Getting a Quick Start with NerveCenter - Working with Behavior Models - Enabling the IfLoad Behavior Model -
Enabling the IfData_LogToFile Behavior Model      Turning on the alarm

Enabling the IfLoad Behavior Model

The IfLoad behavior model monitors each interface on managed nodes and determines whether device load is low, medium, or high. Load is the amount of interface traffic compared to the media's capacity, expressed as a percentage. There are two definitions for each load level -- one for point-to-point networks and one for broadcast networks.

This model can give an immediate impression of network and system utilization. By measuring traffic against capacity, you can determine, for example, whether more file servers need to be added to the network. The model can also be used to track traffic-related trends and identify runaway processes that are using network resources.

Viewing the IfLoad Alarm

The IfLoad alarm is instantiated when the load on a node changes from low to medium or high. To see how the alarm monitors load conditions, open the alarm's definition window.

 
  To open the IfLoad Alarm Definition window:

1. From the client's Admin menu, choose Alarm Definition List.

   The Alarm Definition List window is displayed.

2. Select the IfLoad alarm and select Open.

   The Alarm Definition window is displayed. Below is a picture of the alarm's finite state diagram.

   IfLoad Alarm State Diagram

   

As you can see from the diagram, the alarm contains four states:

• LowLoad -- For point-to-point networks, indicates that the load is less than 10% of maximum utilization. For broadcast networks, the load is less than 0.1% of maximum utilization. This state has a severity level of Normal, indicated by a green icon.

  ---

     Double-click the state to see what severity it has, or select the Notes button for a full description of the alarm.

  ---

• MediumLoad -- For point-to-point networks, indicates that the load is 10-75 percent of maximum utilization. For broadcast networks, the load is 0.1-1 percent of maximum utilization. The alarm enters this state when it detects a mediumLoad trigger. This state has a light blue icon, indicating a traffic severity of Medium.
• HighLoad -- For point-to-point networks, indicates that the load is greater than 75 percent of maximum utilization. For broadcast networks, the load is greater than 1 percent of maximum utilization. The alarm enters this state when it detects a highLoad trigger. This state has a cyan icon, indicating a traffic severity of High.

  The HighLoad state fires a trigger after the alarm has received its third HighLoad trigger. The trigger transitions the alarm to the HighLoadPersists state and can be seen by double-clicking the HighLoad circular transition.

• HighLoadPersists -- The interface being monitored has experienced a high load for three successive polls, at which time an inform is sent to the platform. This state has a yellow icon, indicating a minor fault severity.

When the alarm has entered the MediumLoad, HighLoad, or HighLoadPersists state, receiving a lowLoad trigger returns the alarm to Low and clears any alarm instances.

Poll That Triggers the Alarm

The ifLoadRates poll is responsible for triggering the high, medium, and low states in the IfLoad alarm.The poll solicits load information from managed nodes and fires one of three triggers when its specified condition is detected in a node. Each trigger transitions the corresponding state in the IfLoad alarm.

To see how the ifLoad alarm is instantiated, open the definition window for the ifLoadRates poll.

 
  To open the ifLoadRates Poll Definition window:

1. From the client's Admin menu, choose Poll List.

   The Poll List window is displayed.

2. Select the ifLoadRates poll and select Open.

   The ifLoadRates Poll Definition window is displayed.

   

The Designing and Managing Behavior Models book shipped with NerveCenter describes polls in detail. For now, however, you will take only a cursory look at the ifLoadRates poll. Note specifically the following poll attributes:

• Property -- Though the poll is not assigned a specific property, it is configured to detect certain ifEntry MIB object values. This means that a node's property group must include these attributes before it can be polled.
• Poll Rate -- The polling period is set to five minutes by default. This means that, when you enable the alarm, you must wait that long between polls.
• Poll Condition -- The poll condition contains a formula that determines when the increase in a node's traffic exceeds a predefined value. There are two sets for each poll -- one for point-to-point networks and one for broadcast networks.
• Triggers -- A FireTrigger() command fires one of three triggers when the corresponding condition is detected in a node. The triggers are: HighLoad, MediumLoad, and LowLoad.