So now we're going to move on and talk about troubleshooting using SNMP.
In this module,
we're going to troubleshoot an issue with the network management system,
not an issue with the system itself,
but troubleshoot a network issue using the network management system.
And then we'll end the course with a brief discussion on monitoring itself,
some of the dos and don'ts that I've discovered over the
last few years of doing network monitoring.
Some of the items are pretty common sense,
but you'd be surprised at how many people just don't put that kind of
critical thinking into setting up their monitoring system.
So we, as the network administrator, have just gotten a phone call,
it's one of those wonderful phone calls,
very non-specific, hey, the computer has seemed to be kind of slow,
can you check things out and see what might be going on.
We all love getting those calls,
it could be anything from software on the workstation running
amuck to an outage with your WAN carrier.
Well, if we have proper network monitoring in place,
then this is a lot easier to troubleshoot.
So the first thing we do is we go into our network management console.
We already see that there are two alarms.
We could look at those alarms and that'll give us a
clue as to where to start looking.
So we'll view all the alarms, and right now,
there is only the SSL certificate sensor for our router so
that's not really going to help us with anything.
So the next thing we can do is check out the devices on the network.
So we'll go look at our device list here.
Everything still appears to be in the green all the way down,
except of course with that lovely SSL certificate.
So let's have a look at the server itself.
So we'll go to GLOBO-SRV1, the ping time looks okay,
the CPU load looks okay, but this graph down here,
the ethernet traffic says it looks like it's pushing 62 MB,
which obviously is quite a bit.
You see that it's all inbound traffic.
Depending upon the normal traffic loads and what's actually
going on that server could be normal, it could be not.
In our case,
it's not normal and the only reason that the network management software
hasn't flagged it as being outside of the baseline is because I've
honestly just started the traffic a little bit ago.
I'm using a product called iPerf that generates traffic,
and I'm pushing 60 MB of traffic over to that server.
I could very easily do 600 MB since it is a gigabit adapter that's connected.
And we could watch the sensor jump up here in just a
moment after it takes some time to poll,
but we'll notice that even after running for a couple of minutes,
we can go back here and see that it's been running for about 5 minutes actually,
we still aren't getting the values that we expect here.
We're still only showing about 48 MB, which obviously is not correct.
The reason for this is because this particular poller is polling a 32-bit value.
You see right here under sensor type where it says sensor traffic
32-bit and what's happening is is the counter is rolling over and
the network monitoring software is interpreting that as a lower
amount than it actually is.
This is why I always recommend using a 64-bit counter if it's available.
This one is just what happens to be built into PRTG for SNMP.
Now if we go back and we add a WMI poller on the same server,
I bet you we get the correct information.
So we'll hit Add Sensor and decided we want to do traffic on a Windows box,
and we will add Windows network card, and after just a moment,
we're presented with the only actual value network adapter on the
host which is the Microsoft Hyper-V network adapter.
With SNMP,
you get a lot more information just as we saw earlier on
when we were using the SNMP Walk tool, we see all of the different interfaces.
However, WMI, which is what this particular poller is using,
is a lot more specific.
So we'll go ahead and create this guy and now we have two
different network monitors down here.
So we wait a couple of minutes for it to actually get
kicked off and start collecting data, and once it does,
we see that we're getting the proper reading from this guy,
626, 000 kbps, as opposed to the SNMP monitor of 53,
not 397.
And again, that's simply because of the difference between 32-bit and 64-bit.
We click on this guy down here to see it's bandwidth utilization.
And you'll notice that since we're using WMI,
we're getting a lot more information off of Windows Server.
Now we can absolutely get this information from SNMP,
especially on networking devices, but in order to do that,
you'd have to set up a custom poller or a custom probe in the parlance of PRTG,
and that's a little bit outside the scope of this particular
course since that's specific to the network management system
and not to SNMP or network monitoring, in general.
But getting back to troubleshooting,
we would see that hey this server is polling 600 MB,
there's probably something wrong with this server or
something going on with this server,
and we would be prompted then to go look at the server itself.
Of course, we're causing this problem using this performance tool here.
So if we hit Ctrl+C and exit it,
we'll see that it goes back down to practically nothing here very soon.
We'll take its word for it though,
and we'll move on and talk about network monitoring, in general.