Network Monitoring - Revision history

Admin: /* Ten Best Practices */

2017-04-30T10:01:59Z

Ten Best Practices

← Older revision		Revision as of 10:01, 30 April 2017
Line 138:		Line 138:

	{{Main\|Network Monitoring/Ten Best Practices}}		{{Main\|Network Monitoring/Ten Best Practices}}

			=References=

			Oreilly Books:

			Network Troubleshooting Tools: https://docstore.mik.ua/orelly/networking_2ndEd/tshoot/index.htm

			TCP/IP Network Administration: https://docstore.mik.ua/orelly/networking_2ndEd/tcp/index.htm

	=Flags=		=Flags=

	{{NetworkMonitoringFlag}}		{{NetworkMonitoringFlag}}

Admin: /* Flags */

2017-04-18T06:07:41Z

Flags

← Older revision		Revision as of 06:07, 18 April 2017
Line 134:		Line 134:
	7. Repeat steps 2 through 6		7. Repeat steps 2 through 6
	8. Document your solution		8. Document your solution

			=Ten Best Practices=

			{{Main\|Network Monitoring/Ten Best Practices}}

	=Flags=		=Flags=

	{{NetworkMonitoringFlag}}		{{NetworkMonitoringFlag}}

Admin: /* Discover */

2017-04-18T06:07:14Z

Discover

← Older revision		Revision as of 06:07, 18 April 2017
Line 95:		Line 95:

	Discover consists of finding out what is happening. What is the health of the network? Where are the problems? Where are the potential/future points of failure?		Discover consists of finding out what is happening. What is the health of the network? Where are the problems? Where are the potential/future points of failure?

			The discover process helps you:
	* Identify all of your assets and find out if they are connected		* Identify all of your assets and find out if they are connected
	* Provide a network baseline for network performance		* Provide a network baseline for network performance

Admin: /* DART */

2017-04-18T06:06:48Z

DART

@@ Line 90: / Line 90: @@
 * Troubleshooting
-==DART==
+==DART Explanation==
 ===Discover===
@@ Line 101: / Line 101: @@
 ===Alerting===
-Alerting is a notification that something has gone wrong or is broken. It is important to correctly calibrate
+Alerting is a notification that something has gone wrong or is broken. It is important to correctly calibrate your alerts and thresholds so your network isn't crying wolf and the person doing the monitoring doesn't get totally overwhelmed. Alerts are an indication that something has failed or is about to fail.
 =Flags=
 {{NetworkMonitoringFlag}}

Admin: /* IP Address Monitoring */

2017-04-18T05:55:23Z

IP Address Monitoring

← Older revision		Revision as of 05:55, 18 April 2017
Line 70:		Line 70:
	If you can't physically access each of the networks between you and your target, it is impossible to measure availability/faults/performance. In this case, use [[IP SLA]] to simulate traffic between two networks and measure the performance of the connection. (Particularly useful for things like audio or video, which tend to be more sensitive to network routes/delays).		If you can't physically access each of the networks between you and your target, it is impossible to measure availability/faults/performance. In this case, use [[IP SLA]] to simulate traffic between two networks and measure the performance of the connection. (Particularly useful for things like audio or video, which tend to be more sensitive to network routes/delays).

	==IP Address Monitoring==		==Address Space Monitoring==

	With thousands of IP addresses being assigned on a network, it's important to keep track of what IP addresses have already been used and when subnets are full. It is also important to identify when a network component (e.g., DHCP or DNS) is misconfigured.		With thousands of IP addresses being assigned on a network, it's important to keep track of what IP addresses have already been used and when subnets are full. It is also important to identify when a network component (e.g., DHCP or DNS) is misconfigured.
Line 82:		Line 82:
	* What is the customization cost?		* What is the customization cost?

			=DART Framework=

			SolarWinds recommends using a DART framework, which stands for:
			* Discovery
			* Alerting
			* Remediation
			* Troubleshooting

			==DART==

			===Discover===

			Discover consists of finding out what is happening. What is the health of the network? Where are the problems? Where are the potential/future points of failure?
			* Identify all of your assets and find out if they are connected
			* Provide a network baseline for network performance
			* Gather data needed to compute network performance/efficiency statistics

			===Alerting===

			Alerting is a notification that something has gone wrong or is broken. It is important to correctly calibrate

	=Flags=		=Flags=

	{{NetworkMonitoringFlag}}		{{NetworkMonitoringFlag}}

Admin: /* List of Monitoring Tools */

2017-04-18T05:33:41Z

List of Monitoring Tools

← Older revision		Revision as of 05:33, 18 April 2017
Line 39:		Line 39:
	Platform-specific tools:		Platform-specific tools:

	* (cisco) IP SLA - internet protocol service level agreements are usually found onboard Cisco routers, and can keep the WAN running smoothly		* (cisco) [[IP SLA]] - internet protocol service level agreements are usually found onboard Cisco routers, and can keep the WAN running smoothly

	* (windoze) WMI - windows management instrumentation is a windoze scripting language for collecting information about a target system		* (windoze) WMI - windows management instrumentation is a windoze scripting language for collecting information about a target system

Admin: /* Terminology */

2017-04-18T05:31:33Z

Terminology

← Older revision		Revision as of 05:31, 18 April 2017
Line 7:		Line 7:
	'''Acquisition''' - the process of actually obtaining the observational data from the element		'''Acquisition''' - the process of actually obtaining the observational data from the element

	'''Frequency'' - related to acquisition, what is the frequency at which data arrives? what kind of data is being sent? under what conditions?		'''Frequency''' - related to acquisition, what is the frequency at which data arrives? what kind of data is being sent? under what conditions?

	'''Data warehousing''' - depending on the size of the network and the amount of data, you can end up with a big storage problem on your hands. For purposes of monitoring, you may decide not to store the data at all, you may decide to keep it for a short amount of time, or you may decide to archive it somewhere.		'''Data warehousing''' - depending on the size of the network and the amount of data, you can end up with a big storage problem on your hands. For purposes of monitoring, you may decide not to store the data at all, you may decide to keep it for a short amount of time, or you may decide to archive it somewhere.

Admin: /* Terminology */

2017-04-18T05:31:25Z

Terminology

← Older revision		Revision as of 05:31, 18 April 2017
Line 3:		Line 3:
	==Terminology==		==Terminology==

	* Element - the fundamental unit of network monitoring, an element consists of a single metric that is being monitored. There are usually hundreds or thousands of elements in a given network.		'''Element''' - the fundamental unit of network monitoring, an element consists of a single metric that is being monitored. There are usually hundreds or thousands of elements in a given network.

	* Acquisition - the process of actually obtaining the observational data from the element		'''Acquisition''' - the process of actually obtaining the observational data from the element

	* Frequency - related to acquisition, what is the frequency at which data arrives? what kind of data is being sent? under what conditions?		'''Frequency'' - related to acquisition, what is the frequency at which data arrives? what kind of data is being sent? under what conditions?

	* Data warehousing - depending on the size of the network and the amount of data, you can end up with a big storage problem on your hands. For purposes of monitoring, you may decide not to store the data at all, you may decide to keep it for a short amount of time, or you may decide to archive it somewhere.		'''Data warehousing''' - depending on the size of the network and the amount of data, you can end up with a big storage problem on your hands. For purposes of monitoring, you may decide not to store the data at all, you may decide to keep it for a short amount of time, or you may decide to archive it somewhere.

	* Threshold - this gets into the "what" part of your monitoring. What, exactly, are you monitoring, and what is the value of the element that will trigger an alert? (What constitutes an emergency?)		'''Threshold value''' - this gets into the "what" part of your monitoring. What, exactly, are you monitoring, and what is the value of the element that will trigger an alert? (What constitutes an emergency?)

	* Reset - opposite of threshold, what is the value of the element that will un-trigger an alert and signify the "all clear"?		'''Reset value''' - opposite of threshold, what is the value of the element that will un-trigger an alert and signify the "all clear"?

	* Response - what is the response when a threshold is reached and an alert is triggered?		'''Threshold response''' - what is the response when a threshold is reached and an alert is triggered?

	* Requester - the entity that is requesting the monitoring data, and where it lives (may be on-board the machine, or may be a networked data store)		'''Requester''' - the entity that is requesting the monitoring data, and where it lives (may be on-board the machine, or may be a networked data store)

	==List of Monitoring Tools==		==List of Monitoring Tools==

Admin at 05:30, 18 April 2017

2017-04-18T05:30:23Z

← Older revision		Revision as of 05:30, 18 April 2017
Line 47:		Line 47:
	* (windoze) Event log - the event log in Windows is the equivalent of the syslog, recording everything happening onboard the machine		* (windoze) Event log - the event log in Windows is the equivalent of the syslog, recording everything happening onboard the machine

			=What To Monitor=

			Let's cover what you actually want to monitor on the network.

			==Availability, Faults, Performance==

			Three important things to measure for each element:

			'''Availability''' - is an element online/responding to requests? or is it offline/not responding?

			'''Faults''' - is a given element functioning correctly? have any failures been detected? (Can failures be detected?)

			'''Performance''' - how well is the network performing? (throughput, utilization, response times, error rates)

			The most useful tools for determining these metrics are [[Ping]], [[SNMP]], and [[ICMP]], to measure:
			* Response time
			* Packet loss
			* CPU load
			* Memory utilization
			* Hardware status

			If you can't physically access each of the networks between you and your target, it is impossible to measure availability/faults/performance. In this case, use [[IP SLA]] to simulate traffic between two networks and measure the performance of the connection. (Particularly useful for things like audio or video, which tend to be more sensitive to network routes/delays).

			==IP Address Monitoring==

			With thousands of IP addresses being assigned on a network, it's important to keep track of what IP addresses have already been used and when subnets are full. It is also important to identify when a network component (e.g., DHCP or DNS) is misconfigured.

			Different tools are useful for monitoring different types of elements. Figuring out what tools you need will depend on your role monitoring the network. If you are a one-man band, you need something that can do ''everything'' and keeps it simple. If you're monitoring something specific (i.e., virtual containers), you can go for specialized/expensive tools that help you monitor that one particular thing deeply.

			Things to consider:
			* What is the (one-time) purchase cost?
			* What is the (ongoing) maintenance cost?
			* What is the support cost?
			* What is the customization cost?



			=Flags=

	{{NetworkMonitoringFlag}}		{{NetworkMonitoringFlag}}

Admin: /* List of Monitoring Tools */

2017-04-18T05:14:12Z

List of Monitoring Tools

← Older revision		Revision as of 05:14, 18 April 2017
Line 20:		Line 20:

	==List of Monitoring Tools==		==List of Monitoring Tools==

			Cross-platform tools:

			* [[Ping]] - checks if a target machine is online/up and running, and how long it takes to reach the machine

			* [[SNMP]] - simple network management protocol, this tool can generate data about elements on a network

			* [[ICMP]] - internet control messaging protocol, used by routers/switches to send error messages about unreachable hosts

			* [[Syslog]] - of course, the system log is a useful place for data about what's happening on a particular machine and can yield data about elements

			* Other log files - programs will typically provide a way to log information to a log file, so this is another source of data about various elements on the network

			* Scripting - scripting is the best way to collect information, and allows for custom element data to be collected and sent off to the receiver

			* Flow - understanding the flow of traffic on a network (where it comes from, where it goes, and what kind of traffic it is) is important to understanding the network

			Platform-specific tools:

			* (cisco) IP SLA - internet protocol service level agreements are usually found onboard Cisco routers, and can keep the WAN running smoothly

			* (windoze) WMI - windows management instrumentation is a windoze scripting language for collecting information about a target system

			* (windoze) PerfMon - performance monitor that gives information about the machine's current state, as well as information about errors

			* (windoze) Event log - the event log in Windows is the equivalent of the syslog, recording everything happening onboard the machine



	{{NetworkMonitoringFlag}}		{{NetworkMonitoringFlag}}