Alert Monitor

Use the Alert Monitor application to monitor your network for specific events that trigger "traps" in an agent, and problems that may interfere with logging report data. Alert Monitor signals you when certain conditions occur on the network, and when daemon processes that control report data logging encounter problems retrieving data and generating reports.

Alert Monitor Terminology

Agent events and daemon events are two different types of conditions you can monitor in TrafficDirector with the Alert Monitor application. Agent events are the result of traps that are generated in an agent whenever certain thresholds are exceeded on its segment. Daemon events occur whenever a TrafficDirector logging daemon fails because of problems with agents, report databases, or configuration files.

The following terms apply to the Alert Monitor application:

Alarm	An alarm is a predefined condition based on the following: · Rising data threshold that indicates the highest allowed incidence of a specific condition before a trap is generated on a segment. For example, you can have a rising data threshold of 85 percent utilization on a critical segment. · Falling data threshold that indicates the lowest allowed incidence of a specific condition before a trap is generated on a segment. For example, you can have a falling data threshold of 5 percent utilization on a critical segment.
Trap	Describes the thresholds that you configure in an agent to monitor specific conditions on a segment, and what happens when the specified conditions occur. When an agent detects an alarm condition on a segment, it reacts by logging information about the time, type, and severity of the condition and generates a trap that is sent to all of the IP addresses associated with the community string. A trap is a set of instructions you can configure and install on an agent that executes whenever rising, falling, or both thresholds are exceeded.
Alert	The notification message that is sent to all IP addresses defined in the trap community string.
Event	Any network or logging daemon event that is logged to TrafficDirector and displayed by Alert Monitor.

Monitoring Frame Relay Networks

Certain events that are specific to Frame Relay networks only can be monitored using Alert Monitor. Frame Relay agents can send traps automatically to the Alert Monitor application to notify you whenever a change in PVC status occurs.

Recognizing and Acknowledging Alerts

Whenever a trap is generated and sent to TrafficDirector, or a logging daemon encounters a problem, the Alert Monitor icon blinks. Acknowledge the alert by clicking the Alert Monitor icon once. Click the icon again to display the Alert Monitor window.

To view events, take the following steps:

Step 1 Click the Alert Monitor icon in the main TrafficDirector window.

The Alert Monitor application (Figure 31-1) displays with information about the most recent agent events.

Step 2 Do one of the following to view other alert information:

• Select View>Agent Events to display information about traps generated by network agents (Figure 31-1).

• Select View>Daemon Events to display information about logging and reporting daemon problems (Figure 31-2).

Step 3 Use the up and down arrow buttons to the right of the date field to select the date you want to view. Alert Monitor automatically defaults to the current date.

A list of events recorded for the date you selected is displayed in the list box.

Step 4 Select an event to view detailed information about a specific agent event or a description of a daemon event.

Information on that event is displayed in the lower list box.

Figure 31-1: Alert Monitor Application (Agent Event View)

Figure 31-2: Alert Monitor Application (Daemon Event View)

Deleting Alerts from Alert Monitor

Trap or daemon alerts are automatically written to log files that you can view using Alert Monitor. To clear all traps or daemon alerts for a single day, take the following steps:

Step 1 Launch the Alert Monitor application, if you haven not already done so.

Step 2 Select View>Agent Events or View>Daemon Events to display the event log you want.

Step 3 Click the up or down arrow buttons on the toolbar to display all the alerts for the day that you want to clear.

Step 4 Click Delete or select Edit>Delete.

Step 5 Click Yes to delete all events, or No to cancel the deletion.

Alert Information

Agent events can be triggered by a number of different trap types. Daemon events can be triggered for several reasons. This section describes agent and daemon events to help you understand the information displayed in Alert Monitor. This section also includes a list of items to check when you get daemon event messages, and tips on where to look for more information about traps and daemons.

About Agent Events

When you select View>Agent Events from the Alert Monitor menu bar, the Alert Monitor trap list shows all traps sent to the IP address of your TrafficDirector console, even if they are not RMON-related.The trap list displays all the messages sent on the date shown in the date field at the top of the Alert Monitor window, along with the following information:

Agent Address	The name or IP address of the agent that logged the trap.
Community	The name of the SNMP host community that received this trap.
Severity	The relative severity rating, displayed as a decimal number between 0 and 99. For switches, the severity value often indicates the port number. For Frame Relay agents, the severity may indicate the DLCI.
Absolute Time	The time that the agent recognized the condition.
Trap Type	The standard SNMP trap-type number (0-6) that indicates the type of trap message sent.

Alert Monitor also displays information about the agent that generated the trap, when the trap was generated, and the trap type and severity. When you highlight a single event in the trap list, additional information is displayed in the lower list box. Depending on the type of trap and the topology of the segment where the alarm condition occurred, a variety of information is displayed, including the Sample Type (Delta or Absolute), threshold value, and description (Rising or Falling threshold reached).

What Triggers Agent Events?

Traps or agent events, can be generated by any agent on the network, even agents that are not related to TrafficDirector. Traps are any thresholds that you set on an agent when you want to be notified of certain situations or conditions on your network.

Using traps, you can monitor network variables as diverse as utilization and collisions for a specific segment, insertions on a Token Ring network, or conversation statistics between hosts. If you are using V4.0 Frame Relay agents, they can automatically notify you when that a Frame Relay DLCI goes down (LinkDown) and when it is back in operation (LinkUp). The V4.0 agent also makes it possible to detect duplicate IP addresses on a segment of your WAN or LAN. For more information about SwitchProbes and probe firmware, refer to the SwitchProbe Installation and Configuration Guide.

Understanding Daemon Events

When you select View>Daemon Events from the Alert Monitor menu bar, the Alert Monitor daemon list displays all the daemon events that occurred on the date shown in the date field at the top of the Alert Monitor window, along with the following information:

Logging Daemon	The name of the daemon.
Agent	The name or IP address of the agent that is logging report data.
Message Type	The source of the problem; displayed as either Agent, Database, or File. See the "What Triggers Daemon Events?" section.
Absolute Time	The time that the event occurred.

Alert Monitor displays more specific information about the problem in the lower list box.

What Triggers Daemon Events?

Daemon events occur when any of the logging daemons have problems performing their specific tasks. The Message Type field displays information about the source of the daemon problem. Daemon events are triggered by the following factors:

Agent	The daemon was unable to communicate with the agent logging the report data. Use the Test Agent function to determine if the agent is down.
Database	The daemon was unable to access the report database. This may occur because no SQL server is defined, or the SQL server is down. Use the SQL Server application to verify that the SQL server was defined and that the information displayed is correct. On the SQL server, make sure that you configured an adequate number of licenses.
Files	The daemon found an error in one or more logging configuration files.

If you have logging configured for a domain and that domain is de-installed, you will be notified via Alert Monitor. (This notification allows you to take prompt corrective action, and thereby minimize the period of unsuccessful login).