Monitoring Your Network - Understanding NerveCenter - Main NerveCenter Components - The NerveCenter Database -
Previous: The NerveCenter Server     Next: The NerveCenter User Interface

The NerveCenter Database

The NerveCenter database is primarily a repository for the NerveCenter objects that make up a set of behavior models. The principal objects used in these models are:

• Nodes
• Property groups and properties
• Polls
• Trap masks
• Alarms

For brief explanations of what these objects are and how they are used, see Objects in the Database.

A set of objects that define many useful behavior models ships with NerveCenter and is available as soon as you've installed the product. For a list of these predefined behavior models, see the section Predefined Behavior Models.

On UNIX systems, the NerveCenter database is implemented as a flat file. On Windows NT systems, the database can be either a Microsoft Access database or a Microsoft SQL Server database.

Objects in the Database

This section contains brief definitions of the basic objects used in the construction of behavior models.

• Nodes

  A node represents either a workstation or a network device, such as a router. Each node has an attribute called its property group that controls which behavior models NerveCenter will employ in managing the node.

  ---

  Note    Strictly speaking, a node is not part of a behavior model; rather, it is the entity managed by a behavior model.

  ---

• Property groups and properties

  As mentioned above, each node has a property group. This property group is simply a container for a set of properties, which are strings that typically either describe the type of node or name an object in the MIB used to manage the node. It is actually a node's properties, rather than its property group, that determine whether a particular behavior model will be used to manage that node.

• Polls

  A poll defines what MIB variables NerveCenter should request the values of, how those values should be evaluated, and what action the poll should take. If the poll takes an action, it will be to fire a trigger, which may cause a state transition in one of NerveCenter's finite state machines.

• Trap masks

  A trap mask describes an SNMP trap and contains the name of a trigger. If NerveCenter receives an SNMP trap that matches the description given in the trap mask, NerveCenter fires a trigger with the name defined in the trap mask. If NerveCenter receives a trap that does not match a trap mask, it discards that trap.

• Alarms

  NerveCenter's finite state machines are called alarms. Each alarm defines a set of operational states (such as Normal and Down) and transitions between the states. Transitions are effected by the receipt of the proper trigger and can have actions associated with them. If actions are associated with a transition, the server performs these actions each time the transition takes place.

Behavior Models

Once a set of managed nodes has been defined, NerveCenter's monitoring activities are controlled by a set of behavior models. A behavior model is the group of NerveCenter objects required to detect and take action upon a single network condition, such as high traffic on an interface.

The central object in each behavior model is a deterministic finite state machine called an alarm. For instance, the alarm shown below tracks the level of traffic on an interface.

Alarm State Diagram

The possible states in this alarm are low, medium, and high. And these states have the severities Normal, Medium, and High, respectively. (The color of each state denotes its severity.) The gray rectangles in the alarm represent state transitions.

What about the inputs and outputs of the state machine? The inputs are called triggers and can come from several sources. For example, one predefined NerveCenter poll queries the SNMP agent on a device for the level of traffic on, and the capacity of, each interface on the device. If the level of use exceeds a certain percentage of the capacity for an interface, the poll fires the trigger mediumLoad, which can cause a state transition in an alarm.

The outputs of an alarm are called alarm actions. These actions are associated with the transition from one state to another by the designer of a behavior model, and NerveCenter performs these actions each time the transition occurs. There are many possible actions, including the following:

• Sending an audible alert to the workstation on which the NerveCenter Client is being run
• Executing a program or script
• Deleting a node from the NerveCenter database
• Informing a network management platform of a condition
• Logging information to a disk file
• Sending mail to an administrator
• Paging an administrator
• Sending an SNMP trap
• Setting a MIB attribute

Predefined Behavior Models

When you install NerveCenter and create a new database, that database contains the objects that make up a number of predefined behavior models. These include behavior models for:

• Detecting authentication failures
• Monitoring the error rate on network interfaces
• Monitoring link-up and link-down traps
• Monitoring the amount of traffic on network interfaces
• Indicating the status of network interfaces: up, down, and so on
• Detecting errors that inhibit accurate SNMP device management
• Determining whether a device is down, unreachable, up without an agent, or up with an agent
• Giving early warning concerning TCP connection saturation
• Verifying that the current TCP retransmission algorithm is the most efficient
• Categorizing devices based on TCP retransmission activity
• Logging information about SNMP traps

NerveCenter also includes predefined behavior models that you can import to monitor specific vendors' devices and additional models for troubleshooting, interface status, data collection, and downstream alarm suppression.