Default precedence values

By convention the Event Gateway assigns predefined threshold values that have special significance in the RCA plugin-in.

You can specify your own precedence values when configuring the Event Gateway.

You should specify a higher precedence value for events that meet either of the following conditions:
  • Events on entities that are lower down the protocol stack. For example, confirmation that a physical port has failed would be higher precedence than an IP layer problem on that interface.
  • Events that are a more certain indication of a problem. For example, contrast these two events: a ping fail event and a link down event. The less certain event is the ping fail. This might be because the ICMP packet could not reach the interface. That, in turn, could be due to a network problem between the polling station and the interface. The more certain event is an SNMP trap that explicitly states that a link has gone down because this is a more positive confirmation of a problem on the interface itself, or on its directly connected neighbour.
The following table lists the precedence values that the Event Gateway assigns by default.
Table 1. Default precedence values
Value Meaning Example events
0 Assigned to events that cannot cause other issues. During RCA, the event cannot suppress other events, but it can itself be suppressed. SYSLOG-cisco-ios-SYS-CPUHOG

SYSLOG-cisco-ios-BGP-NOTIFICATION

300 Reserved for non-authoritative events which suggest, but do not necessarily indicate, a failure on the device. For example, failure to reach a device does not necessarily indicate a problem on that device; this failure could be caused by a problem between the polling station and the device. probeping-icmptimeout

SNMPTRAP-IETF-OSPF-TRAP-MIB-ospfIfStateChange

600 Intended for protocol failures. Failures identified lower down the protocol stack should take higher precedence. For example, as OSPF runs over IP, an OSPF failure would be expected to have a lower precedence than an IP failure. SNMPTRAP-IETF-OSPF-TRAP-MIB-ospfIfConfigError
900 Assigned to confirmed physical failures that indirectly imply a Link Down or Ping Fail (and most other events). SNMPTRAP-cisco-CISCO-WIRELESS-IF-MIB-cwrTrapLinkQuality
910 Assigned to confirmed physical failures that directly indicate a Link Down or Ping Fail. SNMPTRAP-linkDown

SYSLOG-smc-switch-linkDown

10 000 Assigned to events that cannot be caused by other issues. During RCA, the event cannot be suppressed by other events, but it can become root-cause, suppressing other events. SYSLOG-cisco-ios-CI-SHUTDOWN

SNMPTRAP-riverstone-RIVERSTONE-NOTIFICATIONS-MIB-rsEnvirHotSwapOut