Cisco Prime Nerk 43 User Guide

							  
11-5
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Ways You Can View Tickets and Events
Figure 11-2 Vision Window Showing Device Inventory View and Events Tabs
The Tickets tab displays tickets for all devices in the map. To manage tickets, see Viewing Tickets and 
Events for a Specific Device, page 11-4. To create a ticket filter, see The following table describes how 
regular and resynced events detail are displayed in Prime Network:, page 11-6.
The Network Events tab displays incoming events that are being processed. Prime Network suspends 
processing for 2 minutes in order to allow correlation with incoming events. When correlation is 
finished, if an event is associated with a ticket, a hyperlink to the ticket properties is provided. This tab 
can also include standard events, which are events for which Prime Network only performs basic 
parsing; they are not processed for correlation. You can identify a standard event by its archive setting, 
which will be set to true.To create a filter for Network Events, see Permissions for Vision Client 
NE-Related Operations, page B-4. For information on the traps, syslogs, and other network events 
displayed in this tab, see Viewing Network Events (Service, Trap, and Syslog Events), page 12-13.
If a ticket is not cleared for Resync Alarms, then you can manually clear the tickets. 
The Provisioning Events tab displays events related to configuration changes that were made to the 
device. If you want to create a Provisioning Events filter, see Permissions for Vision Client NE-Related 
Operations, page B-4. For more information on Provisioning events, see Provisioning Events (Device 
Configuration Results), page 12-17.
Viewing Resync Alarm Details in Prime Network
When full traps are created in Prime Network, events are processed as normal events. This allows the 
correlation information for all resynced events to be overwritten, and assigned to the resynced service 
alarm Ticket ID. The newly created events will have all the event properties similar to the original events 
rather than the standard event properties. You can view the Ticket ID in the Tr a p s tab and the ticket 
history is displayed as a generic resync single event.  
						

							  
11-6
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Ways You Can View Tickets and Events
NoteOn the Network Events tab, you can still view details of standard events that are created.
The following table describes how events, traps, tickets details are displayed for Resync alarm tickets:
The following table describes how regular and resynced events detail are displayed in Prime Network:
Table 11-1 Display Behavior 
Property Prior to Prime Network 4.3.1 Prime Network 4.3.1
Handles both severity and description 
and shows traps in the regular V2 tab.
Severity Displayed as Info The events will have the severity as defined in 
Prime Network parsing rules 
(can be overridden in VCB, and so on).
Ty p e  
(used in 
ENS)Displayed as Standard trap Displays actual type as defined in Prime Network 
parsing rules. 
Description Displayed as Trap MIB OID or 
Translated NameThe trap description as parsed by Prime Network. 
For example, “Port down”.
Ticket Displays one Info Resync ticket. Displays one Info Resync ticket.
Correlation None Traps are assigned into the Resync ticket.
View/Acces
sView or Access Information in the 
Standard tab in the Prime 
Network Events clientView or access the Resync service alarm ticket 
information in the V2 traps tab in the Prime 
Network Events client.
Table 11-2 Regular and Resynced Events Processing
Property Regular Events Resynced Events
Severity The processed events specifies the 
severity as defined in Prime 
Network parsing rules.The processed events specifies the same severity 
as defined in Prime Network parsing rules.
Ty p e  
(used in 
ENS)The type of event as defined in 
Prime Network parsing rules.The actual type as defined in Prime Network 
parsing rules.
Descripti
onThe trap description as parsed by 
Prime Network. Example: Port 
down.The trap description as parsed by Prime Network. 
Example: Port down.
Ticket Generates ticket based on the 
incoming Network Event.Displays Resync ticket  with ‘Info’ severity 
additionally. 
						

							  
11-7
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Ways You Can View Tickets and Events
CautionThe command output displayed for the events that were lost or for events that were resynced should not 
be more than 5000 traps. As a result, if the VNE is down for a very long period of time, and the number 
of events is high, then there is a possibility that the events that were lost during the down time is not 
resynced and is completely lost.
Finding Tickets Using a Ticket Filter
A shown in Figure 11-3, the Vision client provides a robust filter tool to help you locate tickets using a 
variety of criteria. The filter locates tickets that meet the filter criteria. This procedure provides an 
overview of how to create a filter, and then remove it.
NoteThe Vision client has global options that can affect filter behavior, such was how many events should be 
listed in the display. These settings are described in Setting Up Your Events View, page 6-4.
Step 1Launch the filter:
To apply the filter against all devices in a map, open the map.
To apply the filter against a specific device, double-click the device in a map to open its inventory 
window.
Step 2Click Tickets Filter in the ticket pane toolbar to open the Tickets Filter dialog box. Correlati
onNetwork events like Snmp Link 
Down/Up and Port Down/Up are 
assigned to the corresponding 
service event Port down due to 
Admin Down.Traps are assigned to the Resync ticket.
NoteYou can view the Ticket Id information in 
the Tr a p s  tab. However, in the History 
tab, you can view the ticket history that 
includes a generic resync single event as 
before.
Vi ew / A c c
essView or Access information in the 
V2 traps tab in Prime Network 
Events client.View or Access information in the V2 traps tab in 
Prime Network Events client.
Table 11-2 Regular and Resynced Events Processing
Property Regular Events Resynced Events 
						

							  
11-8
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Ways You Can View Tickets and Events
Figure 11-3 Ticket Filter Dialog Box
Step 3
To create a new filter, make sure that [Untitled filter] is chosen from the Filter drop-down list. (For an 
example of this list populated with filters, see Creating and Saving Filters for Tickets and Events, 
page 12-6.)
a.Check the check box for each criterion to use for filtering.
b.As needed, choose the operator for the filter, such as Contains or Does Not Contain. 
c.Supply the specific information to apply to the filter, such as the time, a string, or one or more IP 
addresses. 
						

							  
11-9
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Interpreting the Badges and Colors of an NE
Step 4If you want to save the filter so you can choose it from a drop-down list at another time, perform these 
steps:
NoteA filter is saved for later use only if you click Save. To simply apply the filter to the current 
display (without saving the filter), skip this step.
a.Click Save and enter a name for the filter in the Save Filter dialog box. (Filters are listed 
alphabetically in the drop-down list; note that space is limited.)
b.If you want other Vision client users to be able to use your filter, click Shared. 
c.Click OK in the Save Filter dialog box to save the filter for later use.
Step 5Click OK in the Tickets Filter dialog box to apply the filter to the current display.The tickets are 
displayed in the ticket pane according to the defined criteria, and Filter Enabled is displayed below the 
tickets table (see Determining Whether a Filter Is On and Turning It Off, page 12-10). Once you apply 
a ticket filter, it remains applied until you manually clear it. 
NoteAn enabled filter stays enabled as you move between tabs. But if you log out of the client without 
saving the filter, it is discarded.
Step 6To remove the ticket filter:
a.Click Tickets Filter in the ticket pane toolbar. 
b.Click Clear and OK.
For information on creating a filter for other events, see Creating and Saving Filters for Tickets and 
Events, page 12-6.
Interpreting the Badges and Colors of an NE
Color-coded icons reflect the severity of an NE’s ticket. Because multiple events can be associated with 
a ticket, ticket severity is determined by the associated event with the highest severity. You can view the 
severity for all of a ticket’s associated events in the ticket itself. 
The following table shows the severity indicators.
Icon Color Severity Notes
Critical Red
Critical, Major, Minor, and 
Warning events are considered 
flagging events because they 
may require attention Major Orange
Minor Yellow
Warning Light Blue 
						

							  
11-10
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Interpreting the Badges and Colors of an NE
1
2
3310517
These examples show how an NE with a Major ticket is displayed.
Example 1: Interpreting NE Badges and Colors
Figure 11-4 NE Colors and Badges—Example 1
To summarize Figure 11-4:
The MDS device has a major ticket that has not been cleared. The ticket is still a problem.
The MDS device has other unacknowledged tickets, but those tickets have been cleared. (This also 
means the major ticket was already acknowledged.)
There is no more action you need to take.Cleared, Normal, or OK Green
Information Medium Blue
Indeterminate Dark Blue Icon Color Severity Notes
Value Navigation Pane Map Ticket Pane (Bottom of Vision Window)
Element with ticket of 
Major severity
 
To find out: Look at:Figure 11-4 tells you: Conclusion:
What is the 
most serious 
problem that 
has not been 
fixed yet?(1) Icon color—Represents NE’s 
most serious ticket that has not 
been clearedThe NE has at least one 
major ticket that has not 
been cleared.This MDS device 
has a major ticket 
that has not been 
cleared yet.
Icon—NE type NE is a Cisco MDS 
device.
What is the 
most serious 
problem that no 
one is aware of?(2)  Badge at top right of NE—Color 
represents NE’s most serious 
ticket that is unacknowledged (no 
one is aware of it)The most serious 
problem that no one is 
aware of has already 
been cleared.The only 
unacknowledge 
ticket has already 
been cleared. 
						

							  
11-11
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Interpreting the Badges and Colors of an NE
Example 2: Interpreting NE Badges and Colors
Figure 11-5 NE Colors and Badges—Example 2
To summarize Figure 11-5:
The Cisco 7600 router has a warning ticket that has not been cleared.
The Cisco 7600 router has an unacknowledged warning ticket.
The Cisco 7600 router is only partially reachable.
This tells you that someone needs to acknowledge the warning ticket and start fixing it (see Letting 
Others Know You Are Working on the Ticket (Acknowledging a Ticket), page 11-12). It also tells you 
that the device reachability problem could be the cause of the warning ticket. For information on device 
reachability and communication states, see Troubleshooting Device Reachability and Performance 
Issues, page 11-19.
For troubleshooting steps, see Troubleshooting a Ticket, page 11-12. 
For a complete list of all icons and badges, see Appendix A, “Icon Reference”. To find out: Look at:Figure 11-5 tells you: Conclusion:
Is anyone 
working on the 
problem?(1)  Badge at top right of 
NE—Color represents NE’s 
most serious ticket that is 
unacknowledged (no one is 
aware of it)NE still has at least one 
unacknowledged 
ticket.No one is aware that 
this Cisco 7600 router 
has a warning ticket.
Is there a 
problem now? 
If yes, how 
serious is it?(2) Icon color—Represents NE’s 
most serious ticket that has 
not been clearedThe NE still at least 
one warning ticket that 
has not been cleared.This Cisco 7600 
router has a warning 
ticket, and it is still a 
problem.
Icon represents NE type NE is a Cisco 7600 
router.
Is there a 
device 
communication 
problem?(3) Badge at bottom right of 
NE—Represents device 
reachability and how fully the 
NE has been modeledNE is in the “Device 
Partially Reachable” 
communication state.Prime Network 
cannot fully 
communicate with the 
Cisco 7600 device.
1
2
3310517 
						

							  
11-12
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Letting Others Know You Are Working on the Ticket (Acknowledging a Ticket)
Letting Others Know You Are Working on the Ticket 
(Acknowledging a Ticket)
When you acknowledge a ticket, it signals to other Vision client users that someone else is working on 
the problem. The easiest way to check whether a ticket has been acknowledged is from the ticket table 
(at the bottom of the Vision client window). 
If a new event is correlated to an acknowledged ticket, the ticket status changes to Modified and the ticket 
must be acknowledged again. 
To acknowledge a ticket, right-click the ticket and choose Acknowledge. The change is indicated in all 
clients connected to the gateway, and the ticket’s User Audit tab is updated to say you acknowledged the 
ticket.
If you acknowledge a ticket by mistake, you can undo it by right-clicking the ticket and choosing 
Deacknowledge. 
Troubleshooting a Ticket
The following table provides a basic workflow for troubleshooting a ticket. Prime Network provides a 
variety of ways you can get more information about and troubleshoot a ticket. Some of these tools 
require special permissions; see Permissions Required to Perform Tasks Using the Prime Network 
Clients, page B-1.
NoteTickets are stored in the database in Greenwich Mean Time (GMT) but are converted to match the time 
zone of the client location.
Step Task Described in:
Step 1Get any troubleshooting help that is embedded in the ticket 
and basic information (when the event was detected, its 
location, and so forth).Getting a Ticket’s Troubleshooting Tips 
And Basic Information, page 11-13
Step 2View a chronological listing of all of the events in a ticket.Checking the History of a Ticket and Its 
Associated Events, page 11-14
Step 3Identify which service resources (pairs) are affected by the 
ticket. (Only populated for events that calculate impact 
analysis.)Viewing a Ticket’s Affected Parties Tab 
(Resource Pairs), page 11-15
Step 4Display a hierarchy of events with the root cause at the top.Viewing a Ticket’s Root Cause and 
Associated Events (Correlation 
Information), page 11-16
Step 5Find out how many devices the ticket affected and view 
them on a map or in a list view.Finding Out How Many Devices Are 
Affected by a Ticket, page 11-17
Step 6View any ticket notes entered by other users, and find out 
who changed the ticket (acknowledge, clear, and so forth).Viewing User-Entered Ticket Notes and 
Finding Out Who Changed the Ticket, 
page 11-17 
						

							  
11-13
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Troubleshooting a Ticket
Getting a Ticket’s Troubleshooting Tips And Basic Information
A ticket’s Details tab provides specific information about the probable cause, action to be taken, and 
clearing conditions for the ticket. This information is provided in the Details tab’s Troubleshooting field.
The Details tab also provides a snapshot of the ticket—where the problem is, when the problem was first 
detected, when the ticket was created, and how many alarms (event sequences) are associated with the 
ticket, and so forth.
This table describes some of the fields in the Details tab that may not be self-explanatory.
Step 7Check the Prime Network documentation site. It contains 
event-specific documentation that can be helpful.Checking the Online Documentation for 
Ticket Troubleshooting Information, 
page 11-18
Step 8Check your deployment for built-in troubleshooting tools. If 
they are available, you should be able to launch them by 
right-clicking the NE and choosing Commands.Using Built-in Troubleshooting Scripts 
and Tools, page 11-18
Step 9If you have sufficient permissions to use the Events client, 
search in the database for similar tickets on the same NE.Finding Archived Tickets, Service 
Events, Syslogs, and Traps, page 12-12
Step 10For reachability issues, check the device connectivity 
information provided in the client. This includes:
Connectivity between the device and Prime Network.
Connectivity between Prime Network components.
Also check the VNE investigation state, which represents 
the extent to which the device and its components were 
discovered and modeled. Troubleshooting Device Reachability 
and Performance Issues, page 11-19
For performance issues, check device memory and CPU.Checking Device Memory and CPU 
Usage, page 11-24 Step Task Described in:
Details Tab Field Description
Location Hyperlink to the entity that triggered the root-cause alarm (the hyperlink is 
provided only if you have permission to view the location).
Root Event Time When the root-cause event was detected.
Creation Time When the ticket was created.
Open Alarms Number of uncleared alarms associated with the ticket. For example, 3/4 means 
three of the ticket’s four alarms are still not cleared. 
						

							  
11-14
Cisco Prime Network 4.3.2 User Guide
Chapter 11      Managing Tickets with the Vision Client
  Troubleshooting a Ticket
Checking the History of a Ticket and Its Associated Events
The History in chronological order, every instance of each event associated with a ticket. If the ticket has 
more than one alarm, you can also drill down to get the alarm details and history by double-clicking the 
alarm ID. The following table provides a subset of the information provided. Acknowledged Whether someone is aware of the ticket, with the user name in parentheses.
No—The ticket has not been acknowledged, or it was acknowledged then 
de-acknowledged (in which case the User Audit tab will provide more 
details).
Modified—The ticket was acknowledged, but a new event has been 
associated to it. New events can be associated to a ticket until the ticket is 
archived. (The optional ticket locking mechanism can also affect whether 
new event can associate with a ticket; see How Events and Tickets are 
Purged from the Oracle Database, page 10-14.) Tickets are archived after 
they have remained clear for 1 hour (even if the ticket locking mechanism is 
used). 
Nature Whether or not the ticket will automatically clear.
ADAC (Automatically Detected Automatically Cleared)—Clearing is 
automatically detected and performed by the system (for example, Link 
Down).
ADMC (Automatically Detected Manually Cleared)—Clearing requires 
manual intervention (for example, a fatal error). Details Tab Field Description
History Tab Field Description
Detection Type How the event was detected—Trap, Syslog, or Service event.
Alarm ID Hyperlink to the alarm the event is associated with. Click the hyperlink to view 
the alarm details.
Causing Event ID ID of the event that caused this instance of the alarm. If the same event recurs, 
it continues to have the same causing event.
Duplication Count (For flapping) Total number of event duplications in the flapping alarm. (This 
number is always 1 for regular non-flapping events.)
For example, this Link Down Flapping alarm would have a duplication count of 
3:
link down -> link up -> link down -> link up -> link down -> link up
Reduction Count (For flapping) Total number of event instances in the flapping alarm. (This 
number is always 1 for regular non-flapping events.).
Using the previous example, the Link Down Flapping alarm would have a 
reduction count of 6 (with 6 events listed in the History tab).