List of events in Entuity – Entuity

This article lists the events in the latest version of Entuity (v22.0).

RESTful API:

Please see the following for help and information on event functionality in Entuity RESTful API:

Access Point Came Up

Parent incident:

Event ID: 1102

Default severity level: information

Access Point Went Down

Parent incident:

Event ID: 1103

Default severity level: major

ACI Cluster Event

Parent incident:

Event ID: 1296

Default severity level: severe

ACI Cluster Fault

Parent incident:

Event ID: 1297

Default severity level: severe

ACI Cluster Fault Cleared

Parent incident:

Event ID: 1298

Default severity level: information

ACI Event

Parent incident:

Event ID: 1221

Default severity level: severe

ACI Fault

Parent incident: ACI Fault incident

Event ID: 1151

Default severity level: severe

ACI Fault Cleared

Parent incident: ACI Fault incident

Event ID: 1152

Default severity level: information

Action Required: Upcoming Firewall Information Change

Parent incident:

Event ID: 1150

Default severity level: minor

Air Marshal - Rogue AP Detected

Parent incident:

Event ID: 1104

Default severity level: major

AP Active Controller Change

Parent incident: AP Controller Change incident

Event ID: 825

Default severity level: information

AP Antenna Channel Change Frequency High

Parent incident: AP Antenna Channel Change Frequency Hight incident

Event ID: 842

Description	Default severity level	Typical causes	Actions
automatic configuration change volatility indicates a trouble spot location.	minor	a high frequency of channel change indicates a transmission problem. A change in the antenna's local environment impacts its effectiveness on the current channel, causing it to switch to another channel. Practically, any appliance that operates on the same frequency level (2.4GHz) as 802.11b or 802.11g can cause interference with your wireless network.	keep cordless phones and other electrical equipment at least one meter away from the access point. You can check the AP Advanced tab to review the antenna's current physical channel number and its history.

AP Antenna Channel Change Frequency High Cleared

Parent incident: AP Antenna Channel Change Frequency Hight incident

Event ID: 843

Description	Default severity level	Typical causes	Actions
the clearing correlation event for AP's AP Antenna Channel Change Frequency High event.	information	automatic configuration change volatility that indicated a trouble spot location has been resolved.	none.

AP Antenna Host Count High

Parent incident: AP Antenna Host Count Abnormality incident

Event ID: 804

Description	Default severity level	Typical causes	Actions
for each AWAP antenna, you can set the number of hosts that would impact performance when attached to an antenna. Threshold hierarchy can be set at global, AWAP and antenna levels.	minor	changes in wireless usage have occurred since the network was designed.	through the AWAP Advanced tab, you can review the hourly and daily mean and maximum attached host values. When the historic record indicates a rising usage trend, you may want to extend the capabilities of your wireless network.

AP Antenna Host Count High Cleared

Parent incident: AP Antenna Host Count Abnormality incident

Event ID: 805

Description	Default severity level	Typical causes	Actions
raised when the number of hosts attached to the AWAP antenna has returned to an acceptable level.	information	the managed object's performance is now within the set thresholds.	none.

AP Antenna Host Count Low

Parent incident: AP Antenna Host Count Abnormality incident

Event ID: 806

Description	Default severity level	Typical causes	Actions
the number of hosts attached to the antenna has fallen below the set threshold. This can be set at the global, AWAP and antenna level. By default, the threshold is set to 0, and disabled.	minor	changes in wireless usage have occurred since the network was designed.	check the Interface Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a falling usage trend, you may want to adjust the capabilities of your wireless network.

AP Antenna Host Count Low Cleared

Parent incident: AP Antenna Host Count Abnormality incident

Event ID: 807

Description	Default severity level	Typical causes	Actions
the number of hosts attached to the AWAP antenna has returned to an acceptable level.	information	the managed object's performance is now within the set thresholds.	none.

AP Antenna Offline

Parent incident: AP Antenna Offline incident

Event ID: 846

Description	Default severity level	Typical causes	Actions
Entuity has observed that a AP that was administratively up and operationally up, has now transitioned into the administratively up and operationally down state.	minor	a problem has occurred on the antenna.	investigate the history of the antenna's performance.

AP Antenna Online

Parent incident: AP Antenna Offline incident

Event ID: 847

Description	Default severity level	Typical causes	Actions
the clearing correlation event for AP's AP Antenna Offline event.	information	Entuity has observed that a AP that was administratively up and operationally down, has now transitioned into the administratively up and operationally up state.	none.

AP Antenna Power Change Frequency High

Parent incident: AP Antenna Power Change Frequency High incident

Event ID: 840

Description	Default severity level	Typical causes	Actions
AP antenna power changes more frequently than the set threshold during the polling interval. By default, the frequency is set to three and enabled.	minor	automatic configuration is set to too small an interval.	review the AP antenna power change history. Frequent changes may indicate an unstable local environment.

AP Antenna Power Change Frequency High Cleared

Parent incident: AP Antenna Power Change Frequency High incident

Event ID: 841

Description	Default severity level	Typical causes	Actions
the clearing correlation event for AP Antenna Power Change Frequency High event.	information	the number of hosts attached to the antenna has returned to an acceptable level.	none.

AP Associated With Controller

Parent incident: AP Not Associated With Controller incident

Event ID: 845

Description	Default severity level	Typical causes	Actions
indicates the AP has transitioned to another wireless controller.	minor	the wireless controller has gone down and its APs have been automatically assigned to another one. The AP has been manually reassigned.	investigate the status of the wireless controller.

AP Association With Controllers Degraded

Parent incident: AP Association With Controller Degraded incident

Event ID: 830

Default severity: minor

AP Host Count High

Parent incident: AP Host Count Abnormality incident

Event ID: 832

Description	Default severity level	Typical causes	Actions
the combined count of hosts that are wirelessly associated with all the antennas on a AP has dropped below a selectable threshold. The threshold hierarchy will cover the global, wireless controller and AP levels, and by default will be disabled but set to 0.	minor	changes in wireless usage have occurred since the network was designed.	check the AP Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a rising usage trend, you may want to extend the capabilities of your wireless network.

AP Host Count High Cleared

Parent incident: AP Host Count Abnormality incident

Event ID: 833

Description	Default severity level	Typical causes	Actions
the clearing correlation event for AP Host Count High event.	information	the sum number of hosts attached to the AP's antennas has returned to an acceptable level.	none.

AP Host Count Low

Parent incident: AP Host Count Abnormality incident

Event ID: 834

Default severity level:minor

AP Host Count Low Cleared

Parent incident: AP Host Count Abnormality incident

Event ID: 835

Default severity level: information

AP Not Associated With Controller

Parent incident: AP Not Associated With Controller incident

Event ID: 844

Description	Default severity level	Typical causes	Actions
indicates the AP has transitioned to another wireless controller.	minor	the wireless controller has gone down and for load balancing reasons. the AP has been assigned to a different controller.	investigate the status of the wireless controller.

AP Reachable (ICMP)

Parent incident: AP Reachability Change incident

Event ID: 755

Description	Default severity level	Typical causes	Actions
indicates the AP is once again reachable using ICMP ping, after having been unreachable.	information	none.	none.

AP Standby Controller Change

Parent incident: AP Controller Change incident

Event ID: 826

Default severity level: information

AP Unreachable (ICMP)

Parent incident: AP Reachability Change incident

Event ID: 756

Description	Default severity level	Typical causes	Actions
indicates the AP is unreachable using ICMP ping.	major	a configuration change, loist power, or loose connection.	verify recent configuration changes, check appropriate LEDs are on, and check the AP cable connection to the network.

APIC Cluster ID Changed

Parent incident:

Event ID: 796

Default severity level: minor

ATM VCC High Inbound Utilization

Parent incident: ATM VCC Inbound Utilization Abnormality incident

Event ID: 46

Description	Default severity level	Typical causes	Actions
indicates the virtual channel's inbound utilization has crossed its high threshold level. Source identifies the router, port (ifDescr) and AAL5 VPI/VI. Impacted identifies the impacted peer router, port and AAL5 VPI/VCI. When the impacted routers are not identified, then Entuity displays peer not known. Details displays the channel's actual and threshold utilization values.	major	Virtual Channel's utilization is higher than the high utilization threshold for the port due to increased traffic.	generate ATM utilization reports to monitor the situation.

ATM VCC High Inbound Utilization Cleared

Parent incident: ATM VCC Inbound Utilization Abnormality incident

Event ID: 47

Description	Default severity level	Typical causes	Actions
indicates a previous High ATM Inbound Utilization event for the Virtual Channel has been cleared.	information	reduced usage.	none.

ATM VCC High Outbound Utilization

Parent incident: ATM VCC Outbound Utilization incident

Event ID: 50

Description

Default severity level

Typical causes

Actions

indicates the Virtual Channel's outbound utilization has crossed its high threshold level.

Source identifies the router, port (ifDescr) and AAL5 VPI/VI.
Impacted identifies the impacted peer router, port and AAL5 VPI/VCI. When the impacted routers are not identified, then Entuity displays peer not known.
Details displays the channel's actual and threshold utilization values.

major

Virtual Channel's utilization is higher than the high utilization threshold for the port due to increased traffic.

generate ATM utilization reports to monitor the situation.

ATM VCC High Outbound Utilization Cleared

Parent incident: ATM VCC Outbound Utilization incident

Event ID: 51

Description	Default severity level	Typical causes	Actions
indicates a previous High ATM Outbound Utilization event for the virtual channel has been cleared.	information	reduced usage.	none.

ATM VCC Link Down

Parent incident: ATM VCC Link Down incident

Event ID: 54

Description	Default severity level	Typical causes	Actions
indicates that an ATM virtual channel has transitioned to the down state.	severe	the virtual channel is not functional because either the PVC is disabled or a port (on this switch) used by the PVC is down.	check the ATM connection first by pinging the port. If the port responds, contact your ATM service provider.

ATM VCC Link Up

Parent incident: ATM VCC Link Down incident

Event ID: 55

Description	Default severity level	Typical causes	Actions
indicates that an ATM VCC has transitioned to the up state.	information	connecting a PC or server to a switch port. rebooting the PC or server attached to a switch port. WAN link CSU/DSU equipment re-establishing carrier detection.	none.

ATM VCC Low Inbound Utilization

Parent incident: ATM VCC Inbound Utilization Abnormality incident

Event ID: 48

Description

Default severity level

Typical causes

Actions

indicates that the virtual channel's inbound utilization has crossed its low threshold level.

Source identifies the router, port (ifDescr) and AAL5 VPI/VI.
Impacted identifies the impacted peer router, port and AAL5 VPI/VCI. When the impacted routers are not identified, then Entuity displays peer not known.
Details displays the channel's actual and threshold utilization values.

major

route changes.
outages upstream of the link.
server problems.

may be symptomatic of an issue elsewhere in the network. Check through other events that have recently been reported if excessively low levels of utilization persist. Generate ATM utilization reports to monitor the situation.

ATM VCC Low Inbound Utilization Cleared

Parent incident: ATM VCC Inbound Utilization Abnormality incident

Event ID: 47

Description	Default severity level	Typical causes	Actions
indicates a previous ATM VCC Low Inbound Utilization alarm has been cleared.	information	indicates a previously low inbound utilization for the ATM VCC is now within the set thresholds.	none.

ATM VCC Low Outbound Utilization

Parent incident: ATM VCC Outbound Utilization incident

Event ID: 52

Description

Default severity level

Typical causes

Actions

indicates the virtual channel's outbound utilization has crossed its low threshold level.

Source identifies the router, port (ifDescr) and AAL5 VPI/VI.
Impacted identifies the impacted peer router, port and AAL5 VPI/VCI. When the impacted routers are not identified, then Entuity displays peer not known.
Details displays the channel's actual and threshold utilization values.

major

route changes.
outages upstream of the link.
server problems.

this problem may be symptomatic of an issue elsewhere in the network. Check through other events that have recently been reported, if excessively low levels of utilization persist. Generate ATM utilization reports to monitor the situation.

ATM VCC Low Outbound Utilization Cleared

Parent incident: ATM VCC Outbound Utilization incident

Event ID: 53

Description	Default severity level	Typical causes	Actions
indicates a previous ATM VCC Low Outbound Utilization alarm has been cleared.	information	indicates a previously low outbound utilization for the ATM VCC is now within the set thresholds.	none.

AvailMonitor Application Available

Parent incident: AvailMonitor Application Problem incident

Event ID: 917505, 256:1

Description

Default severity level

Typical causes

Actions

Entuity checks the availability of a monitored application by attempting a TCP connect every two minutes. If an application responds after previously failing to respond, Entuity changes its availability state to Up.

Indicates a previous alarm has been cleared, e.g. Application Unavailable.

information

application is now available.

Event ID:

none.

AvailMonitor Application Unavailable

Parent incident: AvailMonitor Application Problem incident

Event ID: 917506, 256:2

Description	Default severity level	Typical causes	Actions
Entuity checks the availability of a monitored application by attempting a TCP connect every two minutes. If an application fails to respond, Entuity considers the Application as Down.	severe	problem with server resources causing the application to crash. application bug. shutdown.	heck the server for the application.

AvailMonitor Falling Average Latency

Parent incident: AvailMonitor Average Latency Change incident

Event ID: 753

Description	Default severity level	Typical causes	Actions
indicates that the average real-time latency value for the hour has fallen short of the previous hourly value by the Falling Latency threshold set for the device. If the threshold has been changed during the preceding hour, then the most recent setting is used in the comparison. This threshold is in milliseconds.	minor	decrease in network traffic.	investigate network resources.

AvailMonitor High Latency

Parent incident: AvailMonitor High Latency incident

Event ID: 750

Description	Default severity level	Typical causes	Actions
indicates the average real-time latency value for the hour exceeds the ICMP High Latency threshold set for the device. If the threshold has been changed during the preceding hour, then the most recent setting is used in the comparison. This threshold is in milliseconds.	severe	increase in network traffic.	investigate network resources.

AvailMonitor High Latency (95th Percentile)

Parent incident: AvailMonitor High Latency (95th Percentile) incident

Event ID: 748

Default severity: severe

AvailMonitor High Latency Reaching Application

Parent incident: AvailMonitor Application Problem incident

Event ID: 917507, 256:3

Description	Default severity level	Typical causes	Actions
Entuity checks the availability of a monitored application by attempting a TCP connect every two minutes. It also records the time taken to respond. You can set a latency threshold for each application, which by default is 3000ms. If the application response is slower than the set threshold, then ENA raises an event.	severe	insufficient application resource. network congestion.	use the Ticker tool to check the current application port utilization. If this is high, and a historical graph of port utilization reveals that the link is highly utilized in general, then more bandwidth may be needed.

AvailMonitor High Latency Reaching Application Cleared

Parent incident: AvailMonitor Application Problem incident

Event ID: 917508, 256:4

Description	Default severity level	Typical causes	Actions
Entuity checks the availability of a monitored application by attempting a TCP connect every two minutes. It also records the time taken to respond. You can set a latency threshold for each application, which by default is 3000ms. This event indicates that an application that was responding slowly is now responding within the Latency threshold.	information	reduced traffic.	none.

AvailMonitor Low View Device Reachability

Parent incident: AvailMonitor Low View Device Reachability incident

Event ID: 80

Description	Default severity level	Typical causes	Actions
Entuity measures device reachability by pinging a monitored device's IP management address every two minutes. Entuity raises this event when the combined number of devices responding to the ICMP ping (and therefore are reachable), set to Admin Down or in an Uninitialized state is below the Device Reachability threshold for the View (as a percentage).	severe	high utilization of the area of the network where the devices within the View are located.	investigate the devices within the View. If the device reporting the event is a router, then Telnet to the router to ascertain possible causes for the outage.

AvailMonitor Normal Latency

Parent incident: AvailMonitor High Latency incident

Event ID: 751

Description	Default severity level	Typical causes	Actions
indicates that the average real-time latency value for the hour is below the High Latency threshold. If the threshold has been changed during the preceding hour, then the most recent setting is used in the comparison. This threshold is in milliseconds.	information	correlated event to AvailMonitor High Latency, network latency has returned to within set boundaries.	none.

AvailMonitor Normal Latency (95th Percentile)

Parent incident: AvailMonitor High Latency (95th Percentile) incident

Event ID: 749

Default severity: information

AvailMonitor Normal View Device Reachability

Parent incident: AvailMonitor Low View Device Reachability incident

Event ID: 81

Description	Default severity level	Typical causes	Actions
raised when the number of devices responding to the ICMP ping, and therefore are reachable, is now above the Device Reachability threshold for the View.	information	device reachability within the View has moved above the set threshold.	none.

AvailMonitor Rising Average Latency

Parent incident: AvailMonitor Average Latency Change incident

Event ID: 752

Description	Default severity level	Typical causes	Actions
indicates that the average real-time latency value for the hour is above the Rising Latency threshold. If the threshold has been changed during the preceding hour, then the most recent setting is used in the comparison. This threshold is in milliseconds.	severe	increase in network traffic.	investigate network resources.

AvailMonitor Rising Trend in Average Latency

Parent incident: AvailMonitor Rising Trend in Average Latency incident

Event ID: 754

Description	Default severity level	Typical causes	Actions
indicates that the average real-time latency value for the previous hour exceeds the trend for the same hour of the week by a value greater than the Rising Trend Latency threshold. If the threshold has been changed during the preceding hour, then the most recent setting is used in the comparison. This threshold is in milliseconds.	severe	increase in network traffic.	investigate network resources.

AWAP Host Count High

Parent incident: AWAP Host Count Abnormality incident

Event ID: 800

Description	Default severity level	Typical causes	Actions
for each AWAP, you can set the number of hosts that would impact performance when attached to the AWAP. This equates to the sum of the hosts that each antenna can handle. You can set the threshold hierarchy at the global and antenna levels. By default, the threshold is enabled and set to 512.	minor	changes in wireless usage have occurred since the network was designed.	you can check the AWAP Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a rising usage trend, you may want to extend the capabilities of your wireless network.

AWAP Host Count High Cleared

Parent incident: AWAP Host Count Abnormality incident

Event ID: 801

Description	Default severity level	Typical causes	Actions
the number of hosts attached to the AWAP has returned to an acceptable level.	information	the managed object's performance is now within the set thresholds.	none.

AWAP Host Count Low

Parent incident: AWAP Host Count Abnormality incident

Event ID: 802

Description	Default severity level	Typical causes	Actions
the combined count of hosts that are wirelessly associated with the AWAP has fallen below the set threshold. For all AWAPs, the default threshold is set to 0, and disabled.	minor	changes in wireless usage have occurred since the network was designed.	you can check the AWAP Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a falling usage trend, you may want to adjust the capabilities of your wireless network.

AWAP Host Count Low Cleared

Parent incident: AWAP Host Count Abnormality incident

Event ID: 803

Description	Default severity level	Typical causes	Actions
the number of hosts attached to the AWAP has returned to an acceptable level.	information	the managed object's performance is now within the set thresholds.	none.

Background Reachability Check Failed

Parent incident: Server Suspended incident

Event ID: 786454

Description

Default severity level

Typical causes

Actions

indicates the Entuity central server check of the reachability of its remote server(s) has failed. One or more remote servers has failed to respond within the defined period.

By default, the central server polls its remote servers ever 15,000 milliseconds and allows 10,000 milliseconds to receive a response. These settings are configurable through reachabilityAuditorPollingInterval and reachabilityAuditorFutureResultsTimeout in entuity.cfg.

severe

network outage, network congestion, Entuity server overload either of the remote or central server, or the restart of the remote Entuity server, e.g. it was taken down for maintenance.

check the status of the remote Entuity server, e.g. has it been taken down for scheduled maintenance? Review other raised events, do they indicate a general networking issue?

Background Reachability Check Succeeded

Parent incident: Server Suspended incident

Event ID: 786455

Description	Default severity level	Typical causes	Actions
indicates a remote server that was not responding to the central server has started responding.	information	a remote Entuity server that was not responding to the central server's reachability check has now responded.	none.

Backplane Bus A High Utilization

Parent incident: Backplane Bus A High Utilization incident

Event ID: 655438, 8:78

Description

Default severity level

Typical causes

Actions

with some devices, this indicates a major issue when the port speed and density is higher than the available backplane capability. When backplane utilization is over 50%, it may also indicate port queuing or dropped traffic, which then leads to re-transmission and so more traffic.

There are separate backplane utilization events for Bus A, Bus B, Bus C and System Bus, against each can be set a threshold value.

minor

insufficient backplane resources.

consider reassigning links to under utilized backplanes, possible backplane upgrade.

Backplane Bus A High Utilization Cleared

Parent incident: Backplane Bus A High Utilization incident

Event ID: 655439, 8:79

Description	Default severity level	Typical causes	Actions
indicates that backplane utilization is now responding normally.	information	reduced utilization.	none.

Backplane Bus B High Utilization

Parent incident: Backplane Bus B High Utilization incident

Event ID: 655440, 8:80

Description

Default severity level

Typical causes

Actions

with some devices, this indicates a major issue when the port speed and density is higher than the available backplane capabilities. When backplane utilization is over 50% it may also indicate port queuing or dropped traffic, which then leads to re-transmission and so more traffic.

There are separate backplane utilization events for Bus A, Bus B, Bus C and System Bus, against each can be set a threshold value.

minor

insufficient backplane resources.

consider reassigning links to under-utilized backplanes, possible backplane upgrade.

Backplane Bus B High Utilization Cleared

Parent incident: Backplane Bus B High Utilization incident

Event ID: 655441, 8:81

Description	Default severity level	Typical causes	Actions
ndicates that backplane utilization is now responding normally.	information	reduced utilization.	none.

Backplane Bus C High Utilization

Parent incident: Backplane Bus C High Utilization incident

Event ID: 655442, 8:82

Description

Default severity level

Typical causes

Actions

with some devices, this indicates a major issue when the port speed and density is higher than the available backplane capabilities. When backplane utilization is over 50%, it may also indicate port queuing or dropped traffic, when then leads to re-transmission and so more traffic.

There are separate backplane utilization events for Bus A, Bus B, Bus C and System Bus, against each can be set a threshold value.

minor

insufficient backplane resources.

consider reassigning links to under-utilized backplanes, possible backplane upgrade.

Backplane Bus C High Utilization Cleared

Parent incident: Backplane Bus C High Utilization incident

Event ID: 655443, 8:83

Description	Default severity level	Typical causes	Actions
indicates that backplane utilization is now responding normally.	information	reduced utilization.	none.

Backplane System Bus High Utilization

Parent incident: Backplane System Bus High Utilization incident

Event ID: 655436, 8:76

Description

Default severity level

Typical causes

Actions

with some devices, this indicates a major issue when the port speed and density is higher than the available backplane capabilities. When backplane utilization is over 50%, it may also indicate port queuing or dropped traffic, which then leads to re-transmission and so more traffic.

There are separate backplane utilization events for Bus A, Bus B, Bus C and System Bus against each can be set a threshold value.

minor

insufficient backplane resources.

consider reassigning links to under utilized backplanes, possible backplane upgrade.

Backplane System Bus High Utilization Cleared

Parent incident: Backplane System Bus High Utilization incident

Event ID: 655437, 8:77

Description	Default severity level	Typical causes	Actions
indicates that backplane utilization is now responding normally.	information	reduced utilization.	none.

Battery High Temperature

Parent incident: Battery High Temperature incident

Event ID: 1357

Default severity: severe

Battery High Temperature Cleared

Parent incident: Battery High Temperature incident

Event ID: 1358

Default severity: information

Battery Low Reading

Parent incident: Battery Low Reading incident

Event ID: 1353

Default severity: severe

Battery Low Reading Cleared

Parent incident: Battery Low Reading incident

Event ID: 1354

Default severity: information

Battery Low Voltage

Parent incident: Battery Low Voltage incident

Event ID: 1355

Default severity: severe

Battery Low Voltage Cleared

Parent incident: Battery Low Voltage incident

Event ID: 1356

Default severity: information

BGP Peer Briefly Established

Parent incident: BGP Peer Briefly Established incident

Event ID: 133

Description	Default severity level	Typical causes	Actions
indicates that virtual links between BGP speakers are not established, but bounced recently. Entuity identifies a recent bounce as the peer transition count is greater than zero.	critical	BGP keep-alives may be lost, so the local router terminates the connection and then successfully attempt to reestablish it. Other causes may be an unstable remote router, traffic shaping limitations.	check logs are activated on the device. Use the logs to investigate error messages.

BGP Peer Briefly Not Established

Parent incident: BGP Peer Briefly Established incident

Event ID: 132

Description	Default severity level	Typical causes	Actions
indicates that virtual links between BGP are now established, but bounced recently. Entuity identifies a recent bounce as the up time is lower than in the previous poll.	critical	BGP keep-alives may be lost, so the local router terminates the connection and then successfully attempt to reestablish it. Other causes may be an unstable remote router, traffic shaping limitations.	check logs are activated on the device. Use the logs to investigate error messages.

BGP Peer Disappeared

Parent incident: BGP Peer Disappeared incident

Event ID: 130

Description	Default severity level	Typical causes	Actions
indicates a former adjacent peer has been removed from router's configuration. Administrators should be aware of this change to be able to detect rogue configuration updates.	critical	update of router configuration.	investigate the cause of router disappearance.

BGP Peer Established

Parent incident: BGP Peer Established incident

Event ID: 129

Description	Default severity level	Typical causes	Actions
indicates that virtual links between BGP peer have just become well established.	minor	BGP peer established.	none.

BGP Peer Newly Discovered

Parent incident:

(Entuity v21.0 P02 upwards) BGP Peer Disappeared incident
(Entuity v21.0 P01 and below) BGP Peer Newly Discovered incident

Event ID: 128

Description	Default severity level	Typical causes	Actions
indicates Entuity's discovery of a new BGP peer.	minor	configuration of a new BGP peer.	none.

BGP Peer Not Established

Parent incident: BGP Peer Established incident

Event ID: 129

Description	Default severity level	Typical causes	Actions
indicates to administrators that a former adjacent peer is no longer in reach.	critical	problems with IP reachability or incorrect BGP configuration.	at the router's command line interface, use the pingand show route commands to verify network connectivity to the BGP peer. You can use the show log messagescommand to look for error relating to the peer.

BladeCenter Blade +1.25V Rail High Voltage

Parent incident: BladeCenter Blade +1.25V Rail Voltage Problem incident

Event ID: 547

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +1.25v rail has crossed the maximum voltage threshold for that rail. Detailsidentifies the rail's correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +1.25V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +1.25V Rail Voltage Problem incident

Event ID: 548

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has been cleared.	none.

BladeCenter Blade +1.25V Rail Low Voltage

Parent incident: BladeCenter Blade +1.25V Rail Voltage Problem incident

Event ID: 549

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +1.25v rail has crossed the minimum voltage threshold for that rail. Detailsidentifies the rail's correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

event only available with the BladeCenter module.

severe

drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +1.25V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +1.25V Rail Voltage Problem incident

Event ID: 550

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +1.5V Rail High Voltage

Parent incident: BladeCenter Blade +1.5V Rail Voltage Problem incident

Event ID: 543

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the rail has crossed the maximum voltage threshold for that rail. Details identifies the rail's correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +1.5V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +1.5V Rail Voltage Problem incident

Event ID: 544

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has been cleared.	none.

BladeCenter Blade +1.5V Rail Low Voltage

Parent incident: BladeCenter Blade +1.5V Rail Voltage Problem incident

Event ID: 545

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the rail has crossed the minimum voltage threshold for that rail. Details identifies the rail's correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

Event only available with the BladeCenter module.

severe

a drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +1.5V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +1.5V Rail Voltage Problem incident

Event ID: 546

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +12V Rail High Voltage

Parent incident: BladeCenter Blade +12V Rail Voltage Problem incident

Event ID: 535

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +12V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +12V Rail Voltage Problem incident

Event ID: 536

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +12V Rail Low Voltage

Parent incident: BladeCenter Blade +12V Rail Voltage Problem incident

Event ID: 537

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

a drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +12V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +12V Rail Voltage Problem incident

Event ID: 538

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +2.5V Rail High Voltage

Parent incident: BladeCenter Blade +2.5V Rail Voltage Problem incident

Event ID: 539

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +2.5V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +2.5V Rail Voltage Problem incident

Event ID: 540

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +2.5V Rail Low Voltage

Parent incident: BladeCenter Blade +2.5V Rail Voltage Problem incident

Event ID: 541

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

a drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +2.5V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +2.5V Rail Voltage Problem incident

Event ID: 541

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +3.3V Rail High Voltage

Parent incident: BladeCenter Blade +3.3V Rail Voltage Problem incident

Event ID: 531

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +3.3V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +3.3V Rail Voltage Problem incident

Event ID: 532

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +3.3V Rail Low Voltage

Parent incident: BladeCenter Blade +3.3V Rail Voltage Problem incident

Event ID: 533

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

a drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +3.3V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +3.3V Rail Voltage Problem incident

Event ID: 534

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +5V Rail High Voltage

Parent incident: BladeCenter Blade +5V Rail Voltage Problem incident

Event ID: 527

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

surge in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +5V Rail High Voltage Cleared

Parent incident: BladeCenter Blade +5V Rail Voltage Problem incident

Event ID: 528

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade +5V Rail Low Voltage

Parent incident: BladeCenter Blade +5V Rail Voltage Problem incident

Event ID: 529

Description

Default severity level

Typical causes

Actions

Event only available with the BladeCenter module.

severe

a drop in BladeCenter power supply, poorly seated or malfunctioning blade.

check BladeCenter power.
Reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Blade +5V Rail Low Voltage Cleared

Parent incident: BladeCenter Blade +5V Rail Voltage Problem incident

Event ID: 530

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Blade Powered Off

Parent incident: BladeCenter Blade Powered Off incident

Event ID: 519

Description

Default severity level

Typical causes

Actions

indicates that a blade has been switched off. This is identified through monitoring the voltage on the blade.

This event is only available with the BladeCenter module.

severe

blade switched off.

none.

BladeCenter Blade Powered On

Parent incident: BladeCenter Blade Powered Off incident

Event ID: 520

Description

Default severity level

Typical causes

Actions

indicates that a blade has been switched on. This is identified through monitoring the voltage on the blade.

This event is only available with the BladeCenter module.

information

blade switched on.

none.

BladeCenter Blower Failed

Parent incident: BladeCenter Blower Failed incident

Event ID: 514

Description

Default severity level

Typical causes

Actions

indicates that a blower has failed. This is identified through monitoring the voltage on the blade. BladeCenter’s built-in redundancy allows the remaining blower to successfully cool the BladeCenter.

This event is only available with the BladeCenter module.

major

blower failure.

replace the blower. The failed blower module must be replaced within two minutes during service.

BladeCenter Blower Ok

Parent incident: BladeCenter Blower Failed incident

Event ID: 513

Description

Default severity level

Typical causes

Actions

indicates that a BladeCenter blower has transitioned from a failed, or blower slow, state.

This event is only available with the BladeCenter module.

information

previous problem with the blower (either slow performance or failure) has cleared.

none.

BladeCenter Blower Slow

Parent incident: BladeCenter Blower Failed incident

Event ID: 512

Description

Default severity level

Typical causes

Actions

indicates that a blower is running at less than twenty percent (default threshold) of its maximum rotational speed. BladeCenter blowers usually operate at thirty percent or above of their maximum rotational speed, the exact speed depending upon the ambient temperature.

This event is only available with the BladeCenter module.

minor

blower engine failure.

replace the blower.

BladeCenter Chassis +1.8V Rail High Voltage

Parent incident: BladeCenter Chassis +1.8V Rail Voltage Problem incident

Event ID: 567

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +1.8v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +1.8V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis +1.8V Rail Voltage Problem incident

Event ID: 568

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the +1.8v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +1.8V Rail Low Voltage

Parent incident: BladeCenter Chassis +1.8V Rail Voltage Problem incident

Event ID: 569

Description

Default severity level

Typical causes

Actions

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +1.8V Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis +1.8V Rail Voltage Problem incident

Event ID: 570

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the +1.8v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +12V Rail High Voltage

Parent incident: BladeCenter Chassis +12V Rail Voltage Problem incident

Event ID: 535

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +12v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +12V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis +12V Rail Voltage Problem incident

Event ID: 536

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the +12v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +12V Rail Low Voltage

Parent incident: BladeCenter Chassis +12V Rail Voltage Problem incident

Event ID: 537

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +12v rail has crossed the minimum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +12V Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis +12V Rail Voltage Problem incident

Event ID: 538

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the +12v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +2.5V Rail High Voltage

Parent incident: BladeCenter Chassis +2.5V Rail Voltage Problem incident

Event ID: 563

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +2.5v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +2.5V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis +2.5V Rail Voltage Problem incident

Event ID: 564

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the +2.5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +2.5V Rail Low Voltage

Parent incident: BladeCenter Chassis +2.5V Rail Voltage Problem incident

Event ID: 565

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +2.5v rail has crossed the minimum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +2.5 Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis +2.5V Rail Voltage Problem incident

Event ID: 566

Description	Default severity level	Typical causes	Actions
ndicates a previous low voltage alarm raised against the +2.5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +3.3V Rail High Voltage

Parent incident: BladeCenter Chassis +3.3V Rail Voltage Problem incident

Event ID: 555

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +3.3v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +3.3V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis +3.3V Rail Voltage Problem incident

Event ID: 556

Description	Default severity level	Typical causes	Actions
ndicates a previous high voltage alarm raised against the +3.3v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +3.3V Rail Low Voltage

Parent incident: BladeCenter Chassis +3.3V Rail Voltage Problem incident

Event ID: 557

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +3.3v rail has crossed the minimum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +3.3V Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis +3.3V Rail Voltage Problem incident

Event ID: 558

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the +3.3v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +5V Rail High Voltage

Parent incident: BladeCenter Chassis +5V Rail Voltage Problem incident

Event ID: 551

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +5v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +5V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis +5V Rail Voltage Problem incident

Event ID: 552

Description	Default severity level	Typical causes	Actions
indicates a previous high voltage alarm raised against the +5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis +5V Rail Low Voltage

Parent incident: BladeCenter Chassis +5V Rail Voltage Problem incident

Event ID: 553

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the +5v rail has crossed the minimum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis +5V Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis +5V Rail Voltage Problem incident

Event ID: 554

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the +5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none

BladeCenter Chassis -5V Rail High Voltage

Parent incident: BladeCenter Chassis -5V Rail Voltage Problem incident

Event ID: 571

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the -5v rail has crossed the maximum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

surge in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis -5V Rail High Voltage Cleared

Parent incident: BladeCenter Chassis -5V Rail Voltage Problem incident

Event ID: 572

Description	Default severity level	Typical causes	Actions
ndicates a previous high voltage alarm raised against the -5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter Chassis -5V Rail Low Voltage

Parent incident: BladeCenter Chassis -5V Rail Voltage Problem incident

Event ID: 573

Description

Default severity level

Typical causes

Actions

indicates that the voltage reading for the -5v rail has crossed the minimum voltage threshold for that rail. Details identifies the rail’s correct voltage, the actual voltage and the threshold voltage (by default a 5% variance from the correct voltage). Voltage readings are given in millivolts.

This event is only available with the BladeCenter module.

severe

drop in BladeCenter power supply.
poorly seated or malfunctioning blade.

check BladeCenter power.
reseat blade server.
replace blade server.

Entuity recommends always consulting the BladeCenter documentation.

BladeCenter Chassis -5V Rail Low Voltage Cleared

Parent incident: BladeCenter Chassis -5V Rail Voltage Problem incident

Event ID: 574

Description	Default severity level	Typical causes	Actions
indicates a previous low voltage alarm raised against the -5v rail has been cleared.	information	previous problem with the rail voltage has cleared.	none.

BladeCenter CPU1 High Temperature

Parent incident: BladeCenter CPU1 High Temperature incident

Event ID: 521

Description

Default severity level

Typical causes

Actions

indicates that the temperature reading for the CPU has crossed the maximum threshold for that CPU. Details identifies the actual temperature and the temperature threshold. Temperature readings are given in degrees Celsius.

This event is only available with the BladeCenter module.

severe

rise in the ambient temperature.
blower failure.
missing components (e.g. a blade) that impact the cooling of the BladeCenter.

ensure the BladeCenter is properly cooled.
check blower performance.
check ambient temperature.
check missing components.

BladeCenter CPU1 High Temperature Cleared

Parent incident: BladeCenter CPU1 High Temperature incident

Event ID: 522

Description	Default severity level	Typical causes	Actions
indicates a previous high temperature alarm raised against the CPU has been cleared.	information	previous problem with the CPU temperature has cleared.	none.

BladeCenter CPU2 High Temperature

Parent incident: BladeCenter CPU2 High Temperature incident

Event ID: 523

Description

Default severity level

Typical causes

Actions

This event is only available with the BladeCenter module.

severe

rise in the ambient temperature.
blower failure.
missing components (e.g. a blade) that impact the cooling of the BladeCenter.

ensure the BladeCenter is properly cooled.
check blower performance.
check ambient temperature.
check missing components.

BladeCenter CPU2 High Temperature Cleared

Parent incident: BladeCenter CPU2 High Temperature incident

Event ID: 524

Description	Default severity level	Typical causes	Actions
indicates a previous high temperature alarm raised against the CPU has been cleared.	information	previous problem with the CPU temperature has cleared.	none.

BladeCenter DASD1 High Temperature

Parent incident: BladeCenter DASD1 High Temperature incident

Event ID: 525

Description

Default severity level

Typical causes

Actions

indicates that the temperature reading for the DASD1 has crossed the maximum threshold for that DASD1. Details identifies the actual temperature and the temperature threshold. Temperature readings are given in degrees Celsius.

This event is only available with the BladeCenter module.

severe

rise in the ambient temperature.
blower failure.
missing components (e.g. a blade) that impact the cooling of the BladeCenter.

ensure the BladeCenter is properly cooled.
check blower performance.
check ambient temperature.
check missing components.

BladeCenter DASD1 High Temperature Cleared

Parent incident: BladeCenter DASD1 High Temperature incident

Event ID: 526

Description	Default severity level	Typical causes	Actions
indicates a previous high temperature alarm raised against the DASD1 has been cleared.	information	previous problem with the DASD1 temperature has cleared.	none.

BladeCenter Front Panel High Temperature

Parent incident: BladeCenter Front Panel High Temperature incident

Event ID: 517

Description

Default severity level

Typical causes

Actions

indicates that the temperature reading for the Front Panel has crossed the maximum threshold for that Front Panel. Details identifies the actual temperature and the temperature threshold. Temperature readings are given in degrees Celsius.

This event is only available with the BladeCenter module.

severe

rise in the ambient temperature.
blower failure.
missing components (e.g. a blade) that impact the cooling of the BladeCenter.

ensure the BladeCenter is properly cooled.
check blower performance.
check ambient temperature.
check missing components.

BladeCenter Front Panel High Temperature Cleared

Parent incident: BladeCenter Front Panel High Temperature incident

Event ID: 518

Description	Default severity level	Typical causes	Actions
indicates a previous high temperature alarm raised against the Front Panel has been cleared.	information	previous problem with the Front Panel temperature has cleared.	none.

BladeCenter Management Module High Temperature

Parent incident: BladeCenter Management Module High Temperature incident

Event ID: 515

Description

Default severity level

Typical causes

Actions

indicates that the temperature reading for the management module has crossed the maximum threshold for that management module. Details identifies the actual temperature and the temperature threshold. Temperature readings are given in degrees Celsius.

This event is only available with the BladeCenter module.

severe

rise in the ambient temperature.
blower failure.
missing components (e.g. a blade) that impact the cooling of the BladeCenter.

ensure the BladeCenter is properly cooled.
check blower performance.
check ambient temperature.
check missing components.

BladeCenter Management Module High Temperature Cleared

Parent incident: BladeCenter Management Module High Temperature incident

Event ID: 516

Description	Default severity level	Typical causes	Actions
indicates a previous high temperature alarm raised against the management module has been cleared.	information	previous problem with the management module temperature has cleared.	none.

CUCM CPU High Utilization

Parent incident: CUCM CPU High Utilization incident

Event ID: 416

Description	Default severity level	Typical causes	Actions
indicates a process on the Cisco Unified Communications Manager server has high CPU utilization.	severe	high Cisco Unified Communications Manager CPU utilization due to interrupts, or a particular process using a lot of CPU resources. Each device type registered with the Cisco Unified Communications Manager has a weight, this weight should match the Cisco Unified Communications Manager server specification. Problems may occur when this is not the case.	use Flex Reports to create a Cisco Unified Communications Manager CPU Report, for example one that runs every hour to monitor CPU utilization.

Blacklisted Application Detected

Parent incident:

Event ID: 93

Default severity: critical

Bluetooth Clients Have Become Visible

Parent incident:

Event ID: 1105

Default severity level: information

Bluetooth Clients Have Gone Out Of Range

Parent incident:

Event ID: 1106

Default severity level: minor

Cable Error Detected

Parent incident:

Event ID: 1107

Default severity level: major

Cellular Came Up

Parent incident:

Event ID: 1108

Default severity level: information

Cellular Went Down

Parent incident:

Event ID: 1109

Default severity level: major

Chassis Fan Major Fault

Parent incident: Chassis Fan Status Problem incident

Event ID: 655393, 8:33

Description	Default severity level	Typical causes	Actions
indicates that a device has a major fan hardware problem.	severe	faulty fan hardware. faulty environmental card. faulty supervisor card.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Fan Minor Fault

Parent incident: Chassis Fan Status Problem incident

Event ID: 655392, 8:32

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor fan hardware problem.	major	faulty fan hardware. faulty environmental card. faulty supervisor card.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Fan OK

Parent incident: Chassis Fan Status Problem incident

Event ID: 655390, 8:30

Description	Default severity level	Typical causes	Actions
indicates that a previous fan fault for a device has been cleared.	information	faulty firmware has been swapped out.	none.

Chassis Fan Status Unknown

Parent incident: Chassis Fan Status Problem incident

Event ID: 655391, 8:31

Description	Default severity level	Typical causes	Actions
indicates the status of the fan is not reportable or is unknown.	minor	status of the fan is not reportable. status of the fan is unknown.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Major Alarm

Parent incident: Chassis Alarm incident

Event ID: 655397, 8:37

Description	Default severity level	Typical causes	Actions
indicates that a device is reporting a major hardware or firmware problem which is causing or may cause the device to fail.	critical	power supply problems. fan failures. temperature alarms. module faults.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Major Alarm Cleared

Parent incident: Chassis Alarm incident

Event ID: 655398, 8:38

Description	Default severity level	Typical causes	Actions
indicates a previous alarm has been cleared.	information	the original cause of the alarm (e.g. power supply problems, fan failures, temperature alarms, module faults) has been corrected.	none.

Chassis Minor Alarm

Parent incident: Chassis Alarm incident

Event ID: 655395, 8:35

Description	Default severity level	Typical causes	Actions
indicates that a device is reporting a major hardware or firmware problem which is causing or may cause the device to fail.	severe	power supply problems. fan failures. temperature alarms. module faults.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Minor Alarm Cleared

Parent incident: Chassis Alarm incident

Event ID: 655396, 8:36

Description	Default severity level	Typical causes	Actions
indicates a previous alarm has been cleared.	information	the original cause of the alarm (e.g. power supply problems, fan failures, temperature alarms, module faults) has been corrected.	none.

Chassis Temperature Alarm

Parent incident: Chassis Temperature Alarm incident

Event ID: 655410, 8:50

Description	Default severity level	Typical causes	Actions
indicates that a device has measured a significant increase in ambient temperature.	major	faulty fan hardware. faulty environmental card. comms room problems.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Chassis Temperature Alarm Cleared

Parent incident: Chassis Temperature Alarm incident

Event ID: 655411, 8:51

Description	Default severity level	Typical causes	Actions
indicates that a device temperature problem is resolved.	information	hardware swap out that has resolved a previous problem.	none.

Chassis Temperature Critical Alarm

Parent incident: Chassis Temperature Alarm incident

Event ID: 655412, 8:52

Description	Default severity level	Typical causes	Actions
indicates that a device has measured a potentially fatal increase in ambient temperature.	critical	faulty fan hardware. faulty environmental card. comms room problems.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Cisco DNA Center Webhook Alert Received

Parent incident: DNAC Webhook Received incident

Event ID: 741

Default severity level: information

Cisco DNA Center Webhook Alert Cleared

Parent incident: DNAC Webhook Received incident

Event ID: 746

Default severity level: information

Client Connected To Another Network

Parent incident:

Event ID: 1111

Default severity level: information

Client Connectivity Changed

Parent incident:

Event ID: 1112

Default severity level: information

Client IP Conflict Detected

Parent incident:

Event ID: 1112

Default severity level: minor

Clients Are Compliant With Their Security Policy

Parent incident:

Event ID: 1113

Default severity level: minor

Clients Are Violating Their Security Policy

Parent incident:

Event ID: 1114

Default severity level: severe

Clients Came Up

Parent incident:

Event ID: 1115

Default severity level: information

Clients Failing To Connect

Parent incident:

Event ID: 1116

Default severity level: major

Clients Have Enrolled In One Of Your Networks

Parent incident:

Event ID: 1117

Default severity level: information

Clients Have Re-entered Their Geofenced Area

Parent incident:

Event ID: 1118

Default severity level: information

Clients Have Violated Their Geofencing Policy

Parent incident:

Event ID: 1119

Default severity level: major

Clients Went Down

Parent incident:

Event ID: 1120

Default severity level: major

Cloud Controller Connection Failed

Parent incident: Cloud Controller Connection Failure incident

Event ID: 793

Default severity level: severe

Cloud Controller Connection Failure Cleared

Parent incident: Cloud Controller Connection Failure incident

Event ID: 792

Default severity level: information

Cluster High CPU Usage

Parent incident: Cluster High CPU incident

Event ID: 792

Default severity level: severe

Cluster High CPU Usage Cleared

Parent incident: Cluster High CPU incident

Event ID: 1334

Default severity level: information

Cluster High Memory Usage

Parent incident: Cluster High Memory Usage incident

Event ID: 1337

Default severity level: severe

Cluster High Memory Usage Cleared

Parent incident: Cluster High Memory Usage incident

Event ID: 1336

Default severity level: information

Cluster State Alarm

Parent incident: Cluster State Problem incident

Event ID: 1322

Default severity level: severe

Cluster State OK

Parent incident: Cluster State Problem incident

Event ID: 1324

Default severity level: information

Cluster State Unknown

Parent incident: Cluster State Problem incident

Event ID: 1321

Default severity level: minor

Cluster State Warn

Parent incident: Cluster State Problem incident

Event ID: 1323

Default severity level: major

CM Configuration Includes Policy Excursion

Parent incident: CM Configuration Includes Policy Exclusion incident

Event ID:

346

Description

Default severity level

Typical causes

Actions

indicates Entuity Configuration Monitor has identified a device configuration which includes a setting that violates good practice.

minor

poorly or wrongly defined device configuration.

Entuity raises an event for each policy violation. In the Open view mode of the Events dashlet, these events are collapsed into one row, with # identifying the number of events. View the events in History mode to view the specific policy violation in the event’s Details.

Correct the configuration on the device or amended your policy mandated statements file.

CM Configuration Missing Policy Mandated Statement

Parent incident: CM Configuration Missing Policy Mandated Statement incident

Event ID: 345

Description

Default severity level

Typical causes

Actions

indicates Entuity Configuration Monitor has identified that the device configuration does not include a setting required for the device to be configured according to good practice.

minor

poorly or wrongly defined device configuration

Correct the configuration on the device or amended your policy mandated statements file.

CM Firmware Version Changed

Parent incident: CM Firmware Version Changed incident

Event ID:

Description	Default severity level	Typical causes	Actions
indicates Entuity has identified a change in the device firmware configuration. Entuity raises this event and also retrieves the device configuration.	minor	this would usually be an authorized change in the device firmware. However, an unauthorized change may indicate a security issue.	Configuration Monitor initiates a retrieval of device configuration, which you can view in the archive directory

CM Previously Unsaved Configuration Saved

Parent incident: CM Unsaved Configuration incident

Event ID: 344

Description	Default severity level	Typical causes	Actions
indicates the current running and startup device configuration files are now the same.	information	a device configuration that was previously identified as not being saved, has now been saved.	none.

CM Running Configuration Changed

Parent incident: CM Running Configuraiton Changed incident

Event ID: 342

Description	Default severity level	Typical causes	Actions
indicates Entuity Configuration Monitor has retrieved a device running configuration that is significantly different from the previous running configuration retrieved from that device. This new configuration is stored, making it the new last-seen running-configuration. This event expires in 24 hours.	severe	a known configuration change to the device.	from the event's Context menu, you can compare the most recent running configurations. You can also compare configurations through the device's web UI Device Configurations dashlet.

CM Running Configuration Retrieval Failed

Parent incident: CM Running Configuration Retrieval Failed incident

Event ID: 348

Description	Default severity level	Typical causes	Actions
indicates Entuity Configuration Monitor attempted, but failed, to retrieve device running configuration. Details describes the failure to retrieve the configuration and identifies the device (either by resolved name or IP address) .This event ages out after 24 hours.	minor	if this event is raised against all devices with configuration retrieval enabled, it suggests a system-wide problem. e.g: the transport server is not running. the transfer and archive folders do not exist or permission to write to them is denied. if this event is raised against many devices with configuration retrieval enabled, it suggests a localized issue. e.g.: those devices share the same credential set, the definition of which is no longer valid. if this event is raised against one device, then it may be an issue specific to the device, e.g. the device is down, although if you have initiated a manual retrieval, it may be a more widespread issue that is yet to show itself.	check for other events raised against the device, for example Network Outage, to identify whether retrieval failure is a symptom of a more widespread problem or whether it is the real issue. identify if this event is raised against one or more devices: when the event is raised against many devices: check the transfer servers. Although Entuity Configuration Monitor is configured to work with the specified FTP, TFTP, SCP and RCP servers, it does not check that a required server is running when attempting a retrieval. If the server is not running, the retrieval will fail. check the specified transfer and archive folders exist and permit your transport servers to write to them. check credential sets are still valid. if this event is raised against one device, then it may be an issue specific to the device, e.g. the device is down. although, if you have initiated a manual retrieval, it may be a more widespread issue that is yet to show itself. to assist your investigation, you may want to activate debug mode and then re-run configuration retrieval. The additional information assists in identifying where the failure in configuration retrieval occurs.

CM Startup Configuration Changed

Parent incident: CM Startup Configuration Changed incident

Event ID: 341

Description	Default severity level	Typical causes	Actions
indicates Entuity Configuration Monitor has retrieved a device startup configuration that is significantly different from the previous startup configuration retrieved from that device. This new configuration is stored, making it the new last-seen startup-configuration. This event ages out in twenty-four hours.	severe	a known configuration change to the device.	In the Device Configurations dashlet, open and compare the difference between the current and previous configurations.

CM Startup Configuration Retrieval Failed

Parent incident: CM Startup Configuration Retrieval Failed incident

Event ID: 349

Description	Default severity level	Typical causes	Actions
indicates Entuity Configuration Monitor attempted, but failed, to retrieve device running configuration. Details describes the failure to retrieve the configuration and identifies the device, either by resolved name or IP address.This event ages out after 24 hours	minor	if this event is raised against all devices with configuration retrieval enabled, it suggests a system-wide problem. e.g: the transport server is not running. the transfer and archive folders do not exist or permission to write to them is denied. if this event is raised against many devices with configuration retrieval enabled, it suggests a localized issue. e.g.: those devices share the same credential set, the definition of which is no longer valid. if this event is raised against one device, then it may be an issue specific to the device, e.g. the device is down, although if you have initiated a manual retrieval, it may be a more widespread issue that is yet to show itself.	raised against the device, for example Network Outage, to identify whether retrieval failure is a symptom of a more widespread problem or whether it is the real issue. identify if this event is raised against one or more devices: when the event is raised against many devices: check the transfer servers. Although Entuity Configuration Monitor is configured to work with the specified FTP, TFTP, SCP and RCP servers, it does not check that a required server is running when attempting a retrieval. If the server is not running, the retrieval will fail. check the specified transfer and archive folders exist and permit your transport servers to write to them. check credential sets are still valid. if this event is raised against one device, then it may be an issue specific to the device, e.g. the device is down. although, if you have initiated a manual retrieval, it may be a more widespread issue that is yet to show itself. to assist your investigation, you may want to activate debug mode and then re-run configuration retrieval. The additional information assists in identifying where the failure in configuration retrieval occurs.

CM Unsaved Configuration

Parent incident: CM Unsaved Configuration incident

Event ID: 343

Description	Default severity level	Typical causes	Actions
indicates Entuity Configuration Monitor has retrieved, and compared, the current running and startup device configuration files. Entuity Configuration Monitor has found a significant difference between the two, which indicates an unsaved configuration change.	minor	a configuration change to the device.	In the Device Configurations dashlet, open and compare the difference between the current and previous configurations.

Component Error

Parent incident: Component State Problem incident

Event ID: 1190

Default severity: severe

Component No Predicted Failure

Parent incident: Predictive Failure incident

Event ID: 1352

Default severity: information

Component Not Present

Parent incident: Compon ent State Problem incident

Event ID: 1194

Default severity: major

Component OK

Parent incident: Component State Problem incident

Event ID: 1187

Default severity: information

Component Predicted Failure Error

Parent incident: Predicted Failure incident

Event ID: 1349

Default severity: severe

Component Predicted Failure State Unknown

Parent incident: Predictive Failure incident

Event ID: 1350

Default severity: major

Component Predicted Failure Warning

Parent incident: Predictive Failure incident

Event ID: 1351

Default severity: major

Component State Unknown

Parent incident: Component State Problem incident

Event ID: 1189

Default severity: major

Component Warning

Parent incident: Component State Problem incident

Default severity: major

Config Mgmt Job Failed

Parent incident: Config Mgmt Job Failed incident

Event ID: 351

Description

Default severity level

Typical causes

Actions

indicates one or more of the sub-jobs associated with the identified job failed. This event can be disabled for all jobs derived from the task through the task’s administration
Advanced Settings form and the Raise Event on Completion check box.

severe

the event details includes information on the cause of the job failure, e.g.:

validation failure.
user credential failure.
timeout of a sub-job.

investigate the task history.

Config Mgmt Job Succeeded

Parent incident: Config Mgmt Job Succeeded incident

Event ID: 352

Description	Default severity level	Typical causes	Actions
indicates the identified job successfully completed and therefore all of its sub-jobs successfully completed. This event can be disabled for all jobs derived from the task through the task’s administration Advanced Settings form and the Raise Event on Completion check box.	information	successful completion of job.	none.

CUCM CPU High Utilization Cleared

Parent incident: CUCM CPU High Utilization incident

Event ID: 417

Description	Default severity level	Typical causes	Actions
indicates a previous alarm has been cleared.	information	previous problem with the CPU utilization has cleared.	none.

CUCM CTI Device Not Registered

Parent incident: CUCM CTI Device Not Registered incident

Event ID: 402

Description

Default severity level

Typical causes

Actions

indicates the CTI device has not registered to the Cisco Unified Communications Manager.

critical

Cisco Unified Communications Manager or the CTI Manager may have failed.

Cisco Unified Communications Manager may have insufficient resources to handle additional devices.

check the event Details. This indicates the particular cause of the event.
incomplete registration may indicate a device is re-homing in the middle of registration.
the alarm could also indicate a device misconfiguration, database error, or an illegal/unknown device trying to attempt a connection.
for a Cisco Unified Communications Manager or CTI Manager failure, the device attempts to re-register with the back up Cisco Unified Communications Manager or CTI Manager. Entuity raises a successful device registration event. Check the Cisco Unified Communications Manager and CTI Manager for failures.
if multiple device types are failing to register with the Cisco Unified Communications Manager, check the Cisco Unified Communications Manager server has sufficient available CPU and memory resources to support additional devices.

Entuity monitors Cisco Unified Communications Manager CPU and Memory performance, raising events when high utilization thresholds are crossed. Also run a Flex Report on these metrics.

Consult the Cisco Unified Communications Manager documentation for details on device weighting.

CUCM CTI Device Registered

Parent incident: CUCM CTI Device Not Registered incident

Event ID: 403

Description	Default severity level	Typical causes	Actions
indicates the CTI device has successfully registered to the Cisco Unified Communications Manager.	information	successful CTI device registration.	none

CUCM Gatekeeper Not Registered

Parent incident: CUCM Gatekeeper Not Registered incident

Event ID: 404

Description	Default severity level	Typical causes	Actions
Cisco Unified Communications Manager cannot register with the gatekeeper.	critical	gatekeeper configuration problems. Entuity details the specific error code.	Check IP visibility from Cisco Unified Communications Manager to the gatekeeper. 2) Check gatekeeper status and verify that the gatekeeper state is up. 3) When there is a zone subnet defined on the gatekeeper, verify that the subnet of the gateway is in the allowed subnets.

CUCM Gatekeeper Registered

Parent incident: CUCM Gatekeeper Not Registered incident

Event ID: 405

Description	Default severity level	Typical causes	Actions
indicates the gatekeeper has successfully registered to the Cisco Unified Communications Manager.	information	successful gatekeeper registrations.	none.

CUCM Gateway Not Registered

Parent incident: CUCM Gateway Not Registered incident

Event ID: 410

Description	Default severity level	Typical causes	Actions
gateway registration may fail for a number of reasons.	critical	gateway registration may fail for a number of reasons, e.g. gateway software failure.	check that the gateway is up and running. All gateways have a heartbeat LED that blinks one second on and one second off when the gateway software is running normally. After a registration failure the gateway attempts to recover, which alters the LED blink pattern. If the gateway fails to recover consult the gateway documentation.

CUCM Gateway Registered

Parent incident: CUCM Gateway Not Registered incident

Event ID: 411

Description	Default severity level	Typical causes	Actions
indicates the gateway has successfully registered to the Cisco Unified Communications Manager.	information	successful gateway registration	none.

CUCM H.323 Device Not Registered

Parent incident: CUCM H.323 Device Not Registered incident

Event ID: 406

Description	Default severity level	Typical causes	Actions
H.323 Gateway device registration may fail for a number of reasons.	critical (redO	H.323 Gateway device registration may fail for a number of reasons, e.g. gateway software failure.	check that the gateway is up and running. All gateways have a heartbeat LED that blinks one second on and one second off when the gateway software is running normally. After a registration failure the gateway attempts to recover, which alters the LED blink pattern. If the gateway fails to recover consult the gateway documentation.

CUCM H.323 Device Registered

Parent incident: CUCM H.323 Device Not Registered incident

Event ID: 407

Description	Default severity level	Typical causes	Actions
indicates the H.323 device has successfully registered to the CUCM.	information	successful H.323 device registration.	none.

CUCM Media Device Not Registered

Parent incident: CUCM Media Device Not Registered incident

Event ID: 408

Description

Default severity level

Typical causes

Actions

indicates the media device has not registered to the Cisco Unified Communications Manager.

critical

Cisco Unified Communications Manager may have failed or not recognized the device type.
Cisco Unified Communications Manager may have insufficient resources to handle additional devices.

check the event Details. This indicates the particular cause of the event.
incomplete registration may indicate a device is re-homing in the middle of registration.
the alarm could also indicate a device misconfiguration, database error, or an illegal/unknown device trying to attempt a connection.
for a Cisco Unified Communications Manager or CTI Manager failure, the device attempts to re-register with the back up Cisco Unified Communications Manager or CTI Manager. Entuity raises a successful device registration event. Check the Cisco Unified Communications Manager and CTI Manager for failures.
if multiple device types are failing to register with the Cisco Unified Communications Manager, check the Cisco Unified Communications Manager server has sufficient available CPU and memory resources to support additional devices.

Entuity monitors Cisco Unified Communications Manager CPU and Memory performance, raising events when high utilization thresholds are crossed. Also run a Flex Report on these metrics.

Consult the Cisco Unified Communications Manager documentation for details on device weighting.

CUCM Media Device Registered

Parent incident: CUCM Media Device Not Registered incident

Event ID: 409

Description	Default severity level	Typical causes	Actions
indicates the media device has successfully registered to the Cisco Unified Communications Manager.	information	successful media device registration	none.

CUCM Phone Not Registered

Parent incident: CUCM Phone Not Registered incident

Event ID: 400

Description

Default severity level

Typical causes

Actions

indicates the phone has not registered to the Cisco Unified Communications Manager.

critical

Cisco Unified Communications Manager may have failed. Automatic phone registration may be turned off (default state). The Cisco Unified Communications Manager may have insufficient resources to handle additional devices.

check the event Details. This indicates the particular cause of the event.
incomplete registration may indicate a device is re-homing in the middle of registration.
the alarm could also indicate a device misconfiguration, database error, or an illegal/unknown device trying to attempt a connection.
for a Cisco Unified Communications Manager or CTI Manager failure, the device attempts to re-register with the back up Cisco Unified Communications Manager or CTI Manager. Entuity raises a successful device registration event. Check the Cisco Unified Communications Manager and CTI Manager for failures.
if multiple device types are failing to register with the Cisco Unified Communications Manager, check the Cisco Unified Communications Manager server has sufficient available CPU and memory resources to support additional devices.

Entuity monitors Cisco Unified Communications Manager CPU and Memory performance, raising events when high utilization thresholds are crossed. Also run a Flex Report on these metrics.

Consult the Cisco Unified Communications Manager documentation for details on device weighting.

CUCM Phone Registered

Parent incident: CUCM Phone Not Registered incident

Event ID: 401

Description	Default severity level	Typical causes	Actions
indicates the phone has successfully registered to the Cisco Unified Communications Manager.	information	successful phone registration.	none.

CUCM Process Memory High Utilization

Parent incident: CUCM Process memory High Utilization incident

Event ID: 418

Description	Default severity level	Typical causes	Actions
indicates the Cisco Unified Communications Manager has high process memory utilization.	severe	high CUCM process memory utilization due to interrupts, or a particular process using a lot of memory resources. Each device type registered with the Cisco Unified Communications Manager has a weight, this weight should match the Cisco Unified Communications Manager server specification. Problems may occur when this is not the case.	use Flex Reports to create a Cisco Unified Communications Manager memory report, for example one that runs every hour to monitor Cisco Unified Communications Manager memory utilization.

CUCM Process Memory High Utilization Cleared

Parent incident: CUCM Process memory High Utilization incident

Event ID: 419

Description	Default severity level	Typical causes	Actions
indicates a previous alarm has been cleared.	information	previous problem with high memory utilization has cleared.	none.

CUCM Voicemail Device Not Registered

Parent incident: CUCM Voicemail Device Not Registered incident

Event ID: 412

Description

Default severity level

Typical causes

Actions

indicates the voicemail device has not registered to the CUCM.

critical

Cisco Unified Communications Manager may have failed or not recognized the device type.
Alternatively, the Cisco Unified Communications Manager may have insufficient resources to
handle additional devices.

check the event Details. This indicates the particular cause of the event.
incomplete registration may indicate a device is re-homing in the middle of registration.
the alarm could also indicate a device misconfiguration, database error, or an illegal/unknown device trying to attempt a connection.
for a Cisco Unified Communications Manager or CTI Manager failure, the device attempts to re-register with the back up Cisco Unified Communications Manager or CTI Manager. Entuity raises a successful device registration event. Check the Cisco Unified Communications Manager and CTI Manager for failures.
if multiple device types are failing to register with the Cisco Unified Communications Manager, check the Cisco Unified Communications Manager server has sufficient available CPU and memory resources to support additional devices.

ENA monitors Cisco Unified Communications Manager CPU and Memory performance, raising events when high utilization thresholds are crossed. Also run a Flex Report on these metrics.

Consult the Cisco Unified Communications Manager documentation for details on device weighting.

CUCM Voicemail Device Registered

Parent incident: CUCM Voicemail Device Not Registered incident

Event ID: 413

Description	Default severity level	Typical causes	Actions
indicates the voicemail device has successfully registered to the Cisco Unified Communications Manager	information	successful voicemail device registration.	none.

Datastore Accessible

Parent incident: Datastore Inaccessible incident

Event ID: 1318

Default severity level: information

Datastore High Usage

Parent incident: Datastore High Usage incident

Event ID: 1320

Default severity level: severe

Datastore High Usage Cleared

Parent incident: Datastore High Usage incident

Event ID: 1319

Default severity level: information

Datastore Inaccessible

Parent incident: Datastore Inaccessible incident

Event ID: 1317

Default severity level: severe

Device Average CPU Utilization Critical

Parent incident: Device Average CPU Utilization High incident

Event ID: 655460, 8:100

Description	Default severity level	Typical causes	Actions
indicates high device CPU utilization, as an average of the utilization of all its processors.	critical	high CPU utilization due to interrupts. a particular process using a lot of CPU resources.	use the managed host function to view current and historic levels of process usage. create reports (e.g. a Routing Summary Report) that runs every hour to monitor router CPU utilization.

Device Average CPU Utilization High

Parent incident: Device Average CPU Utilization High incident

Event ID: 655415, 8:55

Description	Default severity level	Typical causes	Actions
indicates high device CPU utilization, as an average of the utilization of all its processors.	severe	high CPU utilization due to interrupts. a particular process using a lot of CPU resources.	use the managed host function to view current and historic levels of process usage. create reports (e.g. a Routing Summary Report) that runs every hour to monitor router CPU utilization.

Device Average CPU Utilization Cleared

Parent incident: Device Average CPU Utilization High incident

Event ID: 655414, 8:54

Description	Default severity level	Typical causes	Actions
ndicates that processor utilization on the device, as an average of all the device’s processor utilization, is no longer higher than the set threshold.	information	reduced usage.	none.

Device Average Memory Usage Critical

Parent incident: Device Average Memory Usage High incident

Event ID: 655461, 8:101

Description

Default severity level

Typical causes

Actions

indicates the device has a high level of usage resulting in a critically low level of available memory. Entuity combines all memory resources on the device, calculates the assigned resource and then raises the event when that resource is greater than the set threshold, by default 90%.

severe

low memory may be caused through a combination of factors:

memory leak that has consumed a large amount of memory.

network instability pushing thefree memory to zero.

device does not have enough memory to begin with but the problem is discovered only during a rare network event.

use the managed host function to view current and historic levels of memory

Device Average Memory Usage High

Parent incident: Device Average Memory Usage High incident

Event ID: 655417, 8:57

Description

Default severity level

Typical causes

Actions

indicates the device has low memory. ENA combines all memory resources on the device, calculates the assigned resource and then raises the event when that resource is greater than the set threshold, by default 80%.

severe

low memory may be caused by a combination of factors, eg.:

memory leak consuming a large amount of memory.
network instability pushing free memory to zero.
device does not have enough memory to start with, but the problem is only discovered during a rare network event.

use the managed host function to view current and historic levels of memory.

Device Average Memory Usage Cleared

Parent incident: Device Average Memory Usage High incident

Event ID: 655416, 8:56

Description	Default severity level	Typical causes	Actions
indicates the device is no longer suffering from low memory.	information	reduced usage.	none.

Device Clock Inconsistency

Parent incident: Device Clock Inconsistency incident

Event ID: 655444, 8:84

Description	Default severity level	Typical causes	Actions
poll samples for the device have been discarded, because a discrepancy that is too great between the sample interval according to device sysUpTime, and the sample interval according to ENA's clock.	minor	slow running network. misconfigured device clock.	does not necessarily indicate a network problem. Tolerance values for this event may be adjusted via settings in entuity.cfg.

Device Cold Reboot

Parent incident: Device Not Responding To SNMP incident

Event ID: 655361, 8:1

Description	Default severity level	Typical causes	Actions
indicates that a device has been rebooted or reset. This event is detected by the generation of an SNMP trap on the device.	severe	device configuration changes. hardware/software/firmware faults. lack of memory on the device. power failures.	telnet to the device and check the system logs for an indication of what caused the device to reboot.

Device Status Error

Parent incident: Device Status Problem incident

Device ID: 1255

Default severity: severe

Device Fan Failure

Parent incident: Device Fan Failure incident

Event ID: 938

Description	Default severity level	Typical causes	Actions
indicates the failure of a fan on the device.	critical	fan failure on the device.	the event includes the identifier of the failed fan, which you can use when investigating the failure and to locate it if you have to replace the fan.

Device Fan Failure Cleared

Parent incident: Device Fan Failure incident

Event ID: 937

Description	Default severity level	Typical causes	Actions
indicates a fan that had failed on the device is once again working.	information	fan may have restarted or may have been replaced with a new fan.	none.

Device High Active Sessions

Parent incident: Device High Active Sessions incident

Event ID: 621

Description	Default severity level	Typical causes	Actions
indicates the number of active sessions is greater than the set threshold, by default 1000.	major	highest number of active sessions is greater than the set threshold when the device is polled.	investigate the session history of the device.

Device High Active Sessions Cleared

Parent incident: Device High Active Sessions incident

Event ID: 620

Description	Default severity level	Typical causes	Actions
indicates the number of active sessions was greater than the set threshold, by default 1000, but has now transitioned below the set boundary.	information	number of sessions is below the set threshold.	none.

Device High Authenticated Response Time

Parent incident: Device High Authenticated Response Time incident

Event ID: 623

Description	Default severity level	Typical causes	Actions
data for this event is retrieved through custom scripts. Contact Entuity Technical Services for details.	major	authentication response time is greater than the set threshold.	investigate the authentication history of the device.

Device High Authenticated Response Time Cleared

Parent incident: Device High Authenticated Response Time incident

Event ID: 622

Default severity level: information

Device High External URL Response Time

Parent incident: Device High External URL Response Time incident

Event ID: 625

Default severity level: major

Device High External URL Response Time Cleared

Parent incident: Device High External URL Response Time incident

Event ID: 624

Description	Default severity level	Typical causes	Actions
data for this event is retrieved through custom scripts. Contact Entuity Technical Services for details.	information	external URL response time was greater than the set threshold, but has now transitioned below the set boundary.	none.

Device High Messages Received

Parent incident: Device High Messages Received incident

Event ID: 627

Description	Default severity level	Typical causes	Actions
indicates the number of message received is greater than the set threshold, by default 1000.	major	a large number of messages have been sent to this device.	investigate the history of the device.

Device High Messages Received Cleared

Parent incident: Device High Messages Received incident

Event ID: 626

Description	Default severity level	Typical causes	Actions
indicates the number of message received was greater than the set threshold, by default 1000, but has now transitioned below the set boundary.	information	reduction in the number of messages.	none.

Device Low Disk Space

Parent incident: Device Low Disk Space incident

Event ID: 314

Description	Default severity level	Typical causes	Actions
indicates the device has low disk space.	severe	cause of low disk space depends on the device, e.g. firewalls can generate large log files.	use the managed host function to view current and historic levels of disk space.

Device Low Disk Space Cleared

Parent incident: Device Low Disk Space incident

Event ID: 315

Description	Default severity level	Typical causes	Actions
indicates the device is no longer suffering from low disk space.	information	reduced usage.	none.

Device Name Resolution Failure

Parent incident: Device Name Resolution Failure incident

Event ID: 655448, 8:88

Description	Default severity level	Typical causes	Actions
indicates ENA poller could reach the device using its IP address, but not resolve its device host name.	minor	a corruption or incorrect entry in the hosts file. an incorrect configuration of the Domain Name System server.	investigate domain name resolution. The exact steps depend upon your operating system and the Domain Name System configuration.

Device Name Resolution Failure Cleared

Parent incident: Device Name Resolution Failure incident

Event ID: 655449, 8:89

Description	Default severity level	Typical causes	Actions
indicates ENA can resolve the device hostname.	information	correction of previous DNS problem.	none.

Device OK

Parent incident: Device Status Problem incident

Event ID: 1253

Default severity: information

Device Port(s) Utilization Accuracy Lost

Parent incident: Device Port(s) Utilization Accuracy Problem incident

Event ID: 655446, 8:85

Description	Default severity level	Typical causes	Actions
ENA eyepoller counter wrap margin allows ENA to identify devices for which it may miss counter wraps. This event indicates that the traffic rate is being polled from 32 bit counters and that the combination of the poll rate and linespeed make the resulting measurement susceptible to inaccuracy and the polled data is therefore discarded.	major	this event may be triggered if poll operations take longer, for example as a result of SNMP timeouts. Otherwise this event may suggest that the polling load is beyond ENA's capacity, in which case the problem is with ENA, not with the network.	check the device for polling problems. check the ENA server load.

Device Port(s) Utilization Accuracy at Risk

Parent incident: Device Port(s) Utilization Accuracy Problem incident

Event ID: 655445, 8:86

Description	Default severity level	Typical causes	Actions
ENA eyepoller counter wrap margin allows ENA to identify devices for which it may miss counter wraps. This event indicates that a device was in danger of missing a counter wrap for, is being safely polled.	minor	this event may be triggered if poll operations take longer, for example as a result of SNMP timeouts. Otherwise this event may suggest that the polling load is beyond ENA's capacity, in which case the problem is with ENA, not with the network.	check the device for polling problems. check the ENA server load.

Device Port(s) Utilization Missed Due to Slow Response

Parent incident: Device Port(s) Utilization Accuracy Problem incident

Event ID: 655447, 8:87

Description	Default severity level	Typical causes	Actions
this event indicates that a device has responded too slowly to ENA polling and data has been lost.	major	a configuration change to ENA may mean the device is polled more frequently. If the polling frequency has not changed and there has been no significant change to the device configuration or loading then SNMP traffic may be being lost either in the device or between the Entuity server and the device. This may be because the weakest link is now overloaded for some reason.	monitor the polling of the device.

Device Reachability Degraded

Parent incident: Device Reachability Problems incident

Event ID: 655382, 8:22

Description	Default severity level	Typical causes	Actions
This event is not enabled by default. It is enabled from the ICMP Monitor Settings page (click Administration > ICMP Monitor) by selecting the Enable Device Unreachable Events and Raise "Device Reachability Degraded" events checkboxes.	severe	ENA identifies reachability of the device as degraded but ENA does not consider it as the root cause of the degradation. Reachability to the device is potentially only degraded because of the behavior of the identified root cause, i.e. this may be a symptomatic event.	check the Device Status history.

Device Reboot Detected

Parent incident: Device Not Responding To SNMP incident

Event ID: 655365, 8:5

Description	Default severity level	Typical causes	Actions
indicates that a device has recently been rebooted or reset. ENA monitors device system uptime by polling the device every ten minutes, gathering SysUpTime.	severe	device configuration changes, hardware/software/firmware faults. lack of memory on the device. power failures.	consult your device documentation on investigating the device cooling system.

Device Sensor Non-Operational

Parent incident: Device Sensor Non-Operational incident

Event ID: 942

Default severity: minor

Device Sensor Non-Operational Cleared

Parent incident: Device Sensor Non-Operational incident

Event ID: 941

Description	Default severity level	Typical causes	Actions
indicates a device that was reporting a high temperature is now returning a value within accepted boundaries.	information	resolution of original problem.	none.

Device Sensor Warning Value

Parent incident: Device Sensor Warning Value incident

Event ID: 940

Description	Default severity level	Typical causes	Actions
indicates a high temperature on the device, with the event details including the device’s reported temperature.	major	overworked device, fan failure, air conditioner failure in the room, air blockage to cooling vents.	consult your device documentation on investigating the device cooling system.

Device Sensor Value Cleared

Parent incident: Device Sensor Warning Value incident

Event ID: 939

Description	Default severity level	Typical causes	Actions
indicates a device that was reporting a high temperature is now returning a value within accepted boundaries.	information	resolution of original problem.	none.

Device State Unknown

Parent incident:

Event ID: 1256

Default severity: major

Device Unreachable

Parent incident: Device Reachability Problems incident

Event ID: 655381, 8:21

Description	Default severity level	Typical causes	Actions
This event is not enabled by default. It is enabled from the ICMP Monitor Settings page (click Administration > ICMP Monitor) by selecting the Enable Device Unreachable Events checkbox.	critical	ENA identifies the device as unavailable and also if it is the root cause of the outage. Reachability to the device is potentially only degraded because of the behavior of the identified root cause, i.e. this may be a symptomatic event.	check the Device Status history.

Device Unreachable Cleared

Parent incident: Device Reachability Problems incident

Event ID: 655380, 8:20

Description	Default severity level	Typical causes	Actions
ENA identifies the device as available and clears the original Device Unreachable or Device Reachability Degraded event.	information	resolution of the original problem.	none.

Device Warm Reboot

Parent incident: Device Not Responding To SNMP incident

Event ID: 655362, 8:2

Description	Default severity level	Typical causes	Actions
indicates that a device has just been rebooted or reset. This event is detected by the generation of an SNMP trap on the device.	severe	device configuration changes. hardware/software/firmware faults. lack of memory on the device. power failure.	Telnet to the device and check the system logs for an indication of what caused the device to reboot.

Device Warning

Parent incident: Device Status Problem incident

Event ID: 1254

Default severity: major

Devices Operating At Critical Temperature

Parent incident:

Event ID: 1122

Default severity: severe

DHCP Leases Exhausted

Parent incident:

Event ID: 1121

Default severity: major

DNAC Backup Failure

Parent incident: DNAC Backup Failure incident

Event ID: 675

Default severity: severe

DNAC Backup Success

Parent incident: DNAC Backup Failure incident

Event ID: 674

Default severity: information

DNAC Connection Failed

Parent incident: DNAC Poller Failed incident

Event ID: 743

Default severity: severe

DNAC Connection Failure Cleared

Parent incident: DNAC Poller Failed incident

Event ID: 742

Default severity: information

DNAC Poller Overrun

Parent incident: DNAC Poller Overrun incident

Event ID: 745

Default severity: severe

DNAC Poller Overrun Cleared

Parent incident: DNAC Poller Overrun incident

Event ID: 744

Default severity: information

EGP Neighbor Loss

Parent incident: EPG Neighbor Loss incident

Event ID: 655369, 8:9

Description	Default severity level	Typical causes	Actions
indicates that the device's peer relationship with an EGP (Extended Gateway Protocol) neighbor no longer exists. The SNMP trap includes the identity IP address of the peered router, which ENA attempts to resolve to the host name.	critical	peer router has gone down.	investigate the peer router.

EIGRP Peer Briefly Not Established

Parent incident: EIGRP Peer Briefly Not Established incident

Event ID: 146

Description	Default severity level	Typical causes	Actions
indicates to administrators that virtual links between EIGRP speakers are now well established but bounced recently. ENA identifies a recent bounce as the up time is lower than in the previous poll.	critical	EIGRP keep-alives may be lost, so the local router terminates the connection and then successfully attempt to reestablish it. Other causes maybe an unstable remote router, traffic shaping limitations.	check logs are activated on the device. Use the logs to investigate error messages.

EIGRP Peer Disappeared

Parent incident: EIGRP Peer Disappeared incident

Event ID: 144

Description	Default severity level	Typical causes	Actions
indicates a former adjacent peer has been removed from the router's configuration. Administrators should be aware of this change, to be able to detect rogue configuration updates.	critical	removal of an adjacent router.	investigate the cause of router disappearance.

EIGRP Peer Newly Discovered

Parent incident:

(Entuity v21.0 P02 upwards) EIGRP Peer Disappeared incident
(Entuity v21.0 P01 and below) EIGRP Peer Newly Discovered incident

Event ID: 145

Description	Default severity level	Typical causes	Actions
indicates ENA's discovery of a new EIGRP peer.	minor	configuration of a new EIGRP peer.	none.

Entuity License Expired and This Entuity Server is No Longer Operational

Parent incident: Entuity License Problem incident

Event ID: 786449, 32:17

Description	Default severity level	Typical causes	Actions
indicates the license on the central license server has expired. The central license server provides the credits for the remote ENA license client to manage its network, this remote ENA server also requires a locally installed valid license. The local license determines the modules and integrations enabled on that ENA install.	critical	the Entuity central license server is down. a general network problem is preventing communication between the Entuity servers.	check the status of the license server, for example has it been taken down for scheduled maintenance. review other raised events, do they indicate a general networking issue.

Entuity License Not Updated by License Server and Will Expire

Parent incident: Entuity License Problem incident

Event ID: 786448, 32:16

Description	Default severity level	Typical causes	Actions
indicates the Entuity license server cannot contact the remote Entuity server. The license server regularly contacts its remote clients to maintain and verify their license details. A remote server can only run for a limited time, by default seven days, without contact from its license server. This event is raised after a set period of non-contact, by default two days. These settings are configurable through entuity.cfg.	minor	Entuity central license server is down. a general network problem is preventing communication between the Entuity servers.	check the status of the license server, for example has it been taken down for scheduled maintenance. review other raised events, do they indicate a general networking issue.

Entuity License on Remote Server Could Not be Updated

Parent incident: Entuity License on Remote Server Problem incident

Event ID: 786445, 32:13

Description	Default severity level	Typical causes	Actions
indicates the central license server cannot contact one of its remote Entuity servers. This event is raised after a set period of non-contact, by default two days. These settings are configurable through entuity.cfg.	minor	the remote Entuity server is down. a general network problem is preventing communication between the Entuity servers.	check the status of the remote Entuity server, for example has it been taken down for scheduled maintenance. review other raised events, do they indicate a general networking issue.

Entuity License on Remote Server Expired

Parent incident: Entuity License on Remote Server Problem incident

Event ID: 786446, 32:14

Description	Default severity level	Typical causes	Actions
indicates the license for a remote client is no longer verified. An Entuity server using a client license can only run for a limited time (by default 7 days), without contact from its license server. This setting is configurable through entuity.cfg.	critical	the license server has not contacted its client for a minimum of 7 days.	check the status of the remmote Entuity server, e.g. has it been taken down for scheduled maintenance? Review other raised events and check if they indicate a general networking issue.

Entuity License on Remote Server Successfully Updated

Parent incident: Entuity License on Remote Server Problem incident

Event ID: 786447, 32:15

Description	Default severity level	Typical causes	Actions
indicates the Entuity license server has restored contact to the remote client Entuity server. The license server regularly contacts its remote clients to maintain and verify their license details. A remote server can only run for a limited time (by default 7 days), without contact from its license server. This setting is configurable through entuity.cfg.	information	the central Entuity license server was down, e.g. for maintenance, but is now online again.	none.

Entuity License Successfully Updated by License Server

Parent incident: Entuity License Problem incident

Event ID: 786450, 32:18

Description	Default severity level	Typical causes	Actions
indicates the Entuity license server has reestablished contact with this Entuity server.	information	the remote Entuity license server was down, e.g. for maintenance, but is now online again.	none.

Entuity Remote Subsystem Error

Parent incident: Entuity Remote Subsystem Error incident

Event ID: 786463

Default severity: severe

Entuity Remote Subsystem Error Cleared

Parent incident: Entuity Remote Subsystem Error incident

Event ID: 786465

Default severity: information

Entuity Remote Subsystem Error Updated

Parent incident: Entuity Remote Subsystem Error incident

Event ID: 786464

Default severity: critical

Entuity Server Automated Shutdown

Parent incident: Entuity Automated Shutdown incident

Event ID: 786436, 32:4

Description	Default severity level	Typical causes	Actions
generated by Entuity warning it is shutting down. This is raised by diskMonitor and indicates Entuity is closing down, to protect the database from possible corruption. This is a system-wide event, appearing in all Views.	critical	low disk space.	check server for disk space. if the space appears sufficient, you can amend the diskMonitor threshold settings to values more appropriate to your system.

diskMonitor is intended to protect the Entuity database from corrupting when the server runs out of disk space. This safeguard is removed if diskMonitor is configured incorrectly.

Entuity Server Component Restarting After Failure

Parent incident: (Entuity v21.0 and below) Entuity Server Component Problem incident, (Entuity v21.0 P01 upwards) Entuity Server Component Restarting After Failure incident

Event ID: 786442, 32:10

Description	Default severity level	Typical causes	Actions
indicates a non-critical Entuity component has failed. This is a system-wide event, appearing in all Views.	severe	a component of the Entuity server has failed.	use the Impacted and Details fields to identify the failed Entuity component. Entuity will attempt to restart the component, raising an Entuity Server Permanent Failure of Component event if it fails to restart the component. You can view more details through systemcontrol.log in entuity_home\log.

Entuity Server Critical Component Restarting After Failure

Parent incident: (Entuity v21.0 and below) Entuity Server Component Problem incident, (Entuity 21.0 P01 and above) Entuity Server Component Restarting After Failure incident

Event ID: 786441, 32:9

Description	Default severity level	Typical causes	Actions
indicates a critical Entuity component has failed and that Entuity is attempting to restart that component. This is a system-wide event, appearing in all Views. It persists in the logger pane for 24 hours or until the Entuity server is restarted, whichever is earlier.	severe	a component key to Entuity server performance has failed.	use the Impacted and Details fields to identify the failed Entuity component. Entuity will attempt to restart the component, raising an Entuity Server Permanent Failure of Component event if it fails to restart the component. You can view more details through systemcontrol.log in entuity_home\log.

Entuity Server Database Backup Failure

Parent incident: Entuity Server Database Backup incident

Event ID: 786451

Description	Default severity level	Typical causes	Actions
indicates the Entuity backup failed.	critical	a component that is key to Entuity server performance has failed.	use the Impacted and Details fields to identify the failed Entuity component. Entuity will attempt to restart the component, raising an Entuity Server Permanent Failure of Component event if it fails to restart the component. You can view more details through systemcontrol.log in entuity_home\log.

Entuity Server Disk Space Alert

Parent incident: Entuity Server Disk Space Alert incident

Event ID: 786434, 32:2

Description	Default severity level	Typical causes	Actions
indicates the Entuity server is running low on disk space, and details the remaining disk space in megabytes. It is generated by diskMonitor. This is a system-wide event, appearing in all Views.	critical	low disk space.	check server for disk space, if the space appears sufficient, you can amend the diskMonitor threshold settings to values more appropriate to your system.

diskMonitor is intended to protect the Entuity database from corrupting when the server runs out of disk space. Configuring it inappropriately will remove this safeguard.

Entuity Server Explicit Shutdown Initiated

Parent incident: Entuity Server Explicit Shutdown Initiated incident

Event ID: 786438, 32:6

Description	Default severity level	Typical causes	Actions
indicates Entuity server has been instructed to shutdown, for example from the command line using stopeye or as a result of critical shortage of disc space. This is a system-wide event, appearing in all views when the Entuity server restarts.	severe	administrator has taken down the server.	when the Entuity server has shut itself down, investigate available disk space on the server.

Entuity Server Internal Event

Parent incident: Entuity Server Internal Event incident

Event ID: 786436, 32:1

Description	Default severity level	Typical causes	Actions
event generated that reports on the status of an Entuity service.	minor	license expiry. Entuity process failure.	determined by event type.

Entuity Server License Alert

Parent incident: Entuity Server License Alert incident

Event ID: 786435, 32:3

Description	Default severity level	Typical causes	Actions
indicates one or more of Entuity's licensable components is approaching or has reached either its limit of managed objects or expiry date. The event description details the licensable component(s) and the number of free credits. This is a system wide event, appearing in all Views.	critical	addition of managed objects. approaching expiry date.	either unmanage objects to free up license credits, or contact your Entuity representative and purchase additional credits.

Entuity Server Permanent Component Failure

Parent incident: (Entuity v21.0 and below) Entuity Server Component Problem incident, (Entuity v21.0 P01 upwards) Entuity Server Permanent Component Failure incident

Event ID: 786440, 32:8

Description	Default severity level	Typical causes	Actions
indicates the Entuity server has attempted to restart the failed component, but has been unable to do so. The component remains down until manually restarted, if possible, or the Entuity server is restarted. This is a system-wide event, appearing in all Views.	critical	failure to restart an Entuity component.	use the Impacted and Details fields to identify the failed Entuity component. You can view more details through systemcontrol.log in entuity_home\log.

Entuity Server Shutdown Forced By Critical Failure To Restart

Parent incident: Entuity Server Shutdown Forced by Critical Failure to Restart incident

Event ID: 786439, 32:7

Description	Default severity level	Typical causes	Actions
indicates a critical Entuity component has failed repeatedly preventing the Entuity server from performing normally. The Entuity server has then automatically shutdown. This is a system-wide event, appearing in all Views when the Entuity server restarts.	critical	indicates a critical Entuity component has failed repeatedly, preventing the Entuity server from performing normally.	investigate the Entuity log files, available from entuity_home\log, e.g. systemcontrol.log, DsKernelStatic.log.

Entuity Server Started

Parent incident: (Entuity v21.0 and below) Entuity Server Component Problem incident, (Entuity v21.0 P01 upwards) Entuity Server Permanent Component Failure incident

Event ID: 786437, 32:5

Description	Default severity level	Typical causes	Actions
indicates the Entuity server has successfully started. This is a system-wide event, appearing in all Views when the Entuity server restarts.	information	indicates the Entuity server has successfully started.	none.

Excessive SNMP Trap Rate

Parent incident: Excessive SNMP Trap Rate incident

Event ID: 786459, 32:27

Default severity level: severe

Excessive Syslog Message Rate

Parent incident: Excessive Syslog Message Rate incident

Event ID: 786458, 32:26

Default severity level: severe

Failover Event Detected

Parent incident:

Event ID: 1123

Default severity level: severe

Firewall Access Control Violations High

Parent incident: Firewall Access Control Violations High incident

Event ID: 900

Description

Default severity level

Typical causes

Actions

indicates the NetContinuum firewall is identifying a high number of access control violations by a managed application. This may indicate an attack, or an inappropriate firewall configuration for a particular application. NetContinuum firewalls identify a series of access control type violations:

Denied HTTP.
Requests.
Blocked DAP.
Blacklisted.
Blocked Methods.
Robots Denied.
Robots Allowed.

Entuity sums the total number of violations that occurred during the last polling period (by
default Entuity polls NetContinuum firewalls every five minutes.) When the total number of
access control violations exceeds the set threshold, which is configurable but by default set to ten,
Entuity raises this event.

severe

an application is being inappropriately used. This may be because users are either consciously or inadvertently attempting to use an application beyond the configured constraints.

Entuity includes to the event the source application and the breakdown of access control violations by type, from which you can identify the particular types, or types of violation, causing concern. After investigation you may determine an attack has occurred, or that, for example, the URL Access Control Lists (ACLs) require adjustment.

Firewall Access Control Violations High Cleared

Parent incident: Firewall Access Control Violations High incident

Event ID: 901

Description	Default severity level	Typical causes	Actions
indicates that the high number of access control violations rate has returned to within acceptable boundaries.	information	reduced number of control violations.	none.

Firewall High Accepted Packet Rate

Parent incident: Firewall High Accepted Packet Rate incident

Event ID: 922

Default severity level: major

Firewall High Accepted Packet Rate Cleared

Parent incident: Firewall High Accepted Packet Rate incident

Event ID: 923

Default severity level: information

Firewall High Availability State Changed

Parent incident: Firewall Access Control Violations High incident

Event ID: 797

Default severity: severe

Firewall High Avail User Set Oper State Compliant

Parent incident: Firewall High Avail User Set Oper State Non Compliant incident

Event ID: 1017

Description	Default severity level	Typical causes	Actions
the High Availability module status on the device and the User Set Oper State set in Entuity were different but are now the same.	information	User Set Oper State may have been amended to match the state on the device. the device state may have transitioned to be the same as User Set Oper State.	none.

Firewall High Avail User Set Oper State Non Compliant

Parent incident: Firewall High Avail User Set Oper State Non Compliant incident

Event ID: 1018

Description

Default severity level

Typical causes

Actions

the High Availability module status on the device and the User Set Oper State set in Entuity are different.

severe

User Set Oper State may have been amended to a state different to that on the device. More significantly, the device state may have transitioned to a different state to that of User Set Oper State.

in Events dashlet the event Details column displays both the User Set Oper State and the polled device state. The type of disparity determines your action where the change in High Availability module was:

expected and permanent: amend the module's User Set Oper State.
unexpected: investigate the cause of the change in module state. It may indicate a serious problem that could impact the performance of the firewall cluster.

Firewall High Current Connections

Parent incident: Firewall High Current Connections incident

Event ID: 907

Description	Default severity level	Typical causes	Actions
indicates the number of current connections is greater than the set threshold, which by default is 1000.	severe	highest number of current connections is greater than the set threshold when the firewall is polled.	investigate the connection history of the device.

Firewall High Current Connections Cleared

Parent incident: Firewall High Current Connections incident

Event ID: 906

Description	Default severity level	Typical causes	Actions
indicates the number of current connections was greater than the set threshold, which by default is 1000, but is now below that boundary.	information	reduction in the number of current connections.	none.

Firewall High Dropped Packet Rate

Parent incident: Firewall High Dropped Packet Rate incident

Event ID: 927

Default severity level: major

Firewall High Dropped Packet Rate Cleared

Parent incident: Firewall High Dropped Packet Rate incident

Event ID: 926

Default severity level: information

Firewall High Logged Packet Rate

Parent incident: Firewall High Logged Packet Rate incident

Event ID: 929

Default severity level: major

Firewall High Logged Packet Rate Cleared

Parent incident: Firewall High Logged Packet Rate incident

Event ID: 928

Default severity level: information

Firewall High Rejected Packet Rate

Parent incident: Firewall High Rejected Packet Rate incident

Event ID: 925

Default severity level: major

Firewall High Rejected Packet Rate Cleared

Parent incident: Firewall High Rejected Packet Rate incident

Event ID: 924

Default severity level: information

Firewall Overflow and Intrusion Violations High

Parent incident: Firewall Overflow and Intrusion Violations High incident

Event ID: 902

Description

Default severity level

Typical causes

Actions

indicates the NetContinuum firewall is identifying a high number of overflow and intrusion violations. This may indicate an attack, or an inappropriate firewall configuration for a particular application. NetContinuum firewalls identify a series of overflow and intrusion type
violations:

Keyword Intrusions.
Query Length Intrusions.
Cookie Overflow Intrusions.
Header Count Intrusions.
Content Overflow Intrusions.
Parameter Length Overflows.
Empty Valued.

Entuity sums the total number of violations that occurred during the last polling period (by default Entuity polls NetContinuum firewalls every five minutes). When the total number of overflow and intrusion violations exceeds the set threshold (which is configurable, but by default set to ten), Entuity raises this event.

severe

forms tampering can modify the information sent from a particular field on a form, for example adding extra, malicious instructions through a buffer overflow.

Entuity will include, to the event, the source application and the breakdown of overflow and intrusion violations by type. From this, you can identify the particular types, or types of violation, that are causing concern.

Firewall Overflow and Intrusion Violations High Cleared

Parent incident: Firewall Overflow and Intrusion Violations High incident

Event ID: 903

Description	Default severity level	Typical causes	Actions
indicates the high number of overflow and intrusion violations has returned to within acceptable boundaries.	information	reduced number of overflow and intrusion violations.	none.

Firewall URL Alerts High

Parent incident: Firewall URL Alerts High incident

Event ID: 904

Description

Default severity level

Typical causes

Actions

indicates the NetContinuum firewall is identifying a high number of URL alerts against a particular application. NetContinuum firewalls identify these types of violations:

URL Encoding Errors
Slash Dot URLs Blocked
Tilde in URL Blocked
Character Set Encoding Errors
Bad Certificates.

Entuity sums the total number of alerts against the application that occurred during the last polling period, by default Entuity polls NetContinuum firewalls every five minutes. When the total number of URL alerts exceeds the set threshold (which is configurable, but by default set to 500), Entuity raises this event.

severe

an attack can use different ploys based around how URLs are handled. For example, hiding an attack within a different character set. The NetContinuum Controller can identify character set encoding schemes and identify attacks hidden within them

Entuity includes, to the event, the source application and the breakdown of URL alerts by type, from which you can identify the particular types, or types of URL violation, causing concern.

Firewall URL Alerts High Cleared

Parent incident: Firewall URL Alerts High incident

Event ID: 905

Description	Default severity level	Typical causes	Actions
indicates that the number of URL alerts has returned to within acceptable boundaries.	information	reduced number of URL alerts against the application.	none.

Firmware Task Failed

Parent incident: Firmware Task Failed incident

Event ID: 1222

Default severity: severe

Firmware Task Succeeded

Parent incident:

Event ID:

Default severity: information

Firmware Task Warning

Parent incident: Firmware Task Warning incident

Event ID: 1224

Default severity: minor

FR DLCI High BECN

Parent incident: Firewall DLCI High BECN incident

Event ID: 3

Description	Default severity level	Typical causes	Actions
indicates the frame relay is encountering congestion, specifically the available bandwidth at the time of transmission is not as great as can be supported by the sending terminal.	major	inadequate network infrastructure. heavy network traffic. high levels of line noise. portions of the system going down.	identifying and resolving these issues can improve overall network performance, especially when the system is called upon to carry a large volume of traffic

FR DLCI High BECN Cleared

Parent incident: Firewall DLCI High BECN incident

Event ID: 4

Description	Default severity level	Typical causes	Actions
indicates that the frame relay encountering congestion has returned to within acceptable boundaries.	information	reduced usage.	none.

FR DLCI High DE

Parent incident: FR DLCI High DE incident

Event ID: 5

Description	Default severity level	Typical causes	Actions
indicates that the Committed Information Rate (CIR) has been exceeded on inbound traffic on this PVC.	major	when the CIR is exceeded, traffic gets marked DE by the frame relay switch. If congestion is then detected these packets are dropped.	use the PVC Utilization report to investigate further.

FR DLCI High DE Cleared

Parent incident: FR DLCI High DE incident

Event ID: 6

Description	Default severity level	Typical causes	Actions
indicates that the Committed Information Rate (CIR) has returned to within acceptable boundaries on inbound traffic on this PVC.	information	reduced usage.	none.

FR DLCI High FECN

Parent incident: FR DLCI High FECN incident

Event ID: 1

Description	Default severity level	Typical causes	Actions
indicates that the WAN is encountering congestion forward of the packet, i.e. the available bandwidth at the time of transmission is not as great as can be supported by the receiving terminal.	major	inadequate network infrastructure. heavy network traffic. high levels of line noise. portions of the system going down.	identifying and resolving these issues can improve overall network performance, especially when the system is called upon to carry a large volume of traffic.

FR DLCI High FECN Cleared

Parent incident: FR DLCI High FECN incident

Event ID: 2

Description	Default severity level	Typical causes	Actions
indicates that the Committed Information Rate (CIR) has returned to within acceptable boundaries on outbound traffic on this PVC.	information	reduced usage.	none.

FR DLCI High Inbound Utilization

Parent incident: FR DLCI High Inbound Utilization incident

Event ID: 7

Description	Default severity level	Typical causes	Actions
indicates inbound utilization of the port is high and could impact performance.	major	PVC utilization is higher than PVC utilization threshold for the port, due to increased traffic.	generate PVC utilization reports to monitor the situation.

FR DLCI High Inbound Utilization Cleared

Parent incident: FR DLCI High Inbound Utilization incident

Event ID: 8

Description	Default severity level	Typical causes	Actions
indicates PVC utilization is now below the high threshold value.	information	reduced transmission.	none.

FR DLCI High Outbound Utilization

Parent incident: FR DLCI High Outbound Utilization incident

Event ID: 9

Description	Default severity level	Typical causes	Actions
indicates outbound utilization of the port is high and could impact performance.	major	PVC utilization higher than PVC utilization threshold for the port due to increased traffic.	generate PVC utilization reports to monitor the situation.

FR DLCI High Outbound Utilization Cleared

Parent incident: FR DLCI High Outbound Utilization incident

Event ID: 10

Description	Default severity level	Typical causes	Actions
indicates PVC utilization in now below the high threshold value.	information	reduced transmission.	none.

FR DLCI Link Down

Parent incident: FR DLCI Link Down incident

Event ID: 11

Description	Default severity level	Typical causes	Actions
indicates PVC is unavailable.	severe	problems with connection to router-CSU/DSU devices, PVC congestion indicated by CIR exceeded.	investigate whether the problem occurs on the public or private section of the network, and then run PVC reports.

FR DLCI Link Up

Parent incident: FR DLCI Link Down incident

Event ID: 12

Description	Default severity level	Typical causes	Actions
indicates PVC is available.	information	a PVC that was unavailable is now available.	none.

Gateway To Repeater

Parent incident:

Event ID: 1124

Default severity level: information

HBA Offline

Parent incident: HBA Status Problem incident

Event ID: 1326

Default severity level: severe

HBA Online

Parent incident: HBA Status Problem incident

Event ID: 1328

Default severity level: information

HBA Status Unknown

Parent incident: HBA Status Problem incident

Event ID: 1325

Default severity level: minor

HBA Unbound

Parent incident: HBA Status Problem incident

Event ID: 1327

Default severity level: major

(ACI) High APIC CPU

Parent incident: ACI APIC High CPU incident

Event ID: 787

Description	Default severity level	Typical causes	Actions
indicates the CPU utilisation is greater than the set High APIC CPU threshold. By default 90.	critical	highest number of CPU utilization is greater than the set threshold when the device is polled.	investigate what processes are taking too much CPU time and if the device is under high load.

(ACI) High APIC CPU Cleared

Parent incident: ACI APIC High CPU incident

Event ID: 786

Description	Default severity level	Typical causes	Actions
indicates the CPU utilisation was greater than the set High APIC CPU threshold but has now transitioned below the set boundary.	information	highest number of CPU utilization is back below the set threshold when the device is polled.	none.

(ACI) High APIC Memory

Parent incident: ACI APIC High Memory incident

Event ID: 789

Description	Default severity level	Typical causes	Actions
indicates the memory utilization is greater than the set High APIC Memory threshold. By default 90.	critical	highest number of memory utilization is greater than the set threshold when the device is polled.	investigate what processes are utilizing too much memory space and if the device is under high load.

(ACI) High APIC Memory Cleared

Parent incident: ACI APIC High Memory incident

Event ID: 788

Description	Default severity level	Typical causes	Actions
indicates the memory utilization was greater than the set High APIC Memory threshold, but has now transitioned back below the set boundary.	information	highest number of memory utilization is now back below the set threshold when the device is polled.	none.

HSRP Port Group Activated

Parent incident: HSRP Port Group Activated incident

Event ID: 175

Description	Default severity level	Typical causes	Actions
indicates the HSRP port is active.	major	when preemption is enabled, the newly activated router has a higher priority than the previously active router. the previously active router has become unavailable, this router was the standby router and has now activated.	none.

HSRP Port Group Deactivated

Parent incident: HSRP Port Group Deactivated incident

Event ID: 176

Description	Default severity level	Typical causes	Actions
indicates the HSRP port group has transitioned from an active to a deactivated state.	major	indicates the HSRP port group has transitioned from an active state to one of n/a, Initial, Learn, Listen, Speak, or Standby. You can view the current state through the event details column.	investigate the cause of the transition of the HSRP port group to deactivated when preemption is not enabled. When Entuity monitors the router it raises events indicating the cause of failure.

Hypervisor Connected

Parent incident: Hypervisor Connection Problem incident

Event ID: 1300

Default severity level: information

Hypervisor High CPU Usage

Parent incident: Hypervisor High CPU Usage incident

Event ID: 1306

Default severity level: severe

Hypervisor High CPU Usage Cleared

Parent incident: Hypervisor High CPU Usage incident

Event ID: 1305

Default severity level: information

Hypervisor High Memory Usage

Parent incident: Hypervisor High Memory Usage incident

Event ID: 1308

Default severity level: severe

Hypervisor High Memory Usage Cleared

Parent incident: Hypervisor High Memory Usage incident

Event ID: 1307

Default severity level: information

Hypervisor Not Connected

Parent incident: Hypervisor Connection Problem incident

Event ID: 1299

Default severity level: severe

Hypervisor Not Responding

Parent incident: Hypervisor Connection Problem incident

Event ID: 1333

Default severity level: major

Hypervisor Overall State Alarm

Parent incident: Hypervisor Overall State Problem incident

Event ID: 1310

Default severity level: severe

Hypervisor Overall State OK

Parent incident: Hypervisor Overall State Problem incident

Event ID: 1312

Default severity level: information

Hypervisor Overall State Unknown

Parent incident: Hypervisor Overall State Problem incident

Event ID: 1309

Default severity level: minor

Hypervisor Overall State Warn

Parent incident: Hypervisor Overall State Problem incident

Event ID: 1311

Default severity level: major

Hyperisor Power Standby

Parent incident: Hypervisor Power State Problem incident

Event ID: 1302

Default severity level: major

Hypervisor Power State Unknown

Parent incident: Hypervisor Power State Problem incident

Event ID: 1301

Default severity level: minor

Hypervisor Powered Off

Parent incident: Hypervisor Power State Problem incident

Event ID: 1304

Default severity level: severe

Hypervisor Powered On

Parent incident: Hypervisor Power State Problem incident

Event ID: 1303

Default severity level: information

IO Module High Temperature

Parent incident: IO Module High Temperature incident

Event ID: 1361

Default severity level: severe

IO Module High Temperature Cleared

Parent incident: IO Module High Temperature incident

Event ID: 1362

Default severity level: information

IPAM Conflict Found

Parent incident: IPAM Conflict Found incident

A network has a conflict.

Event ID: 1292

Default severity level: minor

IPAM Conflict Resolved

Parent incident: IPAM Conflict Found incident

A network's conflict was resolved.

Event ID: 1293

Default severity level: information

IPAM IP Usage OK

Parent incident: IPAM IP Usage Over Threshold incident

Having previously exceeded it, a network has a % of active IP addresses that is now equal to or below the network's Usage High value, or the global settings' Usage High value.

Event ID: 1295

Default severity level: information

IPAM IP Usage Over Threshold

Parent incident: IPAM IP Usage Over Threshold incident

A network has a % of active IP addresses that exceed the network's Usage High value, or the global settings' Usage High value.

Event ID: 1294

Default severity level: minor

IP SLA Creation Failure

Parent incident: IP SLA Creation Failure incident

Event ID: 234

Description	Default severity level	Typical causes	Actions
indicates the creation of an IP SLA operation has failed on the source device.	critical	the create command does not include the correct SNMP write community string. Alternatively, there may be access restrictions to the device.	check the correct SNMP write community string is set on the device. check access is not restricted to the device, including any firewall allows through the appropriate commands (i.e. snmpSet permission).

IP SLA Creation Failure Cleared

Parent incident: IP SLA Creation Failure incident

Event ID: 235

Description	Default severity level	Typical causes	Actions
indicates the operation was successfully created, but does not indicate that it is collecting data.	information	raised the first time the operation is successfully created on the device.	none.

IP SLA High ICPIF

Parent incident: IP SLA High ICPIF incident

Event ID: 236

Description	Default severity level	Typical causes	Actions
ICPIF attempts to quantify the key impairments to voice quality that are encountered in the network. A high ICPIF value indicates high impairment.	critical	packet loss due to equipment impairment. latency due to increased traffic.	run a Flex Report to investigate further.

IP SLA High ICPIF Cleared

Parent incident: IP SLA High ICPIF incident

Event ID: 237

Description	Default severity level	Typical causes	Actions
indicates a previous High ICPIF alarm has been cleared.	information	VoIP quality of service, as measured by ICPIF, has returned to acceptable levels.	none.

IP SLA Low MOS

Parent incident: IP SLA Low MOS incident

Event ID: 238

Description	Default severity level	Typical causes	Actions
MOS is a common benchmark used to determine the quality of sound produced by specific codecs. A wide range of listeners have judged the quality of voice samples sent using particular codecs, on a scale of 1 (poor quality) to 5 (excellent quality). The opinion scores are averaged to provide the mean for each sample.	critical	packet loss due to equipment impairment. latency due to increased traffic.	run a Flex Report to investigate further.

IP SLA Low MOS Cleared

Parent incident: IP SLA Low MOS incident

Event ID: 239

Description	Default severity level	Typical causes	Actions
indicates a previous Low MOS alarm has been cleared.	information	VoIP quality of service, as measured by MOS, has returned to acceptable levels.	none.

IP SLA Test Failed

Parent incident: IP SLA Test Failed incident

Event ID: 230

Description	Default severity level	Typical causes	Actions
indicates the operation was successfully created but it failed to connect to the target device.	major	access restrictions to the device. a failure on the network.	check the target device is available. when communicating through a firewall check the IP SLA source port is set correctly. check the target device’s destination port is IP SLA responsive. This is achieved either by having the IP SLA responder enabled or having a process listening on that port. When using IP SLA responder’s control packets must also be used (and also allowed through the firewall).

IP SLA Test High Latency

Parent incident: IP SLA Test High Latency incident

Event ID: 232

Description	Default severity level	Typical causes	Actions
indicates the operation is reporting latency between the source and target device above the threshold settings for the operation.	critical	packet loss, due to equipment impairment. latency, due to increased traffic.	check the performance of the target device. review latency over an extended period, e.g. run the IP SLA Details report.

IP SLA Test High Latency Cleared

Parent incident: IP SLA Test High Latency incident

Event ID: 233

Description	Default severity level	Typical causes	Actions
indicates the operation is reporting latency between the source and target device that has returned to below its threshold settings, having previously been above.	information	the cause of the high latency on the network has been resolved, e.g. a high latency may only be reported at peak times.	none.

IP SLA Test Succeeded

Parent incident: IP SLA Test Failed incident

Event ID: 231

Description	Default severity level	Typical causes	Actions
indicates the operation is successfully collecting data.	information	raised the first time the operation collects data from a device. after a failure in operation collection has been resolved and data is being collected again.	none.

IS-IS Peer Disappeared

Parent incident: IS-IS Peer Disappeared incident

Event ID: 118

Description	Default severity level	Typical causes	Actions
indicates a former adjacent peer has been removed from router's configuration. Administrators should be aware of this change to be able to detect rogue configuration updates.	critical	removal of an adjacent router.	investigate the cause of router disappearance.

IS-IS Peer Established

Parent incident: IS-IS Peer Established incident

Event ID: 117

Description	Default severity level	Typical causes	Actions
indicates that virtual links between IS-IS peers are well established. The state has just transitioned to Full.	minor	OSPF peering established.	none.

IS-IS Peer Newly Discovered

Parent incident:

(Entuity v21.0 P02 upwards) IS-IS Peer Disappeared incident
(Entuity v21.0 P01 and below) IS-IS Peer Newly Discovered incident

Event ID: 119

Description	Default severity level	Typical causes	Actions
indicates discovery of a new IS-IS peer.	minor	configuration of a new IS-IS peer.	none.

IS-IS Peer Not Established

Parent incident: IS-IS Peer Not Established incident

Event ID: 116

Description	Default severity level	Typical causes	Actions
indicates that a former adjacent peer is no longer in reach. The state has just transitioned out of the Full state.	critical	problems with IP reachability or incorrect IS-IS configuration.	use the ping and show route commands to verify network connectivity to the IS-IS peer. You can use the show log messages command to look for errors relating to the peer.

LAP Antenna Host Count High

Parent incident: LAP Antenna Host Count Abnormality incident

Event ID: 836

Description	Default severity level	Typical causes	Actions
for each LAP antenna you can set a maximum number of hosts that they can handle, a number higher than the antenna can efficiently handle.	minor	changes in wireless usage have occurred since hte network was designed.	you can check the Interface Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a rising usage trend you may want to extend the capabilities of your wireless network.

LAP Antenna Host Count High Cleared

LAP Antenna Host Count Abnormality incident

Event ID: 837

Description	Default severity level	Typical causes	Actions
raised when the number of hosts attached to the LAP antenna has returned to an acceptable level.	information	number of hosts attached to the antenna has returned to an acceptable level.	none.

LAP Antenna Host Count Low

LAP Antenna Host Count Abnormality incident

Event ID: 838

Description	Default severity level	Typical causes	Actions
the combined count of hosts that are wirelessly associated with all of the antennas on a WAP has fallen below the set threshold.	minor	changes in wireless usage have occurred since the network was designed.	you can check the Antenna Advanced tab and review the hourly and daily mean and maximum attached host values. When the historic record indicates a falling usage trend you may want to adjust the capabilities of your wireless network.

LAP Antenna Host Count Low Cleared

LAP Antenna Host Count Abnormality incident

Event ID: 839

Description	Default severity level	Typical causes	Actions
the clearing correlation event for WAP Antenna Host Count Low event.	information	number of hosts attached to the antenna has returned to an acceptable level.	none.

Load Balancer High Connection Limit Pkt Drop Rate

Parent incident: Load Balancer High Connection Limit Pkt Drop Rate incident

Event ID: 972

Description	Default severity level	Typical causes	Actions
the connection requests rejected because they exceeded the connection drop rate for a virtual server (IP address:Port).	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate the client connection history.

Load Balancer High Connection Limit Pkt Drop Rate Cleared

Parent incident: Load Balancer High Connection Limit Pkt Drop Rate incident

Event ID: 973

Description	Default severity level	Typical causes	Actions
the connection requests rejected because they exceeded the connection limit for a virtual server (IP address:Port) is now within the set thresholds.	information	reduced demand on the load balancer hardware accelerator.	none.

Load Balancer High Current Sessions

Parent incident: Load Balancer High Current Sessions incident

Event ID: 660

Description	Default severity level	Typical causes	Actions
indicates the number of current sessions is equal to, or greater than the set current sessions threshold, which is by default 10000000.		a change in the usage of the network placing an unexpected demand on your load balancer setup. persistent sessions not releasing resources. a misconfiguration of your load balancer setup, or a failure. Entuity settings inappropriate to load balancer pool services.	investigate the history of session assignment, a persistent problem may indicate a requirement to reconfigure your load balancer setup.

Load Balancer High Current Sessions Cleared

Parent incident: Load Balancer High Current Sessions incident

Event ID: 661

Description	Default severity level	Typical causes	Actions
indicates the number of current sessions is less than the set current sessions threshold, which is by default 10000000.	information	a return to the expected network load.	none.

Load Balancer High Error Count

Parent incident: Load Balancer High Total Errors incident

Event ID: 664

Description	Default severity level	Typical causes	Actions
the total session errors are greater than the set threshold, by default 10000000.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Error Count Cleared

Parent incident: Load Balancer High Total Errors incident

Event ID: 665

Description	Default severity level	Typical causes	Actions
the total inbound and outbound packet errors for the system is within the set threshold.	information	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Inbound Error Rate

Parent incident: Load Balancer High Inbound Error Rate incident

Event ID: 976

Description	Default severity level	Typical causes	Actions
the error rate for incoming packets for the load balancer is higher than the set threshold, which by default is 6250000 packets per second.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Inbound Error Rate Cleared

Parent incident: Load Balancer High Inbound Error Rate incident

Event ID: 977

Description	Default severity level	Typical causes	Actions
the error rate for incoming packets for the load balancer is higher than the set threshold, which by default is 6250000 packets per second.	information	reduced demand on the load balancer hardware accelerator.	none.

Load Balancer High License Denied Pkt Rate

Parent incident: Load Balancer High License Denied Pkt Rate incident

Event ID: 968

Description	Default severity level	Typical causes	Actions
packets were dropped due to exceeding licensing limitations, which by default is 500 packets per second.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High License Denied Pkt Rate Cleared

Parent incident: Load Balancer High License Denied Pkt Rate incident

Event ID: 969

Description	Default severity level	Typical causes	Actions
rate of dropped packets due to exceeding licensing limitations no longer exceeds the set threshold.	information	reduced traffic. availability of greater load balancer resource.	none.

Load Balancer High Maximum Sessions

Parent incident: Load Balancer High Maximum Sessions incident

Event ID: 662

Description	Default severity level	Typical causes	Actions
indicates the number of maximum sessions is equal to, or greater than the set maximum sessions threshold, which is by default 10000000.		a change in the usage of the network placing an unexpected demand on your load balancer setup. persistent sessions not releasing resources. a misconfiguration of your load balancer setup, or a failure. Entuity settings inappropriate to load balancer pool services.	investigate the history of session assignment. A persistent problem may indicate a requirement to reconfigure your load balancer setup.

Load Balancer High Maximum Sessions Cleared

Parent incident: Load Balancer High Maximum Sessions incident

Event ID: 663

Description	Default severity level	Typical causes	Actions
indicates the number of maximum sessions is less than the set maximum sessions threshold, which is by default 10000000.	information	a return to the expected network load.	none.

Load Balancer High Memory Error Pkt Rate

Parent incident: Load Balancer High Memory Error Pkt Rate incident

Event ID: 970

Description	Default severity level	Typical causes	Actions
indicates connection errors were the result of insufficient available memory.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Memory Error Pkt Rate Cleared

Parent incident: Load Balancer High Memory Error Pkt Rate incident

Event ID: 971

Description	Default severity level	Typical causes	Actions
indicates connection errors that were the result of insufficient available memory are resolved.	information	reduced traffic. availability of greater load balancer resource.	none.

Load Balancer High No Handler Denied Pkt Rate

Parent incident: Load Balancer High No Handler Denied Pkt Rate incident

Event ID: 966

Description	Default severity level	Typical causes	Actions
indicates that the incoming packets that could not be processed by a virtual server, NAT or SNAT is at a rate greater than the set threshold.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High No Handler Denied Pkt Rate Cleared

Parent incident: Load Balancer High No Handler Denied Pkt Rate incident

Event ID: 967

Description	Default severity level	Typical causes	Actions
indicates that the incoming packets that could not be processed by a virtual server, NAT or SNAT is now at a rate within the set threshold.	information	reduced traffic. availability of greater load balancer resource.	none.

Load Balancer High Non Syn Denied Pkt Rate

Parent incident: Load Balancer High Non Syn Denied Pkt Rate incident

Event ID: 964

Description	Default severity level	Typical causes	Actions
indicates that the packets that are not connection requests, and are destined for a virtual server that has no connection for the client address, are at a rate greater than the set threshold.	critical	the packets that are not connection requests and are destined for a virtual server that has no connection for that client address.	investigate client's server address list.

Load Balancer High Non Syn Denied Pkt Rate Cleared

Parent incident: Load Balancer High Non Syn Denied Pkt Rate incident

Event ID: 965

Description	Default severity level	Typical causes	Actions
indicates that the packets that are not connection requests, and are destined for a virtual server that has no connection for the client address, are now at a rate within the set threshold.	information	client now has access to the virtual server.	none.

Load Balancer High Outbound Error Rate

Parent incident: Load Balancer High Outbound Error Rate incident

Event ID: 978

Description	Default severity level	Typical causes	Actions
the total outgoing packet errors for the system is greater than the set threshold.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Outbound Error Rate Cleared

Parent incident: Load Balancer High Outbound Error Rate incident

Event ID: 979

Description	Default severity level	Typical causes	Actions
total outgoing packet errors for the system is now within the set threshold.	information	reduced traffic. availability of greater load balancer resource.	none.

Load Balancer High Packet Drop Rate

Parent incident: Load Balancer High Packet Drop Rate incident

Event ID: 974

Description	Default severity level	Typical causes	Actions
total number of dropped packets is higher than the set threshold.	critical	availability of load balancer servers is insufficient to meet demand. inefficient assignment of clients to servers.	investigate load balancer resourcing and configuration.

Load Balancer High Packet Drop Rate Cleared

Parent incident: Load Balancer High Packet Drop Rate incident

Event ID: 975

Description	Default severity level	Typical causes	Actions
total number of dropped packets is within the set threshold.	information	reduced traffic. availability of greater load balancer resource.	none.

Load Balancer High SLB SP Current Sessions

Parent incident: Load Balancer High SLB SP Current Sessions incident

Event ID: 1005

Description	Default severity level	Typical causes	Actions
the number of sessions the Server Load Balancer (SLB) service processor is currently handling is higher than the set threshold, which is by default 75% of the maximum allowed.		a change in the usage of the network placing an unexpected demand on your load balancer setup. Persistent sessions not releasing resources. A misconfiguration of your load balancer setup, or a failure. Entuity settings inappropriate to the SLB setup, for example too low a threshold.	investigate history of service processor utilization.

Load Balancer High SLB SP Current Sessions Cleared

Parent incident: Load Balancer High SLB SP Current Sessions incident

Event ID: 1004

Description	Default severity level	Typical causes	Actions
the number of sessions that the Server Load Balancing (SLB) service processor is currently handling is within the set threshold (by default 75% of the maximum allowed).	information	a reduction in the load on the load balancer.	none.

Load Balancer Pool Critical Member Availability

Parent incident: Load Balancer Pool Member Availability Problem incident

Event ID: 1015

Description	Default severity level	Typical causes	Actions
number of members available to the pool is reduced to a critical level.	critical	number of available members is less than the set threshold when the device is polled.	investigate the history of member usage for the pool.

Load Balancer Pool Critical Member Availability Cleared

Parent incident: Load Balancer Pool Member Availability Problem incident

Event ID: 1013

Description	Default severity level	Typical causes	Actions
number of members available to the pool has transitioned to a value within the set threshold.	information	a reduction in the resources used for the load balancer pool.	none.

Load Balancer Pool Critical Services Availability

Parent incident: Load Balancer Pool Critical Services Availability Problem incident

Event ID: 666

Description	Default severity level	Typical causes	Actions
indicates the number of available services is below the set critical services thresholds, which is by default 0.	critical	a change in the usage of the network, placing an unexpected demand on your load balancer setup. a misconfiguration of your load balancer setup, or a failure. Entuity settings inappropriate to load balancer pool services.	investigate the history of service availability a persistent problem may indicate a requirement to reconfigure your load balancer setup.

Load Balancer Pool Critical Services Availability Cleared

Parent incident: Load Balancer Pool Critical Services Availability Problem incident

Event ID: 667

Description	Default severity level	Typical causes	Actions
indicates the number of available services has transitioned above the set critical services thresholds, which is by default 0.	information	a reduction in the services used for the load balancer pool.	none.

Load Balancer Pool Low Member Availability

Parent incident: Load Balancer Pool Member Availability Problem incident

Event ID: 1016

Description	Default severity level	Typical causes	Actions
the number of members available to the pool is reduced to a low level.	major	number of available members is less than the set threshold when the device is polled.	none.

Load Balancer Pool Low Member Availability Cleared

Parent incident: Load Balancer Pool Member Availability Problem incident

Event ID: 1014

Description	Default severity level	Typical causes	Actions
the number of members available to the pool has transitioned to a value within the set threshold.	information	a reduction in the resources used for the load balancer pool.	none.

Load Balancer Pool Low Services Availability

Parent incident: Load Balancer Pool Critical Services Availability Problem incident

Event ID: 668

Description	Default severity level	Typical causes	Actions
indicates the number of available services is equal to or below the set services thresholds, which is by default 2.	severe	A change in the usage of the network placing an unexpected demand on your load balancer setup. A misconfiguration of your load balancer setup, or a failure. Entuity settings inappropriate to load balancer pool services.	investigate the history of service availability. A persistent problem may indicate a requirement to reconfigure your load balancer setup.

Load Balancer Pool Low Services Availability Cleared

Parent incident: Load Balancer Pool Critical Services Availability Problem incident

Event ID: 669

Description	Default severity level	Typical causes	Actions
indicates the number of available services has transitioned above the set services thresholds, which is by default 2.	information	a reduction in the services used for the load balancer pool.	none.

Load Balancer vServer High Current Sessions

Parent incident: Load Balancer vServer High Current Sessions incident

Event ID: 653

Default severity level: severe

Load Balancer vServer High Current Sessions Cleared

Parent incident: Load Balancer vServer High Current Sessions incident

Event ID: 652

Default severity level: information

Load Balancer vServer High Sessions Rate

Parent incident: Load Balancer vServer High Sessions Rate incident

Event ID: 651

Default severity level: severe

Load Balancer vServer High Sessions Rate Cleared

Parent incident: Load Balancer vServer High Sessions Rate incident

Event ID: 650

Default severity level: information

Load Balancer vService High Current Sessions

Parent incident: Load Balancer vService High Current Sessions incident

Event ID: 659

Default severity level: severe

Load Balancer vService High Current Sessions Cleared

Parent incident: Load Balancer vService High Current Sessions incident

Event ID: 658

Default severity level: information

Load Balancer vService High Failed Sessions Rate

Parent incident: Load Balancer vService High Failed Sessions Rate incident

Event ID: 657

Default severity level: severe

Load Balancer vService High Failed Sessions Rate Cleared

Parent incident: Load Balancer vService High Failed Sessions Rate incident

Event ID: 656

Default severity level: information

Load Balancer vService High Sessions Rate

Parent incident: Load Balancer vService High Sessions Rate incident

Event ID: 655

Default severity level: severe

Load Balancer vService High Sessions Rate Cleared

Parent incident: Load Balancer vService High Sessions Rate incident

Event ID: 654

Default severity level: information

Logical Disk High Used Capacity %

Parent incident: Logical Disk High Used Capacity % incident

Event ID: 1359

Default severity level: severe

Logical Disk High Used Capacity Cleared

Parent incident: Logical Disk High Used Capacity % incident

Event ID: 1360

Default severity level: information

Logical Volume High Disk Queue

Parent incident: Logical Volume High Disk Queue incident

Event ID: 427

Description	Default severity level	Typical causes	Actions
indicates the length of the disk queue is greater than the set Logical Volume High Disk Queue threshold. By default 6.	major	highest number of disk queue length is greater than the set logical volume high disk queue threshold when the device is polled.	Disk queues should be no greater than x2 the number of physical disks serving the drive. For example, if the underlying storage is a 6 disk RAID 5 array, then the total disk queue should be 12 or less.

Logical Volume High Disk Queue Warning

Parent incident: Logical Volume High Disk Queue incident

Event ID: 428

Description	Default severity level	Typical causes	Actions
indicates the length of the disk queue is greater than the set Logical Volume High Disk Queue Warning threshold. By default 6.	minor	highest number of disk queue length is greater than the set logical volume high disk queue warning threshold when the device is polled.	Disk queues should be no greater than x2 the number of physical disks serving the drive. For example, if the underlying storage is a 6 disk RAID 5 array, then the total disk queue should be 12 or less.

Logical Volume High Disk Queue Cleared

Parent incident: Logical Volume High Disk Queue incident

Event ID: 429

Description	Default severity level	Typical causes	Actions
indicates the length of the disk queue was greater than the set threshold, but has now transitioned below the set boundary.	information	highest number of disk queue length is now below the set threshold when the device is polled.	none.

Logical Volume Inodes % Used High

Parent incident: Logical Volume Inodes Percent Used High incident

Event ID: 426

escription	Default severity level	Typical causes	Actions
indicates the Inodes usage is greater than the set Logical Volume Inodes % Used High threshold. By default 80.	major	highest number of Inodes usage is greater than the set threshold when the device is polled.	identify if Inodes are completely exhausted or are just running low. You might need to delete unnecessary files on the disk.

Logical Volume Inodes % Used High Warning

Parent incident: Logical Volume Inodes Percent Used High incident

Event ID: 425

Description	Default severity level	Typical causes	Actions
indicates the Inodes usage is greater than the set Logical Volume Inodes % Used High Warning threshold. By default 70.	minor	highest number of Inodes usage is greater than the set threshold when the device is polled.	identify if Inodes are completely exhausted or are just running low. You might need to delete unnecessary files on the disk.

Logical Volume Inodes % Used High Cleared

Parent incident: Logical Volume Inodes Percent Used High incident

Event ID: 424

Description	Default severity level	Typical causes	Actions
indicates the Inodes usage was greater than the set threshold, but has now transitioned below the set boundary.	information	highest number of Inodes usage is now back below the set threshold when the device is polled.	none.

Logical Volume Low Free Space

Parent incident: Logical Volume Low Free Space incident

Event ID: 1210

Description	Default severity level	Typical causes	Actions
indicates the free space remaining is less than the set Logical Volume Low Free Space threshold. By default 5000 MB.	major	highest amount of free space is less than the set threshold when the device is polled.	free up more space by deleting unnecessary files, or extend the volume.

Logical Volume Low Free Space Warning

Parent incident: Logical Volume Low Free Space incident

Event ID: 808

Description	Default severity level	Typical causes	Actions
indicates the free space remaining is less than the set Logical Volume Low Free Space Warning threshold. By default 7500 MB.	minor	highest amount of free space is less than the set threshold when the device is polled.	free up more space by deleting unnecessary files, or extend the volume.

Logical Volume Low Free Space Cleared

Parent incident: Logical Volume Low Free Space incident

Event ID: 1211

Description	Default severity level	Typical causes	Actions
indicates the free space has now transitioned back above and is greater than the set threshold.	information	highest amount of free space is above the set threshold when the device is polled.	none.

Logical Volume Space % Used High

Parent incident: Logical Volume Space Used Percent High incident

Event ID: 1208

Description	Default severity level	Typical causes	Actions
indicates the space usage is greater than the set Logical Volume Space % Used High threshold. By default 80.	major	highest amount of space usage is greater than the set threshold when the device is polled.	free up more space by deleting unnecessary files, or extend the volume.

Logical Volume Space % Used High Warning

Parent incident: Logical Volume Space Used Percent High incident

Event ID: 809

Description	Default severity level	Typical causes	Actions
indicates the space usage is greater than the set Logical Volume Space % Used High Warning threshold. By default 70.	minor	highest amount of space usage is greater than the set threshold when the device is polled.	free up more space by deleting unnecessary files, or extend the volume.

Logical Volume Space % Used High Cleared

Parent incident: Logical Volume Space Used Percent High incident

Event ID: 1209

Description	Default severity level	Typical causes	Actions
indicates the space usage has now transitioned back below the set threshold.	information	highest amount of space usage is now back below the set threshold when the device is polled.	none.

(ACI) Low EPG Health

Parent incident: ACI Low EPG Health incident

Event ID: 785

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low EPG Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low EPG Health Cleared

Parent incident: ACI Low EPG Health incident

Event ID: 784

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low EPG Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Fabric Node Health

Parent incident: ACI Low Fabric Node Health incident

Event ID: 773

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Fabric Node Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Fabric Node Health Cleared

Parent incident: ACI Low Fabric Node Health incident

Event ID: 772

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Fabric Node Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Fan Tray Health

Parent incident: ACI Low Fan Tray Health incident

Event ID: 777

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Fan Tray Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Fan Tray Health Cleared

Parent incident: ACI Low Fan Tray Health incident

Event ID: 776

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Fan Tray Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Line Card Health

Parent incident: ACI Low Line Card Health incident

Event ID: 775

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Line Card Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Line Card Health Cleared

Parent incident: ACI Low Line Card Health incident

Event ID: 774

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Fan Tray Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Pod Health

Parent incident: ACI Low Pod Health incident

Event ID: 771

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Pod Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Pod Health Cleared

Parent incident: ACI Low Pod Health incident

Event ID: 770

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Pod Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low PSU Health

Parent incident: ACI Low PSU Health incident

Event ID: 779

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low PSU Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low PSU Health Cleared

Parent incident: ACI Low PSU Health incident

Event ID: 778

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Pod Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Supervisor Card Health

Parent incident: ACI Low Supervisor Card Health incident

Event ID: 781

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Supervisor Card Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Supervisor Card Health Cleared

Parent incident: ACI Low Supervisor Card Health incident

Event ID: 780

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Supervisor Card Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

(ACI) Low Tenant Health

Parent incident: ACI Low Tenant Health incident

Event ID: 783

Description	Default severity level	Typical causes	Actions
indicates the health score is lower than the set Low Tenant Health threshold. By default 90.	critical	highest number of the health score is lower than the set threshold when the device is polled.	review current health/status of ACI components to determine root cause of a low health score.

(ACI) Low Tenant Health Cleared

Parent incident: ACI Low Tenant Health incident

Event ID: 782

Description	Default severity level	Typical causes	Actions
indicates the health score was lower than the set Low Tenant Card Health threshold, but has now transitioned back above the set boundary.	information	highest number of the health score is now back above the set threshold when the device is polled.	none.

LUN High Latency

Parent incident: LUN High latency incident

Event ID: 1240

Default severity: severe

LUN High Latency Cleared

Parent incident: LUN High latency incident

Event ID: 1239

Default severity: information

LUN High Used Provisioned

Parent incident: LUN High Used Provisioned % incident

Event ID: 1242

Default severity: severe

LUN High Used Provisioned Cleared

Parent incident: LUN High Used Provisioned % incident

Event ID: 1241

Default severity: information

MAC Address High Port Count

Parent incident: MAC Address High Port Count incident

Event ID: 524336, 2:48

Description

Default severity level

Typical causes

Actions

this is a threshold-based event and is disabled by default. It can be enabled through Threshold Settings by setting the number of MAC addresses you consider is a high MAC address count.

Entuity does not raise this event against trunking ports.

major

macman compares the number of MAC addresses discovered on a port against the Entuity threshold set for that port, by default set to three.

investigate why the device is handling so many MAC addresses, and monitor the impact on its performance.

If you judge the threshold setting is too low, you can amend it for the individual port, for all the ports on the current pot's device, or as a global change for all of the ports managed by the server.
If you judge the event is not appropriate for the port, you can disable it for the individual port, for all ports on the current port's device, or as a global change for all ports managed by the server.

MAC Address High Port Count Cleared

Parent incident: MAC Address High Port Count incident

Event ID: 524337, 2:49

Description	Default severity level	Typical causes	Actions
indicates a previous MAC Address High Port Count alarm associated with this port has been cleared.	information	number of MAC addresses associated with the port is now within the set thresholds.	none.

MAC Address New

Parent incident: MAC Address New incident

Event ID: 524334, 2:46

Description

Default severity level

Typical causes

Actions

Entuity discovers one or more new MAC addresses on a port, raising one event for all of the new MAC addresses on the port. Entuity considers a new MAC address as one not listed in the retained history of MAC addresses for the current port. By default Entuity retains the last fifty MAC addresses discovered on a port, although this is configurable through
machistorylimit in entuity.cfg.

Entuity does not raise events for:

newly discovered ports within a defined inhibit time, which prevents Entuity from raising a torrent of events caused by Entuity discovering new devices. By default this inhibit time is 24 hours, but it is configurable through the MAC Addresses threshold tab.
- a 24 hour inhibit period allows provost scheduled macman to run and discover MAC addresses, providing a base against which new and change events can be recognized. When macman is run through macScheduler then that baseline can be discovered earlier and Entuity can ignore the inhibit time.
the very first MAC address(es) seen on a port, to avoid a blizzard of events when Entuity manages new devices.
any mac addresses that recur on a port.

Entuity checks for changes in port state every hour, and events are raised within that context. When the conditions of the new MAC address match the criteria of the MAC Address Port Change event, Entuity raises both events against this port.

This is a threshold-based event and is disabled by default.

major

Entuity discovers a new MAC address on a managed port, e.g. when a host, such as a PC, is plugged into an access layer switch that Entuity manages, Entuity raises a MAC Address New event.

when this event is not accompanied by a MAC Port Address Port Change event it is a
warning to you that a new host has connected to your network. Although the introduction of a
new host might be a benign event it requires further investigation as it may:

indicate a personally owned device has connected to the network, which may be compromised, e.g. insufficient anti-virus protection which could allow access to malicious worms, adware, viruses and other infectious material.
be the signature of the introduction of an unauthorized Wireless Access Point which might not have its security configuration enabled (they are unsecured by default) and would therefore invite intrusion to an otherwise secure network.

MAC Address Port Change

Parent incident: MAC Address Port Change incident

Event ID: 524332, 2:44

Description

Default severity level

Typical causes

Actions

When Entuity discovers a MAC address that is new to the current port, but which it has a record of occurring on one or more other ports, it raises a MAC Address Port Change event.

ENA considers a change MAC address as one not listed in the retained history of ports for that MAC address, but other ports are listed in this retained history. By default, Entuity retains the last fifty ports associated with a MAC address, although this is configurable through machistorylimit in entuity.cfg.

Entuity raises the event against the first new port (in terms of lexicographic listing), specifying the MAC address, together with the ports it was last seen on and the ports it is now seen on. Entuity checks for changes in port state every hour, and events are raised within that context.

When the conditions of the port change MAC address match the criteria of the MAC Address New event Entuity also raises a MAC Address New event against this port.

This is a threshold-based event and is disabled by default.

A MAC address macman previously discovered on one port, or ports, it now discovers on an additional port. For example, when a host, such as a PC, is unplugged from one access layer switch that Entuity manages and plugged into another, Entuity raises a MAC Address Port Change event.

may indicate a security concern that requires further investigation.

Malware Download Blocked

Parent incident:

Event ID: 1126

Default severity: minor

Malware Download Detected

Parent incident:

Event ID: 1127

Default severity: severe

Matching Software Installations Found

Parent incident:

Event ID: 1128

Default severity: information

MDM Certificate Will Expire Soon

Parent incident:

Event ID: 1125

Default severity: severe

Memory Low

Parent incident: Memory Low incident

Event ID: 655419, 8:59

Description

Default severity level

Typical causes

Actions

indicates the managed memory object is running low on available memory.

severe

may be caused through a combination of factors:

memory leak that has consumed a large amoubt of memory.
a network instability pushes the free memory to zero.
the device does not have enough memory to begin with, but the problem is discovered only during a rare network event.

use the managed host function to view current and historic levels of memory.

Memory Low Cleared

Parent incident: Memory Low incident

Event ID: 655418, 8:58

Description	Default severity level	Typical causes	Actions
indicates the managed object is no longer suffering from low memory.	information	reduced usage.	none.

Memory Module High Temperature

Parent incident: Memory Module High Temperature incident

Event ID: 1371

Default severity: severe

Memory Module High Temperature Cleared

Parent incident: Memory Module High Temperature incident

Event ID: 1372

Default severity: information

Memory Module Low Voltage

Parent incident: Memory Module Low Voltage incident

Event ID: 1369

Default severity: severe

Memory Module Low Voltage Cleared

Parent incident: Memory Module Low Voltage incident

Event ID: 1370

Default severity: information

Memory Used High

Parent incident: Memory Used High incident

Event ID: 655388, 8:28

Default severity: severe

Memory Used High Cleared

Parent incident: Memory Used High incident

Event ID: 655389, 8:29

Default severity: information

Meraki Device Status Healthy

Parent incident: Meraki Device Status Impaired incident

Event ID: 794

Default severity: information

Meraki Device Status Impaired

Parent incident: Meraki Device Status Impaired incident

Event ID: 795

Default severity: information

Meraki Management Profile Removed

Meraki Uplink Status Active

Parent incident: Meraki Uplink Status Change incident

Event ID: 677

Default severity: information

Meraki Uplink Status Inactive

Parent incident: Meraki Uplink Status Change incident

Event ID: 676

Default severity: severe

Meraki: Appliances Came Up

Parent incident:

Event ID: 1277

Default severity: information

Meraki: Appliances Went Down

Parent incident:

Event ID: 1278

Default severity: major

Missing Events

Parent incident:

Event ID:

Description	Default severity level	Typical causes	Actions
these are generated when Entuity detects an event has occurred but cannot display it.	n/a (white)	this indicates Entuity has raised an event for which it does not have record for that type in its database. This may happen, for example, when creating an event through the Open Trap Receiver and the event being raised before Event Viewer has updated its tables to recognize the event. After the next refresh the event would be properly recognized, i.e. the event has not been received by the client.	none. This should be a temporary issue resolved when Entuity's tables and event caches are synchronized.

Module Disappeared

Parent incident: Module Disappeared incident

Event ID: 913

Description	Default severity level	Typical causes	Actions
indicates a module (card) is no longer on a device.	critical	removal of a module by an administrator. critical failure of a module on the device.	when the module has failed the system administrator should investigate. You can Telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Module Discovered

Parent incident:

(Entuity v21.0 P03 upwards) Module Disappeared incident
(Entuity v21.0 P02 and below) Module Discovered incident

Event ID: 912

Description	Default severity level	Typical causes	Actions
indicates discovery module (card) for a device Entuity already manages.	minor	addition of a module on the device. It may also be raised when a device is added to Entuity.	none.

Module Down

Parent incident: Module Status Problem incident

Event ID: 589844, 4:24

Description	Default severity level	Typical causes	Actions
indicates a module (card) fault for a device.	critical	faulty module card hardware or firmware.	Telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Module Major Fault

Parent incident: Module Status Problem incident

Event ID: 589847, 4:23

Description	Default severity level	Typical causes	Actions
indicates a device has a major module (line card) hardware or firmware problem.	critical	faulty card hardware or firmware.	Telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Module Minor Fault

Parent incident: Module Status Problem incident

Event ID: 589846, 4:22

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor module (line card) hardware or firmware problem.	severe	faulty card hardware or firmware.	Telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Module Status OK

Parent incident: Module Status Problem incident

Event ID: 589844, 4:20

Description	Default severity level	Typical causes	Actions
indicates that a module (card) fault for a device has been cleared.	information	faulty module (card) has been swapped out.	none.

Module Status Unknown

Parent incident: Module Status Problem incident

Event ID: 589845, 4:21

Description	Default severity level	Typical causes	Actions
indicates that Entuity cannot determine the status of the device.	major	faulty card hardware or firmware.	Telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Motion Detected

Parent incident:

Event ID: 1130

Default severity: information

MPLS LDP Entity Errors

Parent incident: MPLS LDP Entity Errors incident

Event ID: 192

Description	Default severity level	Typical causes	Actions
the LDP entity represents a label space that is targeted for distribution to an LDP peer.	critical	Entity errors may be: Bad LDP Identifier Errors Bad PDU Length Errors Bad Message Length Errors Bad Message Length Errors Bad TLV Length Errors Malformed TLV Value Errors Keep Alive Timer Expiry Errors.	investigate the entity configuration. The event includes the LDP entity device and associated LDP peer.

MPLS LDP Entity Errors Cleared

Parent incident: MPLS LDP Entity Errors incident

Event ID: 193

Description	Default severity level	Typical causes	Actions
the LDP entity no longer has associated errors.	information	a corrected configuration. improvement in network performance.	none.

MPLS LDP Entity Non-operational

Parent incident: MPLS LDP Entity Non-operational incident

Event ID: 182

Description	Default severity level	Typical causes	Actions
indicates the LDP session state has transitioned from operational to a non-operational state.	critical	indicates the LDP session state has transitioned from operational.	the event includes the LDP entity device and associated LDP peer. Investigate the entity configuration; the event includes the new state of the session: Unknown Non existent Initialized Open Receive Open Sent.

MPLS LDP Entity Operational

Parent incident: MPLS LDP Entity Non-operational incident

Event ID: 183

Description	Default severity level	Typical causes	Actions
indicates the LDP session state has transitioned from a non-operational to an operational state.	information	the session is operational as the LSR has received acceptable initialization and keep alive messages.	none.

MPLS LDP Entity Rejected Sessions

Parent incident: MPLS LDP Entity Rejected Sessions incident

Event ID: 190

Description	Default severity level	Typical causes	Actions
LSR has received a session initialization message but has rejected the session.	critical	one or more of the session parameters, for example LDP protocol version, label distribution method, timer values are not acceptable. The LSR responds by sending a Session Rejected/Parameters Error Notification message and closing the TCP connection.	nvestigate the configuration of the LSR.

MPLS LDP Entity Rejected Sessions Cleared

Parent incident: MPLS LDP Entity Rejected Sessions incident

Event ID: 191

Description	Default severity level	Typical causes	Actions
the LDP entity has now accepted the session.	information	the LDP entity has now accepted the session.	none.

MPLS LDP Entity Shutdown Notifications Received

Parent incident: MPLS LDP Entity Shutdown Notifications Received incident

Event ID: 194

Description	Default severity level	Typical causes	Actions
the LSR has received a shutdown notification message from the peered LSR.	critical	when the last Hello adjacency for a LDP session is deleted, the connected LSR terminates the LDP session. The peer may close the session when it concludes that the transport connection is bad or that the peer has failed, and it terminates the LDP session by closing the transport connection.	nvestigate the network connection, the status of the LSR.

MPLS LDP Entity Shutdown Notifications Received Cleared

Parent incident: MPLS LDP Entity Shutdown Notifications Received incident

Event ID: 195

Description	Default severity level	Typical causes	Actions
integrity of the LDP session has been reestablished.	information	the peered LSR prematurely sent a session terminated notification message, which was subsequently followed by a Want To Reestablish session message.	none.

MPLS LDP Entity Shutdown Notifications Sent

Parent incident: MPLS LDP Entity Shutdown Notifications Sent incident

Event ID: 196

Description	Default severity level	Typical causes	Actions
when the last Hello adjacency for a LDP session is deleted, the LSR terminates the LDP session.	critical	the LSR may close the session when it concludes that the transport connection is bad or that the peer has failed, and it terminates the LDP session by closing the transport connection.	investigate the network connection. investigate the status of the LSR.

MPLS LDP Entity Shutdown Notifications Sent Cleared

Parent incident: MPLS LDP Entity Shutdown Notifications Sent incident

Event ID: 197

Description	Default severity level	Typical causes	Actions
the integrity of the LDP session has been reestablished.	information	the LSR permaturely sent a session terminated notification message, which was subsequently followed by a Want To Reestablish session message.	none.

MPLS LDP Peer Disappeared

Parent incident: MPLS LDP Peer Disappeared incident

Event ID: 184

Description	Default severity level	Typical causes	Actions
the LSR peer has disappeared. An Entuity Shutdown Notification message may already have been raised.	critical	the session has been shutdown and so the peer has disappeared. The administrator may have reconfigured\removed the LSR. Alternatively the LSR may have encountered problems.	when the disappearance is unexpected Entuity may have raised additional events that indicates the cause of the disappearance.

MPLS LDP Peer Newly Discovered

Parent incident:

(Entuity v21.0 P02 upwards) MPLS LDP Peer Disappeared incident
(Entuity v21.0 P01 and below) MPLS LDP Peer Newly Discovered incident

Event ID: 185

Description	Default severity level	Typical causes	Actions
a newly discovered LDP peer indicates the establishment of a new LDP session.	information	administrator has added a new LSR to the network.	check that the newly discovered peer is an expected LSR. An unexpected LSR may indicate a security failure.

MPLS LDP Peer Non-operational

Parent incident: MPLS LDP Peer Non-operational incident

Event ID: 180

Description

Default severity level

Typical causes

Actions

indicates the LDP session state has transitioned from an operational to a non-operational state.

critical

the event associated LDP peer has a state other than operational:

Unknown
Non existent
Initialized
Open Receive
Open Sent

the event includes the non-operational peer’s device name and advertised IP address that you can use to investigate the state of the peer.

MPLS LDP Peer Operational

Parent incident: MPLS LDP Peer Non-operational incident

Event ID: 181

Description	Default severity level	Typical causes	Actions
indicates the LDP peer state has transitioned from a non-operational to an operational state.	information	peer has returned to an operational state, for example after the device has been rebooted.	none.

MPLS LDP Peer TLV Errors

Parent incident: MPLS LDP Peer TLV Errors incident

Event ID: 188

Description	Default severity level	Typical causes	Actions
the peer has received a packet of the correct type, but of unknown content.	critical	the content may have been corrupted during transmission across the network.	check the sending LSR configuration.

MPLS LDP Peer TLV Errors Cleared

Parent incident: MPLS LDP Peer TLV Errors incident

Event ID: 189

Description	Default severity level	Typical causes	Actions
a previous message from the peered LSR had corrupt content, but the subsequent message was correctly formed.	information	the state that caused corrupt content (for example, transport problems) has been resolved.	none.

MPLS LDP Peer Unknown Message Types

Parent incident: MPLS LDP Peer Unknown Message Types incident

Event ID: 186

Description	Default severity level	Typical causes	Actions
the LDP peer received a message of an unknown type.	critical	LSRs support a defined set of message types. A packet that includes a message type not configured to the LSR cannot be processed.	check the supports message types on the LSRs.

MPLS LDP Peer Unknown Message Types Cleared

Parent incident: MPLS LDP Peer Unknown Message Types incident

Event ID: 187

Description	Default severity level	Typical causes	Actions
a previous message from the peered LSR was of a type this LSR did not recognize.	information	the most recent packet from the peer is of a supported message type.	none.

MPLS LSR Interface High Discard Rate (Lookup Failure)

Parent incident: MPLS LSR Interface High Discard Rate (Lookup Failure) incident

Event ID: 206

Description	Default severity level	Typical causes	Actions
indicates the number of labeled packets that have been received on this interface and were discarded because there were no matching entries found for them in mplsInSegmentTable.	severe	there were no forwarding rules for these received packets.	check the configuration of your forwarding tables.

MPLS LSR Interface High Discard Rate (Lookup Failure) Cleared

Parent incident: MPLS LSR Interface High Discard Rate (Lookup Failure) incident

Event ID: 207

Description	Default severity level	Typical causes	Actions
indicates the interface's discard rate caused by lookup failure has transitioned to below the set threshold.	information	the interface is receiving packets for which it has appropriate lookup table entries.	none.

MPLS LSR Interface High Error Free Discard Rate (RX)

Parent incident: MPLS LSR Interface High Error Free Discard Rate (RX) incident

Event ID: 202

Description	Default severity level	Typical causes	Actions
the rate per second of inbound labeled packets, for which no error was detected, that the LSR discarded is above the set threshold.	severe	the LSR may be short of buffer space.	check the LSR configuration. There may also be low buffer events raised for the device.

MPLS LSR Interface High Error Free Discard Rate (RX) Cleared

Parent incident: MPLS LSR Interface High Error Free Discard Rate (RX) incident

Event ID: 203

Description	Default severity level	Typical causes	Actions
indicates the interface’s discard rate of error free packets has transitioned to below the set threshold.	information	the initial reason for discarding packets, e.g. low buffer space, has been resolved, or traffic to the LSR may have dropped.	none.

MPLS LSR Interface High Error Free Discard Rate (TX)

Parent incident: MPLS LSR Interface High Error Free Discard Rate (TX) incident

Event ID: 204

Description	Default severity level	Typical causes	Actions
the rate per second of outbound labeled packets (for which no error was detected) discarded by the LSR is above the set threshold.	severe	the LSR may be short of buffer space.	check the LSR configuration. There may also be low buffer events raised fro the device.

MPLS LSR Interface High Error Free Discard Rate (TX) Cleared

Parent incident: MPLS LSR Interface High Error Free Discard Rate (TX) incident

Event ID: 205

Description	Default severity level	Typical causes	Actions
indicates the interface's discard rate of error-free packets has transitioned to below the set threshold.	information	the initial reason for discarding packets (e.g. low buffer space) has been resolved, or traffic to the LSR may have dropped.	none.

MPLS LSR Interface High Fragmentation Rate

Parent incident: MPLS LSR Interface High Fragmentation Rate incident

Event ID: 208

Description	Default severity level	Typical causes	Actions
indicates the number of outgoing MPLS packets that required fragmentation before transmission on this interface is above the set threshold.	severe	an interface capacity mismatch causes incoming packets to be fragmented before they can be transmitted. Fragmentation is a resource intensive process and can adversely affect LSR performance.	configure the LSR to send and receive compatible sized packets.

MPLS LSR Interface High Fragmentation Rate Cleared

Parent incident: MPLS LSR Interface High Fragmentation Rate incident

Event ID: 209

Description	Default severity level	Typical causes	Actions
indicates the interface’s fragmentation rate of has transitioned to below the set threshold.	information	a reconfiguration of the involved interfaces. a drop in traffic on the interface.	none.

MPLS LSR Interface Low Bandwidth

Parent incident: MPLS LSR Interface Low Bandwidth incident

Event ID: 198

Description	Default severity level	Typical causes	Actions
indicates the total amount of available bandwidth available on this interface is below the set threshold. Available bandwidth is calculated as the difference between the amount of bandwidth currently in use and total bandwidth.	severe	overused interface.	for an interface that is showing consistently low bandwidth, consider adjusting its load.

MPLS LSR Interface Low Bandwidth Cleared

Parent incident: MPLS LSR Interface Low Bandwidth incident

Event ID: 199

Description	Default severity level	Typical causes	Actions
indicates the amount of free bandwidth that is on the interface has transitioned to below the low bandwidth threshold.	information	reduced load on the interface.	none.

MPLS LSR Interface Low Buffer Space

Parent incident: MPLS LSR Interface Low Buffer Space incident

Event ID: 200

Description	Default severity level	Typical causes	Actions
indicates the total amount of available buffer space available on this interface is below the set threshold. Available buffer space is calculated as the difference between the amount of buffer space currently in use and total buffer space	severe	overused interface.	for an interface showing consistently low buffer space, consider adjusting its load.

MPLS LSR Interface Low Buffer Space Cleared

Parent incident: MPLS LSR Interface Low Buffer Space incident

Event ID: 201

Description	Default severity level	Typical causes	Actions
indicates the amount of free buffer space on the interface has transitioned to above the low buffer space threshold.	information	reduced load on the interface.	none.

MPLS LSR Interface Platform High Discard Rate (Lookup Failure)

Parent incident: MPLS LSR Interface Platform High Discard Rate (Lookup Failure) incident

Event ID: 206

Description	Default severity level	Typical causes	Actions
indicates the number of labeled packets that have been received on this platform and were discarded because there were no matching entries found for them in mplsInSegmentTable.	severe	there were no forwarding rules for these received packets.	check the configuration of your forwarding tables.

MPLS LSR Interface Platform High Discard Rate (Lookup Failure) Cleared

Parent incident: MPLS LSR Interface Platform High Discard Rate (Lookup Failure) incident

Event ID: 207

Description	Default severity level	Typical causes	Actions
indicates the platform's discard rate, caused by lookup failures, has transitioned to below the set threshold.	information	the platform is receiving packets for which it has appropriate lookup table entries.	none.

MPLS LSR Interface Platform High Error Free Discard Rate (RX)

Parent incident: MPLS LSR Interface Platform High Error Free Discard Rate (RX) incident

Event ID: 202

Description	Default severity level	Typical causes	Actions
the rate per second of inbound labeled packets, for which no error was detected, that the LSR discarded is above the set threshold.	severe	the LSR may be short of buffer space.	check the LSR configuration. There may also be low buffer events raised for the device.

MPLS LSR Interface Platform High Error Free Discard Rate (RX) Cleared

Parent incident: MPLS LSR Interface Platform High Error Free Discard Rate (RX) incident

Event ID: 203

Description	Default severity level	Typical causes	Actions
indicates the platform's discard rate of error-free packets has transitioned to below the set threshold.	information	the initial reason for discarding packets (e.g. low buffer space) has been resolved. traffic to the LSR may have dropped.	none.

MPLS LSR Interface Platform High Error Free Discard Rate (TX)

Parent incident: MPLS LSR Interface Platform High Error Free Discard Rate (TX) incident

Event ID: 204

Description	Default severity level	Typical causes	Actions
the rate per second of outbound labeled packets, for which no error was detected, that the LSR discarded is above the set threshold.	severe	the LSR may be short of buffer space.	check the LSR configuration. There may also be low buffer events raised for the device.

MPLS LSR Interface Platform High Error Free Discard Rate (TX) Cleared

Parent incident: MPLS LSR Interface Platform High Error Free Discard Rate (TX) incident

Event ID: 205

Description	Default severity level	Typical causes	Actions
iIndicates the platform’s discard rate of error free packets has transitioned to below the set threshold.	information	the initial reason for discarding packets (e.g. low buffer space) has been resolved. traffic to the LSR may have dropped.	none.

MPLS LSR Interface Platform High Fragmentation Rate

Parent incident: MPLS LSR Interface Platform High Fragmentation Rate incident

Event ID: 208

Description	Default severity level	Typical causes	Actions
indicates the number of outgoing MPLS packets that required fragmentation before transmission on this platform is above the set threshold.	severe	an interface capacity mismatch causes incoming packets to be fragmented before they can be transmitted. Fragmentation is a resource intensive process and can adversely affect LSR performance.	configure the LSR to send and receive compatible sized packets.

MPLS LSR Interface Platform High Fragmentation Rate Cleared

Parent incident: MPLS LSR Interface Platform High Fragmentation Rate incident

Event ID: 209

Description

Default severity level

Typical causes

Actions

indicates the platform's fragmentation rate has transitioned to below the set threshold.

information

a reconfiguration of the involved interfaces.

a drop in traffic on the platform.

none.

MPLS VRF High Illegal Label Rate

Parent incident: MPLS VRF High Illegal Label Rate incident

Event ID: 224

Description	Default severity level	Typical causes	Actions
the VRF is receiving packets with labels for which it is not configured at a rate above the set threshold.	severe	the VRF is receiving packets from an area of the network for which it is not configured. This may indicate a misconfiguration or security problem.	investigate the source of the illegal labels.

MPLS VRF High Illegal Label Rate Cleared

Parent incident: MPLS VRF High Illegal Label Rate incident

Event ID: 225

Description	Default severity level	Typical causes	Actions
the VRF is receiving packets with labels for which it is not configured at a rate below the set threshold.	information	a misconfiguration has been corrected.	none.

MPLS VRF Interface BGP Neighbor Disappeared

Parent incident: MPLS VRF Interface BGP Neighbor Disappeared incident

Event ID: 226

Description	Default severity level	Typical causes	Actions
the interface has not received the BGP keep alive message within the set time.	critical	the router has gone down. the route to the router has gone down.	if the involved devices are managed by Entuity, view the router status.

MPLS VRF Interface BGP Neighbor Newly Discovered

Parent incident: MPLS VRF Interface BGP Neighbor Disappeared incident

Event ID: 227

Description	Default severity level	Typical causes	Actions
a new BGP neighbor has been added to the network.	minor	the administrator has added a new BGP neighbor to the network.	where you have concerns over security, check the new neighbor is expected.

MPLS VRF Non-operational

Parent incident: MPLS VRF Non-operational incident

Event ID: 223

Description	Default severity level	Typical causes	Actions
when the number of active interfaces associated with a VRF is zero, then the VRF is not operational.	critical	the interfaces associated with the VRF are down. a change in configuration has removed all interfaces associated with the VRF.	check the number of interfaces, and check the configuration.

MPLS VRF Operational

Parent incident: MPLS VRF Non-operational incident

Event ID: 222

Description	Default severity level	Typical causes	Actions
indicates the VRF has transitioned from a non-operational to an operational state.	information	VRF has returned to an operational state, e.g. after the device has been rebooted.	none

Network Outage

Parent incident: Network Outage incident

Event ID: 983047, 512:7

Description

Default severity level

Typical causes

Actions

Network Outage events are raised on information Entuity collects using traceroute and ICMP ping. It indicates an outage on your network, caused for example by node failure, unreachability of a managed port.

The Details column of the event indicates the particular category of the outage, how Entuity identifies the outage category is a product of how it handles traceroute data. Entuity discovers all IP addresses configured on a device and then determines which ports, if any, these IP addresses belong to. The success of this association is dependent on the structure of the SNMP MIB. Also if a port is unmanaged within Entuity then an IP address cannot be associated with the port.

critical

the Details column in the Events dashlet indicates the particular cause of the outage:

Managed IP On Device Unreachable: indicates that an IP address is not responding to ping:
- the port for the IP address is not managed by Entuity but the device is managed by Entuity. This may be caused by a routing problem.
- Entuity cannot determine the port associated with the IP address because the IP address is not fixed to a port.
Port Unreachable: indicates that an IP address that is associated with a port is not responding to ping. When Entuity is managing the device through a network cloud, Entuity raises this event when some of the device's IP addresses are down. Event details lists the unreachable IP addresses in the cloud.
Node Unreachable: indicates that all IP addresses of a network node are not responding to ping. The node (typically a router or a switch) has transitioned to the down state. When Entuity is managing the device through a network cloud, Entuity raises this event when all the device's IP addresses are down. Event details lists the unreachable IP addresses in the cloud.
Entuity Server disconnected from network: indicates that all discovered IP addresses are not responding to ping, suggesting the disconnection of the Entuity server from the network.

in the Impacted column of the Events dashlet, Entuity displays a count of the nodes, servers and applications impacted by the port down or node failure. You can view the list of impacted objects - or at least those components for which you have permission to view by clicking Show Details in the context menu.

When Entuity raises a Network Outage event, the action you take depends upon the event type raised, on your network administrator role and whether you have physical access to the device:

Managed IP On Device Unreachable or Port Unreachable: for these two categories, check that the relevant network is routable from Entuity.
- If the network is not routable and this is intentional, then to prevent the raising of this event, consider excluding the network from Entuity management through Entuity's configuration settings.
- If the network is not routable and this is a Port Unreachable network outage, check the operation status of the port. If this is down, it may indicate a damaged or pulled out cable, or that the device at the other end of the link has failed.
Node Unreachable: if all a device's IP addresses are not responding to ping and the device is also not responding to SNMP polling, it is probable that the node has failed. You can review the incident history for the device, for example for fan failure and temperature incidents. If the device does not restart, the only recourse is a physical inspection.
Entuity Server disconnected from network: from the Entuity server machine, use the ping utility that is installed as part of its operating system to ping network devices. If ping fails to elicit a response, check for Access Control Lists and firewalls that maybe blocking ICMP ping. If ping succeeds, check that the server's firewall permits applicationMoniotor access. You may have to add a rule for the Entuity process.

Network Outage Cleared

Parent incident: Network Outage incident

Event ID: 983048, 512:8

Description

Default severity level

Typical causes

Actions

indicates an outage on your network is now resolved.

information

the Details column in the Events dashlet indicates the particular network outage clearance:

Managed IP Address Reachable - indicates the IP address is now responding to ping. The port for the IP address is not managed by Entuity, but the device is managed by Entuity.
Port Reachable - indicates that a port is once again responding to ping. For router ports, a filter ensures only ports with an associated IP address are included.
Node Reachable - indicates that a node (typically a router or a switch) has transitioned to the up state. All of the IP addresses of a network node do not respond to ping.
Entuity Server connected to the network - indicates a restored connection of the Entuity server to the network.

none.

Network Usage Alert

Parent incident:

Event ID: 1131

Default severity: minor

New DHCP Server Detected

Parent incident:

Event ID: 1132

Default severity: information

New Splash User Registered

Parent incident:

Event ID: 1133

Default severity: information

Optical Output Power High

Parent incident: Port High Optical Power incident

Event ID: 524368, 2:80

Description	Default severity level	Typical causes	Actions
indicates the transmitted optical power is high.	severe	the transmitted optical power value has exceeded the upper threshold of the specified working range for the optical port.	for the optical port, adjust the optical power to the appropriate working range, ensure use of the correct cable and distance, and consult the vendor's documentation.

Optical Output Power High Cleared

Parent incident: Port High Optical Power incident

Event ID: 524367, 2:79

Description	Default severity level	Typical causes	Actions
indicates the transmitted optical power was high but has now returned to acceptable levels.	information	the transmitted optical power value is now again within the working range for the optical port.	none.

Optical Output Power Low

Parent incident: Port Low Optical Output Power incident

Event ID: 524366, 2:78

Description	Default severity level	Typical causes	Actions
indicates the transmitted optical power is low.	severe	the transmitted optical power value has fallen below the lower threshold of the specified working range for the optical port.	for the optical port, adjust the optical power to the appropriate working range, ensure use of the correct cable and distance, and consult the vendor's documentation.

Optical Output Power Low Cleared

Parent incident: Port Low Optical Output Power incident

Event ID: 524365, 2:77

Description	Default severity level	Typical causes	Actions
indicates the transmitted optical power was low but has now returned to acceptable levels.	information	the transmitted optical power value is now again within the working range for the optical port.	none.

OS Average Total CPU Utilization High

Parent incident: Operating System Average Total CPU High Utilization incident

Event ID: 1200

Default severity level: severe

OS Average Total CPU Utilization High Warning

Parent incident: Operating System Average Total CPU High Utilization incident

Event ID: 952

Default severity level: major

OS Average Total CPU Utilization High Cleared

Parent incident: Operating System Average Total CPU High Utilization incident

Event ID: 1201

Default severity level: information

OS Committed Bytes % Used High

Parent incident: Operating System Committed Bytes Percent Used High incident

Event ID: 179

Default severity level: major

OS Committed Bytes % Used High Warning

Parent incident: Operating System Committed Bytes Percent Used High incident

Event ID: 178

Default severity level: minor

OS Committed Bytes % Used High Cleared

Parent incident: Operating System Committed Bytes Percent Used High incident

Event ID: 177

Default severity level: information

OS High Pages

Parent incident: Operating System High Pages incident

Event ID: 86

Default severity level: severity

OS High Pages Warning

Parent incident: Operating System High Pages incident

Event ID: 85

Default severity level: minor

OS High Pages Cleared

Parent incident: Operating System High Pages incident

Event ID: 84

Default severity level: information

OS High Pages Output

Parent incident: Operating System High Pages Output incident

Event ID: 89

Default severity level: major

OS High Pages Output Warning

Parent incident: Operating System High Pages Output incident

Event ID: 88

Default severity level: minor

OS High Pages Output Cleared

Parent incident: Operating System High Pages Output incident

Event ID: 87

Default severity level: information

OS Low Free Physical Memory

Parent incident: Operating System Low Free Physical Memory incident

Event ID: 1202

Default severity level: severe

OS Low Free Physical Memory Warning

Parent incident: Operating System Low Free Physical Memory incident

Event ID: 951

Default severity level: major

OS Low Free Physical Memory Cleared

Parent incident: Operating System Low Free Physical Memory incident

Event ID: 1203

Default severity level: information

OS Low Free Swap Memory

Parent incident: Operating System Low Free Swap Memory incident

Event ID: 1204

Default severity level: severe

OS Low Free Swap Memory Warning

Parent incident: Operating System Low Free Swap Memory incident

Event ID: 943

Default severity level: major

OS Low Free Swap Memory Cleared

Parent incident: Operating System Low Free Swap Memory incident

Event ID: 1205

Default severity level: information

OS Low Free Virtual Memory

Parent incident: Operating System Low Free Virtual Memory incident

Event ID: 1206

Default severity level: severe

OS Low Free Virtual Memory Warning

Parent incident: Operating System Low Free Virtual Memory incident

Event ID: 936

Default severity level: major

OS Low Free Virtual Memory Cleared

Parent incident: Operating System Low Free Virtual Memory incident

Event ID: 1207

Default severity level: information

OS Physical Memory % Used High

Parent incident: Operating System Memory Used Percent High incident

Event ID: 1212

Default severity level: major

OS Physical Memory % Used High Warning

Parent incident: Operating System Memory Used Percent High incident

Event ID: 944

Default severity level: minor

OS Physical Memory % Used High Cleared

Parent incident: Operating System Memory Used Percent High incident

Event ID: 1213

Default severity level: information

OS Polling Error

Parent incident: OS Polling Problem incident

Event ID: 1216

Default severity level: severe

OS Polling Warning

Parent incident: OS Polling Problem incident

Event ID: 1215

Default severity level: major

OS Polling OK

Parent incident: OS Polling Problem incident

Event ID: 1214

Default severity level: information

OS Processor Time High

Parent incident: Operating System Processor Time High incident

Event ID: 415

Default severity level: severe

OS Processor Time High Warning

Parent incident: Operating System Processor Time High incident

Event ID: 414

Default severity level: major

OS Processor Time High Cleared

Parent incident: Operating System Processor Time High incident

Event ID: 399

Default severity level: information

OS Service State Started

Parent incident: OS Service Stopped incident

Event ID: 1217

Default severity level: information

OS Service State Stopped

Parent incident: OS Service Stopped incident

Event ID: 1218

Default severity level: severe

OS Service Status Error

Parent incident: OS Service Error incident

Event ID: 1220

Default severity level: major

OS Service Status OK

Parent incident: OS Service Error incident

Event ID: 1219

Default severity level: information

OS Shared Memory Segments % Used High

Parent incident: Operating System Shared Memory Segments Percent Used High incident

Event ID: 367

Default severity level: major

OS Shared Memory Segments % Used High Warning

Parent incident: Operating System Shared Memory Segments Percent Used High incident

Event ID: 366

Default severity level: minor

OS Shared Memory Segments % Used High Cleared

Parent incident: Operating System Shared Memory Segments Percent Used High incident

Event ID: 365

Default severity level: information

OSPF Peer Briefly Not Established

Parent incident: OSPF Peer Briefly Not Established incident

Event ID: 164

Description	Default severity level	Typical causes	Actions
indicates that virtual links between OSPF speakers are now established, but recently bounced. Entuity identifies a recent bounce because the up time is lower than in the previous poll.	critical	OSPF keep-alives may be lost, so the local router terminates the connection and then successfully attempts to reestablish it. unstable remote router. traffic shaping limitations.	check logs are activated on the device, and use the logs to investigate error messages.

OSPF Peer Disappeared

Parent incident: OSPF Peer Disappeared incident

Event ID: 162

Description	Default severity level	Typical causes	Actions
indicates a former adjacent peer has been removed from the router's configurations. Administrators should be aware of this change to be able to detect rogue configuration updates.	critical	removal of an adjacent router.	investigate the cause of router disappearance.

OSPF Peer Established

Parent incident: OSPF Peer Not Established incident

Event ID: 161

Description	Default severity level	Typical causes	Actions
indicates that virtual links between OSPF peers are well established. The state has just transitioned to Full.	minor	OSPF peering established.	none.

OSPF Peer Newly Discovered

Parent incident:

(Entuity v21.0 P02 upwards) OSPF Peer Disappeared incident
(Entuity v21.0 P01 and below) OSPF Peer Newly Discovered incident

Event ID: 163

Description	Default severity level	Typical causes	Actions
indicates Entuity has discovered a new OSPF peer.	minor	configuration of a new OSPF peer.	none.

OSPF Peer Not Established

Parent incident: OSPF Peer Not Established incident

Event ID: 160

Description	Default severity level	Typical causes	Actions
indicates to administrators that a former adjacent peer is no longer in reach. The state has just transitioned out of the Full state.	critical	problems with IP reachability or incorrect OSPF configuration.	use the ping and show route commands to verify network connectivity to the OSPF peer. You can use the show log messages command to look for errors relating to the peer.

Other Component High Temperature

Parent incident: Component High Temperature incident

Event ID: 1363

Default severity level: severe

Other Component High Temperature Cleared

Parent incident: Component High Temperature Cleared incident

Event ID: 1364

Default severity level: information

Path Deviated

Parent incident: Path Deviated incident

Event ID: 948

Default severity level: major

Path Deviation Cleared

Parent incident: Path Deviated incident

Event ID: 947

Default severity level: information

Path High Latency

Parent incident: Path High Latency incident

Event ID: 946

Default severity level: major

Path High Latency Cleared

Parent incident: Path High Latency incident

Event ID: 945

Default severity level: information

Path Unreachable

Parent incident: Path Unreachable incident

Event ID: 950

Default severity level: critical

Path Unreachable Cleared

Parent incident: Path Unreachable incident

Event ID: 949

Default severity level: information

Physical Disk High Hard Error Rate

Parent incident: Physical Disk High Hard Error Rate incident

Event ID: 1226

Description	Default severity level	Typical causes	Actions
indicates the hard error rate for the physical disk is greater than the set threshold. By default 0.	severe	a hardware error with the physical disk.	review physical disk manufacturer tolerances as there maybe loss of data.

Physical Disk High Hard Error Rate Cleared

Parent incident: Physical Disk High Hard Error Rate incident

Event ID: 1225

Description	Default severity level	Typical causes	Actions
indicates the hard error rate for the physical disk was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of hard error rate is below the set threshold when the device is polled.	none.

Physical Disk High Latency

Parent incident: Physical Disk High Latency incident

Event ID: 1230

Description	Default severity level	Typical causes	Actions
indicates the latency for the physical disk is greater than the set threshold. By default 20.	severe	high demand is placed on the disk.	review physical disk stats and storage architecture.

Physical Disk High Latency Cleared

Parent incident: Physical Disk High Latency incident

Event ID: 1229

Description	Default severity level	Typical causes	Actions
indicates the latency for the physical disk was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of latency is below the set threshold when the device is polled.	none.

Physical Disk High Soft Error Rate

Parent incident: Physical Disk High Soft Error Rate incident

Event ID: 1228

Description	Default severity level	Typical causes	Actions
indicates the soft error rate for the physical disk is greater than the set threshold. By default 0.	severe	a hardware-related glitch with the physical disk.	in most cases it can be ignored, but monitor disk for any other issues to verify.

Physical Disk High Soft Error Rate Cleared

Parent incident: Physical Disk High Soft Error Rate incident

Event ID: 1227

Description	Default severity level	Typical causes	Actions
indicates the soft error rate for the physical disk was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of soft error rate is below the set threshold when the device is polled.	none.

Physical Disk High Temperature

Parent incident: Physical Disk High Temperature incident

Event ID: 1365

Default severity level: severe

Physical Disk High Temperature Cleared

Parent incident: Physical Disk High Temperature incident

Event ID: 1366

Default severity level: information

Polling Error

Parent incident: Polling Problem incident

Event ID: 1193

Default severity level: severe

Polling OK

Parent incident: Polling Problem incident

Event ID: 1191

Default severity level: information

Polling Warning

Parent incident: Polling Problem incident

Event ID: 1192

Default severity level: major

Port Down

Parent incident: Port Status Problem incident

Event ID: 524290, 2:6

Default severity level: critical

Port Duplex Change

Parent incident: incident

Event ID:

Description	Default severity level	Typical causes	Actions
ndicates that an Ethernet port has changed from half to full duplex or vice versa.	information	configuration change. auto-detection mechanism has detected a duplex change on the attached PC or server NIC card.	none.

Port Error Disable Alarm

Parent incident: Port Error Disable Alarm incident

This event is only enabled through additions to Entuity's configuration. Contact your Entuity Support representative for details.

Event ID: 524328, 2:40

Description	Default severity level	Typical causes	Actions
on Cisco Stack devices, Entuity identifies the additional port status, error disabled port.	critical	the port error disable state indicates that the port has been brought down by the device (even though its admin status is up) because of detected errors persisting for a configured errdisable timeout period. This only happens if sysErrDisableTimeoutEnable is set for the device.	a port in this state will not come up again unless manually re-enabled by the network administrator.

Port Error Disable Alarm Cleared

Parent incident: Port Error Disable Alarm incident

This event is only enabled through additions to Entuity's configuration. Contact your Entuity Support representative for details.

Event ID: 524329, 2:41

Description	Default severity level	Typical causes	Actions
	information	transition of port status to normal.	none.

Port Flapping:

Parent incident: Port Status Problem incident

Event ID: 524293, 2:5

Default severity level: critical

Port High Inbound Discards (Dynamic)

Parent incident: Port High Inbound Discards (Dynamic) incident

Event ID: 385

Description

Default severity level

Typical causes

Actions

indicates that a port is dropping some packets in its receive buffers. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently. The discard rate is higher than the active dynamic threshold.

severe

lack of bandwidth on the port, transmit buffer sizes too small.

Use the Ticker tool to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

Although the percentage level of discards the port reports may be high if it has a low packet throughput then you may want to amend the behavior of the event. You can activate a low traffic filter to eliminate nuisance events. Port Minimum Packet Rate for Discards allows you to set a packets per second threshold; only when this threshold is crossed could Entuity potentially raise this event. When activated the threshold is included to the event details string, for example:

InDiscards=0.32% (threshold=1%) of 7.66Mpkts/300s. Packet-rate=25.54kpkts/s (threshold=0.001pkts/s)

Port High Inbound Discards (Dynamic) Cleared

Parent incident: Port High Inbound Discards (Dynamic) incident

Event ID: 384

Description	Default severity level	Typical causes	Actions
indicates that a port that was dropping enough packets in its receive buffers to cross the set dynamic threshold is no longer doing so.	information	inbound discards has returned to levels within the dynamic threshold.	none.

Port High Inbound Fault (Dynamic)

Parent incident: Port High Inbound Fault (Dynamic) incident

Event ID: 389

Description

Default severity level

Typical causes

Actions

indicates that a port is receiving corrupted packets from the network (a brownout). These
packets will be thrown away by the switch or router that is reporting this problem, causing
application layer timeouts and re- transmissions. Network users may be complaining about slow application response times. Types of corrupted packets include CRC errors, alignment
errors, giants, and runt packets.

severe

duplex/half duplex configuration mismatches on switch and router ports.
faulty cabling between PCs/servers and switch ports.
faulty NIC cards on PCs and servers.
faulty transceivers.
noise on WAN circuits.
giant packets may be caused by faulty firmware on switch devices or encapsulation misconfiguration on trunk ports.

Check the duplex settings on switch ports reporting this problem, and the PC or server which is attached to the switch port. If this isn't the cause of the problem, move the PC or server to a different port and see if the corruption continues. If so, swap out the NIC card on the PC or server.

Although the percentage level of faults the port reports may be high if it has a low packet throughput then you may want to amend the behavior of the event. You can activate a low traffic filter to eliminate nuisance events. The Port Minimum Packet Rate for Faults allows you to set a packets per second threshold; only when this threshold is crossed could Entuity potentially raise this event. When activated the threshold is included to the event details string, for example:

InFault=0.28% (threshold=1.00%) of 24.05Mpkts/300s --> align=9%, crc=4%, abort=16%. Packet-rate=80.16kpkts/s (threshold=1.00pkts/s)

Port High Inbound Fault (Dynamic) Cleared

Parent incident: Port High Inbound Fault (Dynamic) incident

Event ID: 388

Description	Default severity level	Typical causes	Actions
indicates that a port that was receiving corrupted packets from the network (a brownout) is no longer receiving those packets.	information	reduction in traffic.	none.

Port High Inbound Utilization (Dynamic)

Parent incident: Port Inbound Utilization (Dynamic) Abnormality incident

Event ID: 397

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	severe	excessive application traffic. configuration changes.	if high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

Port High Inbound Utilization (Dynamic) Cleared

Parent incident: Port Inbound Utilization (Dynamic) Abnormality incident

Event ID: 396

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing high levels of utilization (bandwidth usage) is now operating within dynamic thresholds.	information	utilization for the port has, during the past hour, returned to within the expected threshold.	none.

Port High Optical Input Power

Parent incident: Port High Optical Input Power incident

Event ID: 524364, 2:76

Description	Default severity level	Typical causes	Actions
indicates the received optical power is high.	severe	the received optical power value has exceeded the upper threshold of the specified working range for the optical port.	for the optical port, adjust the optical power to the appropriate working range, ensure use of the correct cable and distance, and consult the vendor's documentation.

Port High Optical Input Power Cleared

Parent incident: Port High Optical Input Power incident

Event ID: 524363, 2:75

Description	Default severity level	Typical causes	Actions
indicates the received optical power was high but has now returned to acceptable levels.	information	the received optical power value has now come back within the working range for the optical port.	none.

Port High Outbound Discards (Dynamic)

Parent incident: Port High Outbound Discards (Dynamic) incident

Event ID: 383

Description

Default severity level

Typical causes

Actions

indicates that a port is dropping some packets in its transmit buffers, and/or experiencing difficulties transmitting packets out onto the network. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently. The discard rate is higher than the active dynamic threshold.

severe

lack of bandwidth on the port.
transmit buffer sizes too small.

OutDiscards=0.32% (threshold=1%) of 7.66Mpkts/300s. Packet-rate=25.54kpkts/s (threshold=0.001pkts/s)

Port High Outbound Discards (Dynamic) Cleared

Parent incident: Port High Outbound Discards (Dynamic) incident

Event ID: 382

Description	Default severity level	Typical causes	Actions
indicates that a port that was dropping large numbers of packets in its transmit buffers, and or experiencing severe difficulties transmitting packets out onto the network is now performing normally.	information	reduced traffic.	none.

Port High Outbound Fault (Dynamic)

Parent incident: Port High Outbound Fault (Dynamic) incident

Event ID: 387

Description

Default severity level

Typical causes

Actions

indicates that a port is failing to transmit some packets onto the network (a brownout). These packets will be thrown away by the switch or router that is reporting this problem, causing application layer timeouts and re-transmissions. Network users may be complaining about slow application response times. Types of transmit errors include late collisions, carrier loss, and SQE test errors. The outbound fault rate is higher than the active dynamic threshold.

severe

duplex/half duplex configuration mismatches on switch and router ports.
faulty cabling between PCs/servers and switch ports.
faulty NIC cards on PCs and servers.
faulty transceivers.

Check the duplex settings on switch ports reporting this problem, and the PC or server which is attached to the switch port. If this is not the cause of the problem, move the PC or server to a different port and see if the corruption continues. If so, swap out the NIC card on the PC or server.

OutFault=7.40% (threshold=1.00%) of 2.21Mpkts/300s --> SQE=1%, late col=7%, ex col=11%, abort=7%, car loss=75%. Packet-rate=7.37kpkts/s (threshold=1.00pkts/s)

Port High Outbound Fault (Dynamic) Cleared

Parent incident: Port High Outbound Fault (Dynamic) incident

Event ID: 386

Description

Default severity level

Typical causes

Actions

indicates that a port that was failing to transmit some packets onto the network (a brownout), is now transmitting successfully.

information

resolution of:

duplex/half duplex configuration mismatches on switch and router ports.
faulty cabling between PCs/servers and switch ports.
faulty NIC cards on PCs and servers.
faulty transceivers.

none.

Port High Outbound Utilization (Dynamic)

Parent incident: Port Outbound Utilization (Dynamic) Abnormality incident

Event ID: 393

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	severe	excessive application traffic. configuration changes.	if high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

Port High Outbound Utilization (Dynamic) Cleared

Parent incident: Port Outbound Utilization (Dynamic) Abnormality incident

Event ID: 392

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing high levels of utilization (bandwidth usage) is now operating within dynamic thresholds.	information	utilization for the port has during the past hour is within the expected threshold.	none.

Port Inbound Discards High (Device Congestion)

Parent incident: Port Inbound Discards High (Device Congestion) incident

Event ID: 524302, 2:14

Description

Default severity level

Typical causes

Actions

severe

lack of bandwidth on the port.
transmit buffer sizes too small.

use the Ticker tool to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

InDiscards=0.32% (threshold=1%) of 7.66Mpkts/300s. Packet-rate=25.54kpkts/s (threshold=0.001pkts/s)

Port Inbound Discards High Cleared (No Device Congestion)

Parent incident: Port Inbound Discards High (Device Congestion) incident

Event ID: 524303, 2:15

Description	Default severity level	Typical causes	Actions
indicates that a port that was dropping sufficient packets in its receive buffers to cross the set dynamic threshold, is no longer doing so.	information	inbound discards have returned to levels within the dynamic threshold.	none.

Port Inbound Fault High (Packet Corruption)

Parent incident: Port Inbound Fault High (Packet Corruption) incident

Event ID: 524298, 2:10

Description

Default severity level

Typical causes

Actions

indicates that a port is receiving corrupted packets from the network (a brownout). These packets will be thrown away by the switch or router that is reporting this problem, causing application layer timeouts and re- transmissions. Network users may be complaining about slow application response times. Types of corrupted packets include CRC errors, alignment errors, giants, and runt packets

major

duplex/half duplex configuration mismatches on switch and router ports.
faulty cabling between PCs/servers and switch ports.
faulty NIC cards on PCs and servers.
faulty transceivers.
noise on WAN circuits.
giant packets may be caused by faulty firmware on switch devices or encapsulation misconfiguration on trunk ports.

check the duplex settings on switch ports reporting this problem, and the PC or server which is attached to the switch port. If this isn't the cause of the problem, move the PC or server to a different port and see if the corruption continues. If so, swap out the NIC card on the PC or server.

Although the percentage level of faults the port reports may be high, if it has a low packet throughput then you may want to amend the behavior of the event. You can activate a low traffic filter to eliminate nuisance events. The Port Minimum Packet Rate for Faults allows you to set a packets per second threshold; only when this threshold is crossed could Entuity potentially raise this event. When activated the threshold is included to the event details string, for example:

InFault=0.28% (threshold=1.00%) of 24.05Mpkts/300s --> align=9%, crc=4%, abort=16%. Packet-rate=80.16kpkts/s (threshold=1.00pkts/s)

Port Inbound Fault High (No Packet Corruption) Cleared

Parent incident: Port Inbound Fault High (Packet Corruption) incident

Event ID: 524299, 2:11

Description	Default severity level	Typical causes	Actions
indicates that a port that was receiving corrupted packets from the network (a brownout) is no longer receiving those packets.	information	reduction in traffic.	none.

Port Link Down

Parent incident: Port link Down incident

Event ID: 524290, 2:2

Description	Default severity level	Typical causes	Actions
indicates that a port has transitioned to the down state.	critical	Disconnecting a PC or server from a switch port. re-booting the PC or server attached to a switch port. faulty cabling. faulty NIC card on the PC or server attached to a switch port. device configuration changes. WAN link CSU/DSU has reported a carrier loss. a subinterface on a managed device not responding.	if the device reporting the event is a switch, then check what is attached to the port. if it is a trunk or a server port, then this event indicates that there may be a network problem. if the device reporting the event is a router, then Telnet to the router to ascertain possible causes for the outage.

Port Link Up

Parent incident: Port link Down incident

Event ID: 524291, 2:3

Description	Default severity level	Typical causes	Actions
indicates that a port has transitioned to the up state.	information	connecting a PC or server to a switch port. rebooting the PC or server attached to a switch port. WAN link CSU/DSU equipment reestablishing carrier detection.	none.

Port Low Inbound Utilization (Dynamic)

Parent incident: Port Inbound Utilization (Dynamic) Abnormality incident

Event ID: 397

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing low levels of inbound utilization (bandwidth usage).	severe	route changes. outages upstream of the link. server problems.	may be symptomatic of an issue elsewhere in the network. Check through other events that have recently been reported if excessively low levels of utilization persist.

Port Low Inbound Utilization (Dynamic) Cleared

Parent incident: Port Inbound Utilization (Dynamic) Abnormality incident

Event ID: 396

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing low levels of utilization (bandwidth usage) is now operating within dynamic thresholds.	information	utilization for the port, during the past hour, is within the expected threshold.	none.

Port Low Optical Input Power

Parent incident: Port Low Optical Input Power i ncident

Event ID: 524362, 2:74

Description	Default severity level	Typical causes	Actions
indicates the received optical power is low.	severe	the received optical power value has fallen below the lower threshold of the specified working range for the optical port.	for the optical port, adjust the optical power to the appropriate working range, ensure use of the correct cable and distance, and consult the vendor's documentation.

Port Low Optical Input Power Cleared

Parent incident: Port Low Optical Input Power i ncident

Event ID: 524361, 2:73

Description	Default severity level	Typical causes	Actions
indicates the received optical power was low but has now returned to acceptable levels.	information	the received optical power value is now again within the working range of the optical port.	none.

Port Low Outbound Utilization (Dynamic)

Parent incident: Port Outbound Utilization (Dynamic) Abnormality incident

Event ID: 391

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing low levels of inbound utilization (bandwidth usage). The low inbound utilization is lower than the active dynamic threshold.	severe	route changes. outages upstream of the link. server problems.	may be symptomatic of an issue elsewhere in the network. Check through other events that have recently been reported if excessively low levels of utililzation persist.

Port Low Outbound Utilization (Dynamic) Cleared

Parent incident: Port Outbound Utilization (Dynamic) Abnormality incident

Event ID: 390

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing low levels of utilization (bandwidth usage) is now operating within dynamic thresholds.	information	utilization for the port has returned to within the expected threshold during the past hour.	none.

Port Operationally Down

Parent incident: Port Operationally Down incident

Event ID: 36

Description

Default severity level

Typical causes

Actions

indicates that the port is not responding - its administrative state is up but its operational status is down. By default, this event is only enabled for core ports, specifically:

WAN ports.
administrative up ports which have configured IP addresses on devices that are routers or have router capability.
trunks and uplinks that are administrative up.

You can enable (or disable) this event on non-core ports via the port's Context Menu (Polling > Status Events > Enable / Disable).

critical

routing problem.
interface shutdown.

Attempt to ping the device:

if the device reporting the event is a switch, then check what is attached to the port.
if it is a trunk or server port, then this event indicates that there may be a network problem.

Port Operationally Down Cleared

Parent incident: Port Operationally Down incident

Event ID: 37

Description	Default severity level	Typical causes	Actions
indicates that a port that was not responding, is now either responding, or its administrative state has been set to down.	information	routing problem corrected. interface restarted.	none.

Port Outbound Discards High (Port Congestion)

Parent incident: Port Outbound Discards High (Port Congestion) incident

Event ID: 524304, 2:16

Description

Default severity level

Typical causes

Actions

major

lack of bandwidth on the port.
transmit buffer sizes too small.

OutDiscards=0.32% (threshold=1%) of 7.66Mpkts/300s. Packet-rate=25.54kpkts/s
(threshold=0.001pkts/s)

Port Outbound Discards High (No Port Congestion) Cleared

Parent incident: Port Outbound Discards High (Port Congestion) incident

Event ID: 524305, 2:17

Description	Default severity level	Typical causes	Actions
indicates that a port that was dropping large numbers of packets in its transmit buffers, and or experiencing severe difficulties transmitting packets out onto the network is now performing normally.	information	reduction in traffic.	none.

Port Outbound Fault High (Transmit Errors)

Parent incident: Port Outbound Fault High (Transmit Errors) incident

Event ID: 524300, 2:12

Description

Default severity level

Typical causes

Actions

ndicates that a port is failing to transmit some packets onto the network (a brownout). These packets will be thrown away by the switch or router that is reporting this problem, causing application layer timeouts and re-transmissions. Network users may be complaining about slow application response times. Types of transmit errors include late collisions, carrier loss, and SQE test errors.

major

duplex/half duplex configuration mismatches on switch and router ports.
faulty cabling between PCs/servers and switch ports.
faulty NIC cards on PCs and servers.
faulty transceivers.

OutFault=7.40% (threshold=1.00%) of 2.21Mpkts/300s --> SQE=1%, late col=7%, ex col=11%, abort=7%, car loss=75%. Packet-rate=7.37kpkts/s (threshold=1.00pkts/s)

Port Outbound Fault High Cleared (No Transmit Errors)

Parent incident: Port Outbound Fault High (Transmit Errors) incident

Event ID: 524301, 2:13

Description	Default severity level	Typical causes	Actions
indicates that a port that was failing to transmit some packets onto the network (a brownout) is now transmitting successfully.	information	resolution of duplex/half duplex configuration mismatches on switch and router ports. faulty cabling between PCs/servers and switch ports. faulty NIC cards on PCs and servers. faulty transceivers.	none.

Port Speed Change

Parent incident: incident

Event ID:

Description	Default severity level	Typical causes	Actions
indicates that a port has changed its interface speed.	information	configuration change. auto-detection mechanism has detected a speed change on the attached PC or server NIC card.	none.

Port Up

Parent incident: Port Status Problem incident

Event ID: 524291, 2:7

Default severity level: information

Port Utilization Decreased

Parent incident:

Event ID: 524315

Default severity level: major

Port Utilization High

Parent incident: Port Utilization Abnormality incident

Event ID: 524310, 2:22

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	severe	excessive application traffic. configuration changes.	if a high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

Port Utilization High Cleared

Parent incident: Port Utilization Abnormality incident

Event ID: 524311, 2:23

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing high levels of utilization is now transmitting lower traffic volumes.	information	reduced application traffic.	none.

Port Utilization Increased

Parent incident:

Event ID: 524314

Default severity level: major

Port Utilization Low

Parent incident: Port Utilization Abnormality incident

Event ID: 524312, 2:24

Description	Default severity level	Typical causes	Actions
indicates that a port (link) is experiencing low levels of utilization (bandwidth usage).	severe	route changes. outages upstream of the link. server problems.	may be symptomatic of an issue elsewhere in the network. Check through other events that have recently been reported if excessively low levels of utilization persist.

Port Utilization Low Cleared

Parent incident: Port Utilization Abnormality incident

Event ID: 524313, 2:25

Description	Default severity level	Typical causes	Actions
indicates that a port (link) that was experiencing low levels of utilization is now transmitting higher traffic volumes.	information	increased application traffic.	none.

Potential Vulnerability

Applicable to Entuity v22.0 GA upwards

Parent incident: Potential Vulnerability incident

Event ID: 1381

Default severity level: information, although the severity of this event will depend on the CVSS Base Score. Please see this article for further help and information on CVSS Base Score severities.

A Potential Vulnerability event is raised if a CVE is matched against a device during a vulnerability monitoring scan.

CVEs have three potential configuration types from which a match can be made. Potential vulnerabilty events are only raised where the CVE configuration matches the device's CPE configuration. Partial matches are not currently supported.

Basic - only one CPE needs to match for a device to be considered potentially vulnerable, e.g. cpe:2.3:a:fusionpbx:*:*:*:*:*:*:*:*
Running on/with - a combination of potentially vulnerable and non-vulnerable CPEs must be present, e.g. cpe:2.3:o:netgear:wnr3500u_firmware:1.2.2.44_35.0.53na:*:*:*:*:*:*:* running on/with cpe:2.3:h:netgear:wnr3500u:-:*:*:*:*:*:*:*
Advanced - a complex enumeration of CPEs must be present, e.g. cpe:2.3:a:hm-print_project:hm-print:1.2a:*:*:*:*:*:*:* AND cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:* AND cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*

Note, the CVE is only matched against the first matching CPE configuration, e.g. if the CVE's configuration is cpe:2.3:a:fusionpbx:1.1:*:*:*:*:*:*:* OR cpe:2.3:a:fusionpbx:1.2:*:*:*:*:*:*:*, and both of those CPEs are assigned to the device, then only the first CPE checked contributes towards the potential vulnerability incident in Entuity.

Potential Vulnerability Cleared

Applicable to Entuity v22.0 GA upwards

Parent incident: Potential Vulnerability incident

Event ID: 1382

Default severity level: information

A Potential Vulnerability Cleared event is raised if no CVE is matched against a device following an earlier match.

Potential Vulnerability Patched

Applicable to Entuity v22.0 GA upwards

Parent incident: Potential Vulnerability incident

Event ID: 1383

Default severity level: information

A Potential Vulnerability Patched event is raised during a vulnerability monitoring scan if the patch levels of Windows OS Server devices on your network are matched with patched CVEs.

Power Supply Came Up

Parent incident:

Event ID: 1134

Default severity: information

Power Supply Major Fault

Parent incident: Power Supply Problem incident

Event ID: 655484, 8:124

Description	Default severity level	Typical causes	Actions
indicates that a device has a major power supply hardware problem.	severe	faulty power supply hardware.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Power Supply Minor Fault

Parent incident: Power Supply Problem incident

Event ID: 655482, 8:122

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor power supply hardware problem.	severe	faulty power supply hardware.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem.

Power Supply OK

Parent incident: Power Supply Problem incident

Event ID: 655480, 8:120

Description	Default severity level	Typical causes	Actions
indicates that the power supply fault for a device has been cleared.	information	faulty power supply has been swapped out.	none.

Power Supply Unknown State

Parent incident: Power Supply Problem incident

Event ID: 655486, 8:126

Description	Default severity level	Typical causes	Actions
indicates that the state of the device's power supply hardware is unknown.	severe	the power supply type is unknown. The ID EEPROM of the power supply has not been programmed or has been corrupted, or the power supply is not supported by the router.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled depending on the type of problem. Refer to the device documentation for details on power supply unknown.

Power Supply Went Down

Parent incident:

Event ID: 1135

Default severity: severe

Processor Utilization High

Parent incident: Procesor Utilization High incident

Event ID: 655420, 8:60

Description	Default severity level	Typical causes	Actions
indicates the identified processor on the device has high CPU utilization. When the processor cannot be identified, Entuity raises the event against single processor 1.	minor	high CPU utilization due to interrupts. a particular process using a lot of CPU resources.	use the managed host function to view current and historic levels of process usage. Also create reports, e.g. a Router Summary Report, that runs every hour to monitor router CPU utilization.

Processor Utilization High Cleared

Parent incident: Procesor Utilization High incident

Event ID: 655421, 8:61

Description	Default severity level	Typical causes	Actions
indicates the processor on the device no longer has high utilization.	information	reduced usage.	none.

QoS Above Bandwidth Limit

Parent incident: QoS Bandwidth Problem incident

Event ID: 56

Description	Default severity level	Typical causes	Actions
indicates the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, has exceeded the limit.	severe	the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, has exceeded the limt.	evaluate the need to raise the amount of bandwidth assigned to the traffic class.

QoS At Bandwidth Limit

Parent incident: QoS Bandwidth Problem incident

Event ID: 57

Description	Default severity level	Typical causes	Actions
indicates the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, has reached the limit.	minor	the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, has reached the limt.	evaluate the need to raise the amount of bandwidth assigned to the traffic class.

QoS Class Bit Rate High

Parent incident: QoS Class Bit Rate High incident

Event ID: 100

Description	Default severity level	Typical causes	Actions
indicates the bit rate is greater than the set QoS Class Bit Rate High threshold. By default 500000.	minor	highest number of bit rate is greater than the set threshold when the device is polled.	evaluate the need to adjust limits for the QoS class.

QoS Class Bit Rate High Cleared

Parent incident: QoS Class Bit Rate High incident

Event ID: 101

Description	Default severity level	Typical causes	Actions
indicates the bit rate was greater than the set QoS Class Bit Rate High threshold but has now transitioned below the set boundary.	information	highest number of bit rate is now below the set threshold when the device is polled.	none.

QoS Class Drop Bit Rate High

Parent incident: QoS Class Drop Bit Rate High incident

Event ID: 102

Description	Default severity level	Typical causes	Actions
indicates the drop bit rate is greater than the set QoS Class Drop Bit Rate High threshold. By default 100000.	minor	highest number of drop bit rate is now below the set threshold when the device is polled.	investigate if the device or link is under high load and evaluate the need to adjust limits for the QoS Class.

QoS Class Drop Bit Rate High Cleared

Parent incident: QoS Class Drop Bit Rate High incident

Event ID: 103

Description	Default severity level	Typical causes	Actions
indicates the drop bit rate was greater than the set QoS Class Drop Bit Rate High threshold, but has now transitioned back below the set boundary.	information	highest number of drop bit rate is now below the set threshold when the device is polled.	none.

QoS Class Drop Packet Rate (Buffer Shortage) High

Parent incident: QoS Class Drop Packet Rate (Buffer Shortage) High incident

Event ID: 104

Description	Default severity level	Typical causes	Actions
indicates the drop packet rate is greater than the set QoS Class Drop Packet Rate (Buffer Shortage) High threshold. By default 10.	severe	highest number of drop packet rate is greater than the set threshold when the device is polled.	investigate if the device or link is under high load and evaluate the need to adjust limits for the QoS Class.

QoS Class Drop Packet Rate (Buffer Shortage) High Cleared

Parent incident: QoS Class Drop Packet Rate (Buffer Shortage) High incident

Event ID: 105

Description	Default severity level	Typical causes	Actions
indicates the drop packet rate was greater than the set QoS Class Drop Packet Rate (Buffer Shortage) High threshold, but has now transitioned back below the set boundary.	information	highest number of drop packet rate is below the set threshold when the device is polled.	none.

QoS Queue Drop Bit Rate High

Parent incident: QoS Drop Bit Rate High incident

Event ID: 106

Description	Default severity level	Typical causes	Actions
indicates the drop bit rate is greater than the set QoS Queue Drop Bit Rate High threshold. By default 10.	minor	highest number of drop bit rate is greater than the set threshold when the device is polled.	investigate if the device or link is under high load and evaluate the need to adjust limits for the QoS Class.

QoS Queue Drop Bit Rate High Cleared

Parent incident: QoS Drop Bit Rate High incident

Event ID: 107

Description	Default severity level	Typical causes	Actions
indicates the drop bit rate was greater than the set QoS Queue Drop Bit Rate High threshold, but has now transitioned back below the set boundary	information	highest number of drop bit rate is below the set threshold when the device is polled.	none.

QoS Under Bandwidth Limit

Parent incident: QoS Bandwidth Problem incident

Event ID: 107

Description	Default severity level	Typical causes	Actions
indicates the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, had previously exceeded but has now dropped back below the limit.	information	the bandwidth utilization, based on the amount of bandwidth assigned to the traffic class, has dropped below the limt.	none.

RADIUS Authentication Server Unreachable

Parent incident:

Event ID: 1136

Default severity: major

Returned To Using Primary Power

Parent incident:

Event ID: 1137

Default severity: information

Rogue AP Detected

Parent incident:

Event ID: 1138

Default severity: minor

Rogue DHCP Server Detected

Parent incident:

Event ID: 1139

Default severity: minor

Routing Broadcast Traffic High

Parent incident: Routing Broadcast Traffic High incident

Event ID: 524322, 2:34

Description

Default severity level

Typical causes

Actions

indicates an incorrect packet broadcast on a network that causes most hosts to respond all
at once, typically with wrong answers that start the process over again.

major

in a TCP/IP network is the use of ARP (Address Resolution Protocol) requests for address resolution, where the number of devices in a segment is too large.

Defective network adapter card or cable run may cause electrical noise to be sent along the cable, causing broadcast packets to be unanswered. This may cause more broadcast traffic, generating a broadcast storm.

check broadcast traffic domains.
configure the network to block illegal broadcast messages,
where electrical noise is a problem power down the failing device and disconnect from the
cable.

Routing Broadcast Traffic High Cleared

Parent incident: Routing Broadcast Traffic High incident

Event ID: 524323, 2:35

Description	Default severity level	Typical causes	Actions
sent by the router to the sender of a packet indicating that the route is now available.	information	resolution of high broadcast problem.	none.

Routing High No Routes to IP Destination

Parent incident: Routing High No Routes To IP Destination incident

Event ID: 655432, 8:72

Description	Default severity level	Typical causes	Actions
sent by the router to the sender of a packet indicating that there is no route available to deliver the packet to the intended receiver.	information	resolution of high broadcast problem.	none.

Routing High No Routes to IP Destination Cleared

Parent incident: Routing High No Routes To IP Destination incident

Event ID: 655433, 8:73

Description	Default severity level	Typical causes	Actions
sent by the router to the sender of a packet indicating that there is no route available to deliver the packet to the intended receiver.	minor	a network link is disconnected. destination address does not exist.	investigate destination address and network connections.

Routing ICMP High Redirects

Parent incident: Routing ICMP High Redirects incident

Event ID: 655434, 8:74

Description	Default severity level	Typical causes	Actions
indicates routers handling packets with incorrect addresses.	minor	device configured with incorrect routing entries.	locate the incorrectly configured device and correct. Alternatively, where you feel it is appropriate, disable ICMP redirects.

Routing ICMP High Redirects Cleared

Parent incident: Routing ICMP High Redirects incident

Event ID: 655435, 8:75

Description	Default severity level	Typical causes	Actions
indicates a reduction in incorrectly addressed packets.	information	device reconfiguration.	none.

Routing ICMP High TTL Exceeds

Parent incident: Routing ICMP High TTL Exceeds incident

Event ID: 655430, 8:70

Description	Default severity level	Typical causes	Actions
indicates TTL (Time To Live) value in the IP Packet is decremented to zero. The router discards the IP packet and an ICMP 'TTL Expired in transit' message is sent back to the sending IP address.	minor	unreachable device. routing loop.	locate the incorrectly configured sending device and correct.

Routing ICMP High TTL Exceeds Cleared

Parent incident: Routing ICMP High TTL Exceeds incident

Event ID: 655431, 8:71

Description	Default severity level	Typical causes	Actions
indicates transmission to the device is now within TTL (Time To Live) value in the IP packet.	information	device now online.	none.

Running On Backup Power

Parent incident:

Event ID: 1140

Default severity level: severe

SDN Controller Connection Failed

Parent incident: SDN Controller Connection Failure incident

Event ID: 791

Default severity level: information

SDN Controller Connection Failure Cleared

Parent incident: SDN Controller Connection Failure incident

Event ID: 790

Default severity level: information

Sensor Error

Parent incident: Sensor State Problem incident

Event ID: 1198

Default severity level: severe

Sensor Not Present

Parent incident: Sensor State Problem incident

Event ID: 1199

Default severity level: major

Sensor OK

Parent incident: Sensor State Problem incident

Event ID: 1195

Default severity level: information

Sensor State Unknown

Parent incident: Sensor State Problem incident

Event ID: 1197

Default severity level: severe

Sensor Warning

Parent incident: Sensor State Problem incident

Event ID: 1196

Default severity level: information

Service Down

Parent incident: Service State Problem incident

Event ID: 919

Description	Default severity level	Typical causes	Actions
indicates the named service is down.	critical	number of components failing in the service is sufficient to cause the service to fail.	in the Entuity UI, navigate to the My Network View and open the Services dashboard to see the current status of all services. Select the required service to drill down and view the status of its components.

Service State Degraded

Parent incident: Service State Problem incident

Event ID: 918

Description	Default severity level	Typical causes	Actions
indicates the state of the named service is degraded.	severe	the combined state of components in this service crosses the set threshold at which Entuity determines performance of the overall service is compromised. However, the set threshold at which the service would have failed has not been crossed.	in the Entuity UI, navigate to the My Network View and open the Services dashboard to see the current status of all services. Select the required service to drill down and view the status of its components.

Service Status Off

Parent incident: Service State Problem incident

Event ID: 917

Description	Default severity level	Typical causes	Actions
indicates the named service is now set to not generate a state. The event details indicate Status is set to None.	informations	user has amended the service configuration type to None.	in the Entuity UI, navigate to the My Network View and open the Services dashboard to see the current status of all services. Select the required service to drill down and view the status of its components.

Service State Unknown

Parent incident: Service State Problem incident

Event ID: 921

Description	Default severity level	Typical causes	Actions
indicates the state of the named service is unknown.	severe	state of one or more of the components in the service is unknown.	in the Entuity UI, navigate to the My Network View and open the Services dashboard to see the current status of all services. Select the required service to drill down and view the status of its components.

Service Traffic High

Parent incident: Service Traffic High incident

Event ID: 763

Default severity level: severe

Service Traffic High Cleared

Parent incident: Service Traffic High incident

Event ID: 762

Default severity level: information

Service Traffic Low

Parent incident: Service Traffic Low incident

Event ID: 761

Default severity level: severe

Service Traffic Low Cleared

Parent incident: Service Traffic Low incident

Event ID: 760

Default severity level: information

Service Up

Parent incident: Service State Problem incident

Event ID: 920

Description	Default severity level	Typical causes	Actions
indicates the named service is up, after its state has previously been Down or Unknown.	information	sufficient components in this service are now up, so the service is now available.	none.

Settings Changed

Parent incident:

Event ID: 1141

Default severity: information

SNMP Agent Not Responding

Parent incident: Device Not Responding To SNMP incident

Event ID: 655363, 8:3

Description

Default severity level

Typical causes

Actions

indicates the device - specifically its SNMP agent - is not responding to SNMP requests, but it was available when Entuity last attempted to ping it. It is the response to the ping that determines whether Entuity considers a device to be up or down. SNMP Agent Not Responding events are not raised when a device is down.

Entuity availability monitoring operates in one of two modes:

by ICMP ping to hte management IP address only.
by ICMP ping to all IP addresses on the device (default). The device is considered up when Entuity receives one or more responses.

critical

device configuration changes, e.g. to SNMP read community string or SNMP access lists.
device resource issues.

check that the SNMP community string of the device in Entuity is still configured correctly.

SNMP Agent Responding

Parent incident: Device Not Responding To SNMP incident

Event ID: 655364, 8:4

Description	Default severity level	Typical causes	Actions
indicates the device is now responding to SNMP requests, but was unavailable when Entuity last attempted to Ping it. Entuity pings the IP addresses of managed objects every two minutes.	information	device configuration changes, e.g. to SNMP read community string or SNMP access lists. device resource issues.	none.

SNMP Agent Restart Detected

Parent incident: SNMP Agent Restart Detected incident

Event ID: 254

Description	Default severity level	Typical causes	Actions
indicates the SNMP service has restarted on the managed host, since Entuity last attempted to poll it. It also indicates the SNMP counters polled by Entuity for the managed host have been reset, which may explain any unexpected data spikes.	major	device restarted. manual restart of the SNMP agent.	none.

SNMP Authentication Failure

Parent incident: SNMP Authentication Failure incident

Event ID: 655368, 8:8

Description	Default severity level	Typical causes	Actions
indicates that a request did not get proper authentication, usually the result of a bad community string.	severe	invalid community was received in a message.	ping the device to ensure that it is still contactable. If the ping is successful, check that the IP address and SNMP community string of the device in Entuity are still configured correctly (although it may not be the Entuity server that is issuing the SNMP requests that are failing).

SNMP Response Time High

Parent incident: SNMP Response Time High incident

Event ID: 655377, 8:17

Description	Default severity level	Typical causes	Actions
indicates that a device's response to an SNMP request was greater than the set threshold.	severe	latency may be caused by the traffic load on the network, or by load on the device or intermediate devices.	in the Entuity UI, navigate to the device in question and open its Summary dashboard to see and drill down into its latency chart. To view this device's latency performance within the context of other devices, run the Device SNMP Response Time report, which is an Administrative report.

SNMP Response Time High Cleared

Parent incident: SNMP Response Time High incident

Event ID: 655378, 8:18

Description	Default severity level	Typical causes	Actions
indicates that a device's response to an SNMP request has now returned to within the set threshold.	severe	latency has returned to within the set threshold.	none.

SNMPv3 Duplicate Engine ID

Parent incident: SNMPv3 Duplicate Engine ID incident

Event ID: 655450, 8:90

Description	Default severity level	Typical causes	Actions
indicates that two or more devices under management now have the same SNMPv3 engine identifier. Under SNMPv3, devices use the engine identifier when determining the source of a trap and decoding its message.	severe	a device under ENA management has been reconfigured with an engine identifier used by another device that is also under management.	event details include information on the two devices with the same engine identifier. You should reconfigure one of the devices with a unique engine identifier. Please see this article for further help and information.

SSL Certificate Expiration Cleared

Parent incident: SSL Certificate Expiration Critical incident, SSL Certificate Expiration Warning incident

Event ID: 1378

Default severity level: information

SSL Certificate Expiration Critical

Parent incident: SSL Certificate Expiration Critical incident

Event ID: 1377

Default severity level: critical

SSL Certificate Expiration Warning

Parent incident: SSL Certificate Expiration Warning incident

Event ID: 1376

Default severity level: severe

SSL Certificate Expired

Parent incident: SSL Certificate Problem incident

Event ID: 1023

Description	Default severity level	Typical causes	Actions
indicates the SSL certificate has expired. Entuity continues to raise this even, every 24 hours, until the certificate is renewed or removed.	critical	SSL certificate has passed its expiry date.	install a new SSL certificate.

SSL Certificate Expiring

Parent incident: SSL Certificate Problem incident

Event ID: 1024

Description	Default severity level	Typical causes	Actions
indicates the SSL certificate expiry date is within the set expiry notification period. You can amend the notification period against the device. Entuity continues to raise this event, every 24 hours, until the certificate is renewed, removed or expires	severe	SSL certificate expiry date is within the set notification period.	obtain a new SSL certificate. You can create self-signed certificates yourself, otherwise obtain one from a recognized SSL certificate-issuing authority.

SSL Proxy Service Administrative Available to SNMP Poll

Parent incident: SSL Proxy Service Administrative Unavailable to SNMP Poll incident

Event ID: 1021

Description	Default severity level	Typical causes	Actions
indicates that the device is responding, because its administrative state is up.	information	administrator has configured the administrative state to up.	none.

SSL Proxy Service Administrative Unavailable to SNMP Poll

Parent incident: SSL Proxy Service Administrative Unavailable to SNMP Poll incident

Event ID: 1022

Description	Default severity level	Typical causes	Actions
indicates that the device is not responding, because its administrative state is down.	critical	administrator has taken the module down.	none.

SSL Proxy Service Operational Available to SNMP Poll

Parent incident: SSL Proxy Service Operational Available To SNMP Poll incident

Event ID: 1019

Description	Default severity level	Typical causes	Actions
indicates that the device is responding to SNMP polling, because its operational state is up.	information	SSL Proxy service has been down but is now available.	none.

SSL Proxy Service Operational Unavailable to SNMP Poll

Parent incident: SSL Proxy Service Operational Available To SNMP Poll incident

Event ID: 1020

Description	Default severity level	Typical causes	Actions
indicates that the device is not responding to SNMP polling, because its operational state is down.	critical	SSL certificate has passed its expiry date.	contact your SSL authority for a valid certificate.

Storage Device High CPU Usage

Parent incident: Storage Device High CPU Usage incident

Event ID: 1248

Default severity level: severe

Storage Device High CPU Usage Cleared

Parent incident: Storage Device High CPU Usage incident

Event ID: 1247

Default severity level: information

Storage Device High Memory Usage

Parent incident: Storage Device High Memory Usage incident

Event ID: 1250

Default severity level: severe

Storage Device High Memory Usage Cleared

Parent incident: Storage Device High Memory Usage incident

Event ID: 1249

Default severity level: information

Storage Device High Power Consumption

Parent incident: Storage Device High Power Consumption incident

Event ID: 1367

Default severity level: severe

Storage Device High Power Consumption Cleared

Parent incident: Storage Device High Power Consumption incident

Event ID: 1368

Default severity level: information

Storage Device Low Usable Capacity

Parent incident: Storage Device Low Usable Capacity incident

Event ID: 1252

Default severity level: severe

Storage Device Low Usable Capacity Cleared

Parent incident: Storage Device Low Usable Capacity incident

Event ID: 1251

Default severity level: information

Storage Pool High Hard Error Rate

Parent incident: Storage Pool High Hard Error Rate incident

Event ID: 1232

Default severity level: severe

Storage Pool High Hard Error Rate Cleared

Parent incident: Storage Pool High Hard Error Rate incident

Event ID: 1231

Default severity level: information

Storage Pool High Latency

Parent incident: Storage Pool High Soft Error Rate incident

Event ID: 1236

Default severity level: severe

Storage Pool High Latency Cleared

Parent incident: Storage Pool High Soft Error Rate incident

Event ID: 1235

Default severity level: information

Storage Pool High Soft Error Rate

Parent incident: Storage Pool High Soft Error Rate incident

Event ID: 1234

Default severity level: severe

Storage Pool High Soft Error Rate Cleared

Parent incident: Storage Pool High Soft Error Rate incident

Event ID: 1233

Default severity level: information

Storage Pool High Used Capacity

Parent incident: Storage Pool High Used Capacity % incident

Event ID: 1238

Default severity level: severe

Storage Pool High Used Capacity Cleared

Parent incident: Storage Pool High Used Capacity % incident

Event ID: 1237

Default severity level: information

STP New Root Device

Parent incident: STP Topology Change incident

Event ID: 720897

Description	Default severity level	Typical causes	Actions
indicates that a device has reported a new root switch for a spanning tree in which it participates. This even is detected by the generation of an SNMP trap on the device.	critical	device configuration changes. device or link failures.	telnet to the device and check the system logs for an indication of what caused a new device to become the root switch.

STP VLAN Topology Change

Parent incident: STP Topology Change incident

Event ID: 720898

Description	Default severity level	Typical causes	Actions
indicates that a device reported a topology change for a spanning tree in which it participates. This event is detected by the generation of an SNMP trap on the device.	major	device configuration changes. device or link failures.	telnet to the device and check the system logs for an indication of what caused the topology change.

Switch Port Connected

Parent incident:

Event ID: 1142

Default severity: information

Switch Port Disconnected

Parent incident:

Event ID: 1143

Default severity: minor

Syslog Alert

Parent incident: Syslog Alert incident

Event ID: 1048578

Description

Default severity level

Typical causes

Actions

syslog can generate system messages for each of the defined facilities, those defined by default and those defined locally. All of the system message can be prioritized. Syslog event details have the format:

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

severe

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

dependent on the syslog event raised.

Syslog Critical

Parent incident: Syslog Critical incident

Event ID: 1048579

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

severe

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

dependent on the syslog event raised.

Syslog Debug

Parent incident: Syslog Debug incident

Event ID: 1048584

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

information

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

none.

Syslog Emergency

Parent incident: Syslog Emergency incident

Event ID: 1048577

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

critical

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

dependent on the syslog event raised.

Syslog Error

Parent incident: Syslog Error Events incident

Event ID: 1048580

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

major

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

dependent on the syslog event raised.

Syslog Information

Parent incident: Syslog Information incident

Event ID: 1048583

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

information

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

none.

Syslog Notice

Parent incident: Syslog Notice incident

Event ID: 1048582

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

minor

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

none.

Syslog Warning

Parent incident: Syslog Warning incident

Event ID: 1048581

Description

Default severity level

Typical causes

Actions

tag:message

where:

tag indicates the syslog message, e.g.:
- %PAGP-5-PORTFROMSTP, a spanning tree messages.
- %LINK-3-UPDOWN, a link up and down (physical).
- %LINEPROTO-5-UPDOWN, a line up and down (layer 2).
message, the content of the syslog message.

minor

Entuity administrator determines which system messages generate events that are displayed, and the facilities and at what priority level from which these system messages come.

dependent on the syslog event raised.

UCS Blade Down

Parent incident: UCS Blade Status incident

Event ID: 719

Description	Default severity level	Typical causes	Actions
indicates a blade fault for a device.	critical	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Blade Major Fault

Parent incident: UCS Blade Status incident

Event ID: 718

Description	Default severity level	Typical causes	Actions
indicates a major blade hardware or firmware problem.	severe	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Blade Minor Fault

Parent incident: UCS Blade Status incident

Event ID: 717

Description	Default severity level	Typical causes	Actions
indicates a minor blade hardware or firmware problem.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Blade OK

Parent incident: UCS Blade Status incident

Event ID: 715

Description	Default severity level	Typical causes	Actions
indicates that a blade fault for a device has been cleared.	OK (green)	faulty blade has been swapped out.	none.

UCS Blade Status Unknown

Parent incident: UCS Blade Status incident

Event ID: 716

Description	Default severity level	Typical causes	Actions
indicates that Entuity cannot determine the status of the blade.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Chassis Down

Parent incident: UCS Chassis Status incident

Event ID: 684

Description	Default severity level	Typical causes	Actions
indicates a fault for a device.	critical	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Chassis Major Fault

Parent incident: UCS Chassis Status incident

Event ID: 683

Description	Default severity level	Typical causes	Actions
indicates a major chassis hardware or firmware problem.	severe	faulty hardware or firmware.	telnet to the device and check the system settings for an indication of what the problem is. A hardware swap out may need to be scheduled, depending on the type of problem.

UCS Chassis Minor Fault

Parent incident: UCS Chassis Status incident

Event ID: 682

Description	Default severity level	Typical causes	Actions
indicates that a chassis has a minor hardware or firmware problem.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Chassis Status OK

Parent incident: UCS Chassis Status incident

Event ID: 680

Description	Default severity level	Typical causes	Actions
indicates that a chassis fault for a device has been cleared.	OK (green)	faulty chassis has been swapped out.	none.

UCS Chassis Status Unknown

Parent incident: UCS Chassis Status incident

Event ID: 681

Description	Default severity level	Typical causes	Actions
indicates that Entuity cannot determine the status of the chassis.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fabric Extender Down

Parent incident: UCS Fabric Extender Status incident

Event ID: 709

Description	Default severity level	Typical causes	Actions
indicates a fabric extender fault for a device.	critical	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fabric Extender Major Fault

Parent incident: UCS Fabric Extender Status incident

Event ID: 708

Description	Default severity level	Typical causes	Actions
indicates a major fabric extender hardware or firmware problem.	severe	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fabric Extender Minor Fault

Parent incident: UCS Fabric Extender Status incident

Event ID: 707

Description	Default severity level	Typical causes	Actions
indicates a minor fabric extender hardware or firmware problem.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fabric Extender Status OK

Parent incident: UCS Fabric Extender Status incident

Event ID: 705

Description	Default severity level	Typical causes	Actions
indicates that a fabric extender fault for a device has been cleared.	OK (green)	faulty fabric extender has been swapped out.	none.

UCS Fabric Extender Status Unknown

Parent incident: UCS Fabric Extender Status incident

Event ID: 706

Description	Default severity level	Typical causes	Actions
indicates that Entuity cannot determine the status of the fabric extender.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Down

Parent incident: UCS Fan Status incident

Event ID: 699

Description	Default severity level	Typical causes	Actions
indicates a fault on a fan on the device chassis.	critical	faulty fan hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Major Fault

Parent incident: UCS Fan Status incident

Event ID: 698

Description	Default severity level	Typical causes	Actions
indicates a fan on the device chassis has a major fault.	severe	faulty fan hardware. faulty environmental card. faulty supervisor card.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Minor Fault

Parent incident: UCS Fan Status incident

Event ID: 697

Description	Default severity level	Typical causes	Actions
indicates a fan on the device chassis has a minor fault.	major	faulty fan hardware. faulty environmental card. faulty supervisor card.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Module Down

Parent incident: UCS Fan Module Status incident

Event ID: 694

Description	Default severity level	Typical causes	Actions
indicates a fan on the device chassis is down.	critical	faulty fan module hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Module Major Fault

Parent incident: UCS Fan Module Status incident

Event ID: 693

Description	Default severity level	Typical causes	Actions
indicates that a module has a minor fan hardware problem.	severe	faulty fan hardware. faulty environmental card. faulty supervisor card.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Module Minor Fault

Parent incident: UCS Fan Module Status incident

Event ID: 692

Description	Default severity level	Typical causes	Actions
indicates that a module has a minor fan hardware problem.	major	faulty fan hardware. faulty environmental card. faulty supervisor card.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Module Status OK

Parent incident: UCS Fan Module Status incident

Event ID: 690

Description	Default severity level	Typical causes	Actions
indicates that a fan module fault for a device has been cleared.	information	faulty fan module has been swapped out.	none.

UCS Fan Module Status Unknown

Parent incident: UCS Fan Module Status incident

Event ID: 691

Description	Default severity level	Typical causes	Actions
indicates the status of the fan module is not reportable or is unknown.	minor	status of the fan module is not reportable. status of the fan module is unknown.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Fan Status OK

Parent incident: UCS Fan Status incident

Event ID: 695

Description	Default severity level	Typical causes	Actions
indicates that a fan fault for a device has been cleared.	information	faulty fan has been swapped out.	none.

UCS Fan Status Unknown

Parent incident: UCS Fan Status incident

Event ID: 696

Description	Default severity level	Typical causes	Actions
indicates the status of the fan is not reportable or is unknown.	minor	status of the fan is not reportable. status of the fan is unknown.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Local Disk Down

Parent incident: UCS Local Disk Status incident

Event ID: 714

Description	Default severity level	Typical causes	Actions
indicates a local disk fault for a device.	critical	faulty local disk hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Local Disk Major Fault

Parent incident: UCS Local Disk Status incident

Event ID: 713

Description	Default severity level	Typical causes	Actions
indicates that a device has a major local disk hardware or firmware problem.	major	faulty local disk hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Local Disk Minor Fault

Parent incident: UCS Local Disk Status incident

Event ID: 712

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor module (line card) hardware or firmware problem.	minor	faulty local disk hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Local Disk Status OK

Parent incident: UCS Local Disk Status incident

Event ID: 710

Description	Default severity level	Typical causes	Actions
indicates that a module (card) fault for a device has been cleared.	OK (green)	faulty local disk has been swapped out.	none.

UCS Local Disk Unknown

Parent incident: UCS Local Disk Status incident

Event ID: 711

Description	Default severity level	Typical causes	Actions
indicates that the local disk is unknown.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS PSU Down

Parent incident: UCS Power Supply Status incident

Event ID: 689

Description	Default severity level	Typical causes	Actions
indicates a PSU fault for a device.	critical	faulty PSU hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS PSU Major Fault

Parent incident: UCS Power Supply Status incident

Event ID: 688

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor PSU hardware or firmware problem.	critical	faulty PSU hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS PSU Minor Fault

Parent incident: UCS Power Supply Status incident

Event ID: 687

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor PSU hardware or firmware problem.	minor	faulty PSU hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS PSU Status OK

Parent incident: UCS Power Supply Status incident

Event ID: 685

Description	Default severity level	Typical causes	Actions
indicates that a PSU fault for a device has been cleared.	OK (green)	faulty PSU has been swapped out.	none.

UCS PSU Status Unknown

Parent incident: UCS Power Supply Status incident

Event ID: 686

Description	Default severity level	Typical causes	Actions
indicates that the PSU is unknown.	minor	faulty hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Switch Card Down

Parent incident: UCS Switch Card Status incident

Event ID: 704

Description	Default severity level	Typical causes	Actions
indicates a switch card fault for a device.	major	faulty switch card hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Switch Card Major Fault

Parent incident: UCS Switch Card Status incident

Event ID: 703

Description	Default severity level	Typical causes	Actions
indicates that a device has a major switch card hardware or firmware problem.	severe	faulty switch card hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Switch Card Minor Fault

Parent incident: UCS Switch Card Status incident

Event ID: 702

Description	Default severity level	Typical causes	Actions
indicates that a device has a minor switch card hardware or firmware problem.	minor	faulty switch card hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UCS Switch Card Status OK

Parent incident: UCS Switch Card Status incident

Event ID: 700

Description	Default severity level	Typical causes	Actions
indicates that a switch card fault for a device has been cleared.	information	faulty switch card has been swapped out.	none.

UCS Switch Card Status Unknown

Parent incident: UCS Switch Card Status incident

Event ID: 701

Description	Default severity level	Typical causes	Actions
indicates Entuityri received an enterprise trap for which it does not have a loaded MIB, rules or custom event. Trap details include its OID and argument values.	major	faulty switch card hardware or firmware.	copy the message from the event description, or copy the message from the console/system log in the Cisco UCS Manager. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. Also refer to the Release Notes for UCS Manager and the Cisco UCS Troubleshooting Guide. If you cannot resolve the issue, execute the show tech-support command and contact Cisco Technical Support.

UDLD Error

Parent incident:

Event ID: 1145

Default severity: minor

Unknown Trap

Parent incident: Unknown Trap incident

Event ID: 655370, 8:10

Description	Default severity level	Typical causes	Actions
indicates Entuity received an enterprise trap for which it does not have a loaded MIB, rules or custom event. Trap details include its OID and argument values.	major	Entuity received an enterprise trap, for which a mapping has been included to the Entuity database.	through the Event Management System you can import and load MIBs, creating rules and custom events for trap definitions. Alternatively you can prevent Entuity raising Unknown Trap events by activating the Discard Unknown Trap rule.

Unreachable Devices Detected

Parent incident:

Event ID: 1147

Default severity: minor

Uplink Status Changed

Parent incident:

Event ID: 1148

Default severity: information

User Defined Attribute State Disabled

Parent incident: User Defined Attribute Status incident

Event ID: 357

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	major	this event is a state event and is raised when the attribute reports its state as disabled.	view the event details to see the configuration setup for the disabled state.

User Defined Attribute State Down

Parent incident: User Defined Attribute Status incident

Event ID: 358

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	severe	this event is a state event and is raised when the attribute reports its state as down.	view the event details to see the configuration setup for the down state.

User Defined Attribute State Other

Parent incident: User Defined Attribute Status incident

Event ID: 356

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	major	this event is a state event and is raised when the attribute reports its state as other.	view the event details to see the configuration setup for the other state.

User Defined Attribute State Up

Parent incident: User Defined Attribute Status incident

Event ID: 359

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	information	this event is a state event and is raised when the attribute reports its state as up.	view the event details to see the configuration setup for the up state.

User Defined Attribute Value Abnormality Cleared

Parent incident: User Defined Attribute Value Abnormality incident

Event ID: 360

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	information	this event is a threshold event and is raised when the polled attribute value has transitioned to a normal state.	view the event details to see the configuration setup for the normal state.

User Defined Attribute Value Critical

Parent incident: User Defined Attribute Value Abnormality incident

Event ID: 364

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	critical	this event is a threshold event and is raised when the polled attribute value is within the set critical threshold boundary.	view the event details to see the configuration setup for the critical threshold state.

User Defined Attribute Value High

Parent incident: User Defined Attribute Value Abnormality incident

Event ID: 363

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	severe	this event is a threshold event and is raised when the polled attribute value is within the set high threshold boundary.	view the event details to see the configuration setup for the high threshold state.

User Defined Attribute Value Low

Parent incident: User Defined Attribute Value Abnormality incident

Event ID: 361

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	major	this event is a threshold event and is raised when the polled attribute value is within the set low threshold boundary.	view the event details to see the configuration setup for the low threshold state.

User Defined Attribute Value Warning

Parent incident: User Defined Attribute Value Abnormality incident

Event ID: 362

Description	Default severity level	Typical causes	Actions
through User Defined Polling, you can create attributes for Entuity to poll. You can also set Entuity to raise events depending upon the values returned.	major	this event is a threshold event and is raised when the polled attribute value is within the set low threshold boundary.	View the event details. This contains the configuration setup for the low threshold state.

Virtual Machine Heartbeat Alarm

Parent incident: VM Heartbeat Problem incident

Event ID: 1330

Default severity level: severe

Virtual Machine Heartbeat OK

Parent incident: VM Heartbeat Problem incident

Event ID: 1332

Default severity level: information

Virtual Machine Heartbeat Unknown

Parent incident: VM Heartbeat Problem incident

Event ID: 1329

Default severity level: minor

Virtual Machine Heartbeat Warn

Parent incident: VM Heartbeat Problem incident

Event ID: 1331

Default severity level: major

Virtual Machine Max Disk Usage High

Parent incident: Virtual Machine Max Disk Usage High incident

Event ID: 78

Default severity level: major

Virtual Machine Max Disk Usage High Cleared

Parent incident: Virtual Machine Max Disk Usage High incident

Event ID: 77

Default severity level: information

Virtual Machine Moved

Parent incident: VM Moved incident

Event ID: 63

Description	Default severity level	Typical causes	Actions
Entuity has monitored the moving of a VM between hypervisors.	minor	corrected connection details.	none.

Virtual Machine Powered Off

Parent incident: VM Power Status Changed incident

Event ID: 69

Description	Default severity level	Typical causes	Actions
ENA has monitored a VM powering off.	information	corrected connection details.	none.

Virtual Machine Powered On

Parent incident: VM Power Status Changed incident

Event ID: 70

Description	Default severity level	Typical causes	Actions
Entuity has monitored a VM powering on.	information	corrected connection details.	none.

Virtualization Connection Failed

Parent incident: Virtualization Connection Failed incident

Event ID: 65

Description	Default severity level	Typical causes	Actions
indicates that Entuity has failed to connect to the identified VM platform.	severe	incorrect connection details (e.g. an aged out connection password, incorrect connection URL). unavailable VM platform.	Confirm the connection details (the connection to a VM platform is through its SDK). View and modify connection details via the Main Menu > Administration > Managed Assets page.

Virtualization Connection Success

Parent incident: Virtualization Connection Failed incident

Event ID: 64

Description	Default severity level	Typical causes	Actions
Entuity has successfully connected to the VM platform after a previous failure.	information	corrected connection details.	none.

VM CPU High

Parent incident: Virtual Machine High CPU incident

Event ID: 74

Default severity level: major

VM CPU High Cleared

Parent incident: Virtual Machine High CPU incident

Event ID: 73

Default severity level: information

VM Guest Memory High

Parent incident: VM Guest Memory High incident

Event ID: 76

Description	Default severity level	Typical causes	Actions
indicates high memory utilization on the VM. The VM High Guest Memory Threshold can be set against the VM platform and against individual VMs.	minor	excessive application holding of resources.	run a Flex Report to identify long-term utilization of tunnels on the VPN.

VM Guest Memory High Cleared

Parent incident: VM Guest Memory High incident

Event ID: 75

Description	Default severity level	Typical causes	Actions
indicates a previous VM Guest Memory High alarm has been cleared.	information	VM memory utilization has returned to acceptable levels.	none.

vManage Device Alarm

Parent incident: vManage Alarm incident

Event ID: 769

Default severity level: severe

vManage Device Alarm Cleared

Parent incident: vManage Alarm incident

Event ID: 768

Default severity level: information

vManage Poller Failed

Parent incident: vManage Poller Failed incident

Event ID: 767

Default severity level: severe

vManage Poller Overrun

Parent incident: vManage Poller Overrun incident

Event ID: 765

Default severity level: severe

vManage Poller Overrun Cleared

Parent incident: vManage Poller Overrun incident

Event ID: 764

Default severity level: information

vManage Poller Success

Parent incident: vManage Poller Failed incident

Event ID: 766

Default severity level: information

Volume High Latency

Parent incident: Volume High Latency incident

Event ID: 1244

Description	Default severity level	Typical causes	Actions
indicates the latency for the volume is greater than the set threshold. By default 20.	severe	high demand is placed on the volume and the underlying disks.	review storage architecture.

Volume High Latency Cleared

Parent incident: Volume High Latency incident

Event ID: 1243

Description	Default severity level	Typical causes	Actions
indicates the latency for the volume was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of latency is below the set threshold when the device is polled.	none.

Volume High Used Provisioned

Parent incident: Volume High Used Provisioned % incident

Event ID: 1246

Description	Default severity level	Typical causes	Actions
indicates the usage for the provisioned volume is greater than the set threshold. By default 85.	severe	highest number of provisioned volume usage is greater than the set threshold when the device is polled.	review storage architecture.

Volume High Used Provisioned Cleared

Parent incident: Volume High Used Provisioned % incident

Event ID: 1245

Description	Default severity level	Typical causes	Actions
indicates the usage for the provisioned volume was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of provisioned volume usage is below the set threshold when the device is polled.	free up space or increase volume capacity.

VPN High Active Tunnels

Parent incident: VPN High Active Tunnels incident

Event ID: 607

Description	Default severity level	Typical causes	Actions
indicates high VPN tunnel usage.	minor	excessive application traffic. configuration changes.	run a Flex Report to identify long-term utilization of tunnels on the VPN.

VPN High Active Tunnels Cleared

Parent incident: VPN High Active Tunnels incident

Event ID: 606

Description	Default severity level	Typical causes	Actions
indicates a previous VPN High Active Tunnels alarm has been cleared.	information	VPN tunnel usage has returned to acceptable levels.	none.

VPN High Cluster Current Users

Parent incident: VPN High Cluster Current Users incident

Event ID: 933

Default severity level: severe

VPN High Cluster Current Users Cleared

Parent incident: VPN High Cluster Current Users incident

Event ID: 932

Default severity level: information

VPN High Current Users

Parent incident: VPN High Current Users incident

Event ID: 935

Default severity level: severe

VPN High Current Users Cleared

Parent incident: VPN High Current Users incident

Event ID: 934

Default severity level: information

VPN High Initiation Failure Rate

Parent incident: High VPN Initiation Failure incident

Event ID: 814

Default severity level: severe

VPN High Initiation Failure Rate Cleared

Parent incident: High VPN Initiation Failure incident

Event ID: 815

Default severity level: information

VPN High Initiation Response Failure Rate

Parent incident: High VPN Initiation Response Failure incident

Event ID: 812

Default severity level: severe

VPN High Initiation Response Failure Rate Cleared

Parent incident: High VPN Initiation Response Failure incident

Event ID: 813

Default severity level: information

VPN High System Capacity Failure Rate

Parent incident: High VPN Sys Capacity Failure incident

Event ID: 816

Default severity level: severe

VPN High System Capacity Failure Rate Cleared

Parent incident: High VPN Sys Capacity Failure incident

Event ID: 817

Default severity level: information

VPN High Total Hits Rate

Parent incident: VPN High Total Hits Rate incident

Event ID: 931

Default severity level: information

VPN High Total Hits Rate Cleared

Parent incident: VPN High Total Hits Rate incident

Event ID: 930

Default severity level: information

VPN Load Average High

Parent incident: VPN Load Average High incident

Event ID: 600

Description	Default severity level	Typical causes	Actions
load average (average number of processes in the runqueue during the polling interval) is above the set threshold.	minor	excessive application traffic. configuration changes.	run a Flex Report to identify long term utilization of tunnels on the VPN.

VPN Load Average High Cleared

Parent incident: VPN Load Average High incident

Event ID: 601

Description	Default severity level	Typical causes	Actions
indicates a previous VPN Load Average High alarm has been cleared.	information	average loading for the runqueue has returned to acceptable levels.	none.

VPN Network Port Utilization High

Parent incident: VPN Network Port Utilization High incident

Event ID: 604

Description	Default severity level	Typical causes	Actions
indicates that a VPN ethernet port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	minor	excessive application traffic. configuration changes.	if high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

VPN Network Port Utilization High Cleared

Parent incident: VPN Network Port Utilization High incident

Event ID: 605

Description	Default severity level	Typical causes	Actions
indicates a previous VPN Network Port Utilization High alarm has been cleared.	information	VPN port utilization has returned to acceptable levels.	none.

VPN Tunnel Disappeared

Parent incident: VPN Tunnel Disappeared incident

Event ID: 818

Description	Default severity level	Typical causes	Actions
indicates a VPN tunnel has been removed.	critical	a configuration change removing the VPN tunnel	review VPN configuration and investigate the cause of router disappearance.

VPN Tunnel Discovered

Parent incident: VPN Tunnel Disappeared incident

Event ID: 819

Description	Default severity level	Typical causes	Actions
indicates a VPN tunnel was discovered.	minor	a configuration change adding the VPN tunnel	review VPN configuration.

VPN Tunnel High Inbound Packet Loss

Parent incident: High VPN Tunnel In Packet Loss incident

Event ID: 820

Description	Default severity level	Typical causes	Actions
indicates the packet loss is greater than the set VPN Tunnel High Inbound Packet Loss threshold. By default 5.	severe	highest number of packet loss is greater than the set threshold when the device is polled.	check issues with physical connectivity and latency.

VPN Tunnel High Inbound Packet Loss Cleared

Parent incident: High VPN Tunnel In Packet Loss incident

Event ID: 821

Description	Default severity level	Typical causes	Actions
indicates the packet loss was greater than the set VPN Tunnel High Inbound Packet Loss threshold, but has now transitioned below the set boundary.	information	highest number of packet loss is below the set threshold when the device is polled.	none.

VPN Tunnel High Outbound Packet Loss

Parent incident: VPN Tunnel High Outbound Packet Loss incident

Event ID: 823

Description	Default severity level	Typical causes	Actions
indicates the packet loss is greater than the set VPN Tunnel High Outbound Packet Loss threshold. By default 5.	severe	highest number of packet loss is greater than the set threshold when the device is polled.	check issues with physical connectivity and latency.

VPN Tunnel High Outbound Packet Loss Cleared

Parent incident: VPN Tunnel High Outbound Packet Loss incident

Event ID: 822

Description	Default severity level	Typical causes	Actions
indicates the packet loss was greater than the set threshold, but has now transitioned back below the set boundary.	information	highest number of packet loss is back below the set threshold when the device is polled.	none.

VPN Tunnel Usage High

Parent incident: VPN Tunnel Usage High incident

Event ID: 602

Description	Default severity level	Typical causes	Actions
indicates high VPN tunnel usage.	minor	excessive application traffic. configuration changes.	run a Flex Report to identify long term utilization of tunnels on the VPN.

VPN Tunnel Usage High Cleared

Parent incident: VPN Tunnel Usage High incident

Event ID: 603

Description	Default severity level	Typical causes	Actions
indicates a previous VPN Tunnel Usage High alarm has been cleared.	information	VPN tunnel usage has returned to acceptable levels.	none.

VSwitch State Alarm

Parent incident: VSwitch State Problem incident

Event ID: 1314

Default severity level: severe

VSwitch State OK

Parent incident: VSwitch State Problem incident

Event ID: 1316

Default severity level: information

VSwitch State Unknown

Parent incident: VSwitch State Problem incident

Event ID: 1313

Default severity level: minor

VSwitch State Warn

Parent incident: VSwitch State Problem incident

Event ID: 1315

Default severity level: major

Vulnerability Monitoring Fail

Applicable to Entuity v22.0 GA upwards

Parent incident: Vulnerability Monitoring Fail incident

Event ID: 1379

Default severity level: information

Vulnerability Monitoring Success

Applicable to Entuity v22.0 GA upwards

Parent incident: Vulnerability Monitoring Fail incident

Event ID: 1380

Default severity level: information

WAN Port High Inbound Discards

Parent incident: WAN Port High Inbound Discards incident

Event ID: 32

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) is discarding packets. This packet loss causes end to end application performance degradation, as applications timeout and re-transmit data intermittently.	major	when congestion occurs downstream in the network, and the device needs to free buffer space frames are discarded. For Frame Relay the switch dropping frames will select from its buffer the frames with the DE bit set first. If this is not sufficient to relieve the congestion, frames with DE bit clear will be dropped next.	use the Ticker tool to check inbound broadcast traffic on the port reporting discards. If broadcast traffic is light, telnet to the device and check system resources. Increasing the size of the receive buffers, and/or upgrading the device hardware (CPU and memory) may be necessary.

WAN Port High Inbound Discards Cleared

Parent incident: WAN Port High Inbound Discards incident

Event ID: 33

Description	Default severity level	Typical causes	Actions
indicates a WAN Port HighInbound Discards alarm has been cleared as the port discard rate is now below the high threshold value.	information	reduced transmission.	none.

WAN Port High Inbound Errors

Parent incident: WAN Port High Inbound Errors incident

Event ID: 28

Description	Default severity level	Typical causes	Actions
indicates that a port is receiving corrupted packets from the network (a brownout). These packets are thrown away by the port’s device, causing application layer timeouts and re-transmissions. Network users may complain about slow application response times. Types of corrupted packets include CRC errors, alignment errors, giants, and runt packets.	major	duplex/half duplex configuration mismatches on switch and router ports. faulty cabling between PCs/servers and switch ports. faulty NIC cards on PCS and servers. faulty transceivers. noise on WAN circuits. giant packets may be caused by faulty firmware on switch devices or encapsulation misconfiguration on trunk ports.	check the duplex settings on switch ports reporting this problem, and the PC or server which is attached to the switch port. If this isn't the cause of the problem, move the PC or server to a different port and see if the corruption continues. If so, swap out the NIC card on the PC or server.

WAN Port High Inbound Errors Cleared

Parent incident: WAN Port High Inbound Errors incident

Event ID: 29

Description	Default severity level	Typical causes	Actions
indicates that the port error rate is now below the high threshold value.	information	port error rate is now below the high threshold value, as alerted by the WAN Port High Inbound Errors alarm.	none.

WAN Port High Inbound Utilization

Parent incident: WAN Port Low Inbound Utilization Cleared incident

Event ID: 20

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) is experiencing high levels of utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	major	excessive application traffic. configuration changes.	if high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

WAN Port High Inbound Utilization Cleared

Parent incident: WAN Port Low Inbound Utilization Cleared incident

Event ID: 21

Description	Default severity level	Typical causes	Actions
a WAN Port High Inbound Utilization alarm has been cleared, because the port error rate is now below the high threshold value.	information	reduced application traffic.	none.

WAN Port High Outbound Discards

Parent incident: WAN Port High Outbound Discards incident

Event ID: 34

Description	Default severity level	Typical causes	Actions
indicates that a port is dropping some packets in its transmit buffers even though no errors had been detected to prevent their being transmitted. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently	major	lack of bandwidth on a port. transmit buffer sizes too small.	use the Ticker tool to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

WAN Port High Outbound Discards Cleared

Parent incident: WAN Port High Outbound Discards incident

Event ID: 35

Description	Default severity level	Typical causes	Actions
correlated clearing event for the WAN Port High Outbound Discards event.	information	the port discard rate is now below the high threshold rate.	none.

WAN Port High Outbound Errors

Parent incident: WAN Port High Outbound Errors incident

Event ID: 30

Description	Default severity level	Typical causes	Actions
indicates that the WAN port is dropping large numbers of packets in its transmit buffers, and/or experiencing severe difficulties transmitting packets out onto the network. Packet loss and transmission delays cause end to end application performance degradation, as applications timeout and re-transmit data intermittently.	major	Lack of bandwidth on the port. transmit buffer sizes too small. network congestion causing excessive/late collisions and carrier sense errors.	use the Ticker tool to check the current outbound port utilization. If this is high, and a historical graph of port utilization reveals that, in general, the link is highly utilized, then more bandwidth may be needed.

WAN Port High Outbound Errors Cleared

Parent incident: WAN Port High Outbound Errors incident

Event ID: 31

Description	Default severity level	Typical causes	Actions
correlated clearing event for the WAN Port High Outbound Errors Event.	information	port error rate is now below the high threshold value.	none.

WAN Port High Outbound Utilization

Parent incident: WAN Port Outbound Utilization Abnormality incident

Event ID: 24

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) is experiencing high levels of outbound utilization (bandwidth usage). This may cause users who are communicating over this area of the network to experience slow application response times.	major	excessive application traffic. configuration changes.	if high port level utilization persists, then the link speed may need to be increased to accommodate the extra traffic levels.

WAN Port High Outbound Utilization Cleared

Parent incident: WAN Port Outbound Utilization Abnormality incident

Event ID: 25

Description	Default severity level	Typical causes	Actions
indicates the WAN port utilization is now below the high threhsold value.	information	reduced application traffic.	none.

WAN Port Low Inbound Utilization

Parent incident: WAN Port Low Inbound Utilization Cleared incident

Event ID: 22

scription	Default severity level	Typical causes	Actions
indicates that a WAN port (link) is experiencing low levels of inbound utilization (bandwidth usage).	major	route changes. outages upstream of the link. server problems.	problem may be symptomatic of an issue elsewhere in the network. If excessively low levels of utilization persist, check through other events that have recently been reported.

WAN Port Low Inbound Utilization Cleared

Parent incident: WAN Port Low Inbound Utilization Cleared incident

Event ID: 23

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) that was experiencing low levels of utilization is now receiving higher traffic volumes.	information	increased application traffic.	none.

WAN Port Low Outbound Utilization

Parent incident: WAN Port Outbound Utilization Abnormality incident

Event ID: 26

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) is experiencing low levels of outbound utilization (bandwidth usage).	major	route changes. outages upstream of the link. server problems.	problem may be symptomatic of an issue elsewhere in the network. If excessively low levels of utilization persist, check through other events that have recently been reported.

WAN Port Low Outbound Utilization Cleared

Parent incident: WAN Port Outbound Utilization Abnormality incident

Event ID: 27

Description	Default severity level	Typical causes	Actions
indicates that a WAN port (link) that was experiencing low levels of utilization is now transmitting higher traffic volumes.	information	increased application traffic.	none.

Wireless Controller High Number of Connected APs

Parent incident: Wireless Controller High Number of Connected APs incident

Event ID: 811

Description	Default severity level	Typical causes	Actions
indicates the number of connected access points is greater than the set threshold (which is by default 1,000).	major	changes in wireless usage have occurred since the network was designed.	investigate the attached AP history of the device.

Wireless Controller High Number of Connected APs Cleared

Parent incident: Wireless Controller High Number of Connected APs incident

Event ID: 810

Description	Default severity level	Typical causes	Actions
indicates the number of connected access points was greater than the set threshold (which is by default 1,000), but is now below that threshold.	information	number of APs attached to the Wireless Controller has returned to an acceptable level.	none.

Articles in this section

RESTful API:

Access Point Came Up

Access Point Went Down

ACI Cluster Event

ACI Cluster Fault

ACI Cluster Fault Cleared

ACI Event

ACI Fault

ACI Fault Cleared

Action Required: Upcoming Firewall Information Change

Air Marshal - Rogue AP Detected

AP Active Controller Change

AP Antenna Channel Change Frequency High

AP Antenna Channel Change Frequency High Cleared

AP Antenna Host Count High

AP Antenna Host Count High Cleared

AP Antenna Host Count Low

AP Antenna Host Count Low Cleared

AP Antenna Offline

AP Antenna Online

AP Antenna Power Change Frequency High

AP Antenna Power Change Frequency High Cleared

AP Associated With Controller

AP Association With Controllers Degraded

AP Host Count High

AP Host Count High Cleared

AP Host Count Low

AP Host Count Low Cleared

AP Not Associated With Controller

AP Reachable (ICMP)

AP Standby Controller Change

AP Unreachable (ICMP)

APIC Cluster ID Changed

ATM VCC High Inbound Utilization

ATM VCC High Inbound Utilization Cleared

ATM VCC High Outbound Utilization

ATM VCC High Outbound Utilization Cleared

ATM VCC Link Down

ATM VCC Link Up

ATM VCC Low Inbound Utilization

ATM VCC Low Inbound Utilization Cleared

ATM VCC Low Outbound Utilization

ATM VCC Low Outbound Utilization Cleared

AvailMonitor Application Available

AvailMonitor Application Unavailable

AvailMonitor Falling Average Latency

AvailMonitor High Latency

AvailMonitor High Latency (95th Percentile)

AvailMonitor High Latency Reaching Application

AvailMonitor High Latency Reaching Application Cleared

AvailMonitor Low View Device Reachability

AvailMonitor Normal Latency

AvailMonitor Normal Latency (95th Percentile)

AvailMonitor Normal View Device Reachability

AvailMonitor Rising Average Latency

AvailMonitor Rising Trend in Average Latency

AWAP Host Count High

AWAP Host Count High Cleared

AWAP Host Count Low

AWAP Host Count Low Cleared

Background Reachability Check Failed

Background Reachability Check Succeeded

Backplane Bus A High Utilization

Backplane Bus A High Utilization Cleared

Backplane Bus B High Utilization

Backplane Bus B High Utilization Cleared

Backplane Bus C High Utilization

Backplane Bus C High Utilization Cleared

Backplane System Bus High Utilization

Backplane System Bus High Utilization Cleared

Battery High Temperature

Battery High Temperature Cleared

Battery Low Reading

Battery Low Reading Cleared

Battery Low Voltage

Battery Low Voltage Cleared

BGP Peer Briefly Established

BGP Peer Briefly Not Established

BGP Peer Disappeared