Procurve Switch Fault Detection not showing in IMC but ports going offline do.

[edm101]

We have long relied on the fault detection logs that Procurve switches create. 

For example all of our switches are set to "Fault Detection: High Sensitivity (Recommended)" and display messages ssages like:

  Too Many Undersized/Giant Packets on port B8

  Excessive CRC/Alignment Errors on port A9

I would have thought that gathering this information from our 100+ procurve switches would have been default behavior for IMC 5.1 but I can't see anywhere that this is displayed or even how to turn it on.  Can anyone help?

Instead by default it creates major alarms when ports go out of service.  Of course devices get unplugged all day every day.  I  can't see where to turn that off.  I want to know when there are CRC errors, duplex mismatches etc but don't really care about ports going offline!

[LindsayHill]

Check the video from @netmanchris on filtering interface alarms:

http://www.youtube.com/watch?v=u2n9YYwx8iw&feature=plcp

You might want to look at some of the other videos there too - he puts up lots of useful 'how-tos'

http://www.youtube.com/theimcmanagement

Regards the logs, are you sending syslogs to the iMC server?

[ctsib]

How can I see in IMC 5.1 the same error log with the Web interface instance?

In IMC, in System->System Configuration->System Settings-> Interface Up/Down Alarm, I have no filter in PC connected link, server connected link and disconnected link.

In IMC, in System ->System Configuration->Default Monitor Indexes, I have choose the whole tree of

Device Defect, Device Traffic, Interface Statistics, Other Interface Statistics, Others

I monitor only the up interfaces, connected to SNMP, Servers and PCs

I am experience the following issue:

In Web interface of the 4208vl switch I see “Excessive CRC/alignment errors”

But In IMC Alarm I see: “the interface is down” and “the interface is up”

In Web interface of the 4208vl switch I see “High collision or drop rate on port A5”

But In IMC Alarm I see: “the interface A5 is down” and “the interface A5 is up”

In Web interface of the 4208vl switch I see “Excessive broadcasts on port A5”

But In IMC Alarm I see: “the interface A5 is down” and “the interface A5 is up”

How can I see in IMC 5.1 the same error logs with the Web interface instance?

Thank you.

[Peter_Debruyne]

Hi,

You should configure IMC as the snmp trap receiver and syslog destination.

Most SNMP traps will be picked up by IMC as alerts, for the syslog messages you should create a custom rule to promote the syslog events to alerts.

The Video links from the other post are really useful on this subject,

best regards,Peter

[ctsib]

Dear Peter,

During the Auto Discovery of the resources, IMC server has been registered as snmp trap receiver and syslog destination (see below the switch commands),

    snmp-server community "public33" Unrestricted

    snmp-server host 192.168.1.33 "public33" (The ip of the IMC server)

The IMC server can accept syslog traps (automatically configured by the installation). That’s why I receive all these alarms (and much more)!

But for some reasons I get a global description for the problem (link up and down) or, I do not get the correct message!! ??!! In either way, I get more info according this problem, from the Web Interface and not the IMC !!

I saw the videos, they are very nice, but I couldn’t find any answer according the above problem.

How can I see in IMC the same error log (same description) with the Web interface instance?

Do I miss something?

Thank you

[LindsayHill]

Those are two different alarms - it's not that you're getting the wrong description ("Interface down") for an alarm, it sounds more like you're not getting the ("Excessive CRC") type messages.

I don't know how the switch generates those messages in the web interface. Are they in syslog? If they are, they should be on the IMC server, but it may not be escalating those syslog messages to alarms.

On the IMC server, browse the Traps, and the Syslogs - see if you see your messages in there.