Using Alarm and Event group of Remote Network Monitoring (RMON)

Working principle and example of setting

Setting RMON Alarm entries with the SetRMONAlarm LUA script application

Introduction

The goal of this document is to describe how to use LoriotPro software for the management of the alarm group and event group of the remote network monitoring snmp mib.

RMON is used to remotely monitor devices with SNMP. Many devices like routers and switches support these two groups, it is also true for the dedicated RMON probes. The support of RMON is generally provided in the SNMP agent or in a sub agent of the device.

The RMON mib defines multiple groups but we will focus on the Event and Alarm group.

Event Group: The Event group supports the definition of events. An event is triggered by a condition defined in the “Alarm group” or elsewhere in the MIB. When a condition is met, defined action is performed and causes an information to be logged or a SNMP Trap message to be sent, or both of them.

Alarm Group: The Alarm group is used to define a set of threshold on the values of objects located in the MIB. If a threshold is crossed either when the mib object value becomes higher or lower a previously defined event is generated.

Remark: In any cases, the Alarm Group requires the implementation of the Event group for operation. The Event table should be filled with the event number used by the alarm entries.

Working principle

Before configuring the Event table and Alarm table, it is necessary to know what we need to monitor within the hundreds of MIB object. This requires a good knowledge of what and where to find the mib objects.

In the example used in this document we will monitor objects of the Ethernet Statistics table of the RMON mib.

ethernet statistics table

But is could be any object of the MIB as soon as these objects are of ASN Integer type (INTEGER, Integer32, Counter32, Counter64,Gauge, or TimeTicks)

To achieve the goal of sending a trap to LoriotPro the snmp agent event and alarm group should be configured. The configuration process requires creating at least one entry for an event in the Event table and entries for each mib object to monitor in the Alarm table.

RMONAlarm

When an Alarm is set in the Alarm table and if the condition is met, for example the value of the monitored object reach the threshold and event is generated. The event has a unique number in the Event table.

Here under a list of event configured in an Ethernet Switch from Alcatel (model 6624). The event type defines the type of action that will be triggered (send a trap or generate a log).

rmon event table

Remark: The switch should be configured to send trap to LoriotPro elsewhere in its configuration.

As an example of setting, we set alarms on the snmp object etherStatspkts and etherstatsbroadcastpkts.

Both of them are available in the etherstats table of the RMON mib.

etherStatspkts: The total number of packets (including bad packets, broadcast packets, and multicast packets) received.

Etherstatsbroadcastpkts : The total number of good packets received that were directed to the broadcast address. Note that this does not include multicast packets.

After a short baseline analysis of the interface traffic, we decide to set two thresholds, The rising Alarm at 25 pkt/s and the falling alarm at 10 pkts/s.

rmon

The setting is performed with the RMON Alarm setting application written in LUA and explains in a next chapter of this document

If we have a look at the RMON Alarm table in the Loriotpro Mib tree

rmon alarm entry

On the Alcatel switch we can see the same table, this table is not very useful because the snmp object is not displayed, thus better use the MIB table.

alcatel swicth rmon alarm

Here under an example of trap received from the alarm index 100, the last measured value is 2638 and goes over the threshold of 250 pkts/10s.

Be ware that the sampling is done each 10 second and the value is a delta value between to successive collect. The threshold is set on a number of packets for 10 seconds interval too

rmon trap

Setting RMON Alarm entries with the SetRMONAlarm LUA script application

To perform the configuration of entries in the RMON Alarm table and in the RMON Event table we do provide the SetRomnAlarm LUA script application.

What does this program do ?

It can create one or more entries in the RMON Event Table
It can create one or more entries in the RMON Alarm Table
It display the RMON Event Table
It display the RMON Alarm Table

WARNING: This LUA script application requires for working LoriotPro Extended Edition of release (-cl) or higher.

The RMON mib should be compiled on LoriotPro, check in the MIB tree for the RMON branch.

The device that you want to configure should support the RMON Alarm and Event group.

Installation

The SetRMONAlarm application should be located in the /bin/config/script/ directory of LoriotPro.

If you do not see it there download it from this location:SetRMONAlarm.zip

Configuration

Before launching it you should customize the script for your own settings.

At the end of the script you should find where the main settings are performed.

1 - You should define a list of event entries

Example of Event entry creation:

CreateEvent(12,"Event 12",3,"public","loriotpro",deb);

This command creates the event number 12, with the description “Event 12".

The action of the event is to send a snmp trap. The communauty used will be public and the owner of this entry in the table is LoriotPro.

If deb is previously set to 1 a verbose mode is used to debug.

2 - You should define a list of alarm entries.

Exemple of Alarm entry creation

CreateAlarm(101,10,"etherstatsbroadcastpkts.1009",2,1,250,0,11,0,"LoriotPro",deb);--Rising 250pkts/10s

This command creates the alarm number 101, with the sampling interval of 10 seconds.

The snmp object collected is etherstatsbroadcastpkts.1009.

The alarmSampleType is set to 2 meaning that we use the delta value to compare to threshold.

The alarmStartupAlarm is set to 1 meaning that we want to trigger on the rising threshold.

The rising threshold is set to 250.

The falling threshold is set to 0 (not set)

The rising event is the event number 11 defined previously

The falling event is not set (value 0)

The owner of this entry is “LoriotPro”

If deb can be previously set to 1, a verbose mode is used to debug.

How to launch the script.

If you have modified the script from the Script editor (from the main menu select Tools -> Script Editor (Extended Edition))

Load the script for editing. Select Compiler -> Run Script to launch it.

You can also launch a script from the directory and its contextual menu or from the Report Center.

Here under screenshots of the execution of the program. (with the default values provided)

rmon set script lua

event table rmon

alarm group table rmon

Description of the RMON Event Group

The path to the RMON Event group in the MIB is provided below in numerical and string format.

OID LEN (8) : 1.3.6.1.2.1.16.9.

iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).rmon(16).event(9)

This branch contains the Event Table

rmon mib event

eventIndex Type : Integer32 (1..65535)	An index that uniquely identifies an entry in the event table. Each such entry defines one event that is to be generated when the appropriate conditions occur.
eventDescription Type : DisplayString (SIZE (0..127))	comment describing this event entry.
eventType Type : INTEGER Possible values:none(1),log(2),snmptrap(3),logandtrap(4)	The type of notification that the probe will make about this event. In the case of log, an entry is made in the log table for each event. In the case of snmp-trap, an SNMP trap is sent to one or more management stations."
eventCommunity Type : OCTET STRING (SIZE (0..127))	If an SNMP trap is to be sent, it will be sent to the SNMP community specified by this octet string."
eventLastTimeSent Type : TimeTicks	The value of sysUpTime at the time this event entry last generated an event. If this entry has not generated any events, this value will be zero."
eventOwner Type : OwnerString	The entity that configured this entry and is therefore using the resources assigned to it. If this object contains a string starting with 'monitor' and has associated entries in the log table, all connected management stations should retrieve those log entries, as they may have significance to all management stations connected to this device
eventStatus Type : EntryStatus	The status of this event entry. If this object is not equal to valid(1), all associated log entries shall be deleted by the agent."

Description of the RMON Alarm Group

The path to the RMON alarm group in the MIB is provided below in numerical and string format.

OID LEN (8) : 1.3.6.1.2.1.16.3.

iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).rmon(16).alarm(3)

The branch contains a single table the Alarm Table:

rmon mib alarm

Each object in the alarm group is explained below.

alarmIndex

Type : Integer32

An index that uniquely identifies an entry in the alarm table. Each such entry defines a diagnostic sample at a particular interval for an object on the device.

alarmInterval

Type : Integer32

The interval in seconds over which the data is sampled and compared with the rising and falling thresholds.

When setting this variable, care should be taken in the case of delta Value sampling - the interval should be set short enough that the sampled variable is very unlikely to increase or decrease by more than 2^31 - 1 during a single sampling interval.

This object may not be modified if the associated alarm Status object is equal to valid(1.

alarmVariable

Type : OBJECT IDENTIFIER

The object identifier of the particular variable to be sampled.

Only variables that resolve to an ASN.1 primitive type of INTEGER (INTEGER, Integer32, Counter32, Counter64,Gauge, or TimeTicks) may be sampled.

alarmSampleType

Type : INTEGER

Possible values:

absolute Value (1)

delta Value (2)

The method of sampling the selected variable and calculating the value to be compared against the thresholds.

If the value of this object is absolute Value (1), the value of the selected variable will be compared directly with the thresholds at the end of the sampling interval.

If the value of this object is delta Value (2), the value of the selected variable at the last sample will be subtracted from the current value, and the difference compared with the thresholds.

This object may not be modified if the associated alarm Status object is equal to valid(1.

alarmValue

Type : Integer32

The value of the statistic during the last sampling period.

For example, if the sample type is delta Value, this value will be the difference between the samples at the beginning and end of the period.

If the sample type is absolute Value, this value will be the sampled value at the end of the period.

This is the value that is compared with the rising and falling thresholds. The value during the current sampling period is not made available until the period is completed and will remain available until the next period completes."

alarmStartupAlarm

Type : INTEGER

Possible values:

rising Alarm (1)

falling Alarm (2)

rising Or Falling Alarm (3)

The alarm that may be sent when this entry is first set to valid.

If the first sample after this entry becomes valid is greater than or equal to the risingThreshold and alarmStartupAlarm is equal to rising Alarm (1) or rising Or Falling Alarm (3), then a single rising alarm will be generated.

If the first sample after this entry becomes valid is less than or equal to the falling Threshold and alarm Startup Alarm is equal to falling Alarm (2) or rising Or Falling Alarm (3), then a single falling alarm will be generated.

This object may not be modified if the associated alarmStatus object is equal to valid(1).

alarmRisingThreshold

Type : Integer32

A threshold for the sampled statistic.

When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single event will be generated.

A single event will also be generated if the first sample after this entry becomes valid is greater than or equal to this threshold and the associated alarm Startup Alarm is equal to rising Alarm (1) or rising Or Falling Alarm (3).

After a rising event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches the alarm Falling Threshold.

This object may not be modified if the associated alarm Status object is equal to valid(1)."

alarmFallingThreshold

Type : Integer32

A threshold for the sampled statistic.

When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single event will be generated.

A single event will also be generated if the first sample after this entry becomes valid is less than or equal to this threshold and the associated alarm Startup Alarm is equal to falling Alarm(2) or rising Or Falling Alarm(3).

After a falling event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches the alarm Rising Threshold.

This object may not be modified if the associated alarm Status object is equal to valid(1)."

alarmRisingEventIndex

Type : Integer32

The index of the eventEntry that is used when a rising threshold is crossed.

The eventEntry identified by a particular value of this index is the same as identified by the same value of the eventIndex object.

If there is no corresponding entry in the eventTable, then no association exists.

In particular, if this value is zero, no associated event will be generated, as zero is not a valid event index.

This object may not be modified if the associated alarmStatus object is equal to valid(1)."

alarmFallingEventIndex

Type : Integer32

The index of the eventEntry that is used when a falling threshold is crossed.

The eventEntry identified by a particular value of this index is the same as identified by the same value of the eventIndex object. If there is no corresponding entry in the eventTable, then no association exists.

In particular, if this value is zero, no associated event will be generated, aszero is not a valid event index.

This object may not be modified if the associatedalarmStatus object is equal to valid(1)."

alarmOwner

Type : OwnerString

The entity that configured this entry and is therefore using the resources assigned to it."

alarmStatus

Type : EntryStatus

The status of this alarm entry."

End of document


	Newsletter \| Forum \| Contact Us \| News \| Products \| Downloads \| Support \| Partners