Chapter 26: Root Cause - Tavve zoneranger User Manual

Chapter 26: Root Cause

Though the use of a sophisticated root cause analysis service, ZoneRanger will automatically determine
the root cause of a device outage. Depending on the network topology, a problem with one device, such
as a router or switch, can affect status polling results for multiple devices. To address this problem, when
ZoneRanger is triggered by status polling failures as described in Chapter 24, the root cause service
determines which device is the root cause of the problem, and which devices are impacted by the root
cause device.
The root cause service divides root cause analysis into two categories: IP (related to interface status
polling failures) and TCP (related to TCP status polling failures). The Configuration > Root Cause
page IP tab is used to configure the reporting of IP root causes and the Configuration > Root Cause
page TCP tab is used to configure reporting TCP root causes.
After the polling service determines an IP interface has failed a status poll, the root cause service will
enter a verification period to determine if the IP interface is no longer replying or if it was a transitory
outage. The verification time period is configured on the Configuration > Root Cause page IP tab
from the Advanced button. The default is to verify an outage using four ICMP requests over a two
minute period.
Once the device is verified to have failed, a tscZRVerifyDown SNMP trap is generated. Then once the
root cause is determined, the tscZRSourceDown SNMP trap is generated indicating the root cause of the
outage. Using the Configuration > Root Cause page IP tab, ZoneRanger can be configured to send an
email indicating the root cause either through a joined Ranger Gateway or directly from the
ZoneRanger.
If the polling service determines additional IP devices fail to respond, whose outage was caused by a
root cause device, a tscZRInferredDown SNMP trap will be generated indicating this device is impacted
by a root cause outage. The list of current root causes can be displayed using the View > Root Causes
page on the ZoneRanger.
When a root cause device is successfully polled by the polling service, the root cause service verifies the
device is responding and generates a tscZRVerifyUp SNMP trap. A tscZRSourceUp SNMP trap and
optional email, if configured, are then generated indicating the root cause outage has been restored.
The root cause service describes root causes outages in terms of entities which are IP, TCP, or cloud.
The IP entity refers to an IP address. The TCP entity refers to a TCP port. The cloud entity refers to an
area of the network which the ZoneRanger could not determine any specific IP addressable information.
One example of a cloud is a dumb network hub.
ZoneRanger 5.5 User's Guide 79