Getting a Quick Start with NerveCenter - Working with Behavior Models - How Behavior Models Operate -
Understanding Behavior Models      Importing the IfData_LogToFile Behavior Model

How Behavior Models Operate

A behavior model is based on the following operational construct: A NerveCenter trigger-generating object detects a network event on a targeted node and raises a trigger. This trigger generator might be a NerveCenter poll that looks for a specified network condition or a trap mask that detects a certain type of SNMP trap. NerveCenter has other trigger generators as well, such as alarm actions, Perl subroutines, and masks that detect IT/Operations messages. The node is targeted by virtue of its assigned property group.

An alarm detects the trigger coming from the trigger generator. An alarm is a finite state machine that transitions from one state to the next and performs any actions assigned to a transition.

Relationships Among Objects in a Simple Behavior Model shows the interaction of objects in a sample behavior model that uses a single poll and alarm.

Relationships Among Objects in a Simple Behavior Model

When an alarm detects its first trigger, the alarm transitions to the next state, where it remains until another trigger is received -- either from the same or another trigger generator. For example, an alarm might detect a trigger from a poll when an interface on a router goes down. Continued polling would indicate whether the first trigger signified only a momentary network flutter or whether the interface is actually down. The sequence of transitions enables NerveCenter to monitor persistent, simultaneous, or sequential events that, taken together, indicate a critical or important condition.

All associated components must be operational for the behavior model to function. For example, a poll is requested only when there is at least one node targeted to receive the poll -- a node whose property group contains the MIB base object defined in the poll and additionally any property assigned to the poll. Furthermore, an alarm must be enabled and contain a transition that the poll can trigger. If the alarm is assigned a property, the node's property group must include that property as well. NerveCenter implements these restrictions to control network traffic.

---

   A behavior model can consist of multiple alarms and trigger generators. Conversely, any of these objects can be associated with more than one behavior model.

---

NerveCenter can implement a broad range of actions when an alarm is instantiated. A transition might cause NerveCenter to send a trap, e-mail, or page. NerveCenter can also log alarm data, send a message to a network management platform, and perform corrective actions such as setting SNMP attribute values. Finally, all actions can be performed conditionally, based on user-defined criteria such as time of day, severity of the alarm, type of node, and so on.