Chapter 13, Alarm Monitoring and Management

This chapter describes Cisco Transport Controller (CTC) alarm management. To troubleshoot specific alarms, refer to the Cisco ONS 15454 Troubleshooting Guide. Chapter topics include:

13.1 Overview

The CTC detects and reports SONET alarms generated by the Cisco ONS 15454 and the larger SONET network. You can use CTC to monitor and manage alarms at the card, node, or network level. Default alarm severities conform to the Telcordia GR-253 standard, but you can set alarm severities in customized alarm profiles or suppress CTC alarm reporting. For a detailed description of the standard Telcordia categories employed by Optical Networking System (ONS) nodes, refer to the Cisco ONS 15454 Troubleshooting Guide.

Note ONS 15454 alarms can also be monitored and managed through Transaction Language One (TL1) or a network management system (NMS).

13.2 Documenting Existing Provisioning

You can use the File > Print or File > Export options to print or export CTC provisioning information for record keeping or troubleshooting. The functions can be performed in card, node, or network views. The File > Print function sends the data to a local or network printer. File > Export exports the data to a file where it can be imported into other computer applications, such as spreadsheets and database management programs.

Whether you choose to print or export data, you can choose from the following options:

•

Entire frame—Prints or exports the entire CTC window including the graphical view of the card, node, or network. This option is available for all windows.

•

Tabbed view—Prints or exports the lower half of the CTC window containing tabs and data. The printout includes the selected tab (on top) and the data shown in the tab window. For example, if you print the History window Tabbed view, you print only history items appearing in the window. This option is available for all windows.

•

Table Contents—Prints or exports CTC data in table format without graphical representations of shelves, cards, or tabs. This option applies to all windows except:

The Table Contents option prints all the data contained in a table with the same column headings. For example, if you print the History window Table Contents view, you print all data included in the table whether or not items appear in the window.

13.3 Viewing Alarm Counts on the LCD for a Node, Slot, or Port

You can view node, slot, or port-level alarm counts and summaries using the buttons on the ONS 15454 LCD panel. The Slot and Port buttons toggle between display types; the Slot button toggles between node display and slot display, and the Port button toggles between slot and port views. Pressing the Status button after you choose the display mode changes the display from alarm count to alarm summary.

The ONS 15454 has a one-button update for some commonly viewed alarm counts. If you press the Slot button once and then wait eight seconds, the display automatically changes from a slot alarm count to a slot alarm summary. If you press the Port button to toggle to port-level display, you can use the Port button to toggle to a specific slot and to view each port's port-level alarm count. Figure 13-1 shows the LCD panel layout.

13.4 Viewing Alarms

You can use the Alarms tab to view card, node, or network-level alarms. The Alarms window shows alarms in conformance with Telcordia GR-253. This means that if a network problem causes two alarms, such as loss of frame (LOF) and loss of signal (LOS), CTC only shows the LOS alarm in this window because it supersedes the LOF and replaces it.

The Path Width column in the Alarms and Conditions tabs expands upon alarmed object information contained in the access identifier (AID) string (such as "STS-4-1-3") by giving the number of STSs contained in the alarmed path. For example, the Path Width will tell you whether a critical alarm applies to an STS1 or an STS48c. The column reports the width as a 1, 3, 6, 12, 48, etc. as appropriate, understood to be "STS-n."

Table 13-1 lists the column headings and the information recorded in each column.

Table 13-1 Alarms Column Descriptions
Column	Information Recorded
Num	Num (number) is the quantity of alarm messages received, and is incremented automatically as alarms occur to display the current total of received error messages. (The column is hidden by default. To view it, right-click a column and choose Show Column.)
Ref	Ref (reference) is a unique identification number assigned to each alarm to reference a specific alarm message that is displayed. (The column is hidden by default. To view it, right-click a column and choose Show Column.)
New	Indicates a new alarm. To change this status, click either the Synchronize button or the Delete Cleared Alarms button.
Date	Date and time of the alarm.
Object	TL1 AID for the alarmed object. For an STSmon or VTmon, this is the monitored STS or VT object.
Eqpt Type	Card type in this slot.
Slot	Slot where the alarm occurred (appears only in network and node view).
Port	Port where the alarm is raised. For STSTerm and VTTerm, the port refers to the upstream card it is partnered with.
Path Width	Indicates how many STSs are contained in the alarmed path. This information complements the alarm object notation, which is explained in the "Alarm Troubleshooting" chapter of the Cisco ONS 15454 Troubleshooting Guide.
Sev	Severity level: CR (Critical), MJ (Major), MN (Minor), NA (Not Alarmed), NR (Not Reported).
ST	Status: R (raised), C (clear).
SA	When checked, indicates a service-affecting alarm.
Cond	The error message/alarm name. These names are alphabetically defined in the "Alarm Troubleshooting" chapter of the Cisco ONS 15454 Troubleshooting Guide.
Description	Description of the alarm.

Table 13-2 lists the color codes for alarm and condition severities. The inherited (I) and unset (U) severities are only listed in the network view Provisioning > Alarm Profiles tab. They are not currently implemented.

Table 13-2 Color Codes for Alarm and Condition Severities
Color	Description
Red	Raised Critical (CR) alarm
Orange	Raised Major (MJ) alarm
Yellow	Raised Minor (MN) alarm
Magenta	Raised Not Alarmed (NA) condition
Blue	Raised Not Reported (NR) condition
White	Cleared (C) alarm or condition

Note Major and Minor alarms may appear yellow in CTC under certain circumstances. This is not due to a CTC problem but to a workstation memory and color utilization problem. For example, a workstation might run out of colors if many color-intensive applications are running. When using Netscape, you can limit the number of colors used by launching it from the command line with either the -install option or the -ncols 32 option.

13.4.1 Viewing Alarms With Each Node's Time Zone

By default, alarms and conditions are displayed with the time stamp of the CTC workstation where you are viewing them. But you can set the node to report alarms (and conditions) using the time zone where the node is located by clicking Edit > Preferences, and clicking the Display Events Using Each Node's Timezone check box.

13.4.2 Controlling Alarm Display

You can control the display of the alarms shown on the Alarms window. Table 13-3 shows the actions you can perform in the Alarms window.

Table 13-3 Alarm Display
Button/Check Box/Tool	Action
Filter button	Allows you to change the display on the Alarms window to show only alarms that meet a certain severity level, occur in a specified time frame, and/or reflect specific conditions. For example, you can set the filter so that only critical alarms display on the window. If you enable the Filter feature by clicking the Filter button in one CTC view, such as node view, it is enabled in the others as well (card view and network view).
Synchronize button	Updates the alarm display. Although CTC displays alarms in real time, the Synchronize button allows you to verify the alarm display. This is particularly useful during provisioning or troubleshooting.
Delete Cleared Alarms button	Deletes alarms that have been cleared.
AutoDelete Cleared Alarms check box	If checked, CTC automatically deletes cleared alarms.
Filter tool	Enables or disables alarm filtering in the card, node, or network view. When enabled or disabled, this state applies to other views for that node and for all other nodes in the network. For example, if the Filter tool is enabled in the node (default login) view Alarms window, the network view Alarms window and card view Alarms window also show the tool enabled. All other nodes in the network also show the tool enabled.

13.4.3 Filtering Alarms

The alarm display can be filtered to prevent display of alarms with certain severities or alarms that occurred between certain dates. You can set the filtering parameters by clicking the Filter button at the bottom-left of the Alarms window. You can turn the filter on or off by clicking the Filter tool at the bottom-right of the window. CTC retains your filter activation setting. For example, if you turn the filter on and then log out, CTC keeps the filter active the next time you log in.

13.4.4 Viewing Alarm-Affected Circuits

A user can view which ONS 15454 circuits are affected by a specific alarm by positioning the cursor over the alarm in the Alarm window and right-clicking. A shortcut menu appears ( Figure 13-2). When the user selects the Select Affected Circuits option, the Circuits window opens to show the circuits that are affected by the alarm ( Figure 13-3).

13.4.5 Conditions Tab

The Conditions window displays retrieved fault conditions. A condition is a fault or status detected by ONS 15454 hardware or software. When a condition occurs and continues for a minimum period, CTC raises a condition, which is a flag showing that this particular condition currently exists on the ONS 15454.

The Conditions window shows all conditions that occur, including those that are superseded. For instance, if a network problem causes two alarms, such as LOF and LOS, CTC shows both the LOF and LOS conditions in this window (even though LOS supersedes LOF). Having all conditions visible can be helpful when troubleshooting the ONS 15454. If you want to retrieve conditions that obey a root-cause hierarchy (that is, LOS supersedes and replaces LOF), you can exclude the same root causes by checking a check box in the window.

Fault conditions include reported alarms and Not Reported or Not Alarmed conditions. Refer to the trouble notifications information in the Cisco ONS 15454 Troubleshooting Guide for more information about alarm and condition classifications.

13.4.6 Controlling the Conditions Display

You can control the display of the conditions on the Conditions window. Table 13-4 shows the actions you can perform in the window.

Table 13-4 Conditions Display
Button	Action
Retrieve	Retrieves the current set of all existing fault conditions, as maintained by the alarm manager, from the ONS 15454.
Filter	Allows you to change the Conditions window display to only show the conditions that meet a certain severity level or occur in a specified time. For example, you can set the filter so that only critical conditions display on the window. There is a Filter button on the lower-right of the window that allows you to enable or disable the filter feature.
Exclude Same Root Cause	Retrieves conditions that obey a root-cause hierarchy (for example, LOS supersedes and replaces LOF).

13.4.6.1 Retrieving and Displaying Conditions

The current set of all existing conditions maintained by the alarm manager can be seen when you click the Retrieve button. The set of conditions retrieved is relative to the view. For example, if you click the button while displaying the node view, node-specific conditions are displayed. If you click the button while displaying the network view, all conditions for the network (including ONS 15454 nodes and other connected nodes) are displayed, and the card view shows only card-specific conditions.

You can also set a node to display conditions using the time zone where the node is located, rather than the time zone of the PC where they are being viewed. See the "Viewing Alarms With Each Node's Time Zone" section for more information.

13.4.6.2 Conditions Column Descriptions

Table 13-5 lists the Conditions window column headings and the information recorded in each column.

Table 13-5 Conditions Column Description
Column	Information Recorded
Date	Date and time of the condition.
Object	TL1 AID for the condition object. For an STSmon or VTmon, the object.
Eqpt Type	Card type in this slot.
Slot	Slot where the condition occurred (appears only in network and node view).
Port	Port where the condition occurred. For STSTerm and VTTerm, the port refers to the upstream card it is partnered with.
Path Width	Width of the data path
Sev¹	Severity level: CR (Critical), MJ (Major), MN (Minor), NA (Not Alarmed), NR (Not Reported).
SA 1	Indicates a service-affecting alarm (when checked).
Cond	The error message/alarm name; these names are alphabetically defined in the "Alarm Troubleshooting" chapter of the Cisco ONS 15454 Troubleshooting Guide.
Description	Description of the condition.

¹All alarms, their severities, and service-affecting statuses are also displayed in the Condition tab unless you choose to filter the alarm from the display using the Filter button.

13.4.6.3 Filtering Conditions

The condition display can be filtered to prevent display of conditions (including alarms) with certain severities or that occurred between certain dates. You can set the filtering parameters by clicking the Filter button at the bottom-left of the Conditions window. You can turn the filter on or off by clicking the Filter tool at the bottom-right of the window. CTC retains your filter activation setting. For example, if you turn the filter on and then log out, CTC keeps the filter active the next time your user ID is activated.

13.4.7 Viewing History

The History window displays historic alarm or condition data for the node or for your login session. You can chose to display only alarm history, only events, or both by checking check boxes in the History > Node window. You can view network-level alarm and condition history, such as for circuits, at that level. At the node level, you can see all port (facility), card, STS, and system-level history entries. For example, protection-switching events or performance-monitoring threshold crossings appear here. If you double-click a card, you can view all port, card, and STS alarm or condition history that directly affects the card.

The ONS 15454 can store up to 640 critical alarm messages, 640 major alarm messages, 640 minor alarm messages, and 640 condition messages. When any of these limits is reached, the ONS 15454 discards the oldest events in that category.

Note In the Preference dialog General tab, the Maximum History Entries value only applies to the Session window.

•

The History > Session window is shown in network view, node view, and card view. It shows alarms and conditions that occurred during the current user CTC session.

•

The History > Node window is only shown in node view. It shows the alarms and conditions that occurred on the node since CTC software was operated on the node.

•

The History > Card window is only shown in card view. It shows the alarms and conditions that occurred on the card since CTC software was installed on the node.

Tip

Double-click an alarm in the History window to display the corresponding view. For example, double-clicking a card alarm takes you to card view. In network view, double-clicking a node alarm takes you to node view.

If you check the History window Alarms check box, you display the node history of alarms. If you check the Events check box, you display the node history of Not Alarmed and transient events (conditions). If you check both check boxes, you retrieve node history for both.

13.4.7.1 History Column Descriptions

Table 13-6 lists the History window column headings and the information recorded in each column.

Table 13-6 History Column Description
Column	Information Recorded
Num	An incrementing count of alarm or condition messages. (The column is hidden by default; to view it, right-click a column and choose Show Column > Num.)
Ref	The reference number assigned to the alarm or condition. (The column is hidden by default; to view it, right-click a column and choose Show Column > Ref.)
Date	Date and time of the condition.
Object	TL1 AID for the condition object. For an STSmon or VTmon, the object.
Slot	Slot where the condition occurred (only displays in network view and node view).
Port	Port where the condition occurred. For STSTerm and VTTerm, the port refers to the upstream card it is partnered with.
Path Width	Width of the data path
Sev	Severity level: Critical (CR), Major (MJ), Minor (MN), Not Alarmed (NA), Not Reported (NR).
ST	Status: raised (R), cleared (C), or transient (T).
SA	Indicates a service-affecting alarm (when checked).
Cond	Condition name.
Description	Description of the condition.
Eqpt Type	Card type in this slot.

13.4.7.2 Retrieving and Displaying Alarm and Condition History

You can retrieve and view the history of alarms and conditions, as well as transients (passing notifications of processes as they occur) in the CTC history window. The information in this window is specific to the view where it is shown (that is, network history in the network view, node history in the node view, and card history in the card view).

The node and card history views are each divided into two tabs. In node view, when you click the Retrieve button, you can see the history of alarms, conditions, and transients that have occurred on the node in the History > Node window, and the history of alarms, conditions, and transients that have occurred on the node during your login session in the History > Session window. In the card-view history window, after you retrieve the card history, you can see the history of alarms, conditions, and transients on the card in the History > Card window, or a history of alarms, conditions, and transients that have occurred during your login session in the History > Session window. You can also filter the severities and occurrence period in these history windows.

13.5 Alarm Severities

ONS 15454 alarm severities follow the Telcordia GR-253 standard, so a condition might be Alarmed (at a severity of Critical [CR], Major [MJ], or Minor [MN]), Not Alarmed (NA), or Not Reported (NR). These severities are reported in the CTC software Alarms, Conditions, and History windows at all levels: network, shelf, and card.

ONS equipment provides a standard profile named Default listing all alarms and conditions with severity settings based on Telcordia GR-253 and other standards, but users can create their own profiles with different settings for some or all conditions and apply these wherever desired. (See the "Alarm Profiles" section.) For example, in a custom alarm profile, the default severity of a carrier loss (CARLOSS) alarm on an Ethernet port could be changed from major to critical. The profile allows setting to Not Reported or Not Alarmed, as well as the three alarmed severities.

Critical and Major severities are only used for service-affecting alarms. If a condition is set as Critical or Major by profile, it will raise as Minor alarm in the following situations:

•

In a protection group, if the alarm is on a standby entity (side not carrying traffic)

•

If the alarmed entity has no traffic provisioned on it, so no service is lost

Because of this possibility of being raised at two different levels, the alarm profile pane shows Critical as CR / MN and Major as MJ / MN.

13.6 Alarm Profiles

The alarm profiles feature allows you to change default alarm severities by creating unique alarm profiles for individual ONS 15454 ports, cards, or nodes. A created alarm profile can be applied to any node on the network. Alarm profiles can be saved to a file and imported elsewhere in the network, but the profile must be stored locally on a node before it can be applied to the node, its cards, or its cards' ports.

CTC can store up to ten active alarm profiles at any time to apply to the node. Custom profiles can take eight of these active profile positions. Two other profiles, Default profile and Inherited profile, are reserved by the NE, and cannot be edited.The reserved Default profile contains Telcordia GR-253 severities. The reserved Inherited profile allows port alarm severities to be governed by the card-level severities, or card alarm severities to be determined by the node-level severities.

If one or more alarm profiles have been stored as files from elsewhere in the network onto the local PC or server hard drive where CTC resides, you can utilize as many profiles as you can physically store by deleting and replacing them locally in CTC so that only eight are active at any given time.

13.6.1 Creating and Modifying Alarm Profiles

Alarm profiles are created in the network view using the Provisioning > Alarm Profiles tabs. Figure 13-4 shows the default list of alarm severities. A default alarm severity following Telcordia GR-253 standards is preprovisioned for every alarm. After loading the default profile or another profile on the node, you can clone a profile to create custom profiles. After the new profile is created, the Alarm Profiles window shows the original profile (frequently Default) and the new profile.

The alarm profile list contains a master list of alarms that is used for a mixed node network. Some of these alarms might not be used in all ONS nodes.

Tip

To see the full list of profiles including those available for loading or cloning, click the Available button. You must load a profile before you can clone it.

Note Up to 10 profiles, including the two reserved profiles (Inherited and Default) can be stored in CTC.

Wherever it is applied, the Default alarm profile sets severities to standard Telcordia GR-253 settings. In the Inherited profile, alarms inherit, or copy, severity from the next-highest level. For example, a card with an Inherited alarm profile copies the severities used by the node housing the card. If you choose the Inherited profile from the network view, the severities at the lower levels (node and card) are copied from this selection.

You do not have to apply a single severity profile to the node, card, and port alarms. Different profiles can be applied at different levels. You could use the inherited or default profile on a node and on all cards and ports, but apply a custom profile that downgrades an alarm on one particular card. For example, you might choose to downgrade an OC-N unequipped path alarm (UNEQ-P) from Critical (CR) to Not Alarmed (NA) on an optical card because this alarm raises and then clears every time you create a circuit. UNEQ-P alarms for the card with the custom profile would not display on the Alarms tab. (But they would still be recorded on the Conditions and History tabs.)

•

All Critical (CR) or Major (MJ) default or user-defined severity settings are demoted to Minor (MN) in Non-Service-Affecting (NSA) situations as defined in Telcordia GR-474.

•

Default severities are used for all alarms and conditions until you create a new profile and apply it.

The Load and Store buttons are not available for Retrieve and Maintenance users.

The Delete and Store options will only display nodes to delete profiles from or store profiles to if the user has provisioning permission for those nodes. If the user does not have the proper permissions, CTC greys out the buttons and they are not available to the user.

13.6.2 Alarm Profile Buttons

The Alarm Profiles window displays six buttons at the bottom of the window. Table 13-7 lists and describes each of the alarm profile buttons and their functions.

Table 13-7 Alarm Profile Buttons
Button	Description
New	Creates a new profile.
Load	Loads a profile to a node or a file.
Store	Saves profiles on a node (or nodes) or in a file.
Delete	Deletes profiles from a node.
Compare	Displays differences between alarm profiles (for example, individual alarms that are not configured equivalently between profiles).
Available	Displays all profiles available on each node.
Usage	Displays all entities (nodes and alarm subjects) present in the network and which profiles contain the alarm. Can be printed.

13.6.3 Alarm Profile Editing

Table 13-8 lists and describes the five profile-editing options available when you right-click an alarm item in the profile column (such as Default).

Table 13-8 Alarm Profile Editing Options
Button	Description
Store	Saves a profile in a node or in a file.
Rename	Changes a profile name.
Clone	Creates a profile that contains the same alarm severity settings as the profile being cloned.
Reset	Restores a profile to its previous state or to the original state (if it has not yet been applied).
Remove	Removes a profile from the table editor.

13.6.4 Alarm Severity Options

To change or assign alarm severity, left-click the alarm severity you want to change in the alarm profile column. Seven severity levels appear for the alarm:

Inherited and Use Default severity levels only appear in alarm profiles. They do not appear when you view alarms, history, or conditions.

13.6.5 Row Display Options

The Alarm Profiles window (from network view) or the Alarm Profile Editor (from node view) displays three check boxes at the bottom of the window:

•

Only show service-affecting severities—If unchecked, the editor shows severities in the format <sev1>/<sev2> where <sev1> is a service-affecting severity and <sev2> is not service-affecting. If checked, the editor only shows <sev1> alarms.

•

Hide reference values—Highlights alarms with non-default severities by clearing alarm cells with default severities.

•

Hide identical rows—Hides rows of alarms that contain the same severity for each profile.

13.6.6 Applying Alarm Profiles

In CTC node view, the Alarm Behavior window displays alarm profiles for the node. In card view, the Alarm Behavior window displays the alarm profiles for the selected card. Alarm profiles form a hierarchy. A node-level alarm profile applies to all cards in the node except cards that have their own profiles. A card-level alarm profile applies to all ports on the card except ports that have their own profiles.

At the node level, you can apply profile changes on a card-by-card basis or set a profile for the entire node. At the card-level view, you can apply profile changes on a port-by-port basis or set alarm profiles for all ports on that card. Figure 13-5 shows the E1000-2-G card view of an alarm profile.

13.7 Suppressing Alarms

ONS 15454 nodes have an alarm suppression option that clears raised alarm messages for the node, chassis, one or more slots (cards), or one or more ports. After they are cleared, these alarms change appearance from their normal severity color to white and they can be cleared from the display by clicking Synchronize. Alarm suppression itself raises the alarms suppressed by user (AS-CMD) condition that is shown in applicable Alarms windows. Node-level suppression is shown in the node view Alarms window, and card or port-level suppression is shown in all views. The AS-CMD alarm itself is not cleared by the suppress command. Each instance of this alarm indicates its object separately in the Object column.

A suppression command applied at a higher level does not supersede a command applied at a lower level. For example, applying a node-level alarm suppression command makes all raised alarms for the node appear to be cleared, but it does not cancel out card-level or port-level suppression. Each of these conditions can exist independently and must be cleared independently.

Suppression causes the entity alarm to behave like a Not Reported event. This means that the alarms, having been suppressed from view in the Alarms window, are now only shown in the Conditions window. The suppressed alarms are displayed with their usual visual characteristics (service-affecting status and color-coding) in the window. The alarms still appear in the History window.

Note Use alarm suppression with caution. If multiple CTC or TL1 sessions are open, suppressing the alarms in one session suppresses the alarms in all other open sessions.

13.8 Provisioning External Alarms and Controls

External alarm inputs can be provisioned on the Alarm Interface Controller (AIC) or Alarm Interface Controller-International (AIC-I) cards for external sensors such as an open door and flood sensors, temperature sensors, and other environmental conditions. External control outputs on these two cards allow you to drive external visual or audible devices such as bells and lights. They can control other devices such as generators, heaters, and fans.

You provision external alarms in the AIC card view Provisioning > External Alarms tab and controls in the AIC card view Provisioning > External Controls tab. Up to 4 external alarm inputs and four external controls are available with the AIC card. Up to 12 external alarm inputs and four external controls are available with the AIC-I card. If you also provision the alarm extension panel (AEP) with the AIC-I, there are 32 inputs and 16 outputs.

13.8.1 External Alarms

You can provision each alarm input separately. Provisionable characteristics of external alarm inputs include:

•

Raised When—Open means that the normal condition is to not have current flowing through the contact, and the alarm is generated when current does flow; closed means that the normal condition is to have current flowing through the contact, and the alarm is generated when current stops flowing.

Note

If you provision an external alarm to raise upon an open contact before you physically connect to the ONS equipment, the alarm will raise until you do create the physical connection.

Note

When you provision an external alarm, the alarm object is ENV-IN-nn. The variable nn refers to the external alarm's number, regardless of the name you assign.

13.8.2 External Controls

You can provision each alarm output separately. Provisionable characteristics of alarm outputs include:

•

Closure setting (manually or by trigger). If you provision the output closure to be triggered, the following characteristics can be used as triggers:

–

Local NE alarm severity—A chosen alarm severity (for example, major) and any higher-severity alarm (in this case, critical) causes output closure.

–

Remote NE alarm severity—Similar to local NE alarm severity trigger setting, but applies to remote alarms.

–

Virtual wire entities—You can provision an alarm that is input to a virtual wire to trigger an external control output.

13.9 Audit Trail

The Cisco ONS 15454 maintains a Telcordia GR-839-CORE-compliant audit trail log that resides on the TCC2/TCC2P. This record shows who has accessed the system and what operations were performed during a given period of time. The log includes authorized Cisco logins and logouts using the operating system command line interface, Cisco Transport Controller (CTC), and TL1; the log also includes FTP actions, circuit creation/deletion, and user/system generated actions.

Event monitoring is also recorded in the audit log. An event is defined as the change in status of an element within the network. External events, internal events, attribute changes, and software upload/download activities are recorded in the audit trail.

Audit trails are useful for maintaining security, recovering lost transactions, and enforcing accountability. Accountability refers to tracing user activities; that is, associating a process or action with a specific user. To view the Audit Trail log, refer to the Cisco ONS 15454 Procedure Guide. Users can access the audit trail logs from any management interface (CTC, CTM, TL1).

The audit trail is stored in persistent memory and is not corrupted by processor switches, resets or upgrades. However, if a user pulls both TCC2/TCC2P cards, the audit trail log is lost.

13.9.1 Audit Trail Log Entries

•

Task—Name of the task involved in the activity (view a dialog box, apply configuration, etc.)

•

Status—Status of the user action (Read, Initial, Successful, Timeout, Failed)

13.9.2 Audit Trail Capacities

The system is able to store 640 log entries.When this limit is reached, the oldest entries are overwritten with new events. When the log server is 80 percent full, an AUD-LOG-LOW condition is raised and logged (by way of CORBA/CTC).

When the log server reaches a maximum capacity of 640 entries and begins overwriting records that were not archived, an AUD-LOG-LOSS condition is raised and logged. This event indicates that audit trail records have been lost. Until the user off-loads the file, this event occurs only once regardless of the amount of entries that are overwritten by the system. To export the Audit Trail log, refer to the Cisco ONS 15454 Procedure Guide.

Table Of Contents

Alarm Monitoring and Management