Skip to main content
NetApp Knowledge Base

FAQ: Active IQ Unified Manager Event Management

Views:
316
Visibility:
Public
Votes:
0
Category:
active-iq-unified-manager
Specialty:
om
Last Updated:

Applies to

Active IQ Unified Manager (AIQUM)

Frequently Asked Questions

General
What are the different types of events in AIQUM?
  1. Built-in events

  • Predefined events for different object types (Aggregate, Cluster, Node, Volumes, etc.)
  • Two types of built-in events
    • Health Events
      • Automatic notifications triggered by predefined conditions or when an object's health reaches a threshold
      • They help prevent performance issues and system unavailability. Events are classified by impact area (availability, capacity, configuration, or protection) and assigned a severity and impact level to determine the urgency of action needed
    • Performance Events
      • Incidents related to workload performance on a cluster and can help identify workloads with slow response times
  • Unified Manager treats repeated occurrences of the same event as a single event
  • A full list can be found here
  1. Active IQ Portal Events
  • Events that are discovered by Unified Manager through Active IQ
  • Created by applying rules to AutoSupport messages from monitored storage systems
  • Unified Manager automatically checks and downloads new rules for clusters after midnight
    • For sites with no external network access, upload rules manually from Storage Management > Event Setup > Upload Rules
  • These events usually pertain to cluster risks and may offer fix options or suggested actions
  • Event details include the rule ID being checked
  • Click here for more information
  1. EMS Based Events
  • Administrators can use EMS subscription to monitor storage events not included in the built-in events
    • Unified Manager has hundreds of built-in events, whereas ONTAP has several thousand EMS events
  • EMS subscription allows configuration of Unified Manager to receive specific EMS events from clusters in real-time
  • Unified Manager polls on 15-minute intervals which may cause a delay in processing built-in events
  • EMS events are broken up into two categories
    • Automatically Subscribed Events
      • Automatically enabled when a cluster is added to Unified Manager
      • The cluster notifies Active IQ Unified Manager about these events through REST notifications over port 9443
      • The events appear in the format "<Severity> EMS Received," and more details can be viewed by drilling down into the event details
      • See all automatically subscribed events
      Manually Subscribed Events

What are the different types of events in Active IQ Unified Manager?

What happens when an event is generated?

When Unified Manager generates an event, it is displayed in the Dashboard page, in the Event Management inventory page, in the Summary and Explorer tabs of the Cluster/Performance page, and in the object-specific inventory page (for example, the Volumes/Health inventory page).

When Unified Manager detects multiple continuous occurrences of the same event condition for the same cluster component, it treats all occurrences as a single event, not as separate events. The duration of the event is incremented to indicate that the event is still active.

Depending on how you configure settings in the Alert Setup page, you can notify other users about these events. The alert causes the following actions to be initiated:

  • An email about the event can be sent to all Unified Manager Administrator users.
  • The event can be sent to additional email recipients.
  • An SNMP trap can be sent to the trap receiver.
  • A custom script can be executed to perform an action.

What happens when an event is generated in AIQUM?

How do I verify the event conditions match the alerts?

If the incorrect or no alert is listed, review the desired alert to verify the conditions match the event.

  1. Check the alert's Resources section to ensure either the <<All {TYPE}>> option or the option with the specific source name is listed in the Selected Resources
    • Adding only All Clusters to the resource section will only alert on events where the cluster is the source of the event. This will not alert on events for other objects such as node, SVM, volume, aggregate, etc.. 
  2.  Review the Exclude tab to ensure no exclusion matches the source name in question. Use the inventory grid view landing page for the object to verify exclusions
  3. In the Events section, confirm that either the specific event type or the All <EVENT_SEVERITY> Events option is present
  4. For EMS subscriptions, select the cluster name or <<All Clusters>> option, along with the appropriate <EMS_SEVERITY> EMS received event type
  5. Review the Related Alerts section when navigating to the page for the Cluster, Volume, SVM, Aggregate, etc.. and confirm that expected alert is present.

How to verify event condition match alerts in AIQUM

How do I get event thresholds via API?

The API call is sent via option.rpc and the required information is available via the um cli option command

  1. Run the commands

um cli login

um option list

  1. Open the cli.log
  2. Copy the below API call

https://<AIQUM_IP>:443/api/management-server/admin/cli/options/

  1. Use the API call to get the necessary information in JSON format

How to get event thresholds from AIQUM via API

Filtering
What is the default filter for Event Management in AIQUM?
  • The default view in Event Management is 'All active events'
    • This will show events with the following filters set
    • Events may not show up in this default view if they don't match this criteria
      • It may be necessary to modify or clear the filters or use the other views to find a particular event.
    • Navigating away from this page and back will reset the view

What is the default filter for Event Management in AIQUM?

How do I clear filters in AIQUM event management?
  1. Browse to the Event Management page in AIQUM
  2. Click on Filter
  3. Click on Reset
    • You can also click on the trash can icon to remove individual filters
  4. Click on Apply Filter (Not applicable if you click on reset)

How to clear filters in Event Management

How do I change filters in AIQUM event management?
  1. Click on Filter
  2. Edit the existing filters (Impact Level, State, Triggered Time) or click on the trash can to remove them
  3. Add other filters as desired
  4. If you want to save the view, specify a name for the view and click save

How to change filters in Event Management

How do I filter based on event severity?
  1. Navigate to the Event Management page
  2. Click on Filter
  3. Edit the existing filters (Impact Level, State, Triggered Time) or click on the trash can to remove them
  4. Click on Add Filter
  5. Select Severity dropdown and set the desired severities
  6. Add/Edit other filters as necessary and click on Apply Filter
  7. If you want to save the view, specify a name for the view and click save

How to filter based on event severity in AIQUM

How do I filter based on event name?
  1. Navigate to Event Management page.
  2. Click on Filter
  3. Click on Add filter
  4. Click on the Name dropdown
  5. Select the desired operation from the middle drop down
  6. Enter the event name or pattern match in the 3rd column
  7. Add/Edit other filters as necessary and click on Apply Filter
  8. If you want to save the view, specify a name for the view and click Save.

How to filter based on event name in AIQUM

Disabling events
How do I disable events?
  1. ​​​​​Identify the event severity that needs to be disabled:
  2. Edit the events
    • For 9.7  and newer - Click Settings > Storage Management > Event Setup
    • For pre-9.7  releases - Select Administration > Manage Events
  3.  In the Manage Events/Event Setup page, click Disable
  4. Select the severity of the event that needs to be disabled
  5. In the Matching Events column, click the event name that needs to be disabled
  6. Click on the second arrow to move a single event to the right column
  7. Click Save and Close

**Warning: This change is global and will disable all events of that type for all clusters.**

How to disable events within Active IQ Unified Manager

How do I disable Platform Events?
  1. In the left navigation pane, click General > Feature Settings
  2. In the Feature Settings page, disable Active IQ platform events in the Active IQ Portal Events panel by moving the slider button to the left
  3. Confirm your changes
  4. Acknowledge and resolve any related event(s) previously created

How to disable Platform Events in AIQUM?

How do I prevent "Port Status Down" events for unconnected/unused ports?
Using System Manager
For Ethernet Ports
  1. Navigate to Network | Ethernet ports.
  2. Expand the section for the node indicating an unused port (will show as a red icon).
  3. Under the port slide the Enable/Disable option to the left.
  4. The port icon will now show as black.
For FC Ports (Requires ONTAP 9.9.1 or Later)
  1. Navigate to Network | FC ports.
  2. Expand the section for the node indicating an unused port (will show as a red icon).
  3. Under the port slide the Enable/Disable option to the left.
  4. The port icon will now show as black.
Using ONTAP CLI
For Ethernet Ports
  1. Enable advanced mode on ONTAP CLI

set advanced

  1. Confirm the current "up-admin" property for the port

network port show -node -port -fields link, up-admin

Example: Cluster::*> network port show -node Node-01 -port e0b -fields link, up-admin

node port link up-admin

-------- ---- ---- --------

Node-01 e0b down true

  1. Change "up-admin" to false for the port.

network port modify -node -port -up-admin false

  1. Confirm the port is administratively disabled.

network port show -node -port -fields link, up-admin

  1. To use/connect the port in the future, it can be re-enabled by setting -up-admin true

network port modify -node -port -up-admin true

For FC Ports
  1. Excute command to observe the ports admin status was up operational status as link disconnected

::> fcp adapter show

  1. Excute command to observe the ports admin status was down and operational status as off-line by user/system

::*> net fcp adapter modify - node <nodename> -adapter <portname> admin down

  1. Excute command to observe the ports admin status was up and operational status as Link not connected.

::*> net fcp adapter modify - node <nodename> -adapter <portname> admin up

  1. After this action plan cross-verify the port status in AQIUM and it has to be in UP state

How to prevent UM from reporting Port Status Down event

How can I stop AIQUM from receiving EMS events?
  • Remove the subscribed event from Unified Manager
    • This action will remove the event subscription from all clusters Unified Manager is monitoring

How to stop AIQUM from receiving EMS events

How do I prevent Obsolete/Resolved events?
Active IQ Unified Manager 9.7 and newer
  1. From the UM interface, navigate to Storage Management->Alert Setup
  2. Disable the option Alerts for Resolved and Obsolete Events in the top right

Active IQ Unified Manager (AIQUM)

 

Active Unified Manager 9.6
  1. From the UM interface, navigate to Configuration > Alerting
  2. Disable the option Alerts for Resolved and Obsolete Events in the top right 

Alerts for Resolved and Obsolete Events

Unified Manager 9.5 and earlier

Log into the CLI as the diag user

Warning:

  • Changes made within the DIAG shell can result in data loss and/or loss of functionality within the Virtual appliance
  • It is recommended to take a database backup and virtual machine snapshot prior to entering DIAG shell

Run the below commands (case sensitive)

dfm cli login -u <maintenance_user> -p <password>
​dfm option set terminalEventState.alertEnabled=false

How to stop alerts related to Obsolete/Resolved events

Additional Information

N/A

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.