Net Inspector Client lets you find those alarms or events that match the user-specified search filter. Search filters are configured in the same manner as display filters.
Search results are displayed in a separate tab in the Events window. The list of alarms produced by the search operation does not change over time (i.e., alarms are not automatically added to or removed from the list once the Find operation is finished).
Furthermore, found alarms cannot be managed (acknowledged, unacknowledged, manually cleared, etc.).
To find alarms that match the specified search filter, proceed as follows:
1. Select the Event / Find Events command or click the Find Events button in the Events window to open the Find Events dialog box (Figure 54).
Note: For detailed description of the Find Events dialog box, please consult the Net Inspector Client Reference Manual.
Figure 54: Find Events dialog box
2. Into the Name input line, enter the name of the Events window tab to display the search results in.
70 3. From the Time frame drop-down list select the time period for the search
operation (i.e., Today, This week, This month, User defined). The search operation will look only for those alarms/events that have been triggered within the specified time frame.
4. The From and To input lines display the start and end date and time for the search operation, depending on the entry selected in the Time frame drop-down list. If you have selected the “User defined” option in the Time frame drop-down list, you can specify arbitrary time frame for the search operation by entering the start and end date and time into the From and To input lines. The search operation will look only for those alarms/events that have been triggered within the specified time frame. The From an To date and time values are formatted according to the setting of the Date/Time format parameter in the User Preferences dialog box.
5. In the Search in section click the Active Alarms radio button (to search among active alarms only) or the All Alarms radio button (to search among all alarms:
active and cleared).
Note: The Events radio button lets you search for events which trigger, change and clear alarms. For more information about events, please see the Inspector Client Reference Manual.
6. In the New Condition toolbar, select the desired values from the Condition type, Operator, and Value drop-down lists to create a filter condition. You can select among the following options:
Severity
Specifies the severity level of the alarm. If this condition type is selected, you can choose the alarm severity level from the Value drop-down list (e.g.
“Critical”, “Major”, etc.).
Source
Uniquely identifies the object, which has triggered the alarm. If this type of condition is selected, click the (…) Browse button next to the Value field to open the Select Source dialog box. The Select Source dialog box displays two panels; the left panel contains the expandable map tree, while the panel on the right displays all objects included in the map that is selected in the left panel.
The left panel also displays some properties of the listed objects, including their unique object IDs. To select a Source object, click the relevant map in the left panel, choose the object on the right panel and click the Select button.
Alternatively, you can select one or more objects in the Maps window and then open the Find Events dialog box. This will automatically create filter conditions for selected source objects.
Source name
Specifies the name of the object (as displayed on the workspace), which has triggered the alarm. If this condition type is selected, you can enter the name of the object into the Value input line. Note, however, that two or more objects can have the same name. Use the Source condition type to uniquely specify the source in such case.
Source info
Specifies additional information about the problem (as displayed in the Source Info column in the Events window). If this condition type is selected,
71 you can enter additional informational about the object into the Value input line (e.g., “Processor:#1”).
Source type
Specifies the type of the object, which has triggered the alarm. If this condition type is selected, you can choose the type of the object from the Value drop-down list (e.g. “IP”, etc.).
Message
A short description of the alarm. If this condition type and the operator “is” or “is not” is selected, you can choose a message from the list of all messages in the Value drop-down list (e.g. “Device is down”). If this condition type and the operator “contains” is selected, you can enter a text string (e.g., “Dev”) into the Value input line to find all alarms whose message field contains the specified character(s).
Cause
Specifies the cause of the alarm. If this condition type is selected, you can choose a cause from the Value drop-down list (e.g. “Lan Error”).
Type
Specifies the type of the alarm. If this condition type is selected, you can choose an alarm type from the Value drop-down list (e.g. “Communication”).
Event state
Specifies the state of the alarm or event. If this condition type is selected, you can choose an event or alarm state from the Value drop-down list (e.g.
“ACKNOWLEDGED” or “MANUALLY CLEARED” or “UNCLEARED”, etc.).
(Un)Acknowledge time
Specifies the date and time of acknowledging or unacknowledging the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., “Sep 12, 2008 12:45:12 PM”).
(Un)Clear time
Specifies the date and time of clearing or unclearing the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., “Sep 12, 2008 12:45:12 PM”).
Event state info
Specifies who has changed the state of the alarm or event as last. This can be either a user that has managed alarm (e.g., acknowledged, unacknowledged, manually cleared, uncleared) or the “Auto” if the alarm has been automatically cleared by the system. When specifying a user, you can also specify the location (IP address) of the user who has managed the alarm in square brackets (e.g., operator [192.168.10.120]). If this condition type is selected, you can enter an event state info into the Value input line (e.g. “admin [192.168.10.123]” or “Auto”, etc.).
7. After you have selected the desired entries from the Condition type, Operator, and Value drop-down lists, click the Add button to add the condition to the Filter.
The added condition will appear in the central section of the dialog box (Conditions panel).
8. Repeat steps 6-7 above to add additional conditions to the search filter.
72
Note 1: If you add two or more conditions of the same type (e.g., Severity=Critical and Severity=Major), these conditions will be combined with the logical OR operator, whereas conditions of different types (e.g., Severity=Critical and Message=Device is down) are combined with the logical AND operator.
Note 2: For more information on creating search filters, please refer to the Net Inspector Client Reference Manual, section Find Events dialog box.
9. To remove a condition from the filter, select it and click the Remove button.
10. When you have added all filter conditions to the filter, click the Find button to start the search operation.
11. Search results are displayed in a new tab in the Events window (Figure 55). The search progress bar at the bottom of this tab moves from left to right and vice-versa, until the search operation is finished. To abort the search operation, click the Abort button in the Events window.
Figure 55: Viewing results of the search operation in the Events window
Tip 1: To find alarms for particular objects only, select those objects in the Maps window and use the Alarms / Find Alarms pop-up command. This will open the Find Events dialog box and automatically insert the appropriate Source type of condition(s) into it in order to restrict the search operation to the selected object(s). You can then add additional conditions to the Find Events dialog box by following the procedure described above.
Tip 2: To modify the search conditions after the search operation has been started, select the tab in the Events window where the results of this search operation are displayed and use the Events / Modify Filter command. The Find Events dialog box will reappear listing all the conditions that were used in the initial/previous search operation. After modifying the search conditions, click the Find button again. The old research results will be deleted and the new search results will be displayed in the same tab of the Events window.
Tip 3: To save the search filter, use the Event / Save Filter command and enter a meaningful name for the filter into the dialog box that appears. Saved filters can later be opened and applied using the Event / Load Filter command.
Tip 4: To remove a tab from the Events window, right click the tab symbol at the bottom of the Events window and select the Close [tab name] pop-up command.
73
8 MONITORING ALARMS AND STATUS OF MANAGED OBJECTS IN MAPS AND EXPLORER WINDOWS
In addition to the Events window, information about active alarms is displayed in the Maps and Explorer windows as well. Furthermore, the Maps and Explorer windows provide also information about the current status of objects.
The Maps window can display managed objects, system objects, action objects and submaps either by means of icons (Graphics view) or by means of a table (Details view). The Graphics view provides information about active alarms in alarm balloons above the icons and in alarm rectangles displayed on the icons that represent objects and submaps. The Details view displays information about active alarms on objects and submaps in the Alarms and New Alarms columns. Both views display also the information about the current status of objects.
The Explorer window displays the Net Inspector workspace structure, i.e., all user views assigned to the user and the hierarchical tree-like structures of maps and submaps within user views. Maps contain zero or more objects, submaps, and graphic elements (lines, connections, rectangles, bitmaps, etc.). The Explorer window is used for displaying the contents of maps in the Maps window and for switching between user views. Besides, the Explorer window is used also for configuring and monitoring the object status and alarm propagation.
This section describes the principle of monitoring active alarms and object statuses in the Maps and Explorer windows.