So now we're going to take a few minutes and talk about some of
the dos and don'ts of network monitoring,
in general.
Now I know this is a course on SNMP,
but I wanted to kind of back up and give you a
broader view of what SNMP is used for.
Obviously,
it's a network management protocol and so the whole reason you're going to
implement SNMP is to manage a network and what good is managing a network
and what good is managing a network if you don't have a network management
and monitoring solution in place.
So that's the reason we're taking a bit of a step back to kind of give
you a holistic view of what you will use SNMP for.
The first thing I can recommend is ensure that all
of your devices are monitored, and again,
this kind of sounds like a no brainer.
Well, of course, I want to monitor all of my devices,
but you'd be surprised at the number of places that I see
where we only monitor our core servers and our core switches
and the routers on our branches.
Well, what about the switched at your branches?
Oh, those aren't really that important.
We don't waste time monitoring those.
And you can probably get away with that until you have a bad quos policy on one
of your switches that drives your CPU to 100% and impacts traffic flow or voice
traffic to those devices connected to that switch.
The same goes for infrastructure devices such as Fibre
Channel switches or SANs that almost certainly have SNMP
monitorability built into them.
You want to know everything about those devices that you can.
In short,
if it speaks SNMP or you can somehow get manageability
that speaks SNMP to that device,
you probably want to monitor at least some of the outputs,
if nothing else, then uptime and CPU.
And of course,
this gets into a bit of a cost because nearly every network monitoring
system out there prices their product per device,
but in the long run,
it will pay for itself because you get very detailed views into
everything that's going on with your network.
The second is set realistic alert thresholds.
When you first set up a network monitoring system,
you're going to get flooded with alerts and potentially with emails
about every little thing that happens on your network.
Oh, this particular device, this CPU is over 10% for more than 2 minutes.
This device has a high ping time for the last 30 seconds,
etc,
and it's tempting to just take all of those alerts and say I want
to know about everything that happens and then you get these alerts
and you get these emails and you open up your email and you look in
the folder and there is 2, 478 unread emails in your alert folder.
What do most people do when they see that?
They go in there, they highlight everything and they hit Delete.
You run into a problem of having too much signal to noise,
and potentially,
missing something important and yet it's kind of a hairy thing to get
into because well where are those alert thresholds that we can get
actual actionable alerts out of the system,
and honestly, that's different for every environment.
You will have to run it in kind of verbose mode for a
while before you realize that oh yeah,
these bandwidth alerts that I'm getting every few minutes because of bandwidth
spikes are from backups being taken over on our SQL Server,
so I don't necessarily need to know about those on this
particular server or I need to set the threshold higher so
that if it goes on for 15 minutes, then I know about it.
So at the end of the day,
if you're responsible for network and infrastructure monitoring,
it will take some buy-in from all of the other
departments that manage SQL servers, and email servers,
etc, if that doesn't happen to be you,
to find out where these alerts need to be set and getting those
alerts to the appropriate person or group effectively.
Lastly, check the reports.
Again, kind of a no-brainer, but especially after a while,
you'll start getting these daily reports or weekly reports
about things that have gone on in the network.
Here's the bandwidth that's been used, here's the latency,
here's the disk space that's used, and you see those reports and you go oh yeah,
there's the daily report, delete,
and you do that enough and then you start getting phone calls saying hey I
can't connect to my email database and you go and you find out that the
Exchange services are not running or the datastore is filled up and you can't
write anymore data into the Exchange database,
and you might ask yourself why didn't I know about this and this
goes back to the last two bullet points here.
You need to make sure that your alert thresholds are set such that you'll
actually read and take action on any alerts that you get and if you're
getting reports on disk space or things like that,
actually read those reports that you took the time
to build and have emailed to you.
Your network monitoring system is only as good as you make it and there
is no point in enabling SNMP on all of these devices,
setting up SNMP v3, the encryption,
making sure that you have everything locked down,
setting up a network monitoring system,
making sure that it's polling everything properly,
which is a lot of work, and then just ignoring the output of that system.
It just makes no sense,
but you'd be surprised with the number of organizations that do exactly that. And that concludes our discussion on network monitoring.