that are self-correcting, or that do not have a significant impact on system performance.
 Warning - Address these alarms in a timely manner. A Warning alarm indicates that the system
is functioning, but likely not at an optimum level.
 Information - These alarms provide important status information but do not require any action
by the administrator.
To correct the condition causing an alarm, you perform the alarm corrective action and then
acknowledge the alarm.
Related topics
Related information
Alarm Processes (Enterprise Manager Configuration and Administration Guide)

Active alarms and the Alarm Dashboard View a list of active alarms in the enterprise
View a list of active alarms in the enterprise

You can view a list of the active alarms in the enterprise. You can display all active alarms, or you can
use the Filter options to display only active alarms that meet specific criteria.
Procedure
1. Click System Monitoring > System Monitor > Alarm Dashboard.
2. A list of active alarms displays in the Enterprise Alarms pane of the Alarm Dashboard.
The Filter options selected in the left pane determine the specific active alarms that display in
the Enterprise Alarms pane. (By default, all active alarms in the enterprise display in the
Enterprise Alarms pane.)
3. To view information about the alarm in other panes of the Alarm Dashboard, click the active
alarm.
 Use the Page controls at the bottom of the Enterprise Alarms pane to page through multiple
pages of alarms.
Related topics
Enterprise Alarms pane reference, page 17
Customize the Enterprise Alarms pane column display, page 21
Export active alarms to a text file, page 45

Enterprise Alarms pane reference

The Enterprise Alarms pane displays the active alarms in the enterprise.
The Filter options selected in the left pane determine the active alarms that display in this pane.
 You can click in a column heading to:
 Sort the data in that column in ascending or descending order. When a column is
sorted, the ascending or descending icon appears in the column heading to indicate how it
is sorted.
 To add or remove columns on the Enterprise Alarms pane, select a Column option.
Enterprise Alarms pane fields
Field Description
Refresh Every setting and icons
Refresh Every Specifies the interval (in minutes) with which the data displayed in
the Alarms Dashboard is refreshed. When this interval elapses, the
dashboard refreshes the display with the latest active alarm data
stored in the Framework Database.
By default, the Alarms Dashboard is refreshed every 60 seconds.
You can click the Refresh icon to refresh the display instantly
rather than waiting for the refresh interval to elapse.
If you select the No Refresh setting, the display refreshes only when
you click the Refresh icon.

Field Description
Configuration To see the status of configuration changes the Enterprise Manager

Messages Status application is processing, click this icon.
icon For information about how the Enterprise Manger handles
configuration changes, see the “Architecture and Technical
Concepts” chapter of the Enterprise Manager Configuration and
Administration Guide.
Export Alarms To export every active alarm to a text file, click this icon . Use the
icon web browser features to save the exported text file to a local or
network directory.
The exported text file is tab-delimited. To view a spreadsheet
containing the list of active alarms, and the alarm attributes
associated with each active alarm, open the text file in Microsoft
Excel .
Use this feature in troubleshooting or other scenarios where it is
useful to capture every currently active alarm in the system in a
spreadsheet.
Enterprise Alarms pane fields
Enterprise Alarms Filtered icon - This icon displays next to the Enterprise
Alarms pane Alarms heading when you configure Filter options and click the
icons Filter button to apply them. The icon indicates that the dashboard
displays a filtered list of active alarms rather than all active alarms.
Maximize/Minimize icon - To maximize the Enterprise Alarms
pane, click this icon . To minimize the pane, click this icon .

Field Description
Priority Shows the priority (or severity level) of the alarm.

A color-coded icon containing an exclamation point indicates each
priority level.
The default priority levels are listed here in order of their severity. By
default, the alarms display in the Enterprise Alarms pane order of
their severity (with Major alarms at the top).
 Major - Address these alarms immediately. If a major alarm is
not addressed, the system fails either partially or completely.
 Minor - Review these alarms and take action if necessary.
Minor alarms often indicate problems that are self-correcting, or
that do not have a significant impact on system performance.
 Warning - Address these alarms in a timely manner. A
Warning alarm indicates that the system is functioning, but likely
not at an optimum level.
 Information - These alarms provide important status
information but do not require any action by the administrator.
Alarm Number Shows the unique numeric identifier of an alarm.
Alarm Name Shows the Alarm Name as it appears in the user interface.
Note: Each alarm also has an internal alarm name, which is different
from the Alarm Name that displays in the user interface. The internal
alarm name is used by internal components of the alarm system and
appears in log files.
Servers Shows the number of servers on which an alarm exists.

The Servers column does not display if the Show Desktop Alarms
filter option is selected.
Desktops Shows the number of desktop systems on which an alarm exists.

The Desktops column displays only when the Show Desktop
Alarms filter option is selected.
Instances Shows the total number of instances of an alarm on all servers or

desktops in the enterprise.
Last Triggered Lists the date and time at which the most recent instance of the
alarm was triggered.
The time displays in the local time zone of the user viewing the
Alarms Dashboard.

Field Description
Component Displays the software component that triggered the most recent
instance of the alarm.
Page controls To navigate through multiple pages of active alarms, use these
controls at the bottom of the pane:
 The Page box indicates the specific page of alarms that is

currently displayed. To go to a specific page, type in a page
number and press Enter.
 To go to the first page of alarms, click the leftmost double arrow
icon. To go to the last page of alarms, click the rightmost double
arrow icon.
 To go to the preceding page of alarms, click the leftmost single
arrow icon. To go to the following page of alarms, click the
rightmost single arrow icon.
To the right of the Page box, the Enterprise Alarms pane indicates
the specific alarms that are displayed.
For example: Displaying alarms 11-20 of 30 means that there are
30 total alarms and the Enterprise Alarms pane is displaying alarms
11 through 20.
Related topics
Customize the Enterprise Alarms pane column display, page 21
Filter pane reference, page 24
Instances pane reference, page 30
Servers pane reference, page 34
Details pane reference, page 41
Change the Priority assigned to an alarm, page 106
Change or create an alarm priority, page 91

Customize the Enterprise Alarms pane column display

You can add or remove columns from the Enterprise Alarms pane. You can also rearrange the order
in which columns display in this pane.
Procedure
1. To add or remove a column from the Enterprise Alarms pane:
 Point your mouse to any column heading in the Enterprise Alarms pane.
 Click the small down-pointing arrow at the right of the column heading.
 Point your mouse to the Columns icon , and place a check mark beside the columns you
want to appear in the Enterprise Alarms pane (all columns appear by default).
Clear the check mark for a column if you do not want that column to display in the Enterprise
Alarms pane.
2. To rearrange the order in which columns display in the Enterprise Alarms pane, click in a column
heading and drag the column to the right or the left in the pane.
Related topics

Active alarms and the Alarm Dashboard Filtering the list of active alarms
Filtering the list of active alarms

By default, all active alarms display in the Alarm Dashboard. Configure the Filter options to limit the
display of the active alarms to alarms that meet a specific criteria.
The Filter options (or criteria) available to limit the display of active alarms include:
 Alarm Name - Use this option to display only active alarms that have a specific alarm name and
number.
 Component Name - Use this option to display only active alarms triggered by specific server role
components.
 Priority - Use this option to display only active alarms of specific priorities.
 Installations - Use this option to display only active alarms that are associated with a particular
node (site group, site, or server) of the Installations tree.
 Desktop - Use this option to display only active alarms raised by remote desktops.
How the filter options work

Each of the filter option works as follows:
 If a filter option is not configured (that is, it is left blank, or no check box is selected), all alarms of
that criterion display in the dashboard.
 The exception is the Show Desktop Alarms option of the Desktop filter. When this
option is not selected, no desktop alarms display in the dashboard. Only server alarms
display in the dashboard. When this option is selected, only desktop alarms display in
the dashboard, and server alarms do not display.
For example, assume the Alarm Name option is left blank. In this case, the alarm names of all
active alarms that meet the criteria specified in the other filter options display in the dashboard.
By default, none of the filter options are configured, and all active alarms in the enterprise display
in the dashboard.
 If a filter option is configured (that is, at least one of its criteria is selected), only alarms of the
selected criteria display in the dashboard.
For example, if you select one specific Component Name, only the active alarms triggered by the
selected component display in the dashboard.
When you configure Filter options, the combined configuration of all four filter options determines
the alarms that display in the dashboard.
For example, assume that you select only one server node in the Installations filter option, and only
Major in the Priority option. But, you do not select any values for either Alarm Name or
Component Name options.
With this configuration, only the active alarms on the selected server that are of the Major priority
display in the dashboard. All alarm names and all component names associated with these active
alarms display.

Any active alarms in the enterprise that do not meet the combined criteria of all four filter options do
not display in the dashboard.
Related topics
Filter the list of active alarms, page 23
Filter the list of active alarms

Filter the list of active alarms to display only active alarms that meet a specific criteria.
Procedure
2. In the Filter pane on the left side:
a. To display only the active alarms with that Alarm Name (Alarm Number) in the dashboard,
select, or type an Alarm Name (or an alarm number).
To display the alarm names of all active alarms in the dashboard, clear the Alarm Name
field.
b. To display only the active alarms triggered by the selected component in the dashboard,
select one or more Component Name options.
To display alarms associated with all components in the dashboard, clear the Component
Names field.
c. If you want only the alarms of specific priorities to display in the dashboard, select one or
more Priority options.
To display the alarms of all priorities in the dashboard, clear the check marks from all the
Priority options.
d. To display only the alarms associated with the selected nodes in the dashboard, select one or
more Installations nodes.
To display the active alarms associated with all nodes in the enterprise in the dashboard,
clear the check mark from all Installations nodes.
e. To display only the desktop alarms in the dashboard, select Show Desktop Alarms. To
display the alarms for only one specific desktop, select that desktop from the drop-down list
in the Desktop filter option.
3. To filter the display of the alarms according to all the criteria selected in step 2, click Filter.
4. (Optional) To clear all filtering settings for all four filter options, click Clear All. If you clear all
filtering settings, and then click Filter, all of the active alarms in the enterprise display in the
dashboard.
Related topics

Filter pane reference

The Filter pane contains these filter options: Alarm Name, Component Name, Priority,
Installations, and Desktop.
Use these Filter options to limit the display of active alarms in the dashboard to only those alarms
that meet a specific criteria.

Filter pane options
Filter Options and Description

icons
Items that apply to all Filter Options
Collapse/Expand You can collapse the Filter pane to hide the pane at the left-side of
Filter pane icons the screen.
To collapse the Filter pane, click the small left-pointing icon
halfway down the pane.
To expand the Filter pane, click the right-pointing icon halfway
down the pane at the left-edge of the screen.
Collapse/Expand You can expand or collapse each Filter option by selecting the icon
Filter options in the upper-right corner of each option.
 To collapse an option, select the icon.
 To expand an option, select the icon.
Filter Options
Important: When you configure an individual filter option, the combined configuration
of all four filter options determines the alarms that display in the dashboard.
Alarm Name This field lists every alarm in the enterprise in this format: alarm
name (xxxxxx), where xxxxxx is the individual alarm number of the
alarm.
Do either of the following to display information about the active
alarm that has that alarm name in the dashboard:
 Select an alarm name from the drop-down list.
 Type either an alarm name or an alarm number in the field.
If you type an alarm name, or an alarm number, the field
searches for a matching alarm as you type each character.
If you select or type an alarm name (alarm number) in this field,
click the Filter button to put the filtering change into effect.
By default, no alarm name is selected in this field.
If no alarm name is selected here, all active alarm names that
meet the criteria specified by the other filter options display in the
dashboard.


icons
Component Name To display only the active alarms triggered by the selected
components, select one or more component names.
Note: The term “components” refers to the server software
components that trigger alarms on a server.
Note the following about selecting component names in this field:
 To select a component name from the drop-down list, click a
component name so that it is highlighted. You can select
multiple component names.
 To cancel the selection of a component name, click a
highlighted component name a second time so that is no longer
highlighted.
 Only component names that have active alarms are available in
this option.
If you select a component name in this field, click the Filter button
to put the filtering change into effect.
By default, no component name is selected in this field.
When no component name is selected in this field, the active
alarms triggered by all components, and that meet the criteria
specified by the other filter options, display in the dashboard.
Note: When no component name is selected, the text “Select
Component Names” appears in this field.
Priority To display only active alarms of the selected priorities in the

dashboard, select one or more priorities .
For example, select Major and Warning to display only alarms of
those two priorities in the Alarm Dashboard.
If you select a priority in this field, click the Filter button to put the
filtering change into effect.
By default, no priority is selected in this field.
When no priority is selected here, active alarms of all priorities,
that also meet the criteria specified by the other filter options,
display in the dashboard. The alarms display in order of their
severity (with Major priority alarms on top).


icons
Installations To display only the active alarms that are associated with the
selected nodes in the dashboard, select one or more Installation
tree nodes.
Note the following when selecting Installations tree nodes:
 To view or hide child nodes, click the small arrow to the left of a
node.
 If you select a parent node, all its child nodes are automatically
selected, and the active alarms associated with those nodes
display in the dashboard.
 If you unselect a parent node, all its child nodes are also
automatically unselected.
 If a parent node contains multiple child nodes, you can select
specific individual child nodes and cancel the selection of other
child nodes.
If you select an Installations node in this field, click the Filter
button to put the filtering change into effect.
By default, no Installation tree nodes are selected in this field.
When no Installation tree nodes are selected, the active alarms
that are associated with all Installation tree nodes, and that meet
the criteria specified by the other filter options, display in the
dashboard.
You cannot select an Installations node if the Show Desktop
Alarms filter option is selected.


icons
Desktop Select Show Desktop Alarms to display only desktop alarms in

the dashboard.
A “desktop” is a remote system that hosts an application that
contains software components that have registered with the
Enterprise Manager. The registered applications on these desktops
can use an API to raise alarms in the Alarm Dashboard. When you
select Show Desktop Alarms, only alarms from such remote
systems display in the dashboard. Alarms from enterprise servers
do not display in the dashboard.
In the Select Desktop Name drop-down list, you can select an
individual desktop to display only alarms from that desktop in the
dashboard. Only desktops on which an alarm is raised are
available from the Select Desktop Name drop-down list. If you
are looking for a particular desktop, and you cannot find it in the
drop-down list, the registered applications on that desktop have
not raised any alarms.
When you select the Show Desktop Alarms option, the
Installations filter is not used.
Clear a filter option Each of the four filter options has a Clear option underneath its
filter selections.
To clear any selected filtering criteria for the option, click Clear
underneath an individual filter option and then click the Filter
button. In this case, all alarms associated with the cleared filtering
option that meet the criteria of the other configured filter options
For example, if you click Clear underneath the Alarm Name filter
option, all Alarm Names display in the dashboard.
Filter Buttons (at bottom of Filter pane)
Clear All button To clear all filter settings from all four filter options, click this
button.
When you clear all filter settings from all four filter options, all
active alarms in the enterprise display in the alarm dashboard.
Filter button When you change any filter setting, you must click this button to
implement the change on the dashboard.
When you click the Filter button, the active alarms displayed in the
dashboard reflect the current filter configuration.
Related topics
Filter the list of active alarms, page 23

Active alarms and the Alarm Dashboard Viewing all instances of an active alarm
Viewing all instances of an active alarm

You can display all the instances of a specific active alarm in the Instances pane of the Alarm
Dashboard.
The Instances pane includes basic information about each instance of the alarm, including the server
or desktop on which each instance exists.
Multiple alarm instances

Multiple instances of the same alarm occur in these scenarios:
 The same alarm is triggered on different servers or desktops - In this scenario, you must
perform the corrective action for each alarm instance separately, and acknowledge each alarm
instance separately.
 The same alarm is triggered multiple times on one server or desktop - In this scenario, you
must select each alarm instance, and review the Last Instance Details information in the Details
pane to understand the condition causing each alarm instance. There are two possibilities:
 A single persistent condition is causing the same alarm to trigger repeatedly - In this case,
you can perform the corrective action one time to address the persistent condition, and then
acknowledge the alarm.
 Multiple different conditions are triggering the same alarm - In this case, you must address
all conditions causing all alarm instances before acknowledging the alarm. If you do not address
all conditions triggering all instances of the alarm, the alarm will recur after you acknowledge it.
Related topics
View all instances of an active alarm, page 29
View all instances of an active alarm

You can display all the instances of a specific active alarm in the Instances pane of the Alarm
Dashboard.
Procedure
2. In the Enterprise Alarms pane, click the specific alarm whose instances you want to view.

3. To display the list of alarm instances, click Instances in the lower left of the dashboard.
 If the Instances text appears in a blue font (rather than black) when you point to it
with the mouse, the Instances pane is already selected.
If you click a specific instance of an alarm in the Instances pane, details about the
alarm instance display in the Details pane on the right.
A small arrow icon appears at the top of a column to indicate when the column is
sorted in ascending or descending order.
Use the Filter options in the left pane to display only active alarms that meet
specific criteria.
Use the Page controls at the bottom of a pane to page through multiple pages of
alarms.
Related topics
Instances pane reference, page 30
Instances pane reference

The Instances pane displays each instance of the active alarm that is selected in the Enterprise
Alarms pane.
 Click in a column heading to sort the data in that column in ascending or descending
order.

Instances pane fields
Field Description
Maximize/Minimize To maximize the Instances pane, click this icon . To minimize

icon the pane, click this icon .
Server Displays the user-defined name of the server on which the

alarm instance exists. (This name is the name specified in the
Server Name field of the System Management > Enterprise >
Settings screen for the server.)
If different server names display in this column, the same alarm
is triggered on multiple servers.
If the same server name displays repeatedly in this column, the
same alarm is triggered multiple times on the server.
This column does not display when the Show Desktop Alarms
Desktops Displays the fully-qualified domain name (FQDN) of the desktop

system on which the alarm is active.
If different desktop names display in this column, the same
alarm is triggered on multiple desktops.
If the same desktop name displays repeatedly in this column,
the same alarm is triggered multiple times on the desktop.
This column displays only when the Show Desktop Alarms
Alarm Name Displays the Alarm Name as it appears in the user interface.
Note: Each alarm also has an internal alarm name, which is
different from the Alarm Name that displays in the user
interface. The internal alarm name is used by internal
components of the alarm system and appears in log files.
Last Triggered Lists the date and time at which the alarm instances were raised
(or triggered).
Alarms Dashboard.

Field Description
Alarm Status The status of an alarm can be either of the following:

 Active - Indicates the conditions causing the alarm still exist.
To resolve the alarm, view the alarm details, perform the
corrective action steps, and acknowledge the alarm.
 Ack Pending (date/time) - Indicates that the system is
completing the alarm acknowledgment process, and the date
and time at which the alarm was acknowledged. This status
displays immediately after an administrator, or the system,
acknowledges an alarm.
Note: The Ack Pending status usually exists for
approximately 30 seconds after alarm acknowledgment.
The status can exist longer when there is much alarm
activity on a server (or in other isolated cases).
Page controls Use these controls to navigate through multiple pages of active
alarm instances:

 To go to the first page of alarms or the last page of alarms,
click the double arrow icons.
 To go to the preceding page of alarms or the following page
of alarms, click the single arrow icons.
To the right of the Page box, the Instances pane indicates the
specific alarm instances that are displayed.
For example: Displaying instance 1-20 of 30 means that there
are 30 total alarm instances and the Instances pane is
displaying instances 1 through 20.
Related topics
View all instances of an active alarm, page 29

Active alarms and the Alarm Dashboard View a list of servers on which an alarm is active
View a list of servers on which an alarm is active

When an alarm is active, it can be active on more than one server. To see all the servers on which a
specific alarm is active, view the Servers pane.
Procedure
2. In the Enterprise Alarms pane, click an active alarm.
3. To display the list of servers on which the selected alarm is active, click Servers in the lower left of
the dashboard.
 If the Servers text appears in a blue font (rather than black) when you point to it with
the mouse, the Servers pane is already selected.
A small arrow icon appears at the top of a column to indicate when the column is
sorted in ascending or descending order.
 To display only active alarms that meet specific criteria, use the Filter options in
the left pane.
 To page through multiple pages of alarms, use the Page controls at the bottom of
a pane .
Related topics
View active alarms from EMA or RM, page 48

Servers pane reference

When you select an alarm in the Enterprise Alarms pane, or in the Instances pane, the Servers pane
displays the list of servers on which the selected alarm is active.
 Click in a column heading to sort the data in ascending or descending order.
Servers pane fields
Field Description
Maximize/Minimize To maximize the Servers pane, click this icon . To minimize the
icon pane, click this icon .
Server Displays the user-defined name of the server on which one or

more instances of the alarm exists. (This name is the name as
specified in the Server Name field of the System Management
> Enterprise > Settings screen for the server.
The server name displays as a link. To open the Enterprise
Manager Agent (EMA) or Recorder Manager (RM) application on
the server, click the link. You can work with alarms in either of
these applications. For details, see Alarms in Enterprise
Manager Agent and Recorder Manager, page 47.
different from the Alarm Name that displays in the user
interface. The internal alarm name is used by internal
components of the alarm system and appears in log files.

Field Description
Count Displays the number of instances of the alarm that have either
the Active or Ack Pending status on a server.
These alarm statuses include:
 Active - Indicates the conditions causing the alarm still exist.
To resolve the alarm, view the alarm details, perform the
corrective action, and acknowledge the alarm.
 Ack Pending (date/time) - Indicates that the system is
completing the alarm acknowledgment process, and shows
the date and time when the alarm was acknowledged. This
status displays immediately after an administrator, or the
system, acknowledges an alarm.
Note: The Ack Pending status usually exists for
approximately 30 seconds after alarm acknowledgment.
The status can exist longer when there is much alarm
activity on a server (or in other isolated cases).
Last Triggered Lists the date and time at which the most recent alarm instance
was raised (or triggered) on the server.
Alarms Dashboard.
Acknowledge To acknowledge all instances of a specific alarm on the server,

click the icon. Acknowledge an alarm only after you have
performed the corrective actions required to fix all the
conditions causing the alarm.
Page controls Use these controls to navigate through multiple pages of

servers:

 To go to the first page of alarms or the last page of alarms,
click the double arrow icons.
 To go to the preceding page of alarms or the following page
of alarms, click the single arrow icons.
To the right of the Page box, the Servers pane shows the
specific alarms that are displayed.
For example: Displaying alarms 11-20 of 30 means that there
are 30 total alarms and the Servers pane is displaying alarms 11
through 20.

Related topics

Active alarms and the Alarm Dashboard View the active alarms for Desktops
View the active alarms for Desktops

Application developers can program application software components to raise alarms in the Alarm
Dashboard. These applications install on remote systems (or desktops). The applications use an API to
register and communicate with the system to raise alarms in the Alarms Dashboard. The Face-to-Face
Recorder application is an example of such an application.
You can view the alarms raised by these desktop systems in the Alarm Dashboard. When you view
these desktop alarms, only desktop alarms display in the Alarm Dashboard. The enterprise server
alarms do not display.
Procedure
2. In the Filter column, under Desktop, select Show Desktop Alarms.
3. In the drop-down list in the Desktop section of the Filter column, do one of the following:
 Select a particular desktop. If you select a particular desktop, only the alarms for that desktop
 Do not select a particular desktop. If you do not select a particular desktop, the alarms for all
desktops display in the dashboard.
4. Click the Filter option at the bottom of the Filter column. The alarms for the desktops display in
the dashboard.
5. If you did not select a particular desktop in step 3, do the following:
a. In the Enterprise Alarms pane, click on an active alarm.
b. In the bottom left of the dashboard, click Desktops to display the list of desktops on which
the selected alarm is active. You can also click Instances in the bottom left of the dashboard
to view a list showing each instance of the alarm.
Related topics
Desktops pane reference, page 37
Desktops pane reference

The Desktops pane displays only when the Show Desktop Alarms filter option is selected. When you
select an alarm in the Enterprise Alarms pane, the Desktops pane displays the list of desktops on
which the selected alarm is active.
A "desktop" is a remote system that hosts an application that contains software components that use
an API to raise alarms in the Alarm Dashboard.

 Click in the column heading to sort the data in ascending or descending order.
Field Description
Maximize/Minimize Click this icon to maximize the Servers pane. Click this icon to
icon minimize the pane.
Desktop Displays the fully qualified domain name (FQDN) of a desktop

system on which one or more instances of the alarm exists.
different from the Alarm Name that displays in the user interface.
The internal alarm name is used by internal components of the
alarm system and appears in log files.
Count Displays the number of instances of the alarm that have either the
Active or Ack Pending status on a server.
These alarm statuses are described below:
 Active - Indicates the conditions causing the alarm still exist. You
must view the alarm details, perform the corrective action, and
acknowledge the alarm to resolve the alarm.
 Ack Pending (date/time) - Indicates the system is completing
the alarm acknowledgement process, and shows the date and
time when the alarm was acknowledged. This status displays
immediately after an administrator, or the system, acknowledges
an alarm.
Note: The Ack Pending status normally exists for approximately
30 seconds after alarm acknowledgement. The status may exist
longer when there is a lot of alarm activity on a desktop (or in
other isolated cases).

Field Description
Last Triggered Lists the date and time at which the most recent alarm instance was
raised (or triggered) on the desktop.
Alarms Dashboard.
Acknowledge Click the icon to acknowledge all instances of a specific alarm on

the desktop. Acknowledge an alarm only after you have performed
the corrective actions required to fix all of the conditions causing
the alarm.
Page controls Use these controls to navigate through multiple pages of desktops:

 Click the double arrow icons to go to the first page of alarms or
the last page of alarms.
 Click the single arrow icons to go to the preceding page of alarms
or the next page of alarms.
To the right of the Page box, the Desktops pane shows the specific
alarms that are displayed.
For example: Displaying alarms 11 - 20 of 30 means that there are
30 total alarms and the Desktops pane is displaying alarms 11
through 20.
Related topics
View the active alarms for Desktops, page 37

Active alarms and the Alarm Dashboard View active alarm details and corrective actions
View active alarm details and corrective actions

Access the Details pane of the Alarm Dashboard to view detailed information about any active alarm,
including the alarm corrective action.
Procedure
2. If you want to view details about:
 The most recent instance of the alarm, select the alarm in the Enterprise Alarms pane.
 A single instance of an alarm, select the instance in the Instances pane.
3. The Details pane displays information about the selected alarm instance, including the corrective
action for the alarm.
 To display a subset of the active alarms, use the Filter options.

To page through multiple pages of alarms, use the Page controls at the bottom of a pane.
Related topics

Details pane reference

The Details pane of the Alarm Dashboard displays detailed information about an active alarm,
including its corrective action.
Details pane fields
Field Description
Icon Maximize/Minimize icon - To maximize the Details pane, click this

icon . To minimize the pane, click this icon .
Priority Shows the priority (or severity level) of the alarm.

An icon indicates each priority level.
The default priority levels are listed here in order of their severity.
 Major - Address these alarms immediately. If a major alarm is
not addressed, the system fails either partially or completely.
 Minor - Review these alarms and take action if necessary.
Minor alarms often indicate problems that are self-correcting, or
that do not have a significant impact on system performance.
 Warning - Address these alarms in a timely manner. A
Warning alarm indicates that the system is functioning, but likely
not at an optimum level.
 Information - These alarms provide important status
information but do not require any action by the administrator.

Field Description
Alarm Number The unique numeric identifier of an alarm.
Alarm Name The alarm name as it displays in the user interface.

Note: Each alarm also has an internal alarm name, which is different
from the Alarm Name that displays in the user interface. The internal
alarm name is used by internal components of the alarm system and
appears in log files.
Summary A summary of the condition causing the alarm.
Last Instance A specific description of the most recent instance of the alarm. This
Details description is the most detailed information available about a
specific instance of the alarm.
If this column is blank, detailed information about the alarm instance
is not available.
Corrective Action Shows the corrective action steps for the alarm.
To correct the alarm condition, follow these steps. Once the alarm
has been corrected, you acknowledge the alarm to prevent the alarm
from displaying as an active alarm. Acknowledged alarms are moved
into Alarm History.
Note: The system automatically corrects and acknowledges some
alarms.
Related topics

Active alarms and the Alarm Dashboard Acknowledging active alarms
Acknowledging active alarms

Acknowledge an active alarm after you have performed the corrective action that corrects the
condition causing the alarm. Acknowledging an alarm changes the alarm status from active to inactive,
and moves the alarm into Alarm History.
The system automatically corrects and acknowledges some alarms.
If there are multiple instances of the same alarm on a server or desktop, you acknowledge all
instances of the alarm on the server or desktop at the same time.
 You can acknowledge multiple alarms on one server simultaneously from the Enterprise
Manager Agent (EMA) or Recorder Manager (RM) application that resides on the server.
Related topics
Acknowledge an active alarm, page 43
Acknowledge multiple alarms simultaneously from EMA or RM, page 55
Related information
Enterprise Manager Configuration and Administration Guide (“Alarm Processes” section)
Acknowledge an active alarm

Acknowledging an alarm changes the alarm status from active to inactive, and moves the alarm into
Alarm History.
Before you begin

Determine the corrective action for an alarm. Select the active alarm in the Enterprise Alarms pane,
and read the corrective action in the Details pane.
Perform the corrective action that resolves the condition causing the alarm.
Procedure
2. Under Enterprise Alarms, click the alarm that you want to acknowledge.
 To display a subset of the active alarms, use the Filter options in the left pane.
To page through multiple pages of alarms, use the Page controls at the bottom of a
pane.
3. Click Servers or Desktops at the bottom left of the dashboard. (Desktops displays only if you
have selected the Show Desktop Alarms filter option.)
4. Under the Acknowledge column, click the acknowledge icon .

Active alarms and the Alarm Dashboard Acknowledging active alarms
5. When prompted to acknowledge the alarm, click Yes.

If multiple instances of an alarm exist on a server or desktop, acknowledging one instance of the
alarm automatically acknowledges all instances of the alarm on the server or desktop.
6. A message displays indicating the alarm acknowledge request was sent successfully to the server
or desktop.
7. The Alarm Status changes to Ack Pending while the system performs the acknowledgment
process. It usually takes around 30 seconds for the server or desktop to process the alarm
acknowledgment request (make the alarm inactive and move the alarm into alarm history).
8. When the “Alarms have been acknowledged successfully” prompt displays, click Yes.
Related topics

Active alarms and the Alarm Dashboard Export active alarms to a text file
Export active alarms to a text file

You can export all active alarms in the system to a text file. The text file is tab-delimited. You can open
the text file in Microsoft Excel to view a spreadsheet containing the list of active alarms, and the alarm
attributes associated with each active alarm.
Procedure
1. Select System Monitoring > System Monitor > Alarm Dashboard.
2. Click the Export Alarms icon .
3. Save the text file using the features of the web browser.
You can open the text file in Microsoft Excel to view a spreadsheet containing the list of active
alarms.
Related topics

Active alarms and the Alarm Dashboard Open Recorder Manager or Enterprise Manager Agent from the Alarm Dashboard
Open Recorder Manager or Enterprise Manager

Agent from the Alarm Dashboard
You can open the Recorder Manager (RM) or Enterprise Manager Agent (EMA) application on a
particular server from the Servers pane of the Alarm Dashboard.
Procedure
2. In the lower left of the Alarm Dashboard, click Servers to display the Servers pane.
3. In the Servers column, click the link to the name of an individual server to open the RM or EMA
application on that server.
 If the server is a recorder server, the RM application launches. If the server is any
other type of server, the EMA application launches.
Related topics

C h a p t e r 2
Alarms in Enterprise Manager

Agent and Recorder Manager
You can work with alarms in the Enterprise Manager Agent (EMA) or Recorder Manager (RM)
application on an individual server. You can view or acknowledge the active alarms on an
individual server and view the alarm history on an individual server.
 When you use the EMA or RM application, you can only work with those alarms
that exist on the individual server that hosts the RM or EMA application you are
using.
If you have multiple servers in your enterprise, use the Alarm Dashboard to work
with active alarms. You can work with any active alarm on any server in the
enterprise from the Alarms Dashboard.
Topics
View active alarms from EMA or RM 48

View the corrective action for an alarm 53
Acknowledge an alarm from EMA or RM 54
Acknowledge multiple alarms simultaneously from EMA or RM 55
View alarms in Alarm History 56
Clear alarms in Alarm History 59
Alarms in Enterprise Manager Agent and Recorder Manager View active alarms from EMA or RM
View active alarms from EMA or RM

To view the list of active alarms on an individual server, you can open the Enterprise Manager Agent
(EMA) or Recorder Manager (RM) application on a server.
Before you begin

You must have View Alarms privileges to view the list of alarms for a managed server or a specific
server role.
Procedure
1. Click System Management > Enterprise > Settings.
2. In the Installations tree (left pane), select the specific Server node for which you want to view
alarms.
3. Click Launch.
4. To open the respective application, click either Recorder Manager or Enterprise Manager
Agent.
5. Click Alarms > View Alarms > Active Alarms.
6. To view preliminary information about active alarms on each server role on the server, do the
following:
 In the Roles pane, expand the Server node (click the small triangle beside the Server) to display
all server roles on the server.
 Click a specific Server Role node. Only active alarms associated with the selected server role
display in the pane on the right side.

7. To view detailed information about an individual alarm (including the alarm corrective action):
 Select the alarm and click View (or just double-click the alarm). The Active Alarm Details
screen displays detailed information about the alarm.
 To view a drop-down list containing the corrective action for the alarm, click the small right-
pointing arrow that appears to the left of the alarm name.
8. If you have performed the corrective action for the alarm, you can click Acknowledge to
acknowledge the alarm and place it in alarm history.
Related topics
Active Alarms screen reference, page 49
Active Alarm Details screen reference, page 51
Acknowledge an alarm from EMA or RM, page 54
Active alarms and the Alarm Dashboard, page 11
Active Alarms screen reference

The Active Alarms screen displays preliminary information about active alarms on a server. The
screen displays the active alarms that are associated with the node selected in the Roles pane.
 If all the information discussed in the following table does not appear on the screen, the
screen was customized to exclude the missing information. To display the missing
information, use the Customize option above the screen.

Active Alarms screen fields
Item Description
Alarm Name The name of the alarm.
Last Triggered The date and when the alarm was last raised (triggered). If there are
multiple instances of an alarm, the trigger time of the most recent
alarm instance displays.
Alarm Summary A summary of the condition causing the alarm.
Priority The priority specified for the alarm.

 Major - Address these alarms immediately. If a major alarm is not
addressed, the system fails either completely or partially.
 Warning - Address these alarms in a timely manner. A Warning
alarm indicates that the system is functioning, but likely not at an
optimum level.
 Minor - Review these alarms and take action if necessary. Minor
alarms often indicate problems that are self-correcting, or that do
not have a significant impact on system performance.
 Information - These alarms provide important status information
but do not require any action by the administrator. You can
acknowledge these alarms without performing any corrective
action.
Alarm priorities are specified for individual alarms from the System
Monitoring > System Monitor > Alarm Settings screen.
Count Instance count. Number of occurrences/instances of the alarm that

is active.
Last Alarm Summary description of the alarm. This description is the common
Instance Details description for all instances of an alarm and not based on a specific
alarm instance. For a detailed, instance-specific description, select
the alarm and then click View the alarm, or review the alarm in
alarm history.
Component The system component that triggered the alarm.

More than one component can trigger some alarms.
Customize Use the customize feature to add or remove columns from the Active
Alarms screen.
To use this feature, select Edit from the Customize drop-down list.
See the Customize window online help for usage details.

Item Description
Refresh Rate Shows the current setting for refresh rate in minutes. Choose 1, 2, 3,
4, 5, 10, 15, or 20 minutes as the automatic refresh rate. At these
times, the RM, or EMA application updates the status of the alarms
on the managed server. Default is 1. You can also click the Refresh
icon to update alarms immediately, without waiting for the
automatic refresh cycle.
Related topics
Active Alarm Details screen reference

The Active Alarms Details page displays detailed information about one alarm on the server,
including the alarm corrective action. Access this page from the Active Alarms page (by selecting an
alarm and then clicking the View button).
This table describes the Active Alarm Details screen fields and options:

Item Description
Corrective Action To view a drop-down list containing the corrective action for the
Steps alarm, click the small right-pointing arrow at the left of the alarm
name.
To correct the alarm condition, follow these steps. Once the alarm
has been corrected, you can acknowledge the alarm to place it in
Alarm History.
Last Triggered The date and time and when the alarm was last raised (triggered). If
there are multiple instances of an alarm, the latest trigger date and
time of the alarm instance is displayed.
Details The specific description of the alarm. This description is the most
detailed information available about this specific instance of the
alarm.
Priority The default priority/severity of the alarm.

 Major - Address these alarms immediately. If a major alarm is not
addressed, the system fails either completely or partially.
 Warning - Address these alarms in a timely manner. A Warning
optimum level.
 Minor - Review these alarms and take action if necessary. Minor
 Information - These alarms provide important status information
but do not require any action by the administrator.
Component The component on the selected managed server or server role that
triggered the alarm.
Refresh Rate Shows the current setting for refresh rate in minutes. Choose 1, 2, 3,
4, 5, 10, 15, or 20 minutes as the automatic refresh rate. At these
times, the EMA, or RM application updates the status of the alarms
on the managed server. Default is 1. You can also click the Refresh
icon to update alarms immediately, without waiting for the
automatic refresh cycle.

Alarms in Enterprise Manager Agent and Recorder Manager View the corrective action for an alarm
View the corrective action for an alarm

From the Enterprise Manager Agent (EMA) or Recorder Manager (RM) application on a server, you can
view the corrective action steps for a particular alarm.
Procedure
alarms.
3. Click Launch.
Agent.
6. In the Roles pane on the left side, select the Server node to view all active alarms on the server.
You can also select a Server Role node to view only the active alarms associated with the selected
server role.
7. Select the alarm whose corrective action you want to view, and click View (or just double-click on
the alarm). The Active Alarm Details screen displays.
8. In the Alarm Name column, click the small right-pointing arrow that appears just to the left of the
alarm name. This action displays a drop-down list containing the corrective action steps for the
alarm.
9. To correct the condition causing the alarm, perform the corrective action steps.
What to do next
Related topics

Alarms in Enterprise Manager Agent and Recorder Manager Acknowledge an alarm from EMA or RM
Acknowledge an alarm from EMA or RM

After you perform the corrective action for an alarm, you can acknowledge the alarm. Acknowledging
the alarm makes the alarm inactive and moves it into alarm history.
Before you begin

View the corrective action for an alarm, page 53
Procedure
alarms.
3. Click Launch.
Agent.
6. In the Roles pane on the left side, select the Server node to view all active alarms on the server.
You can also select a Server Role node to view only the active alarms associated with the selected
server role.
7. In the Active Alarms tab (right pane), select the alarm you want to acknowledge.
8. Click Acknowledge.
Related topics
View alarms in Alarm History, page 56
Open Recorder Manager or Enterprise Manager Agent from the Alarm Dashboard, page 46

Alarms in Enterprise Manager Agent and Recorder Manager Acknowledge multiple alarms simultaneously from EMA or RM
Acknowledge multiple alarms simultaneously from

EMA or RM
You can acknowledge multiple alarms, or all alarms on a server, simultaneously from either the
Enterprise Manager Agent (EMA) application or the Recorder Manager (RM) application.
Under usual circumstances, acknowledge alarms one-at-a-time from either the Alarm Dashboard, the
EMA, or the RM. This procedure provides a convenient way to clear alarms if there are too many
alarms to acknowledge one-at-a-time.
The Acknowledge Alarms privilege is required to acknowledge alarms.
Procedure
alarms.
3. Click Launch.
Agent.
6. In the Roles pane on the left side, select the Server or Server Role node for which you want to
acknowledge multiple (or all) alarms.
7. Do one of the following:
 To acknowledge multiple (but not all) alarms simultaneously, hold down the Ctrl key, select
each alarm you want to acknowledge, and click Acknowledge.
You can also select a range of alarms by holding down the Shift key, and clicking the top and
bottom alarm in the range.
 To acknowledge all active alarms simultaneously, click Select All, then click Acknowledge.
If you decide not to acknowledge all alarms, click Select None to cancel the selection of all
alarms.
8. You are prompted to verify that you have started all services indicated by the alarms you are
acknowledging. (Many alarms require you to restart a specific service before acknowledging the
alarm.)
Perform this verification, and then click OK.
 If you acknowledge multiple alarms simultaneously, it takes time for the system to
process the acknowledgments. In this case, a message appears at the top of the
screen indicating the system is processing the alarms. When the acknowledgment
processing completes, the alarms move from the Active Alarms tab to the Alarm
History tab.

Alarms in Enterprise Manager Agent and Recorder Manager View alarms in Alarm History
View alarms in Alarm History

To see the alarms on the server that have been corrected and acknowledged, and are now inactive,
view the Alarm History screen.
Procedure
alarms.
3. Click Launch.
Agent.
 You can also open Recorder Manager or Enterprise Manager Agent from the Alarm
Dashboard. For details, see View active alarms from EMA or RM, page 48.
5. Click Alarms > View Alarms > Alarm History.

6. In the Roles pane on the left side, select the Server node to view all inactive alarms on the server.
You can also select a Server Role node to view only the inactive alarms associated with the
selected server role.
Related topics
Alarm History screen reference, page 57
Configure how long acknowledged alarms display in the Alarm History tab, page 90

Alarm History screen reference

The Alarm History page displays alarms on a server that were acknowledged and are now inactive.
You can configure the amount of time that acknowledged alarms display in the Alarms History page.
Alarm History screen fields
Item Description
Last Triggered The last date and time the alarm was raised (triggered). For multiple
instances of an alarm, the latest trigger date and time of the alarm
instance is displayed.
Details Displays detailed information about the specific instance of the

alarm.
Priority The priority specified for the alarm.

Alarm priorities are specified for individual alarms from the System
Monitoring > System Monitor > Alarm Settings screen. For more
information, see Change or create an alarm priority, page 91.
Acknowledged The date and time when the alarm was placed into alarm history
Date (that is, acknowledged).
Acknowledged By The name of the component (for automatic acknowledgment) or

user (if manual acknowledgment) that acknowledged the alarm.
Note: Components automatically acknowledge some alarms.

Item Description
Component The component or user on the selected managed server or server

role that caused the alarm to be triggered.
Page controls Use these controls to view more pages of alarm history.
You can change the number of records that display per page in
Preferences.
Related topics

Alarms in Enterprise Manager Agent and Recorder Manager Clear alarms in Alarm History
Clear alarms in Alarm History

You can clear all alarms displayed in the Alarm History screen. You cannot select specific alarms and
clear only the selected alarms. A maximum of 1000 inactive alarms are retained in alarm history.
You need the Edit Alarms privilege to clear alarms from alarm history.
Procedure
alarms.
3. Click Launch.
Agent.
5. Click Alarms > View Alarms > Alarm History.
6. In the Roles pane on the left side, select the Server node to view all inactive alarms on the server,
or a Server Role node to view only the inactive alarms associated with the selected server role.
7. Click Clear All with a Server or Server Role node selected to delete all alarms for the selected node
from the alarms history window.
Related topics

C h a p t e r 3
Recorder Health Summary
The Recorder Health Summary provides a visual indicator of Recorder health across the
enterprise. Administrators responsible for managing the recording-related systems use the
Recorder Health Summary to see the health status at a glance and to identify Recorder-
related alarms that require their attention. The Recorder Health Summary is a widget that is
available from the Dashboards module.
Topics
Recorder Health Summary overview 61

Set the scope for the Recorder Health Summary 64
Recorder Health Summary reference 65
Recorder Health Summary Recorder Health Summary overview
Recorder Health Summary overview

The Recorder Health Summary provides administrators with a single location to see both the
operational status of recording -related systems and active alarms for those systems.
Use of the Recorder Health Summary can minimize the impact of situations that adversely affect
system performance. The information presented is a consolidation and assessment of status
information. The status information would otherwise be available only by visiting multiple locations in
Enterprise Manager and Recorder Manager. The summary enables you to identify problems as they
occur, isolate the affected components, and then take the appropriate corrective action.
Access permissions required

Use of the Recorder Health Summary requires the appropriate permission for the role assigned to
you in the Roles Setup section of User Management.
Under Enterprise Manager, select System Monitor.
 Only roles with the View Alarms privilege can use the Recorder Health Summary.
 By default, administrative roles have access to the Recorder Health Summary.
Recorder-related categories
The Recorder Health Summary categorizes alarms into three categories, each of which has a health
assessment.
 Recording: Indicates the health and alarm status for recording components. For
example: Consolidator, Content Server, Recorder Ingestion Web Service, Screen Capture, Recorder
Integration Service.
 Archive: Indicates the health and alarm status for Archiver and the Archive Web Service.
 Recorder analytics: Indicates the health and alarm status for the Real-Time Analytics
(RTA) Framework. The Real-Time Analytics (RTA) Framework includes Identity Authentication and
Fraud Detection (IAFD), metadata detection, and Real-Time Speech Analytics (RTSA). For
example: Biometrics Engine, Metadata Engine, Recorder Analytics Framework.
Features and configuration

The Recorder Health Summary is a widget you can add to a Dashboard. To learn how to use
dashboards and widgets, see the related information section.
Features of the widget include:
 View scope: Set the view scope for what the widget displays. View the entire enterprise, a specific
site, or a specific server.
 Health category tiles: View Recorder health by category. A tile represents each category. Each tile
is color-coded according to the health of the category. The color code used is based on the number
and type of alarms currently active in that category. The total number of alarms for the category is
also shown on the tile.

 Sort alarms: Sort the alarm list using a column heading. The list shows all the Recorder-related
alarms totaled by each of the category health indicators.
 Automatic refresh: An automatic refresh interval of 60 seconds.
Example of the Recorder Health Summary
Related topics
Health assessment based on alarm thresholds , page 62
Recorder Health Summary, page 60
Related information
Recorder Health Summary widget (Dashboards Administration and User Guide)
Roles and Privileges Reference
Health assessment based on alarm thresholds

The Recorder Health Summary widget uses color codes to assess the health status for each of the
three categories. Alarm thresholds determine the color code assigned.
Health color codes

The health color code shown for each category depends on the number and type of alarms active in
the category.

Example Color Description

code
Green Alarms for the category, if any, are within

acceptable limits. No administrator action is
required.
Amber Operation is not optimal; functionality of

category components is potentially diminished.
For example, recording of contacts or archive
operation could be impacted. The
administrator needs to review the alarms and
investigate the cause.
Red A critical failure of one or more components is

detected for the category. A red status requires
Immediate attention from the administrator.
For example, a red status can impact multiple
contact recordings or the archiving of multiple
contacts.
 Some alarms, even with an excessive

frequency of occurrence, cannot result
in a red status. Only alarms that
disrupt essential Recorder operations
can result in a red status.
Thresholds
The color code used for a category is based on predefined thresholds. The thresholds are a function
of:
 The specific alarm instance. For example, alarm 39018, "Disk Manager Detected Un-Archived Audio
Files".
 The frequency of occurrence for the alarm instance.
The thresholds are not configurable. If you require an adjustment to the thresholds, contact your
support representative for assistance.
Related topics
Recorder Health Summary overview, page 61

Recorder Health Summary Set the scope for the Recorder Health Summary
Set the scope for the Recorder Health Summary

By default, the scope of the Recorder Health Summary is all servers in the enterprise to which you
have access. To focus the information summarized, refine the scope to a specific server or to a single
site.
Before you begin

Add the Recorder Health Summary widget to a dashboard.
Procedure
1. Open a dashboard that contains the Recorder Health Summary widget.
2. From the View drop-down list, located in the upper right corner of the widget, select the scope of
what the widget displays.
 Enterprise: Displays health status and alarms for all servers to which you have access in the
enterprise. Enterprise is the default setting.
 Site: Displays health status and alarms for all servers that belong to the site.
 Server: Displays health status and alarms for the selected server.
When you change the scope for the widget, the category tiles and the alarm list update
automatically based on the scope selected.
 To see more alarm details, the corrective action, and to acknowledge an alarm, use the Alarm
Dashboard.
Related topics
Acknowledge an active alarm, page 43
Related information
Add a dashboard (Dashboards Administration and User Guide)

Recorder Health Summary Recorder Health Summary reference
Recorder Health Summary reference

The Recorder Health Summary displays health status by Recorder-related categories and the
associated alarms that determine the health status.
Field Description
View Use the drop-down list to set the scope for the information displayed. The
list includes all servers in the enterprise to which you have access. Select a
specific server, a single site, or the entire enterprise (default).
After selecting a scope, Recorder Health Summary updates for only those
alarms in the selected scope.
Recorder Category tiles use colors as visual indicators of health for each category in
category the selected scope. Each tile also displays the total number of active
health tiles alarms for the category.
Categories are:
 Recording
 Archive
 Recorder Analytics

Recorder Health Summary Recorder Health Summary reference
Field Description
Alarm list The alarm list summarizes the active alarms for all categories. Sort the list
in ascending or descending order by clicking a column heading, Reorder
the sequence of the columns by dragging and dropping a column heading.
 Alarm: The unique numeric identifier of an alarm.
 Alarm Name: The name of the alarm shown in the user interface.
 Category: Identifies the Recorder-related category for the alarm.
 Component: The specific component from the Category where the
alarm occurred. Examples of components include DiskManager,
RecorderIntegrationService, ArchiveWS, and Biometrics.
 Instances: Number of times the alarm has triggered.
 Priority: An icon representing the severity and urgency of the alarm.
See the related topics section to learn more about priorities.
 Time: Date and time for the most recent instance of the alarm. Time
displays in the local time zone of the user viewing the Recorder
Health Summary widget.
Related topics
Set the scope for the Recorder Health Summary, page 64
Recorder Health Summary overview, page 61

C h a p t e r 4
Alarm notification profiles
Use alarm notification profiles to notify individual employees or the network management
system when individual alarms are triggered.
Topics
Alarm notification profile overview 68

Standard notification profiles 69
Make the standard notification profiles operational 71
Test and acknowledge alarms from the Alarm Testing notification profile 73
Viewing the list of alarm notification profiles 75
Changing the email addresses and SNMP nodes assigned to a notification profile 78
Custom notification profiles 84
Delete an alarm notification profile 87
Alarm notification profiles Alarm notification profile overview
Alarm notification profile overview

Use alarm notification profiles to notify individual employees or the network management system
when individual alarms are triggered. Employees are notified by email. The network management
system is notified by SNMP traps.
An alarm notification profile is a list that includes email addresses, SNMP nodes (for the network
management system), or both.
An alarm notification profile is assigned to an alarm. When the alarm is triggered, an email is sent to
each email address in the profile. An SNMP trap is sent to each SNMP node in the profile.
 The notification email lists only the UTC time at which an alarm was triggered. The email does
not provide the alarm trigger time in any other time zones.
Standard, custom, and testing profiles

The types of notification profiles are standard profiles, custom profiles, and an alarm testing profile.
Standard notification profiles are available by default and are the recommended way to provide
notifications of triggered alarms to your employees and the network management system.
If the standard notification profiles do not meet all the needs of your enterprise, you can create
custom notification profiles. Custom notification profiles are useful when a notification profile is
needed for a special purpose.
An Alarm Testing profile is available to test that the alarm system is working properly. From the Alarm
Testing profile you can raise and acknowledge four test alarms. The four test alarms include one
alarm assigned to each of the four alarm priorities: Warning, Information, Minor, and Major.
Related topics
Standard notification profiles, page 69
Make the standard notification profiles operational, page 71
Viewing the list of alarm notification profiles, page 75
Changing the email addresses and SNMP nodes assigned to a notification profile, page 78
Custom notification profiles, page 84
Test and acknowledge alarms from the Alarm Testing notification profile, page 73

Alarm notification profiles Standard notification profiles
Standard notification profiles

The standard notification profiles are assigned to alarms by default, but they are not operational by
default. You must perform some additional configurations to make them operational.
To understand how the standard notification profiles operate, read this section.
Default assignment of standard notification profiles

There are six standard notification profiles available following a system installation. These notification
profiles are named Alarm Testing, All Alarms, Critical, Major, Minor, and Information.
By default, every alarm has two standard notification profiles assigned to it, including:
 All Alarms - This notification profile is assigned to every alarm.
 One other notification profile depending on the priority level of the alarm, as noted in this table:
Notification By default, this An employee or SNMP node added to

Profile Name: profile is assigned to: this notification profile is notified
when:
Alarm Testing Four test alarms. There The four test alarms are triggered.
(Use for alarm is one test alarm
testing assigned to each alarm
purposes only) priority (Warning,
Information, Minor,
Major).
All Alarms Every alarm Every alarm that is triggered.
Critical Every alarm of the Every alarm of the Major priority that is
Major priority triggered.
Major Every alarm of the Every alarm of the Minor priority that is
Minor priority triggered.
Minor Every alarm of the Every alarm of the Warning priority that
Warning priority is triggered.
Information Every alarm of the Every alarm of the Information priority

Information priority that is triggered.
E-mail notifications with standard notification profiles

To ensure employees are notified by e-mail when alarms are triggered, you add employee e-mail
addresses to the standard notification profiles.
For example, if want an employee named Manuel Ortega to be notified by e-mail each time an alarm
of the Major priority is triggered, add Manuel Ortega to the Critical notification profile. Manuel will
receive an e-mail each time an alarm of the Major priority is triggered.
All other standard notification profiles work the same way. If you want an employee to be notified of
alarms of the Warning priority, add that employee to the Minor notification profile. If you want an

Alarm notification profiles Standard notification profiles
employee to be notified of alarms of the Information priority, add that employee to the Information
notification profile, and so on.
 If you include the same employee’s e-mail address in more than one notification profile, that
employee may receive multiple e-mails about the same alarm. For example, if an alarm has
both the All Alarms notification profile and the Critical notification profile assigned to it, and
Manuel Ortega appears in both of these notification profiles, Manuel will receive two e-mails
when the alarm is triggered.
SNMP trap notifications with standard notification profiles

SNMP trap notifications work basically the same way as the e-mail notifications.
If you want an SNMP node to be notified each time an alarm of the Major priority is triggered, add
that SNMP node to the Critical notification profile. If you want an SNMP node to be notified when any
alarm is triggered, add that SNMP node to the All Alarms notification profile, and so on.
What to do next
To make standard notification profiles operational, see Make the standard notification profiles
operational, page 71.
Related topics
Alarm notification profile overview, page 68

Alarm notification profiles Make the standard notification profiles operational
Make the standard notification profiles operational

This section describes the most basic procedure to make the standard alarm notification profiles
operational.
Before you begin

 If you want the notification profile to send e-mails to employees, configure the system to work with
an SMTP Email server. Perform this configuration by completing the SMTP Settings on the System
Management > Enterprise > Enterprise Settings tab.
 If you want the notification profile to send SNMP traps to the network management system, obtain
and configure the Management Information Base (MIB) files.
Procedure
1. Add SNMP nodes to the system:
a. Click System Monitoring > System Monitor > Global Alarm Settings.
b. In the SNMP Node Settings section, add every SNMP node that must receive an SNMP trap
when an alarm is triggered.
2. Add employees and SNMP nodes to five standard notification profiles (All Alarms, Critical,
Information, Major, and Minor). For example:
a. Click System Monitoring > System Monitor > Notification Profiles.
b. In the left pane, select the Enterprise node.
c. Select the All Alarms profile, and click Edit.
d. In the E-Mail Address section, select an Organization, and then move the employees you
want to be part of this notification profile into the Selected Employees section.
For example, in the All Alarms profile, move the employees who must be notified of every
alarm that is triggered into the Selected Employees section.
e. In the SNMP Nodes section, move the SNMP nodes that you want to be part of this
notification profile into the Assigned SNMP nodes section.
For example, in the All Alarms profile, move the SNMP nodes that must receive traps when
every alarm is triggered into the Assigned SNMP nodes section.
f. Click Save And Apply to Children.
g. Repeat steps b. through f. above for each remaining standard notification profile (Critical,
Information, Major, Minor).
For example, in the Critical notification profile, specify all employees and SNMP nodes to be
notified if an alarm of the Major priority is triggered. In the Major profile, specify all
Employees and SNMP nodes to be notified if an alarm of the Minor priority is triggered, and
so on.

Alarm notification profiles Make the standard notification profiles operational
 In step 2, it is not mandatory to add employees and SNMP nodes to every

standard notification profile. For example, some enterprises may want
notifications to be sent only for alarms of the Major and Minor priorities. In this
case, it is only necessary to add employees or SNMP nodes to the Critical and
Major notification profiles.
3. Enable E-mail notification and SNMP notification.

a. Click System Monitoring > System Monitor > Global Alarm Settings
b. Select Email Notification.
c. Select SNMP Notification.
d. Click Save.
Once you understand how to make the standard notification profiles operational, you can vary from
the procedure described above to customize the configuration for your enterprise. For example, you
can create your own custom notification profiles, edit existing notification profiles at different nodes
of the Installations tree, and so on.
Related topics
SNMP MIB files, page 122
Editing notification profiles at different nodes of the Installations tree, page 78

Alarm notification profiles Test and acknowledge alarms from the Alarm Testing notification profile
Test and acknowledge alarms from the Alarm

Testing notification profile
An Alarm Testing profile is available to test that the alarm system is working properly. From the Alarm
Testing profile you can raise and acknowledge four test alarms. The four test alarms include one
alarm assigned to each of the four alarm priorities: Information, Warning, Minor, and Major.
Before testing alarms from the Alarm Testing notification profile, you can edit the profile by assigning
email addresses and SNMP nodes to the profile. After you verify that the four test alarms were raised
successfully, you can also verify that the selected employees received an email and the selected SNMP
nodes received an SNMP trap.
When you have verified that the four test alarms were successfully raised, you can acknowledge the
four test alarms. You must acknowledge the test alarms in the same browser session in which you
raised them.
Before you begin

You must have the Raise/Acknowledge Test Alarms user privilege to perform this procedure. This
privilege is available underneath the Enterprise Manager, System Monitor, View Alarm Settings,
Edit Alarm settings privilege on the Roles Setup page.
Procedure
1. Go to System Monitoring. Under System Monitor, select Notification Profiles.
2. Under Installations (left pane), select the Enterprise node.
3. Click on the Alarm Testing (Use for alarm testing purposes only) notification profile once so
that it is highlighted.
4. Click Raise Test Alarms in the lower-right of the screen.
5. Access the Alarm Dashboard, by clicking Alarm Dashboard in the upper-left of the screen.
6. In the Filter (left hand) pane, under Component Name, select Enterprise Manager. Then click
Filter at the bottom of the Filter pane.
7. In the Alarm Dashboard, verify that the four test alarms appear in the Enterprise Alarms pane.
There is one test alarm for each alarm priority. The test alarms have names such as Test Alarm
(Major priority) and Test Alarm (Minor priority). If the four test alarms appear in the Enterprise
Alarms pane, the alarms were raised successfully.
8. (Optional) If you specified an email address in the Alarm Testing notification profile, verify that an
emails were sent to the specified email address. If you specified an SNMP node in the Alarm
Testing notification profile, verify that SNMP traps were sent to the SNMP node.
9. To acknowledge the four test alarms (acknowledge the test alarms in the same browser session in
which you raised them):
a. From the Alarm Dashboard, select Notification Profiles near the top of the screen.
b. Under Installations (left pane), select the Enterprise node, if necessary.

Alarm notification profiles Test and acknowledge alarms from the Alarm Testing notification profile
c. Click on the Alarm Testing (Use for alarm testing purposes only) notification profile once
so that it is highlighted.
d. Click Acknowledge Test Alarms in the lower-right of the screen.
e. Access the Alarm Dashboard, by clicking Alarm Dashboard in the upper-left of the screen.
f. In the Alarm Dashboard, verify that the four test alarms no longer appear in the Enterprise
Alarms pane. If the four alarms no longer appear, the alarms were acknowledged
successfully.
Related topics
Change the email address and SNMP node assignments, page 80

Alarm notification profiles Viewing the list of alarm notification profiles
Viewing the list of alarm notification profiles

You can view a list of all alarm notification profiles that exist in the system. The list shows the email
addresses and SNMP nodes assigned to each profile.
When viewing the list of notification profiles, the Installation tree node selected in the left-hand pane
affects the notification profile details that appear in the right-hand pane. Notification profiles can be
configured differently at each node of the Installations tree.
Related topics
View the list of alarm notification profiles, page 75
View the list of alarm notification profiles

You can view a list of all alarm notification profiles that exist in the system.
Procedure
2. In the Installations tree (left pane), select the Enterprise node. The list of all alarm notification
profiles in the enterprise displays in the Notification Profiles List.
3. In the Installations tree, you can select lower nodes of the Installations tree (Site Group, Site, or
Server). Select the lower nodes to display the notification profiles that are assigned to alarms at
each node of the Installations tree.
Related topics
Notification Profiles List screen reference, page 76

Notification Profiles List screen reference

The Notification Profiles List screen shows the notification profiles configured at each node of the
Installations tree.
In the pane on the left side, click an Installation tree node to see how the notification profiles are
configured for that node.
Each field of the Notification Profiles List screen is described in this table.
Field Description
Profile Name Shows the names assigned to the alarm notification profiles. The
standard notification profiles are All Alarms, Critical, Information,
Major, and Minor.
An Alarm Testing notification profile is available to users with the
appropriate security privilege to test that the alarm system is
working.
Assigned to Alarm Shows a Yes/No list indicating whether the notification profile is
assigned to any alarms.
By default, each of the alarm notification profiles is assigned to
multiple alarms. Notification profiles are assigned to alarms based
on the priority of each alarm.
To view the notification profiles assigned to alarms, go to System
Monitoring. Under System Monitor, select Alarm Settings.
SNMP Nodes Shows the name of the SNMP (Simple Network Management
Protocol) nodes that are assigned to this notification profile.
These SNMP nodes are notified (by means of SNMP trap) when an
alarm with this profile assigned to it is triggered.
By default, SNMP nodes are not assigned to any of the notification
profiles. You must manually assign the SNMP nodes to notification
profiles (by editing the notification profile).

Field Description
To E-Mail Shows the email addresses that are assigned to this alarm
Addresses notification profile. Each email address is separated by a comma or
semicolon. There can be zero or many addresses listed here.
These email addresses are notified when this profile is assigned to
an alarm and the alarm is triggered.
By default, no email addresses are assigned to any of the
notification profiles.
Inherited From Shows the node of the Installations tree from which the
configuration of the notification profile is inherited.
Notification profiles can be configured differently at each node of
the Installations tree, and the notification profile configuration can
be inherited by the child nodes.
Configuration To open the Configuration Checker, click the icon.

Checker
Use the Configuration Checker to identify and resolve configuration
issues in a recording environment. For details about using the
Configuration Checker, see the Configuration Checker help or the
Recorder Configuration and Administration Guide.
Related topics
View the list of alarm notification profiles, page 75

Alarm notification profiles Changing the email addresses and SNMP nodes assigned to a notification profile
Changing the email addresses and SNMP nodes

assigned to a notification profile
You can change the email addresses and SNMP nodes assigned to a notification profile. You can edit
notification profiles at different nodes of the installations tree to achieve complex notification
schemes.
Related topics
Editing notification profiles at different nodes of the

Installations tree
It is important to understand how the Installations tree node that you select when editing a
notification profile affects the operation of the notification profile.
You can configure (edit) a notification profile differently at each node of the Installations tree
(Enterprise, Site Group, Site, or Server).
This capability enables you to configure alarm notifications to operate differently on a server-by-
server, site-by-site, or site group-by-site group basis.
For example, you can configure notification profiles so that:
 One group of administrators is notified when an alarm is triggered on any server in Site A
 A different group of administrators is notified when that same alarm is triggered on any server in
Site B
Related topics
Example: Editing notification profiles at different nodes of the Installations tree, page 78
Example: Editing notification profiles at different nodes of the Installations tree

To illustrate how you can achieve complex notification schemes by configuring notification profiles at
different nodes of the Installations tree, consider the following example scenario:
 Assume that you have two Sites in your enterprise: the Milan Site and the Rome Site.
 The Milan administrators group administers servers in the Milan Site.
 The Rome administrators group administers servers in the Rome Site.
 You want the Milan administrators to be notified of alarms on the Milan Site servers, but not of the
alarms on the Rome site servers.

 You want the Rome administrators to be notified of alarms on the Rome Site servers, but not of the
alarms on the Milan Site servers.
To achieve this configuration, you edit the notification profiles differently at the Milan and Rome Site
nodes of the Installations tree.
For example:
2. In the left pane, select the Milan Site node.
3. With the Milan Site node selected in the left pane, select the All Alarms profile in the right pane.
4. In the All Alarms profile, do the following:
 In the E-Mail Address section, move only the Milan administrators into the Selected Employees
box. (Do not include any Rome administrators in this box.)
 In the SNMP Nodes section, move only the Milan SNMP nodes into the Assigned SNMP Nodes
box. (Do not include any Rome SNMP nodes in this box.)
 Click Save and Apply to Children. (This action applies the change to all the server nodes in the
Milan Site.)
5. In the left pane, select the Rome Site node.
6. With the Rome Site node selected in the left pane, select the All Alarms profile in the right pane.
7. In the All Alarms profile, do the following:
 In the E-Mail Address section, move only the Rome administrators into the Selected Employees
box. (Do not include any Milan administrators in this box.)
 In the SNMP Nodes section, move only the Rome SNMP nodes into the Assigned SNMP Nodes
box. (Do not include any Milan SNMP nodes in this box.)
 Click Save and Apply to Children. (This action applies the change to all the server nodes in the
Rome Site.)
Notes about the configuration example

In this example configuration note that the All Alarms notification profile is configured differently at
the Milan Site than it is at the Rome Site.
Because the notification profile is configured differently at each Site, the Milan administrators are
notified of all alarms occurring on the servers in the Milan Site. The Milan administrators are not
notified of the alarms occurring at the Rome Site. Similarly, the Rome administrators are notified of
all alarms occurring on the server in the Rome Site. The Rome administrators are not notified of
alarms occurring at the Milan Site.
In this example, you would continue the configuration so that the remaining notification profiles
(Critical, Major, Minor, Information) are also configured in the same manner as the All Alarms profiles.
Configure each profile so that only Milan administrators are notified of alarms on the Milan Site
servers. Configure each profile so that only the Rome administrators are notified of alarms on the
Rome Site server.

Notification profile configuration inheritance

On the Notification Profile List screen, the Inherited From column shows the Installations tree node
from which each node inherits its notification profile configuration.
By default, all notification profiles inherit their configuration from the Enterprise node.
When you edit a particular notification profile at a lower node of the Installations tree, the node no
longer inherits its configuration from its parent node. The node now has its own, unique
configuration. In this case, the Inherited From column for that node displays its own name, rather
than the name of a parent node.
Related topics
Notification Profiles List screen reference, page 76
Change the email address and SNMP node assignments

To change the name of a notification profile, or the email addresses and SNMP nodes that are
assigned to a profile, perform this procedure.
Before you begin

Review these topics:
 Editing notification profiles at different nodes of the Installations tree, page 78
 Example: Editing notification profiles at different nodes of the Installations tree, page 78
Procedure
2. Select the Installations tree node from which you want to edit the notification profile (Enterprise,
Site Group, Site, or Server). The node that you select determines the managed servers to which
the notification profile changes apply.
3. Click Edit.
4. Edit the fields on the Notification Profile screen as needed.
 Click Save. When you click Save, the changes are applied to the selected node. If a child node
has not been previously altered from its default state and saved, the changes are also applied
to the child node.
If a child node has been previously altered and saved, changes are not applied to the child
node when you click the Save button.
 To ignore any changes, click Revert to Parent. The Site Group, Site, or Server that is currently
selected in the Installation tree then inherits the settings of its parent Site, or Site Group.

 To apply the changes to the selected node and all its child nodes, click Save and Apply to
Children. The changes are always applied to the child nodes.
 To return to the settings that existed the last time the screen was saved, click Revert.
Related topics
Notification Profile configuration screen reference, page 81
Notification Profile configuration screen reference

Complete or change the fields on the Notification Profile configuration screen when creating or editing
a notification profile.
The fields on the Notification Profile screen are described here.
Field Description
Notification Profile Details
Profile Name Type the name you want to assign to the alarm notification profile.

Field Description
Assigned to Read-only field that indicates if the Profile Name has been assigned to
Alarms any alarms.
Email Address
Employees - If you are adding employees to the notification profile, click the Select
Organization Group icon to the right of the Organization field. Then select the
Organization that contains the employees you want to add.
All employees in the selected Organization display in the Available
Employees window.
Available Shows a list of employees belonging to the selected Organization.

Employees To assign an employee email address to this notification profile, select
the employee name and click the right-pointing arrow. This action
moves the employee name into the Selected Employees box.
Selected Shows a list of every employee currently assigned to the notification

Employees profile.
If this notification profile is assigned to an alarm and that alarm is
triggered, these employees receive notification emails. The email is sent
to the email address specified in each employee user profile.
To remove an employee email address from this notification profile,
select the employee name in the Selected Employees box and click the
left-pointing arrow. This action moves the employee name into the
Available Employees box.
Additional Email Type other email addresses you want to associate with the notification
Addresses profile. Separate multiple entries with a comma or semicolon. There
can be many addresses listed here or the field can be left blank.
When an alarm associated with this notification profile is triggered, the
Enterprise Manager also sends an email notification to these email
addresses.
Typically, email addresses listed here are not available in an employee
user profile. For example, some users want personal email addresses
listed here so that they also receive alarm notification emails at their
personal email addresses.
SNMP Nodes

Field Description
Available SNMP Shows a list of all SNMP servers/nodes that are specified in the Global
nodes Alarm Settings.
To assign an available SNMP node to this notification profile, select it
and then click the right-pointing arrow. This action moves the node into
the Assigned SNMP nodes box.
When an alarm associated with this notification profile is triggered, an
SNMP trap is sent to this SNMP node.
Assigned SNMP Shows the SNMP nodes that have been assigned to the current
nodes notification profile. These SNMP nodes receive SNMP traps when an
alarm to which this notification profile is assigned is triggered.
To remove an Assigned SNMP node from this notification profile, select
it and then click the left-pointing arrow. This action moves the node into
the Available SNMP nodes box.
Related topics
Add v1/v2c SNMP nodes for notification profiles, page 91

Alarm notification profiles Custom notification profiles
Custom notification profiles

Use custom notification profiles if the standard notification profiles do not meet all the needs of your
enterprise. Custom notification profiles are usually used when a notification profile is needed for a
special purpose.
Custom notification profiles work in the same way as the standard notification profiles. The
difference is that you must manually create the custom notification profiles and manually assign
them to individual alarms.
The topics in this section illustrate the use of custom notification profiles, and describe the
configuration workflow for these profiles.
Related topics
Example: Custom notification profile usage, page 84
Workflow: Custom notification profile configuration, page 85
Create a custom notification profile, page 85
Example: Custom notification profile usage

To illustrate how to use a custom notification profile for a special purpose, assume that the following
situation exists:
 There are two alarms of the Major priority that are triggered persistently.
 You want employees Mike Marshall and Alison Allard to be notified when these two alarms are
triggered so they can investigate them. However, you do not want Mike and Alison to be notified of
any other alarms.
In this situation, you can do the following:

 Manually create a new, custom notification profile. (You must define the name for the profile when
you create it.)
 Add only employees Mike Marshall and Alison Allard to the custom profile.
 Assign the custom profile to the two alarms of the Major priority that are recurring.
Mike and Alison each receive e-mails when either of the two alarms is triggered. If their names are
not included in any other notification profiles, Mike and Alison are not notified of any other alarms.
This example illustrates only one use of custom profiles. You can use custom profiles in any way that
suits the needs of your enterprise.
Related topics

Workflow: Custom notification profile configuration

The workflow for configuring custom notification profiles is similar to the workflow described earlier
in this chapter to make the standard notification profiles operational.
Workflow
1. Add SNMP nodes to the system (if they are not already added).
2. Create the custom notification profile.
3. Add email addresses and SNMP nodes to the custom notification profile.
4. Enable E-mail notification and SNMP notification (if they are not already enabled).
5. Assign the custom notification profile to the appropriate alarms.
Related topics
Example: Custom notification profile usage, page 84
Enable E-Mail and SNMP Notifications for notification profiles, page 90
Create a custom notification profile

Create a new, custom alarm notification profile if the standard alarm notification profiles are not
sufficient for your enterprise.
Procedure
1. Choose System Monitoring >System Monitor>Notification Profiles.
2. In the Installations tree (left pane), select the Enterprise node. You can create a custom
notification profile only from the Enterprise node.
3. Click Create.
4. Complete the fields on the Notification Profile configuration screen.
5. Click Save.
What to do next
Assign the custom notification profile to one or more alarms. See Change the notification profiles
assigned to an alarm, page 108.
Related topics
Notification Profile configuration screen reference, page 81


Alarm notification profiles Delete an alarm notification profile
Delete an alarm notification profile

To remove the alarm notification profile from the list of alarm notification profiles and to unassign
the profile from all alarms, delete the profile.
Procedure
1. Choose System Monitoring >System Monitor>Notification Profiles.
2. In the Installations tree (left pane), select the Enterprise node. The list of alarm notification profiles
displays in the pane on the right side.
You can only delete alarm notification profiles from the Enterprise node of the Installation tree.
3. In the Notification Profile window, select the profile to be deleted.
4. Click Delete. A warning displays if the profile is associated to any alarms.
5. Click OK to confirm the deletion. The profile is deleted and is no longer assigned to any alarms.
Related topics
Alarm notification profiles, page 67

C h a p t e r 5
Alarm configuration options
You can configure global alarm settings that apply to all alarms or individual alarm settings
that apply to a single alarm.
Topics
Configure Global Alarm Settings 89

Configuring individual alarm settings 99
Reset alarms to their default settings 121
Alarm configuration options Configure Global Alarm Settings
Configure Global Alarm Settings

Global alarm settings apply to every alarm. If you change a global alarm setting, the change affects
every alarm in the enterprise.
The global alarm settings determine whether an audible sound plays when each alarm is triggered.
These settings also define the priority levels that you can assign to alarms, and determine how long
acknowledged alarms display in alarm history.
If you are using alarm notification profiles, you also enable E-mail and SNMP notifications for
triggered alarms from the global alarm settings.
Related topics
Configure Audible Notifications for all alarms, page 89
Add v3 SNMP nodes for notification profiles, page 92
Global Alarm Settings screen reference, page 94
Configure Audible Notifications for all alarms

You can enable audible notifications for every alarm in the enterprise.
If you enable audible notifications for all alarms, a sound plays on the system hosting the Enterprise
Manager application when any alarm is triggered. You can disable audible notification for individual
alarms.
If you disable audible notification for all alarms, no sound plays when alarms are triggered. In this
case, audible notification cannot be enabled for individual alarms.
Windows Performance Counter alarms

The audible notification feature is not available for Windows Performance Counter alarms. For
information about identifying these local host alarms, see Windows Performance Counter and the
Error Retrieving Performance Counter Alarm, page 219.
Procedure
1. Choose System Monitoring > System Monitor > Global Alarm Settings.
2. To enable audible notification, select the Audible Notification check box. To disable audible
notification, clear the check box.
3. Click Save.
Related topics
Configure Audible Notification for an individual alarm, page 105

Enable E-Mail and SNMP Notifications for notification profiles

To use notification profiles to send email or SNMP notifications when alarms are triggered, you must
enable E-Mail Notifications and SNMP Notifications for all alarms.
If you make E-mail and SNMP Notifications unavailable for all alarms, notification emails and SNMP
traps are never sent, regardless of how the notification profiles are configured.
Procedure
2. To enable notification profiles to send emails to employees when alarms are triggered, select the
E-Mail Notification check box
To make email notifications unavailable, clear the check box.
3. To enable notification profiles to send traps to SNMP nodes in the NMS when alarms are
triggered, select the SNMP Notification check box.
To make SNMP trap notifications unavailable, clear the check box.
4. Click Save.
Related topics
Configure how long acknowledged alarms display in the Alarm

History tab
Acknowledged alarms display in an Alarm History tab in the Recorder Manager (RM) or Enterprise
Manager Agent (EMA) application. You can configure the number of days an acknowledged alarm
displays in the Alarm History tab.
When the specified number of days elapses, the acknowledged alarm is removed from the Alarm
History tab.
Procedure
2. In the Maximum number of days to store alarm in history setting, enter the number of days
that an acknowledged alarm displays in the Alarm History screen.
3. Click Save.
Related topics
Clear alarms in Alarm History, page 59

Change or create an alarm priority

You can edit the name of an existing alarm priority or create a new alarm priority. An alarm priority
indicates the severity of an alarm.
If you create a new alarm priority, you must manually assign it to the individual alarm that you want
to have the priority.
Procedure
2. In the Alarm Priority Settings section, do one of the following:
 To edit the name of an existing alarm priority, type a new name for the priority in the Name
box.
 To add a new alarm priority:
 Click the Add button.
 In the Priority column, provide a priority number for the alarm. The number must be 4 or
higher. (The default priorities use numbers 0 through 3. You cannot change these default
priority numbers.)
3. Click Save.
4. If you created a new priority, you must manually assign the priority to an alarm.
Related topics
Configure Global Alarm Settings, page 89
Add v1/v2c SNMP nodes for notification profiles

You can use notification profiles to send SNMP traps to notify the Network Management System (NMS)
when alarms are triggered. To use notification profiles for this purpose, you must add SNMP nodes to
the Global Alarm Settings.
Add the SNMP nodes that must receive SNMP traps when alarms are triggered.
You can add version v1, v2c, or v3 nodes to the Global Alarm Settings. Use these instructions to add
v1 or v2c nodes.
Procedure
2. In the SNMP Node Settings > SNMP Nodes section of the screen:
a. Click Add.
b. In the Name column, type the name of an SNMP trap configuration.

c. In the SNMP Manager Host column, type the host name or IP address of the SNMP server to
which the SNMP trap is sent.
d. In the Trap Port column, type the port on which the SNMP server listens for connections
(usual default port is 162).
e. In the Community column, type the name used to identify the group to which SNMP devices
and management stations belong.
f. In the Version drop-down, select v1/v2c.
g. To add another SNMP node, repeat steps a. through f.
3. Click Save.
What to do next
Assign the SNMP node(s) you added to the appropriate notification profile(s).
Related topics
Add v3 SNMP nodes for notification profiles

You can use notification profiles to send SNMP traps to notify the Network Management System (NMS)
when alarms are triggered. To use notification profiles for this purpose, you must add SNMP nodes to
the Global Alarm Settings.
Add the SNMP nodes that must receive SNMP traps when alarms are triggered.
You can add version v1, v2c, or v3 SNMP nodes to the Global Alarm Settings. Use these instructions to
add v3 nodes.
Procedure
2. In the SNMP Node Settings > V3 Node Settings section of the screen, complete the four fields as
noted here. The values entered in these fields are common to every v3 SNMP Node that you add
in step 3.
a. In the Query Port field, enter the port on the SNMP agent to which SNMP queries are sent
during the discovery and monitoring processes (usual default port is 161).
b. In the Authentication Protocol field, select the protocol used to authenticate all SNMPv3
Trap messages.
c. In the Privacy Protocol field, select the protocol used to encrypt all SNMPv3 Trap messages.

d. In the Privacy Password field, enter the password used to encrypt all SNMPv3 Trap
messages. A password is required when the Privacy Protocol field has a value other than
None.
3. In the SNMP Node Settings > SNMP Nodes section of the screen add individual SNMP nodes:
a. Click Add.
b. In the Name column, type the name of an SNMP trap configuration.
c. In the SNMP Manager Host column, type the host name or IP address of the SNMP server to
which the SNMP trap is sent.
d. In the Trap Port column, type the port on which the SNMP server listens for connections
(usual default port is 162).
e. In the Community column, type the name used to identify the group to which SNMP devices
and management stations belong.
f. In the Version drop-down, select v3.
g. In the User Name field, enter the User Name used to authenticate SNMPv3 messages for this
node. This field is required when the Authentication Protocol field (completed in step 2) has
a value other than None.
h. In the Password field, enter the password used to authenticate SNMPv3 messages for this
node. This field is required when the Authentication Protocol field (completed in step 2) has
a value other than None.
i. To add another SNMP node, repeat steps a. through h.
4. Click Save.
What to do next
Assign the SNMP node(s) you added to the appropriate notification profile(s).
Related topics

Global Alarm Settings screen reference

The Global Alarm Settings screen contains the configuration settings that are applied to every alarm in
the enterprise.

This table describes the Global Alarm Setting configuration options:
Field Description
Alarm Settings
Audible Select this option if you want a sound to accompany every alarm that
Notification is triggered. This option is selected by default. If this option is
selected, you can still make audible notification unavailable for
individual alarms.
If you clear the check mark from this option, audible notification for
all alarms is made unavailable. This behavior cannot be changed at
the individual alarm level. (The audible notification field is
unavailable at the individual alarm level.)
E-Mail Select this option if you want the alarm system to send email
Notification notifications to specific people when an alarm is triggered.
To support email notifications, you must also configure notification
profiles. The notification profiles assigned to each alarm determine
who receives the email notifications.
This setting is not selected by default and emails are not sent when
alarms are triggered.
SNMP Select this option if you want the alarm system to send SNMP
Notification (Simple Network Messaging Protocol) traps to the Network
Management System (NMS) when alarms are triggered.
To support SNMP notifications, you must also set up notification
profiles. The notification profiles assigned to each alarm determine
the SNMP nodes to which SNMP traps are sent.
This field is not selected by default and SNMP traps are not sent
when alarms are triggered.
Max days to store After an alarm is acknowledged, the system makes the alarm
alarm history inactive and places it in alarm history.
Type the maximum number of days that an alarm is displayed in
alarm history. The default for this field is 7 days. After this period,
the inactive (acknowledged) alarm is deleted from alarm history.
Alarm Priority Settings

Field Description
Priority Specifies the numeric value of the alarm priorities. By default, a

priority of zero applies to alarms that have the least severity or effect
on system performance. The priority value increases with the
severity of the alarm.
The default settings are:
0 -Information - These alarms provide important status information
but do not require any action by the administrator.
1 - Warning - Address these alarms in a timely manner. A Warning
optimum level.
2 - Minor - Review these alarms and take action if necessary. Minor
3 - Major - Address these alarms immediately. If a major alarm is
not addressed, the system fails either completely or partially.
You cannot change the first four default priority levels.
Name Shows the name of the alarm priority. By default, there are four
alarm priorities: Information (0), Warning (1), Minor (2), and Major
(3), representing severity levels for each alarm.
You can change the name of an alarm priority by typing a new name
in the Name box and clicking Save. Changing a priority name on this
screen also changes the priority name on other user interface
screens where the priority appears.
You can also add new alarm priorities or delete unassigned alarm
priorities that you have created.
Is used Shows Yes if the alarm priority has been applied to an alarm, and No
if it has not been applied to an alarm.
By default, each of the four standard priorities is applied to alarms.
SNMP Node Settings

Add an SNMP node to make it available to be assigned to a notification profile. SNMP
nodes assigned to notification profiles receive SNMP traps when alarms are triggered.
V3 Node Complete these fields only when SNMPv3 is deployed in your

Settings enterprise. The V3 Node Settings are common to every SNMPv3
node in the enterprise
Query Port Specifies the port on the SNMP agent to which SNMP queries are
sent during the discovery and monitoring processes. This port
number is required. The default port is port 161.

Field Description
Authentication Specify the protocol used to authenticate all SNMPv3 messages,

Protocol Possible values are:
 None
 MD5
 SHA-1
The default value is None.
Privacy Protocol Specify the protocol used to encrypt all SNMPv3 messages. Possible
values are:
 None
 DES
 AES128
The default value is None.
Privacy Password Specify the password used to encrypt all SNMPv3 messages. You
must enter a password here when the Privacy Protocol field
specifies a setting other than None.
The minimum length of the password is eight characters and the
maximum length is 200. The password can include upper-case
letters, lower-case letters, and numbers. The password is encrypted
using CCL encryption.
SNMP Nodes Complete these fields to add individual v1, v2c, or v3 SNMP nodes to
the system
Name Type the name of an SNMP trap configuration, such as Atlanta SNMP
server. The name can be a maximum of 100 characters,
SNMP Manager Type the host name or IP address of the server to which the SNMP
Host trap message is sent. This value can be a maximum of 100
characters.
Trap Port Type the port number on which the SNMP server specified in the
SNMP Manager Host setting listens for SNMP traps. The default
port is port 162.
Community Type the name used to identify the group to which SNMP devices
and management stations belong. The community name acts as a
weak password that is required for the NMS to consider the trap
valid. This value can be a maximum of 100 characters.

Field Description
User Name This field is used only for SNMPv3 nodes. Specify the user name
used to authenticate SNMPv3 messages for this node. You must
enter a user name in this field when the Authentication Protocol
field specifies a value other than None.
The minimum length of the user name is six characters and the
maximum length is 32. You can use upper-case letters, lower-case
letters, and numbers in this field.
Password This field is used only for SNMPv3 nodes. Specify the password used
to authenticate SNMPv3 messages for this node. You must enter a
password in this field when the Authentication Protocol field
specifies a value other than None.
The minimum length of the password is eight characters and the
maximum length is 200. You can use upper-case letters, lower-case
letters, and numbers in the password. The password is encrypted
using CCL encryption.
Is Used Shows Yes if this SNMP node is assigned to a notification profile, or

No if the node is not assigned to a notification profile.
Related topics
Configure Audible Notifications for all alarms, page 89

Alarm configuration options Configuring individual alarm settings
Configuring individual alarm settings

You can change the configuration settings of an individual alarm. If you change the configuration
settings of an individual alarm, the changes affect only that alarm.
Use individual alarm settings to do any of the following:
 Specify whether an audible alarm sounds when a specific alarm is triggered
 Change the priority level of an alarm.
 Schedule the times of day in which a specific alarm is in effect.
 Assign notification profiles to an alarm to determine who receives email notification, and which
SNMP nodes receive SNMP traps when that alarm is triggered.
Configure multiple alarms simultaneously

You can select multiple individual alarms and make the same configuration changes simultaneously
to all the selected alarms. When editing multiple alarms simultaneously, you can only change those
configuration settings common to all the selected alarms.
To configure individual alarm settings, you must have Edit Alarm Configuration privileges for the
selected installation.
Related topics
Installation tree hierarchy and alarm configuration, page 99
View the list of alarms for each Installations node, page 101
Enable an alarm, page 104
Schedule an alarm, page 107
Change the notification profiles assigned to an alarm, page 108
Edit multiple alarms simultaneously, page 115
Configuring alarm filters, page 117
Reset alarms to their default settings, page 121
Installation tree hierarchy and alarm configuration

The Installations tree node that you select when configuring an alarm determines the servers on which
the alarm configuration changes are implemented.
Change the configuration of an alarm at a specific node of the Installation tree if you want the
configuration change to apply only to the servers at that node. This capability allows you to configure
the same alarm to behave differently for different site groups, sites, or individual servers.
Example: Configure an alarm to behave differently on one server than on other servers
Assume that the “Proxy Detected” alarm is important for one server in your enterprise, but you do
not want any other servers to trigger this alarm.

To achieve this configuration, you could do the following:

1. Make the Proxy Detected alarm unavailable for all servers in the enterprise.
For example, from the Alarm Settings tab, do the following:
a. Select the Enterprise node in the Installations tree.
b. Select the Proxy Detected alarm, click Edit, and cancel the selection of the alarm. (Make sure
that the Enterprise node is selected when you cancel the selection of the alarm.)
c. Click Save And Apply To Children. This step makes the alarm unavailable at the Enterprise
node and at all child nodes of the Enterprise node.
2. Enable the Proxy Detected Alarm only on the server for which it is relevant.
For example, from the Alarm Settings tab, do the following:
a. Select the Server node in the Installations tree for which the Proxy Detected alarm is relevant.
b. Select the Proxy Detected alarm, click Edit, and enable the alarm.
c. Click Save.
In the configuration example above, the “Proxy Detected” alarm is made unavailable for every server
in the Enterprise except the server selected in step 2. Only this server can trigger the Proxy Detected
alarm.
Use this hierarchical approach to alarm editing when you need specific alarms to behave differently
at specific nodes of the Installations tree.
Save, Save and Apply to Children, Revert to Parent, and Revert Buttons
When you select an Installation tree node on the Configure Alarms screen, and make a configuration
change, you can select one of four buttons to save or revert the changes.
The four buttons are Save, Save and Apply to Children, Revert to Parent, and Revert. The function of
each of these buttons is described here.
 Save - To apply the changes to the selected node, click this option.
 If the child nodes were never previously altered and saved, the changes are also applied to the
child nodes.
 If the child nodes were previously altered and saved, the changes are not applied to the child
nodes.
 Save and Apply to Children - To apply the changes to the selected node and all its child nodes,
click this option. The changes are always applied to the child nodes.
 Revert to Parent - To change all settings to be the same as the parent node of currently selected
node, click this option.
 Revert - To return the alarm settings to the settings that existed the last time the screen was saved,
click this option.
If you are making alarm configuration changes, and you decide you do not want to keep the
changes, you must click Revert before you click Save.
Related topics
Configuring individual alarm settings, page 99

View the list of alarms for each Installations node

You can view a list of every alarm in the enterprise, or every alarm associated with each Installations
tree node in the enterprise. The list of alarms includes basic information about each alarm, such as the
priority of the alarm, whether the alarm is enabled, and the server roles to which the alarm applies.
From the lists of alarms, you can select individual alarms to configure (or edit) them.
Procedure
1. Click System Monitoring > System Monitor > Alarm Settings.
 The Configure Alarms screen displays a list of the alarms according to the View (filter)
selected in the upper-right corner of the screen. The All filter, which displays all
servers and all alarms, is selected by default.
2. Select the node of the Installations tree for which you want to view a list of alarms. Select the:
 Enterprise node to view a list of all alarms on all managed servers installed in the enterprise.
 A Site Group node to view a list of all alarms on all managed servers installed in a site group.
 A Site node to view a list of all alarms on all managed servers in the site.
 A Server node to view a list of all alarms on a specific managed server. (The alarms listed
depend on the server roles active on that server.)
3. The list of alarms, and information about each alarm, displays in the right pane.
At the bottom of the screen, use the Page arrow controls to navigate through multiple pages of
alarms.
Related topics
Configure Alarms screen reference, page 102

Configure Alarms screen reference

The Configure Alarms screen lists every alarm that is associated with the Installation tree node that is
selected in the Installations (left) pane.
This table describes each field of the Configure Alarms screen.
Field Description
View To create, edit, or delete an alarm filter, use the View drop-down
menu above the screen.

Field Description
Search Alarm To search for terms or phrases, use the Search Alarm field in the
upper-right corner. These terms or phrases exist in either the Alarm
Name or the Description fields of the Configure Alarms screen.
The search returns all instances of the entire phrase that is entered in
the Search Alarm field.
For example, assume that you enter “playback attempts” in the search
field and click Go. The search returns every alarm that includes the
entire phrase “playback attempts” in either its Alarm Name or
Description field.
Such a search does not return alarms that have only the term
“playback” or only the term “attempts” in the Alarm Name or
Description field.
To search for alarms that include only the term “playback” in the
Alarm Name or Description fields, enter only the term “playback” in
the search field.
Alarm Number The unique numeric identifier of the alarm.

Click in the column heading to sort the alarm numbers in ascending
or descending order.
Description A brief description of the alarm.
Priority The priority/severity level for this alarm.
Enabled A Yes value indicates that the alarm is active. A No value indicates that
the alarm is not active. If No is selected, the alarm cannot be
triggered.

Field Description
Inherited From The Site Group, Site, or Server node from which the alarm settings
(not the actual alarms) are inherited.
You can configure settings for individual alarms at the Enterprise, Site
Group, Site, or Server node of the Installations tree. The lower nodes
of the Installations tree can then inherit the alarm configuration. (If
you click the Save and Apply to Children button after changing the
configuration of an alarm, the lower nodes of the Installations tree
inherit the configuration settings.)
You can select a lower node of the Installations tree and change (or
edit) the configuration for the alarm at the lower node. This capability
allows you to configure the same alarm to behave differently for
different Site Groups, Sites, or Servers.
When you select a node in the Installations tree, the Inherited From
column shows the node from which the selected node is inheriting the
alarm configuration.
If the Inherited From field displays the same node that is selected in
the Installations tree, the individual alarm settings are configured at
the selected node. The alarm settings are not inherited from a higher
node in the Installations tree.
Roles Affected The server roles affected by the condition that this alarm reports. For
example, an archive configuration error would affect the functioning
of the Centralized Archiving role on a server.
Profiles Shows the notification profiles assigned to the alarm.

Assigned The same alarm can have different Notification Profiles assigned to it
at different nodes of the Installations tree. The same Notification
Profile can also be configured to notify different employees (by means
of email) and SNMP nodes at different nodes of the Installations tree.
Related topics
View the list of alarms for each Installations node, page 101
Enable an alarm
You can enable (activate) an individual alarm or make the alarm unavailable (deactivate the alarm).
If you enable an alarm, the alarm is triggered whenever the error condition associated with the alarm
exists on any managed server.
If you make an alarm unavailable, the alarm is never triggered.

Procedure
1. Choose System Monitoring > System Monitor > Alarm Settings.
2. In the Installations tree (left pane), select the Installations tree node (Enterprise, Site Group, Site,
or Server) from which you want to enable the alarm or make the alarm unavailable.
3. In the Configure Alarms screen, select the alarm(s) you want to enable or make unavailable:
 To select a single alarm, click that alarm.
 To select multiple alarms, do one of the following:
 Hold down the Ctrl key and click multiple alarms.
 Click Select All to select all alarms on the currently displayed page of alarms. (Alarms not
visible on the currently displayed page are not selected.)
4. Click Edit.
5. To enable an alarm, select the Enabled check box.
To make the alarm unavailable, clear the check box.
6. Click the Save, Save and Apply to Children, or a Revert option as appropriate.
Related topics
Configure Alarm screen reference, page 110
Save, Save and Apply to Children, Revert to Parent, and Revert Buttons, page 100
Configure Audible Notification for an individual alarm

You can enable audible notifications for individual alarms or make audible notifications unavailable.
If you enable audible notifications for an alarm, a sound plays on the system hosting the Enterprise
Manager application when the alarm is triggered.
If you make audible notifications unavailable, no sound plays when the alarm is triggered.
 If audible notifications are made unavailable for all alarms in the Global Alarm Setting tab,
you cannot enable audible notification for an individual alarm. In this case, the Audible
Notification check box is unavailable for the individual alarms.
Procedure
2. In the Installations tree (left pane), select the Installations tree node from which you want to
configure alarm audible notifications (Enterprise, Site Group, Site, or Server).

3. In the Configure Alarms screen, select the alarms for which you want to enable audible
notifications or make audible notifications unavailable.
4. Click Edit.
5. To enable audible notification for an alarm, select the Audible Notification check box.
To make audible notifications unavailable for an alarm, clear the check box.
Related topics
Change the Priority assigned to an alarm

By default, each alarm has an alarm priority assigned to it. You can change the alarm priority that is
assigned to an alarm.
If you create a new alarm priority, use this procedure to assign the new priority to one or more
alarms.
 If you manually edit an alarm priority, and the alarm priority changes as part of either a KB,
update release, or other new release, the manually edited priority resets to the new default
value.
Procedure
assign priorities to alarms (Enterprise, Site Group, Site, or Server).
3. In the Configure Alarms screen, select the alarms for which you want to change the priority
assignment.


4. Click Edit.
5. In the Priority Name drop-down box, select the priority you want to assign to the alarms.
Related topics
Schedule an alarm
You can schedule the specific days, and time periods within each day, during which an alarm can be
triggered.
If you create a schedule for an alarm, the alarm can be triggered only during the scheduled times. The
alarm is never triggered outside its scheduled times, even if the error condition associated with the
alarm occurs.
Procedure
schedule an alarm (Enterprise, Site Group, Site, or Server).
3. In the Configure Alarms screen, select the alarms you want to schedule.
4. Click Edit.

5. Complete the Scheduling section of the screen:

a. In the Day column, select the days during which the alarm can be triggered.
b. In the Start Time column, click the clock icon and select the time of day at which the alarm is
active and can be triggered.
c. In the End Time column, click the clock icon and select the time of day at which the alarm
becomes inactive (the alarm cannot be triggered after this time).
 In the Start Time and End Time fields, you can also type a time in the
hh:mm:AM/PM format, rather than using the clock icon.
Related topics
Change the notification profiles assigned to an alarm

You can change the notification profiles assigned to an alarm. Change the notification profile assigned
to an alarm if you want to change the employees and SNMP nodes that are notified when the alarm is
triggered.
Each alarm has two standard notification profiles assigned to it by default.
Procedure
assign notification profiles to alarms (Enterprise, Site Group, Site, or Server).
3. In the Configure Alarms screen, select the alarms to which you want to assign or unassign
notification profiles.
4. Click Edit.

5. In the Notification Profiles section of the screen, do the following:

 To assign a notification profile to one or more alarms, move the notification profile into the
Assigned Profiles box.
 To remove (or unassign) a notification profile from one or more alarms, move the notification
profile into the Available Profiles box.
Related topics

Configure Alarm screen reference

The Configure Alarms page contains the configuration settings that apply to an individual alarm.
This table describes each Configuration Alarm screen option.
Item Description
Description Shows a brief, read-only description of the alarm.
Enabled To enable an alarm or to make an alarm unavailable, use this check box.
If a check mark appears in the box, the alarm is enabled (active).
To make the alarm unavailable (deactivate the alarm), clear the check
mark from the check box.
When enabled, the alarm is triggered (made active) when the condition
associated with it exists on a managed server.
When an alarm is made unavailable, the alarm cannot be triggered.
Each alarm is enabled by default.
If you are simultaneously editing multiple alarms, an asterisk (*) can
appear in this field. The asterisk indicates that the alarms you are editing
have different values configured for this field.

Item Description
Audible Check to indicate that the alarm is to give off a warning sound when
Notification triggered. To prevent the alarm from giving off a warning sound when
triggered, clear the check mark.
If audible notifications are made unavailable in the Global Alarm Settings,
this setting is unavailable and cannot be enabled.
Priority Name Select a priority level for this alarm. The default priority levels are listed
here in order of their severity.
 Major (most severe)
 Warning
 Minor
 Information (least severe)
You can add new a new alarm priority if necessary.
An alarm priority can change as part of a new release. If you manually edit
an alarm priority, and the alarm priority changes as part of either a KB,
update release, or other new release, the manually edited priority resets
to the new default value.

Item Description
Trigger Delay Specifies the Trigger Delay interval for an alarm (in seconds).
This setting is disabled (either empty or set to zero) by default. Usually,
you can accept the default and leave this setting disabled.
This setting is an advanced setting that is needed only in particular
circumstances. This setting prevents administrators from being notified of
alarms that require no action by the administrator to resolve.
The Trigger Delay interval specifies the number of seconds that passes
between the detection of an alarm and the time that the user is notified of
the alarm. (The user is notified either through the appearance of the alarm
in the user interface, an email notification, or an SNMP notification).
Specify a Trigger Delay value only when a particular alarm repeatedly
turns on and then off and requires no action by the administrator to
resolve it.
Sometimes, the typical operating conditions in an environment can cause
a specific alarm to be repeatedly turned on and off. For example, if your
environment frequently experiences short network disconnections that
trigger an alarm, configure this setting to prevent administrators from
being repeatedly notified of the alarm.
If you specify a value for this setting, the recommended value is 10
seconds. Sometimes you need to experiment with this value to determine
the appropriate delay period.
When this setting is disabled, there is no Trigger Delay and the alarm is
raised as soon as it is detected.
Resend Delay Specifies the number of seconds that the Alarm Service waits to resend an
SNMP notification for an unacknowledged alarm.
The Alarm Service sends an SNMP notification when it detects an alarm. If
this setting is selected, the system resends this SNMP notification at
regular intervals until the alarm is acknowledged.
The SNMP Notification option must be selected in the Global Alarm
Settings tab for this option to be in effect.
This setting is blank by default. When this setting is blank, the SNMP
notification is not re-sent.
specify different values for this field.

Item Description
Scheduling Allows you to schedule the alarm. You can specify the days of the week,
and the times of the day, that the alarm is in effect. To open the Time
window and set times, or to type times in the format hh:mm:AM/PM, click
the Clock icon.
The alarm can only be triggered during the times in which it is scheduled
to be in effect. By default, an alarm is configured to be in effect seven days
a week, 24 hours a day.
specify different values for this field.
Alarm when This option does not appear for all alarms.
threshold is If applicable, use this option to specify a value, or threshold, at which the
above/below * alarm is triggered.
Each alarm is different. Some alarms are triggered when the value rises
above the specified threshold (threshold is above). Other alarms are
triggered when the value falls below the specified threshold (threshold is
below).
Acknowledge This option does not appear for all alarms.

Alarm when If applicable, use this option to specify a value, or threshold, at which the
threshold is alarm is automatically acknowledged (that is, put to history/made inactive)
above/below * by the system.
Each alarm is different. Some alarms are automatically acknowledged
when the value rises above the specified threshold (threshold is above).
Other alarms are acknowledged when the value falls below the specified
threshold (threshold is below).
This option can work with the Alarm when threshold is above/below
option. For example, you can set the Alarm when threshold is above
option to 3000 and the Acknowledge Alarm when threshold is below
option to 2000. In this configuration, the alarm is raised (becomes active)
when the value exceeds 3000. The system does not automatically
acknowledge the alarm until the value goes back below 2000.
In the example above, the alarm is not acknowledged until the value is
safely below the threshold at which it was triggered. Ensure that the two
values differ by a reasonable amount. Do not set the two values too close
together. If the system wavers back and forth across the threshold value,
values that are too close together can cause repeated triggering and
acknowledgment of the alarm.

Item Description
Notification To assign a notification profile to an alarm, select a profile from the

Profiles Available Profiles pane (left). To move that profile to the
AssignedProfiles pane (right), click the right-pointing arrow. To remove
alarm notification profiles from this alarm, reverse this process.
The notification profiles assigned to an alarm determine who receives
email notification, and which SNMP nodes receive SNMP traps, when an
alarm is triggered.
For more information about notification profiles, see Alarm notification
profiles, page 67. (Alarm notifications are not configured to work by
default, and must be configured to operate.)
specify different values for this field. For more information, see Edit
multiple alarms simultaneously, page 115.
Buttons When you change alarm configuration settings, you select an Installation
tree node and make the configuration changes. These buttons determine
how the configuration changes are applied to the child nodes of the
selected Installations tree node.
 Save - To apply the changes to the selected node, click this option.
If the child nodes were never previously altered and saved, the
changes are also applied to the child nodes.
If the child nodes were previously altered and saved, the changes are
not applied to the child nodes.
 Save and Apply to Children - To apply the changes to the selected
node and all of its child nodes, click this option. The changes are always
applied to the child nodes.
 Revert to Parent - To change all settings to be the same as the parent
node of currently selected node, click this option .
 Revert - to return the alarm settings to the settings that existed the last
time the Alarm Settings screen was saved, click this option. The screen
remains open and you can continue to change it.
 Cancel - To close the Alarm Settings screen without saving changes,
click this option.
* These fields appear only for alarms that have thresholds. For alarms that do not have a
threshold, these fields do not display.
Related topics
Enable an alarm, page 104

Schedule an alarm, page 107

Reset alarms to their default settings, page 121
Edit multiple alarms simultaneously

If you want to change the same settings for several different alarms, you can edit multiple alarms
simultaneously.
Note the following about editing multiple alarms simultaneously:
 Optionally, you can select specific alarms, or you can select all the alarms on one page of the
Configure Alarms screen.
 You can edit only those settings that are common to all the alarms selected for editing. If all the
alarms you selected have identical settings, all alarm settings are available for editing.
 You cannot edit settings that are not common to all alarms selected for editing. For example, if two
of the selected alarms have unique settings that other selected alarms do not have, you cannot edit
those settings for any alarms.
 If you change a setting, the new setting applies to every alarm you selected for editing.
Example Procedure for Editing Multiple Alarms

This procedure describes how to select multiple alarms for editing, and describes how the Edit Alarms
screen displays configuration settings for multiple alarms.
2. In the Installations tree (left pane), select the node of the Installations tree from which you want to
edit multiple alarms (Enterprise, Site Group, Site, or Server).
3. In the pane on the right side, do one of the following:
 Press and hold the Ctrl key while you select the specific alarms you want to edit, and then click
Edit.
 To edit all the alarms on the currently displayed page, click the Select All button, and then click
Edit.

4. The Edit Alarms screen displays.
When simultaneously editing multiple alarms, note the following about the Edit Alarms screen:
 Only the alarm settings that are common to all the alarms that you selected in step 3 display
and are available for editing.
 If the alarms you selected currently have different values configured for this field, an asterisk
(*) appears as a value for a field
If you replace an asterisk with a specific value, all the alarms you have selected will have the
same value for the field.
 If a specific value appears for a field (and not an asterisk), all the alarms you selected currently
have this same value specified for the field.
 A few of the alarms include an Alarm when threshold is above/below and an

Acknowledge alarm when threshold is above/below field. These fields do not
appear on the Edit Alarms screen when you select multiple alarms to configure.
To change one of these fields, you must configure the alarm individually.
5. Change the values on the Edit Alarms screen as needed. Only the values that you change on the
Edit Alarms screen are applied to every alarm you selected in step 3.

Related topics
Alarm configuration options, page 88
Configuring alarm filters

Alarm filters allow you to filter the alarms that display in the Configure Alarms screen available from
the Alarm Settings tab.
The All alarm filter exists by default and displays all alarms associated with the node that is selected
in the Installations tree.
To limit the alarms that display in the Configure Alarms screen to only alarms that are of specific
interest, create an alarm filter.
To create an alarm filter, you list specific alarm characteristics in the filter. When the alarm filter is
selected, only the alarms that have the characteristics specified in the filter display in the Configure
Alarms screen.
The three characteristics available for filtering alarms are
 Enabled/Disabled
 Alarm Priority
 Server role
For example, you can create an alarm filter that displays only Enabled alarms that have the Major
priority level and are associated with the Integration Service server role.
You can also edit and delete alarm filters. You can edit or delete any alarm filter created by an
administrator. You cannot edit or delete the All alarm filter.
Related topics
Create an alarm filter, page 117
Create Filter screen reference, page 118
Edit an alarm filter, page 119
Delete an alarm filter, page 120
Create an alarm filter

To limit the display of alarms in the Configure Alarms screen, create an alarm filter. Select the alarm
characteristics that comprise the filter. When the filter is applied on the Configure Alarms screen, only
alarms with those characteristics display in the screen.
Procedure
1. Click System Monitoring > System Monitor > Alarms Settings.
2. Click the View menu above the right pane of the screen, and then select CreateFilter.

3. In the Create Filter screen, specify the alarm characteristics to include in the filter.
When this filter is selected in the user interface, only the alarms that have the characteristics that
you select display in the Configure Alarms screen.
 Click Save As to save the alarm filter as a new filter and provide it with a name. The new name
then appears as a selection in the View menu.
 Click Default Filter to have this alarm filter appear as the default selection in the View area.
 Click Clear to clear all fields and start over from scratch.
Related topics
Create Filter screen reference

The Create Filter screen contains all alarm characteristics that can be included in an alarm filter. When
the filter is selected, only alarms with the selected characteristics display in the Configure Alarms
screen.

This table describes the options on the Create Filter screen.
Item Description
Enabled/Disabled Select one of the following to determine whether the alarm filter
displays enabled alarms, disabled alarms, or both:
 Enabled Only - Displays only alarms that are currently
enabled. Enabled alarms are triggered whenever the condition
associated with the alarm exists on a managed server.
 Disabled Only - Displays only alarms that are currently
disabled. Disabled alarms are never triggered.
 All - Displays all alarms (both enabled and disabled).
Priority Select a specific priority if you want the alarm filter to display only
alarms of that priority. Choices include Information, Warning,
Major, and Minor, or any other alarm priority that has been
created in the Global Alarm Settings tab.
Roles Affected Select specific server roles if you want the alarm filter to display
only alarms that affect those server roles.
To include a server role in the alarm filter, select a server role in
the Available Roles pane. Click the right-pointing arrow to move
the role into the Selected Roles pane.
To remove server roles from the alarm filter, click the server role
in the Selected Roles pane. Click the left-pointing arrow to move
the role into the Available Roles pane.
Related topics
Create an alarm filter, page 117
Edit an alarm filter, page 119
Delete an alarm filter, page 120
Edit an alarm filter

To change the alarm characteristics that comprise an alarm filter, edit the filter.
Procedure
2. Click the View menu on the right side of the screen, and select the alarm filter you want to edit.
3. Click the View menu in the right side of the screen again and select Edit Filter.
4. In the Create Filter screen, specify the alarm characteristics to include in the filter.


 Click Default Filter to have this filter appear as the default selection in the View area.
 Click Clear to clear all fields and make new selections for the filter being edited.
 Click Save to save your changes.
 Click Save As if you want to save the edited filter with a new name.
 Click Delete if you want to delete the filter.
Related topics
Delete an alarm filter

To remove an alarm filter as a selection in the View menu, delete the alarm filter.
Procedure
2. Click the View menu in the right corner of the screen, and select the alarm filter you want to
delete.
 You cannot delete the All alarm filter.
3. Click the View menu in the right corner of the screen again and select Edit Filter.
4. Click Delete.
Related topics

Alarm configuration options Reset alarms to their default settings
Reset alarms to their default settings

You can reset all the alarms in the enterprise to their default configuration settings.
Note the following about resetting all alarms:
 You must reset the settings for all alarms. You cannot select individual alarms and reset the settings
for only the selected alarms.
 The notification profiles assigned to each alarm revert to the default configuration:
1. If you have assigned custom profiles to alarms, the custom profiles will no longer be assigned to
the alarms after you reset the alarms.
2. Custom profiles are not deleted from the system; they are just unassigned from alarms.
 In the Global Alarm Settings tab, the settings under the Alarm Settings heading are restored to
their default settings. However, the settings under the Alarm Priority Settings heading and the
SNMP Node Settings heading are not restored to their default settings.
Procedure
2. In the Installations tree (left pane), select the Enterprise node.
3. Click the Reset button. A message appears indicating that all alarm and profile settings are reset
to their default values.
4. Click OK.
Related topics
Alarm configuration options, page 88

C h a p t e r 6
SNMP MIB files
If you want servers to notify the Network Management System (NMS) when alarms are
triggered, you must deploy the SNMP MIB files and configure notification profiles.
Deploy the SNMP MIB files before configuring the notification profiles.
What are MIB files?

The Management Information Base (MIB) files allow the Network Management System
(NMS) to monitor any device defined within the Recording system.
Specifically, Management Information Base (MIB) files enable the SNMP manager in the
NMS to interpret SNMP trap messages sent from a managed server.
To interpret these trap messages, the SNMP manager must have access to the MIB file that
describes the format and content of every trap that the server can send.
Supported SNMP versions

SNMPv1, SNMPv2, SNMPv2c, and SNMPv3 are supported.
Topics
Deploy the MIB files 123

SNMP MIB structure 133
SNMPv3 discovery 135
SNMPv3 queries 136
SNMP MIB files Deploy the MIB files
Deploy the MIB files

You must deploy the MIB files to enable the SNMP manager in the NMS to interpret trap messages
sent to it from a managed server.
To deploy the MIB files, complete these steps:
1. Locate the MIB files, page 123
2. Copy the MIB files, page 123
3. Enable the SNMP configuration tool to use the MIB files, page 124
Related topics
Locate the MIB files

Step 1 of 3 required to deploy the MIB files.
Locate the MIB files. The MIB files are placed in this directory by the server installation: <install
directory>\Software\ContactStore\MIBS.
What to do next
Copy the MIB files, page 123
Copy the MIB files

To complete this step, copy the MIB files to the appropriate folder running your SNMP configuration
tool.
Procedure
1. Copy the five MIB files to the appropriate folder on the server running your SNMP configuration
tool. These files include:
 WITS-CSFAMILY-MIB.mib
 WITS-CS-MIB.mib
 WITS-PRODUCTS-MIB.mib
 WITS-TRAP-MIB.mib
 WITS-TRAP-MIBv1.mib
For example, if you are using the Castle Rock SNMPc Network Manager, copy the MIB files to
<Install Path>\SNMPc Network Manager\mibfiles on the server running the Castle Rock
SNMPc Network Manager.
What to do next
Complete the procedure Enable the SNMP configuration tool to use the MIB files, page 124.

Enable the SNMP configuration tool to use the MIB files

To complete this step, you enable your SNMP configuration tool to use the MIB files.
This procedure varies depending on the SNMP configuration tool used in your enterprise.
 The following example illustrates how to perform this procedure using the Castle Rock SNMPc
Network Manager. If you use a different SNMP configuration tool in your enterprise, use this
example procedure as a guideline. Follow the specific instructions provided in the
documentation for the configuration tool used in your environment.
To enable the Castle Rock SNMPc Network Manager to use the MIB files, you perform two tasks:
1. Compile the MIB files, page 124.
2. Configure the Event Filter, page 126
Compile the MIB files

Task 1 of 2 required to enable the Castle Rock SNMPc Network Manager to use the MIB files.
Procedure
1. Open Start > Programs > SNMPc Network Manager > Startup System.
2. In the SNMPc management console, choose Config > MIB database.

3. Click Add to select the Recorder MIB files.
4. Select the Recorder MIB files to add.

5. Click Compile. It compiles all the MIB files loaded.
6. Click Done to complete the compilation.
What to do next
Complete the task Configure the Event Filter, page 126
Configure the Event Filter

Task 2 of 2 required to enable the Castle Rock SNMPc Network Manager to use the MIB files.
Procedure
To complete this task, you set up one Event Filter for each severity: Major, Minor, Information and
Warning. The following steps show how to set up the Major filter.

1. In the left pane of the SNMPc Management Console, select the Event tab and go to witsTraps.
2. Expand the witsTraps folder.

3. Go to alarmTrap.

4. Right-click and then select Insert Event filter…
5. Within the Add Event Filter dialog, on the General tab:

a. Set Event Name as Major.
b. Set Message as $'5.
Setting message to $'5 extracts the message in field 5 of SNMP trap and displays it in the
monitor window. Field 5 is the body of the alarm message, so this action causes the alarm
message to be displayed in the monitor window.

6. Click the Match tab.
7. Under the Match tab:

a. In the Var List, select witscsAlarmSeverity.
b. In the Var Value, select Major from the drop-down list.

8. Under the Actions tab, set the Priority as Major-Yellow from the drop-down box.
9. Click OK to complete the event filter configuration.

When configured properly, you see a new Event Filter called Major under Alarm Trap.

10. Repeat these steps for all other severities; Minor, Information, and Warning.
As you define each filter, assign:
 The proper Event Name on the General tab (Minor, Information and Warning)
 The correct Var Value on the Match tab (Minor, Information and Warning)
 The appropriate Priority on the Actions tab.

SNMP MIB files SNMP MIB structure
SNMP MIB structure

The SNMP MIB structure consists of a single alarm trap ID (OID = 1.3.6.1.4.1.1815.1.1.1.6.6.2) that
includes the parameters listed in this table. These MIB parameters are updated in the third-party
SNMP monitoring application used in your environment.
Parameter Object Identifier (OID) Description
AlarmIndex 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.1 A unique identifier of the alarm

instance.
AlarmTime 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.2 The time the alarm was raised

or acknowledged.
AlarmSeverity 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.3 The alarm severity:

0 - Informational
1 - Warning
2 - Minor
3 - Major
AlarmBody 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.4 The message text for the alarm

including the actual
parameters (AlarmPx).
Note: In the alarm chapters of
this documentation, the
AlarmBody is the same as the
Alarm Details listed for an
alarm.
AlarmToken 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.5 The AlarmToken is the same as

the alarm display name (that is,
the alarm name as it displays
in the user interface).
In the alarm chapters of this
documentation, the alarm
display name is the heading of
an alarm’s description.
AlarmNumber 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.6 A predefined numeric identifier

for the alarm.

SNMP MIB files SNMP MIB structure
Parameter Object Identifier (OID) Description
AlarmActive 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.7 A flag that indicates whether

the alarm has been
acknowledged or is currently in
the raised state.
0 - Acknowledged (sent for
both manually and
automatically acknowledged
alarms as noted
below)
1 - Raised
Note: When an alarm
condition is resolved, an alarm
can be acknowledged either
manually by the user (from the
alarming user interface) or
automatically by the system.
The 0 flag is sent for both
manually and automatically
acknowledged alarms.
AlarmClientId 1.3.6.1.4.1.1815.1.1.1.6.6.2.1.8 The SNMP ClientId as set by

the Enterprise Manager in the
AlarmConfig.xml files:
<snmpclientid> element
Common Data
SysUpTime 1.3.6.1.4.1.1815.1.1.1.4.1 The number of tick counts for

which the system has been
running.
Related topics

SNMP MIB files SNMPv3 discovery
SNMPv3 discovery
The SNMPv3 discovery feature is supported. If your Network Management System (NMS) provides a
SNMPv3 agent discovery feature, you can use this feature to populate your NMS with all the SNMP
agent nodes and their respective EngineIDs.
What is SNMP discovery?

To send and receive SNMPv3 encrypted messages between your NMS and the agent, SNMP requires
several pieces of information. Required information includes authentication details, encryption
details, and a unique ID assigned to the agent. The unique ID is called an ‘EngineId’.
To reduce the burden of manually configuring each agents EngineId, the agents EngineID is typically
generated by the agent.
The generated agent EngineId then needs to be communicated back to the NMS. The EngineId is
communicated back to the NMS so that the NMS can communicate with the agent securely.
The standard protocol used for communicating this EngineId back to the NMS is called ‘SNMP
discovery’.
Related information
For more details, see RFC3414 section 4.

SNMP MIB files SNMPv3 queries
SNMPv3 queries
The agent supports several SNMPv3 read class operations. Most NMS software provides a standard set
of MIBs that allows you to query the parameters listed below by name. Querying the parameters by
name saves you from having to supply the actual OID. If your NMS does not provide any of these
standard MIBs, obtain the relevant MIB listed in the ‘Located ’ column. Install the MIB according to your
NMS software instructions.
Parameter Object Identifier Located Description Example

(OID) in MIB
sysDescr.0 1.3.6.1.2.1.1.1.0 SNMPv2- Avaya installed 15.2 2020R1

MIB product version. Recorder
The installation
version details
are read from the
ServerVersion-
Information.xml
file.
sysObjectID.0 1.3.6.1.2.1.1.2.0 SNMPv2- SNMP product Returned value is

MIB OID registered always:
with the IANA. enterprise.1815.1
sysUpTime.0 1.3.6.1.2.1.1.3.0 SNMPv2- System up time. Timeticks:

MIB (429080562) 4
days, 23:11:20.562
sysContact.0 1.3.6.1.2.1.1.4.0 SNMPv2- Manufacturer Returned value is

MIB contact details. always:
Verint Systems
sysName.0 1.3.6.1.2.1.1.5.0 SNMPv2- Host name of the ServerOne

MIB server.
sysLocation.0 1.3.6.1.2.1.1.6.0 SNMPv2- Host name of the ServerOne

MIB server. Same as
sysName.
ipAdEntAddr 1.3.6.1.2.1.4.20.1.1 IP-MIB IPv4 address of 192.168.11.23

the server.

SNMP MIB files SNMPv3 queries
Parameter Object Identifier Located Description Example

(OID) in MIB
ipAdEntIfIndex 1.3.6.1.2.1.4.20.1.2 IP-MIB Index value that 19

uniquely
identifies the
network interface
to which the IPV4
address is
applicable.
ipAdEntNetMask 1.3.6.1.2.1.4.20.1.3 IP-MIB Subnet mask 255.255.255.0

associated with
the IPv4 address.
Related information
For more details about read class operations, see RFC3411 section 2.8.

C h a p t e r 7
Alarms Spreadsheet
An alarm spreadsheet is available that lists every alarm the system can raise.
Topics
Alarms Spreadsheet Contents 139

Alarm attributes 140
Advanced Corrective Actions Are For Certified Support Personnel Only 143
Alarms Spreadsheet Alarms Spreadsheet Contents
Alarms Spreadsheet Contents

The Alarms Spreadsheet lists every alarm the system can raise, and also shows the default value of
every attribute of every alarm.
The Alarms Spreadsheet is an Excel file that is provided as an attachment to the PDF version of this
document. The Alarms Spreadsheet is also available as a separate stand-alone document.
The Alarms Spreadsheet is useful in any alarm configuration activity. You can quickly locate any alarm,
or sort the entire list of alarms based on any alarm attribute. For example, you can sort alarms
alphabetically by alarm name or numerically by alarm number or priority.
The Alarms Spreadsheet includes these three tabs:
 Start - This tab contains introductory information for the Alarms Spreadsheet.
 List of All Alarms - This tab contains the alarms list. One alarm is listed on each row. The columns
display the attributes of each alarm, and show the default attribute values for each alarm. If an
attribute value is empty for an alarm, that attribute is not applicable to the alarm.
 Alarm Attribute Help - This tab provides an explanation of each alarm attribute (that is, each
column) shown in the List of All Alarms tab.

Alarms Spreadsheet Alarm attributes
Alarm attributes
In the Alarms Spreadsheet, one alarm is listed in each row of the spreadsheet. The spreadsheet
columns list the attributes of each alarm.
List of alarm attributes described for each alarm in the Alarms Spreadsheet
A description of each alarm attribute listed in the spreadsheet is provided here.
 This same information also appears on the Alarm Attribute Help tab of the Alarms
Spreadsheet
 Components: Shows the component to which an alarm belongs.

Many alarms can be raised by multiple components (that is, a component can raise an alarm even
if the alarm does not belong to that component).
If you are viewing alarms in the user interface, the Active Alarms screen shows the component that
raised the alarm, not the component to which the alarm belongs.
 Alarm Name: The alarm name as it displays in the user interface.
 Internal Alarm Name: The internal name for the alarm. This name appears in logs and in the
software code, but does not display in the user interface.
 Alarm Number: A unique numeric identifier for the alarm. Some alarms have the same Alarm
Name, but different alarm numbers.
 Event Alarm: Indicates whether the alarm is, or is not, triggered by a transient event. Alarms
triggered by transient events indicate that a problem has occurred, but the problem often cannot be
resolved by an administrator. This value can be On or Off.
The On value indicates that a transient event triggered the alarm. The alarm only alerts the
administrator that a problem has occurred but often the administrator cannot resolve the problem
that the alarm reports. For example, a missed network packet can trigger an event alarm. In this
case, the event happened in the past and the administrator cannot recover the lost packet.
However, the alarm alerts the administrator that the event occurred.
The Off value indicates that a component experienced a problem that is not transient (for
example, the Recorder component stopped running). For such an alarm, the administrator must
perform a corrective action to return the system to a functioning state.
 Maximum Instances: The maximum number of instances of the alarm that can be triggered
(active) at one time.
 Enabled: This column indicates if the alarm is On or Off by default. If the alarm is On, the alarm can
be triggered. If the alarm is Off, the alarm cannot be triggered. An administrator can configure this
setting for each alarm.
 Priority: The numeric identifier of the default priority level of the alarm. These default priority levels
are:
 0 - Information
 1 - Warning

 2 - Minor
 3 - Major
These priority numbers and text values (Information, Warning, Minor, Major) are configurable by
the administrator.
 Alarm Summary: A summary of the problem causing the alarm.
 Alarm Details: Provides detailed information about the alarm.
 Corrective Action:Explains how to correct or resolve the problem causing the alarm.
 Advanced Corrective Action: Describes more corrective procedures if the initial attempts to
correct the alarm fail.
 Advanced corrective actions are performed only by authorized support personnel.

 Cycle Multiplier: The value used to determine how often to evaluate the rate counter to determine
when to raise an alarm. The frequency with which the system evaluates the rate counter is based on
the value of this attribute and the cycle time seconds that is configured globally for the Alarm
Service. The formula for the frequency is:
cycle multiplier * cycle time seconds
Cycle time seconds is a non-configurable parameter that is set to 30 seconds. This element is not
used with all alarms.
 Object Name: Lists the Windows Performance counter object name. This element is not used with
all alarms.
 Counter Name: Lists the Windows Performance counter name (or other counter name if the
counter is not a Windows Performance counter).
 Trigger Rule: Lists the condition on which an alarm is triggered. The possible values include:
 above - The counter must be above the threshold to trigger the alarm.
 below - The counter must be below the threshold to trigger the alarm.
 notexist - The alarm is raised if the counter does not exist. This trigger rule is useful for raising
alarms about processes that are not running.
This element is not used with all alarms.
 Trigger Type: Lists the type of trigger for the alarm. The possible values include:
 peak - The alarm is raised when the Windows performance counter goes above (if trigger rule is
above) or below (if trigger rule is below) the configured threshold.
The system acknowledges the alarm when the counter is above (if trigger rule is below) or below
(if trigger rule is above) the acknowledge threshold.
 average - The alarm is raised when the average value of the Windows performance counter goes
above (if trigger rule is above) or below (if trigger rule is below) the configured threshold.

The system acknowledges the alarm when the average value of the Windows performance
counter is above (if trigger rule is below) or below (if trigger rule is above) the acknowledge
threshold.
The average is calculated over a period using this formula:
cyclemultiplier * cycle time seconds.
 difference - The alarm is raised when the Windows performance counter differs by a configured
threshold. The alarm is acknowledged when the counter differs less than the configured
acknowledge threshold.
This element is not used with all alarms.
 Rate Counter: The On value indicates that the counter is a Windows Performance monitor rate
counter. This element is not used with all alarms.
 Threshold: The threshold at which the alarm is triggered. Some alarms are triggered when the
value rises above this threshold while other alarms are triggered when the value falls below this
threshold. This value is configurable by the administrator. Not all the alarms have thresholds.
 Acknowledge Threshold:Specifies the value at which the system automatically acknowledges the
alarm. Generally, a certain amount of separation exists beneath this value and the Threshold value.
This separation exists to prevent the repeated triggering and acknowledgment of alarms when a
value wavers back and forth across a specific threshold.
For example, you can set an alarm Threshold to above 3000 and the Acknowledge Threshold to
below 2000. In this configuration, the alarm is triggered when the value exceeds 3000. The alarm is
automatically acknowledged when the value goes back below 2000.
In this example, the alarm is not acknowledged until the value is safely below the threshold at
which it was triggered. Setting the two values too close together can cause the repeated triggering
and acknowledgment of the alarm if the system wavers back and forth across the threshold value.
 Trigger Delay: Specifies the number of seconds that passes between the detection of an alarm and
the time that the user is notified of the alarm. (The user is notified of the alarm either through the
appearance of the alarm in the user interface, an email notification, or an SNMP trap).
This setting is an advanced setting that is needed only in particular circumstances. This setting
prevents administrators from being notified of alarms that require no action by the administrator
to resolve.

Alarms Spreadsheet Advanced Corrective Actions Are For Certified Support Personnel Only
Advanced Corrective Actions Are For Certified

Support Personnel Only
Certified support personnel must perform advanced corrective actions.

C h a p t e r 8
System logs
This section describes how to use the system’s logging features.
Topics
Using WFO Log Manager to Activate Log Files 145

WFO Log Viewer Configuration 146
Viewing Log Files 147
Customizing the Log Viewer Display 148
Using the Customize Window 149
Log file storage 150
HTTP access logs 159
System logs Using WFO Log Manager to Activate Log Files
Using WFO Log Manager to Activate Log Files

Use the Log Manager to activate specific log files. After you activate a specific log file, you use the Log
Viewer to view the logged information.
Log configurations are created and stored in XML files.
To activate a system log file:

1. Click System Monitoring > Log > WFO Log Manager. The Log Manager window displays.
2. Review fields according to the following:
Item Description
Log Server Shows the server(s) in which the log files are being configured. For
(dropdown menu) example, shows Localhost if you accessed Log Manager from a local
Recorder, or shows a list of selectable managed servers if you accessed
Log Manager from Enterprise Manager.
Name Shows the name of the log file.
Active Toggle between Yes and No, which are options that enable or disable the
generation of logs for the named file.
Descriptions Shows a description of each named file.
3. Highlight the log configuration file that you want to make active, and then click Activate. See the
related topics for information on viewing the log files once they have been activated.
Related topics
Viewing Log Files, page 147

System logs WFO Log Viewer Configuration
WFO Log Viewer Configuration

Use the Log Viewer settings to configure the Log Viewer to display only the logged information in
which you are interested. After you configure the Log Viewer, click the View button to display the
information you have selected.
The application logs all actions that will result in a modification or change to the configuration. An
administrator accessing a configuration is not logged.
To configure the Log Viewer:

1. Click System Monitoring > Log > WFO Log Viewer. The Log Viewer window displays.
2. Select the log server from the list.
3. Select the type of log from the list:
 Default - Logs system data according to current log configuration.
 Error Dump - Logs additional information used to troubleshoot problems.
4. Type the User Name to filter by. Leave the field blank to display data for all users.
5. Type Message Contains to filter by. Leave the field blank to display data for all message contents.
6. Type the Category to filter by. Leave the field blank to display data for all message categories.
The category is usually a specific Java class name that logged the error, or a client log. For
example:
ejb.bpx.am.msgProcessor.MessageQueueConnector
7. Type the Component to filter by. Leave the field blank to display data for all message
components.
The component is the package or area of the application that contains the class that logged the
error. For example:
web.bbm, bpfx, ejb.am
8. Type the Number of Lines to be displayed at one time. From the main page, click Next to display
additional events.
9. Check the Severity of the errors you want displayed. Choices include Fatal, Error, Warning,
Information, and Debug,
10. Select the time period to be displayed. Select None to display events for all time periods covered
by the log, or select a time range.
The next time the user logs in or views this page, the settings that were used last will be
automatically populated.
11. Click View. The filtered report is displayed.

System logs Viewing Log Files
Viewing Log Files

View log files to obtain detailed information on the logs you configured in Log Viewer, typically for
troubleshooting and diagnostic purposes. For example, if you set the Severity level to show only
errors, then you can view only messages with a Severity level of Error. You can also customize the
display of log file information to show all or only selected categories.
 In a multi-tenant enabled environment, the Service Provider Administrator (SPA) can

impersonate a tenant user and access the WFO application on behalf of the tenant user.
When a SPA impersonates a tenant user and performs an action that creates a log entry, the
log indicates that the username who performed the action was SPA username&tenant
username.
To view log files:

1. Click System Monitoring > Log > WFO Log Viewer and complete the Log Viewer window as
described in WFO Log Viewer Configuration, page 146.
2. Click View. The Log Viewer report window displays.
3. Review information in the Log Viewer window according to WFO Log Viewer Configuration,
page 146.
 Click Restart to return to the beginning of the page.
 Click Next to review the next batch of messages on the page, (instead of using the scroll bar to
view the additional messages).
 Click Configure to return to the Log Viewer window, as described in WFO Log Viewer
Configuration, page 146.
 Select Edit in the Customize menu (at the top of the window), and follow procedures described
in Customizing the Log Viewer Display, page 148.

System logs Customizing the Log Viewer Display
Customizing the Log Viewer Display

Customize the display of log messages to choose log file properties to display, or to rearrange the
display of columns in the Log Viewer report. Do this by clicking the customize dropdown menu in the
Log Viewer report window, and then choosing Edit.
To customize the log viewer display:

1. Click System Monitoring > Log > WFO Log Viewer. The Log Viewer window displays.
2. Complete the fields in the Log Viewer window as described in WFO Log Viewer Configuration,
page 146, and then click View. The Log Viewer report displays.
3. In the Log Viewer report window, click Edit in the Customize dropdown menu (at the top right of
the window). The Customize window displays.
4. Use the Customize window to determine which items display in the Log Viewer report window
(Selected Properties), and the sequence in which those items display. For additional help, see
Using the Customize Window, page 149.
5. Click Save to save the default customization, or click Save As to save the configuration as a
different name that will appear as a menu item in the Customize drop down.

System logs Using the Customize Window
Using the Customize Window

Use the Customize window to create a customized view of the information (change how information
is displayed). You create a customized view by doing one or both of the following:
 Adding or removing columns from the display
 Changing the left-to-right order in which columns display
You can create a new customized view, or edit an existing customized view of the displayed
information.
To use the Customize window:

1. From the Customize drop-down list, choose a configuration to edit.
2. Use the right/left arrows to move properties into or out of the customized view, as discussed
below:
 To add a property to the customized view, move the property from the Available Properties
window to the Selected Properties window. All properties listed in the Selected Properties
window will appear in the customized view.
 To remove a property from the customized view, move the property from the Selected
Properties window to the Available Properties window. All properties listed in the Available
Properties window will be excluded from the customized view.
 If you are customizing the view of the Audit Viewer, an asterisk can display to the
right of a property. The asterisk indicates that the property is a name that is
available for selection in the Details: Name option of the Audit Viewer search
configuration screen.
3. Use the up/down arrows (to the right of the Selected Properties pane) to control the left-to-right
order in which properties display in the customized view, as discussed below:
 Move a property to the top of the Selected Properties list to make it appear at the left-most
position in the Active Alarms tab.
 Move a property to the bottom of the Selected Properties list to make it appear at the right-
most position in the Active Alarms tab.
 Click Save to save changes to an existing customized view.
 Click Save As to save the configuration as a new customized view. You are prompted to
provide a name for the new customized view. After you provide a name, the new customized
view name appears as a selectable option in the Customize drop-down list at the top of the
Active Alarms display.

System logs Log file storage
Log file storage

Log files are automatically zipped and stored on a server.
You can configure the amount of disk space allotted for log file storage. Increasing the amount of disk
space allows you to save more logging history on the server.
Zipped log files are automatically deleted when the stored files exceed the disk space allotted for
them.
Related topics
Log file types and storage directories, page 150
Active log files, page 151
Zipped log files, page 151
Log file zipping process, page 152
Automatic deletion of zipped log files, page 152
Configure log file storage for application, EMA, and RM logs, page 153
Configure log file storage for WFO logs, page 156
View stored log files, page 158
Log file types and storage directories

The table below shows the log file types, and the directories where their files are stored. Both the
active log file and the zipped log files are stored in these directories.
Log File Type Storage Directory
EMA log
(application log) %IMPACT360DATADIR%Logs\EMA
EMA* error log
EMA debug log
RM** error log

%IMPACT360DATADIR%Logs\RM
RM debug log
WFO*** log
(wfo.log4j.log)
%IMPACT360DATADIR%Logs\ProductionServer
WFO coherence
log
WFO error log

Log File Type Storage Directory
*EMA is Enterprise Manager Agent, **RM is Recorder Manager, ***WFO is Workforce

Optimization (also called Foundation logs)
Active log files

An active log file is one to which logging data is currently being written. The Log Viewer user interface
displays information from the active log file.
Active log files have these filename formats:
 EMA error and logs: ema.error.log and ema.debug.log
 Applications log: ema.log
 RM error and debug logs: rm.error.log and rm.debug.log
 wfo log and wfo error log (foundation logs): wfo.log4j.log, coherence.log and error.log
Zipped log files

When an active log file reaches its configured size limit (default 20 MB), the log file is automatically
added to the appropriate zip file to conserve disk space.
Zipped log files have these filename formats:
 EMA error and debug zip files - ema.logfiletype.timestamp.zip
 Applications zip files - ema.timestamp.zip
 RM error and debug zip files - rm.logfiletype.timestamp.zip
 WFO log zip files - wfo.log4j.timestamp.zip
 WFO coherence log zip files - coherence.timestamp.zip
 WFO error log zip files - error.timestamp.zip
Where:
 logfiletype is either error or debug.
 timestamp specifies the time the file was created in this format: 2012-05-03-12-44-31 (Year-
Month-Day-Hour-Minute-Second)
For example, active log file names look like this:
 ema.error_2013_05_03_09_47_15.zip
 ema.log.2013_05_03_12_44_31.zip

 rm.debug_2013_05_03_07_26_59.zip
 wfo.log4j-2013_05_03_07_26_59.zip
Log file zipping process

Log files are zipped once the active log file achieves the maximum specified size (default 20 mb).
The steps below illustrate how the system automatically zips log files to conserve storage space.
This example describes only the process for zipping EMA error log files. Note that EMA debug, RM
error, RM debug, log files, and WFO logs are also zipped as described below.
1. Logging data is written to the currently active EMA error log file.
2. When the currently active log file reaches its configured size limit (default 20 MB), a utility creates
an EMA error zip file and adds the active log file to this zip file. The timestamp in the zip file name
indicates when the zip file was created (for example, ema.error_2013_05_03_12_44_31.zip).
3. A new active EMA error log file is created and logging information is now written to this new active
log file.
4. Any other active EMA error log file that reaches its configured size limit on that day is also placed
in the zip file created in step 2 (the zip file time-stamped for that day).
5. On the following day, this same process repeats. The zip file created on this day is timestamped to
indicate the current date and time at which it is created. All EMA error log files that reach their
configured size limit on that day are placed in this zip file.
 Usually, only one zip file is created for each day and all active log files that reach their size
limit on that day are stored in that zip file. However, if you open the current day’s zip file to
view the individual log files it contains, an additional zip file can be created for that day. For
more information, see View stored log files, page 158.
Automatic deletion of zipped log files

By default, each log type is allotted a specific amount of disk space in which to store zipped log files,
as shown in the table below.
Log File Type Storage space allotted by default
EMA log (application log) 100 MB
EMA* error log 100 MB
EMA debug log 100 MB
RM** error log 100 MB
RM debug log 100 MB

Log File Type Storage space allotted by default
WFO*** log (wfo.log4j.log)

500 MB total for all three WFO log types
WFO coherence log
WFO error log
*EMA is Enterprise Manager Agent, **RM is Recorder Manager, ***WFO is Workforce

Optimization (also called Foundation logs)
When the maximum disk space allotted for a particular log type is reached, zip files of that log type
are automatically deleted.
Zip files are deleted one at a time and this deletion continues until the amount of space consumed by
the log files falls below the configured threshold. The oldest zip file is the first deleted.
Related topics
Configure log file storage for application, EMA, and RM logs, page 153
Configure log file storage for WFO Logs, page 155
Configure log file storage for application, EMA, and RM logs

 Perform the procedures in this section only in consultation with Technical Support. Changes
to the log file configuration files can have a significant impact on the performance of your
system.
You can configure two aspects of log file storage for the Application, EMA, and RM log types:
 The size at which an active log file is zipped
 The maximum amount of disk space allotted for log files
These two aspects of log file storage are configured by manually editing parameters in an XML file
(either a core.xml file or a debugFile.xml file). The XML files that you edit to configure log file storage
for each log type are at these locations:
 EMA error log and applications log
-%IMPACT360SOFTWAREDIR%Conf\applications\EMA\logconfig\core.xml
 EMA debug log -%IMPACT360SOFTWAREDIR%Conf\applications\EMA\logconfig\debugFile.xml
 RM error log -%IMPACT360SOFTWAREDIR%Conf\applications\RM\logconfig\core.xml
 RM debug log -%IMPACT360SOFTWAREDIR%Conf\applications\RM\logconfig\debugFile.xml
In each of the four XML files above, you can change the following parameters to change log file
storage behavior. These parameters appear in each XML file as shown below:

 <param name="MaxFileSize" value="20MB" /> - The value= attribute specifies the

size at which an active log file is zipped.
 <param name="MaxDiskSpaceInMb" value="100" /> - The value= attribute specifies
the maximum amount of disk space in megabytes that zipped log files of a particular type can
consume.
 <param name="MaxZipFileSizeInPct" value="80" /> - The value= attribute
specifies when any single zip file reaches 80% of the maximum disk space. At that point a second zip
file is created so even if the automatic deletion process deletes the zip files that are at maximum
size for that day, there is still a zip file left with around 20% content in the zip file.
To illustrate the process of configuring log file storage, the following example explains how to make
changes to the log file storage for both the EMA error log and the applications log:
1. Use a text or XML editor to open the core.xml file at this
location:%IMPACT360SOFTWAREDIR%\Conf\applications\EMA\logconfig
2. The file appears as shown below. Locate the MaxFileSize and MaxDiskSpaceInMb
parameters located within the <appender name=”file” attribute.
3. Locate the following section of code:
<appender name="file" class="com.verint.web.ema.log.EMALogAppender">
<param name="File" value="${DATADIR}/logs/EMA/ema.error.log" />
<param name="MaxFileSize" value="20MB" />
<param name="MaxDiskSpaceInMb" value="500" />
<param name="MaxZipFileSizeInPct" value="20" />
4. Do one or both of the following:
 For <param name=”MaxFileSize” value=”20MB” /> change value= to a different
value to change the size at which the active EMA error log file and the active applications log file
is zipped.
 For <param name=”MaxDiskSpaceInMb” value=”100” /> change value= to a
different value to change the amount of disk space allotted for the EMA error log and the
applications log zip files.
For example, if you change value= to “200”, the EMA error log is allotted 200MB of disk
space and the applications log is allotted a separate 200 MB of space.
5. Save the core.xml file.
 The EMA debug log, RM error log, and RM debug log are configured as described above,
except you must edit a different XML file to configure each log type as noted at the beginning
of this topic.

Configure log file storage for WFO Logs

 Perform the procedures in this section only in consultation with Technical Support. Changes
to the log file configuration files can have a significant impact on the performance of your
system.
You can configure two aspects of log file storage for these WFO logs: wfo.logrj4.log, coherence.log,
and error.log:
 The size at which an active log file is zipped
 The maximum amount of disk space allotted for zipped log files
Related topics
Log Viewer configuration and log configuration files, page 155
Log Viewer configuration and log configuration files

In the Enterprise Manager application Log Manager page, a user can select any of seven different log
configurations (or log levels) for the WFO logs. (To access the Log Manager page, click System
Management > Logs > Log Manager.)
The seven log configurations available on the Log Manager page are:
 core.xml
 debugFile.xml
 IrfTrace.xml
 JdmoTrace.xml
 mddui.xml
 ReportFramework.xml
 rm.xml
Each of these Log Manager page configurations has an associated WFO log configuration XML file in
this location:
%VERINT_WEBLOGIC_DOMAIN_HOME%config\logconfig
The WFO log configuration files in the .\logconfig directory have the same name as the Log Manager
page log configuration with which they are associated. For example, the log configuration XML file for
the core.xml Log Manager page configuration is named core.xml, the log configuration XML file for
the debugFile.xml Log Manager page configuration is named debugFile.xml, and so on.
The settings in each of the WFO log configuration XML files control how WFO log zip files are handled
when the corresponding log configuration is selected on the Log Manager page.
For example:

 If the core.xml configuration is selected in the Log Manager page, the settings in the associated
core.xml log configuration XML file (in the .\logconfig directory) control how WFO log zip files are
stored.
 If the debugFile.xml configuration is selected in the Log Manager page, the settings in the associated
debugFile.xml log configuration XML file (in the .\logconfig directory) control how WFO log zip files
are stored, and so on.
To change how WFO log zip files are handled, you can modify the WFO log configuration XML files.
Related topics
Configure log file storage for WFO logs

This section provides an example of how to change the WFO log configuration in one WFO log
configuration XML file. This procedure is identical for each WFO log configuration file.
In this example, assume a user has selected the IrfTrace.xml configuration in the System
Management > Logs > Log Manager page of the Enterprise Manager application.
To modify the log file storage behavior when the IrfTrace.xml configuration is selected in the
Enterprise Manager Log Manager page, you would do the following:
1. Use a text or XML editor to open the IrfTrace.xml file located in %VERINT_WEBLOGIC_DOMAIN_
HOME%config\logconfig.
2. Locate the following section of code. This section of code controls log storage for the
wfo.log4j.log zip files:
<appender name="file"
class="com.bluepumpkin.common.logging.zip.ZipLogAppender">
<param name="File"
value="${DATADIR}/Logs/ProductionServer/wfo.log4j.log" />
You can change the following three parameters to change log file storage behavior for the
wfo.log4j.log file. Note that the values shown for each parameter are the default values.
<param name="MaxDiskSpaceInMb" value="500" /> - The value= attribute specifies
the maximum amount of disk space in megabytes that all zipped wfo log files together can
consume.
This value is also used in combination with the value for MaxZipFileSizeInPct below to determine
the maximum amount of disk space one zipped wfo log file can consume.
<param name="MaxZipFileSizeInPct" value="20" /> - The value= attributes
indicates a percentage. This percentage multiplied by the value of the MaxDiskSpaceInMb
parameter above determines the maximum amount of disk space one zipped wfo log files can
consume.

For example, the two parameters above are configured, by default, to limit the maximum
amount of disk space consumed. As configured above, one zipped WFO log file is limited to 100
MB (.20 x 500 = 100).
<param name="MaxFileSize" value="20MB" /> - The value= attribute specifies the
size at which an active log file is zipped. The default setting is 20 MB.
Edit these three parameters as needed to change the wfo.log4j.log zip file storage behavior.
3. Locate the following section of code. This section of code controls log storage for the
coherence.log zip files.
<appender name="cohfile"
class="com.bluepumpkin.common.logging.zip.ZipLogAppender">
<param name="File"
value="${DATADIR}/Logs/ProductionServer/coherence.log" />
<param name="QueCapacity" value="20" />
The parameters for the coherence.log zip files work in exactly the same way as the parameters
described in step 2 for the wfo.log4j.log zip files. The example above shows the default values
for these parameters.
Edit the three parameters (MaxDiskSpaceInMb, MaxZipFileSizeInPct,
MaxFileSize) as needed to change the coherence.log zip file storage behavior.
4. Locate the following section of code. This section of code controls log storage for the error.log zip
files.
<appender name="errordump"
class="com.bluepumpkin.common.logging.zip.ZipErrorDumpAppender">
<param name="File"
value="${DATADIR}/Logs/ProductionServer/error.log" />
The parameters for the error.log zip files work in exactly the same way as the parameters
described in step 2 for the wfo.log4j.log zip files. The example above shows the default values
for these parameters.
Edit the three parameters (MaxDiskSpaceInMb, MaxZipFileSizeInPct,
MaxFileSize) as needed to change the error.log zip file storage behavior.
As noted previously, the configuration procedure is the same for each of the seven WFO log
configuration XML files. The only difference is in the specific WFO log configuration XML file that you
alter.
When a particular log configuration is selected in the Log Manager page, the settings in the WFO log
configuration XML file associated with that log configuration control how the WFO log zip files are
handled.

View stored log files

Generally only one log zip file is created each day for each log file type.
However, if you open the zip file for the current day, it is possible for an additional log zip file to be
created for that day.
If you have the current day’s zip file open, and the currently active log file reaches its configured size
limit, the system does not try to add this log file to the log zip file you have open.
Instead, the system creates an additional zip file for that day, and places the log file in that zip file. As
a result, two separate zip files are created for this day, each with a different timestamp in its filename.

System logs HTTP access logs
HTTP access logs

The system creates HTTP access logs for each incoming request. The access logs include details such
as sender IP, date and time.
Compone location Log details

nt
Secure On all servers: LogFormat:

Gateway %a Access %b %c --> %d [%e] -[%f] [%g]"%h" %i %j %k
%IMPACT360DATADIR% where:
\Logs\  %a: time that the request replied back to the client
SecureGateway\
SGW_Access_CF.ltf
 %b: Severity (verbose, informational, non-critical,
critical)
 %c: source ip
 %d: destination ip
 %e: authentication method
 %f: time that the request was received
 %g: Process id and thread id
 %h: request URL
 %i: HTTP response code
 %j: size of response in bytes
 %k: request processing time in milliseconds
Authentication methods include the following types:
 NoAuth
 assMissingToken
 Denied
 UserToken: <user> <tenant id>
 SWT: <key id> (system/tenant id)
 PassphraseToken: <system>
Example:
2018-11-07 23:59:34.107-05:00 Access Informational 0 - ->
127.0.0.1 [Auth:PassMissingToken] -
[07/Nov/2018:23:59:34 -0500] [pid 14984:tid 57368] "POST
/MdalWS/MDALWS.asmx?username=systemaccount&toke
n=SHORTTERM_55v05EupE6 HTTP/1.0" 200 359 80
Weblogic On Application Servers: c-ip x-ClientAddress x-VerintUserName date time cs-

%IMPACT360DATADIR% method cs-uri sc-status bytes time-taken
\Logs\
ProductionServer\weblo
gic\
access.log

C h a p t e r 9
Audit trail
Audit trail provides a record of the actions performed in the applications. It allows contact
centers to track who logged into the system, performed a search, played back contacts,
evaluated or flagged contacts, assigned and completed training materials, and deleted items
from the application. Audit actions are also logged for the Framework Application.
Topics
Using the system Audit Viewer 161

Actions that can be audited for each module 175
Interactions Audit Trails 195
Analytics Audit Trails 207
Audit Trail file viewing 216
Audit trail Using the system Audit Viewer
Using the system Audit Viewer

Administrators use the system’s Audit Viewer feature to view the list of audited actions that have
occurred in the system.
When an administrator uses an application to change the configuration of the managed server(s), an
audit trail is created. These details about audited actions display in the Audit Viewer.
You can configure the search criteria for querying audit trail entries by navigating to System
Monitoring > Audit Viewer > Audit Viewer.
The list of audited actions includes a variety of information about each action, such as the Actor
(username) that performed the action, the module in which the action occurred, the time of the
action, a summary description of the action, and a detailed description of the action.
Generally, privileges to view audit trails are assigned to users that have an administrator role in the
suite. For example, for Enterprise Manager, roles with this privilege include Enterprise Manager, and
Enterprise Manager Agent.
Related topics
Specifying the Audit Viewer search criteria, page 161
Specifying the Audit Viewer search criteria

Before you view the audit trail, you can specify the search criteria for querying and filtering the audit
trail records.
For example, depending on the values you supply for the audit fields, you could configure the system
to show:
 A list of configuration changes a particular user (or actor) has made
 A list of a particular type of change, such as a list of all password changes
 All changes made by any user to the Jan 1 - Jan 7 schedule of a particular employee
If you do not provide values for any of the fields on this screen, when you view the audit trail, every
possible audit trail item is displayed for all users.
When a text string is entered in the Text Search field, the Audit Viewer can display a maximum of
5000 records (or rows).
When the Text Search search field is not used, the Audit Viewer can display a maximum of 10000
records (or rows).

Procedure
1. Go to System Monitoring > Audit Viewer > Audit Viewer.
2. In the Actor (User Name), type the Username for the user who performed the action you are
auditing.
3. In the Module drop-down list box, select the module in which the actions you are auditing took
place.
4. In the Action drop-down list box, select the audit-able action. The actions available depend on the
Module that is selected.
5. In the Object Name field, type the name of the object in the module upon which the action was
performed. For example, if John Smith logs in and changes the password of Sonja Graff, the
Username of employee Sonja Graff is the Object Name and the Username of John Smith is the
Actor (Username).
6. In the Time of Event and Impact Time Frame boxes, click the calendar icons at the right. Then
select the start and end dates for the action.
7. Complete the Details fields (optional).
a. In the Name field, select an audit property key from the drop down list.
This field is an optional field that is available if either the Module or Action fields are
populated. The Name is the name of a property key in a database table. The values that are
available in the Name field depend on the combination of items that are selected in the
Module and Action fields.
This field works in combination with the Value field below to return specific audit entries.
b. In the Value field, select a value associated with the option selected in the Name field.

populated and works in combination with the Name field. The values that are available
depend on the key selected in the Name field.
For example, assume Security is selected as the Module, Sign in is selected as the Action,
and Platform is selected as the Name. In this scenario, the Value field has three options:
All, Web, and Mobile. The All value will return sign in audit entries from both the Web and
Mobile platforms.
Using this field can slow the Audit Viewer performance when returning audit entries.
When this field is used, a maximum of 5000 audit records (or rows) are returned.
8. In the Text Search field, enter a text string to filter the returned audit entries to only those audit
entries that contain the text string.
This field is unavailable if any value other than "All" is specified in the Details: Name field.
 Using this field can slow Audit Viewer performance when returning audit entries.
When this field is used a maximum of 5000 audit records (or rows) are returned.
9. To see an audit trail based on the specified search criteria, click Search.
Related topics
Viewing the audit trail, page 167
Audit Viewer search screen reference

This topic describes the fields on the Audit Viewer search screen.

Field Description
Actor The Username of the person who made the configuration change or
(Username) performed the action that is being audited.
For example, if John Smith logs in and changes the password of Sonja Graff,
the Username of John Smith is the actor and the Username of employee
Sonja Graff is the Object Name.
Notes:
 The Username for a user is specified on the User Management >
Security > Usernames screen.
 In a multi-tenant enabled environment, the Service Provider
Administrator (SPA) can impersonate a tenant user and access
applications on behalf of the tenant user. When a SPA impersonates a
tenant user and performs an action that creates an audit entry, this field
indicates that the username who performed the action was
"SPA username on behalf of tenant username".
Module The name of the audit-able action (for example, Change Password). This
value is set using a drop-down menu. The actions available depend on the
module that is selected.
Action The name of the software module where the action occurred (for
example, Security). This value is set using a drop-down menu. (Module
here does not refer to the top-level modules of the suite, such as App
Admin.)
Object Name The name of the object that was updated. This value depends on the audit
entry action.
For example, for the action Change Password, the object name is the
Username of the user whose password was changed. If John Smith logs in
and changes the password of Sonja Graff, the Username of employee
Sonja Graff is the Object Name and the Username of John Smith is the
Actor (Username).
Note: The Username for a user is specified on the User Management >
Security > Usernames screen.
Time of Event The time when the audited event/action occurred. This value can be set
using a Date and Time range selector.

Field Description
Impact Time This time frame specifies the beginning time from which a changed item is
Frame valid to the ending time for which a changed item is valid. This value is not
used for all audited actions.
Consider the example of an employee profile. An Employee Profile
specifies a Start Date and an End Date for an employee. In the profile, the
Start Date can be populated while the End Date is left blank.
If no End Date is specified for the employee in the employee profile, no End
Date must be specified for the employee in the Impact Time Frame End
Date field.
In general:
 If you are searching for an audited item that has no end date specified,
you must leave the End Date empty in the Impact Time Frame setting.
 If you are searching for an audited item that has no start date specified,
you must leave the Start Date empty in the Impact Time Frame setting.
 If you are specifying a Start Date in the Impact Time Frame, the Start
Date must be earlier than or equal to the start date of the item being
audited.
 If you are specifying an End Date in the Impact Time Frame, the End
Date must be later than or equal to the end date of the item being
audited.

Field Description
Details  In the Name field, select an audit property key from the drop down list.
This field is an optional field that is available if either the Module or
Action fields are populated. The Name is the name of a property key
in a database table. The values that are available in the Name field
depend on the combination of items that are selected in the Module
and Action fields.
This field works in combination with the Value field below to return
specific audit entries.
For example, assume you want to return audit entries that show the
log in and log out activity from the web portal or from mobile
applications.
To return the log in entries for the web portal, you would select
Security as the Module, and Sign in as the Action. Then you would
select Platform in the Name field and Web in the Value field, and click
Search.
To return the log out entries for the web portal, you would specify the
same Audit Viewer search criteria, except you would select Sign out as
the Action.
To return the log in entries for mobile applications, you would select
Security as the Module, and Sign in as the Action. Then you would
select Platform in the Name field and Mobile in the Value field, and
click Search.
To return the log out entries for mobile applications, you would specify
the same Audit Viewer search criteria, except you would select Sign
out as the Action.
Using this field can slow the Audit Viewer performance when returning
audit entries.
 In the Value field, select a value associated with the option selected in
the Name field.
This field is an optional field that is available if either the Module or
Action fields are populated and works in combination with the Name
field. The values that are available depend on the key selected in the
Name field.
For example, assume Security is selected as the Module, Sign in is
selected as the Action, and Platform is selected as the Name. In this
scenario, the Value field has four options: All, Desktop, Web, and
Mobile. The All value will return sign in audit entries from the
Desktop, Web, and Mobile platforms.
Using this field can slow the Audit Viewer performance when returning
audit entries.
When this field is used, a maximum of 5000 audit records (or rows) are
returned.

Field Description
Text Search Enter a text string to filter the returned audit entries to only those audit
entries that contain the text string.
Text Search is an optional field that is available only if both the Module
and Action fields are populated. This field allows you to refine the audit
trail results by searching for particular text strings in the property values
of a database table. The text string entered does not have to be an exact
match. For example, if the property value in the database table has
entries such as "User_Test_username" and "User_Test_LastName" and
"User_Test" is entered in the Text Search field, both entries would be
returned. If "LastName" was entered in the Text Search field, only the
"User_Test_LastName" entry would be returned.
This field is unavailable if any value other than "All" is specified in the
Details: Name field.
 Using this field can slow Audit Viewer performance when

returning audit entries.
When this field is used a maximum of 5000 audit records (or rows) are
returned.
Viewing the audit trail

2. If desired, narrow the audit trail results by Specifying the Audit Viewer search criteria, page 161.
3. Click Search.
The Audit Viewer page opens, displaying the following information:

Field Description
Actor (User Name) The Username of the person who made the
configuration change or performed the action that is
being audited.
For example, if John Smith logs in and changes the
password of Sonja Graff, the Username of John Smith is
the actor and the Username of employee Sonja Graff is
the object.
Notes:
 The Username for a user is specified on the User
Management > Security > Usernames screen.
 In a multi-tenant enabled environment, the Service
Provider Administrator (SPA) can impersonate a
tenant user and access applications on behalf of the
tenant user. When a SPA impersonates a tenant user
and performs an action that creates an audit entry,
this field indicates that the username who performed
the action was "SPA username on behalf of tenant
username".
Action The name of the audit-able action (for example, Change

Password). This value is set using a drop-down menu.
The actions available depend on the module that is
selected.
Module The name of the software module where the action

occurred (for example, Security). This value is set using
a drop-down menu. (Module here does not refer to the
top-level modules of the suite, such as App Admin.)
Object Name The name of the object that was updated. This value
depends on the audit entry action.
For example, for the action Change Password, the
object name is the Username of the user whose
password was changed. If John Smith logs in and
changes the password of Sonja Graff, the Username of
employee Sonja Graff is the object and the Username of
John Smith is the actor.
Note: The Username for a user is specified on the User
Time of Event The time when the audited event/action occurred. This
value can be set using a Date and Time range selector.

Field Description
Impact Time Frame This time frame specifies the beginning time from which
a changed item is valid to the ending time for which a
changed item is valid. This value is not used for all
audited actions.
Consider the example of an employee profile. An
Employee Profile specifies a Start Date and an End Date
for an employee. In the profile, the Start Date can be
populated while the End Date is left blank.
If no End Date is specified for the employee in the
employee profile, no End Date must be specified for the
employee in the Impact Time Frame End Date field.
In general:
 If you are searching for an audited item that has no
end date specified, you must leave the End Date
empty in the Impact Time Frame setting.
start date specified, you must leave the Start Date
 If you are specifying a Start Date in the Impact Time
Frame, the Start Date must be earlier than or equal to
the start date of the item being audited.
 If you are specifying an End Date in the Impact Time
Frame, the End Date must be later than or equal to
the end date of the item being audited.
Short Detail Displays a short text description of the adit record. If a

record does not contain any details, the related field in
the Short Detail column is blank.
4. You can perform the following actions:

 To view the details for a row in the list, either double-click the row or select the row and click
View Details.
 You can select the columns to be displayed on this page. Use the drop-down Customize menu
to choose any previously saved configurations. You can also create a configuration by choosing
the Edit option from the drop-down menu.
 You can control the number of audit entries that display on a page of the user interface. To do
this, use the page controls that appear in the lower left corner of the Audit Viewer screen. By
default, 20 audit entries appear on a single page of the Audit Viewer screen. You can change
the number of entries that appear on a single page by selecting the icon and specifying a
value between 1 and 500.
 You can control the number of audit entries that display on a page of the user interface. To do
this, use the page controls that appear in the lower left corner of the Audit Viewer screen. By

default, 20 audit entries appear on a single page of the Audit Viewer screen. You can change
the number of entries that appear on a single page by selecting the icon and specifying a
value between 1 and 500.
 You can return to the Audit Viewer search page by clicking Back to Search.
5. To rerun the last search query, click Rerun Search.
Audit Viewer search results screen reference

This topic describes the fields on the Audit Viewer search results screen.

Field Description
Actor (User Name) The Username of the person who made the configuration
change or performed the action that is being audited.
For example, if John Smith logs in and changes the
password of Sonja Graff, the Username of John Smith is
the actor and the Username of employee Sonja Graff is the
Object Name.
Notes:
 The Username for a user is specified on the User
 In a multi-tenant enabled environment, the Service
Provider Administrator (SPA) can impersonate a tenant
user and access applications on behalf of the tenant
user. When a SPA impersonates a tenant user and
performs an action that creates an audit entry, this field
indicates that the username who performed the action
was "SPA username on behalf of tenant username".
Action The name of the audit-able action (for example, Change

Password). This value is set using a drop-down menu. The
actions available depend on the module that is selected.
Module The name of the software module where the action

occurred (for example, Security). This value is set using a
drop-down menu. (Module here does not refer to the top-
level modules of the suite, such as App Admin.)
Object Name The name of the object that was updated. This value
depends on the audit entry action.
For example, for the action Change Password, the object
name is the Username of the user whose password was
changed. If John Smith logs in and changes the password
of Sonja Graff, the Username of employee Sonja Graff is
the object and the Username of John Smith is the actor.
Note: The Username for a user is specified on the User
Time of Event The time when the audited event/action occurred. This
value can be set using a Date and Time range selector.

Field Description
Impact Time Frame This time frame specifies the duration for which a changed
item is valid. This value is not used for all audited actions.
Consider the example of an employee profile. An
Employee Profile specifies a Start Date and an End Date for
an employee. In the profile, the Start Date can be
populated while the End Date is left blank.
If no End Date is specified for the employee in the
employee profile, no End Date must be specified for the
employee in the Impact Time Frame End Date field.
In general:
 If you are searching for an audited item that has no end
date specified, you must leave the End Date empty in
the Impact Time Frame setting.
start date specified, you must leave the Start Date
 If you are specifying a Start Date in the Impact Time
Frame, the Start Date must be earlier than or equal to
the start date of the item being audited.
 If you are specifying an End Date in the Impact Time
Frame, the End Date must be later than or equal to the
end date of the item being audited.
Short Detail Displays a short text description of the audit record. If a

record does not contain any details, the related field in the
Short Detail column is blank.
Related topics
Export the audit trail

You can export the audit trail to a comma-separated values (CSV) file.
Before you export the audit trail, you must specify the search criteria for querying and filtering the
audit trail records in the Audit Viewer user interface.
The exported file will contain only the audit trail data that was specified in the user interface, with the
exception of the Text Search field.
 You cannot export the data specified in the Text Search field to the CSV file. You also have
the option to include or exclude the Details Name and Details Value data in the CSV file.

Procedure
2. In the Actor (User Name), type the Username for the user who performed the action you are
auditing.
3. In the Module drop-down list box, select the module in which the actions you are auditing took
place.
4. In the Action drop-down list box, select the audit-able action. The actions available depend on the
Module that is selected.
5. In the Object Name field, type the name of the object in the module upon which the action was
performed.
6. In the Time of Event and Impact Time Frame boxes, click the calendar icons at the right. Then
select the start and end dates for the action.
7. Complete the Details fields (optional).
a. In the Name field, select an audit property key from the drop down list.
populated. The Name is the name of a property key in a database table. The values that are
available in the Name field depend on the combination of items that are selected in the
Module and Action fields.
This field works in combination with the Value field below to return specific audit entries.
For example, assume you want to return audit entries that show the log in and log out
activity from the web portal or from mobile applications.
To return the log in entries for the web portal, you would select Security as the Module, and
Sign in as the Action. Then you would select Platform in the Name field and Web in the
Value field, and click Search.
To return the log out entries for the web portal, you would specify the same Audit Viewer
search criteria, except you would select Sign out as the Action.
To return the log in entries for mobile applications, you would select Security as the
Module, and Sign in as the Action. Then you would select Platform in the Name field and
Mobile in the Value field, and click Search.
To return the log out entries for mobile applications, you would specify the same Audit
Viewer search criteria, except you would select Sign out as the Action.
Using this field can slow the Audit Viewer performance when returning audit entries.
b. In the Value field, select a value associated with the option selected in the Name field.
populated and works in combination with the Name field. The values that are available
depend on the key selected in the Name field.
For example, assume Security is selected as the Module, Sign in is selected as the Action,
and Platform is selected as the Name. In this scenario, the Value field has four options: All,
Web, Mobile, and Desktop. The All value will return sign in audit entries from the Web,
Mobile, and Desktop platforms.
When this field is used, a maximum of 5000 audit records (or rows) are returned.

8. To export the audit trail that you have configured above, click Export. The audit trail is exported to
a CSV file.
Related topics

Audit trail Actions that can be audited for each module
Actions that can be audited for each module

Use the Audit Viewer side-bar element to configure search criteria for querying audit trail entries.
The search criteria are used to filter the audit trail entries.
 More modules can display than actually exist in your system. If a module displays for which
you have no license, ignore that module.
The following table lists the audit modules and the actions that can be audited for each module:
Module Action
API Keys Generate API Key
AQM Corpus Services Create Corpus.

Query Corpus
Query Corpus Data
Adapter Performance Calc Engine Finish

RTAA Chunk Finish
RTAA Thread Finish
Source Measure Extract Adapter Finish
Analytics Rules Create Analytics Rule

Create Identification Rule
Create/Update Analytics Rule Action
Create/Update Analytics Rule Conditions
Create/Update Analytics Rule Engine
Delete Analytics Rule
Delete Analytics Rule Action
Delete Identification Rule
Update Analytics Rule
Update Call Selection Associations
Update Identification Rule
Application Startup Message Reset

Update

Module Action
Archiving Copy Archive Media

Create Archive Media
Create Campaign
Create Schedule
Delete Archive Media
Delete Campaign
Delete Schedule
Import Views/Migrate Campaigns
Save Campaign Conditions
Save Campaign as
Update Archive Media
Update Campaign
Update Schedule
Assignment Manager Copy to Entities

Copy to Groups
Copy to Roles
Missing Privilege
Refresh Assignments
Set Entities Values for Group
Set Entities Values for Role
Set Values for Entity
User logged in to the system
Attributes Create
Delete
Update
Update Custom Data Mapping
Update UDF Mapping
Audit Trail Export Audit Trail

Query Audit Trail
Backlog Age Assigned

Create
Delete
Unassigned
Update

Module Action
Biometrics Create Field

Create Metadata
 As of V15.2 2020R1, Create Person (employee, customer, target)
Biometrics actions are Create Watch List
audited by the Recorder
Delete Field
DataCenter APIs.
Delete Metadata
Delete Person (employee, customer, target)
Delete Segment
Delete Watch List
Update Audio Segment (add, approve or
unapprove)
Update Field
Update Metadata
Update Person (employee, customer, or target
changed, including opting in/out)
Update Watch list
Bulk Export Export

Export Failed
Export Finished
Export Privilege Failure
Business Rule Create

Delete
Update

Module Action
Call Lock Add Call to Case

Add Eware
Assign Query Template
Assign Query Templates
Create Case
Deassign Query Templates
Designate Drive
Remove Call from Case
Remove Case
Remove Eware
Replay Call
Search Eware
Update Case
Update Eware
Verify Call in Case
Custom Data Missing Privilege

Update Custom Data
Dashboard Change Owner

Create
Delete
Duplicate
Redistribute
Rename
Revert
Share
Update
Update Share
Data Access Service Delete relevancy rules

Get data masking sequences
Get relevancy rules
Publish relevancy rules
Upsert relevancy rules

Module Action
Data Source Assign Members to Group

Associate Recorders to Group
Create
Create Data Source Group
Create Employee Mapping
Create Group
Create Phone
Create Phone Range
Create Recording Profile
Create Subnet
Create Workstation
Delete
Delete Data Source Group
Delete Employee Mapping
Delete Group
Delete Phone
Delete Recording Profile
Delete Subnet
Delete Workstation
Import
Schedule Import
Unassign Members from Group
Update
Update Data Source Group
Update Employee Mapping
Update Group
Update Phone
Update Recording Profile
Update Subnet
Update Workstation
Delete Interactions Delete

DeleteFailure
DeletePrivilegeFailure
Finalize

Module Action
Employee Create
Delete
Terminate
Update
Employee Group Create

Delete
Update

Module Action
Extraction Engine Configure Notification Profile

Configure SMTP Server
Configure SNMP Node
Create Case
Create Job
Create Notification Profile
Create SNMP Node
Create User Role
Delete Adapter
Delete Data Source
Delete Job
Delete Notification Profile
Delete SNMP Node
Delete Selection Plan
Delete User Role
Load Custom Data
Manage Reprocessing
Process Permanent Retry Failure
Save Adapter
Save Adapter Metadata
Save Custom Data
Save Data Source
Save General Settings
Save Integration Settings
Save Other Settings
Save Selection Plan
Start Service
Stop Service
Update Alarm Config
Update Alarm Settings
Update Job
Update User Role
Feature Settings Create

Delete
Update

Module Action
Feedback Goals Overwritten

Revert to Parent Orgs
Save
Save and Apply to Sub Orgs
Form Designer Added Value to Custom Data/Status Field

Added Value to Rating Field
Created new form
Deleted a form
Edited a form
Form Custom Data/Status disabled
Form Custom Data/Status enabled
Hide a form
Published a form template
Rating Set created
Rating Set deleted
Reason deleted
Removed Value from Custom Data/Status Field
Removed Value from Rating Field
Shared Component created
Shared Component modified
Staged a form
User created a reason

Module Action
Form Fillout Calculated the score of an

evaluation/assessment
Deleted a saved evaluation/assessment
Deleted an evaluation/assessment
Downloaded an evaluation/assessment
Edited an evaluation/assessment
Loaded a Blank Form
Loaded a saved evaluation/assessment
Loaded an evaluation/assessment
Performed an evaluation of an interaction
monitored in real time
Performed an evaluation/assessment of a
recorded interaction/contact
Performed an evaluation/assessment of an
external interaction/contact
Printed an evaluation/assessment
Saved an evaluation/assessment
Submitted an evaluation/assessment resulting in
score calculation
User updated auto score
Host Register Host

Module Action
Installation Node Acknowledge Alarms

Add Serial Number
Block or Unblock Server
Cluster Site
Collect Server Logs
Copy Replay Restriction
Copy Server
Create
Create Replay Restriction
DR Completed Failed Switch Over
DR Database Settings saved
DR Setup Primary Data Center
DR Switch Over
DR Teardown Primary Data Center
Delete
Delete IS-Recorder Association
Delete Replay Restriction
Export Data Center Configuration
Generate new serial number
Import Data Center Configuration
Import Replay Restriction
Move Node
Move Server
Reset Alarm and Profile Settings
Restore Enterprise Settings
Revert Alarm Profile Setting to Parent
Revert Alarm Setting to Parent
Save Enterprise/Security Settings
Save Recorder Mode
Save Role Association
Set Standby Server
Synchronize Extensions
Synchronize Replay Restriction
Topology Report Schedule Update
Uncluster Site
Update
Update Alarm Profile Setting

Module Action
Update Alarm Setting

Update Global Alarm Setting
Update IS-Recorder Association
Update Pair Association
Update Replay Restriction
Interactions Accessed the interaction workspace

Added a remark to an interaction
Completed an interaction using the Shared Inbox
Deleted an interaction
Flagged a contact
Flagged an evaluation
Focused on an interaction
Grid export
Initiated Feedback
Monitored an Employee
Monitored an Extension
Opened the Monitor Employees Dashboard
Performed a search
Rejected an interaction using the Shared Inbox
Removed an evaluation/assessment from a
folder
Removed an interaction from folder
Removed contact flagging
Removed evaluation flagging
Responded to Feedback
Set the retention for a flagged folder
Updated the Inbox's rules
Viewed an evaluation/assessment
kmsAPI Check API Available

Get Current Key
Get Key By ID
Language Model Management Activate Language Model

Delete Language Model
Save Language Model

Module Action
Legal Hold Cases Add Interactions (includes copying and moving

interactions to cases)
Create Case
Delete Case
Lock Case
Missing Privilege
Remove Interactions
Unlock Case
Update Case
 Missing Privilege can occur for

unsuccessful actions taken through
customer-generated API calls. The
action failed because the actor (user
account) lacked sufficient privileges for
the action. See the event details to learn
which account and specific action was
attempted.
License Update License

Upload License File
Organization Create
Delete
Update
Playback Service Download media

Open media
Play media
Send media
Project Rules Manager Assigned Rule to Tenant

Created Rule (includes cloning a rule, which
results in rule creation)
Deleted Rule
Exported Rule
Imported Rule
Updated Rule

Module Action
Public Safety Insight Center Export

Insight Center Export Incident
Insight Center Login
Insight Center Logout
Insight Center Playback
Insight Center Save Annotation
Insight Center Save Configuration
Insight Center Save Incident
Insight Center Save Preferences
Insight Center Save Remark
Instant Recall Live Monitoring
Instant Recall Login
Instant Recall Logout
Instant Recall Playback
Instant Recall Save Settings
Publishing Publish
Unpublish

Module Action
Recorder DataCenter APIs Add Metadata to Watchlist

Add Person to Watchlist
 As of V15.2 2020R1, the Added Utterance to Biometrics Session
Recorder DataCenter APIs Associate Field to Person Type
audit actions that were
Claim Manual Enrollment
previously audited through
the Biometrics application. Created Biometrics Session
Created Field
Created Media
Created Metadata
Created Metadata Watchlist
Created People Watchlist
Created Person
Created Print
Created UI Filter
Deleted Biometrics Session
Deleted Field
Deleted Media
Deleted Metadata
Deleted Metadata Watchlist
Deleted People Watchlist
Deleted Person
Deleted Print
Deleted UI Filter
Initiate Manual Enrollment
Locked Person
Posted File
Remove Field from Person Type
Remove Metadata from Watchlist
Remove Person from Watchlist
Replace Print
Started Ingestion
Unlocked Person
Updated Field
Updated Media
Updated Metadata
Updated Metadata Watchlist
Updated People Watchlist

Module Action
Updated Person
Updated Print
Updated UI Filter
Uploaded File
Reliable Messaging Delete Message

Delete Message Job
Remote Component Alarm Notification Configuration Update

Alarms Configuration Update
Alarms View Configuration Update
Analyzer Configuration Update
Archive Configuration Update
Audit Entry Tampered
Checksum Updated
Component Logs Update
Compression Type Configuration Update
Consolidation Configuration Update
Disk Management Configuration Update
Email Configuration Update
Extension Configuration Update
File Tampered
IF Adapter Configuration Update
Live Monitor Configuration Update
Manage Component Service
Media Verification
Network Setting Configuration Update
Recorder Configuration Import
Recorder Configuration Update
Recorder Licensing Update
Recorder Threshold Update
SNMP Configuration Update
Server Roles Update
Updated Recorder Maintenance Mode
User Update
Voice Card Configuration Update

Module Action
Replay Approval Approved

MissingAprovalPrivilege
Rejected
Request
Report Framework Create Adhoc Report

Create Report Request
Delete Adhoc Report
Delete Report Instance
Delete Report Request
Deploy Custom Report
Edit Adhoc Report
Run Report Interactively
Run Report Now
Run Report Trimmer
Set Access Rights
Undeploy Custom Report
View Adhoc Report
View Report Instance
Risk Management Export Interactions

Publish
Replay
Search
Unpublish
 A search status of Failure with a result

count of -1 indicates that the search
failed to return results. To diagnose the
cause of the failure, contact technical
support.
Scheduling Create
Delete
Scheduler Completed
Scheduler Started
Update

Module Action
Security Change DB Authentication

Change Password
Sign in
Sign out
Terminate Session
Security - Role Create

Delete
Update
Security: Access Rights Security Assignment
Security: Role - Privilege Security Assignment
Security: Role - Scoped Privilege Security Assignment
Security: Role - Secure Fields Security Assignment
Security: User Change User Status

Create
Delete
Update
Shared Objects Delete Shared Object

Missing Privilege
Refresh Shared Objects

Module Action
Speech Analytics Portal Clear Filter

Contacts: Open Selected Interaction in Player
Contacts: View Interaction Details
Contacts: View User's Search Results
Create Compare Result Sets Report
Delete Real-Time Category
Export Category Definitions
Export Category Report
Export Charts Report
Export Interactions Report
Import Category Definitions
Save Category
Save Real-Time Category
Search Term
Set Filter
Set Filter in Category Designer
Term Trend: Get Noisy Terms
Term Trend: Hide Noisy Terms
Term Trend: Unhide Noisy Terms
Tune Transcript: Approve Suggestion
Tune Transcript: Export Approved Suggestions
Tune Transcript: Reject Suggestion
Tune Transcript: Review Suggestion
Tune Transcript: Set View for Tune Transcript
Tune Transcript: Submit Suggestion
View Speech Transcription
Survey Builder: Business Objective Create

Delete
Update
Survey Builder: Question Create

Delete
Update

Module Action
Survey Builder: Survey Create

Delete
Export to QM
Update
Survey Management: Assignment Overwritten

Revert to Parent Orgs
Save
Save and Apply to Sub Orgs
Survey Management: Transaction Create

Default Transaction Overwritten
Delete
Revert Default to Parent Org
Set Default Transaction
Update
System Management: Call Transfer Create

Delete
Update
System Management: Common Update

Sound Files
System Management: ETL Data Create

Source Delete
Update
System Management: Survey Create

Language Delete
Update
System Settings: Customer Feedback Update
Tenant Segmentation Create

Update

Module Action
Text Analytics Portal Delete Save Search

Deleting Category
Deleting Report
Download Report
Editing Category
Editing Channel Configuration
Editing Properties Category
Export Category Data
Export Interaction Data
Get Interaction Preview
Publish Metadata
Reprocess Category
Reprocess Report
Save As Category
Save As Search
Time Record Create

Delete
Update

Audit trail Interactions Audit Trails
Interactions Audit Trails

The System Audit Trail records actions for the Interactions application, and additional applications
such as the Form Designer and the Assignment Manager. In addition, Audit Trails for the Interactions
application, and additional applications, are also available in log files on the application servers.
You can view the Audit Trail log files in a text editor such as Notepad or WordPad, or in Microsoft
Excel.
Interactions Audit Trail Log File Format

The Audit Trail log file is generated once a day in the Data\Logs\Audit Trail folder on the application
server.
The time at which the system generates an Audit Trail file is determined according to the time at
which you last restarted the application server. For example, if you restart the Interactions
Application Server at 16:45, the Interactions Application Audit Trail file includes all actions performed
from 16:45 on the previous day to 16:44 on the day on which the Audit Trail is generated.
By default, a history of the last 10 audit trail files is available at any time (configurable). When the
system generates a new file each day (the eleventh file in the folder), it deletes the oldest of the
existing files.
 Audit Trail file name format and extension:
Audit Trail_mm.dd.yy_hh.mm.ss.mmm.ltf
 Audit Trail file information format:
<time>;<user name and ID>;<action>;<application generating the audit trail>;<additional
identifying values>
Related topics
Interactions Audit Trail information, page 195
Form Fillout Audit Trail information, page 199
Form Designer Audit Trail information, page 202
Project Rules Manager Audit Trail information, page 204
Assignment Manager Audit Trail information, page 204
DAS API Audit Trail information, page 205
Audit Trail file viewing, page 216
Interactions Audit Trail information

Logged Action Description Additional Logged
Information
Logged in User logged on to the None

system.


Information
Performed a search User performed a search. Type—interactions,

evaluations/assessments
Focused on an interaction User focused on an  Employee name

interaction from the search  Interaction ID
results.  Local Start Time
 Local End Time
Played back interaction User played back an  Employee name

interaction's audio from a  Contact ID
folder or search results list.  Local Start Time
This action is logged in both  Local End Time
the Interactions and
Analytics Audit Trails and the
system Audit Viewer.
Accessed the interaction User selected an interaction  Employee name

workspace from a search or folder  Contact ID
results set and opened it in
the Interaction Review
workspace page.
Flagged a contact User flagged a contact for  Flag ID

follow—up or further  Contact ID
attention.
Flagged an evaluation User assigned a flag to an  Flag ID

evaluation.  Evaluation ID
Removed contact flagging User removed a flag  Flag ID

attached to a contact.  Contact ID
Removed evaluation flagging User removed a flag  Flag ID

attached to an evaluation.  Evaluation ID
Removed an interaction User removed an interaction  Employee name

from folder from the folder in which it  Interaction ID
resides.  Folder ID
Deleted an interaction User deleted an interaction  Employee Name

from the Interactions  Interaction ID
application.


Information
Added a remark to an User added a remark to an  Employee Name

interaction interaction.  Remark
 Interaction ID
Viewed an User selected a evaluation  Form name

evaluation/assessment or assessment from the  Evaluation/Assessment ID
search or folder results set  Employee name
and opened it in the  Interactions ID
Interaction workspace.
Initiated Feedback User initiated a feedback  Feedback Sender’s Name

session on an evaluation  Comment
that is flagged with the  Feedback Receiver’s
Forward to Employee flag. Name
 Evaluation ID
Responded to Feedback User responded to feedback  Feedback Sender’s Name

received on an evaluation  Comment
that is flagged with the  Feedback Receiver’s
Forward To Employee flag. Name
 Evaluation ID
Removed an User removed an evaluation  Employee Name

evaluation/assessment from or assessment from a folder.  Contact ID
a folder  Evaluation/Assessment ID
 Folder ID
Downloaded an interaction User downloaded an  Contact ID

interaction.  Interaction ID
 Employee name
 Audio—Media
component selected for
download
 Screen—Media
component selected for
download


Information
Sent an interaction User sent the interaction in  Contact ID—ID of the sent
an email. contact
 Interaction ID—ID of the
sent interaction
 Employee Name
 Audio—Media
components sent
(Yes/No)
 Screen—Media
components sent
(Yes/No)
 Email Address—
Destination email address
Opened the Monitor User accessed the Monitor None

Employees Dashboard Employees Dashboard
Monitored an extension User monitored an Extension

extension in real—time.
Monitored an Employee User monitored an  Employee ID

employee in real—time.  PBX ID
Updated the Inbox’s Rules User either added, updated Employee ID

or deleted an Inbox rule(s).
Completed an interaction User either clicked ‘Next’ or  Employee Name

using the Shared Inbox. ‘Complete’ in the Shared  Interaction ID
Inbox.
Rejected an Interaction User clicked ‘Reject’ in the  Employee Name

using the Shared Inbox Shared Inbox.  Interaction ID
Set the retention for a In the Flag Manager, user set  Flag ID
flagged folder the 'Retention in Flagged  Retention value
Folder' value for a flagged
folder.

Form Fillout Audit Trail information

Information
Loaded a saved A previously saved form was  Application Name

evaluation/assessment loaded.  Form Name
 Employee Name (for
evaluations only)
 Contact ID
 Evaluation/Assessment ID
Loaded an A form was loaded.  Application Name

evaluation/assessment  Form Name
evaluations only)
 Contact ID
Loaded a blank form A blank form was loaded Application Name
Performed an User evaluated or assessed  Application Name

evaluation/assessment of a an interaction/contact  Form Name
recorded interaction/contact recorded by the platform.  Contact ID
 Local Start Time
 Local End Time
evaluations only)
Performed an User evaluated or assessed  Application Name

evaluation/assessment of an an interaction/contact not  Form Name
external interaction/contact recorded by the platform.  Contact ID
 Local End Time
evaluations only)


Information
Performed an evaluation of User evaluated an  Application Name

an interaction monitored in interaction monitored in  Form Name
real—time real—time.  Employee Name
 Contact ID
 Evaluation ID
 Local End Time
evaluations only)
Edited an User edited an existing  Application Name

evaluation/assessment evaluation or assessment.  Form Name
 Contact ID
evaluations only)
Deleted an User deleted an evaluation  Form Name

evaluation/assessment or assessment from the  Contact ID
platform.  Evaluation/Assessment ID
 Score ID
 Base template ID
 Evaluator/Assessor Name
evaluations only)
Deleted a saved User deleted a saved  Form Name

evaluation/assessment evaluation or assessment  Contact ID
from the platform.  Evaluation/Assessment ID
 Saved
Evaluation/Assessment ID
evaluations only)


Information
Saved an User saved an evaluation or  Form Name

evaluation/assessment assessment.  Contact ID
 Saved
Evaluation/Assessment ID
evaluations only)
Downloaded an User downloaded an  Application Name

evaluation/assessment evaluation or assessment.  Base template ID
Printed an User printed an evaluation  Application Name

evaluation/assessment or assessment.  Base template ID
Submitted an User submitted an  Evaluation/Assessment ID

evaluation/assessment evaluation or assessment  Employee Id
resulting in score calculation which resulted in a score  Old score
calculation.  New score
Calculated the score of an User calculated the score of  Evaluation/Assessment ID

evaluation/assessment an evaluation or  Employee Id
assessment.  Old score
 New score
User updated auto score User updated the automatic  Employee Id

answer assigned by the  Application name
system to an automated  Form name
question.  Contact Id
 Form Id
 Question Id
 Original Answer Id
 Overwritten Answer Id

Form Designer Audit Trail information

Action Description Logged Information
Created new form User created a new form  Form Name

either an evaluation or an  Status—options are
assessment. Under Construction,
Staged, Published,
Hidden
Staged a form User prepared a draft  Form Name

version of a form.  Status—options are
Under Construction,
Staged, Published,
Hidden, Version
Published a form template User published a form.  Form Name

 Status—options are
Under Construction,
Staged, Published,
Hidden, Version
Hide a form User hid a form from view.  Form Name

Under Construction,
Staged, Published,
Hidden, Version
Edited a form User edited an existing form.  Form Name

Under Construction,
Staged, Published,
Hidden, Original Revision,
New Revision
Deleted a form User deleted a form.  Form Name

 Version
Form Custom Data/Status User disabled the Form Custom Data/Status Field
disabled Custom Data or Status Name
options.
Form Custom Data/Status User enabled the Form  Custom Data/Status Field
enabled Custom Data or Status Name
option  Reason created

User created a reason. Reason Name Status—options are Under

Construction, Staged,
Published, Hidden
Rating Set created User created a Rating Set.  Rating Set name
 Status
Reason deleted User deleted a reason.  Reason Name
Rating Set deleted User deleted a Rating Set.  Rating Set Name
Shared Component created User created a shared  Component Name

component.  Component Type
Under Construction,
Staged, Published,
Hidden
Shared Component User changed a shared  Component Name

modified component.  Component Type
 Status
 Modification
Added Value to Custom User added a new value to  Value Name

Data/Status Field Custom Data or Status in  Status—options are
Shared Data. Under Construction,
Hidden, Published.
Added Value to Rating Field User added a new value to  Value Name
the Rating Set in Shared  From
Data.  To
Removed Value from User deleted a value from Value Name

Custom Data/Status Field Custom Data or Status in
Shared Data.
Removed Value from Rating User deleted a value from Value Name
Field the Rating Set in Shared
Data.

Project Rules Manager Audit Trail information

User logged in to the system None
Created Rule A rule was created  Name—Rule Name

 ID—Rule ID
Updated Rule A rule was updated  Name—Rule Name

 ID—Rule ID
Deleted Rule A rule was deleted  Name—Rule Name

 ID—Rule ID
Assignment Manager Audit Trail information

Set Entities Values For Group Set entity values for group. Group ID
Set Entities Values For Role Set entity values for role. Role ID
Set Values For Entity Set values for entity. Entity ID
Initialize Culture User X logged in. User Name
Copy To Groups Copy to groups, from source  Source ID

X to destination Y.  Target IDs
Copy To Roles Copy to roles, from source X  Source ID

to destination Y.  Target IDs
Copy To Entities Copy to entities, from source  Source ID

X to destination Y.  Target IDs

DAS API Audit Trail information

Get Media File by Session ID User retrieved an interaction  Request Source Address
file according to the  Site ID
interaction’s Session ID.  Session ID
 Media Type - type of the
file such as Audio, Screen
or VAD
 Decrypt-True for
decrypted, False for
encrypted
 Format-empty for regular
format, Portable for
standard format
Get Media File by Recording User retrieved an interaction  Request Source Address
Details file according to the  Module
interaction’s recording  Channel
details.  Start Time
or VAD
encrypted
standard format
Download File User downloaded an  Request Source Address

interaction file.  Site ID
 Session ID
or VAD
encrypted
standard format

Forward File User sent the interaction in  Request Source Address

an email.  Site ID
 Session ID
or VAD
encrypted
standard format
 Email Address—
Destination email
address
Get File Path User retrieved an  Request Source Address

interaction’s file path.  Module
 Channel
 Start Time
 Screen Module
or VAD
encrypted
standard format

Audit trail Analytics Audit Trails
Analytics Audit Trails

The System Audit Trail records actions for the Speech and Text Analytics applications. In addition, for
Speech Analytics, Audit Trails are available for several actions including search. You can view the
Audit Trail files in a text editor such as Notepad or WordPad, or in Microsoft Excel.
Related topics
Speech Analytics System Audit Trail, page 211
Text Analytics System Audit Trail, page 214
Speech Analytics Portal Audit Trail information

Played back interaction User played back an  Employee Name

interaction's audio.  Contact ID
This action is logged in both  Local End Time
system Audit Trail.
View Transcription User viewed the N/A

transcription of an
interaction.
This action is logged in both

system Audit Trail.

Speech Analytics Search Activity Audit Trail information

Query String User searched for  Time

interactions that include  User Details
specific terms or phrases  Session ID
stated in the conversation.  Instance ID
 Operation
 Application
 Action
 Term Query String
 Breadcrumbs
 Number of results
Category Query String User searched for  Time

categories that include  User Details
specific terms or phrases.  Session ID
 Instance ID
 Operation
 Application
 Action
 Breadcrumbs
Set Filters User set filters to data set  Time

according to specific  User Details
parameters.  Session ID
 Instance ID
 Operation
 Application
 Action
 Breadcrumbs

Clear Filters User cleared previously set  Time

filters.  User Details
 Session ID
 Instance ID
 Operation
 Application
 Action
 Breadcrumbs
Related topics
Speech Analytics Search Activity logged information, page 209
Examples of user search Audit Trail logs, page 210
Speech Analytics Search Activity logged information

Each Search Activity log includes a set of logged fields.
Field Name Description
Time Time at which the Search activity took place (mm/dd/yy).
User Details User name and ID
Session ID Session ID
Instance ID ID of Speech Analytics instance on which the search was

performed.
Operation User Search Activity
Application Speech Analytics
Action Four options:

 Query String
 Category Query String
 Set Filters
 Clear Filters

Field Name Description
Term Query String The string used in the relevant action:

 If the query is a Category search: field displays the terms
query string used in the category.
 If the query is a Filter setting: field displays a summary of
the filters applied during the search.
Breadcrumbs History of all search activities performed. This field will show
the breadcrumbs that appear in the Speech Analytics portal.
The character length of the Breadcrumbs field is
unlimited.
Number of results Number of results in the last action.
Related topics
Speech Analytics Search Activity Audit Trail information, page 208
Examples of user search Audit Trail logs

The examples show the different types of trail logs that can be generated. Each one shows the
specific type of action, the Term Query String that was searched and the associated breadcrumbs.
Search Query String

06/22/10 10:36:18.406 (+02) ; Ctgapp(40000000) ; o0vuheqdtrqe4u55irq1bd55 ; 1 ;User Search Activity
; Speech Analytics ; Search Query String ; happy birthday ; happy birthday; 35
Where: Happy Birthday was the query that the user searched for.
Category Query String

06/22/10 09:09:14.343 (+02) ; Ctgapp(40000000) ; o0vuheqdtrqe4u55irq1bd55 ; 1 ;User Search Activity
; Speech Analytics ; Category Query String ; before after ; charge charged charges charging > C; 36
Where: the user searched the category C that was defined with the terms: before and after. The
breadcrumbs show a previous search of the terms: charge, charged, charges, charging.
Set Filters
06/22/10 09:16:48.484 (+02) ; Ctgapp(40000000) ; o0vuheqdtrqe4u55irq1bd55 ; 1 ; User Search
Activity ; Speech Analytics ; Set Filters ; TimeZone = <None> , LocalStartTime <= 04/01/10 01:59:59.000
, LocalStartTime >= 03/01/10 02:00:00.000 ; All Interactions > Filters set; 12
Where: the user set a filter on the start time between the 03/01/10 and 04/01/10. The breadcrumbs
show a search of All Interactions, and then the filter was set.
Clear Filters
06/22/10 09:12:38.625 (+02) ; Ctgapp(40000000) ; o0vuheqdtrqe4u55irq1bd55 ; 1 ; User Search
Activity ; Speech Analytics ; Clear Filters ; ; charge charged charges charging > C > Filters set > Filters
cleared; 23
Where: the user cleared the previously set filter.

Related topics
Speech Analytics Search Activity Audit Trail information, page 208
Speech Analytics System Audit Trail

The table lists the actions for the Speech Analytics Portal included in the system audit, and the
information displayed or logged for each action.
Clear Filter User cleared all filters defined in Current  Project ID

Search.  Project Name
 Clear Search:
 ClearFilters
 ClearAll
Create Compare User created Compare Two Result Sets in  Project ID

Results Set Report Analyze> Charts workspace.  Project Name
 Report Name
 Additional Info:
 First Results Set Name
and Second Results Set

Name
Delete Real-Time User deleted a real-time category.  User name and ID

Category  Project Name
 Real-Time Category ID
Export Category User selected Export Category  Project ID

Definitions Definitions from either the Design >  Project Name
Categories or Real-Time Categories  Export Category Option:
workspace and selects to export to file.  All
 Selected
Export Charts Report User selected Export Chart Data from  Project ID
any Analyze workspace.  Project Name
 Report Name
 Report Format

Export Category User selected Export Category  Project ID

Report Definitions from either the Design >  Project Name
Categories or Real-Time Categories  Additional Info:
workspaces, and selects to export to  Report format
PDF.  Export category
option: All or Selected
Export Interactions User selected Export Interaction Data in  Project ID

Report Analyze > Interactions workspace.  Project Name
 Report Name
 Interaction Export
option
Import Category User selected Import Category  Project ID

Definitions Definitions from the Design > Categories  Project Name
workspace.  Import Category Option
(indicates the option
selected to resolve
conflicts, if any). Can be
one of the following:
 Overwrite
 Rename
 Empty (when there were
no conflicts)
 Aborted (if the process
was stopped)
Save Category User selected Save after modifying an  Project ID

existing or creating a new category.  Project Name
 Category Name
 Category ID
 Category State
 Active
 Inactive
 Published

Save Real-Time User selected Save after modifying an  Project ID

Category existing or creating a new real-time  Project Name
category.  Real-Time Category Name
 Real-Time Category ID
 Real-Time Category State
 Inactive
 Published
Search Term Users defined a search query to find  Project ID

interactions in the data set.  Project Name
 Search Query
Set Filter User defined Advanced Filters in Current  Project ID

Search for data set.  Project Name
Set Filter in Category User defined Filter Criteria in Design  Project ID

Designer > Category or Real-Time Category  Project Name
workspaces, for an existing or new
category.
Term Trend: Get Noisy In the Discover Trends workspace, user  Project ID
Terms clicks Manage in the Terms & Phrases to  Username
view list of hidden terms in project.  List of hidden terms
Term Trend: Hide In the Discover Trends workspace, user  Project ID

Noisy Terms mouses over term in Terms & Phrases,  Username
and from the tooltip, selects Hide from  Hidden term
view.
Term Trend: Unhide In Discover Trends workspace, user  Project ID

Noisy Terms mouses over hidden term in Terms  Username
& Phrases, and does one of the  List of terms
following:
Selects Unhide from tooltip.
Clicks Manage, and then clears
checkboxes for single or multiple hidden
terms.
Tune User reviewed suggested text and did  ID and Name of user who
Transcript: Approve one of the following: approved suggestion
Suggestion Edited suggested fix and then selected  Transaction ID
Approve.
Approved suggested fix.

Tune User selected Export Suggestions in  Model Name

Transcript: Export Suggestions grid to export all approved
Approved Suggestions suggestions to a JSON file.
Tune User goes to Review Suggestion form to  ID and Name of user who
Transcript: Review review suggested text. reviewed suggestion
Suggestion  Transaction ID
Tune User reviewed suggested text and  ID and Name of user who
Transcript: Reject selected Reject. rejected suggestion
Suggestion  Transaction ID
Tune User selected Model and State for  Model ID

Transcript: Select View suggestions to set the view context for
for Tune Transcript the Tune Transcript workspace.
Workspace
Tune User selected term in Transcription tab,  Transaction ID

Transcript: Submit entered a term in the Suggest Fix field
Suggestion and clicked Submit Suggestion.
View Speech User selected an interaction to view its  Project ID

Transcription transcript.  Channel (channel on which
the call was recorded)
 Module (unique identifier
of interaction in database)
 Start Time (as recorded in
the database)
Text Analytics System Audit Trail

The table lists the actions for the Text Analytics Portal included in the system audit, and the information
displayed or logged for each action.
Get Interaction User selected an interaction in the Analyze  Tenant (Store) ID

Preview Interactions workspace to see the text  Project ID
preview.  Interaction ID
 Thread ID for threaded
analysis mode

Save As Category User selected Save As Category to create a  Tenant (Store) ID

category from search criteria in either the  Project ID
Analyze Content or Interactions workspaces.  Category Name
Save Search User selected Save Search to save and reuse  Tenant (Store) ID
the current search criteria as a saved search.  Project ID
 Saved Search Name
Edit Category User selected a category from the list of  Tenant (Store) ID
Definitions categories in the Analyze Content or  Project ID
Interactions workspaces, and then selected  Category Name
Edit Category Definitions to modify the
category.
Delete Category User selected a category from the list of  Tenant (Store) ID
categories in either the Analyze Content or  Project ID
Interactions workspaces, and then selected  Category Name
Delete to remove the category.
Export Category User selected Export Category Data in either  Tenant (Store) ID
Data the Analyze Content or Interactions  Project ID
workspaces.  Language
Export Interaction User selected Export Interaction Data from  Tenant (Store) ID
Data either the Analyze Content or Interactions  Project ID
workspaces to export all or a subset of  Export Interaction Data
results from the current search. Option:
 All
 First <num> results
Delete Interaction User selected a completed or failed exported  Tenant (Store) ID

Data Report interaction data report from the Report My  Project ID
Export workspace, and selected Delete.  Report GUID
Reprocess User selected a completed exported  Tenant (Store) ID

Interaction Data interaction data report from the Report My  Project ID
Report Export workspace, and selected Reprocess  Report GUID
Export.
Edit Project User selected a Text Project in the Configure  Tenant (Store) ID
Configuration Projects workspace, and then selected the  Project ID
Configure option to modify settings.  Project Name
 Language
 Model Name
 Retention Period

Audit trail Audit Trail file viewing
Audit Trail file viewing

You can view Audit Trail files in a text editor such as Notepad or WordPad, or in Microsoft Excel. Excel
enables you to view the file in table format and take advantage of sorting and filtering features.
 View Audit Trail files in a Text Editor , page 216
 View Audit Trail files in Microsoft Excel, page 216
View Audit Trail files in a Text Editor

Procedure
1. Double-click the Audit Trail file.
2. If you are prompted to select an application with which to open the file, select Notepad or
WordPad.
The file opens in the selected application.
View Audit Trail files in Microsoft Excel

Procedure
1. Copy the Audit Trail file to a computer with Microsoft Excel.
2. Open Excel and browse to the required .ltf file.
3. From the Files of type drop-down list, select All files (*.*).
4. Select the required .ltf file and click Open.
5. In the Original data type section of the Text Import Wizard, select Delimited and click Next.
6. In the Delimiters list, clear the Tab check box and select Semicolon, then click Next.
7. In the Column data format list, select General and click Finish.
The file opens in Excel.

C h a p t e r 1 0
Troubleshooting
This section describes alarm related troubleshooting procedures.
Topics
Troubleshooting procedures 218

Troubleshooting Troubleshooting procedures
Troubleshooting procedures
This section describes the individual troubleshooting procedures for alarms.
Topics
 Email notifications are not sent when an alarm is triggered, page 218
 Preventing the “Error Retrieving Performance Counter” alarm in mixed language server
configurations, page 218
Email notifications are not sent when an alarm is triggered

If emails are not sent when an alarm is triggered, verify that you have correctly configured the system
to support email notifications.
This list describes all configuration that must exist for email to be sent when an alarm is triggered:
 The connectivity information for the SMTP server must be specified in SMTP settings on the System
Management > Enterprise Management > Settings tab.
 The Email Notification setting must be selected in the System Management > System Monitor >
Global Alarm Settings tab.
 The email addresses that you want to receive email notifications must be listed in a Notification
Profile in the System Management > System Monitor > Notification Profiles tab.
 The Notification Profile that contains the email addresses must be assigned to the alarm that is
triggered.
Related topics
Preventing the “Error Retrieving Performance Counter” alarm in

mixed language server configurations
This topic explains why the “Error Retrieving Performance Counter” alarm (number 30998) is raised
with mixed language server configurations. The topic also explains how to prevent this alarm from
being raised.
This topic includes these sections:
 What is a mixed language server configuration?, page 219
 Windows Performance Counter and the Error Retrieving Performance Counter Alarm, page 219
 Preventing the alarm from being raised, page 220

 An authorized technical support representative must perform, or supervise the performance

of, the procedure described in this section.
What is a mixed language server configuration?

This topic clarifies the term “mixed language server” configuration.
For this troubleshooting procedure, the term “mixed language server configuration” refers to either
of the following configurations:
 A server with a Windows language pack installed that is different from the language of the Windows
operating system. For example, a server with an English language operating system that has a
Spanish language pack installed is a mixed language server configuration.
 A server with third-party software installed that is of a different language than the Windows
operating system. For example, a Spanish language SQL Server installed on the English language
Windows operating system is a mixed language server configuration.
Windows Performance Counter and the Error Retrieving Performance Counter

Alarm
This topic describes the problems that can occur with the Windows Performance Counter in a mixed
language server configuration.
The server Alarmer component uses Windows operating system performance counters to raise and
acknowledge alarms.
 You can view these performance counter names by running the perfmon.exe utility
(available at <root>:\Windows\SysWOW64\). In the perfmon.exe utility, select Data Collector
Sets > System > System Performance and then select Performance Counters
For the performance counter to operate successfully with the Alarmer component, the performance
counter names displayed in the perfmon.exe utility must match the Alarmer component
configuration.
A mixed language server configuration causes performance counter names to display in two different
languages: some in the language of the operating system and others in the language of the language
pack or third-party software.
Assume that the Alarmer component is asked to query a Windows performance counter, and the
counter name is not in the language expected by the Alarmer configuration. In this scenario, the
Alarmer assumes that the counter does not exist, and raises the "Error Retrieving Performance
Counter" alarm.

Preventing the alarm from being raised

If you see an “Error Retrieving Performance Counter” alarm that results from a mixed server
configuration, you can perform the following procedure to address this issue.
This procedure specifies the performance counter names it translates and those counter names it
does not.
Procedure
1. The “Error Retrieving Performance Counter” alarm specifies the display name of the alarm it could
not query. Identify the alarm display name indicated by the “Error Retrieving Performance
Counter” alarm.
2. Locate the alarm definition XML file that contains the alarm display name identified in step 1, as
noted here:
 All alarm XML definition files reside in the following directory on the server on which the
Framework Applications server role is active: <installdirectory>\Conf\alarm
 Manually search through the alarm definition XML files in the <installdirectory>\Conf\alarm
directory until you locate the alarm display name identified in step 1. (The name is located
inside an <a:fullname><a:/fullname> element in one alarm definition within the file).
3. When you have located the single alarm XML definition file that contains the alarm identified in
step 1, edit the file as follows:
a. Locate the individual alarm definition of the alarm identified in step 1. The alarm definition is
enclosed within the <componentalarm></componentalarm> tags.
b. Within the alarm definition, make these two changes:
 In the <a:objectname translang=”On”>Process</a:objectname> tag, change the On value to
Off.
 In the <a:countername translang=”On”>Private Bytes</a:countername> tag, change the On
value to Off.
 You can verify which counter language is being published by running the
perfmon.exe utility. Using this utility, search for the object that matches the
<objectname> value and the counter name that matches the <countername> value.
4. At the top of the alarm definition XML file, increment the version number.
 Locate the <systemmonitordefinition> tag at the top of the file.
 Within the <systemmonitordefinition> tag, increment the version= value by 1. For example, if
version=”15101”, change it to version=”15102.”
5. Save the updated alarm definition XML file. Wait for the Enterprise Manager application to update
the AlarmConfig.xml file with the new information.
 Never edit the AlarmConfig.xml file. This file is automatically regenerated and
overwritten by the Enterprise Manager application.

6. From the Windows desktop, start the Windows Services Administrative Tool and restart the
Recorder Alarm Service.
Restarting this service causes the Alarmer component to retranslate any necessary counter
names.

Avaya IX WEM V15 2 System Monitoring Messaging and Alarms Guide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Avaya IX WEM V15 2 System Monitoring Messaging and Alarms Guide

Uploaded by

Copyright:

Available Formats

Avaya Workforce Engagement

System Monitoring, Logs, and Alarms

April 14, 2023

About this guide 7

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 4

Confidential and Proprietary Information of Verint Systems Inc.

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 5

Confidential and Proprietary Information of Verint Systems Inc.

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 6

Confidential and Proprietary Information of Verint Systems Inc.

About this guide

Document revision history

Revision Description of changes

1.20 Minor editorial revisions.

1.18  In Actions that can be audited for each module, removed

Revision Description of changes

1.16 Updates for V15.2 2021R1:

1.15 Updates for V15.2 2020R1:

1.14 Aligned audited activity for Identity Authentication and Fraud

1.13 Removed references to ema.error log, ema.debug.log, rm.error

1.12 Updates for V15.2 HFR7:

1.11 Updates for V15.2 HFR6:

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 8

Confidential and Proprietary Information of Verint Systems Inc.

Revision Description of changes

1.08 Updates for V15.2 HFR5:

1.06 Updates for V15.2 HFR4:

1.05  This book is renamed from System Monitoring, Messaging, and

1.04 All references to TAS are removed from the guide.

1.03 New for HRF1:

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 9

Confidential and Proprietary Information of Verint Systems Inc.

Revision Description of changes

1.02 Adding text indicating the audible notification feature is not

1.01 Adding the Alarms Spreadsheet as an attachment to the PDF

1.00 The following changes are new for this release:

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 10

Confidential and Proprietary Information of Verint Systems Inc.

Active alarms and the Alarm

Alarm Dashboard overview 12

Alarm Dashboard overview

Alarm Dashboard panes

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 12

Confidential and Proprietary Information of Verint Systems Inc.

User security privileges required

Other ways to work with active alarms

Export a list of active alarms

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 13

Confidential and Proprietary Information of Verint Systems Inc.

Alarms in Enterprise Manager Agent and Recorder Manager, page 47

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 14

Confidential and Proprietary Information of Verint Systems Inc.

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 15

Confidential and Proprietary Information of Verint Systems Inc.

View a list of active alarms in the enterprise

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 16

Confidential and Proprietary Information of Verint Systems Inc.

Enterprise Alarms pane reference

 You can click in a column heading to:

Enterprise Alarms pane fields

Refresh Every setting and icons

Avaya Workforce Engagement System Monitoring, Logs, and Alarms 17

Confidential and Proprietary Information of Verint Systems Inc.