Retrieve "Alert Central" information from CUCM/CUC/etc

[cdnadmin]

This document was generated from CDN thread

Created by: ERIK TAMMINGA on 18-06-2013 04:46:50 AM
Hi,
Is there an API available to retrieve the data seen in RTMT "Alert Central"?
Regards,
Erik

Subject: RE: Retrieve "Alert Central" information from CUCM/CUC/etc
Replied by: David Staudt on 19-06-2013 02:48:07 PM
I believe the messages are from the system 'syslog'.  It is possible to configure an app server as a remote syslog recipient (Serviceability/Alarms.)  Syslog events are also accessible via SNMP trap.

Subject: RE: Retrieve "Alert Central" information from CUCM/CUC/etc
Replied by: David Staudt on 19-06-2013 03:19:04 PM
Sounds like you've done your research...about all I can do is confirm there is no formal API for retrieving the alerts like you describe.  If you can pull the data by retrieving particular log files, that's probably your best bet, but of course susceptible to backward compatibility problems if the log format/filename changes in future...

Subject: RE: Retrieve "Alert Central" information from CUCM/CUC/etc
Replied by: ERIK TAMMINGA on 19-06-2013 03:11:35 PM
Hi,

Yes I know this information is based on Syslog (or generates Syslog) messages.
RTMT is able to retrieve this information instantly, so there should be a list of actual Alarm Central states somewhere.
I'm optimizing our monitoring tools to also include this RTMT Alarm Central alarms list. The Cisco applications already have the knowledge on how to interpret the syslog messages so I'd rather use this list from RTMT. The only thing is that I cannot find out how RTMT retrieves the list. I have found the .csv log files that contain the "active" alarms and I can build history from this, but I guess there should be a faster way around to retrieve the information besides retrieving the .csv log files and parsing them.

So, my question still stands ;)

Regards/Thanks,
Erik

[douglasfir]

Hi Erik,

Were you able perhaps to find the solution to extract this information that looks like Alert Central in RTMT? I was also struggling to solve this but still without success.

Thanks! Dragan

[Alexey Smirnov]

Hello Dragan

I wrote a post about retrieving alarms from CUCM Collecting alarms from CUCM – Cisco Collaboration tips and tricks

But it looks like that 10.5.2 version has a bug which doesn't allow to get certain files with API.

[douglasfir]

Hi Alexey,

Thanks a lot! I will try to call this from Java, based on the great example that you sent!

Regards, Dragan

[douglasfir]

Hi Alexey,

I've implemented code in Java for Android based on your article, which helped me a lot! However, this method requires  that I download the whole CSV file per every poll, if I am right...I guess that RTMT uses some different method to achieve this, because the alarms come up almost instantly. Did you try to use SFTP method perhaps (where your machine acts as SFTP server)? I found some description about this here (also mentioned in your article ):

Cisco DevNet: sxml - API Reference - Log Collection (LogCollection, DimeGetFile)

Thanks again!

Dragan

[Alexey Smirnov]

Hello Dragan,

I haven't tried the one with SFTP - it will just upload the same CVS file to a remote server for you to parse. So I don't think it will speed up things. I think that RTMT use some proprietary mechanism to retrieve alerts. I wish I had CUCM  tomcat private key to decode tls session between RTMT and CUCM.

[dstaudt]

I think typically the UCM's remote syslog capability is intended for real time alerting, though that implies an on-premise service to receive the syslog messages, then parse and forward to an Android app...

[douglasfir]

Hi Aleksey, you are right about that. I tried to sniff traffic between CUCM and RTMT and its all going via 8443, to it's impossible to see what's inside. Perhaps are those some SQL queries into CUCM database itself, what do you think? There is an interface for executing SQL queries via Serviceability XML.

[caten]

I'm not sure if this is what you are looking for, but you might be able to make use of the RTMT-servlet tester for this.

Navigate to https://X.X.X.X/ast/AstIsapi.dll?GetAlertSummaryList and check out what is there. I believe it will tell you if an alarm is triggered or not and the time at which it triggered. As far as further details, unfortunatly you are SOL.

[douglasfir]

Hi Cole,

thanks a lot! This is really great and useful! The rest of the information I pull out from CVS file via SFTP - not the most optimal solution, but it works

Regards, Dragan