FAQ: Active IQ Unified Manager Event Management

1. Built-in events

• Predefined events for different object types (Aggregate, Cluster, Node, Volumes, etc.)
• Two types of built-in events
  • Health Events
    • Automatic notifications triggered by predefined conditions or when an object's health reaches a threshold
    • They help prevent performance issues and system unavailability. Events are classified by impact area (availability, capacity, configuration, or protection) and assigned a severity and impact level to determine the urgency of action needed
  • Performance Events
    • Incidents related to workload performance on a cluster and can help identify workloads with slow response times
• Unified Manager treats repeated occurrences of the same event as a single event
• A full list can be found here

2. Active IQ Portal Events

• Events that are discovered by Unified Manager through Active IQ
• Created by applying rules to AutoSupport messages from monitored storage systems
• Unified Manager automatically checks and downloads new rules for clusters after midnight
  • For sites with no external network access, upload rules manually from Storage Management > Event Setup > Upload Rules
• These events usually pertain to cluster risks and may offer fix options or suggested actions
• Event details include the rule ID being checked
• Click here for more information

3. EMS Based Events

• Administrators can use EMS subscription to monitor storage events not included in the built-in events
  • Unified Manager has hundreds of built-in events, whereas ONTAP has several thousand EMS events
• EMS subscription allows configuration of Unified Manager to receive specific EMS events from clusters in real-time
• Unified Manager polls on 15-minute intervals which may cause a delay in processing built-in events
• EMS events are broken up into two categories
  • Automatically Subscribed Events
    • Automatically enabled when a cluster is added to Unified Manager
    • The cluster notifies Active IQ Unified Manager about these events through REST notifications over port 9443
    • The events appear in the format "<Severity> EMS Received," and more details can be viewed by drilling down into the event details
    • See all automatically subscribed events
    Manually Subscribed Events
    • Events that storage administrators may want to set up alerts for, but they are not part of the built-in or automatically subscribed events
    • The cluster notifies Unified Manager about these events through Syslog over UDP port 514.
    • The events appear in the format "<Severity> EMS Received," and more details can be viewed by drilling down into the event details
    • How to configure and receive alerts from ONTAP EMS Event Subscription in Active IQ Unified Manager

When Unified Manager generates an event, it is displayed in the Dashboard page, in the Event Management inventory page, in the Summary and Explorer tabs of the Cluster/Performance page, and in the object-specific inventory page (for example, the Volumes/Health inventory page).

When Unified Manager detects multiple continuous occurrences of the same event condition for the same cluster component, it treats all occurrences as a single event, not as separate events. The duration of the event is incremented to indicate that the event is still active.

Depending on how you configure settings in the Alert Setup page, you can notify other users about these events. The alert causes the following actions to be initiated:

• An email about the event can be sent to all Unified Manager Administrator users.
• The event can be sent to additional email recipients.
• An SNMP trap can be sent to the trap receiver.
• A custom script can be executed to perform an action.

If the incorrect or no alert is listed, review the desired alert to verify the conditions match the event.

1. Check the alert's Resources section to ensure either the <<All {TYPE}>> option or the option with the specific source name is listed in the Selected Resources
   • Adding only All Clusters to the resource section will only alert on events where the cluster is the source of the event. This will not alert on events for other objects such as node, SVM, volume, aggregate, etc.. 
2.  Review the Exclude tab to ensure no exclusion matches the source name in question. Use the inventory grid view landing page for the object to verify exclusions
3. In the Events section, confirm that either the specific event type or the All <EVENT_SEVERITY> Events option is present
4. For EMS subscriptions, select the cluster name or <<All Clusters>> option, along with the appropriate <EMS_SEVERITY> EMS received event type
5. Review the Related Alerts section when navigating to the page for the Cluster, Volume, SVM, Aggregate, etc.. and confirm that expected alert is present.

The API call is sent via option.rpc and the required information is available via the um cli option command

1. Run the commands

um cli login

um option list

2. Open the cli.log
3. Copy the below API call

https://<AIQUM_IP>:443/api/management-server/admin/cli/options/

4. Use the API call to get the necessary information in JSON format

• The default view in Event Management is 'All active events'
  • This will show events with the following filters set
    • Impact Level: Incident or Risk
      • Event impact levels
    • State: New or Acknowledge
      • Event state definitions
    • Triggered in the last 7 days
  • Events may not show up in this default view if they don't match this criteria
    • It may be necessary to modify or clear the filters or use the other views to find a particular event.
  • Navigating away from this page and back will reset the view

1. Browse to the Event Management page in AIQUM
2. Click on Filter
3. Click on Reset
   • You can also click on the trash can icon to remove individual filters
4. Click on Apply Filter (Not applicable if you click on reset)

1. Click on Filter
2. Edit the existing filters (Impact Level, State, Triggered Time) or click on the trash can to remove them
3. Add other filters as desired
4. If you want to save the view, specify a name for the view and click save

1. Navigate to the Event Management page
2. Click on Filter
3. Edit the existing filters (Impact Level, State, Triggered Time) or click on the trash can to remove them
4. Click on Add Filter
5. Select Severity dropdown and set the desired severities
6. Add/Edit other filters as necessary and click on Apply Filter
7. If you want to save the view, specify a name for the view and click save

1. Navigate to Event Management page.
2. Click on Filter
3. Click on Add filter
4. Click on the Name dropdown
5. Select the desired operation from the middle drop down
6. Enter the event name or pattern match in the 3rd column
7. Add/Edit other filters as necessary and click on Apply Filter
8. If you want to save the view, specify a name for the view and click Save.

1. ​​​​​Identify the event severity that needs to be disabled:
2. Edit the events
   • For 9.7  and newer - Click Settings > Storage Management > Event Setup
   • For pre-9.7  releases - Select Administration > Manage Events
3.  In the Manage Events/Event Setup page, click Disable
4. Select the severity of the event that needs to be disabled
5. In the Matching Events column, click the event name that needs to be disabled
6. Click on the second arrow to move a single event to the right column
7. Click Save and Close

**Warning: This change is global and will disable all events of that type for all clusters.**

1. In the left navigation pane, click General > Feature Settings
2. In the Feature Settings page, disable Active IQ platform events in the Active IQ Portal Events panel by moving the slider button to the left
3. Confirm your changes
4. Acknowledge and resolve any related event(s) previously created

• Remove the subscribed event from Unified Manager
  • This action will remove the event subscription from all clusters Unified Manager is monitoring