Configuring Logging Correlation Rules; Internal Rules - Cisco ASR 9000 Serie Configuration Manuals

Implementing and Monitoring Alarms and Alarm Log Correlation

Internal Rules

Internal rules are defined on Cisco IOS XR Software and are used by protocols and processes within
Cisco IOS XR Software. These rules are not customer configurable, but you may view them by using the
show logging correlator rule command. All internal rule names are prefixed with [INTERNAL].
SNMP Alarm Correlation
In large-scale systems, such as Cisco IOS XR multi-chassis system , there may be situations when you encounter
many SNMP traps emitted at regular intervals of time. These traps, in turn, cause additional time in the Cisco
IOS XR processing of traps.
The additional traps can also slow down troubleshooting and increases workload for the monitoring systems
and the operators. So, this feature addresses these issues.
The objective of this SNMP alarm correlation feature is to:
• Extract the generic pieces of correlation functionality from the existing syslog correlator
• Create DLLs and APIs suitable for reusing the functionality in other components
• Integrate the SNMP agent with the DLLs to enable SNMP trap correlation
How to Implement and Monitor Alarm Management and Logging
Correlation

Configuring Logging Correlation Rules

This task explains how to configure logging correlation rules.
The purpose of configuring logging correlation rules is to define the root cause and non-root-cause alarm
messages (with message category, group, and code combinations) for logging correlation. The originating
root-cause alarm message is forwarded to the syslog process, and all subsequent (non-root-cause) alarm
messages are sent to the logging correlation buffer.
The fields inside a message that can be used for configuring correlation rules are as follows:
• Message category (for example, PKT_INFRA, MGBL, OS)
• Message group (for example, LINK, LINEPROTO, or OIR)
• Message code (for example, UPDOWN or GO_ACTIVE).
The logging correlator mechanism, running on the active route processor, begins queueing messages matching
the ones specified in the correlation rules for the time specified in the timeout interval of the correlation rule.
The timeout interval begins when the correlator captures any alarm message specified for a given rule.
Cisco ASR 9000 Series Aggregation Services Router System Monitoring Configuration Guide, Release 4.2.x
Internal Rules
9