Default precedence values
By convention the Event Gateway assigns predefined threshold values that have special significance in the RCA plugin-in.
You can specify your own precedence values when configuring the Event Gateway.
You should specify a higher precedence value
for events that meet either of the following conditions:
- Events on entities that are lower down the protocol stack. For example, confirmation that a physical port has failed would be higher precedence than an IP layer problem on that interface.
- Events that are a more certain indication of a problem. For example, contrast these two events: a ping fail event and a link down event. The less certain event is the ping fail. This might be because the ICMP packet could not reach the interface. That, in turn, could be due to a network problem between the polling station and the interface. The more certain event is an SNMP trap that explicitly states that a link has gone down because this is a more positive confirmation of a problem on the interface itself, or on its directly connected neighbour.
The following table lists the precedence values that the
Event Gateway assigns by default.
| Value | Meaning | Example events |
|---|---|---|
| 0 | Assigned to events that cannot cause other issues. During RCA, the event cannot suppress other events, but it can itself be suppressed. | SYSLOG-cisco-ios-SYS-CPUHOG SYSLOG-cisco-ios-BGP-NOTIFICATION |
| 300 | Reserved for non-authoritative events which suggest, but do not necessarily indicate, a failure on the device. For example, failure to reach a device does not necessarily indicate a problem on that device; this failure could be caused by a problem between the polling station and the device. | probeping-icmptimeout SNMPTRAP-IETF-OSPF-TRAP-MIB-ospfIfStateChange |
| 600 | Intended for protocol failures. Failures identified lower down the protocol stack should take higher precedence. For example, as OSPF runs over IP, an OSPF failure would be expected to have a lower precedence than an IP failure. | SNMPTRAP-IETF-OSPF-TRAP-MIB-ospfIfConfigError |
| 900 | Assigned to confirmed physical failures that indirectly imply a Link Down or Ping Fail (and most other events). | SNMPTRAP-cisco-CISCO-WIRELESS-IF-MIB-cwrTrapLinkQuality |
| 910 | Assigned to confirmed physical failures that directly indicate a Link Down or Ping Fail. | SNMPTRAP-linkDown SYSLOG-smc-switch-linkDown |
| 10 000 | Assigned to events that cannot be caused by other issues. During RCA, the event cannot be suppressed by other events, but it can become root-cause, suppressing other events. | SYSLOG-cisco-ios-CI-SHUTDOWN SNMPTRAP-riverstone-RIVERSTONE-NOTIFICATIONS-MIB-rsEnvirHotSwapOut |