How to configure abnormal on Omada Pro Controller

Contents

How to Customize Thresholds and Severity Levels for Abnormal Incidents on the Controller

How to Configure Notification on the Controller

How to Check the Overview of Abnormal Incidents on the Controller

How to Check the Root Causes of Abnormal Incidents and Maintenance Suggestions on the Controller

Conclusion

FAQ

Objective

This article primarily focuses on how to configure the Abnormal feature on the Omada Pro Controller to help users efficiently identify network issues, while offering a simple, intuitive, and reliable solution.

Requirements

Omada Pro Controller (Software Controller / Hardware Controller / Cloud-Based Controller, v1.0 and above)
Omada AP

Introduction

This feature is mainly used to identify abnormal issues in the network through an intelligent anomaly detection system, such as client disconnections and network outages, among 72 different types of abnormal incidents (the list may be subject to change in future iterations). It records issues or faults and locates their root causes, helping operational personnel to quickly detect and resolve problems. The intelligent anomaly detection system accurately describes each abnormal incident, including detailed records, queries, and root cause analysis. Ultimately, it presents the abnormal incidents’ details, root causes, and maintenance suggestions for users to efficiently identify network problems with a simple, intuitive, and reliable solution.

Detectable abnormal incidents are categorized as follows:

Function-related: Networking, Mesh, Access, Roaming, Network Service, Software/Configuration, Hardware, Security
Performance-related: Throughput, Coverage

Note: The Controller UI may vary due to different versions. The following configuration steps are based on Omada Pro Controller v1.9.20.7 and for reference only.

Configuration

How to Customize Thresholds and Severity Levels for Abnormal Incidents on the Controller

Step 1. Log in to the Controller via web browser and go to Site Settings > Abnormal > Settings. Here you can find the Edit button in the Action column.

Abnormal Page. Select settings to show all the Abnormal events list.

Choose one Abnormal event and click the Edit button.

Step 2. Click the Edit button and the Incident Definition window will pop up. Specify the threshold in the Trigger Event field and select the Level for incident severity. Click Confirm to save your configuration.

Trigger Event: Specify the threshold to trigger the event.
Level: Select the incident severity level: Critical, Error, Warning, Info

The Incident Definition shows up. There’s trigger event and level two parameters we can edit.

Set the trigger event as “Within 1 hour, the AP goes offline for 2 or more times”. Set the Level as Critical.

How to Configure Notification on the Controller

Step 1. Log in to the Controller via web browser and go to Site Settings > Abnormal > Notification. Here you can enable Alert Emails, after which the Controller will send emails to notify the administrators and viewers of the abnormal incidents.

Disable the Alert Email in Notification.

Step 2. After enabling Alert Emails, you can also enable Send similar alerts within xx seconds in one email and specify the time period, so that the incidents will be sent together in one email after the specified time period.

Enable the Alert Emails in Notification without checking Sending similar alerts within xx seconds in one email.

Step 3. Select the incident types to be sent in the Incident Object, Incident Category and Incident Level sections. Click Apply to save your settings.

Select Email Alerts type. There’re Incident Object, Incident Category, and Incident Level to choose.

How to Check the Overview of Abnormal Incidents on the Controller

Step 1. Log in to the Controller via web browser and go to Site Settings > Abnormal > Overview. On the top right corner, you can choose the time range you want to check: 1 hour, 24 hours, 7 days, and 30 days.

Abnormal windows. There’s a time range you can choose on the upper right corner of this window, including 1 hour, 24 hours, 7 days, and 30 days. The first module is Unresolved and Ongoing Network Incidents, there’s a pie chart showing the Level and a bar chart showing incident counts in this module. The second module is Incident Trend, there’s a line graph showing the Level and incident counts.

Step 2. After selecting the time range, you can view the changes in incidents on the four sections of the Overview page.

Unresolved and Ongoing Network Incidents: On the left provides a donut chart displaying the total number of unresolved incidents, along with the number and proportions of incidents corresponding to different severity levels. On the right features a bar chart that illustrates the distribution of various types of incidents and the number of incidents at different severity levels within each type.

On the left provides a donut chart displaying the total number of unresolved incidents, along with the number and proportions of incidents corresponding to different severity levels. On the right features a bar chart that illustrates the distribution of various types of incidents and the number of incidents at different severity levels within each type.

Note: You can choose whether to display the corresponding severity levels by clicking them on the upper right corner of the section. For example, if Critical is unchecked, there will be no records of Critical-level incidents shown in the chart.

Incident Trend: This section demonstrates the trend of abnormal incidents in the form of a curve chart, showing the number of new abnormal incidents at each time point. Similarly, you can choose whether to display the corresponding severity levels by clicking them on the upper right corner of the section.

The Incident trend demonstrates the trend of abnormal incidents in the form of a curve chart, showing the number of new abnormal incidents at each time point. Similarly, you can choose whether to display the corresponding severity levels by clicking them on the upper right corner of the section.

Devices with Most Incidents: This section lists devices with most incidents.

Device detail shows the device with the most incidents.

Clients with Most Incidents: This section lists clients with most incidents.

Device detail shows the clients with the most incidents, including the client name(MAC address as default).

How to Check the Root Causes of Abnormal Incidents and Maintenance Suggestions on the Controller

Step 1. Log in to the Controller via web browser and go to Site Settings > Abnormal > Incident. Here lists key information of all abnormal incidents detected, including the category, content, device of the incident, number of occurrences, last occurrence time, and status.

Incident shows the abnormal incidents triggered with the column including the category, content, device of the incident, number of occurrences, last occurrence time, and status.

You can modify the incident status to Solve or Ignore, or delete the record in the Action column.

The left button is Solve, and the medium button is Ignore.

You can search incidents based on their content, device name, IP address, and MAC address in the search bar.

the search bar.

You can filter incidents based on their severity level, category, and status.

The filter incidents based on their severity level, category, and status.

Ongoing: Continuously occurring incidents detected by the Controller. When the Controller detects that such an incident ends, it will set the incident to Resolved.
Unresolved: Non-persistent incidents detected by the Controller.
Resolved: Incidents that have been resolved.
Ignored: Incidents that have been ignored.

Step 2. Click an incident entry and the Incident Detail page will pop up on the right.

Incidents properties window including Incident Detail, Incident Time, and Possible Cause (optional).

Incident Detail: Here presents an overview of the incident category, content, and start time.
Incident Time and Possible Cause: Here records the detailed time and possible cause of each incident. You can modify the incident status singly or in batches in this page.

Step 3. Click Detail in the Incident Time and Possible Cause section for more details of the incident, including the incident description, inferred cause, and maintenance suggestions. Click the dropdown icon on the right to view maintenance suggestions. The content of abnormal incident and root cause can be displayed in various forms. The following figures showcase some examples of description in text:

Possible Cause and Detail.

Possible Cause can unfold to see detail.

Possible detail No.1 shows up after unfolding the Possible Cause.

Possible detail No.2 shows up after unfolding the Possible Cause.

Other forms to display the content of abnormal incidents and root causes can be the following:

Curves: Displaying variations in parameters such as CPU, memory, RSSI, etc.
Timeline: Displaying information based on a timeline, such as the client’s online/offline status, or the port’s UP/DOWN status on a timeline.
List: Displaying a list of clients connected to a specific AP, their authentication time and number of connection failures, etc.
Bar Chart: Displaying the distribution of the number of clients connected to a specific AP at various signal strengths.
Protocol Replay: Listing the execution results of each authentication process when a client fails to pass authentication.
PoE Status: Displaying PoE-related information such as the PoE power of each port of the switch and total PoE power usage.
For Ongoing Incidents, the Detail page also displays the duration of the incident and the most recent data from the last cycle.

Forms to display the content of abnormal incidents and root causes.

Conclusion

With the steps above, you can successfully configure the Abnormal feature on the Omada Pro Controller.

FAQ

1. How can I restore the default configuration after customizing the settings?

Re: You can click the Reset button to restore the default configuration. Remember to click Confirm to save the configuration.

2. Why do I receive alert emails before the specified time period?

Re: When the number of incidents reaches 100, alert emails will be sent immediately even before the time period you set.

Get to know more details of each function and configuration please go to Download Center to download the manual of your product.

ผลิตภัณฑ์ที่เราแนะนำ