Cisco Prime Nerk 43 User Guide
Have a look at the manual Cisco Prime Nerk 43 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
![Page 1129
C-17
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Possible Root Cause
1.Prime Network waits two minutes. For more information, see How Prime Network Correlates
Incoming Events, page 10-4.
2.After two minutes, the [BGP Neighbor Loss, RR2] event triggers the VNE to initiate an IP-based
flow to the destination IP of its lost BGP neighbor (PE-North-West):
Flow Path: RR2 > P-North > P-West > P-West port is connected to PE-North-West (which is...](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1128.png "Page 1129
C-17
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Possible Root Cause
1.Prime Network waits two minutes. For more information, see How Prime Network Correlates
Incoming Events, page 10-4.
2.After two minutes, the [BGP Neighbor Loss, RR2] event triggers the VNE to initiate an IP-based
flow to the destination IP of its lost BGP neighbor (PE-North-West):
Flow Path: RR2 > P-North > P-West > P-West port is connected to PE-North-West (which is...")
![Page 1131
C-19
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-16 BGP Process Down Causes Several Events
For the event [BGP Neighbor Loss, RR2]:
Additional Collected Events: [BGP Process Down, RR2], [BGP Neighbor Loss, RR2].
Root cause: Correlates to [BGP Process Down, RR2].
Figure C-17 displays the events identified by the system in this scenario.
Figure C-17 BGP Process Down Correlation
BGP process down
RR2-IOU-176
RR2-IOU-176 : 169.254.......](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1130.png "Page 1131
C-19
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Figure C-16 BGP Process Down Causes Several Events
For the event [BGP Neighbor Loss, RR2]:
Additional Collected Events: [BGP Process Down, RR2], [BGP Neighbor Loss, RR2].
Root cause: Correlates to [BGP Process Down, RR2].
Figure C-17 displays the events identified by the system in this scenario.
Figure C-17 BGP Process Down Correlation
BGP process down
RR2-IOU-176
RR2-IOU-176 : 169.254.......")
![Page 1134
C-22
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Prime Network Failure Processing
Event Identification
The following service alarms are generated by the system:
[BGP Link Down, RR2 < > PE-North-West] event. This event might be revealed in one of two ways:
–After polling, changes are found in the BGP neighbor list in the device.
–Syslogs suggest that something has changed in the device’s BGP neighbors or process.
This alarm causes an...](http://img.usermanuals.tech/thumb/17/104726/w64_prime-nerk-43-user-guide-1524844501_d-1133.png "Page 1134
C-22
Cisco Prime Network 4.3.2 User Guide
Appendix C Event Correlation Examples
Correlation Scenarios
Prime Network Failure Processing
Event Identification
The following service alarms are generated by the system:
[BGP Link Down, RR2 < > PE-North-West] event. This event might be revealed in one of two ways:
–After polling, changes are found in the BGP neighbor list in the device.
–Syslogs suggest that something has changed in the device’s BGP neighbors or process.
This alarm causes an...")
C-19 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-16 BGP Process Down Causes Several Events For the event [BGP Neighbor Loss, RR2]: Additional Collected Events: [BGP Process Down, RR2], [BGP Neighbor Loss, RR2]. Root cause: Correlates to [BGP Process Down, RR2]. Figure C-17 displays the events identified by the system in this scenario. Figure C-17 BGP Process Down Correlation BGP process down RR2-IOU-176 RR2-IOU-176 : 169.254.... RR1-IOU-176 : 169.254.... RR2-IOU-176 : 169.254.... PE-South-IOU-176 :169... RR2-IOU-176 : 169.254.... PE-East-IOU-176 :169.2... RR2-IOU-176 : 169.254.... PE-East-IOU-176RR... PE-South-IOU-176R... RR1-IOU-176RR2-I... RR2-IOU-176 370863 Event Correlation Hierarchy Location BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog BGP link down BGP link down BGP link down BGP neighbour loss BGP neighbor down syslog BGP neighbor down syslog
C-20 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios BGP Link Down Scenarios Figure C-18 illustrates the lab setup for the BGP Link Down scenarios described in this topic. Figure C-18 Lab Setup for BGP Link Down Scenarios Figure C-19 illustrates the lab setup for the scenarios with only the BGP links displayed. Figure C-19 Lab Setup for Scenarios with Only the BGP Links Displayed The VNE models the BGP connection between routers and actively monitors its state. If connectivity is lost and a link between the devices exists in the VNE, a BGP Link Down event is created. A BGP Link Down event is created only if both sides of the link are managed.
C-21 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios A BGP link might be disconnected in the following scenarios: The BGP process on a certain device goes down, causing all the BGP links that were connected to that device to disconnect. A physical link (path) is disconnected, causing one side of the logical BGP link to become unreachable. A device becomes unreachable, due to reload or shutdown. This causes all the links to the device to be lost, including the BGP links. Description of Fault Scenario in the Network Due to a physical link down, the BGP connection between PE-North-West and RR2 is lost. Related Faults Port that is connected to the P-North goes down. Port that is connected to the RR2 goes down. BGP link between RR2 and PE-North-West is disconnected. NoteSyslogs and traps corresponding to network faults are also reported. Additional related faults might also be reported, but are not described in this discussion. Figure C-20 reflects the BGP Link Down due to physical link down scenario. The relevant devices are RR2, P-north, P-West, and PE-North-West. Figure C-20 BGP Link Down Due to Physical Link Down
C-22 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Prime Network Failure Processing Event Identification The following service alarms are generated by the system: [BGP Link Down, RR2 < > PE-North-West] event. This event might be revealed in one of two ways: –After polling, changes are found in the BGP neighbor list in the device. –Syslogs suggest that something has changed in the device’s BGP neighbors or process. This alarm causes an acceleration of the polling for the BGP neighbor data on the device. Possible Root Cause 1.Prime Network waits two minutes. For more information, see How Prime Network Correlates Incoming Events, page 10-4. 2.After two minutes, the [BGP Link Down, RR2 < > PE-North-West] event triggers the RR2 VNE to initiate two IP-based flows: –One from its routing entity to the destination IP address of its lost BGP neighbor, PE-North-West. –One from the destination IP address of its lost BGP neighbor back to the RR2. Flow Path: RR > P-North > PE-North-West Flow Path: RR > PE-North-West > P-North > RR2 Root Cause Selection For the event [BGP Link Down, RR2 < > PE-North-West]: Collected Events: [Link Down, P-North < > RR2] and [BGP Link Down, RR2 < > PE-North-West]. Root Cause: Correlates to [Link Down, P-North < > RR2]. Figure C-21 displays the events identified by the system in this scenario.
C-23 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-21 BGP Link Down Correlation to the Root Cause of Physical Link Down Clearing Phase A BGP Link Up event arrives when the root cause event is fixed so that the network is repaired. This clearing event is created after a clearing syslog arrives or after the next polling result reestablishes the BGP connection. Link down due to admin down P-North-IOU-176#0:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... PE-South-IOU-176 : 169... PE-South-IOU-176R... RR1-IOU-176 : 169.254.... PE-East-IOU-176 : 169.2... PE-East-IOU-176RR... RR1-IOU-176RR2-I... RR2-IOU-176 PE-North-West-IOU-176... 370864 Event Correlation Hierarchy Location OSPF neighbor down syslog Interface status down Line down trap BGP neighbor down syslog BGP link down BGP neighbor down syslog BGP neighbor down syslog BGP link down BGP link down Device unreachable BGP link downLine down syslog Link down syslog
C-24 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-22 displays the up event that clears all tickets identified by the system. Figure C-22 BGP Link Up Clears All the Tickets Variation In a managed network, the following events might be identified in addition to the BGP Link Down event: BGP Process Down. Device Unreachable. BGP Process Down Figure C-23 displays the scenario where a BGP Process Down event causes BGP Link Down events. Link up P-North-IOU-176#0:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... P-North-IOU-176 IP:Seri... PE-South-IOU-176 : 169... PE-South-IOU-176R... RR1-IOU-176 : 169.254.... PE-East-IOU-176 : 169.2... PE-East-IOU-176RR... RR1-IOU-176RR2-I... RR2-IOU-176 PE-North-West-IOU-176... 370865 Event Correlation Hierarchy Location OSPF neighbor up syslog Interface status up Line down trap BGP neighbor up syslog BGP link up BGP neighbor up syslog BGP neighbor up syslog BGP link up BGP link up Device reachable BGP link upLine up syslog Link up syslog
C-25 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Figure C-23 BGP Process Down Causes BGP Link Down Events For the event [BGP Link Down, RR2 < > PE-North-West]: Additional Collected Events: [BGP Process Down, RR2]. Root cause: Correlates to the event [BGP Process Down, RR2]. Figure C-24 displays the events identified by the system in this scenario. Figure C-24 BGP Process Down Correlation BGP process down RR2-IOU-176 RR2-IOU-176 : 169.254.... RR2-IOU-176 : 169.254.... RR2-IOU-176 : 169.254.... PE-East-IOU-176 : 169.2... RR2-IOU-176 : 169.254.... PE-East-IOU-176RR... PE-South-IOU-176R... RR1-IOU-176RR2-I... PE-North-West-IOU-176... PE-South-IOU-176 : 169... RR1-IOU-176 : 169.254.... 370866 Event Correlation Hierarchy Location BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog BGP link down BGP link down BGP link down BGP link down BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog BGP neighbor down syslog
C-26 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Device Unreachable For the event [BGP Link Down, RR2 < > PE-North-West]: Additional Collected Events: [Device Unreachable, RR2]. Root cause: Correlates to [Device Unreachable, RR2]. In an unmanaged network core (as illustrated in Figure C-25), the following events might be identified in addition to the BGP Link Down event: BGP Process Down. Device Unreachable. Figure C-25 Lab Setup with Unmanaged Network Core
C-27 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios BGP Process Down NoteThe BGP Process Down event occurs on the managed PE-South. In Figure C-26, the BGP Process Down event on PE-South causes BGP Link Down events. The relevant devices are PE-South, RR1, and RR2. Figure C-26 BGP Process Down on PE-South Causes BGP Link Down Events For the event [BGP Link Down, PE-South < > RR2]: Additional Collected Events: [BGP Process Down, PE-South] and [BGP Link Down, PE-South < > RR1]. Root cause: Correlates to [BGP Process Down, PE-South]. Figure C-27 displays the events identified by the system in this scenario. Figure C-27 BGP Process Down Correlation BGP process down PE-South-IOU-176 PE-South-IOU-176 : 169.254.176.216 PE-South-IOU-176RR2-IOU-176 PE-South-IOU-176 : 169.254.176.224 PE-South-IOU-176ce-2-IOU-176 PE-South-IOU-176RR1-IOU-176 370867 Event Correlation Hierarchy Location BGP neighbor down syslog BGP neighbor down syslog BGP link down BGP link down vrf BGP link down
C-28 Cisco Prime Network 4.3.2 User Guide Appendix C Event Correlation Examples Correlation Scenarios Device Unreachable For the Device Unreachable event, one or more PEs report on BGP connectivity loss to a neighbor that is unreachable. In Figure C-28, the Device Unreachable on an unmanaged core causes multiple BGP Link Down events. The relevant devices are RR2 (Device Unreachable), RR1, PE-East, and PE-South. Figure C-28 Device Unreachable on Unmanaged Core Causes Multiple BGP Link Down Events For the event [BGP Link Down, RR2 < > PE-South]: Additional Collected Events: [Device Unreachable, RR2] and [BGP Link Down, RR2 < > RR1]. Root cause: Correlates to [Device Unreachable, RR2]. Figure C-29 displays the events identified by the system in this scenario. Figure C-29 Device Unreachable on Unmanaged Core Correlation For the event [Device Unreachable, RR2] (see Figure C-30: Additional Collected Events: [BGP Link Down, RR2 < > PE-South]. Root cause: Correlates to [BGP Link Down, RR2 < > PE-South]. Device unreachable RR2-IOU-176 PE-South-IOU-176R... RR1-IOU-176RR2-I... PE-East-IOU-176RR... 370868 Event Correlation Hierarchy Location BGP link down BGP link down BGP link down