>> Would someone provide me with an example of when you would
>> want to configure a SNMP Custom Service and use the Rate of
>> Change option when monitoring?
Many MIB variables are counters. Some counters will move very regularly, or
very rarely, and a change in this behavior indicates a problem. By
measuring the rate of change you can watch for anomalous behavior on your
network.
Two examples, one with a rate above a threshold and one below. (You didn't
mention a version, but I'm assuming WUG 7's SNMP Monitoring plug-in).
(1) "ABOVE" example. Pick an error counter, for instance ifInErrors
(1.3.6.1.2.1.2.2.1.14). This is the number of erroneous packets coming in
on a particular interface of a router or device. Normally will creep up
slowly as random errors occur. If it suddenly surges, that might be
evidence of a problem like failing link hardware.
So you would create a new Monitor/Service of type SNMP Monitoring and give
it a name, and then set:
ObjectID: ifInErrors.xx (where xx is the interface number, you
can use
SNMPVIEW to find the one you want)
Check it for: Rate of Change in Value
Rate of change: 10 (10 error packets per second is the
chosen maximum)
Failing rate is: Above
(2) "BELOW" example. Pick a non-error counter, like outgoing bytes on a
particular interface (ifOutOctets 1.3.6.1.2.1.2.2.1.16). Maybe you know
from the design of your network that this particular interface always has
traffic on it. (Perhaps there are two key systems on either side of it that
talk constantly all day). If the packet counter rate of increase drops
BELOW a certain value, that could indicate something has failed.
ObjectID: ifOutOctets.xx (again xx is the interface number)
Check it for: Rate of Change in Value
Rate of change: 100 (100 packets per second is the minimum)
Failing rate is: Below
>> My perception on its use, for example: when you wanted to monitor
>> disk usage and be notified if the amount of free space is falling
>> at a rapid rate. Is my perception correct? if not, how is it used?
Yes, that is an excellent use.
--Tim Farley
IPSWITCH
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
