|
|
Property Editor lets you configure alarms on network variables to determine when a specific condition occurs. Using Property Editor, you can set multiple alarms on selected events associated with any RMON-MIB variable, and on any private MIB variable or network resource you are monitoring. Configure monitoring when you suspect a fault in a segment or device, or just for notification if a problem develops. You can use Property Editor to monitor network variables as diverse as utilization and collisions for a specific segment, or the failure of a network device.
An alarm is a predefined condition based on rising data thresholds, falling data thresholds, or both. When such a condition occurs, the agent sends an Simple Network Management Protocol (SNMP) trap to the IP addresses associated with the community string you specify. You can set the same alarm on multiple agents, switches, or Frame Relay agents, or set multiple alarms on the same variable.
When TrafficDirector receives a trap, the Alert Monitor icon on the TrafficDirector management console blinks until you select it. You can also create UNIX script or DOS BAT files to take a particular action once a trap occurs.
Use Property Editor to configure alarms on both shared and custom properties to monitor your network for specific conditions.
An alarm lets you define a pair of thresholds on a network variable. The probe or switch checks the value of the network variable at a specified interval and compares it to the thresholds. If a threshold is crossed, the agent generates an SNMP trap. The probe then checks its trap destination table, and sends the trap to all IP addresses associated with the community string you specify.
When you configure the alarm, you specify a rising threshold and a falling threshold. The rising threshold is crossed when the value of the network variable is equal to or greater than the rising threshold. The falling threshold is crossed when the value of the network variable is equal to or less than the value of the falling threshold. The agent can then generate an SNMP trap based on the crossing of a rising or falling threshold, or both.
You can also re-arm a threshold. To prevent the agent from sending redundant traps based on small fluctuations. For example, a trap is generated when utilization crosses a threshold of 80 percent, then drops to 79 percent. Another trap is generated seconds later when utilization rises to 81 percent. This can be both annoying and redundant. To prevent multiple alarms, the agent generates an SNMP trap the first time the rising threshold is crossed, and does not generate another trap until the value of the network variable crosses the falling threshold, then reaches the rising threshold again. Similarly, once the falling threshold is crossed, the agent generates an SNMP trap, and does not generate another trap until the value of the network variable reaches the rising threshold, then crosses the falling threshold again.
For this reason, when you set rising and falling thresholds you really only want to be notified when only one threshold is reached. You only configure the other threshold to re-arm the first threshold.
For example, you want the agent to notify you when utilization on a network segment reaches 95 percent, but you want to avoid the redundant traps described in the above example. Configure an alarm on Utilization with a rising threshold of 95 percent and a falling threshold of 75 percent, and configure the agent to generate an SNMP trap when the rising threshold is reached. In this case, the agent generates a trap when segment utilization reaches 95 percent, and does not generate another trap until utilization drops to at least 75 percent and reaches 95 percent again.
You can configure an alarm to monitor the absolute value or the delta value of a network variable. The absolute value is the actual value of the network variable when the probe samples it. The delta value is the difference in values between two successive sampling periods, and is used to monitor the rate at which the value of the network variable changes.
In most cases, whether you monitor the absolute or delta value of a network variable depends on the type of variable you are working with. You can set alarms on the following types of network variables:
Because counters increment and do not decrement, it makes more sense to sample the counter as a delta value, where you are concerned with the rate of change in a given time interval. A counter sampled as an absolute value can never cross a falling threshold and can cross a rising threshold only once.
For example, you can set an alarm on Ethernet Collisions to alert you of possible problems such as too many nodes on the segment or unterminated segments. If collisions reach two percent of the bandwidth used, it is reasonable to assume there may be a problem. For example, based on your network utilization, you have determined that 280 collisions flag a possible problem. Because collisions is a counter that increases and does not decrease in value, it would not make sense to set a rising threshold of 280 and sample the collisions variable as an absolute value. If you did, only a single trap would be sent when the number of collisions reached 280 (even if it took hours to reach 280), but would never be sent again.
When you add or modify an alarm, you can define trap messages for the rising and falling thresholds. The message includes the following items:
| Trap Description | A text string of up to 127 characters that is sent as part of the trap message to the reporting console, or the IP address you specify. When TrafficDirector receives a trap message, the Alert Monitor blinks until you select it, then displays the text message as part of the trap listing. The default descriptions are "Falling Threshold Reached" and "Rising Threshold Reached." |
| Severity | A relative rating of the severity of the trap. The value range is a decimal number from 0 to 99. The severity rating of a trap appears as part of the trap information displayed in the Alert Monitor. Severity ratings are always passed to the program you specify in the Program Information field when an alarm is triggered. |
| Trap Number | Sent as part of the trap message and used to distinguish between traps sent when rising and falling thresholds are crossed. |
Defining trap descriptions is especially useful when working with DLCIs, switch ports, and multiport probes, because there is no built-in mechanism for determining which DLCI, switch port, or interface originated the trap. You can define the message to let you know which DLCI, switch port, or probe interface generated the trap.
For example, if you configure alarms on two DLCIs to notify you when utilization reaches 75 percent, you can enter the following descriptions as part of the alarm configuration for each DLCI: "Utilization reached 75% on DLCI #1" and "Utilization reached 75% on DLCI #2." This will help you determine which DLCI originated the trap.
You can also configure the Severity rating to identify the DLCI or port number that originated the trap, then write a script to take specific action based on the severity level. The script action will be based on the DLCI or port on which the alarm is triggered. For example, if you configure an alarm on DLCI number 423, you can specify the severity level as 423. Similarly, if you configure an alarm on port 16, you can specify the severity level as 16. This information is then passed to the script you specify as the Program to run.
You can also use UNIX script files, DOS BAT files, or executables to take a specific action when a trap occurs. You simply define the name and path of the file as the Program to run when you add the alarm and the agent will execute the program when the trap is generated.
Keep in mind that the severity ratings for the alarm are always passed as arguments to the specified program.
For example, you can specify two different severity ratings for rising and falling thresholds, and write a script to take different actions based on whether a rising or falling threshold has been crossed. You can have the script notify certain users when a rising threshold has been crossed, and other users when a falling threshold has been crossed.
You can configure the agent to generate one of seven predefined SNMP trap types. To do so, enter a number in the ID field that corresponding to the trap type you want the agent to generate as a result of an alarm. You can choose from the following predefined SNMP standard trap types:
To configure an alarm as part of a shared or custom properties file, take the following steps:
Step 1 Open the properties file in which you want to add an alarm.
The Property Editor main window opens.
Step 2 Click Add to the right of the alarm list box in the lower half of the Property Editor window.
The Add Trap window opens (Figure 37-1).
Step 3 Enter the following parameters:
Domain--The domain on which you want to configure the alarm. Select the box to the right of the Domain field, then select a domain from the Domain list box.
1Fn--The switch port or DLCI on which you want to configure the alarm. You can select this field only when you are configuring custom properties for a switch or Frame Relay interface. If you are configuring a custom properties file for a switch port, this field is labeled Port; for a Frame Relay agent, the field is labeled DLCI.
Stats Type--The statistics group that contains the variable on which you want to configure the alarm.
Trap Variable--The variable on which you want to configure the alarm.
Key 1--The host address when monitoring host statistics, or the source address when monitoring conversation statistics. Both are available when you select Domain as the data type. When you select Resource Manager Variables as the Stats Type, this field displays the target host address, filled in automatically when you select a variable to monitor.
Key 2--The destination address when monitoring conversation statistics, available when you select Domain as the type. If you select Resource Manager Variables as the type, this field is automatically filled in with the MIB OID when a Proxy SNMP variable is selected.
Type--Whether the alarm is triggered on a change in data rate (Delta), such as packets per second; or an absolute value (Absolute), such as number of packets counted or utilization.
Threshold--The rising and falling threshold value that triggers the trap. Values must be a decimal number. The ranges allowed depend on the variable selected. Note that if you are entering a value for utilization, you enter the percentage value as a decimal number. For example, to specify a threshold of 75 percent on utilization, enter 75.
Severity--The relative rating of severity of the trap, from 0 to 99, decimal. The severity rating of a trap appears as part of the trap message sent by the agent. If you select Rising or Falling, specify a severity level for rising, falling, or both. If you select Both, specify a severity level for both rising and falling.
Program to run--The name (including the path) of the UNIX script file or DOS BAT file you want to execute when a trap is detected. The default directory for the file is $NSHOME/usr. You can use a trap to trigger actions in TrafficDirector, UNIX, or DOS. If you select Rising or Falling, specify a program to run for rising, falling, or both. If you select Both, specify a program to run for both rising and falling.
Description--The text string you want to be sent as part of the trap message when the threshold is exceeded. You can enter up to 127 characters. If you select Rising or Falling, specify a description for rising, falling, or both. If you select Both, specify a description for both rising and falling.
Community (Rising and Falling)--The agent sends traps to each host registered for the community specified when a rising and falling threshold is reached. The host from which you installed the alarm is automatically registered in the specified rising and falling communities. If you select Rising or Falling, specify a community for rising, falling, or both. If you select Both, specify a community for both rising and falling. The default community for both thresholds is public.
Trap Number (Rising and Falling)--A number you define to identify the trap as either rising or falling. If you select Rising or Falling, specify a trap number for rising, falling, or both. If you select Both, specify a trap number for both rising and falling. The default rising trap number is 1; the default falling trap number is 2.
ID--The type of SNMP trap sent. This is a standard SNMP 0 to 6 trap-type number. The default is 6.
Check every--The interval, in seconds, at which the agent samples the data and compares it with applicable rising and falling thresholds. The value must be a decimal number. The allowed range is 1 to 3600 seconds. The default is 60.
Step 4 Click OK to save the configuration and add the new alarm to the properties file, or click Cancel to exit the Add Trap window without writing the specified alarm to the properties file.
Property Editor lets you modify any of the alarm configuration parameters. You may want to change the rising or falling threshold value, destination address, or even specify a new script file to execute when the trap occurs.
To modify an existing trap, take the following steps:
Step 1 Select the trap you want to edit from the lower list box in the Property Editor main window and click Edit.
The Edit Trap window opens with the complete alarm configuration of the selected trap (Figure 37-2).
Step 2 Make any required changes. See "Adding Alarms."
Step 3 Click OK to accept the changes or click Cancel to leave the configuration unchanged.
You can remove any traps you no longer need by taking the following steps:
Step 1 Select a trap from the lower list box in the Property Editor main window and click Delete.
A dialog box prompts you to confirm the deletion.
Step 2 Click Yes to delete the trap, or click No to cancel the deletion.
Use the command line utility, dvadmin, to define specific IP addresses that you want the agent to send SNMP traps to when alarm conditions occur. You do this by associating hosts with communities, then entering the community strings in the rising and falling community fields when you configure an alarm. When the alarm condition is reached, the agent sends SNMP traps to all members of the defined community strings.
The agent uses a trap destination table in the probe or switch to determine the hosts to which it will send an SNMP trap. Each entry in the table maps a single host to a specified community string. Use the TrafficDirector dvadmin utility to maintain this admin table in the probe, or CicsoView/CLI for switches.
When you install a properties file that contains an alarm configuration on an agent, the agent automatically creates an entry in the trap destination table. The entry maps the host that installed the properties file to the community strings defined when you configured the alarm. This configures the agent to send SNMP traps to the host that defined the alarm by default. You can use the dvadmin utility to define the different communities to which you want the probe to send SNMP traps.
For example, you want to configure an alarm that notifies different hosts depending on whether a rising or falling threshold has been reached. You can specify a community string named "rising" to notify selected hosts of a rising alarm, and a community named "falling" to notify other hosts of a falling alarm. Your dvadmin table will contain this type of entries (Figure 37-3).
In Figure 37-3, if a rising threshold is crossed, the agent sends traps to hosts 10.20.11.56 and 10.20.11.57. If a falling threshold is crossed, the agent notifies hosts 20.30.12.40 and 20.30.12.42.
Use the following command to add a host-community mapping to the trap-destination table in a specified agent:
dvadmin agent add target_host trap_community
In this command, agent is the agent on which you want to add the host-community mapping, target_host is the host you want the agent to send SNMP traps to when an alarm condition occurs, and trap_community is the community string to which you want the target host to belong.
Use the following command to delete a host-community mapping from the trap-destination table in a specified agent:
dvadmin agent delete target_host trap_community
In this command, agent is the agent on which you want to delete the host community mapping, target_host is the host you want to delete from the trap destination table, and trap_community is the community string associated with the target_host you want to delete.
You can dump the contents of the trap destination table in a specified agent to find the hosts to which the probe will send traps, by using the following command:
dvadmin agent list
In this command, agent is the agent with the trap-destination table you want to view.
|
|
