Designing and Managing Behavior Models - Behavior Models and Their Components - Constructing Behavior Models - How the Pieces Fit Together -
Constructing Behavior Models      NerveCenter Support for SNMP v3

How the Pieces Fit Together

Let's first review how you define which managed nodes a behavior model will monitor and manage. As Nodes, Property Groups, and Properties shows, each node belongs to a property group, and that property group contains properties.

Nodes, Property Groups, and Properties

Any set of nodes that share a unique property can be managed as a set of devices. (The nodes need not be members of the same property group.) In the figure above, the tcp property might be that unique property.

For a node to be pollable, the principal requirements are that:

• The poll's property must be in the node's property group.
• The base object around which the poll's poll condition is built must be a property in the node's property group.
• The poll's trigger must correspond to a pending alarm transition, and the alarm's property must be in the node's property group.

Relationship Between Node and Poll shows the definition of a poll that has been designed to work with the node shown in Nodes, Property Groups, and Properties.

Relationship Between Node and Poll

As you can see, the node's property group, Mib-II, contains a property tcp that matches the poll's property and the base object used in the poll's poll condition. Once this poll is enabled, the poll TcpMedRetrans will poll the node, unless there is no alarm that the poll can affect or the node is suppressed. (If the node is suppressed, no polling will occur because the poll is marked suppressible.)

---

   Since trap masks do not have properties, this type of matching is not necessary for masks.

---

If TcpMedRetrans polls the node, receives a response to its query, and that response satisfies the poll condition, the poll will fire a trigger. If an alarm has been defined whose first transition is tcpRetransMed (the poll's trigger) and that alarm is enabled has the property tcp, a new instance of that alarm will be instantiated to monitor the node. Because the alarm is instantiated using the trigger's Node and Subobject, the key attributes of the trigger and alarm will match, and the first transition will be effected.

Once an alarm instance has been instantiated and has gone through one transition, the transitions that can be effected from its current state determine which triggers affect the alarm. For example consider the following alarm, TcpRetransMon.

An Alarm: TcpRetransMon

When this alarm is first instantiated and the tcpRetransMed transition is made, the alarm transitions to the tcpMedRtrans state, so two transitions are pending: tcpRetransNorm and tcpRetransHigh. If NerveCenter sees a trigger with one of those names, and the trigger's Node and Subobject match those of the transition, the transition occurs.

An Example of a Behavior Model

This section presents an overview of the set of steps you would need to perform to create a behavior model that monitors node interfaces. The possible interface conditions are link up and link down.

---

   Don't try to follow these directions. Just read over them to get an overview of the procedure. Detailed procedures are available in following chapters.

---

1. Create a property group named CheckLink.
2. Add to this property group the properties ifEntry (base object) and
   checkLink (user defined).
3. Assign the property group CheckLink to all of the managed nodes whose interfaces you want to monitor.
4. Create two masks: LinkUp and LinkDown.

   The values you use to create LinkUp are shown in the table below.

   Values Needed to Create LinkUp

   Attribute	Value
   Name	LinkUp
   Generic	LinkUp=3
   Trigger Type	Simple Trigger
   Enabled	On

   ---

   The definition for LinkDown is the same as the definition of LinkUp except for the name of the mask and Generic SNMP trap number (LinkDown=2).

5. Create the alarm shown below.

   

   Once this alarm is enabled, the behavior model will become functional.

   The IfLinkUpDown alarm contains the property ifEntry, which is in the property group CheckLink. Even though a trap mask filters all traps sent to NerveCenter, the IfLinkUpDown alarm will only become instantiated when the SNMP agent sending the trap belongs to a node in the CheckLink property group.

Here's how the behavior model might interact with one port on a workstation that belongs to the property group:

1. The mask LinkDown will cause a transition to the DownTrap state, as well as start a three-minute timer (linkTimer).
2. If the agent comes back up, then the alarm transitions back to Ground and the timer is cleared.
3. If three minutes has past, and the interface remains down, then the alarm transitions to LinkDown, and sends a 7004 Inform to the network management platform.