What's changed: Initial version
5.1Network management & monitoring
Covers device monitoring via SNMP (manager/agent/MIB/OID), the trade-off between polling and traps, the security hardening of SNMPv3, flow monitoring with NetFlow/sFlow, event collection via syslog, and the design thinking behind monitoring design for early fault detection.
For a network operator, "noticing after a failure occurs" and "detecting early warning signs and acting first" lead to very different service impacts. This section combines SNMP, which periodically and proactively grasps device state, flow monitoring, which gives a bird's-eye view of large volumes of traffic, and syslog, which aggregates events, to build the judgment needed to design monitoring that detects anomalies early.
5.1.1How SNMP works (manager/agent/MIB/OID)
- SNMP (Simple Network Management Protocol) is a protocol for centrally monitoring and managing network devices. It consists of a manager (the monitoring server that watches) and an agent (software resident on routers, switches, etc. that is watched).
- The MIB (Management Information Base) is the hierarchical database definition of the management information an agent exposes. Each individual managed item (interface traffic volume, CPU usage, etc.) is uniquely identified by an OID (Object Identifier), a number in a tree structure. The manager specifies an OID to get or set a value.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.