View source for Network Monitoring/Ten Best Practices

Ten best practices for network monitoring: the short list:
1. Establish baseline behavior
2. Perform network inventory
3. Avoid network alert sawtoothing/flapping
4. Don't filter your email alerts
5. Monitor deltas
6. Provide details
7. Escalation
8. Parent-Child
9. Event Correlation
10. View traffic from application endpoint

==Establish baseline behavior==

Establishing a network baseline is important to establishing a sense of how the network performs normally. (Note that, to this end, [[Bro]] can be used for network baselining, even though it is designed as an intrusion detection system, not as a network monitoring tool.)

==Perform network inventory==

Keep an inventory of devices on the network:
* Network devices
* Ports
* Interfaces being used for network connections
* Network hardware (links, switches, controllers, power supplies)
* Servers
* Virtual machines
* SAN devices

If you don't know what's on your network, you can't monitor it very well!

==Avoid network alert sawtoothing==

Alert sawtoothing is where an element's numerical value hovers right around the threshold, causing the alert to be triggered multiple times. This is a sign the threshold needs to be changed (higher if false alarm, lower if "too late").










{{NetworkMonitoringFlag}}

{{LinuxNetworkingFlag}}