|
|
You can use Alert Monitor to watch for specific events that were triggered by SNMP traps defined for an agent. You can also examine background daemon events for problems that interfere with logging TrafficDirector report data.
Alert Monitor signals you when certain conditions occur on the network, and when daemon processes that control report data logging encounter problems retrieving data and generating reports. The sooner you are alerted to problems, the faster you can analyze the event and take corrective steps.
The following sections contain more information about using Alert Monitor:
Agent events and daemon events are two different types of conditions you can monitor using Alert Monitor. Agent events are generated as the result of traps whenever certain thresholds are exceeded on a network segment. Daemon events occur whenever a TrafficDirector logging daemon fails due to problems with agents, report databases, or configuration files.
The terms defined in Table 10-1 apply to Alert Monitor:
| This Term... | Refers to |
|---|---|
Alarm | A predefined condition based on:
|
Trap | Describes the thresholds you configure in an agent to monitor specific conditions on a segment, and what happens when specified conditions are met. When an agent detects an alarm condition on a segment, it reacts by logging information about the time, type, and severity of the condition, and generates a trap---or notification message---that is sent to all IP addresses defined in the community string. A trap is a set of instructions you can configure and install on an agent that executes whenever rising, falling, or both thresholds are exceeded. |
Alert | Refers to the notification message sent to all IP addresses defined in the trap community string. |
Event | Any network or logging daemon event logged to the TrafficDirector software and displayed by Alert Monitor. |
Certain events specific to Frame Relay networks only can be monitored using Alert Monitor. Frame Relay agents can send traps automatically to Alert Monitor to notify you whenever a change in PVC status occurs.
A Frame Relay agent is a WAN interface set up to monitor a Frame Relay segment. When you add a Frame Relay agent using Configuration Manager (see Chapter 7, "Configuring Frame Relay Agents"), you also see all the DLCIs that the SwitchProbe device discovered on the selected network segment.
Configuration Manager allows you to monitor DLCIs as individual agents using protocol domains. All protocol domains that you install on the physical Frame Relay interface using a shared properties file are automatically propagated to all DLCIs on that interface. You can also configure traps and logging for individual DLCIs using the custom properties file for the selected Frame Relay interface.
For example, if you want to monitor IP host and conversation statistics, you enable host and conversation statistics for the IP domain on the physical Frame Relay interface that you added to the TrafficDirector application. The agent will configure all DLCIs on the selected interface to track IP hosts and conversations. The agent also will enable IP hosts and conversations for any new DLCIs it discovers on the selected network segment.
If you disable IP hosts and conversations on the physical Frame Relay interface, the agent disables IP hosts and conversations for all DLCIs discovered on that interface. If you do not want to generate reports for all PVCs on a selected interface, you can install a custom properties file on the physical Frame Relay interface to define logging only for selected DLCIs.
Whenever a trap is generated and sent to the TrafficDirector application, or a logging daemon encounters a problem, the Alert Monitor icon blinks to get your attention until you acknowledge the alert by clicking the Alert Monitor icon once. Click the icon again to display the Alert Monitor window.
To view events, follow these steps:
Step 1 Click the Alert Monitor icon in the TrafficDirector main window.
Alert Monitor is displayed with information about the most recent agent events.
Step 2 To view other alert information, do one of the following:
Step 3 Click the up and down arrow buttons (to the right of the date) to select the date you want to view.
A list of alert events that took place on the date you selected appears in the list box.
Step 4 To view detailed information about a specific agent event, or a description of a daemon event, highlight the event.
Information on that event is displayed in the lower list box.
The following sections contain more information about working with the Alert Monitor displays:
You can update the information in the list box to show new traps in one of the following three ways:
Trap or daemon alerts are automatically written to log files that you can view using Alert Monitor. To clear all traps or daemon alerts for a single day, follow these steps:
Step 1 Select View>Agent Events or View>Daemon Events to display the event log you want.
Step 2 Click the up or down arrow buttons on the tool bar to display all the alerts for the day that you want to clear.
Step 3 Click Delete, or select Edit>Delete.
A dialog box prompts you to confirm the deletion.
Step 4 Click Yes to delete all events, or click No to cancel the deletion.
Agent events can be triggered by a number of different trap types. Daemon events can be triggered for several reasons. This section describes agent and daemon events to help you understand the information displayed in Alert Monitor. This section also includes a list of items to check when you receive daemon event messages, and tips on where to look for more information about traps and daemons.
The following sections contain more information about alert information:
When you select View>Agent Events from the Alert Monitor menu bar, the Alert Monitor trap list shows all traps sent to the IP address of the TrafficDirector management console, even if they are not RMON-related.
The trap list displays all the messages sent on the date shown in the date field at the top of the Alert Monitor window, along with the following information:
Alert Monitor also displays information about the agent that generated the trap, when it was generated, and the type and severity. When you highlight a single event in the trap list, the additional information is displayed in the lower list box. Depending on the type of trap and the topology of the segment where the alarm condition occurred, you see a variety of information, including the Sample Type (Delta or Absolute), threshold value, and description (Rising or Falling threshold reached).
The following section describes the conditions that can trigger agent events:
Traps or agent events can be generated by any agent on the network---even those agents not related to the TrafficDirector application. Traps are any thresholds that you set on an agent when you want to be notified of certain situations or conditions on your network.
You can use traps to monitor network variables as diverse as utilization and collisions for a specific segment, insertions on a Token Ring network, or conversation statistics between hosts.
If you are using Frame Relay agents, traps can automatically notify you when a Frame Relay link goes down (LinkDown) and when it is back in operation (LinkUp). The agent also detects duplicate IP addresses on a segment of your WAN or LAN. For more information about SwitchProbe devices and firmware, see the Cisco SwitchProbe Installation and Configuration Guide.
For more information about using Property Editor to set up traps, see Chapter 6, "Working with Properties."
For more information about using Configuration Manager to install traps on agents, see Chapter 3, "Using Configuration Manager," and Chapter 9, "Configuring Alarms."
When you select View/Daemon Events from the Alert Monitor menu bar, the Alert Monitor daemon list displays all daemon events that occurred on the date shown in the date field at the top of the Alert Monitor window, along with the following information:
In the lower list box, Alert Monitor displays more specific information about the problem. For example:
Could not connect to the database server!
The following section describes those conditions that can trigger daemon events:
Daemon events occur whenever any of the logging daemons have problems performing their specific tasks. The Message Type field displays information about the source of the daemon problem. Daemon events can occur due to any of the following factors:
If you have logging configured for a domain and that domain is de-installed, you will be notified via Alert Monitor. This notification allows you to take prompt corrective action, and thereby minimize the period that logins could be unsuccessful.
For more information about the TrafficDirector logging daemons, see Chapter 33, "Reviewing Report Resource Information."
For more information about configuring logging for reports, see Chapter 6, "Working with Properties."
Posted: Mon Feb 8 15:07:29 PST 1999
Copyright 1989-1999©Cisco Systems Inc.