Creating Custom Alerts in RTMT

William Bell
Vice President, Solutions and Products

Real Time Monitoring Tool (RTMT)

The RTMT tool is provided by Cisco with all Cisco Unified Communications Manager (CUCM) and Cisco Unified Presence Server (CUPS) systems.  Using RTMT an administrator can get a good idea of the general health of a system.  RTMT has come a long way since it was first introduced in Call Manager 3.1.

There are various tools in RTMT worth looking into, today I am focusing on using the Alert Central tool.  Specifically, creating custom alerts.


RTMT can be configured to monitor basic thresholds and then trigger an alert when a specific threshold is violated.  There are essentially three parts to an alert:

  1. The element being monitored
  2. The threshold monitored
  3. The alert action

RTMT comes with a set of “canned” alerts.  You can view these alerts when launching RTMT and going to System>Tools>Alerts>Alert Central

Canned alerts are found under the “System” and “CallManager” tabs.  You will notice that there is also a “Custom” tab.  One would be inclined to think that you could browse to this tab and use some context based menu to add a custom alert.  One would be wrong.

Adding a Custom Alert

To add a custom alert, you must use the Performance viewer.

  1. Go to System>Performance>Open Performance Monitoring
  2. Under the “StandAloneCluster” context, choose a node you are interested in monitoring
  3. Expand the node to expose the counter classes and choose a class (e.g. Cisco MGCP Gateways)
  4. Choose a counter object (e.g. PRIChannelsIsActive)
  5. Some counter objects have “instances”.  For example, on Cisco MGCP Gateway classes, there can be zero or more registered gateways.  Each gateway will spawn a single instance.
  6. Add your instance and/or counter to the monitoring display by double clicking, right clicking and choosing “Add” from the context menu, or “drag and drop”
  7. Right click on the new counter in the monitoring window and choose ” Set Alert Properties”
  8. Provide a description and click Next

  9. Specify the threshold, calculation method and duration of the alert and click Next

  10. Set Frequency and Schedule parameters and click Next

  11. Specify if you want to generate an E-mail alert (otherwise, the alert is only on screen), configure a custom E-mail message, and choose the appropriate alert action.  Once configured, click Save.

Once you save the alert, you can now view it under the Custom tab in Alert Central.  From here you can enable, disable, or delete the new alert.

While RTMT isn’t a replacement for a well designed and implement voice management solution, it can augment an existing solution or be used to catch things an existing solution may miss.  Of course, reality sometimes dictates a gap between actual deployment time of the CUCM system and  the actual deployment time of a voice aware management solution. RTMT is a decent option for filling this gap.

13 responses to “Creating Custom Alerts in RTMT

  1. I don’t have the means to test this myself, so can you tell me: where is the alert saved and ran from? e.g., is it save locally on my pc and ran from my pc? if that is true, then my pc would have to be online for the alert to work, correct? if it’s somehow stored on cucm, then my pc can be offline, and the alerts will still work, correct?

  2. Anthony,

    I believe alerts are managed from the server. IOW, the RTMT client does not need to be running for alerts to function. I haven’t tested this with custom alerts. Note that performance monitoring updates (such as those available via Serviceability Reporting) are also ran on the server in the background.



  3. Hello Bill / Gareth

    I’m experiencing the same issue as Gareth, I"m trying to setup the exact same counter and it never triggers even when I exceed the configured threshold. I’m using RTMT ver 8.5(014) for CUCM version 8.0.3-2000.


  4. Hi,

    Very very good collection
    Only I face this error when trying to press PRI channels Active : [No Instances] No Cisco MGCP Gateways instances available

    Although I gave an MGCP registered to CUCM

    Do I need to do anything so RTMT sense this mgcp gw ?

    Thank you very much

  5. Paul,

    That sounds like you may be trying to add a counter using a CUCM node that doesn’t have any MGCP GW registrations. For example, you may see this type of error message when adding a counter on the publisher node when it is not used for device registrations.



  6. Hi Bill,

    Thank you very much for this information. Can you (or anyone else that would like to contribute) please give some examples of which alerts you have created that you find meaningful? For example, do you have one montoring the D channel on a PRI? Why is it meaningful, and what settings did you use to create it?

    Best regards,

    P.S. Regarding monitoring a D channel It seems like it would be channel 24 (instead of 23 counting from zero) and it’s natural state is … 4? I could be way off. That does not seem right to me.

  7. Hi Bill,
    I am working as a VoIP engineer and i should get this alert "EXCEEDED THRESHOLD" every day..
    So could you please explain how do we avoid this alert normally?

  8. Hey William,

    is there anyway to get alerts using a cloud based email (google or even o365)? i know it sounds basic but i had a few engineers saying that it isnt as simple as just pointing it to google’s mail server

Leave a Reply


Nick Kelly

Cybersecurity Engineer, Cisco

Nick has over 20 years of experience in Security Operations and Security Sales. He is an avid student of cybersecurity and regularly engages with the Infosec community at events like BSides, RVASec, Derbycon and more. The son of an FBI forensics director, Nick holds a B.S. in Criminal Justice and is one of Cisco’s Fire Jumper Elite members. When he’s not working, he writes cyberpunk and punches aliens on his Playstation.


Virgilio “BONG” dela Cruz Jr.

CCDP, CCNA V, CCNP, Cisco IPS Express Security for AM/EE
Field Solutions Architect, Tech Data

Virgilio “Bong” has sixteen years of professional experience in IT industry from academe, technical and customer support, pre-sales, post sales, project management, training and enablement. He has worked in Cisco Technical Assistance Center (TAC) as a member of the WAN and LAN Switching team. Bong now works for Tech Data as the Field Solutions Architect with a focus on Cisco Security and holds a few Cisco certifications including Fire Jumper Elite.


John Cavanaugh

CCIE #1066, CCDE #20070002, CCAr
Chief Technology Officer, Practice Lead Security Services, NetCraftsmen

John is our CTO and the practice lead for a talented team of consultants focused on designing and delivering scalable and secure infrastructure solutions to customers across multiple industry verticals and technologies. Previously he has held several positions including Executive Director/Chief Architect for Global Network Services at JPMorgan Chase. In that capacity, he led a team managing network architecture and services.  Prior to his role at JPMorgan Chase, John was a Distinguished Engineer at Cisco working across a number of verticals including Higher Education, Finance, Retail, Government, and Health Care.

He is an expert in working with groups to identify business needs, and align technology strategies to enable business strategies, building in agility and scalability to allow for future changes. John is experienced in the architecture and design of highly available, secure, network infrastructure and data centers, and has worked on projects worldwide. He has worked in both the business and regulatory environments for the design and deployment of complex IT infrastructures.