2.2.8 Configuring incidents

NNMi analyzes problems discovered during monitoring and SNMP traps by using the functionality for resolving root causes, and if the root cause is identified, NNMi reports the cause as an incident.

Organization of this subsection

(1) About incidents
(2) Checking the details of incident settings
(3) Configuring SNMP trap incidents
(4) Configuring automatic actions for an incident

(1) About incidents

An incident is network-related information with high importance that needs to be reported to the administrator. NNMi monitors a network, detects events that have occurred, analyzes them by using the functionality for analyzing root causes, and then reports only the incidents that the administrator needs to know about.

An incident is reported as a result of root cause analysis performed based on the information obtained through network monitoring via SNMP and ICMP (ping) and from problem reports by SNMP traps.

[Figure]

NNMi provides, as standard, definitions for approximately 150 types of incidents, including Management Event incidents and SNMP Trap incidents, which are configured as incident definitions corresponding to this network monitoring. These incident definitions correspond to various events, and therefore you can use them without change for operation.

For example, the information below is configured in the Management Event incidents as incidents that occur when a node goes down. The functionality for analyzing root causes analyzes the status, and reports the appropriate one from the incidents.

NodeDown (The node is down.)
NodeOrConnectionDown (The node or connection is down.)

As one of the operation methods, you can include a node in the Important Nodes node group. Monitor a NodeDown incident that is issued if an important node does not respond.

Examples of issued incidents: The table below provides examples of incidents that are generated when the node of a network device is down and stopped. The functionality for analyzing root causes reports only the root cause events as incidents.

To minimize the impact of a failure during the operation of a network, NNMi provides the following approaches to appropriately handle all incidents without omission.

Functionality	Description	Reference
Automatic action for incidents	You can configure the setting so that actions are automatically performed according to the lifecycle state of incidents.	2.2.8(4)
Failure monitoring through incidents	If an incident is generated, it is reported and displayed on the NNMi console. You can check the details by switching the windows between Topology Maps and Incident Browsing.	3.1
Incident lifecycle management	NNMi manages the progress of handling of an incident by lifecycle states.	4.2

You need to configure incidents in order to use the above functionality.

(2) Checking the details of incident settings

The JP1 network management products provide pre-configured standard incident settings usable for operations. In the following procedure, you will view the incident settings provided as standard, and check the basic items.

Procedure

In the Configuration workspace, click Incidents and then SNMP Trap Configurations or Management Event Configurations.
To check the incidents caused by SNMP traps, select SNMP Trap Configurations. To check the incidents detected by NNMi network monitoring, select Management Event Configurations.
Click the row of the incident that you want to check, and then click (Open).
The details of the incident configurations are displayed. As examples, check the following Management Event incidents that are generated when a node goes down.
- NodeDown (The node is down.)
- NodeOrConnectionDown (The node or connection is down.)
The meaning of the incident is displayed in Description.

Result

Check the details of incidents to deepen your understanding. If necessary, configure the incident for an SNMP trap, and set up automatic actions for the incident.

To Page Top

(3) Configuring SNMP trap incidents

Some network devices might provide SNMP trap definitions as an extended MIB file to report the occurrence of a failure by using an SNMP trap. NNMi provides many incident definitions for SNMP traps as standard, but you can also load a vendor-specific extended MIB file for a device such as a network device, and configure incident definitions for SNMP traps that are unique for the device. General MIB files contain MIB definitions and SNMP trap definitions. For details about MIB files for each vendor, see the vendor's manual. Many MIBs have already been loaded during installation of NNMi. You can view a list of loaded MIBs by selecting the Configuration workspace, MIBs, and Loaded MIBs.

Before you begin

To receive an SNMP trap, the following conditions must be met. If the conditions are not met, the trap is discarded.

The incident that corresponds to the SNMP trap is configured. In addition, the Enabled check box is selected.
The source node that issued the SNMP trap is discovered. In addition, the management mode of the node is set to Managed.

For details, see the topic Manage SNMP Traps in the Help for Administer. If you want to receive SNMP traps from a node that has not been discovered, see the topic Manage unresolved incoming SNMP traps in the Help for Administer.

Procedure

Execute the nnmloadmib.ovpl command of NNMi.
Example of specification: nnmloadmib.ovpl -load MIB-file-name

Executing this command loads the contents of the MIB file to NNMi. Specify the MIB file to be loaded for the -load option.
Execute the nnmincidentcfg.ovpl command of NNMi.
Example of specification: nnmincidentcfg.ovpl -loadTraps MIB-module-name

Executing this command creates the incident configuration from the MIB database of NNMi.

Specify the MIB module name defined in the MIB file for the -loadTraps option.
In the Configuration workspace, click Incidents and then SNMP Trap Configurations.
You can check the status of SNMP traps.

Note

You can also use the nnmtrapdump.ovpl command to check the status of SNMP traps.

Example:

nnmtrapdump.ovpl -source IP-address

Executing this command displays traps received from the IP address.

nnmtrapdump.ovpl -t

Executing this command continuously displays received traps. Use the command when you check the configuration.

For details, see the topic SNMP Traps view in the Help for Operators, and information displayed by clicking the Help menu, NNMi Documentation Library, Reference Pages, and nnmtrapdump.ovpl.

Note

To find the MIB module name, open the MIB file, and check the area around the top of the file. The name defined before DEFINITIONS ::= BEGIN is the MIB module name.

Example:

Example of a MIB module name

------ MIB Simple Sample

SAMPLE-MIB DEFINITIONS ::= BEGIN

In this example, the MIB module name is SAMPLE-MIB.

(4) Configuring automatic actions for an incident

If you configure automatic actions for an incident, you can execute a specified command under a specific lifecycle state.

Context

Note: By linking to JP1/IM, you can send an email when a failure occurs and use a signal light.

Procedure

In the Configuration workspace, click Incidents and then SNMP Trap Configurations or Management Event Configurations.
To configure automatic actions for incidents caused by SNMP traps, select SNMP Trap Configurations. To configure automatic actions for incidents detected by NNMi network monitoring, select Management Event Configurations.
Click the row of the incident that you want to configure automatic actions, and then click (Open).
Switch the tab display by clicking , and if the Actions tab is displayed, click it.
Tip
If you want to configure different automatic actions for each node, you can specify conditions for each node by configuring the settings from the following tabs:
- The Actions tab in the Interface Settings tab: You can specify conditions for each interface group.
- The Actions tab in the Node Settings tab: You can specify conditions for each node group.
- The Actions tab: The target is not limited.
The order of priority is the Interface Settings tab, the Node Settings tab, and the general Actions tab, from highest to lowest. Actions are performed only once because the action settings configured from a tab with a higher priority overwrite the settings configured from a tab with a lower priority. Therefore, for example, you can configure automatic actions for all nodes, and then different automatic actions for a specific node group.

For details, see the topic Configure Incidents in the Help for Administer.
Select the Enabled check box.
If you omit this setting, automatic actions are not performed even if an incident occurs.
Set Author to Customer.
The user needs to change the author to Customer before changing incident definitions.
Under Lifecycle Transition Actions on the Actions tab, click (New).
Select the timing for executing automatic actions in Lifecycle State.
Specify the setting as follows, depending on the timing you want to execute automatic actions:
- Registered: When a failure is detected and an incident is issued, an automatic action is executed.
- In Progress: When Lifecycle State becomes In Progress, such as when a person responsible for handling is assigned to an incident, or when an incident is investigated, an automatic action is executed.
- Completed: When handling of the failure is completed and Lifecycle State becomes Completed, an automatic action is executed.
- Closed: When NNMi detects that the failure has been solved and Lifecycle State becomes Closed, an automatic action is executed. For example, if you want a node to link with the report system when the node restarts after recovery, specify Closed.
Select a command type in Command Type.
To specify the Jython command, select Jython. To specify an execution file or a batch file, select ScriptOrExecutable.
Enter a command in Command.
If the command type is ScriptOrExecutable, enter a command that can be executed on the OS, and for which necessary parameters are specified.

Example:

msg.exe Administrator "Incident $name occurred at $sourceNodeName."

For details about how to enter commands whose command type is Jython, see the topic Configure an action for an incident in the Help for Administer.
Click (Save and Close).
In the SNMP Trap Configurations view or Management Event Configurations view, click (Save and Close).
The settings are saved.
Tip
To check the execution status of automatic actions, click the Tools menu and then Incident Actions Log. You can also check the status by using the following log file:
- For Windows
  
  NNMi-installation-data-folder\log\nnm\incidentActions.*.*.log
- For Linux
  
  /var/opt/OV/log/nnm/public/incidentActions.*.*.log
If you fail to select the Enabled check box of the action settings, automatic actions are not executed and the history is not output to the log file. If automatic actions are not performed, make sure that the Enabled check box is selected. For details, see the topic Configure Incidents in the Help for Administer.

Next steps

You have now successfully configured automatic actions for incidents. In the next section, access and configure SSO.