When configuring RMON, go to these sections
for information you are interested in:
l
RMON
Overview
l
Configuring
RMON
l
Displaying
and Maintaining RMON
l
RMON
Configuration Example
1.1 RMON Overview
This section covers these topics:
l
Introduction
l
RMON
Groups
1.1.1 Introduction
Remote Monitoring (RMON) is a type of
IETF-defined MIB. It is the most important enhancement to the MIB II standard.
It allows you to monitor traffic on network segments and even the entire
network.
RMON is implemented based on the Simple
Network Management Protocol (SNMP) and is fully compatible with the existing
SNMP framework.
RMON provides an efficient means of monitoring
subnets and allows SNMP to monitor remote network devices in a more proactive
and effective way. It reduces traffic between network management station (NMS) and
agent, facilitating large network management.
RMON comprises two parts: NMSs and agents
running on network devices.
l
Each RMON NMS administers the agents within its administrative
domain.
l
An RMON agent resides on a network monitor or
probe for an interface. It monitors and gathers information about traffic over the
network segment connected to the interface to provide statistics about packets
over a specified period and good packets sent to a host for example.
RMON allows multiple monitors. A monitor provides
two ways of data gathering:
l
Using RMON probes. NMSs can obtain management
information from RMON probes directly and control network resources. In this
approach, RMON NMSs can obtain all RMON MIB information.
l
Embedding RMON agents in network devices such as
routers, switches, and hubs to provide the RMON probe function. RMON NMSs
exchange data with RMON agents with basic SNMP commands to gather network
management information, which, due to system resources limitation, may not
cover all MIB information but four groups of information, alarm, event,
history, and statistics, in most cases.
S9500 series adopts the second way. By using
RMON agents on network monitors, an NMS can obtain information about traffic
size, error statistics, and performance statistics for network management.
1.1.2 RMON Groups
RMON categorizes objects into ten groups.
This section describes only the major implemented five groups.
I. Event group
The event group defines event indexes and controls
the generation and notifications of the events triggered by the alarms defined
in the alarm group and the private alarm group. The events can be handled in one
of the following ways:
l
Logging events in the event log table
l
Sending traps to NMSs
l
Both logging and sending traps
l
No action
II. Alarm group
The RMON alarm group monitors specified
alarm variables, such as statistics on a port. If the sampled value of the
monitored variable is bigger than or equal to the rising threshold, a rising
alarm event is triggered; if the sampled value of the monitored variable is
lower than or equal to the falling threshold, a falling alarm event is
triggered. The event is then handled as defined in the event group.
The following is how the system handles
entries in the RMON alarm table:
1)
Samples the alarm variables at the specified
interval.
2)
Compares the sampled values with the predefined
threshold and triggers events if all triggering conditions are met.
If a monitored variable
overpasses the same threshold multiple times, only the first one can cause an
alarm event. That is, the rising alarm and falling alarm are alternate.
III. Private alarm group
The private alarm group calculates the sampled
values of alarm variables and compares the result with the defined threshold, thereby
realizing a more comprehensive alarming function.
System handles the prialarm alarm table
entry (as defined by the user) in the following ways:
l
Periodically samples the prialarm alarm
variables defined in the prialarm formula.
l
Calculates the sampled values based on the prialarm
formula.
l
Compares the result with the defined threshold
and generates an appropriate event.
IV. History group
The history group controls the periodic
statistical sampling of data, such as bandwidth utilization, number of errors, and
total number of packets.
Note that each value provided by the group
is a cumulative sum during a sampling period.
V. Ethernet statistics group
The statistics group monitors port
utilization. It provides statistics about network collisions, CRC alignment errors,
undersize/oversize packets, broadcasts, multicasts, bytes received, packets
received, and so on.
After the creation of a valid event entry
on a specified interface, the Ethernet statistics group counts the number of
packets received on the current interface. The result of the statistics is a
cumulative sum.
Currently, S9500
series switches do not support statistics about oversize frames and bytes
received.
Before configuring RMON, configure the SNMP
agent as described in SNMP Configuration in the System Volume.
Follow these steps to configure RMON:
|
To do…
|
Use the command…
|
Remarks
|
|
Enter
system view
|
system-view
|
—
|
|
Create an
event entry in the event table
|
rmon
event entry-number
[ description string ] { log | trap trap-community
| log-trap log-trapcommunity | none
} [ owner text ]
|
Optional
|
|
Enter
Ethernet interface view
|
interface
interface-type interface-number
|
—
|
|
Create an
entry in the history table
|
rmon
history entry-number buckets
number interval sampling-interval [ owner text
]
|
Optional
|
|
Create an
entry in the statistics table
|
rmon
statistics entry-number [ owner
text ]
|
Optional
|
|
Exit
Ethernet interface view
|
quit
|
—
|
|
Create an
entry in the alarm table
|
rmon
alarm entry-number alarm-variable
sampling-interval { absolute | delta } rising-threshold
threshold-value1 event-entry1 falling-threshold
threshold-value2 event-entry2 [ owner text
]
|
Optional
|
|
Create an
entry in the private alarm table
|
rmon
prialarm entry-number prialarm-formula
prialarm-des sampling-interval { absolute | changeratio
| delta } rising-threshold threshold-value1 event-entry1
falling-threshold threshold-value2 event-entry2 entrytype
{ forever | cycle cycle-period } [ owner
text ]
|
Optional
|
l
Two entries with the same configuration cannot
be created. If the parameters of a newly created entry are identical to the
corresponding parameters of an existing entry, the system considers their
configurations the same and the creation fails. Refer to Table 1-1
for the parameters to be compared for different entries.
l
The system limits the total number of all types
of entries (Refer to Table 1-1 for the detailed numbers). When the total number of an entry
reaches the maximum number of entries that can be created, the creation fails.
Table 1-1 Limitations
on the configuration of RMON
|
Entry
|
Parameters to be compared
|
Maximum number of entries that can be
created
|
|
Event
|
Event
description (description string), event type (log, trap,
logtrap or none) and community name (trap-community or log-trapcommunity)
|
60
|
|
History
|
Sampling
interval (interval sampling-interval)
|
100
|
|
Statistics
|
Only one
statistics entry can be created on an interface.
|
100
|
|
Alarm
|
Alarm
variable (alarm-variable), sampling interval (sampling-interval),
sampling type (absolute or delta), rising threshold (threshold-value1)
and falling threshold (threshold-value2)
|
60
|
|
Pri-alarm
|
Alarm variable formula (alarm-variable),
sampling interval (sampling-interval), sampling type (absolute,
changeratio or delta), rising threshold (threshold-value1)
and falling threshold (threshold-value2)
|
50
|
|
To do…
|
Use the command…
|
Remarks
|
|
Display RMON statistics
|
display rmon statistics [ interface-type interface-number ]
|
Available in any view
|
|
Display RMON history information and the
latest history sampling information
|
display rmon history [ interface-type interface-number ]
|
Available in any view
|
|
Display RMON alarm configuration information
|
display rmon alarm [ entry-number ]
|
Available in any view
|
|
Display RMON prialarm configuration information
|
display rmon prialarm [ entry-number ]
|
Available in any view
|
|
Display RMON events configuration
information
|
display rmon event [ entry-number ]
|
Available in any view
|
|
Display RMON event log information
|
display rmon eventlog [ event-number ]
|
Available in any view
|
1.4 RMON Configuration Example
I. Network requirements
Agent is connected to a configuration terminal
through its console port and to a remote NMS across the Internet.
Create an entry in the RMON Ethernet
statistics table to gather statistics on GigabitEthernet 4/2/2, and logging is
enabled after received bytes exceed the specified threshold.
II. Network diagram
Figure 1-1 Network diagram for RMON
III. Configuration procedure
# Configure RMON to gather statistics for interface
GigabitEthernet 4/2/2.
<Sysname> system-view
[Sysname] interface GigabitEthernet 4/2/2
[Sysname-GigabitEthernet4/2/2] rmon statistics 1 owner user1-rmon
[Sysname-GigabitEthernet4/2/2] quit
# Display RMON statistics for interface GigabitEthernet
4/2/2.
<Sysname> display rmon
statistics GigabitEthernet 4/2/2
Statistics entry 1 owned by user1-rmon
is VALID.
Interface : GigabitEthernet4/2/2<ifIndex.157>
etherStatsOctets :
0 , etherStatsPkts : 0
etherStatsBroadcastPkts :
0 , etherStatsMulticastPkts : 0
etherStatsUndersizePkts :
0 , etherStatsOversizePkts : 0
etherStatsFragments :
0 , etherStatsJabbers : 0
etherStatsCRCAlignErrors :
0 , etherStatsCollisions : 0
etherStatsDropEvents (insufficient
resources): 0
Packets received according to
length:
64 : 0 , 65-127 :
0 , 128-255 : 0
256-511: 0 , 512-1023:
0 , 1024-1518: 0
# Create an event to start logging after
the event is triggered.
<Sysname> system-view
[Sysname] rmon event 1 log owner 1-rmon
[Sysname] display rmon event 1
Event table 1 owned by 1-rmon is
VALID.
Description: null.
Will cause log when triggered, last
triggered at 2day(s) 03h:56m:06s.
# Configure an alarm group.
[Sysname] rmon alarm 1 1.3.6.1.2.1.16.1.1.1.4.1
delta rising-threshold 1000 1 falling-threshold 100 1 owner 1-rmon
[Sysname] display rmon alarm 1
Alarm table 1 owned by 1-rmon is
VALID.
Samples type : delta
Variable formula : 1.3.6.1.2.1.16.1.1.1.4.1<etherStatsOctets.1>
Sampling interval : 10(sec)
Rising threshold : 1000(linked
with event 1)
Falling threshold : 100(linked
with event 1)
When startup enables :
risingOrFallingAlarm
Latest value : 2552
