Getting a Quick Start with NerveCenter - Working with Behavior Models - Enabling the IfLoad Behavior Model -
Previous: Poll that Triggers the Alarm Next: Monitoring Alarms

Enabling the IfLoad Behavior Model

The IfLoad behavior model monitors each interface on managed nodes and determines whether device load is low, medium, or high. Load is the amount of interface traffic compared to the media's capacity, expressed as a percentage. There are two definitions for each load level -- one for point-to-point networks and one for broadcast networks.

This model can give an immediate impression of network and system utilization. By measuring traffic against capacity, you can determine, for example, whether more file servers need to be added to the network. The model can also be used to track traffic-related trends and identify runaway processes that are using network resources.

Viewing the IfLoad Alarm

The IfLoad alarm is instantiated when the load on a node changes from low to medium or high. To see how the alarm monitors load conditions, open the alarm's definition window.

To open the IfLoad Alarm Definition window:

From the client's Admin menu, choose Alarm Definition List.
The Alarm Definition List window is displayed.
Select the IfLoad alarm and select Open.
The Alarm Definition window is displayed. Below is a picture of the alarm's finite state diagram.
IfLoad Alarm State Diagram

Click the thumbnail above to view full-sized image.

As you can see from the diagram, the alarm contains four states:

LowLoad -- For point-to-point networks, indicates that the load is less than 10% of maximum utilization. For broadcast networks, the load is less than 0.1% of maximum utilization. This state has a severity level of Normal, indicated by a green icon.
MediumLoad -- For point-to-point networks, indicates that the load is 10-75 percent of maximum utilization. For broadcast networks, the load is 0.1-1 percent of maximum utilization. The alarm enters this state when it detects a mediumLoad trigger. This state has a light blue icon, indicating a traffic severity of Medium.
HighLoad -- For point-to-point networks, indicates that the load is greater than 75 percent of maximum utilization. For broadcast networks, the load is greater than 1 percent of maximum utilization. The alarm enters this state when it detects a highLoad trigger. This state has a cyan icon, indicating a traffic severity of High.
The HighLoad state fires a trigger after the alarm has received its third HighLoad trigger. The trigger transitions the alarm to the HighLoadPersists state and can be seen by double-clicking the HighLoad circular transition.
HighLoadPersists -- The interface being monitored has experienced a high load for three successive polls, at which time an inform is sent to the platform. This state has a yellow icon, indicating a monir fault severity.

When the alarm has entered the MediumLoad, HighLoad, or HighLoadPersists state, receiving a lowLoad trigger returns the alarm to Low and clears any alarm instances.

Poll That Triggers the Alarm

The ifLoadRates poll is responsible for triggering the high, medium, and low states in the IfLoad alarm.The poll solicits load information from managed nodes and fires one of three triggers when its specified condition is detected in a node. Each trigger transitions the corresponding state in the IfLoad alarm.

To see how the ifLoad alarm is instantiated, open the definition window for the ifLoadRates poll.

To open the ifLoadRates Poll Definition window:

From the client's Admin menu, choose Poll List.
The Poll List window is displayed.
Select the ifLoadRates poll and select Open.
The ifLoadRates Poll Definition window is displayed.
IfLoadRates Poll Definition Window

Click the thumbnail above to view full-sized image.

The Designing and Managing Behavior Models book shipped with NerveCenter describes polls in detail. For now, however, you will take only a cursory look at the ifLoadRates poll. Note specifically the following poll attributes:

Property -- Though the poll is not assigned a specific property, it is configured to detect certain ifEntry MIB object values. This means that a node's property group must include these attributes before it can be polled.
Poll Rate -- The polling period is set to five minutes by default. This means that, when you enable the alarm, you must wait that long between polls.
Poll Condition -- The poll condition contains a formula that determines when the increase in a node's traffic exceeds a predefined value. There are two sets for each poll -- one for point-to-point networks and one for broadcast networks.
Triggers -- A FireTrigger() command fires one of three triggers when the corresponding condition is detected in a node. The triggers are: HighLoad, MediumLoad, and LowLoad.

Turning on the alarm

You enable the behavior model by turning on its alarm and polls. In our case, because all polls are turned on by default when you install NerveCenter, you need only turn on the alarm.

To turn on the IfLoad alarm:

From the client's Admin menu, choose Alarm Definition List.
The Alarm Definition List window is displayed.
Select the IfLoad alarm and select Open.
The Alarm Definition window is displayed.
Select the Enabled On radio button.
Select Save.

The IfLoad alarm is now enabled and will transition when any of its associated polls detect a medium or high load condition on a managed node.

Generating an Alarm Instance

Your next step is to make sure one of your managed nodes causes an IfLoad alarm instance. One easy way to do this is to start a fairly large software application on the node, thus temporarily increasing its load.

To increase the load on a node:

An alarm should be instantiated for this node during the next poll.

Previous: Poll that Triggers the Alarm	Next: Monitoring Alarms
Please send comments or corrections to Information Development	This file was last updated on 10 October 2000