About this Manual We’ve added this manual to the Agilent website in an effort to help you support your product. This manual is the best copy we could find; it may be incomplete or contain dated information. If we find a more recent copy in the future, we will add it to the Agilent website. Support for Your Product Agilent no longer sells or supports this product. Our service centers may be able to perform calibration if no repair parts are needed, but no other support from Agilent is available.
User’s Guide 1 HP OpenView NetMetrix/UX version 6.
Introduction The New World of Network Management Welcome to the new world of network management—a world where you can clearly see what’s happening on your network, and it is no longer a mystery or black box. Is it a fantasy? Not with HP OpenView NetMetrix/UX. NetMetrix clarifies what is happening on the network so that network problems can be quickly isolated and potential problems corrected before they become a problem.
HP OpenView NetMetrix/UX User’s Guide Introduction Improve Network Performance and Manage Switch Networks The only thing worse than an unavailable network is a poorlyperforming network. NetMetrix can help you become more proactive in managing your network performance, so that action can be taken before performance becomes unacceptable or unavailable.
HP OpenView NetMetrix/UX User’s Guide Introduction Create and Maintain Network Service Level Agreements Networked environments have evolved and matured to the point where focus has shifted from technology adoption and implementation issues to management activities needed to support users’ business-critical environments. As a result, the strategic role that IT plays in delivering business continuity across the enterprise has elevated.
HP OpenView NetMetrix/UX User’s Guide Introduction Extend the Power of HP OpenView Network Node Manager NetMetrix and Network Node Manager are the industry’s two leading network management solutions in their respective areas. When combined, they provide the most powerful integrated network management solution available in the industry today.
Reporter—At a Glance Figure 1 Reporter: Status Window ➀ ➁ ➂ ➃ ➄ ➀ Menu bar: ➁ ➂ Report status area, with one report selected File Menu contains items to create a new report, open an existing report file, view the error log, and exit the application. Report Menu includes items that operate on one or more selected reports: modify (page 56), generate now (page 55) display now (page 54), and remove (page 58). Help Menu provides access to online documentation for Reporter.
Figure 2 Reporter: Report Definition Window Toolbar functions: saves the report to a file (page 69). cuts the selected graph(s) to the clipboard (page 74). copies the selected graph(s) to the clipboard (page 74). pastes the contents of the clipboard at the current location (page 74). displays the schedule/output window (page 67). generates the report now (page 55). displays the report on screen (page 65).
Internetwork Monitor—At a Glance Figure 3 Internetwork Monitor: Internetwork View Window ➀ ➁ ➅ ➃ ➆ ➂ ➄ ➇ ➈ ➀ Toolbar gives quick access to common ➁ ➂ ➃➄ functions; see close-up on the next page. Current time interval. Segment ring, as reported by an agent, ERM instance, or archive file; lines represent traffic flow between nodes and segments. Labels showing node and line information. 8 ➅ Protocols shown in the current view.
Figure 4 Internetwork Monitor: Internetwork View Window, Close-Up ➀ ➁ ➂ ➀ ➃ ➄ Menu bar: File Menu contains items to create, load, or save a model (page 217); save or recall configuration settings (page 242); print the current data graphically or as a text report (page 237); and view the error log (page 169). Report Menu displays the current data as a text table (page 182).
Load Monitor—At a Glance Figure 5 Load Monitor: Base Window Choose items from the View menu to display graphs of network load Base window menus, summarized below Status area shows information about current data source/ instance File Menu contains items to load data from an archive file and view the error log. View Menu includes items to open windows containing graphs that display network load. 10 Attach… button lets you attach to a different instance.
Figure 6 Load Monitor: Zoom View Current Zoom path and pop-up menus Use pop-ups to change the path Zoom path graphs: Double-click in a graph to select Zoom focus point. The graph title and a dashed line indicate the current zoom point. Subsequent graphs in the path are updated to show their status at the selected zoom point(s) Zoom shows the relationships between different aspects of network traffic. The Zoom path indicates how each graph progressively refines the displayed information.
Protocol Analyzer—At a Glance Figure 7 Protocol Analyzer: Base Window Base window menus, summarized below Click START to begin packet capture Status area gives information about current capture instance Click STOP to end packet capture File Menu contains items to save captured data to or load data from a file, save filters and settings to a file or recall them, clear current filters/settings and load the defaults, and display the error log.
Figure 8 Protocol Analyzer: Packet Decodes Window ➅ ➀ ➁ ➂ ➃ ➆ ➇ ➉ ➄ ➈ ➀ Marked packet; double-click to toggle mark, or use Marks menu ➁ Error packet, Information packet indicates error or information bit is set; Detail pane shows packet status ➂ Current packet; click to select, use ↑ and ↓ keys, or use Navigate menu ➃ Skipped packets; indicates a gap in the packet numbers, usually occurs when the buffer fills and wraps faster than packets can be displayed ➄ Highlights show correlation between Detail
RMON Utilities—At a Glance Alarms and Traps Alarms and traps let you configure RMON agents to alert you when interesting activity occurs on the network. You define what “interesting activity” is, and you control what happens when the agent detects it. For example, you might configure an alarm to monitor octet counts per second.
Token Ring Applications LanProbe IP Address Tracking The RMON Utilities include several tools specifically for token ring networks. LanProbe IP Address Tracking lets you match MAC addresses and IP addresses as seen by an HP LanProbe. Ring Status displays descriptive information about one or more token ring networks. Ring Order shows information about which stations are currently active and which stations were once active but have dropped out or been removed from a token ring network.
Applications and Agents Table 1 on page 18 lists all of the applications in the HP OpenView NetMetrix/UX suite and indicates which agents are supported. LanProbe J3458A HP Fast Ethernet LanProbe J3457A HP Quad Ethernet LanProbe 4986B HP Ethernet LanProbe 4987B HP Ethernet LanProbe with AUI J3911A HP Multiport Token-Ring LanProbe 4985A HP Token-Ring LanProbe 4985B HP Token-Ring LanProbe J332xB HP FDDI LanProbe with Ethernet Telemetry, J332xA HP FDDI LanProbe.
HP OpenView NetMetrix/UX User’s Guide Applications and Agents HP ProCurve Switch J4110A ProCurve Switch 8000M J4120A ProCurve Switch 1600M J4121A ProCurve Switch 4000M J4122A ProCurve Switch 2400M J3298A ProCurve Switch 212M J3299A ProCurve Switch 224M J3301A ProCurve Switch 10base T Hub12M J3303A ProCurve Switch 10base T Hub 24M J3288A ProCurve Switch 10T/100T Managed 12-Port Hub J3289A ProCurve Switch 10T/100T Managed 24-Port Hub J4093A ProCurve Switch 2424M Extended Data Source (DS) A device other th
HP OpenView NetMetrix/UX User’s Guide Applications and Agents Application Wan/ATMProbe ERM PVC ISL VLAN Cisco Switch HP Procurve Extended DS RMON DS NetMetrix Applications and Agents LanProbe Table 1 Reporter ● ● ∅ ● ● ● ● ● ● WanProbe, ATMProbe, and PVC Notes data sources must be associated with an ERM. Available graphs depend on configured data collection. Also works with Internetwork Response Agents (IRAs) and network components.
HP OpenView NetMetrix/UX User’s Guide Applications and Agents Application Wan/ATMProbe ERM PVC ISL VLAN Cisco Switch HP Procurve Extended DS RMON DS NetMetrix Applications and Agents, continued LanProbe Table 1 Alarms and Traps ● ● ∅ ● ● ● ● ∅ ● Requires Alarm and Event Notes RMON groups. Traps require an event manager, such as HP OpenView Network Node Manager.
HP OpenView NetMetrix/UX User’s Guide Applications and Agents Agent Administration: Warm/Cold Start Authentication LanProbe Configuration Download Firmware PVC ISL VLAN Cisco Switch HP Procurve Extended DS RMON DS Internetwork Response Manager ERM Application Wan/ATMProbe NetMetrix Applications and Agents, continued LanProbe Table 1 ● ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ Requires up-to-date firmware on Notes the probe. Also works with IRA. Refer to DNA User’s Guide for details.
HP OpenView NetMetrix/UX User’s Guide Applications and Agents In This Book The following summarizes the HP OpenView NetMetrix/UX documentation set, which gives detailed information about the NetMetrix software suite. Document Description Installation Installation and configuration of the NetMetrix/UX software suite, including a troubleshooting section and information on licensing. Data Collector Reference Agent Manager, Agent Administration, Collector Daemon, Extended RMON Module (ERM).
HP OpenView NetMetrix/UX User’s Guide Applications and Agents 22 5967–9446
Contents User’s Guide Introduction 2 Reporter—At a Glance 6 Internetwork Monitor—At a Glance 8 Load Monitor—At a Glance 10 Protocol Analyzer—At a Glance 12 RMON Utilities—At a Glance 14 Applications and Agents 16 Reporter 35 Introduction 36 Graph Types 37 Required Data 42 Temporary Files 44 About LOW-CONTRIB, TCP-other, and UDP-other Reporter’s Web Interface 46 Baselines 47 What You Need 49 Running Reporter 45 50 To start Reporter in demonstration mode 51 To start Reporter 52 To display the results
User’s Guide Contents To learn more about Reporter To view the error log 59 To exit Reporter 60 Creating Reports 59 61 To create a new report from a sample report 62 To select data sources 64 To display the report on the screen 65 To save a sample report with a different name 66 To schedule a report and specify the output 67 To generate the report 69 To save a report 69 To create a new report from scratch 70 Manipulating Graphs 71 To add graphs to a report 72 To modify selected graphs 73 To remove a
User’s Guide Contents Component Health Graphs 114 To configure a Component Health graph 115 To Create Custom Component Categories 123 Scheduling Reports 125 To schedule on one day per week 126 To schedule at the same time on more than one day per week 127 To schedule on the same day and time for one or more months 128 To set a custom schedule 129 To suspend a report 131 To activate a suspended report 131 Setting Up Report Output 132 To send output to a printer 133 To send output to an X display 134
User’s Guide Contents Internetwork Monitor 161 Running Internetwork Monitor To access live data 164 To access archive files 166 To view the error log 169 To exit Internetwork Monitor 169 Viewing the Internetwork 170 163 Placement: Assigning Nodes to Segments 170 Views: Network Layer, MAC Layer, or Segment To set the placement method 172 Address Placement 172 Traffic Placement 175 To view end-to-end traffic patterns 176 To view traffic within and across segments 177 To view intersegment traffic patte
User’s Guide Contents To resize a segment ring 206 To collapse or expand a segment ring To rotate a segment ring 207 To move nodes 208 To tailor the graphical display 210 207 Launching Other Tools 212 To launch Load Monitor from Internetwork Monitor 213 To launch Protocol Analyzer from Internetwork Monitor 215 Traffic Profile Modeling 217 To create a model 218 To create a new segment ring in the view To manipulate a model 219 To save a model 225 To load a model 226 Interpreting the Internetwork View
User’s Guide Contents Working with Properties Files 242 To save properties in a file 243 To load a properties file 243 To tailor the default properties 243 Load Monitor 245 Running Load Monitor 247 To access extended RMON data 248 To access standard RMON data 251 To run Load Monitor for an archive file To view a different instance 256 To view the error log 256 To exit Load Monitor 257 Displaying Load 254 258 To open a view window 258 Special Entries: Others, LOW-CONTRIB, TCP-other, and UDP-other
User’s Guide Contents To sort data 293 To filter data 295 To set the Zoom layout 298 To change a graph’s appearance 299 To modify a graph’s scale 301 To save properties in a file 303 To load a properties file 303 To tailor the default properties 304 Statistics 305 Working with Collected Data 333 To print or save the graph(s) in the view window To print graph(s) in color 335 To print or save a text report 335 To load an archive file 336 Availability of Features 334 337 Extended RMON Data 338 Standa
User’s Guide Contents To arm an instance 355 To configure the capture buffer 356 To slice packets 357 To specify which network interface to use 357 To capture on multiple network interfaces simultaneously Building a Filter 358 360 Filter Component Windows 360 Filter Expression Language 361 To filter by host 362 Specifying Hosts 362 To filter by protocol 366 To filter by packet status 369 To filter by matching a pattern 371 To specify a filter expression 376 Filter Expression Syntax 376 Description of T
User’s Guide Contents To load a filter/settings file 400 To load the default filter/settings 401 To tailor the default filter/settings 402 To save properties in a file 403 To load a properties file 403 To tailor the default properties 404 Using the protanal Command Protocol Decodes 405 407 Alarms and Traps Configuring Traps 417 419 To manage trap groups 420 To add a trap group or destination 423 Network Trap Destinations 423 Serial Trap Destinations 425 To modify a trap destination 427 To remove a tr
User’s Guide Contents Live Statistics 455 Multi-Segment Statistics 457 To display multi-segment statistics Node Statistics 458 461 To display a graph of node statistics 462 To display a table of node statistics 465 To export statistics to a file 467 Traffic Matrix 468 To display the traffic matrix graph 469 To display Traffic Matrix as a table 472 To export statistics to a file 474 Historical Statistics Displaying Statistics 475 477 Available Statistics 478 Interpreting Data Loss 479 To displ
User’s Guide Contents Token Ring Applications 491 To display token ring status 493 To display token ring order 495 To display source routing statistics 497 To remove a station from the ring 498 To display token ring entry errors 500 To export token ring entry errors to a file Protocol Distribution 501 503 To display the distribution graph 505 Special Entries: Other, TCP-other, and UDP-other 506 To indicate how frequently to generate a new snapshot 507 To pause the application 508 To select the graph un
User’s Guide Contents Graphs and Tables 527 Working with Graphs 528 To control what statistics are shown and how 530 To change the display interval and resolution 532 To view statistics for the graph 534 To tailor the graph’s appearance 535 Working with Data Tables 537 To sort a table 538 To print a table 539 To save a table 539 Index 34 541 5967–9446
User’s Guide Reporter 5967–9446
Reporter Introduction HP OpenView NetMetrix/UX Reporter lets you create and schedule reports showing your network activity and responsiveness. Once you have configured a report, it is generated automatically, according to the schedule you set, without further intervention. A report consists of one or more graphs arranged on pages, using data collected from data sources and stored in data files on your management station.
Reporter Introduction Graph Types Reporter provides five basic types of graphs: ● Protocol Distribution graphs let you see the protocol mix on your network. You can request a graph showing all data in aggregate (a single data value for each protocol for the entire time span), or ask for a graph showing protocol use over time, using the interval you specify. In addition, you can limit the graph to the protocols used most often.
Reporter Introduction ● Component Health graphs show network component statistics over time, based on 5- or 30-minute intervals. In addition, you can choose to graph a baseline for a particular statistic. These graphs are based on data collected from network component MIBs by HP OpenView Network Node Manager’s snmpCollect utility. The available statistics depend on the component category. Reporter includes statistics for Cisco Routers, Cisco Router Interfaces, and Universal MIB.
Reporter Introduction Figure 9 Sample Report Showing Graph Types This sample report shows three of the basic graph types: Protocol Distribution, Top N, and Network Health For clarity, most reports shown in this chapter use fill patterns, rather than colors, and 2D graphs, rather than 3D. These characteristics are controlled with X resources configured in the Netm resources file. Refer to the file for details.
Reporter Introduction Figure 9 Sample Report Showing Graph Types, cont’d This sample report shows a Response Profile graph with average response time for two targets 40 5967–9446
Reporter Introduction Figure 9 Sample Report Showing Graph Types, cont’d This sample report shows a Component Health graph 5967–9446 41
Reporter Introduction Required Data Reporter bases its graphs on data collected from data sources on your network and stored in data files on the management station. In order to create reports, you first need to configure agents, data sources, and data collection in Agent Manager. Four types of data collection can be configured: ● RMON, which is based on the History group. For FDDI, RMON data collection is based on a History-like group in HP’s private MIB.
Reporter Introduction Table 2 Required Data for Graphs Graph Data Type Protocol Distribution mix of protocols in use Extended RMON Top N top talkers, top listeners, top conversation pairs Extended RMON Network Health: WAN, PVC link statistics over time; with or without baseline Extended RMON Network Health: Ethernet, Token-Ring, FDDI, full-duplex Fast Ethernet, ISL VLAN segment statistics over time; with or without baseline RMON Response Profile Response available only for HP-UX response and
Reporter Introduction Temporary Files Reporter uses temporary files for several purposes, including merging data from multiple data files, writing out X resources used to produce reports, and writing the report output. Temporary files are created in directory defined by the environment variable TMPDIR. If the variable does not exist, /var/tmp is used, and the bigM.* and ldmp.* are placed in the /var/tmp/netmrep hierarchy. Temporary files created by Reporter use the following file name formats: bigM.
Reporter Introduction Reporter cleans up its temporary files once they are no longer needed. (As discussed on page 137, a temporary report output file is not deleted automatically if the output is processed by a command.) You can suppress the clean up of temporary files by running Reporter with a debug logging level of 5. For details, refer to the man pages for reporter(1) and reportgen(1).
Reporter Introduction Reporter’s Web Interface Reporter includes a Web interface that provides World-Wide-Web access to reports generated automatically by Reporter. All of the Web-related Reporter files—including scripts, documentation and configuration information—are installed in the directory tree /usr/netm/www. The basic building block of Reporter’s Web interface is the domain. Each Reporter Web domain lets you publish usage reports for the local and wide area networks within that domain.
Reporter Introduction Baselines Reporter’s Network Health, Response Profile, and Component Health graphs include a baseline feature. Baselines are useful in determining what is normal for your network which, in turn, helps you identify abnormal events. This information is helpful, for example, when setting alarm thresholds. Reporter depicts the baseline as a colored area behind the line graph, which shows the actual data values for the selected statistic.
Reporter Introduction As mentioned, Reporter uses up to sixteen weeks of historical data to calculate the baseline. In addition, even if the graph itself is configured to use 30- or 300-second data, the baseline is calculated from 30-minute data. If sixteen weeks of data have not been collected, Reporter uses whatever data is available.
Reporter Introduction What You Need Before using Reporter, check the following: ❏ Verify that all of the data sources—including components and IRAs—that you want to use are defined in Agent Manager and that you have configured appropriate data collection for each. Refer to the Agent Manager chapter in Data Collector Reference for information about defining data sources and configuring data collection. Table 2 on page 43 lists the kind of data collection required for each Reporter graph type.
Running Reporter Reporter includes a graphical user interface that lets you define and schedule reports of network activity. To use Reporter to create and schedule reports based on your own network’s activity, ensure that you have checked the required items on the previous page. In particular, ensure that you are collecting data from the data sources you want to use with Reporter.
Reporter Running Reporter To start Reporter in demonstration mode ● From Agent Manager or OpenView NNM, choose Misc ➤ HP NetMetrix Demonstration ➤ Internetwork Reporting… Reporter’s demonstration mode lets you experiment with Reporter’s capabilities using sample data sources, network data, and report definitions. Demo mode does not require any agent, data source, data collection, or cron set up. When you start Reporter in demo mode, the demo version of the Report Status window opens.
Reporter Running Reporter To start Reporter ● Important From Agent Manager or OpenView NNM, choose Performance ➤ Internetwork Reporting… Before using Reporter with data sources on your network, ensure that you have checked the required items on page 49. When you start Reporter, the Report Status window opens. A sample of this window is shown in Figure 10 on page 53.
Reporter Running Reporter Figure 10 Report Status Window ➀ ➁ ➂ ➃ ➄ ➀ Menu bar: ➁ ➂ Report status area, with one report selected File Menu contains items to create a new report (page 70), open an existing report file (page 57) view the error log (page 59), and exit the application (page 60). Report Menu includes items that operate on one or more selected reports: modify (page 56), generate now (page 55) display now (page 54), and remove (page 58).
Reporter Running Reporter Note: When running the Reporter on Solaris 2.6, some warning messages can be displayed: Warning: Can’t load codeset file ‘C’ using internal fallback Warning: Cannot convert string “hpInsertline” to type VirtualBinding Warning: Cannot convert string “hpDeleteline” to type VirtualBinding These warning messages do not affect the Reporter’s performance; ignore these messages. Any new reports that you create will have no data sources selected.
Reporter Running Reporter To print a displayed report ● Click or choose File ➤ Print. When you display a report, each page of the report is shown in a grapher window, allowing you to see what the report will look like when printed. The grapher window includes a print function, which lets you print the report page in the window. When you print from the grapher window, the report page is sent to the printer configured in the report’s Schedule/Output Setup window.
Reporter Running Reporter To modify selected reports ● Double-click the report’s summary line in the status window. or Select one or more summary lines in the status window. 2 Click or choose Report ➤ Modify… 1 When you modify a report, the Report Definition window appears; a sample of this window is shown in figure 11 on page 63. You can then make the changes you want to the report and save them. See Also “To save a report” on page 69.
Reporter Running Reporter To open a report that’s not shown Click on the Status window’s toolbar or choose File ➤ Open… 2 Specify the report file name. 1 When you open a report, the Report Definition window opens, allowing you to modify the report. A sample of this window is shown in figure 11 on page 63. The report is added to the status window when you save it. The status window shows only those reports that have crontab entries. You may want to open a report that’s not currently scheduled in cron.
Reporter Running Reporter To create a new, blank report ● Click or choose File ➤ New… When you create a new report in this fashion, the report is initially blank—that is, it has no graphs or data sources defined. For information on specifying the parameters for a new report, refer to page 70. You can also create reports based on sample files provided with Reporter. For details, refer to page 61. “Creating Reports” on page 61. “To create a new report from scratch” on page 70.
Reporter Running Reporter To learn more about Reporter ● Click or choose Help ➤ On Tool… from either of Reporter’s main windows. Reporter’s help is an online version of this chapter. To view the error log ● Select File ➤ Error Log… If an error occurs, Reporter notifies you by displaying the error log, with the most recent error message visible. Error messages are generally selfexplanatory and suggest a corrective course of action where appropriate.
Reporter Running Reporter To exit Reporter ● Select File ➤ Exit. When you exit Reporter, all windows associated with it are closed, except for grapher windows opened by the Display Now and Generate Now functions.
Reporter Creating Reports Creating Reports Reporter lets you configure and schedule reports based on the network activity you want to see. To define a report, you choose the graphs to include, select the data sources for which to report, specify the output parameters, and set the report generation schedule. For convenience, a number of sample report files are provided. These reports consist of preconfigured graphs and output parameters; you choose the data sources and schedule.
Reporter Creating Reports To create a new report from a sample report 1 2 3 4 5 6 7 Verify that you meet Reporter’s prerequisites, listed on page 49. Click on the Status window’s toolbar or choose File ➤ Open… Select a sample report file from the directory /usr/netm/data/reporter_sample/. Identify the data sources to use for the report, as described on page 64. Click or choose Report ➤ Display Now… to check the report’s appearance. See page 65.
Reporter Creating Reports Figure 11 Report Definition Window Toolbar functions: saves the report to a file (page 69). cuts the selected graph(s) to the clipboard (page 74). copies the selected graph(s) to the clipboard (page 74). pastes the contents of the clipboard at the current location (page 74). displays the schedule/output window (page 67). generates the report now (page 69). displays the report on screen (page 65).
Reporter Creating Reports: Selecting Data Sources To select data sources ● Move data sources from the right list box to the left. The bottom area of the Report Definition window consists of two selection list boxes containing the data sources defined in Agent Manager. The left list contains the names of the data sources currently included in the report, if any. The right list contains the names of all other available data sources. Figure 12 shows a close-up view of the data source selection lists.
Reporter Creating Reports: Displaying To display the report on the screen ● Click or choose Report ➤ Display Now… To check the appearance of your report, use the Display Now function to display the report on your screen. Note that it is perfectly possible to create a report to run well into the future. As such, the data necessary to construct the report may not be available currently.
Reporter Creating Reports: Saving To save a sample report with a different name 1 2 Choose File ➤ Save As… Specify the new file name for the report definition. You can save a report into a different file name with the Save As… function—effectively making a copy of the original report. When you base your report on a sample file, be sure to use the Save As… feature to save the report with your modifications to a new file name.
Reporter Creating Reports: Schedule and Output To schedule a report and specify the output 1 2 Click or choose Report ➤ Schedule/Output Setup… Specify the schedule and output information. Once you have checked the appearance of your report, the next step is to define when the report should be generated and, if needed, change the report output parameters. The output parameters for a report are stored in the report file itself.
Reporter Creating Reports: Schedule and Output Figure 13 Schedule/Output Setup Window This example schedules the report to be generated every weekday at 6:30 pm, sending PostScript output to the printer with an lp command. For additional schedule/output examples, see pages 125 and 132.
Reporter Creating Reports: Schedule and Output To generate the report ● Click or choose Report ➤ Generate Now… To check the report output, use the Generate Now function to execute the report and send the report output to the configured destination—printer, file, screen, mail, or command. You can also access this function from the Report Status window, as discussed on page 55. “To generate selected reports now” on page 55.
Reporter Creating Reports To create a new report from scratch 1 2 3 4 5 6 7 8 Ensure that you meet Reporter’s prerequisites, listed on page 49. Click on the Status window’s toolbar or choose File ➤ New Report… Identify the data sources to use for the report, as described on page 64. Add one or more graphs to the report, as discussed on page 72. Indicate how many graphs per page, select the layout, and choose segment or multi-segment view. For details, see page 147.
Reporter Manipulating Graphs Manipulating Graphs A report consists of one or more graphs that show network activity. With Reporter, you can manipulate the graphs that comprise your reports in many ways: ● Add a new graph to a report, specifying the parameters (duration, statistics, targets) for the graph. ● Modify an existing graph’s parameters. ● Remove a graph from a report. ● Control the order of graphs in a report by inserting new graphs before existing graphs or cutting and pasting graphs.
Reporter Manipulating Graphs To add graphs to a report 1 2 or 3 4 Important If necessary, select the data source(s) for your report, as described on page 64. Click a graph icon on the toolbar: for Protocol Distribution for Top N for Network Health for Response Profile for Component Health Choose Graph ➤ Create GraphType… Configure the graph as needed, then push OK to add the graph icon to the Report Definition window. Repeat these steps until you have defined all the graphs you want in your report.
Reporter Manipulating Graphs Network Health graphs include Duration, Statistics, Exception, and Graph parameters. See page 83 for details. ● Response Profile graphs include Duration, Targets, Exception, and Graph parameters. See page 105 for details. ● Component Health graphs include Duration, Statistics, Exception, and Graph parameters. See page 114 for details. ● In addition to adding graphs to a report, you can cut or copy an existing graph and paste it, as described on page 74.
Reporter Manipulating Graphs To insert a new graph before an existing graph 1 2 Select the graph that will come after the new graph. Add the new graph, as described on page 72. To insert a new graph before an existing graph, select the existing graph, then add the new graph by clicking the appropriate graph icon on the toolbar or selecting from the Graph menu. After you have configured the graph’s parameters and pushed the OK button, the graph icon will appear before the icon you initially selected.
Protocol Distribution Graphs Protocol Distribution graphs let you see the protocol mix on your network. You can request a graph showing all data in aggregate (a single data value for each protocol for the entire time span), or ask for a graph showing protocol use over time, using the interval you specify. In addition, you can limit the graph to the protocols used most often. As discussed on page 42, Protocol Distribution graphs require extended RMON data.
Reporter Protocol Distribution Graphs To configure a Protocol Distribution graph Add or modify a Protocol Distribution graph, as described on page 72 and page 73, respectively. 2 Configure the Duration and Graph parameters as needed. 1 Protocol Distribution graphs include the following configuration parameters: ● Duration parameters set the dates and times to be included in the graph.
Reporter Protocol Distribution Graphs Figure 14 Protocol Distribution: Parameters and Sample Graph This example graphs all octet values for the top 8 protocols, using values for yesterday (no matter what day of the week it is) from 9 am to 5 pm, summing all data for each protocol into a single value.
Reporter Protocol Distribution Graphs Figure 14 Protocol Distribution: Parameters and Sample Graph, cont’d This sample Protocol Distribution graph was created with the Duration parameters shown at the top of the previous page. For clarity, most reports shown in this chapter use fill patterns, rather than colors, and 2D graphs, rather than 3D. These characteristics are controlled with X resources configured in the Netm resources file. Refer to the file for details.
Top N Graphs Top N graphs show the top talkers (source hosts), top listeners (destination hosts), or top pairs (conversations between two hosts). As with Protocol Distribution, you can request a graph showing all data in aggregate (a single data value for each talker, listener, or pair for the entire time span), or ask for a graph showing values over time, using the interval you specify.
Reporter Top N Graphs To configure a Top N graph Add or modify a Top N graph, as described on page 72 and page 73, respectively. 2 Configure the Duration and Graph parameters as needed. 1 Top N graphs include the following configuration parameters: ● Duration parameters set the dates and times to be included in the graph. Figure 15 on page 81 shows the Duration parameters for a Top N graph, along with corresponding sample graph output. ● Graph parameters determine the graph’s appearance.
Reporter Top N Graphs Figure 15 Top N: Parameters and Sample Graph This example graphs octet values for the top ten talkers, showing the top five protocols for each, using data from five days ago to today, ignoring data for Saturday and Sunday, limiting the data to the hours between 8 am and 6 pm.
Reporter Top N Graphs Figure 15 Top N: Parameters and Sample Graph, cont’d This sample Top N graph was created with the Duration parameters on the previous page.
Reporter Network Health Graphs Network Health Graphs Network Health graphs show network statistics over time, based on 30-second or 30-minute intervals. In addition, you can choose to graph a baseline for a particular statistic. You can also define exception criteria for Network Health graphs. If a graph meets the exception criteria, all of the graphs on the same page are generated. In other words, when activity is “normal” or unexceptional, no report page is generated.
Reporter Network Health Graphs To configure a Network Health graph Add or modify a Network Health graph, as described on page 72 and page 73, respectively. 2 Configure the Duration, Statistics, Exception, and Graph parameters as needed. 1 Network Health graphs include the following configuration parameters: ● Duration parameters set the dates and times to be included in the graph. Figure 16 on page 85 shows the Duration parameters for a Network Health graph, along with corresponding sample graph output.
Reporter Network Health Graphs Figure 16 Network Health: Parameters and Sample Graph This example graphs values for Utilization % and Total Errors for the period ending yesterday and going back three days, based on the 30-minute study.
Reporter Network Health Graphs Figure 16 Network Health: Parameters and Sample Graph, cont’d This sample Network Health graph was created with the Statistics and Duration parameters on the previous page.
Reporter Network Health Graphs Figure 17 Network Health with Baseline: Parameters and Sample Graph This example graphs total errors and total errors baseline (90% confidence) for the period between July 24 and July 29, 1995, based on the 30-minute study.
Reporter Network Health Graphs Figure 17 Network Health with Baseline: Parameters and Sample Graph, cont’d This sample Network Health graph with baseline was created with the Statistics and Duration parameters on the previous page.
Reporter Network Health Graphs: Statistics Table 3 Except for Utilization %, these statistics are shown in Network Health graphs as average units/second Network Health Statistics: FDDI Statistic Description Broadcasts+Multicasts Calculated from Data Broadcast Packets and Data Multicast Packets CRC Errors fddiMLHistoryCRCErrors Data 16 Bit Address Packets fddiPHistoryData16BitAddressPkts Data 48 Bit Address Packets fddiPHistoryData48BitAddressPkts Data Asynchronous Packets fddiPHistoryDataAsync
Reporter Network Health Graphs: Statistics Table 3 Network Health Statistics: FDDI, cont’d Statistic Description Reserved Octets fddiMLHistoryResOctets Reserved Packets fddiMLHistoryResPkts SMT Octets fddiMLHistorySMTOctets SMT Packets fddiMLHistorySMTPkts Total Errors Calculated from CRC Errors, Frame Error Reports, Link Error Rate Conditions, Duplicate Address, Peer Wrap Conditions, Port Path Changes, and Undesirable Connections Total Octets Calculated from MAC Octets, SMT Octets, Data Octe
Reporter Network Health Graphs: Statistics Table 4 Except for Utilization % and Maximum Active Stations, these statistics are shown in Network Health graphs as average units/second Network Health Statistics: Token Ring Statistic Description ARI/FCI (ACErrors) (I) tokenRingMLHistoryACErrors Abort Errors tokenRingMLHistoryAbortErrors Beacon Events tokenRingMLHistoryBeaconEvents Beacon Packets tokenRingMLHistoryBeaconPkts Beacon Time% tokenRingMLHistoryBeaconTime Broadcasts tokenRingPHistoryDat
Reporter Network Health Graphs: Statistics Table 4 Network Health Statistics: Token Ring, cont’d Statistic Description NAUN Changes tokenRingMLHistoryNAUNChanges Non-Isolating Errors Calculated from Lost Frame Errors, Congestion Errors, Frame Copied Errors, and Token Errors Ring Poll Events tokenRingMLHistoryRingPollEvents Ring Purge Events tokenRingMLHistoryRingPurgeEvents Ring Purge Packets tokenRingMLHistoryRingPurgePkts Soft Error Reports tokenRingMLHistorySoftErrors Token Errors (N) to
Reporter Network Health Graphs: Statistics Table 5 Except for Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: Ethernet Statistic Description Broadcasts etherHistoryBroadcastPkts Broadcasts+ Multicasts Calculated from Broadcasts and Multicasts CRC/Align etherHistoryCRCAlignErrors Collisions etherHistoryCollisions Error Rate Total Errors divided by Packets; lets you compare errors on s
Reporter Network Health Graphs: Statistics Table 6 * Statistic is shown in Network Health graphs as average units/second Network Health Statistics: T1/E1 Signaling Statistic Description Alarm Indication Signal Defect* Number of Alarm Indication Signal Defects or Blue Alarms. Bursty Errored Seconds Number of type B (bursty) errored seconds that occurred. Controlled Slip Seconds Number of seconds containing one or more controlled slips.
Reporter Network Health Graphs: Statistics Table 6 * Statistic is shown in Network Health graphs as average units/second Network Health Statistics: T1/E1 Signaling, cont’d Statistic Description Loss of Frame* Number of Loss of Frame (LOF) failures. A LOF is declared when an Out of Frame or Loss of Signal defect has persisted for 2–10 seconds (inclusive). Loss of MultiFrame* E1 only. Number of Loss of MultiFrame failures (LOMF).
Reporter Network Health Graphs: Statistics Table 6 * Statistic is shown in Network Health graphs as average units/second Table 7 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: T1/E1 Signaling, cont’d Statistic Description TS16 Alarm Indication Signal Failure* E1 only. Number of times when time-slot 16 is received as all ones for all frames of two consecutive multiframes.
Reporter Network Health Graphs: Statistics Table 7 Table 8 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: V-Series Signaling, cont’d Statistic Description In Utilization % Out Utilization % In Octets or Out Octets divided by the media speed, expressed as a percentage.
Reporter Network Health Graphs: Statistics Table 8 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: ATM Signaling, cont’d Statistic Description In SVC Connections Out SVC Connections Numbers of times an SVC VCC was established—that is, a call request was successful—for each direction.
Reporter Network Health Graphs: Statistics Table 8 Table 9 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: ATM Signaling, cont’d Statistic Description Total Errors Calculated from SCCOP Connections Events, SSCOP Errored PDUs, Route Unavailability Detected, Route Unavailability Transmitted, Resource Unavailability Detected, Resource Unavailability Transmitted, Unsuccessful C
Reporter Network Health Graphs: Statistics Table 9 Table 10 Except for Total Utilization %, In Utilization %, Out Utilization %, Estimated Up Time, and Estimated Down Time, these statistics are shown in Network Health graphs as average units/second Network Health Statistics: AAL/5 Data Link, cont’d Statistic Description In Oversized SDUs Out Oversized SDUs Number of AAL/5 SDUs that were too large, for each direction on the line.
Reporter Network Health Graphs: Statistics Table 10 Table 11 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: AAL/5 per-PVC Statistic RMON Object or Calculation In Octets Out Octets Number of octets for each direction on the PVC. In Oversized SDUs Out Oversized SDUs Number of AAL/5 SDUs that were too large, for each direction on the PVC.
Reporter Network Health Graphs: Statistics Table 11 Table 12 Except for Total Utilization %, In Utilization %, and Out Utilization %, these statistics are shown in Network Health graphs as average units/ second Network Health Statistics: PPP Data Link, cont’d Statistic Description In Long Frames Out Long Frames Number of frames that exceeded the MRU, for each direction on the line. In Octets Out Octets Number of octets for each direction on the line.
Reporter Network Health Graphs: Statistics Table 12 Table 13 Except for Total Utilization %, In Utilization %, Out Utilization %, Estimated Up Time, and Estimated Down Time, these statistics are shown in Network Health graphs as average units/second Network Health Statistics: Frame Relay Data Link, cont’d Statistic Description Total Frames Calculated from In Frames and Out Frames. Total Octets Calculated from In Octets and Out Octets.
Reporter Network Health Graphs: Statistics Table 14 Packets and Octets are shown in Network Health graphs as average units/second Network Health Statistics: High-Level LAN/WAN Statistic RMON Object or Calculation Octets Total number of octets seen for both directions on the line. Packets Total number of packets seen for both directions on the line. Utilization % Calculated from Octets and twice the media speed, expressed as a percentage.
Reporter Response Profile Graphs Response Profile Graphs Response Profile graphs show response measurement data over time for targets created by Internetwork Response Manager (IRM), using 5- or 30-minute intervals. You can choose to graph average response time, conformance of average response to a specified value, minimum and maximum response times, availability percentage, and retransmission percentage. In addition, you can choose to graph a baseline for a particular statistic.
Reporter Response Profile Graphs To configure a Response Profile graph Add or modify a Response Profile graph, as described on page 72 and page 73, respectively. 2 Configure the Duration, Targets, Exception, and Graph parameters as needed. 1 Important Response Profile graphs are available only for HP-UX and only if response data collection is configured. Response Profile graphs include the following configuration parameters: ● Duration parameters set the dates and times to be included in the graph.
Reporter Response Profile Graphs Figure 18 Response Profile: Parameters and Sample Graph This example graphs response data for Yesterday between 10:00 am and 6:00 pm, based on 5-minute intervals. Target parameters, including statistics, are shown on the next page.
Reporter Response Profile Graphs Figure 18 Response Profile: Parameters and Sample Graph, cont’d This example graphs average response times and conformance with a response threshold of 25 milliseconds for two specific targets, filesrv1 and filesrv2.
Reporter Response Profile Graphs Figure 18 Response Profile: Parameters and Sample Graph, cont’d This sample Response Profile graph was created with the Duration and Targets parameters on the previous pages.
Reporter Response Profile Graphs Table 15 Response Profile Statistics Response Statistic Description Average Response Time (ms) Total response time for the interval (5- or 30minute) divided by the number of successful tests, expressed in milliseconds. Note that unsuccessful tests are not included at all in the average response calculation. So, if the target was available throughout the interval, there will be no data point for Average Response Time for that interval.
Reporter Response Profile Graphs Table 15 Response Profile Statistics, cont’d Response Statistic Description Retransmission % Number of times a test was retransmitted (repeated) after an initial attempt timed out, shown as a percentage of the number of tests. Because it is shown as a percentage, this value is useful when comparing targets with different test intervals. *For LanProbes with firmware prior to that included in the 4.70 release and for IRAs prior to version 4.
Reporter Response Profile Graphs Target Names Target names in Reporter’s Response Profile graphs use a format like this: target_host_name–test_proto–test_row_num where target_host_name indicates the name of the target being tested, test_proto indicates the test protocol being used, and row_num is the row number of the test on the data source. The row_num is omitted if it is 1. For example: mailserver-ICMP-Echo-4 namesrv1-DNS-Lookup-6 filesrv1.corp.com-ICMP-Echo-2 127.127.255.
Reporter Response Profile Graphs separate graph. In this case, the statistics for each target from each testing data source will appear by itself. For example, if you have two different data sources performing response tests on the same two file server hosts, this scheme results in four graphs, one for the response results for each of the two file servers as tested by each of the two data sources.
Reporter Component Health Graphs Component Health Graphs Component Health graphs show component statistics over time, based on 5-minute or 30-minute intervals. In addition, you can choose to graph a baseline for a particular statistic. You can also define exception criteria for Component Health graphs. If a graph meets the exception criteria, all of the graphs on the same page are generated. In other words, when activity is “normal” or unexceptional, no report page is generated.
Reporter Component Health Graphs To configure a Component Health graph Add or modify a Component Health graph.If necessary, select the data source(s) for your report, as described on page 61. To add a graph: Click a graph icon on the toolbar for Component Health Choose Graph‰Create GraphType… 3 Configure the graph as needed, then push OK to add the graph icon to the Report Definition window. 4 Repeat these steps until you have defined all the graphs you want in your report.
Reporter Component Health Graphs Exception parameters indicate whether the graph is generated only when exceptional criteria are met. For details, see page 139. ● Graph parameters determine the graph’s appearance. For information on Graph parameters, refer to page 146.
Reporter Component Health Graphs Figure 19 Component Health: Parameters and Sample Graph This example graphs values for Utilization % and Total Errors for the period ending yesterday and going back five days, based on the 30-minute study.
Reporter Component Health Graphs Figure 19 Component Health: Parameters and Sample Graph, cont’d This sample Component Health graph was created with the Duration and Statistics parameters on the previous pages.
Reporter Component Health Graphs Table 16 Except for avgBusy5, freeMem, Cisco%BufferMisses, Cisco%BufferFailures , these statistics are shown in Component Health graphs as average units/second Component Health Statistics: Cisco Routers Statistic Description avgBusy5 Five minute exponentially decayed moving average of the CPU busy percentage. freeMem Amount of memory that is available in the managed device. Used to determine memory problems.
Reporter Component Health Graphs Table 17 Except for utilization% these statistics are shown in Component Health graphs as average units/second Component Health Statistics: Cisco Router Interfaces Statistic Description utilization% Calculated from ifInOctets, ifOutOctets, and ifSpeed. The calculation for utilization is performed by SNMPCollect and configured by netm+mibd as a MIB expression in the smnpCollect configuration.
Reporter Component Health Graphs Table 17 Component Health Statistics: Cisco Router Interfaces, cont’d Statistic Description locifInputQueueDrops Number of packets dropped because the input queue was full. locifOutputQueueDrops Number of packets dropped because the output queue was full. ifInDiscards Number of input or output packets received but discarded even though no errors were detected. This could be a result of a full input or output buffer.
Reporter Component Health Graphs Table 18 Except for utilization% these statistics are shown in Component Health graphs as average units/second Component Health Statistics: Universal MIB (MIB-II) Statistic Description utilization% Calculated from ifInOctets, ifOutOctets, and ifSpeed. The calculation for utilization is performed by SNMPCollect and configured by netm+mibd as a MIB expression in the smnpCollect configuration.
Reporter Custom Component Categories To Create Custom Component Categories Create a directory for each new component category under /usr/netm/data/archives/components. 2 Create a format file in each new directory to specify the collection metrics. 3 Configure data collection and create reports for the new category. 1 The directory name is based on its category type where spaces in the name are represented by the dot (.) character. The user can cut and paste MIB expressions from the mibExpr.
Reporter format file B and C being OIDs in the OpenView format. The OV OID format specifies OIDs always starting with `.’ and ending with a `.’ if an instance number is added. For MIB expressions exceeding the mibExpr.conf file character limit of 40 characters, use multiple lines with “#EXPR”. For example: #EXPR (COUNTER) .1.3.6.1.2.1.2.2.1.10. \ #EXPR (COUNTER) .1.3.6.1.2.1.2.2.1.16. + 8 * \ #EXPR (GAUGE) .1.3.6.1.2.1.2.2.1.5.
Reporter Scheduling Reports Scheduling Reports Reporter uses cron to generate reports according to the schedule you specify. Reporter’s scheduling window gives you an easy way to set the schedule, which is then translated into an entry for your crontab file. In particular, you can choose to schedule reports: ● Weekly: schedules the report for one day of the week, at the indicated time. ● Daily: schedules the report at a specific time on one or more days of the week.
Reporter Scheduling Reports To schedule on one day per week Click or choose Report ➤ Schedule/Output Setup… Select Generate Report Weekly. 3 Select the day of the week and indicate the time. 1 2 To generate a report once per week, use the weekly schedule option, shown in figure 20. Figure 20 Schedule: Weekly This example schedules the report each Sunday at 11:45 pm.
Reporter Scheduling Reports To schedule at the same time on more than one day per week Click or choose Report ➤ Schedule/Output Setup… Select Generate Report Daily. 3 Select the days of the week and indicate the time. 1 2 To generate a report on more than one day of the week at the same time, use the daily schedule option, shown in figure 21. Figure 21 Schedule: Daily This example schedules the report each weekday at 6:30 pm.
Reporter Scheduling Reports To schedule on the same day and time for one or more months Click or choose Report ➤ Schedule/Output Setup… Select Generate Report Monthly. 3 Select the day of the month and indicate the time. 1 2 To generate a report on the same day for one or more months, use the monthly schedule option, shown in figure 22. Figure 22 Schedule: Monthly This example schedules the report for the first day of each quarter (January, April, July, October) at 5 minutes past midnight.
Reporter Scheduling Reports To set a custom schedule Click or choose Report ➤ Schedule/Output Setup… Select Generate Report Custom. 3 Select the days of the week and days of the month, indicate the time, and set the months. 1 2 If the Weekly, Daily, and Monthly schedule options don’t suit your needs, specify a custom schedule, which lets you set any schedule supported by cron. An example is shown in figure 23 on page 130.
Reporter Scheduling Reports Figure 23 Schedule: Custom This example schedules the report for 6 am and 6 pm every day.
Reporter Scheduling Reports To suspend a report 1 2 Choose Report ➤ Suspend. Save the report by choosing File ➤ Save. Reporter lets you suspend a report, preventing its generation until you activate it. When a report is suspended, the entire report definition— parameters, schedule, output set-up—is maintained. For example, you might use this feature to prevent a report from being generated during a site shutdown.
Reporter Setting Up Report Output Setting Up Report Output When defining reports, you can choose the report output format and where the output should be sent. Reports can be generated in three output formats: ● PostScript: the report is rendered in the PostScript page description language. With PostScript output, all Reporter formatting features are preserved. ● Text: the data for each graph in a report is represented as an ASCII text table, no matter what graph style (bar, pie, etc.) is selected.
Reporter Setting Up Report Output To send output to a printer Click or choose Report ➤ Schedule/Output Setup… Select Output to Printer. 3 Specify the output format: PostScript, XWD, or Text. 4 Indicate the command for printing the report. 1 2 To send a report to a printer, use the Printer option, shown in figure 24.
Reporter Setting Up Report Output To send output to an X display Click or choose Report ➤ Schedule/Output Setup… Select Output to Screen. 3 Indicate the X display. 1 2 To send a report to an X display, use the screen option, shown in figure 25. Figure 25 Output to X display This example sends the report to the output to the X display mickey:0.
Reporter Setting Up Report Output To save output in a file Click or choose Report ➤ Schedule/Output Setup… Select Output to File. 3 Specify the output format: PostScript, XWD, or Text. 4 Indicate the file name in which to save the report. 1 2 To save a report to a file, use the File option, shown in figure 26. Figure 26 Output to a File This example saves XWD output to the file /usr/reports/weeklyrpt.xwd.
Reporter Setting Up Report Output To send output as electronic mail Click or choose Report ➤ Schedule/Output Setup… Select Output to Mail. 3 Specify the output format: PostScript, XWD, or Text. 4 Indicate the destination (email address) for the report. 1 2 To send a report as electronic mail, use the Mail option, shown in figure 27. Figure 27 Output to Electronic Mail This example sends text output to the user reports@mickey.
Reporter Setting Up Report Output To process output with a command Click or choose Report ➤ Schedule/Output Setup… Select Output to Command. 3 Set the output format: PostScript, XWD, or Text. 4 Specify the command for processing the report output. 1 2 If the Printer, Screen, File, and Mail output options don’t suit your needs, you can specify a command to process report output. An example is shown in figure 28 on page 138.
Reporter Setting Up Report Output Figure 28 Output to a Command This example processes XWD output through two NetPBM utilities that convert the image to GIF format, storing the result in a file with a name that reflects the start date for the report. To create the file name, the $STARTDATE variable’s value is piped through a sed command that substitutes hyphens for the slashes in the date. The result is a GIF file with a name such as 06-15-95.gif.
Reporter Exception Reporting Exception Reporting Exception reporting lets you configure reports such that pages are generated only when exceptional criteria are met. In other words, when activity is “normal” or unexceptional, no report page is created. You define the exception criteria, which can be based either on a specified threshold value for a particular statistic or on the baseline envelope for a statistic.
Reporter Exception Reporting To define a graph’s exception criteria 1 2 3 4 5 Add or modify a Network Health, Response Profile, or Component Health graph, as discussed on page 83, page 105, and page 114, respectively. Choose Exception parameters. Indicate whether to define the exception based on a Static Threshold or Auto-Adjusting Baseline. For Static Threshold, select the statistic, choose the direction, indicate the threshold value, and set the number of consecutive data points.
Reporter Exception Reporting Figure 29 Exception Parameters Select the type of exception The available fields depend on which exception type you choose You can choose AutoAdjusting Baseline only if the baseline is configured in the Statistics/Targets parameters For Static Threshold, select the statistic, choose the direction (above or below), indicate the threshold value, and set the number of consecutive threshold violations Available statistics depend on the Statistics/Targets parameters Indicate the
Reporter Exception Reporting Because 10% of past data fall outside of the baseline, then if 10% or less of the data in the reporting period falls out of the baseline, the data is normal when compared with the past data from which the baseline is calculated. To highlight unusual data, then, enter an exception percentage number greater than 100% minus the confidence level.
Reporter Exception Reporting Table 19 Exception Criteria: Network Health and Component Health graphs Report Scope Auto-Adjust Baseline Static Threshold Segment View allowed check data source Multi-Segment View not allowed check each data source* *Each data source in the graph is matched to the exception criteria. If any data source is deemed exceptional, the graph is generated with data for all data sources.
Reporter Exception Reporting Designing report pages As described on page 139, exception criteria are evaluated on per-graph basis, but the entire page containing the exceptional graph is either generated or not generated, depending on whether the criteria are met. This scheme allows you to see other information—perhaps Top N or Protocol Distribution graphs, which don’t have exception criteria—only when a Network Health, Response Profile, or Component Health graph on the same page is deemed exceptional.
Reporter Exception Reporting When defining supporting graphs for an exception Response Profile graph, configure the Response Profile graph to show all targets in one graph. Otherwise, it is harder for you to design the report so that supportive graphs are on the same page as the graph with exception. To disable a graph’s exception criteria Modify the Network Health or Response Profile graph, as discussed on page 73. 2 Choose Exception parameters. 3 Choose Disabled.
Reporter Tailoring a Report’s Appearance Tailoring a Report’s Appearance Reporter gives you extensive control over the appearance of your reports. The following pages describe Reporter features that let you tailor the way your reports look: ● Page layout parameters, which let you set a page header and footer, control how many graphs to place on each page and in what layout, and select whether data from multiple data sources should be shown in each graph or separate graphs.
Reporter Tailoring a Report’s Appearance To set the page layout parameters Indicate how many graphs to include on each page of the report and the layout for the graphs on the page. 2 Specify the page header and footer text. 3 Indicate whether to generate each data source’s data in a separate graph or combine all the data sources’ data in one graph. 1 In addition to defining the graphs that comprise your report, you can set the page layout for the report output.
Reporter Tailoring a Report’s Appearance When defining the page header and footer, you can include variables that are replaced when the report is generated. Table 21 on page 149 lists these variables. Special Variables: DISPLAY, LPDEST, PRINTER Reporter lets you reference several variables from your environment, including DISPLAY, LPDEST, and PRINTER. However, these variables may not be defined when the report is generated via cron.
Reporter Tailoring a Report’s Appearance Table 21 Graph Variables These variables are evaluated on a pergraph basis. When specified in the page header or footer, the values for the last graph on the page are used. Reporter Variables Variable Name Description Example of Value AGENTS Data source name(s) shown in graph; when specified in page header/ footer, value shows all data sources represented on page lp:1, lp:2, lp:3, walt.nashua.hp.
Reporter Tailoring a Report’s Appearance Table 21 Graph Variables (cont’d) Reporter Variables, cont’d Variable Name Description Example of Value BASELINESTAT Network Health, Response Profile, or Component Health statistic used for baseline Utilization % Average Response Time (ms) BASELINETARGET Response Profile only: the target used for baseline walt-ICMP-Echo-2 DURATION Amount of time shown in the graph; available only when specifying duration with the Ending On format 3 days 2 weeks EXCEPTI
Reporter Tailoring a Report’s Appearance Table 21 Graph Variables (cont’d) Reporter Variables, cont’d Variable Name Description Example of Value STARTTIME Start date and time for report in the format mm/dd/yy hh:mm 06/23/95 09:00:00 End date for report in the format mm/dd/yy 06/24/95 STOPTIME End date and time for report in the format mm/dd/yy hh:mm 06/23/95 17:00:00 TARGETS Response Profile only: Target name(s) shown in graph; when specified in page header/footer, value shows all targets rep
Reporter Tailoring a Report’s Appearance Table 21 Output Variables These variables are relevant primarily for the output area of the Schedule/ Output Setup window, discussed on page 132.
Reporter Tailoring a Report’s Appearance To change the graph settings In the Report Definition window, select the icon for the graph you want to modify. 2 Click or choose Report ➤ Modify… 3 Choose the Graph button in the graph definition screen. 4 On the left side of the graph definition screen, press the icon button for the graph settings you want to change.
Reporter Tailoring a Report’s Appearance Figure 31 Graph Settings Windows and Sample Graph The following Top Talkers graph was formatted with the graph settings shown on the following pages. The circled numbers show the correspondence between the graph element and the parameter that controls its appearance.
Reporter Tailoring a Report’s Appearance Figure 31 Graph Settings Windows and Sample Graph, cont’d ➀ Graph Style Select from six graph styles: table, bar, stacked bar, line, area, and pie. Refer to page 158 for details. Use to display the results of your changes Leave the text field blank to suppress an axis label ➁ Graph Axes Specify text for the X and Y axis labels and choose a font. You can include Reporter variables in the labels; see page 149 for a list.
Reporter Tailoring a Report’s Appearance Figure 31 Graph Settings Windows and Sample Graph, cont’d Leave the text field blank to suppress the graph header You can specify a font name or use the font browser; refer to page 160 ➂ Graph Header Specify the text, font, and border style for the graph header Variables are listed on page 149 Use to display the results of your changes Border styles are shown on page 157 Leave the text field blank to suppress the graph footer You can specify a font name or use
Reporter Tailoring a Report’s Appearance Figure 31 Graph Settings Windows and Sample Graph, cont’d Use to display the results of your changes You can specify a font name or use the font browser; refer to page 160 ➄ Graph Legend Specify the font, location, and border style for the graph legend Border Styles 5967–9446 157
Reporter Tailoring a Report’s Appearance To specify the graph style Display the graph settings for the graph you want to modify, as described on page 153. 2 Click on the graph style icon. 3 Select the format to use. 1 Reporter lets you graph data using any of six different graph styles: Table Line graph Bar graph Area graph Stacked bar graph Pie graph Tables are not supported for XWD output. Some graphs work best with certain graph styles and don’t work well with others.
Reporter Tailoring a Report’s Appearance Table 22 Usefulness of Graph Styles Graph Type Graph Description Useful Graph Styles (Default is given first) Protocol Distribution Aggregate, single segment Pie, Bar, Stacked Bar, Table Aggregate, multi-segment Pie, Bar, Stacked Bar, Table Time Interval, single segment Pie, Bar, Stacked Bar, Table Area, when showing all protocols Time Interval, multi-segment not allowed Aggregate, single segment Bar, Table Aggregate, multi-segment Bar, Stacked Bar,
Reporter Tailoring a Report’s Appearance To select a font Display the graph settings for the graph you want to modify, as described on page 153. 2 Click on the graph axes, header, footer, or legend icon button. 3 Specify a font name or push the Select… button to display the font selector. 1 When specifying a font for the graph axes, header, footer, or legend, you can give an X font name (as displayed by the xlsfonts command), or you can use the font selector, shown in figure 32.
User’s Guide Internetwork Monitor 5967–9446
Internetwork Monitor Internetwork Monitor lets you monitor network load on multiple segments of an internetwork and integrate the data from these segments into one logical view. This internetwork view provides a comprehensive picture of network activity, both with live data and historically. You can control and configure many different aspects of the view in order to analyze and finetune your network. In addition, you can easily play “what if” with your network’s topology.
Running Internetwork Monitor Internetwork Monitor can be run in several different ways: ● Live data sources using Extended RMON Internetwork Monitor constructs an integrated view based on data collected by Extended RMON Modules (ERMs) and extended data sources. ● Archive Files Internetwork Monitor displays an integrated view of past network activity as archived in files by NetMetrix Load Monitor or the collector daemon. These methods are discussed on the pages that follow.
Internetwork Monitor Running Internetwork Monitor To access live data From Agent Manager or OpenView NNM, select the data source(s) to use. 2 Choose Performance ➤ Internetwork Traffic… 3 If needed, select the interface(s) to use. 1 OpenView NNM The OpenView NNM Internetwork Monitor menu item is context sensitive. To launch against an ERM, ensure that the host’s symbol indicates the agent type.
Internetwork Monitor Running Internetwork Monitor Figure 33 Internetwork Monitor, Live Data ➀ Agent Manager starts Internetwork Monitor ➁ Internetwork Monitor communicates with ERM over the network using SNMP (solid lines) If the display is not local to Agent Manager host, X protocol traffic from both Agent Manager and Internetwork Monitor will travel on the network host ➀ Agent Manager Internetwork Monitor X display data source X network monitoring segment ➁ SNMP traffic network ERM data sources se
Internetwork Monitor Running Internetwork Monitor Extended RMON Module chapter in Data Collector Reference. See Also To access archive files ● Give the command: inetmon –file_list filespec1 filespec2 … In addition to viewing live network data, you can use Internetwork Monitor to create an integrated view based on data in one or more extended RMON archive files.
Internetwork Monitor Running Internetwork Monitor Figure 34 Internetwork View Window ➀ ➁ ➅ ➃ ➆ ➂ ➄ ➇ ➈ ➀ Toolbar gives quick access to common ➆ “Collapsed” segment ring, which appears ➁ ➂ ➇ ➃➄ ➅ functions; see close-up on the next page. Current time interval. Segment ring, as reported by a data source, ERM instance, or archive file; lines represent traffic flow between nodes and segments. Labels showing node and line information. Protocols shown in the current view.
Internetwork Monitor Running Internetwork Monitor Figure 34 Internetwork View Window, continued ➀ ➁ ➂ ➀ ➃ ➄ Menu bar: File Menu contains items to create, load, or save a model (page 217); save or recall configuration settings (page 242); print the current data graphically or as a text report (page 237); and view the error log (page 169). Report Menu displays the current data as a text table (page 182).
Internetwork Monitor Running Internetwork Monitor To view the error log ● Select File ➤ Error Log… If an error occurs, Internetwork Monitor notifies you by displaying the error log, with the most recent error message visible. Error messages are generally self-explanatory and suggest a corrective course of action where appropriate. All errors for a given Internetwork Monitor process are collected in a file called netm.errlog.pid, where pid is this Internetwork Monitor’s process ID.
Internetwork Monitor Viewing the Internetwork Viewing the Internetwork When you run Internetwork Monitor, it constructs an internetwork view that shows integrated network traffic data from the current data sources. The integrated data is displayed graphically. Nodes are assigned to segment rings, and lines connect nodes and segments. As discussed on page 187, line colors and thickness indicate the relative contribution of a particular line’s traffic. The data can also be displayed as a tabular report.
Internetwork Monitor Viewing the Internetwork Views: Network Layer, MAC Layer, or Segment For either placement method, you can choose to view the integrated data in several ways: ● Network layer view shows end-to-end traffic patterns, letting you see past the effects of connecting equipment such as bridges and routers. ● MAC layer view, while based on end-to-end network-layer data, preserves the MAC layer activity within and between segments.
Internetwork Monitor Viewing the Internetwork To set the placement method ● Choose Address or Traffic from the toolbar’s placement pop-up. or Select Properties ➤ Data Collection Properties… 2 Choose the Traffic button, if necessary. 3 Change the Placement by property. 1 By default, Internetwork Monitor places nodes on segment rings based on network addresses. You can choose to base the node placement on traffic analysis instead, if you prefer.
Internetwork Monitor Viewing the Internetwork Figure 35 Placement Method: Address and Traffic Address Placement In this example, Internetwork Monitor is running against two data sources— mickey and palo-alto. Nodes with addresses 15.58.98.* are assigned to the paloalto ring, and nodes with 15.59.144.* to the nashua ring. Someone on the palo-alto ring is talking with node 15.56.225.36. The Agent Manager database includes a data source, csprings, whose IP address+subnet mask matches 15.56.225.
Internetwork Monitor Viewing the Internetwork Figure 35 Placement Method: Address and Traffic, continued Traffic Placement This view shows the same network traffic as the example on the previous page; however, the placement method has been changed to Traffic. Internetwork Monitor is running against two data sources—mickey and paloalto. Nodes are assigned to the palo-alto and nashua rings based on traffic analysis.
Internetwork Monitor Viewing the Internetwork With address-based placement, names for segment rings are also derived from the network addresses. For each ring, Internetwork Monitor checks the Agent Manager database for a data source using the same network number or with the same IP address after applying the subnet mask. If a data source is found, the segment uses that name for the segment name. If no data source is found, then the segment name reflects the network address.
Internetwork Monitor Viewing the Internetwork To view end-to-end traffic patterns ● Choose Network layer from the toolbar’s view type pop-up. or Select Properties ➤ View Properties… 2 Change the View Type property to Network layer. 1 By default, the Internetwork Monitor shows the MAC layer view. To focus on end-to-end traffic between hosts, change the View Type to Network layer, either from the toolbar or from the View Properties window.
Internetwork Monitor Viewing the Internetwork To view traffic within and across segments ● Choose MAC layer from the toolbar’s view type pop-up. or Select Properties ➤ View Properties… 2 Change the View Type property to MAC layer. 1 By default, the Internetwork Monitor shows traffic at the MAC layer, which lets you focus on how traffic gets from one segment to another.
Internetwork Monitor Viewing the Internetwork To view intersegment traffic patterns ● Choose Segment from the toolbar’s view type pop-up. or Select Properties ➤ View Properties… 2 Change the View Type property to Segment. 1 By default, Internetwork Monitor shows intrasegment traffic as well as segment-to-segment traffic. To focus on the traffic between segments, change the View Type to Segment, either from the toolbar or from the View Properties window.
Internetwork Monitor Viewing the Internetwork Figure 36 Network Layer, MAC Layer, and Segment Views Choose the Network layer view type from the toolbar Each line represents end-to-end traffic between two nodes This view does not attempt to show you how the traffic actually gets from one node to another 5967–9446 179
Internetwork Monitor Viewing the Internetwork Figure 36 Network Layer, MAC Layer, and Segment Views, continued Choose the MAC layer view type from the toolbar Traffic between segment rings flows through connector points—bridges or routers.
Internetwork Monitor Viewing the Internetwork Figure 36 Network Layer, MAC Layer, and Segment Views, continued Choose the Segment view type from the toolbar Each segment ring is collapsed into a segment icon Traffic between each pair of segments is shown as a single line 5967–9446 181
Internetwork Monitor Viewing the Internetwork To view the data values being displayed ● Click the Data Report icon on the toolbar. or ● Choose Report ➤ Data Report… In addition to viewing the integrated data graphically, you can see the underlying data values by looking at the data report. For details on how the traffic data is integrated for the data report, refer to page 227.
Internetwork Monitor Viewing the Internetwork Figure 37 Data Report: Segment, Network, and MAC Views Click the Data Report icon in the toolbar Format of data report depends on the current view type Segment View Current data field; see page 194 Segment names for a segment pair shown in the graph 5967–9446 Total traffic values for each pair and each direction: Segment 1 to Segment 2 and vice versa 183
Internetwork Monitor Viewing the Internetwork Figure 37 Data Report: Segment, Network, and MAC Views, continued Network Layer View Current data field; see page 194 Host names for a traffic pair shown in the graph Total traffic values for each pair and each direction: Host 1 to Host 2 and vice versa Host 1’s segment Host 2’s segment Report is divided into sections for segment-to-segment and intra-segment data Click to select a line in the data report; the corresponding traffic line is selected (dashe
Internetwork Monitor Viewing the Internetwork Figure 37 Data Report: Segment, Network, and MAC Views, continued MAC Layer View Current data field; see page 194 Host names for a traffic pair shown in the graph Total traffic values for each pair and each direction: Host 1 to Host 2 and vice versa Host 1’s segment Host 2’s segment Report is divided into sections for segment-to-segment and intra-segment data Click to select a line in the data report; the corresponding traffic line is selected (dashed) i
Internetwork Monitor Viewing the Internetwork Figure 37 Data Report: Segment, Network, and MAC Views, continued Click to select a traffic line; the data report’s corresponding line is highlighted 186 5967–9446
Internetwork Monitor Viewing the Internetwork Color and Line Styles The internetwork view uses color and line thickness to represent the relative amount of network traffic for each line, node label, and segment ring. Colors and line thickness are based on the reference value for the items in the display. For traffic lines, Internetwork Monitor computes the total bidirectional traffic value for each line in the view; the busiest line’s value becomes the reference value for lines.
Internetwork Monitor Viewing the Internetwork Icons in the internetwork view Network nodes are represented in the internetwork view by icons on segment rings. These node icons fall into several general categories: ● Vendor icons show a two- or three-letter acronym identifying a specific vendor as determined by the first part of the MAC address. The icons at left represent equipment from HP, Sun Microsystems, and Cisco. ● A question mark icon is used when the vendor is unknown.
Controlling the Data in the View Internetwork Monitor includes several options that let you control the data being viewed and the amount of data brought from data sources during a poll. By limiting the amount of data, you can minimize the network traffic generated by Internetwork Monitor itself and improve the tool’s performance. These data control options are divided into four groups: Time, Traffic, Filter, and Monitor. Time options let you: – Pause the view, suspending any traffic updates.
Internetwork Monitor Controlling the Data in the View To pause the view ● Click the Pause icon on the toolbar. or Select Properties ➤ Data Collection Properties… 2 Choose Time. 3 Set the Time Mode to Paused. 1 Pausing the display is useful when traffic pattern shows something of interest and you want to prevent an update from altering the display. Push the Pause icon on the toolbar to pause; push it again to resume.
Internetwork Monitor Controlling the Data in the View To change the displayed time interval Select Properties ➤ Data Collection Properties… Choose Time. 3 Choose the Time Mode to use. 4 Change the Interval, Start, and End fields as necessary. 1 2 The Time data collection properties let you specify a time range for which Internetwork Monitor shows network data. Figure 38 shows the Time data collection properties.
Internetwork Monitor Controlling the Data in the View You can choose from the following time modes. Delta Displays data values for the period between the last update and the current update. Usually, this period is the same as the value specified in the Update Frequency field. However, the first display after starting the application or applying changes to the properties will show data values from the earliest time available to the current time.
Internetwork Monitor Controlling the Data in the View To change how often graphs are updated Select Properties ➤ Data Collection Properties… Choose Time. 3 Change the Update Frequency property to reflect how often to update the view. 1 2 The Update Frequency property indicates how often, in seconds, to update the information in the internetwork view; this interval determines how often Internetwork Monitor polls live data sources to retrieve data.
Internetwork Monitor Controlling the Data in the View To change what data is displayed Select Properties ➤ Data Collection Properties… Choose Traffic. 3 Select Octets or Packets from the Data option pop-up. 4 Check the per second toggle button to display rates. 1 2 The Data Collection properties let you control how Internetwork Monitor collects and displays data. Figure 39 shows the Traffic data collection properties.
Internetwork Monitor Controlling the Data in the View To set the threshold ● In the toolbar, set the threshold value and type. or Select Properties ➤ Data Collection Properties… 2 Choose Traffic. 3 Choose the type of threshold. 4 Set the threshold value. 1 Thresholding determines the number of end-to-end (network-layer) traffic reports or conversations that are retrieved from each data source, thus determining how many nodes and lines are displayed in the internetwork view.
Internetwork Monitor Controlling the Data in the View You can choose from several threshold mechanisms. None Disables thresholding. This option causes the most amount of network traffic, the most cluttered graphical display, and the slowest performance when viewing live data. Use this option with caution. Count Limits the number of traffic reports from each data source to the most active.
Internetwork Monitor Controlling the Data in the View To filter data by protocol 1 2 Select Properties ➤ Filter… Specify the protocol(s) on which to filter traffic data. You can limit the internetwork view to traffic values for a specified set of protocols. The data report for each pair of end-to-end nodes will reflect only the traffic that matches the protocol(s) you choose. When you choose Properties ➤ Filter…, a window like the one shown in figure 41 on page 198 appears.
Internetwork Monitor Controlling the Data in the View Protocols… Opens a selection list window from which you can choose protocols. The selection list is based on sysprotolist and the built-in protocol map. Remove from List To remove an item from the filter, select it from the protocol list box, then click the Remove from List button.
Internetwork Monitor Controlling the Data in the View To enable monitoring for a new data source 1 2 Choose Monitor ➤ Enable… Specify the data source to enable in the view. or Select a segment ring whose labels indicates a data source for which to enable monitoring. 2 Choose Monitor ➤ Enable… to enable monitoring for the selected segment.
Manipulating the View Internetwork Monitor lets you manipulate the internetwork view window in a variety of ways. Specifically, you can: ● Choose whether to display node, line, and segment labels, which give a brief description of the selected items. ● Display information boxes for nodes, lines, and segments; these boxes give detailed information about the selected items. ● Move and resize segment rings (node groups). ● Collapse or expand segment rings. ● Rotate segment rings.
Internetwork Monitor Manipulating the View To select items The following table summarizes how to select items in the Internetwork Monitor graphical view. Task Action To select a node, line, segment icon, or segment ring (node group) Click on the node, line, or segment. You can also select lines from the data report, as discussed on page 182. To select an additional node, line, or segment Shift-click on the node, line, or segment.
Internetwork Monitor Manipulating the View To display labels One Node/Line ● Double-click on the node or line. All Nodes ● Choose View ➤ Labels ➤ All Nodes On. All Lines ● Choose View ➤ Labels ➤ All Lines On. Selected 1 Transient ● Select the nodes and lines for which to display labels. 2 Choose View ➤ Labels ➤ Selected On. Ctrl-click on the node, line, or segment. In the graphical view, you can display labels for nodes and lines.
Internetwork Monitor Manipulating the View To remove labels One Node/Line ● All ● Selected 1 2 Double-click on the node or line whose label you want to remove. Choose View ➤ Labels ➤ Remove All. Select the nodes and lines for which to remove labels. Choose View ➤ Labels ➤ Selected Off. To display information boxes Select the nodes, lines, and segments for which to display information boxes.
Internetwork Monitor Manipulating the View Figure 42 Labels and Info Boxes Transient label for segment; use Ctrl–Click to display Selected line; Info box shown below Node labels (one node is selected, one isn’t) Use arrow keys to rotate a selected segment ring Line label Clients are arranged opposite Servers (Layout Policy property, see page 210) Selection handle Info box for selected line shown above Info boxes for the segment ring and selected node shown above 204 5967–9446
Internetwork Monitor Manipulating the View To move a segment ring or icon ● Use mouse button 2 to drag the ring or icon to its new location. You can relocate segment rings and segment icons within the graphical view. Using mouse button 2, click on the ring or icon, then drag it to a new location. A shadow of the ring or icon highlights as you move it, as shown in figure 43. When clicking on the segment ring, you can click on the ring, the ring label, or within the ring (but not on a traffic line).
Internetwork Monitor Manipulating the View To resize a segment ring 1 2 Select the segment ring. Using mouse button 2, click on a selection handle and drag the ring to its new shape and size. You can resize segment rings within the graphical view. Select the segment ring so that the selection handles are visible. Using mouse button 2, click on a selection handle, then drag the ring to its new size. A shadow of the ring highlights as you drag the mouse, as shown in figure 43.
Internetwork Monitor Manipulating the View To collapse or expand a segment ring ● ● Double-click on a segment ring to collapse it into a single icon. Double-click on a segment ring icon to expand it. In the MAC layer and Network layer graphical views, you can collapse and expand segment rings by double-clicking on the segment (ring or icon) to toggle its current state. Figure 34 on page 167 shows several collapsed segment rings.
Internetwork Monitor Manipulating the View To move nodes One Node ● Many Nodes 1 Using mouse button 2, click on a node and drag it to the new location. Select the nodes you want to move. 2 Using mouse button 2, click on any of the selected nodes. 3 Drag the nodes to the new location. In the MAC layer and Network layer views, you can move nodes within a segment ring or from one ring to another.
Internetwork Monitor Manipulating the View Figure 45 Moving a Node Use mouse button 2 to drag a node to a new location; the mouse pointer changes to the node icon The node stays in its original location until you release the mouse button As the node is dragged, nearby drop zones are highlighted To cancel a move in progress, press Esc When the mouse button is released, the node’s position is updated See Also “Traffic Profile Modeling” on page 217. “Interpreting the Internetwork View” on page 227.
Internetwork Monitor Manipulating the View To tailor the graphical display 1 2 Select Properties ➤ View Properties… Change the properties as needed. View properties let you control several aspects of the graphical display, Figure 46 shows the view properties window.
Internetwork Monitor Manipulating the View Node Label Indicates the format for node labels and for nodes in the data report. Choose any or all of the following: Host Name translates addresses to names. Example: bigbird.hp.com. If the name is not available (via gethostbyname or the sysnodelist file), MAC address format is used. Network Address shows the node’s network-layer address. Examples: 128.204.1.20, 120:14. Network address formats are listed in table 23.
Launching Other Tools Internetwork Monitor includes the ability to select an item in the internetwork view, then launch Load Monitor or Protocol Analyzer using the context of the selected item and the internetwork view properties.
Internetwork Monitor Launching Other Tools To launch Load Monitor from Internetwork Monitor Select one host, conversation, or entire segment in the actual view (not a model). 2 Choose Tools ➤ Network Analysis… or use mouse button 3 to select from the pop-up menu. 1 When you launch Load Monitor from Internetwork Monitor, the context of the internetwork view is passed along to the Load Monitor view.
Internetwork Monitor Launching Other Tools Table 24 Launching Load Monitor from Internetwork Monitor Item Selected in Internetwork View Time Properties* Host (node) Earliest Since yes or no Delta Range Incremental Paused yes or no Earliest Since yes Protocol ➞ Conversation ➞ Time no Conversation ➞ Protocol ➞ Time Delta Range Incremental Paused yes or no Time ➞ Conversation ➞ Protocol any yes or no Time ➞ Protocol ➞ Conversation Selected host is Zoom focus point in Load Monitor Source gr
Internetwork Monitor Launching Other Tools To launch Protocol Analyzer from Internetwork Monitor 1 2 Select one host or conversation. Choose Tools ➤ Packet Analysis… or use mouse button 3 to select from the pop-up menu. When you launch Protocol Analyzer from Internetwork Monitor, the context of the internetwork view is passed along to the Protocol Analyzer application. Table 25 on page 216 describes this context, which depends on the selected item and the current filter.
Internetwork Monitor Launching Other Tools Table 25 Launching Protocol Analyzer from Internetwork Monitor Item Selected in Internetwork View Protocol Filter? Host (node) yes ToFrom the selected host AND protocol filter from Internetwork Monitor. no ToFrom the selected host. yes Between the two hosts for the conversation AND protocol filter from Internetwork Monitor. no Between the two hosts for the conversation.
Traffic Profile Modeling Internetwork Monitor’s powerful traffic profile modeling feature lets you easily play “what if” with your internetwork, based on actual network data. A model is a copy of the internetwork view. Once you create a model, you can manipulate it without changing the original view, allowing side-byside comparisons between your actual network traffic patterns and the model.
Internetwork Monitor Traffic Profile Modeling To create a model ● Click the Create Model icon on the toolbar. or ● Choose File ➤ Create Model… When you create a model, a new internetwork view window appears. The new window is initially identical to the existing view window except for the title bar. To create a new segment ring in the view Choose View ➤ Create Node Group… 2 Specify a name for the new segment.
Internetwork Monitor Traffic Profile Modeling To manipulate a model ● ● ● ● Change the view properties, including whether the view type is Network layer, MAC layer, or Segment. Create new segment rings. Move nodes. Move, resize, collapse, expand, and rotate segment rings. Once you have created a model, you can manipulate it in a number of ways without affecting the original view.
Internetwork Monitor Traffic Profile Modeling Example 1 While viewing two segments, you notice a node on each segment— hpntdna.nashua.hp.com and minnie.nashua.hp.com—that is talking only to nodes on the other segment. You want to see if moving these nodes makes sense for your network by creating a model and viewing the results. Figure 47 on page 221 illustrates the steps in this example.
Internetwork Monitor Traffic Profile Modeling Figure 47 Example 1: Creating and Manipulating a Model Network layer view of two segments with the two nodes selected Click the icon to create a new model; a new view window based on the original view appears In the model, move the first node, hpntdna, from the Engineering segment to the Marketing segment The model view now looks like this 5967–9446 221
Internetwork Monitor Traffic Profile Modeling Figure 47 Example 1: Creating and Manipulating a Model, continued Move the second node, minnie, from the Marketing segment to the Engineering segment The model view now looks like this The original view remains unchanged; it still looks like this Any traffic updates or changes to the data collection properties will affect both the model and the original view 222 5967–9446
Internetwork Monitor Traffic Profile Modeling Example 2 One of your network segments is approaching overload, so you decide to create a model to determine the best arrangement for a new segment. To do so, you bring up an internetwork view against the busy segment, create a new model, add a new segment ring, and move nodes from the busy segment to the new segment until you are satisfied with the results. Figure 48 on page 224 illustrates the steps in this example.
Internetwork Monitor Traffic Profile Modeling Figure 48 Example 2: Creating and Manipulating a Model Network layer view of the busy segment Two server nodes are selected, hpnshaa and bambi Click the icon to create a new model; a new view window based on the original view appears In the model, create a new segment ring, called “new_segment” After moving server hpnshaa and all its clients to the new ring, the model view looks like this The original view remains unchanged Any traffic updates or changes to
Internetwork Monitor Traffic Profile Modeling To save a model Click the Save Model icon on the toolbar or choose File ➤ Save Model… 2 Specify a name for the model. 1 When you save a model, its properties, node-to-segment assignments, and traffic data are saved, each in a separate file. The model name you specify lists the files associated with model. A model’s file names all start with the name you specify, and an extension indicates the file type.
Internetwork Monitor Traffic Profile Modeling To load a model Click the Load Model icon on the toolbar or choose File ➤ Load Model… 2 Indicate the name of the model to load. 1 When you load a model, a new view window is opened. This new window reflects the information stored in the model, including traffic data, node placement, and properties. The original view and the model view are both paused.
Interpreting the Internetwork View To construct the graphical view, Internetwork Monitor looks at the endto-end network-layer traffic data from each data source according to the current filter and threshold settings. Each node is assigned to a segment based on the current placement method, Address or Traffic, as discussed on the next page. Next, Internetwork Monitor integrates the data based on the current view type: Segment, Network layer, or MAC layer.
Internetwork Monitor Interpreting the Internetwork View Address Placement Address-based placement assigns each node to a segment based on the node’s network address: ● For IP addresses, the subnet mask for the host running Internetwork Monitor is applied to node addresses. All nodes with the same address after applying the mask are assigned to the same segment. You can change the subnet mask used by Internetwork Monitor by setting the environment variable NETM_SUBNET_MASK before starting the application.
Internetwork Monitor Interpreting the Internetwork View Interconnect Devices After all end-point nodes are assigned to segments according to the placement method, interconnect devices are discovered and placed based on their MAC addresses; this process is discussed in detail on page 233. Internetwork Monitor creates non-routing interconnect devices (called “pseudo-devices”) as needed and adds them to the segment map.
Internetwork Monitor Interpreting the Internetwork View Data Integration, Network Layer View To construct the Network layer view, Internetwork Monitor collates the network-layer end-to-end traffic reports (conversations) and checks the node-to-segment assignments. Because the internetwork view is based on network-layer conversations, any node running more than one protocol stack will appear multiple times in the view (subject to thresholding and filtering).
Internetwork Monitor Interpreting the Internetwork View Data Integration, Segment View To construct the Segment view, Internetwork Monitor computes the segment-to-segment data by assigning end-to-end network-layer conversations to segment pairs. It then presents the total traffic for each segment pair. Data values from pairs of end points within the same segment are combined to tally the intrasegment traffic.
Internetwork Monitor Interpreting the Internetwork View Figure 49 Calculating Segment Traffic End-to-end traffic (Network layer view), with nodes A – F assigned to segments S1, S2, and S3 S1 A S3 E B F C Segment-toSegment: S1↔S2 = B↔C + B↔D S1↔S3 = A↔E S2 D Intrasegment: S1: A↔B S3: E↔F Segment view of traffic S1 A↔E S3 B↔C + B↔D S2 232 5967–9446
Internetwork Monitor Interpreting the Internetwork View Data Integration, MAC Layer View To construct the MAC layer view, Internetwork Monitor uses the end-toend network-layer conversations to compute intrasegment and segmentto-segment data values. End-to-end traffic pairs with both end points on the same segment are added to the intrasegment traffic data list.
Internetwork Monitor Interpreting the Internetwork View In this case, Internetwork Monitor assumes that nodes R1 and R2 are routers. The data report for intrasegment traffic will show entries for A↔R1 and C↔R2; the segment-to-segment traffic will include the A↔B traffic in the S1↔S2 segment pair’s data. Figure 50 illustrates this example.
Internetwork Monitor Interpreting the Internetwork View Non-Routed Traffic When Internetwork Monitor cannot determine that traffic is routed, it constructs connector nodes, called pseudo-devices, on the segments. In particular, pseudo-devices are added when: ● The network layer shows a conversation pair’s end points on different segments. and ● The MAC layer also shows the end points on different segments.
Internetwork Monitor Interpreting the Internetwork View Figure 51 End-to-end traffic (Network layer view), with nodes A, B, C, and D assigned to segments S1 and S2 Handling Non-Routed Traffic A C S1 S2 B D Corresponding MAC addresses for intersegment endpoint pairs A↔C, A↔D, and B↔D reveal no routers, so pseudo-devices P1 and P2 are created for segments S1 and S2 MAC layer view of traffic, showing pseudo-device placement Network-Layer End Points A↔B A↔C A↔D B↔D MAC-Layer End Points Pseudo-Device E
Printing and Saving Data Internetwork Monitor lets you print and save the load statistics for your network for future reference. The following pages explain how to: ● Print or save the graphical view in color or black and white. ● Print or save the data report as a text report.
Internetwork Monitor Printing and Saving Data To print or save the graphical view Click the Print icon on the toolbar or choose File ➤ Print… 2 Specify Graph output. 3 Choose the Output Format and Source. 4 Choose Printer or File, then specify either a printer name or a file name. 1 Internetwork Monitor lets you print or save the current graphical view. Several output formats are supported. When saving to a file, a file extension corresponding to the output format is appended to the file name you specify.
Internetwork Monitor Printing and Saving Data Figure 52 Printing Graphs from NetMetrix Tools START does NETM_PRINT_COLOR exist? yes no convert image to black and white Notes • NETM_PRINT_COLOR, NETM_output_OPTIONS, NETM_XPR_COMMAND, and NETM_PRINT_COMMAND are all environment variables recognized by Internetwork Monitor. • The netm_xwd and netm_xpr utilities are based on xwd and xpr; some modifications were made to allow printing a segment graph that is not completely visible.
Internetwork Monitor Printing and Saving Data Table 26 Supported Printer Formats Output Format File Extension Environment Variable for netm_xpr Options PostScript .PS NETM_POSTSCRIPT_OPTIONS HP LaserJet .ljet NETM_HP_LASER_JET_OPTIONS HP PaintJet .pjet NETM_HP_PAINT_JET_OPTIONS HP PaintJet XL .pjetxl NETM_HP_PAINT_JET_XL_OPTIONS DEC LA100 .la100 NETM_DEC_LA100_OPTIONS DEC LN03 .ln03 NETM_DEC_LN03_OPTIONS IBM PP3812 .pp NETM_IBM_PP3812_OPTIONS X Window Dump .
Internetwork Monitor Printing and Saving Data To print or save the data report Click the Print icon on the toolbar or choose File ➤ Print… 2 Specify Text output. 3 Choose Printer or File, then specify either a printer name or a file name. 1 Internetwork Monitor lets you print or save the data report. If you save the data to a file, the extension .txt is automatically appended to the file name you specify.
Working with Properties Files Internetwork Monitor lets you configure view properties so that you can see just the network statistics that interest you. This configuration information can be saved in files for future use. The following page explains how to: ● Save view properties, including selected nodes and lines, in a file. ● Load properties from a file. ● Tailor the default properties to suit your needs.
Internetwork Monitor Working with Properties Files To save properties in a file 1 2 Choose File ➤ Save Properties… Specify the file in which to save the current properties. When you save properties, all of the items configured with the Properties menu are saved in the file you specify. In addition, the size of the Internetwork Monitor window is saved, as are the currently selected nodes and lines. To load a properties file 1 2 Choose File ➤ Load Properties… Specify the properties file to load.
Internetwork Monitor Working with Properties Files 244 5967–9446
User’s Guide Load Monitor 5967–9446
Load Monitor NetMetrix Load Monitor lets you monitor the traffic on your network. Specifically, you can: ● Monitor network use over extended periods. ● See how load and performance vary over time. ● Analyze which systems interact. ● Develop profiles of the network for later comparison when it goes awry. ● Learn how much load each network application is generating. ● Display network traffic data in graphical form. This chapter explains how to use Load Monitor to look at traffic patterns on your network.
Running Load Monitor Load Monitor lets you view statistics regarding network load, either by working with a live data source monitoring your network or by loading statistics previously saved in an archive file. Depending on the capabilities of live data sources, you can view two types of data: ● Extended RMON data NetMetrix RMON extensions provide access to network-layer statistics in the Load Monitor views.
Load Monitor Running Load Monitor To access extended RMON data Select one or more extended data sources. Select an item from the Performance ➤ Network Analysis ➤ Extended RMON ➤ or the Performance ➤ Network Views ➤ menu. 3 If needed, select the interface to use. Agent Manager OpenView NNM 1 Internetwork Monitor 1 Availability 2 Select a host (node) or conversation.
Load Monitor Running Load Monitor The view window shows data from the selected data source. Depending on how you launched Load Monitor, you may be able to select a different data source within the application, as discussed on page 256. When communicating with an ERM, you can display views based on data from any of the ERM’s associated data sources.
Load Monitor Running Load Monitor Figure 53 Load Monitor, extended RMON data Extended RMON Module ➀ Agent Manager starts Load Monitor ➁ Load Monitor communicates with the ERM (solid line) host host ➀ Agent Manager ERM Load Monitor shared memory X X If the display is not local to Agent Manager host, X protocol traffic from both Agent Manager and Load Monitor will travel on the network display erm_rmond erm_netmd data source info ➁ SNMP traffic network segment segment ERM data sources send net
Load Monitor Running Load Monitor “To view a different instance” on page 256. “Displaying Load” on page 258. “Availability of Features” on page 337. “Launching Other Tools” on page 212. Extended RMON Module chapter in Data Collector Reference. See Also To access standard RMON data In Agent Manager or OpenView NNM, select one or more RMON data sources. 2 If necessary, initialize the agent’s RMON tables. 3 Select an item from the Performance ➤ Network Analysis ➤ RMON ➤ menu.
Load Monitor Running Load Monitor Figure 54 Load Monitor, standard RMON data ➀ Agent Manager starts Load Monitor on Agent Manager host ➁ Load Monitor communicates with agent over the network using SNMP If the display is not local to Agent Manager host, X protocol traffic from both Agent Manager and Load Monitor will travel on the network host ➀ Agent Manager Load Monitor X display X RMON agent network monitoring ➁ SNMP traffic network An RMON agent other than an HP probe may not have the appropriate
Load Monitor Running Load Monitor Table 27 Load Monitor Launch Options and Corresponding Zoom Paths Menu Item Network Analysis ➤ Extended RMON ➤ Zoom Correlation Statistics Over Time Top Sources Top Destinations Top Conversations Top Protocols Packet Size Distribution Display Control RMON ➤ Statistics Over Time Top Sources Top Destinations Top Conversations Packet Size Distribution Display Control Archive File Network Views ➤ Capacity Per Application Conversation Per Application Usage Per Host Capacity P
Load Monitor Running Load Monitor To run Load Monitor for an archive file Command Line ● Internetwork Monitor 1 Give the command: loadmon –datafile filespec While viewing archive files, select a host (node) or conversation. 2 Choose Tools ➤ Network Analysis… When you start Load Monitor from the command line, the specified archive file is loaded, and a view window is automatically opened. When you launch Load Monitor from Internetwork Monitor, Load Monitor is launched against the relevant archive file.
Load Monitor Running Load Monitor Figure 55 Load Monitor Base Window Choose items from the View menu to display graphs of network load Base window menus, summarized below Status area gives information about the current data source, including its name, type, number of intervals completed, how long it has been running, number of packets, error packets seen, and average percent utilization File Menu contains items to load data from an archive file and view the error log.
Load Monitor Running Load Monitor To view a different instance 1 2 Push the Attach… button in the base window. Choose the instance you want from the selection list and push OK. When you launch Load Monitor, it attaches to the instance you selected (or the default instance for the data source) and displays that instance in any view window. When you attach to a different instance, any open view window showing live data is updated to reflect the newly-attached instance.
Load Monitor Running Load Monitor All errors for a given Load Monitor process are collected in a file called netm.errlog.pid, where pid is this Load Monitor’s process ID. The file is placed in the temporary directory defined by the environment variable TMPDIR, if this variable exists; otherwise, the file is placed in /usr/tmp. You can view the contents of the error log at any time by selecting File ➤ Error Log… from either the base window or the view window.
Load Monitor Displaying Load Displaying Load When you launch Load Monitor, a view window showing network load is automatically displayed (unless you chose the Display Control menu item). You can display as many view windows as you like for an instance, perhaps configuring each to display the data from a different perspective, or using different views to compare live data to an archive file. The following pages explain how to view load statistics and manipulate the display to show the information you want.
Load Monitor Displaying Load Special Entries: Others, LOW-CONTRIB, TCP-other, and UDP-other Load Monitor graphs may include some special entries: others, LOW-CONTRIB, TCP-other, and UDP-other. The others item accounts for hosts or protocols that do not meet the current view’s threshold. You control the threshold and whether the others item is shown, as discussed on page 295.
Load Monitor Displaying Load Figure 56 View Window: Source and Time Graphs Current data source (Live, Archive) Average for the sort field (Octets), based on the items shown Shows the number of selected items in this graph and the total number for which statistics are available Column to the left of Y axis reflects current tabular fields (Octets) Data values for graphical fields are shown as a bar graph Node names are shown when they can be resolved Legend (at bottom of graph) shows current graphical
Load Monitor Displaying Load Figure 56 View Window: Source and Time Graphs, continued Current data source (Live, Archive) Shows the number of selected data points in this graph and the total number for which statistics are available Average Utilization % for the data points shown in the graph Graph scale Data values for graphical fields are shown as a line graph Legend (at bottom of graph) shows current graphical fields: Utilization, Total Errors, Multicasts, and Broadcasts For details on: • Changing
Load Monitor Displaying Load To use Zoom Select View ➤ Zoom… from the base window. Use the Zoom pop-up menus to insert, delete, or exchange items in the Zoom path. 3 Double click in a graph to set its Zoom focus point. 1 2 Availability The Zoom… menu item requires NetMetrix RMON extensions; it is not available when accessing standard RMON data. For standard RMON data, some Zoom paths are allowed, depending on which RMON groups are supported by the agent. Refer to page 264 for further information.
Load Monitor Displaying Load Figure 57 Default Zoom View: Time ➞ Source ➞ Destination Current Zoom path and pop-up menus Use pop-ups to change the path Zoom path graphs Double-click in a graph to select Zoom focus point. The graph title and a dashed line indicate the current zoom point. Subsequent graphs in the path are updated to show their status at the selected zoom point(s) Zoom Layout is This property is discussed on page 298 The examples beginning on page 268 illustrate the utility of Zooming in.
Load Monitor Displaying Load Zoom Elements and Paths Availability The availability of Zoom elements and the Zoom paths you can construct depend on whether you are viewing extended or standard RMON data; for standard RMON, the available Zoom paths also depend on which RMON groups the agent supports. All Zoom elements and paths are supported when viewing extended RMON data. For standard RMON data: – The Protocol element is not available. – The Time element requires the Statistics and History groups.
Load Monitor Displaying Load Time Network load as a function of time. By default, Time is shown as a plot or line graph. Size Percentage of network traffic for different size ranges. Size can be correlated only with Time when constructing Zoom paths. By default, Size is shown as a bar graph. Zoom Pop-Up Menus Each of the elements in the Zoom path has a pop-up menu associated with it; items on these menus let you change the current Zoom path. The menus contain the following items.
Load Monitor Displaying Load Useful Zoom Paths Table 28 summarizes some useful zoom paths.
Load Monitor Displaying Load Table 28 See Also Useful Zoom Paths, continued To determine this… Use this Zoom path… what source nodes are sending to which destination nodes, and how their usage varies over time Source ➞ Destination ➞ Time which sources are using routers and bridges and what protocols they are using Destination ➞ Source ➞ Protocol (Source and Destination data properties configured to include MAC layer traffic) “To search for a data point” on page 274.
Load Monitor Displaying Load Example 1 To find out what nodes are sending and receiving data during peak network usage, run Load Monitor against an ERM data source. Select View ➤ Zoom… from the base window. The default Zoom path is Time ➞ Source ➞ Destination. This Zoom path lets you determine what source node is talking to which destination node at any available time interval.
Load Monitor Displaying Load Figure 58 shows that at time interval 06/20 15:30:00 – 16:00:00, source node sun-train7 was communicating with sun-train3, sun-train6, sun-train8, sun-train5, and other destination nodes. Note the dashed lines, graph titles, and Zoom focus point description.
Load Monitor Displaying Load Example 2 Now, let’s say you also want to see what protocols are being used by these source and destination nodes during peak usage. 1 Choose Destination ➤ Insert After ➤ Protocol. The Protocol pie graphs appear. There may be a slight delay in the display of the pie graph. 2 Double click on a destination node. A dashed line appears through the selected destination node’s bar.
Load Monitor Displaying Load Figure 59 Sample Zoom View: Time ➞ Source ➞ Destination ➞ Protocol Zoom path and current focus points reflect addition of Protocol graph Pie graphs show which protocols were used by source sun-train7 and destination sun-train6 at time interval 15:30:00 – 16:00:00 Zoom Layout is This property is discussed on page 298 5967–9446 271
Load Monitor Displaying Load To view a Conversation segment graph 1 2 Select Conversation ➤ Properties ➤ Graph… Change the Graph Type to Segment. A useful way to view traffic between nodes is with Load Monitor’s conversation segment graph. A segment graph provides a two-dimensional visual representation of the network. Nodes are displayed as icons on a ring, with traffic between the nodes represented by lines of various thickness and color.
Load Monitor Displaying Load Figure 60 Conversation Segment Graph Click to toggle node and line labels (Show Labels property, page 300 Use mouse button 2 to display label temporarily Label shows 2.25 Octs from piggy to walt, 4.
Load Monitor Displaying Load To search for a data point Choose Search…, Search ➤ Node…, or Search ➤ Pair… from the Zoom pop-up menu. 2 Specify the value you want to find. 1 The search function lets you locate a data point of interest in plot and bar graphs. (You cannot search for items in pie or segment graphs.) Each of the Zoom path elements has a search function; the items in the search window depend on which element’s graph you are searching.
Load Monitor Displaying Load Protocol Search Window Protocol Indicates the protocol to find. Protocols… Displays a selection list from which you can choose the protocol to find.
Load Monitor Displaying Load To expand or contract the X or Y axis Select a range in the graph by using mouse button 1 and mouse button 2 within the graph area at the beginning and end of the range. 2 Click mouse button 3 on the graph area, then choose Expand or Contract from the graph pop-up menu. X Axis 1 Y Axis 1 Select a range in the graph by using mouse button 1 and mouse button 2 to the left of the graph area at the beginning and end of the range.
Load Monitor Displaying Load Figure 61 on page 278 shows a time graph with an X-axis range selected and a source graph with a Y-axis range selected. Once a range is selected, click mouse button 3 on the graph area to display the graph pop-up menu, and choose either Expand or Contract. The Default Scale option returns the display to its default scale values, thus undoing any Expand or Contract operation.
Load Monitor Displaying Load Figure 61 Effects of Expand X Axis: Time Graph Lines indicate selected range With Expand, points within the selected range are expanded to fill the visible graph area Same graph after an Expand shows that the points within the selected range are expanded to fill the visible graph area 278 5967–9446
Load Monitor Displaying Load Figure 61 Effects of Expand, continued Y Axis: Source Graph Horizontal lines indicate selected range With Expand, bars within the selected range are expanded to fill the visible graph area Same graph after an Expand shows that the six bars within the selected range are expanded to fill the visible graph area 5967–9446 279
Load Monitor Displaying Load Figure 62 Effects of Contract X Axis: Time Graph Vertical lines indicate selected range With Contract, points within the visible graph area are contracted to fit the selected range Same graph after a Contract shows that the points within the graph area above are contracted to fit within the selected range 280 5967–9446
Load Monitor Displaying Load Figure 62 Effects of Contract, continued Y Axis: Source Graph Horizontal lines indicate selected range With Contract, bars within the visible graph area are contracted to fit the selected range Same graph after a Contract shows that the ten bars within the graph area above are contracted to fit the space of the six bars in the selected range 5967–9446 281
Load Monitor Displaying Load To accumulate time values with the graph pop-up Select a range in the Time graph by using mouse button 1 and mouse button 2 within the graph area at the beginning and end of the range. 2 Click mouse button 3 on the graph area, then choose Accumulate from the graph pop-up menu. 1 Load Monitor includes the ability to accumulate data points in the Time graph, combining several points into a single point.
Load Monitor Displaying Load Example For example, if the marked range of a time graph includes fifteen points and each point represents two minutes of data, the new accumulated graph will show each point as 30 minutes of data. Figure 63 shows before and after views for this example.
Load Monitor Changing Properties Changing Properties Load Monitor includes many properties that let you control the graphical displays. These properties are divided into two major groups: Data properties and Graph properties. Each Zoom element has its own data and graph properties. Once you have configured the data and graph properties to your liking, you can save them in a file for future use, as described on page 303.
Load Monitor Changing Properties Figure 64 Data Properties: Source Filter properties screen out unwanted data values; see page 295 Display properties control what fields are shown and the format to use for node addresses and user information; see page 289 This property controls how often graphs are updated for live views; see page 288 Sort properties control the order of items within the graphs; see page 293 5967–9446 285
Load Monitor Changing Properties Graph Properties Graph properties let you control the appearance of the graphs. You can: ● Choose the type of graph: plot, bar, pie, or segment; specify whether to display a grid; and select two- or three-dimensional. graphs. ● Control what scale is used, what units to display, and when to update the scale. ● Specify the number of data points to display in a Time graph and whether to combine several points into one.
Load Monitor Changing Properties Figure 65 Graph Properties: Conversation Display properties control the graph appearance; see page 299 Segment properties are available for the Conversation segment graph; see page 299 Scale properties affect the graph’s scale (X axis for Time graph, Y axis for others); see page 301 Zoom layout specifies how the graphs are arranged in the view window See page 298 This layout is shown in figure 59 on page 271 5967–9446 287
Load Monitor Changing Properties To change how often graphs are updated Select Properties ➤ Data… from any Zoom pop-up menu. 2 Change the Global Update Interval data property to reflect how often to update graphs. 1 The Update Interval property indicates how often, in seconds, to update the graphs in the view window. Changing this interval affects all displayed graphs.
Load Monitor Changing Properties To change what data fields are displayed Select Properties ➤ Data… from the appropriate Zoom pop-up menu. 2 Change the Display data properties as needed. 1 Display data properties let you control what fields are shown in the graph and the format to use for node addresses. The available options depend on which Zoom element’s properties you are changing. Figure 66 shows the display data properties for the Destination graph.
Load Monitor Changing Properties You can change the following display data properties. Show Data (Time graph) Determines how often data points are added to the Time graph when viewing live data. For Each Update Interval (Live Statistics) adds a data point each time the graph display is updated. The default update interval is 30 seconds. (Changing the update interval is discussed on page 288.) For Each Collection Interval (Historical Statistics) adds a point for each collection interval from the agent.
Load Monitor Changing Properties Host Traffic Indicates whether to show Network Layer traffic, MAC Layer traffic, or both. When displaying both Network and MAC layer traffic for items such as routers that don’t have a network layer address, data values are distributed across all the network layer addresses that the MAC layer address services. Network Layer traffic is available only when viewing extended data.
Load Monitor Changing Properties Figure 67 Effects of Display Data Properties on Source Graph Source graph’s display data properties, including selection lists for tabular and graphical fields ➀ ➁ ➂ ➃ Graph shows effects of display data properties ➀ ➁ ➂ ➃ ➄ ➀ MacHost column shows MAC layer nodes as names; note that two addresses couldn’t be resolved ➁ NetHost column shows Network layer nodes as numeric addresses 292 ➂ Three tabular fields are shown for each node, as indicated by the column he
Load Monitor Changing Properties To sort data Select Properties ➤ Data… from the appropriate Zoom pop-up menu. 2 Change the Sort data properties as needed. 1 Sort properties let you control the order of items within all graphs except Time. Figure 68 shows the sort properties for the Conversation graph.
Load Monitor Changing Properties Sort By Indicates how to sort the entries in the graph. This field has no effect when viewing a pie graph. Descending Cum sorts on cumulative data values from largest value to smallest, placing the largest values closest to the graph axis. Descending Delta sorts on changes in data values (from one update interval to the next) from largest value to smallest, placing the largest values closest to the graph axis.
Load Monitor Changing Properties To filter data Select Properties ➤ Data… from the appropriate Zoom pop-up menu. 2 Change the Filter data properties as needed. 1 Filter data properties let you screen out unwanted data values, letting you focus on the information you want to see. The available filter options depend on which Zoom element’s properties you are changing. Figure 69 on page 297 shows the Filter data properties for the Source graph. You can change the following Filter data properties.
Load Monitor Changing Properties Threshold Sets a threshold for the graph. Threshold works with the Sort By and Sort On Field values to determine which entries are displayed. (Sort properties are discussed on page 293.) Count limits the number of entries in the graph to the value specified, based on the Sort By and Sort Field properties.
Load Monitor Changing Properties Figure 69 Filter Data Properties, Filter Window, and Selection List Displays a filter window (shown below); lets you include or exclude specific items (standard RMON data only) Sets a threshold to restrict the number of entries in the graph Displays an “others” item in the graph, which includes the total for all items not shown individually (extended data only) Type in this text field and press Return to add hosts to the list Current list Choose from this option pop-up
Load Monitor Changing Properties To set the Zoom layout Select Properties ➤ Graph… from any Zoom pop-up menu. 2 Change the Global Zoom Layout graph property to reflect how to arrange graphs in the view window. 1 The Zoom Layout property specifies how the graphs in the Zoom path are arranged within the view window. Choose one of the icons represents. to use the tiling scheme it Figure 57 on page 263 shows the effect of the page 271 shows the effect of the layout. layout.
Load Monitor Changing Properties To change a graph’s appearance Select Properties ➤ Graph… from the appropriate Zoom pop-up menu. 2 Change the graph properties as needed. 1 You can change the following properties to tailor a graph’s appearance; the available fields and choices depend on which Zoom element’s properties you are changing. Graph Type Indicates a Bar , Plot , Pie , or Segment graph.
Load Monitor Changing Properties Interval Specifies whether to show labels on the Time graph’s horizontal scale as Absolute (actual) time or Relative to the start of data collection. In either case, the time label at the graph origin shows hours, minutes, and seconds. The following intervals show only the minutes until the hour changes, when the label again shows hours, minutes, and seconds. (The Time graph in figure 59 on page 271 shows an example of these labels.
Load Monitor Changing Properties To modify a graph’s scale Select Properties ➤ Graph… from the appropriate Zoom pop-up menu. 2 Change the Scale graph properties as needed. 1 You can change the following Scale graph properties. The available fields and choices depend on which Zoom element’s properties you are changing. Type Specifies the display of data values within the graphs. Units shows data values expressed as raw numbers in the appropriate units.
Load Monitor Changing Properties Update Specifies when to change the graph scale. Increment/Decrement recomputes both the scale’s maximum and minimum values at each graph update and changes the scale as necessary. Increment recomputes only the scale’s maximum value at each graph update and changes the scale as needed. Fixed sets the scale at the current values and doesn’t change them.
Load Monitor Changing Properties To save properties in a file 1 2 Choose File ➤ Save Properties… from the view window. Specify the file in which to save the current properties. Choose File ➤ Save Properties… from the view window to save the current data and graph properties in a file. When you save properties, all of the items configured with the graph and data properties items for all of the Zoom elements are saved in the file you specify.
Load Monitor Changing Properties To tailor the default properties Choose the view window size, Zoom path, and Zoom focus points you want. 2 Configure graph and data properties for all of the Zoom elements. 3 Choose File ➤ Save Properties… from the view window. 4 Specify the file name loadmon.view.default in the NetMetrix search path. 1 To have the current properties be the Load Monitor’s defaults, specify the file name loadmon.view.default in the NetMetrix search path.
Load Monitor Statistics Statistics The tables on the following pages describe the statistics that can be viewed in Load Monitor graphs. For each media type, the statistics available in the Time graph are shown, followed by the statistics available in other graphs. Statistics are listed for the following media types: ● Ethernet (page 306). ● FDDI (page 308). ● Token Ring (page 311). ● T1/E1 (page 315). ● V-Series (page 320). ● ATM (page 324). ● DS3/E3 (page 328).
Load Monitor Statistics: Ethernet RMON Time Graph Load Monitor Statistics: Ethernet Extend.
Load Monitor Statistics: Ethernet RMON Source, Destination, Conversation, Protocol, and Size* Graphs Load Monitor Statistics: Ethernet, continued Extend. Table 29 ✓ ✓ Utilization % Calculated from Octets, Packets, packet overhead, Drop Events, and media speed ✓ ✓ Octets ✓ ✓ Packets Extended data Calculated from information in representative packets sent to ERM.
Load Monitor Statistics: FDDI RMON Time Graph Load Monitor Statistics: FDDI Extend.
Load Monitor Statistics: FDDI RMON Time Graph, continued Load Monitor Statistics: FDDI, continued Extend.
Load Monitor Statistics: FDDI Source, Destination, Conversation, Protocol, and Size* Graphs RMON Time Graph, continued Load Monitor Statistics: FDDI, continued Extend.
Load Monitor Statistics: Token Ring RMON Load Monitor Statistics: Token Ring Extend.
Load Monitor Statistics: Token Ring RMON Time Graph, continued Load Monitor Statistics: Token Ring, continued Extend.
Load Monitor Statistics: Token Ring RMON Time Graph, continued Load Monitor Statistics: Token Ring, continued Extend.
Load Monitor Statistics: Token Ring RMON Source, Destination, Conversation, Protocol, and Size* Graphs Load Monitor Statistics: Token Ring, continued Extend. Table 31 ✓ ✓ Octets ✓ ✓ Packets − ✓ Total Errors† ✓ ✓ Utilization % Statistic RMON Object or Calculation Extended data Calculated from information in representative packets sent to ERM.
Load Monitor Statistics: T1/E1 FR PVC PPP Time Graph Load Monitor Statistics: T1/E1 Fr. Relay. Table 32 ✓ − ✓ Alarm Indication Statistic Signal Defect T1/E1 statistics are available only in extended views. ✓ − ✓ Bursty Errored Seconds ✓ − ✓ Controlled Slip Seconds Description Number of Alarm Indication Signal Defects or Blue Alarms. Number of type B (bursty) errored seconds that occurred. Number of seconds containing one or more controlled slips.
Load Monitor Statistics: T1/E1 FR PVC PPP Time Graph, continued Load Monitor Statistics: T1/E1, continued Fr. Relay. Table 32 − − ✓ In Bad Controls Statistic Out Bad Controls − − ✓ In Bad PPP FCSs Out Bad PPP FCSs ✓ ✓ ✓ − ✓ ✓ − In BECNs ✓ − In DEs Out DEs Number of frames for each direction, with the Discard Eligibility bit set.
Load Monitor Statistics: T1/E1 FR PVC PPP Time Graph, continued Load Monitor Statistics: T1/E1, continued Fr. Relay. Table 32 ✓ − ✓ Line Errored Seconds Number of seconds for which one or more Line Coding Violations occurred. Not incremented during an unavailable second. ✓ − ✓ Loss of Frame Number of Loss of Frame (LOF) failures. A LOF is declared when an Out of Frame or Loss of Signal defect has persisted for 2–10 seconds (inclusive). ✓ − ✓ Loss of MultiFrame E1 only.
Load Monitor Statistics: T1/E1 FR PVC PPP Time Graph, continued Load Monitor Statistics: T1/E1, continued Fr. Relay. Table 32 ✓ − ✓ Severely Errored Statistic Seconds Description Number of seconds for which any of the following occurred: ● ESF signals with one of the following: 320 or more Path Code Violations, one or more Out of Frame Defects, an Alarm Indication Signal Defect. ● E1-CRC signals with one of the following: 832 or more Path Code Violations, one or more Out of Frame Defects.
Load Monitor Statistics: T1/E1 FR PVC PPP Time Graph, continued Load Monitor Statistics: T1/E1, continued Fr. Relay. Table 32 ✓ − ✓ Total Errors Statistic Description Frame Relay: Calculated from Out of Frame Defects, Path Coding Violations, Line Coding Violations, Loss of Frame, Loss of Signal, Remote Alarm Indications, Alarm Indication Signal Defect, TS16 Alarm Indication Signal Failure, Loss of Multiframe, and Far End Loss of Multiframe.
Load Monitor Statistics: V-Series FR PVC PPP Time Graph Load Monitor Statistics: V-Series Fr. Relay. Table 33 − ✓ − Estimated Down Statistic Time Estimated Up Time V-Series statistics are available only in extended views.
Load Monitor Statistics: V-Series FR PVC PPP Load Monitor Statistics: V-Series, continued Fr. Relay. Table 33 ✓ ✓ ✓ In FECNs Statistic Out FECNs ✓ ✓ ✓ In Frames Out Frames − − ✓ In Long Frames Out Long Frames Time Graph, continued ✓ ✓ ✓ In Octets Out Octets ✓ − ✓ In Overruns Out Overruns ✓ ✓ ✓ In Utilization Out Utilization Description Number of frames with the Forward Explicit Congestion Notification bit set, for each direction.
Load Monitor Statistics: V-Series FR PVC PPP Load Monitor Statistics: V-Series, continued Fr. Relay. Table 33 ✓ − ✓ Total Errors Statistic Description Frame Relay: Calculated from In Aborted Frames, Out Aborted Frames, In Bad V-Series FCSs, Out Bad V-Series FCSs, In Overruns, Out Overruns, and Interrupted Frames.
Load Monitor Statistics: V-Series FR PVC PPP Time Graph, continued Load Monitor Statistics: V-Series, continued Fr. Relay. Table 33 ✓ ✓ ✓ Total Octets Calculated from In Octets and Out Octets. ✓ ✓ ✓ Total Utilization Frame Relay, PPP: Total Octets divided by twice the media speed, expressed as a percentage. Statistic Description Frame Relay PVC: Total Octets divided by the sum of the forward and reverse CIRs, expressed as a percentage.
Load Monitor Statistics: ATM AAL/5 PVC Load Monitor Statistics: ATM AAL/5 Table 34 Time Graph ✓ − Call Setup Attempts Number of call setup requests seen, in either direction. ATM statistics are available only in extended views. ✓ − Calling Party Events Number of error events that occur due to the originating user doing something wrong, for each direction.
Load Monitor Statistics: ATM AAL/5 PVC Load Monitor Statistics: ATM, continued AAL/5 Table 34 ✓ − In Out of Cell Statistic Out Out of Cell ✓ ✓ In Oversized SDUs Out Oversized SDUs Time Graph, continued ✓ ✓ In PDUs Out PDUs ✓ − In SVC Connections Out SVC Connection ✓ ✓ In Utilization Out Utilization Description Number of times cell delineation was lost, for each direction. Number of AAL/5 SDUs that were too large, for each direction.
Load Monitor Statistics: ATM AAL/5 PVC Load Monitor Statistics: ATM, continued AAL/5 Table 34 ✓ − Restart Activity Errors Statistic Detected Restart Activity Errors Transmitted Time Graph, continued ✓ − Route Unavailability Detected Route Unavailability Transmitted Description Number of host, switch, or network RESTART messages for each direction. Number of call setup attempts rejected due to lack of route—that is, no available path—for each direction.
Load Monitor Statistics: ATM AAL/5 PVC Time Graph, continued Load Monitor Statistics: ATM, continued AAL/5 Table 34 ✓ ✓ Total Octets Calculated from In Octets and Out Octets. ✓ ✓ Total Utilization AAL/5: Total Octets divided by twice the media speed, expressed as a percentage. Statistic Description AAL/5 PVC: Total Octets divided by the sum of the forward and reverse CIRs, expressed as a percentage.
Load Monitor Statistics: ATM Table 35 Load Monitor Statistics: NetMetrix WanProbe LAN/WAN All Graphs These statistics are available when using an older HP NetMetrix WanProbe, which supports only extended views. Octets Calculated from information in representative packets sent to ERM. Packets Total number of packets seen for both directions on the line. Utilization % Calculated from Octets and twice the media speed, expressed as a percentage. Not available in the Size graph.
Load Monitor Statistics: ATM ✓ ✓ ✓ In Frames PPP FR PVC Load Monitor Statistics: DS3/E3, continued Fr. Relay. Table 36 Statistic Out Frame ✓ ✓ ✓ In Octets Out Octets ✓ ✓ ✓ In Utilization Out Utilization ✓ Description The total number of frames seen originating from either direction of the link including errored frames. The sum of octets from all frames seen originating from either direction of the link including errored frames.
Load Monitor Statistics: ATM ✓ PPP FR PVC Load Monitor Statistics: DS3/E3, continued Fr. Relay. Table 36 Statistic ✓ ✓ State Changes The number of times the PVC when from an Up state to a Down state or vice versa. − A PES is a second with one or more PCVs OR one or more Out of Frame defects OR a detected incoming AIS. This gauge is not incremented when UASs are counted.
Load Monitor Statistics: ATM FR PVC PPP Load Monitor Statistics: DS3/E3, continued Fr. Relay. Table 36 ✓ − ✓ P-Bit Coding Viola- Statistic tions ✓ − ✓ Line Errored Seconds ✓ − ✓ C-Bit Coding Violations ✓ − ✓ C-bit Errored Seconds ✓ − ✓ C-bit Severely Errored Seconds ✓ − ✓ Remote Alarm Indi- Description For all DS3 applications, a coding violation error event is a P-bit Parity Error event.
Load Monitor Statistics: ATM FR PVC PPP Load Monitor Statistics: DS3/E3, continued Fr. Relay. Table 36 ✓ − ✓ Alarm Indication Statistic Signals Description Number of Alarm Indication Signal Defects or Blue Alarms. ✓ − ✓ Loss of Frame Number of Loss of Frame (LOF) failures. A LOF is declared when an Out of Frame or Loss of Signal defect has persisted for 2–10 seconds (inclusive). ✓ − ✓ Loss of Signal Number of times a Loss of Signal failure was detected.
Load Monitor Working with Collected Data Working with Collected Data Load Monitor lets you print and save the load statistics for your network for future reference. The following pages explain how to: ● Print or save the graph(s) in the view window in color or black and white (page 334). ● Print or save the data for the graph(s) in the view window as a text report (page 335). ● Load an archive file for viewing (page 336).
Load Monitor Working with Collected Data To print or save the graph(s) in the view window Choose File ➤ Print… from the view window. Specify Graph output. 3 Choose the Graph Output Format and, for segment graphs, the Segment Graph Source. 4 Choose Printer or File, then specify either a printer name or a file name. 1 2 Load Monitor lets you print or save the current graph image(s). Several output formats are supported.
Load Monitor Working with Collected Data To print graph(s) in color Set the environment variable NETM_PRINT_COLOR to any value. 2 Choose File ➤ Print… from the view window, and specify appropriate parameters. 1 Normally, when you print or save the graphs in the view window, Load Monitor converts the image to black and white. To suppress this conversion, set the environment variable NETM_PRINT_COLOR before running Load Monitor. This variable is boolean; that is, it takes effect if it exists.
Load Monitor Working with Collected Data For example, if the Zoom path is Time ➞ Source ➞ Destination, the text report will list all of the available time intervals, all of the source nodes for the Time graph’s focus point, and all of the destination nodes for the Source graph’s focus point at that time interval. To load an archive file Base Window 1 2 View Window 1 2 Choose File ➤ Load Data… from the base window. Specify the archive file to load. Choose File ➤ Load Data… from the view window.
Load Monitor Availability of Features Availability of Features As noted throughout this chapter, the availability of some Load Monitor features depends on whether you are viewing extended RMON data or standard RMON data. The following page summarizes feature availability for these two categories.
Load Monitor Availability of Features Extended RMON Data When the Load Monitor is accessing an extended data source, the Select filter data property, described on page 295, is not supported and is ignored. Standard RMON Data When using Load Monitor to view standard RMON data, the following limitations apply. For RMON agents other than HP probes, you should initialize the agent before using it with Load Monitor. Refer to the Agent Administration chapter in Data Collector Reference for details.
User’s Guide Protocol Analyzer 5967–9446
Protocol Analyzer NetMetrix Protocol Analyzer lets you capture and decode packets on your network. Specifically, you can: ● Capture packets and analyze their contents. ● Decode packets automatically. ● Build filters to capture packets of interest. ● View a graph showing how many packets matched each installed filter. ● Detect nodes generating excessive packets. ● Debug protocols and distributed applications. ● Arm a packet capture and associate it with an alarm.
Running Protocol Analyzer Protocol Analyzer works in concert with a data source that actually monitors the network and collects packets. The following pages discuss how to launch Protocol Analyzer from Agent Manager, HP OpenView Network Node Manager (NNM), and Internetwork Monitor. You can also start Protocol Analyzer by giving the protanal command. For details, refer to page 405.
Protocol Analyzer Running Protocol Analyzer To run Protocol Analyzer Agent Manager OpenView NNM 1 2 3 4 5 6 Internetwork Monitor 1 2 Select one or more data sources. Choose Fault ➤ Packet Analysis… If necessary, select the interface to use. Create a new instance, if appropriate. Configure the instance to capture the packets you want to analyze. Click the START button in the base window. Select a host (node), conversation, or segment.
Protocol Analyzer Running Protocol Analyzer Figure 70 Protocol Analyzer, RMON data source ➀ Agent Manager starts Protocol Analyzer on Agent Manager host ➁ Protocol Analyzer communicates with the agent over the network using SNMP If the display is not local to Agent Manager host, X protocol traffic from both Agent Manager and Protocol Analyzer will travel on the network host ➀ Agent Manager Protocol Analyzer X display X RMON data source packet capture ➁ SNMP traffic network See Also “Using Packet Cap
Protocol Analyzer Running Protocol Analyzer Figure 71 Protocol Analyzer Base Window Base window menus, summarized below Current instance Click START to begin packet capture for the current instance Status area gives information about current instance Click STOP to end packet capture for the current instance File Menu contains items to save captured data to or load data from a file, save filters and settings to a file or recall them, clear current filters and settings and load the defaults, and display
Protocol Analyzer Running Protocol Analyzer To view the error log ● Select File ➤ Error Log… from the base window or the packet decodes window. If an error occurs, Protocol Analyzer notifies you by displaying the error log, with the most recent error message visible. Error messages are generally self-explanatory and suggest a corrective course of action where appropriate. All errors for a given Protocol Analyzer process are collected in a file called netm.errlog.
Protocol Analyzer Running Protocol Analyzer To exit Protocol Analyzer ● Select File ➤ Exit from the base window. When you exit Protocol Analyzer, all windows associated with it are closed. However, packet capture instances are not stopped unless you explicitly stop them. Similarly, packet capture instances continue to use resources (such as memory) on the agent until they are removed.
Using Packet Capture Instances A Protocol Analyzer packet capture instance is an independent entity that captures network packets and puts them in a capture buffer, where they can be displayed in the packet decodes window. You can have several instances running simultaneously, capturing packets according to different criteria; however, you can only view the data from one instance at a time (per running copy of Protocol Analyzer). Figure 72 on page 348 gives an overview of Protocol Analyzer instances.
Protocol Analyzer Using Packet Capture Instances Figure 72 For details on: • Source of data, see page 395 • Capture and filter criteria, see pages 356 and 360 • Viewing data, see page 380 Although you can have multiple, simultaneous instances, you can view only one instance at a time (per copy of Protocol Analyzer) Protocol Analyzer Instances source of data: • network (live) • trace file • post-filter capture and filter criteria capture buffer Instance 1 source of data: • network (live) • trace file
Protocol Analyzer Using Packet Capture Instances To create a new packet capture instance Select Instance ➤ Attach… from the base window. In the Create New Instance text field, specify a name for the new instance and click OK. 3 Configure the new instance with the Settings menu, if necessary. 4 Specify a filter with the Filter menu as needed. 5 Click the START button or choose Instance ➤ Start to begin capturing packets for this instance.
Protocol Analyzer Using Packet Capture Instances Settings menu items: pages 356 – 358. Filter menu items: pages 360 – 379. “Working with Configuration Files” on page 399. “Using the protanal Command” on page 405. See Also To attach to an existing instance Select Instance ➤ Attach… from the base window. 2 Choose the instance you want from the selection list and click OK. 1 When you select Instance ➤ Attach…, a window like the one shown in figure 73 opens.
Protocol Analyzer Using Packet Capture Instances You can also attach to a specific instance when you start Protocol Analyzer by using the protanal -instance instancename command. For details, refer to page 405. See Also “Working with Captured Packets” on page 380. “Using the protanal Command” on page 405.
Protocol Analyzer Using Packet Capture Instances To remove an instance Select Instance ➤ Remove… from the base window. Choose the instance you want to remove and click OK. 3 Confirm that you want to remove the instance. 1 2 Caution When you remove an instance, any captured packets for that instance are discarded. If you want to keep the captured packets, ensure that you save them before you remove the instance. Refer to page 393 for instructions.
Protocol Analyzer Using Packet Capture Instances To start an instance 1 2 Attach to the instance, if necessary. Click the START button or choose Instance ➤ Start. When you start an instance, the current configuration (settings and filter) is applied to the instance, and data collection begins. Caution When you restart an instance, the current configuration supersedes the previous settings and filter. (To keep a configuration for future use, save it in a file; refer to page 399 for instructions.
Protocol Analyzer Using Packet Capture Instances To stop an instance 1 2 Attach to the instance, if necessary. Click the STOP button or choose Instance ➤ Stop. When an instance is stopped, any captured packets remain in the capture buffer and may be viewed or saved to a file. Caution As discussed on page 353, if you restart a stopped instance, any previously captured packets are discarded and the settings and filter configuration are superseded by the current configuration.
Protocol Analyzer Using Packet Capture Instances To arm an instance 1 2 Attach to the instance, if necessary. Choose Instance ➤ Arm. When you arm an instance, the current configuration (settings and filter) is applied to the instance, the instance is configured on the agent, and agent resources are allocated for the instance. Packet capture is not started, although the packet match counter does track how many packets match the current filter.
Protocol Analyzer Using Packet Capture Instances To configure the capture buffer Create a new instance, if necessary. Select Settings ➤ Capture Buffer… from the base window. 3 Indicate the type of capture buffer. 4 Specify the size of the buffer. 5 Indicate whether to slice packets. 1 2 When Protocol Analyzer captures packets, it stores them in the capture buffer on the agent. You can specify the type of capture buffer, its size, and whether to slice (truncate) packets.
Protocol Analyzer Using Packet Capture Instances To slice packets Create a new instance, if necessary. Select Settings ➤ Capture Buffer… from the base window. 3 Choose the Truncate After point. 1 2 When Protocol Analyzer captures packets, it stores them in the capture buffer. You can set the capture buffer to keep all packet data or slice off and keep only the first part of each packet. This technique lets you make better use of the capture buffer space by not cluttering it up with data you don’t need.
Protocol Analyzer Using Packet Capture Instances The solution to this is to use the Settings ➤ Interface… menu to select an interface other than Interface 1 for these probes. When you select Settings ➤ Interface…, the Interface configuration window appears. This window contains the following items. Interface Description Selects the interface to use for capturing packets. The available choices are determined from information provided by the agent.
Protocol Analyzer Using Packet Capture Instances Although you can capture packets from multiple interfaces simultaneously, you can view the packets from only one instance at a time (for each copy of Protocol Analyzer). See Also “To view packets” on page 381.
Protocol Analyzer Building a Filter Building a Filter One of the most powerful aspects of Protocol Analyzer is its comprehensive filtering capabilities. Protocol Analyzer gives you two mechanisms for specifying a packet capture filter: ● Filter component windows let you indicate filter criteria through a graphical interface. The criteria you specify are converted to the Protocol Analyzer’s filter expression language.
Protocol Analyzer Building a Filter Figure 74 Logical Connections between Filter Components Host ToFrom OR Between OR Source AND/OR Destination AND Protocol AND Packet Status AND Pattern Match Filter Expression Language Protocol Analyzer lets you specify a filter expression directly, rather than using the component windows. This approach gives you complete control over the filter expression and lets you create filters that cannot be specified through the component windows.
Protocol Analyzer Building a Filter To filter by host Choose an option from the Filter ➤ Host ➤ menu. Specify the host(s) to filter. 3 Indicate whether to include or exclude packets matching the specified host(s). 4 Repeat steps 1 through 3 as needed. 1 2 Protocol Analyzer lets you filter host traffic in several ways. The following options are available on the Filter ➤ Host ➤ menu. ToFrom Filters traffic flowing to or originating from the selected host(s).
Protocol Analyzer Building a Filter Figure 75 Host Source Filter Component Window and Selection List Type in this text field and press Return to add hosts to the filter list Current filter list Multiple items are connected by logical ORs.
Protocol Analyzer Building a Filter ToFrom List Between List Source List Destination List Shows the hosts in the current filter list. Add to List Adds hosts to the filter list. Enter a host in this text field and press Return to add it. A host may be specified in one of three ways: ● As a symbolic name (for example, walt). Protocol Analyzer resolves the name to a numeric address. ● As an address type and symbolic name (for example, ETHER walt).
Protocol Analyzer Building a Filter Table 37 Host Address Types and Formats Address Type Address Format Description Pop-Up Selection ETHER xx:xx:xx:xx:xx:xx, where xx represents one byte of the address in hexadecimal Example: 0:60:8c:d8:1b:a8 Ethernet MAC… IP ddd.ddd.ddd.ddd, where ddd represents one component of the IP address in decimal Example: 15.59.144.48 Internet Protocol IP… IDP netnum.
Protocol Analyzer Building a Filter To filter by protocol Choose Filter ➤ Protocol… Specify the protocol(s) to filter. 3 Indicate whether to include or exclude packets matching the specified protocol(s). 1 2 When you select Filter ➤ Protocol…, a window like the one shown in figure 76 on page 367 appears. This window lets you specify the criteria for the protocol filter. The protocol filter component window contains the following items. Protocol List Shows the protocols in the current filter list.
Protocol Analyzer Building a Filter Protocols… Opens a selection list window from which you can choose protocols. The selection list is based on the file sysprotolist and the built-in protocol map. Include/Exclude Specifies whether to include or exclude packets matching the Protocol List. Figure 76 Protocol Filter Component Window and Selection List Type in this text field and press Return to add items to the filter list Current filter list Multiple items are connected by logical ORs.
Protocol Analyzer Building a Filter Table 38 Protocol Levels Protocol Level Description Value ETHER Ethernet type field LLC 802.
Protocol Analyzer Building a Filter To filter by packet status Choose Filter ➤ Status… Specify the status keyword(s) or code(s) to filter. 3 Indicate whether to include or exclude packets matching the specified status keyword(s)/code(s). 1 2 When you select Filter ➤ Status…, a window like the one shown in figure 77 on page 370 appears. This window lets you specify the criteria for the packet status filter. The packet status filter component window contains the following items.
Protocol Analyzer Building a Filter Figure 77 Packet Status Filter Component Window and Selection List Type in this text field and press Return to add items to the filter list Current filter list Multiple items are connected by logical ORs.
Protocol Analyzer Building a Filter Ethernet Token Ring FDDI Others Packet Status Keywords and Codes Description good ✓ ✓ ✓ ✓ Packets with no errors bad ✓ ✓ ✓ Packets with any errors ✓ Packets with CRC or alignment errors Keyword Hex Code Table 39 crc 0x4 ✓ oversize 0x1 ✓ Packets larger than 1518 bytes undersize 0x2 ✓ Packets smaller than 64 bytes ar-set 0x20 ✓ ✓ Packets with the Address Recognized bit set fc-set 0x10 ✓ ✓ Packets with the Frame Copied bit set To f
Protocol Analyzer Building a Filter Filter on data anywhere within the packet, not just on the packet headers. ● Match packets that can’t be decoded. ● Filter packets at the bit level. ● A pattern match element compares a sequence of up to 32 bytes at a specified offset in the packet to a pattern of the same length. For further flexibility, you can apply a mask to the packet before the pattern comparison is performed.
Protocol Analyzer Building a Filter Figure 78 Pattern Filter Component Window Specify the logical connection between the eight available pattern elements Valid characters: 12345678 &|()! See close-up, below Indicate which of the eight pattern elements to display for editing in the Pattern and Mask boxes Configure the pattern element Offset is used for both pattern and mask Indicate a comparison operator to apply when matching the pattern element to the packet Use these items to enable and define a mask
Protocol Analyzer Building a Filter The pattern filter component window contains the following items. Pattern Expression Specifies the logical connection for the pattern/mask elements. Valid characters in this field are integers 1 through 8, left and right parentheses (), and these logical operators: & (AND), | (OR), and ! (NOT). You can configure up to eight different pattern/mask elements, then combine them with operators to create the pattern filter component.
Protocol Analyzer Building a Filter Figure 79 Example: Using a Pattern and Mask This pattern/mask lets you match the second half of the byte at offset 10 with the hex pattern value 9.
Protocol Analyzer Building a Filter To specify a filter expression 1 2 Choose Filter ➤ Expression… from the base window. Specify the filter expression. Protocol Analyzer lets you specify a filter expression directly, rather than using the filter component windows. This approach gives you complete control over the filter expression and lets you create filters that cannot be specified through the component windows. The complete filter expression syntax is described below.
Protocol Analyzer Building a Filter See page 379 for a description of these terms ::= | null ::= or | ::= and | ::= | | | | | | | | | | between dst-host dst-proto host not pattern offset num hexstring proto src-host
Protocol Analyzer Building a Filter ::= | | | | | | | | | | | | | | ::= protoname | protonum ::= eq | ne ::= maskop maskval hexstring | null ::= and ::= | () ::= | hexnum ::= | or
Protocol Analyzer Building a Filter num a decimal number hexstring a hexadecimal number enclosed in double quote characters; for example, "3f" hexnum a hexadecimal number prefixed with 0x; for example, 0x3f hostname a host name defined in the file sysnodelist hostaddr a numeric host address; see table 37 on page 365 for valid formats protoname a protocol name defined in the file sysprotolist or the built-in protocol map protonum a protocol number that represents a protocol level’s value; see t
Protocol Analyzer Working with Captured Packets Working with Captured Packets Once you have configured and started an instance to capture the packets of interest, you can: ● View the contents of the captured packets. ● Mark packets, letting you differentiate them from the rest. You can then perform operations on only marked packets or only unmarked packets. ● Search for a packet based on its contents. ● Print or save a report of the packets. ● Save the packets in a trace file for later analysis.
Protocol Analyzer Working with Captured Packets To view packets ● Select View ➤ Packet Decodes… from the base window. Once packets have been captured, you can display them by selecting View ➤ Packet Decodes… from the base window. Figure 80 on page 382 shows a sample packet decodes window. Packets can be viewed even while capture is in progress.
Protocol Analyzer Working with Captured Packets Figure 80 Protocol Analyzer Packet Decodes Window ➅ ➀ ➁ ➂ ➃ ➆ ➇ ➉ ➄ ➈ ➀ Marked packet; double-click to toggle mark, or use Marks menu ➁ Error packet, Information packet indicates error or information bit is set; Detail pane shows packet status ➂ Current packet; click to select, use ↑ and ↓ keys, or use Navigate menu ➃ Skipped packets; indicates a gap in the packet numbers, usually occurs when the buffer fills and wraps faster than packets can be displ
Protocol Analyzer Working with Captured Packets Window Panes The packet decodes window consists of three window panes: ● Summary gives a brief description for each captured packet. The current packet is highlighted. (See item ➆ in figure 80 on page 382.) ● Detail shows the current packet’s contents after decoding (item ➇ in figure 80 on page 382). The decoded layers are shown in different colors. The colors used are configured in the Netm X resources file.
Protocol Analyzer Working with Captured Packets Navigation The current packet is highlighted in the Summary pane, and its decoded and hexadecimal contents are displayed in the other panes. Table 40 lists techniques for changing the current packet.
Protocol Analyzer Working with Captured Packets Error and Information Packets The packet decodes window shows when any of a packet’s error or information bits are set by displaying E or I in the Summary pane. (See item ➁ in figure 80 on page 382.) The decode for an error or information packet shows the meaning of the bits that are set. An E in the margin means the packet contains an error—either a mediaspecific error or an SNMP error.
Protocol Analyzer Working with Captured Packets To mark packets ● ● ● Double-click on an unmarked packet in the Summary pane. Choose Marks ➤ Mark Current or use Ctrl+M to mark the current packet. Choose Marks ➤ Mark by Number… or use Ctrl+Shift+M to mark a specific packet number. Marking packets lets you differentiate them from the rest.
Protocol Analyzer Working with Captured Packets To search for a packet Choose Navigate ➤ Search for Packet… from the packet decodes window. 2 Indicate whether to search in the Summary, Detail, or Hex pane. 3 Specify a range of packets to narrow the search. 4 Specify the exact pattern to find. 1 Searching lets you locate a packet that contains the pattern you specify. When you choose Navigate ➤ Search for Packet…, a window similar to the one in figure 81 on page 388 opens.
Protocol Analyzer Working with Captured Packets Figure 81 Search for Packet Window Specify which pane to search Give a packet range to narrow the search Indicate the exact pattern you want to find Click Apply again to find the next occurrence of the pattern in the specified range. If Protocol Analyzer reaches the end of the packet range (indicated by the To Packet # field), it wraps around, searching again from the beginning of the range. Searching a large number of packets can be slow.
Protocol Analyzer Working with Captured Packets To tailor the Summary pane Choose Properties ➤ Summary View… from the packet decodes window. 2 Specify the Summary pane’s configuration. 1 The Summary pane shows brief information for each captured packet. You can tailor the Summary pane to suit your needs. You can configure the following Summary View properties. Protocol Layers Indicates which protocol layers to include in the summary.
Protocol Analyzer Working with Captured Packets MAC Format Indicates the format for MAC addresses: Hex shows the address as 12 hexadecimal digits. Manufacturer translates the first three bytes of the address to the manufacturer name. If the manufacturer is unknown to NetMetrix, then the address is displayed in Hex format. Host translates addresses to names, as defined in the sysnodelist file. If the name is not found, then the address is displayed in Manufacturer format.
Protocol Analyzer Working with Captured Packets Figure 82 Examples: Changing the Summary View Properties Default Summary View properties Protocol Layers: All Line Mode: Multiple Protocol Layers: All Line Mode: Multiple Time: Absolute MAC Format: Manufacturer 5967–9446 391
Protocol Analyzer Working with Captured Packets To print or save a report of captured packets Choose File ➤ Print… from the packet decodes window. Choose Summary, Detail, and/or Hex. 3 Indicate the first and last packet numbers. 4 Choose Printer or File, then specify either a printer name or a file name. 1 2 Protocol Analyzer lets you print or save a text report containing data for some or all packets displayed in the packet decodes window.
Protocol Analyzer Working with Captured Packets To save captured packets in a trace file 1 2 Choose File ➤ Load Data… from the base window. Specify the trace or capture buffer file to load. . All Packets To save all packets, choose File ➤ Save Data… from the base window. 2 Specify the file in which to save the data. 1 Choose File ➤ Load Data ➤ File… from the packet decodes window. 2 Specify the trace or capture buffer file to load.
Protocol Analyzer Working with Captured Packets To load a trace file Base Window 1 2 Choose File ➤ Load Data… from the base window. Specify the trace or capture buffer file to load. Decodes Window 1 Choose File ➤ Load Data ➤ File… from the packet 2 decodes window. Specify the trace or capture buffer file to load. When loading a trace or capture buffer file, you do not need to stop the currently attached instance, if any, or create a new instance specifically for the loaded file.
Protocol Analyzer Working with Captured Packets To post-filter captured packets Attach to an instance or load a trace file to post filter. Specify a filter with the Filter menu as needed. 3 Choose Instance ➤ Post Filter. 1 2 You can post-filter packets captured in an instance or saved in a trace file.
Protocol Analyzer Working with Captured Packets To display Traffic Trend (packet match counts) Create and start live instances for the filter/settings you want. 2 Choose View ➤ Traffic Trend… 1 Traffic Trend displays a line graph showing how many packets per second match each available instance’s filter. You can set up packet capture instances to filter on the types of traffic you want to see—hosts, protocols, packet status, and/or pattern match.
Protocol Analyzer Working with Captured Packets Example The following example configures four packet capture instances, one for traffic to and from each of four file servers on a particular LAN segment. Once the instances are configured and started, you can view the relative traffic patterns for these systems on the same graph. To configure the four packet capture instances, follow these steps: 1 Start Protocol Analyzer, SNMP-based, against an agent on the seg- ment containing the four file servers.
Protocol Analyzer Working with Captured Packets Figure 83 Traffic Trend Graph Example The legend shows four lines: one for each packet capture instance configured on agent tigger; “hpnshaa,” “hpntdsrj,” “mickey,” and “bambi,” are the instance names For information on changing the line configuration, zooming in and out, and changing the graph scale, refer to page 528 398 5967–9446
Protocol Analyzer Working with Configuration Files Working with Configuration Files Protocol Analyzer lets you configure instance settings and filters so that you can capture just those packets that interest you. Similarly, you can tailor the packet decodes window’s properties, configuring the Summary pane’s format to display what you want. All of this configuration information can be saved in files for future use.
Protocol Analyzer Working with Configuration Files To save filter/settings in a file Choose File ➤ Save Filter/Settings… from the base window. 2 Specify the file in which to save the current filter/ settings. 1 When you save settings, all of the items configured with the Settings and Filter menus are saved in the file you specify. These items include timer settings, capture buffer settings and interface, as well as the current filter.
Protocol Analyzer Working with Configuration Files You can load settings from a file previously saved with File ➤ Save Filter/ Settings… This action affects capture buffer settings and interface, as well as the current filter. When you load a filter/settings file, any settings you have configured with items on the Filter and Settings menus are discarded; they are replaced with the ones stored in the file. To keep a configuration, be sure to save it before you load a settings/filter file.
Protocol Analyzer Working with Configuration Files When you load the defaults, any settings you have configured with items on the Filter and Settings menus are discarded; they are replaced with the defaults. To keep a configuration, be sure to save it before you load the defaults. Refer to page 400 for instructions. Caution “To save filter/settings in a file” on page 400.
Protocol Analyzer Working with Configuration Files To save properties in a file Choose File ➤ Save Properties… from the packet decodes window. 2 Specify a file in which to save the current properties. 1 When you save packet decodes window properties, all of the items configured with Properties ➤ Summary View… are saved in the file you specify. In addition, the following items are saved: the size of the packet decodes window, which panes are open, the current packet, and whether auto scrolling is enabled.
Protocol Analyzer Working with Configuration Files To tailor the default properties Choose the packet decodes window size and which panes (Summary, Detail, Hex) to show. 2 Configure the Summary View properties that you want. 3 Choose File ➤ Save Properties… from the packet decodes window. 4 Specify the file name protanal.view.default in the NetMetrix search path. 1 To have the current properties be Protocol Analyzer’s defaults, specify the file name protanal.view.default in the NetMetrix search path.
Protocol Analyzer Using the protanal Command Using the protanal Command Many of Protocol Analyzer’s features can be driven from the command line. This capability, for example, lets you create scripts that start, stop, and arm packet capture instances on multiple agents. The protanal command syntax depends on whether you want to access an RMON agent or use local mode.
Protocol Analyzer Using the protanal Command –stop Stops the instance named instname, but does not remove it. Protocol Analyzer is not launched. For local mode, you can also use the protanal_kill command. –remove Removes the instance named instname, discarding any captured packets for that instance. Protocol Analyzer is not launched. For local mode, you can also use the protanal_remove command. –instance instname Specifies the instance name to use.
Protocol Analyzer Protocol Decodes Protocol Decodes NetMetrix Protocol Analyzer decodes the protocols listed in table 41. You can also get a list of supported decodes by giving the pdprint -X command.
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description Application Oracle Oracle RADIUS Accounting Banyan Vines CDPD Cisco Cisco (cont’d) 408 Reference RFC2139 SyBase SyBase database protocol AS Application Services ICP Internet Control Protocol IPC Interprocess Communication Protocol Matchmaker Program to Program Communication SPP Sequenced Packet Protocol Vines-ARP Vines Address Resolution Protocol Vines-Echo Echo Vine
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description DECnet CTERM Command Terminal DAP Data Access Protocol DecNET-DNS Distributed Name Services DRP DECnet Routing Protocol FOUND Found LAT Local Area Transport Protocol MOP Maintenance Operations Protocol NICE Network Information & Control Exchange NSP Network Services Protocol SCP Session Control Protocol Data Flow Control SNA Session Layer DCAP Document Content Architect
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description Path Control SNA Network Layer SNA-NCP Network Control Protocol SNA-SCP Session Control Protocol Transmission Control SNA Transport Layer Ethernet Ethernet Data Link Control FDDI Fiber Distributed Data Interface IEEE 802.1 Spanning Tree IEEE 802.1 VLAN - GARP, GVRP, GMRP IEEE 802.3 IEEE 802.3 IEEE 802.
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description NCP 4.x Netware Control Protocols version 4.x NLSP Novell Link State Protocol Novell-Echo Echo Novell-NetBIOS NetBIOS Novell-RIP Routing Information Protocol Novell-SAP Service Advertising Protocol Packet Burst Packet Burst PEP Packet Exchange Protocol SPX Sequenced Packet Exchange ACSE Application Control Service Element ASN.
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description Reference TP4 Transport Protocol class 4 ISO8073 X.400 Electronic Mail X.400/ ISO10021 X.500 Directory Services X.
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description HTTP Hypertext Transfer Protocol HTTP 1.1 Hypertext Transfer Protocol V1.
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description SNMP-2 Simple Network Management Protocol V2 TCP Transport Control Protocol RFC793 TELNET Telnet RFC854 TFTP Trivial File Transfer Protocol RFC873 TIMED Time Daemon Protocol UDP User Datagram Protocol VJC VanJacobson Compression XWIN X-Windows Cisco SLE Serial Link Encapsulation Frame Relay Frame Relay HDLC High level Data Link Control PPP Point to Point Protocol SDL
Protocol Analyzer Protocol Decodes Table 41 NetMetrix Protocol Decodes, continued Family Protocol Description XNS-RIP Routing Information Protocol XNS-SPP Sequenced Packet Protocol 5967–9446 Reference 415
Protocol Analyzer Protocol Decodes 416 5967–9446
User’s Guide Alarms and Traps 5967–9446
Alarms and Traps Alarms and traps let you configure RMON data sources to alert you when interesting activity occurs on the network. You define what “interesting activity” is, and you control what happens when the data source detects it. When you define alarms and traps, you essentially tell a data source what to look for on the network and what to do (or who to notify) when the data source sees it. For example, you might configure an alarm to monitor octet counts per second.
Configuring Traps A trap is an SNMP message from an RMON data source that alerts a management station of significant events occurring on the network. With traps, the management station doesn’t need to continuously poll the data source for information about network conditions. Instead, the burden is on the data source to monitor the network and notify the management station when a notable event occurs. Typically, traps are saved as entries in event logs on the management station.
Alarms and Traps Configuring Traps To manage trap groups Select the HP probes whose trap groups you want to manage. 2 Choose Configuration ➤ Trap Destination… 3 If needed, select the ports you want to configure. Agent Manager 1 OpenView NNM 1 Select the HP probes whose trap groups you want to manage. 2 Choose Configuration ➤ HP Network Agents ➤ Trap Destination… 3 If needed, select the ports you want to configure.
Alarms and Traps Configuring Traps Community Sets the community name to use when accessing the probes. If no community name is entered, the community names in the Agent Manager database are used. Specify a level-3 community name Trap Destination Group Selects a trap destination group to display in the trap destinations box. Destinations box Shows the configured trap destinations for the selected trap group.
Alarms and Traps Configuring Traps Figure 84 Trap Destinations Window Selected probes Community name (specify if not in agentmgr.
Alarms and Traps Configuring Traps To add a trap group or destination Display the Trap Destinations window, as described on page 420. 2 To add a destination to an existing group, choose the trap group from the option pop-up. 3 Push the Add Network Dest… or Add Serial Dest… button. 4 Specify the trap group name and the parameters for the trap destination. 1 The Add Network Dest… and Add Serial Dest… buttons let you create a new trap group or add a trap destination to an existing group.
Alarms and Traps Configuring Traps Owner Gives information about the owner of the trap group. Trap Destination Group Specifies the trap group to which this destination will be added. The default is the trap group chosen with the option pop-up in the Trap Destinations window. To create a new trap group, specify a name that doesn’t already exist. Network IP Address Indicates the IP address for the management station to configure as a trap destination in this trap group.
Alarms and Traps Configuring Traps Serial Trap Destinations The Add Serial Dest… button lets you create a new trap group or add a serial trap destination to an existing group. When you push this button, the Add Serial Trap Destination window, shown in figure 86, opens.
Alarms and Traps Configuring Traps Trap Destination Group Specifies the trap group to which this destination will be added. The default is the trap group chosen with the option pop-up in the Trap Destinations window. To create a new trap group, specify a name that doesn’t already exist. Serial IP Address Indicates the IP address for the management station to configure as a trap destination in this trap group.
Alarms and Traps Configuring Traps To modify a trap destination 1 2 3 4 5 Display the Trap Destinations window, as described on page 420. Choose the trap group with the destination you want to modify. Highlight the destination you want to change. Push the Modify… button. Change the destination as needed. When you push Modify… to change a trap destination, the Add Network Trap Destination or Add Serial Trap Destination window opens with the values for the highlighted destination.
Alarms and Traps Configuring Traps To remove a trap destination or group Display the Trap Destinations window, as described on page 420. 2 Choose the trap group with the destination you want to remove. 3 Highlight the destination you want to remove. 4 Push the Delete button. Destination 1 Group 1 2 3 4 5 Caution Display the Trap Destinations window, as described on page 420. Choose the trap group you want to remove. Highlight a destination in the trap group. Push the Delete button.
Alarms and Traps Configuring Traps HP Probe-Specific Events/Traps In addition to traps generated by alarms that you configure, an HP probe will send a trap to the management station whenever the following occurs: ● The probe is warm-started. ● Someone attempts to contact the probe with an incorrect community string. Note that the trap does not include an indication of the offending management station; however, this information can be viewed in the RMON Log utility, discussed on page 515.
Setting Alarms An alarm triggers when a threshold for a specified network activity, or monitored object, is crossed in a particular direction. You can set an alarm to trigger when a monitored object goes above an indicated value (a rising threshold), or when it drops below an indicated value (a falling threshold). In addition, you can specify a threshold that indicates when the alarm rearms, allowing it to trigger again. You control what happens when an alarm triggers.
Alarms and Traps Setting Alarms To manage alarms Select the data source(s) whose alarms you want to manage. 2 Choose Fault ➤ RMON Alarms… 3 If necessary, select the interface(s) to use. Agent Manager OpenView NNM 1 Protocol Analyzer ● Choose Tools ➤ Alarms… to launch the Alarms application against the current data source. The RMON Alarms window, shown in figure 87, lets you manage and configure alarms on RMON data sources.
Alarms and Traps Setting Alarms The RMON Alarms window contains the following items. Probe Displays the names or IP addresses of the selected data sources. If multiple data sources were selected, their names are separated with spaces. If you change the data sources in this field, push the Reload from probe button to retrieve the alarm configuration from the new list. Community Sets the community name to use when accessing the data sources.
Alarms and Traps Setting Alarms To configure an alarm Display the RMON Alarms window, as described on page 431. 2 Push the Add… button. 3 Specify the object to monitor and the threshold. 4 Specify a trap destination group, if applicable. 1 When you push Add… to create a new alarm, the Configure Alarm window opens. This window is shown in figure 88.
Alarms and Traps Setting Alarms The Configure Alarms window contains the following items. Probe Displays the data sources on which to configure the alarm. Community Sets the community name to use when accessing the data sources; if a name was given in the RMON Alarms window, it carries through to this field. If no community name is entered, the community name in Agent Manager is used. For HP probes, specify at least a level-3 community name; otherwise, specify the write community.
Alarms and Traps Setting Alarms Threshold Specifies the threshold at which to trigger and rearm the alarm. When the value for the monitored object crosses the threshold in the appropriate direction, the alarm fires. When it crosses back the other way, the alarm rearms. Choose above or below to configure a rising or falling alarm, respectively, indicating which direction triggers the alarm. Specify the value for the monitored object, the sample type, and the sampling duration for the threshold.
Alarms and Traps Setting Alarms Thresholds The threshold determines when an alarm triggers and when it rearms, allowing it to trigger again. The above or below indicator signifies whether to configure a rising or falling alarm, respectively. An alarm is triggered only when the value for the monitored object crosses the threshold in the appropriate direction.
Alarms and Traps Setting Alarms The threshold’s sample type works in conjunction with the value you specify to determine when the threshold is crossed: ● Choose delta to set an alarm based on the change in value for the monitored object over a specified period of time. For example, you could set an alarm that triggers when more than 5,000 packets are seen in a tensecond interval. ● Choose units per second to set an alarm based on the value of the monitored object over a time interval.
Alarms and Traps Setting Alarms To modify an alarm Display the RMON Alarms window, as described on page 431. 2 Highlight the alarm you want to change. 3 Push the Modify… button. 4 Change the alarm’s configuration as needed. 1 When you push Modify… to change an alarm, the Configure Alarm window opens with the values for the highlighted alarm. This window is shown in figure 88 on page 433. To remove an alarm Display the RMON Alarms window, as described on page 431. 2 Highlight the alarm you want to remove.
Alarms and Traps Setting Alarms To set different rising and falling thresholds Configure an alarm as discussed on page 433. Push the Options… button. 3 Set separate thresholds for Rising Event and Falling Event. 1 2 With many network problems, a monitored object fluctuates around a given value for a period of time, crossing and recrossing the threshold in each direction. As a result, an alarm may trigger several times without actually signaling a new network problem.
Alarms and Traps Setting Alarms To set different thresholds, configure the alarm as described on page 433, then push the Options… button. A window like the one in figure 91 opens. This window includes areas for configuring both a rising threshold and a falling threshold. The initial value for each is the value specified in the Configure Alarms window. When you set different thresholds, the text field for the threshold value in the Configure Alarms window cannot be changed.
Alarms and Traps Setting Alarms To control what happens when an alarm triggers Configure an alarm as discussed on page 433. Push the Options… button. 3 Indicate what to do when the alarm triggers. 1 2 Important In order to use traps, you must have a network management environment, such as OpenView NNM, that supports them, and trap destination information must be configured for the agent. Refer to page 419 for details.
Alarms and Traps Setting Alarms Send SNMP trap Indicates whether to send a trap when the threshold is crossed. You can and execute… also specify a command to execute on the OpenView NNM management (OpenView NNM station when the trap is sent. only) The default action sends a trap and executes pmTrapDisp.sh when the alarm triggers (but not when it rearms). The script pmTrapDisp.sh, located in /usr/OV/bin, displays a dialog box on the management station(s) in the specified trap destination group.
Alarms and Traps Setting Alarms Table 42 Environment Variables for Trap-Triggered Scripts Variable Definition $TRAPTYPE One of these values: Rising, Falling, or Match. $AGENT Name of the data source that sent the trap. $ALARMROW Row in the alarm table of the triggered alarm. $OBJECT Object identifier of the monitored object. $THRESHOLD Alarm threshold value that was crossed. $VALUE Measured value for the monitored object. $SEVERITY Severity of the alarm.
Alarms and Traps Setting Alarms Alarms and Packet Capture Instances Alarms work with Protocol Analyzer packet capture instances in two ways: ● You can set the monitored object to be a packet capture instance, triggering an alarm when some number of packets are captured or when the number of packets captured in a time interval reaches the indicated level. ● You can start or stop a packet capture in response to an alarm trigger or rearm event.
Alarms and Traps Setting Alarms 2 Push the Options… button to display the advanced alarm parameters. Set the rising event to Send SNMP trap and execute… a script called pmNewNode.sh. Figure 92 on page 445 shows the relevant parts of the Configure Alarm and Alarm Advanced Options windows for this alarm.
Alarms and Traps Setting Alarms Example 2 The following example configures an alarm on broadcast packets. The alarm triggers when the data source detects a high level of Ethernet broadcast packets on the network, and rearms when the level of broadcasts drops back to a more normal level. Historical Statistics graphs indicate that the typical rate of broadcast packets on this particular network segment is below 4 per second. Rarely does the rate exceed 10 per second.
Alarms and Traps Setting Alarms Figure 93 Example: Alarm on Broadcast Packets with Packet Capture Configure Alarm Alarm Advanced Options Script displays a dialog box when trap is sent Packet capture instance “broadcast/ alarm” stops when alarm triggers When the alarm triggers, the agent logs the event, then sends a trap to your management station, which executes a script that notifies you.
Alarms and Traps Setting Alarms Example 3 The following example configures an alarm on CRC/alignment error packets. The alarm triggers when the data source detects a high level of these error packets on the network, and rearms when the level drops back to a more normal level. Historical Statistics graphs indicate that the typical rate of CRC error packets on this particular network segment is below 1 per second. Rarely does the rate exceed 4 per second.
Alarms and Traps Setting Alarms Figure 94 shows the relevant parts of the Configure Alarm and Alarm Advanced Options windows for this alarm.
Alarms and Traps Setting Alarms About Alarm Owner Strings NetMetrix RMON alarms use the alarm owner string to pass useful information back to the management station. The string contains four fields, delimited by ^ characters: version^alarm description^status_chars^actual owner string where: version Version number; always 2. alarm description The alarm’s description (specified in the Configure Alarm window, shown on page 433).
Alarms and Traps Setting Alarms Trap Handling When an RMON alarm sends a trap to an OpenView NNM management station, the following sequence occurs: 1 OpenView NNM detects the trap. 2 The ovactiond process recognizes that special action is needed and starts /usr/OV/bin/pmTrapMgr.sh (part of the NetMetrix RMON Utilities). 3 pmTrapMgr.sh contacts the agent to determine additional informa- tion about the alarm that generated the trap, including the owner string, what command to execute (if any), and so on.
Alarms and Traps Setting Alarms To display an alarm’s log Display the RMON Alarms window, as described on page 431. 2 Highlight the alarm(s) for which to display a log. 3 Push the Logs… button. 1 By default, an entry is added to the agent’s log every time an alarm triggers and rearms. (You can change this behavior, as discussed on page 441.
Alarms and Traps Setting Alarms Example The following example shows two entries from the log on an agent called lanprobe2. The alarm is configured on Ethernet Utilization %. The first entry shows that a rising threshold of 15% was crossed at 3:06 pm on May 5, the measured utilization was 20.89%, and a trap was sent. The second entry shows that a falling threshold of 15% was crossed at 3:18 pm, and the measured value was 11.97%.
Alarms and Traps 454 5967–9446
User’s Guide Live Statistics 5967–9446
Live Statistics NetMetrix includes several tools for viewing live (real-time) statistics: ● Multi-Segment Statistics show segment-level statistics from multiple data sources on the same graph, allowing you to compare statistics from different segments with ease. The statistics shown by this tool are based on RMON’s Statistics group (page 457). ● Node Statistics let you view the entire node (host or station) table, or you can display a graph of statistics for specified nodes on the segment.
Multi-Segment Statistics The Multi-Segment Statistics application lets you view segment statistics from multiple data sources on the same graph, allowing you to easily compare statistics from different segments. Multiple Interfaces You cannot view multi-segment statistics for data sources using a network interface other than 1 (that is, for a non-default interface) from OpenView NNM, unless the agent is a multi-interface HP probe or a Cisco switch.
Live Statistics Multi-Segment Statistics To display multi-segment statistics In Agent Manager or OpenView NNM, select one or more data sources that use the same interface number. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Multi-Segment… 3 If needed, select the interface to use. 1 When you choose Live Statistics ➤ Multi-Segment…, a graph showing statistics from the selected data sources is shown.
Live Statistics Multi-Segment Statistics Figure 95 Multi-Segment Statistics Graph Ethernet collision statistics for three segments are shown, as reported by data sources lanprobe2, lanprobe, and 15.59.145.
Live Statistics Multi-Segment Statistics The available statistics are from the RMON Statistics group. Specifically, the following Ethernet segment statistics can be graphed. Broadcasts Collisions CRC/Alignment Errors Fragments Jabbers Multicasts Octets Oversize Packets Undersize The following token ring segment statistics can be graphed.
Node Statistics The Node Statistics options let you view node statistics for specified nodes on the segment, as reported by one or more RMON data sources. A node is any device that has a physical address associated with it. Examples of nodes are workstations, PCs, and network printers. You can display node statistics as a table or a graph, as discussed on the following pages. In addition, you can export the node statistics to a file.
Live Statistics Node Statistics To display a graph of node statistics In Agent Manager or OpenView NNM select one or more data sources that use the same interface number. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Node Graph… 3 If needed, select the interface to use. 4 Indicate the name, IP address, or MAC address of the node for which to display statistics.
Live Statistics Node Statistics The following Ethernet host statistics can be graphed. In Octets In Packets Out Broadcasts Out Errors Out Multicasts Out Octets Out Packets The following token ring station statistics can be graphed.
Live Statistics Node Statistics Figure 96 Node Statistics Graph Statistics for node bambi are shown, as reported by the data source lanprobe 464 5967–9446
Live Statistics Node Statistics To display a table of node statistics In Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Node Table… 3 If needed, select the interface to use. 1 When you choose Live Statistics ➤ Node Table…, NetMetrix displays a table of Ethernet host statistics or token-ring station statistics. Data from each selected data source is shown in its own table. Figure 97 on page 466 shows a sample Node Statistics table.
Live Statistics Node Statistics Figure 97 Node Statistics Table This data source’s Host table shows statistics for the nodes seen by the data source See Also “Working with Data Tables” on page 537. “To sort a table” on page 538.
Live Statistics Node Statistics To export statistics to a file In Agent Manager or OpenView NNM select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Node Export To File… 3 Specify the file name in which to save the data. 4 If needed, select the interface to use. 1 When you choose Live Statistics ➤ Node Export To File…, a terminal window opens with a prompt asking for the file in which to save the statistics.
Traffic Matrix The Traffic Matrix options let you view activity between specified nodes, as reported by one or more RMON data sources. You can display Traffic Matrix statistics as a table or a graph, as discussed on the following pages. In addition, you can export the statistics to a file. Traffic Matrix statistics are based on the RMON Matrix group.
Live Statistics Traffic Matrix Statistics To display the traffic matrix graph In Agent Manager or OpenView NNM select one or more data sources with the same interface number. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Traffic Matrix Graph… 3 If needed, select the interface to use. 4 Indicate the names, IP addresses, or MAC addresses of the pair of nodes for which to display statistics.
Live Statistics Traffic Matrix Statistics Figure 98 Traffic Matrix Graph Statistics are shown for traffic from node bambi (A) to kermit (B) and from kermit (B) to bambi (A), as reported by data source lanprobe Note that the window title bar shows which node is A and which is B Multiple Interfaces Matrix statistics on multiple interfaces are supported for multi-interface HP probes.
Live Statistics Traffic Matrix Statistics The following statistics can be graphed. Errors from Node A ➞ Node B Octets from Node A ➞ Node B Packets from Node A ➞ Node B The Traffic Matrix application displays an error message if any selected data source is unreachable. See Also “Working with Graphs” on page 528. “To control what statistics are shown and how” on page 530.
Live Statistics Traffic Matrix Statistics To display Traffic Matrix as a table In Agent Manager or OpenView NNM select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Traffic Matrix Table… 3 If needed, select the interface to use. 1 When you choose Live Statistics ➤ Traffic Matrix Table…, NetMetrix displays a table of statistics. Information from each selected data source is shown in its own table. Figure 99 on page 473 shows a sample Traffic Matrix table.
Live Statistics Traffic Matrix Statistics Figure 99 Traffic Matrix Table Traffic Matrix table, as reported by data source lanprobe Table is sorted by the Octets column You can sort the table on any of the columns, as discussed on page 538. See Also “Working with Data Tables” on page 537. “To sort a table” on page 538.
Live Statistics Traffic Matrix Statistics To export statistics to a file In Agent Manager or OpenView NNM select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Live Statistics ➤ Traffic Matrix Export To File… 3 Specify the file name in which to save the data. 4 If needed, select the interface to use. 1 When you choose Traffic Matrix Export To File…, a terminal window appears with a prompt asking for the file in which to save the statistics.
User’s Guide Historical Statistics 5967–9446
Historical Statistics NetMetrix Historical Statistics application lets you view past network activity and develop baselines that help you discern patterns of activity, trends in behavior, and exceptional events. By looking at short-term statistics, you can identify network performance problems; long-term statistics assist you in network configuration, capacity planning, and network segmentation.
Displaying Statistics When you run the Historical Statistics application, NetMetrix displays a window containing plot or line graphs of network statistics for the study you chose (hourly, daily, or monthly). When a LanProbe is powered on, it automatically collects network statistics for certain default time intervals or studies. These statistics are retained in the agent’s memory as follows: The 5-second study is retained for 5 minutes; the 30-second study for 1 hour; and the 30-minute study for 3 weeks.
Historical Statistics Displaying Statistics Available Statistics The following Ethernet statistics can be graphed. Items in bold are shown by default. Broadcasts Broad+Multicasts Collisions CRC/Align Fragments Jabber Multicasts Octets Oversize Packets Total Errors Undersize Utilization % The following token ring statistics can be graphed. Items in bold are shown by default.
Historical Statistics Displaying Statistics Interpreting Data Loss A data source can lose data or fail to report statistics to NetMetrix for several reasons: ● If the network traffic rate is such that the data source cannot keep up, the historical statistics graph shows dashed lines. ● If the data source cannot collect data for some time (for example, it is powered off or disconnected from the network), the graph shows gaps in the lines. The data file also shows a jump in the Epoch column values.
Historical Statistics Displaying Statistics To display the hourly study From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Hourly… 3 If needed, select the interface to use. 1 When you choose Historical Statistics ➤ Hourly…, NetMetrix displays a graph of network statistics collected by the data source, using 5-second collection intervals. Data from each data source is shown in its own window.
Historical Statistics Displaying Statistics Figure 100 Sample Historical Statistics Graph Color-coded legend shows which statistics are displayed Click and hold mouse button 1 to display a time/date stamp for the pointer’s location When you release the mouse button, the graph is centered at the pointer’s location Click to the left of the Y axis to move back one screen Click at right edge of graph to move forward one screen Click mouse button 3 on the graph to display this pop-up menu: Zoom in x 2 and
Historical Statistics Displaying Statistics To initialize the hourly study From Agent Manager or OpenView NNM, select one or more agents. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Hourly… 3 If needed, select the interface to use. 4 Confirm that you want to initialize the agent. 1 By default, the hourly (5-second) study is configured for HP LanProbes, but not for many standard RMON agents.
Historical Statistics Displaying Statistics To display the daily study From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Daily… 3 If needed, select the interface to use. 1 When you display the Daily study, NetMetrix displays a graph of network statistics collected by the data source, using 30-second collection intervals. Data from each data source is shown in its own window.
Historical Statistics Displaying Statistics To display the monthly study From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Monthly… 3 If needed, select the interface to use. 1 When you display the monthly study, NetMetrix displays a graph of network statistics collected by the data source, using 30-minute collection intervals. Data from each data source is shown in its own window.
Using Baselines Baselines combine historical measurements with statistical algorithms to analyze network data. In determining baselines for your network, NetMetrix gathers individual measurements over long periods of time and presents this analysis in a graphical format. The baseline graph shows patterns of activity, trends in behavior, and exceptional events.
Historical Statistics Using Baselines as a single “bucket” or unit, and the baseline width determines the “repeat” period, that is, it determines how the baseline intervals are distributed into data sets. The default baseline width is one week, and the default baseline interval is eight hours, resulting in 21 separate data sets. Figure 101 gives a pictorial representation of these defaults.
Historical Statistics Using Baselines A large spread between low and high baselines indicates that the parameter fluctuates significantly over time. High and low baselines are useful in determining what is normal for your network which, in turn, helps you identify abnormal events. This information is helpful when setting alarm thresholds, as discussed on page 430. You can specify a different confidence level with the pmReporter command.
Historical Statistics Using Baselines To display the monthly baseline From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Monthly Baseline… 3 If needed, select the interface to use. 1 Important You need at least two weeks of data available to display statistically valid baselines. In practice, you may need to collect statistics for one or two months to see trends and patterns for your network.
Historical Statistics Using Baselines Figure 102 Sample Baseline Graph The following line styles are used by default: • measured value, thin solid line • low baseline, thick dotted line • high baseline, thick dashed line • cumulative average, thick solid line Note the low values for Sunday, 10/2/94, as compared to the higher values for Monday, 10/3/94, and the following days The baseline interval and width account for typical day-to-day usage patterns 5967–9446 489
Historical Statistics Using Baselines To display the yearly baseline From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Performance ➤ RMON Statistics ➤ Historical Statistics ➤ Yearly Baseline… 3 If needed, select the interface to use. 1 When you choose Historical Statistics ➤ Yearly Baseline…, NetMetrix displays a graph of baseline statistics based on data collected by the data source. A separate graph window is opened for each data source.
User’s Guide Token Ring Applications 5967–9446
Token Ring Applications NetMetrix Token Ring Applications include several applications specifically for token ring networks. These applications include: ● Ring Status displays descriptive information about one or more token ring networks (page 493). ● Ring Order shows information about which stations are currently active and which stations were once active but have been dropped out or removed from a token ring network (page 495).
Token Ring Applications Token Ring Status To display token ring status From Agent Manager or OpenView NNM, select one or more token ring data sources. 2 Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Ring Status… 3 If needed, select the interface to use. 1 When you choose Ring Status…, NetMetrix displays a table of statistics. Information from multiple data sources is shown in a single table. The table contains the following columns.
Token Ring Applications Token Ring Status Beacon Sender Indicates the IP address or domain name of the ring station that generated the most recent beacon transmission. Beacon NAUN Indicates the IP address or domain name of the Nearest Active Upstream Neighbor (NAUN) of the ring station that generated the most recent beacon transmission. Active Monitor Indicates the IP address or domain name of the active monitor on the ring network. The active monitor is the main communication manager on the ring.
Token Ring Applications Token Ring Order To display token ring order From Agent Manager or OpenView NNM, select one or more token ring data sources. 2 Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Ring Order… 3 If needed, select the interface to use. 1 The Ring Order application gives you information about both the participating and non-participating stations on the ring.
Token Ring Applications Token Ring Order Enter Time Indicates when the station entered the ring. Note that the Enter Time can be unknown, indicating that the data source was unable to determine when the station entered the ring, probably because the station entered before the data source did. Exit Time Indicates when the ring station left or exited the ring. Note that the Exit Time can be unknown, indicating that the station has not exited while the data source has been inserted in the ring.
Token Ring Applications Token Ring Source Routing Statistics To display source routing statistics From Agent Manager or OpenView NNM, select one or more token ring data sources. 2 Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Source Routing… 3 If needed, select the interface to use. 1 When you choose Token Ring Source Routing…, NetMetrix displays a graph of source routing statistics collected by the data source(s). Information from all selected data sources is shown in one window.
Token Ring Applications Token Ring Remove Station To remove a station from the ring 1 2 3 4 5 From Agent Manager or OpenView NNM, select one or more token ring LanProbe data sources. Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Remove Station… If needed, select the interface to use. Indicate a level-4 community name, if not configured in Agent Manager. Specify the name, IP address, or MAC address of the station you want to remove.
Token Ring Applications Token Ring Remove Station Messages Shows any status and error messages from communication with the data sources.
Token Ring Applications Token Ring Entry Errors To display token ring entry errors From Agent Manager or OpenView NNM, select one or more token ring data sources. 2 Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Ring Entry Errors Table… 3 If needed, select the interface to use. 1 When you choose Ring Entry Errors Table…, NetMetrix displays a table of error statistics collected by the data source. Information from each data source is shown in its own table.
Token Ring Applications Token Ring Entry Errors To export token ring entry errors to a file From Agent Manager or OpenView NNM, select one or more token ring data sources. 2 Choose Performance ➤ RMON Statistics ➤ Token Ring Extensions ➤ Ring Entry Errors Export To File… 3 If needed, select the interface to use. 4 Specify the file name in which to save the data.
Token Ring Applications Token Ring Entry Errors 502 5967–9446
User’s Guide Protocol Distribution 5967–9446
Protocol Distribution NetMetrix Protocol Distribution lets you view pie graphs showing the top protocols used on your network, based on data collected by a standard RMON agent, provided the agent supports the Filter and Capture RMON groups. The application sets up a packet capture instance on the agent, slicing packets at 128 bytes. A buffer size of one megabyte is requested for FDDI LanProbe data sources, 100 kilobytes for all others.
Protocol Distribution Displaying Protocol Distribution To display the distribution graph From Agent Manager or OpenView NNM, select one or more data sources. 2 Choose Misc ➤ Protocol Distribution… 3 If needed, select the interface to use. 1 When you choose Protocol Distribution…, NetMetrix displays a window containing pie graphs showing the distribution of protocols at four layers: data link, transport, network, and application. See figure 103.
Protocol Distribution Displaying Protocol Distribution Special Entries: Other, TCP-other, and UDP-other Protocol Distribution graphs may include some special entries: Other, TCP-other, and UDP-other. The “Other” item accounts for protocols that are not shown as individual slices in the pie graphs. Protocol Distribution determines which values are assigned to the Other slice based on two X resources in the Netm resources file: protdist*xrtPieThresholdMethod and protdist*xrtPieThresdholdValue.
Protocol Distribution Displaying Protocol Distribution To indicate how frequently to generate a new snapshot ● Choose the update interval from the toolbar’s pop-up menu: 30 seconds, 1 minute, or 2 minutes. The update interval pop-up, shown in figure 104, determines how long Protocol Distribution waits after processing a snapshot before asking the agent for a new snapshot.
Protocol Distribution Displaying Protocol Distribution To pause the application ● Choose Pause from toolbar’s update interval pop-up menu. You can prevent any display or snapshot updates by setting the update interval to Pause, as shown in figure 105. The display remains paused until you change the update interval to 30 seconds, 1 minute, or 2 minutes. The pause feature is useful when the protocol distribution shows something of interest and you want to prevent an update from altering the display.
Protocol Distribution Displaying Protocol Distribution To select the graph units ● Choose Octets or Packets from toolbar’s graph units pop-up menu. By default, Protocol Distribution bases the percentages shown in the pie graphs on octet counts. To display percentages based on packets, change the graph units pop-up menu, shown in figure 106.
Protocol Distribution Displaying Protocol Distribution To view the error log ● Select File ➤ Error Log… If an error occurs, Protocol Distribution notifies you by displaying the error log, with the most recent error message visible. All errors for a given Protocol Distribution process are collected in a file called netm.errlog.pid, where pid is this Protocol Distribution’s process ID.
User’s Guide LanProbe IP Address Tracking 5967–9446
LanProbe IP Address Tracking LanProbe IP Address Tracking lets you match MAC addresses and IP addresses as seen by an HP LanProbe. For a list of what probes work with LanProbe IP Address Tracking, refer to table 1 on page 18. When using LanProbe IP Address Tracking with a multi-interface LanProbe, note that there is one set of information (one IP table) that includes information from all network interfaces on the probe.
LanProbe IP Address Tracking Displaying the IP Table To display the IP Table From Agent Manager or OpenView NNM, select one or more LanProbes. 2 Choose Misc ➤ LanProbe IP Address Tracking… 1 When you choose LanProbe IP Address Tracking, a table like the one in figure 107 opens.
LanProbe IP Address Tracking Displaying the IP Table The table includes the following columns. MAC Address Indicates the MAC address of the node. IP Address Indicates the IP address associated with the MAC address. Name or Vendor Shows the domain name or vendor name for the MAC address. Examples: ag.ca.itc.tenneco.com, HP, HPLanP. Status Displays known, unknown, changedOnce, or multipleChanges.
User’s Guide RMON Log Table 5967–9446
RMON Log Table RMON Log Table lets you view the log table entries for an agent. For each log entry, RMON Log Table creates a line with the event index, the log index, the time the event fired and the log description associated with that event. RMON Log Table includes filter capabilities that let you sort the log table, view only selected events, or restrict the displayed entries to a specified time range. These capabilities are discussed on the following pages.
RMON Log Table Displaying the RMON Log Table To display the log table From Agent Manager or OpenView NNM, select one or more agents. 2 Choose Misc ➤ RMON Log Table… 1 When you choose RMON Log Table…, NetMetrix displays a window of the log entries for the agent. The log from each agent is shown in its own window. The window title indicates the name or address of the agent. A sample RMON Log Table window is shown in figure 108.
RMON Log Table Sorting the Table To sort the log table 1 2 Choose Filter ➤ Filter… Indicate how to sort the table: Decreasing Time, Increasing Time, or Event. The RMON Log Table Filter window, shown in figure 109, includes a Sort By field that lets you specify how to sort the table. By default, the log table entries are sorted by Increasing Time, that is, from earliest to most recent.
RMON Log Table Controlling the Time Range To control the displayed time range Choose Filter ➤ Filter… Indicate the Time Mode: All available, Since a specified time, or a time Range. 3 For Since, specify the Time Start. For Range, specify both the Time Start and Time End. Note that four digits are allowed to express the year (for example, 1999 or 2000).
RMON Log Table Filtering by Event Figure 110 RMON Log Table Event Selection Window Removes the highlighted events from the Event List Type an event number and press Return to add it to the event list Displays a selection list containing all available events (shown below) Event List When you click Apply, the log table window is updated to show only the events in this list Click to toggle highlight Event selection list, displayed when you click the List… button (shown above) Click to toggle highlight W
RMON Log Table Viewing the Error Log To view the error log ● Select File ➤ Error Log… If an error occurs, RMON Log Table notifies you by displaying the error log, with the most recent error message visible. All errors for a given RMON Log Table process are collected in a file called netm.errlog.pid, where pid is this RMON Log Table’s process ID. The file is placed in the temporary directory defined by the environment variable TMPDIR, if this variable exists; otherwise, the file is placed in /usr/tmp.
RMON Log Table 522 5967–9446
User’s Guide RMON Status 5967–9446
RMON Status RMON Status retrieves status information from an agent. It displays the values of all instances of control table entries for an RMON group. You can choose which group to display. For a list of what agents work with RMON Status, refer to table 1 on page 18. When using RMON Status with a multi-interface agent, note that there is one set of status information that includes information from all interfaces. To display status information From Agent Manager or OpenView NNM, select one or more agents.
RMON Status Displaying Status Information Figure 111 RMON Status Window (History Group) Choose from the Group menu to display the values for a particular RMON group Several system variables are shown here Table entries are listed in order by table index To display the status for a different RMON group ● Choose an item from the Group menu. By default, RMON Status shows information for the Statistics group. To view the status for a different group, select an item from the Group menu.
RMON Status Displaying Status Information To view the error log ● Select File ➤ Error Log… If an error occurs, RMON Status notifies you by displaying the error log, with the most recent error message visible. All errors for a given RMON Status process are collected in a file called netm.errlog.pid, where pid is this RMON Status’s process ID. The file is placed in the temporary directory defined by the environment variable TMPDIR, if this variable exists; otherwise, the file is placed in /usr/tmp.
User’s Guide Graphs and Tables 5967–9446
Graphs and Tables Several NetMetrix applications use a graph tool or table tool to display information. These tools provide many features for manipulating the displayed data such that you can visualize the information in a way that best suits your needs. The chapters for the applications that use the graph and table tools discussed here refer you to these pages as needed. The graph tool is discussed below. Information on the table tool begins on page 537.
Graphs and Tables Working with Graphs Figure 112 Sample Enterprise Utilities Graph Color-coded legend Click and hold mouse button 1 to display a time/date stamp for the pointer’s location When you release the mouse button, the graph is centered at the pointer’s location Click to the left of the Y axis to move back one screen Click at right edge of graph to move forward one screen Click mouse button 3 on the graph to display Zoom in x 2 and Zoom in 30% magnify a pop-up menu like the display (showing fe
Graphs and Tables Working with Graphs To control what statistics are shown and how Choose View ➤ Line Configuration… from the graph window. 2 Change the parameters as needed. 1 When you choose View ➤ Line Configuration…, a window like the one in figure 113 on page 531 appears. Each row in this window controls the attributes for a line in the graph. The first two columns, Data Label and On/Off, and the last column, Displayed Values, determine which statistics are shown as lines in the graph.
Graphs and Tables Working with Graphs Figure 113 View ➤ Line Configuration… Statistics are shown as separate pop-up menus In some cases, the option pop-up menus include a “more…” item that lets you select additional statistics Sets the values to display for this statistic: Average (solid line), Minimum or Low Baseline (dotted line), Maximum or High Baseline (dashed line) Selects a scale multiplier for the statistic Determines which statistics are shown Sets the line color and thickness for this stati
Graphs and Tables Working with Graphs To change the display interval and resolution 1 2 Choose View ➤ Time Intervals… Change the Display Interval and Display Width options as needed. When you choose View ➤ Time Intervals…, a window like the one in figure 114 on page 532 appears. The options in this window let you control how much and which portion of the available data is shown in the graph window.
Graphs and Tables Working with Graphs You can also control how much data is shown in the graph window with the graph pop-up menu displayed by mouse button 3. Refer to figure 112 on page 529 for details. For Live Statistics graphs and the Token Ring Source Routing graph, you can control how often new points are added to the graph. The SNMP Polling text field lets you change the rate at which points are added to the graph.
Graphs and Tables Working with Graphs To view statistics for the graph ● Choose View ➤ Statistics… When you choose View ➤ Statistics…, a window like the one in figure 115 appears. For each line in the graph, the statistics window shows the minimum, average, maximum, and most recent data values. The option pop-up menu at the top of the Statistics window lets you display actual data values or the data values as affected by the scale multiplier for the statistic (as set in the Line Configuration window).
Graphs and Tables Working with Graphs To tailor the graph’s appearance ● ● The View menu’s options depend on the graph tool’s version ● ● Choose from the View ➤ Y-axis ➤ menu to set the scale for the graph. Choose from the View ➤ Color/Monochrome ➤ menu or change the View ➤ Color toggle to select whether color is used. Choose from the View ➤ Show/Hide Legend ➤ menu or change the View ➤ Show Legend toggle to indicate whether to display the graph legend.
Graphs and Tables Working with Graphs View ➤ Show/Hide Indicate whether to display or omit the graph legend. Hiding the legend Legend is useful when you have so many lines in the graph that a large part of View ➤ Show Legend the window is used to show the legend. If the graph window is resized to a small height, the legend and menu bar are hidden to provide more room for the graph area, regardless of the Show/Hide Legend setting.
Graphs and Tables Working with Data Tables Working with Data Tables The table tool used by the Enterprise Utilities lets you manipulate the data in the table in several ways. A sample table is shown in figure 112. table tool icon The following pages explain how to: ● Sort the table on selected columns. ● Print the table. ● Save the table in a file.
Graphs and Tables Working with Data Tables To sort a table 1 2 Choose View ➤ Sort… from the table window Specify the columns to sort on. As shown in figure 117, when you choose View ➤ Sort… the table window’s column headings change to column numbers, and a dialog appears asking for the sort’s start and end columns. Using the column numbers in the table window as a guide, specify the columns on which to sort the table.
Graphs and Tables Working with Data Tables To print a table 1 2 Choose File ➤ Print… from the table window Specify the print command to use. To save a table Choose File ➤ Save As… from the table window 2 Specify the file name in which to save the table’s data. 1 When you save the table to a file, the information is saved in ASCII format, with spaces separating the table columns.
Graphs and Tables 540 5967–9446
Index A AAL/5 (ATM) statistics, Load Monitor, 324–327 AAL/5 data link statistics, Reporter, 99–100 AAL/5 per-PVC statistics, Reporter, 100–101 Accumulate, 282 accumulating Load Monitor time values, 282–283 example, 283 activating a suspended report, 131 address format AppleTalk, 211, 365 DECnet, 211, 365 Ethernet, 211, 365 IDP, 211, 365 IP, 211, 365 IPX, 211, 365 VINES, 211, 365 XNS, 211, 365 Address placement, 170, 172–175, 227–229 Address Recognized bit, 371 addrmap, 291, 462, 465, 469, 472, 514 AGENT, 4
User’s Guide Index DECnet address format, 211, 365 decode, protocols, 407–415 default configuration Internetwork Monitor, 243 Load Monitor, 304 Protocol Analyzer, 401–402, 402, 404 Default Scale, 277, 282 deleting instances Protocol Analyzer, 352 demonstration mode, Reporter, 51 DESCRIPTION, 443 Detail pane Protocol Analyzer, 383 DISPLAY, 134, 148 Display Now printing, 55 Report Definition window, 65 Status window, 54 displaying network load, 258–283 DURATION, 150 Duration graph parameters, 77–109 E E1 Fra
User’s Guide Index axes, 155 fonts, 160 footer, 156 header, 156 legend, 157 graph style, Reporter, 155, 158–159 graph tool, 528–536 example, 529 graph type, changing Load Monitor, 299 graph types, Reporter, 37–39 Component Health, 38, 114–122 examples, 39, 78, 82, 86, 88, 109, 118 Network Health, 37, 83, 85–88 Protocol Distribution, 37, 75–78 required data, 42 Response Profile, 37, 105, 107–109 Top N, 37, 79–82 grapher displaying, 54, 65 printing, 55 graphical fields Load Monitor, 290 graphs adding to repo
User’s Guide Index LanProbe IP address tracking, 511– 514 launching, tools from Internetwork Monitor, 212–216 layout, 147–148 ldmp.
User’s Guide Index node placement, Internetwork Monitor, 170, 172–175, 227–229 node statistics, 461–467 exporting, 467 graph, 462–463 table, 465–466 nodes, Internetwork Monitor moving, 208–209 non-routed traffic, Internetwork Monitor, 235–236 O OBJECT, 443 Octets(M) notation, 82, 151 OpenView, launching applications Internetwork Monitor, 164–166 Load Monitor, 248–252 Protocol Analyzer, 342–343 Reporter, 52 output, setting for reports, 67–68, 132–138 Command, 132, 137–138 File, 132, 135 Mail, 132, 136 PostS
User’s Guide Index scrolling, 383 packet match counts, 396–398 example, 397–398 packet trace creating, 393 loading, 394, 406 printing, 392 properties loading, 403 saving, 403 protanal command, 405–406 examples, 406 syntax, 405 protocol decodes, 407–415 saving data, 393 searching, 387–388 slicing, 356, 357 START button, 342, 344, 349, 353 starting, 341–343 from Internetwork Monitor, 215– 216 standard RMON, 342–343 STOP button, 344, 354 Summary pane, 383 tailoring, 389–391 Traffic Trend, 396–398 example, 397
User’s Guide Index RUNTIME, 151 S sample reports, 61–69 saving configuration files Internetwork Monitor, 243 Load Monitor, 303 Protocol Analyzer, 400 data Protocol Analyzer, 393 filter, 400 model, Internetwork Monitor, 225 properties Internetwork Monitor, 243 Load Monitor, 303 Protocol Analyzer, 403 report file, 66, 69 table tool data, 539 scale changing, 301–302 defaults, 282 schedule, setting for reports, 67–68, 125–131 custom, 129–130 daily, 127 monthly, 128 weekly, 126 Screen output, Reporter, 132, 134
User’s Guide Index THRESHOLD, 443 threshold alarms, 435, 436–437, 439–440 Internetwork Monitor, 195–196 Load Monitor, 296 TMPDIR, 44, 59, 169, 257, 345 token ring, 491–501 remove station, 498–499 ring entry errors, 500–501 ring order, 495–496 ring status, 493–494 source routing, 497 statistics, Load Monitor, 311–314 statistics, Reporter, 91–92 Top N graphs, 37, 79–82 trace file creating, 393 loading, 394, 406 traffic matrix statistics, 468–474 exporting, 474 graph, 469–471 table, 472–473 Traffic placement,
© Copyright Hewlett-Packard Company 1999 All Rights Reserved. Reproduction, adaptation, or translation without prior written permission is prohibited, except as allowed under the copyright laws. Manual Part No.
