RMON Configuration
Remote Network Monitoring (RMON) can monitor data traffic on a network segment or an entire network.
Overview of RMON
RMON implements data traffic monitoring and statistics on a network segment or an entire network, which helps to effectively manage large-size networks.
To improve the availability of management information, lighten the burden on the Network Management Station (NMS), and enable the network administrator to monitor multiple network segments, the Internet Engineering Task Force (IETF) develops RMON to release the Simple Network Management Protocol (SNMP) from the restriction on managing increasingly distributed networks. RMON monitors data traffic on a network segment or an entire network, and enables SNMP to monitor remote network devices more efficiently and proactively. In addition, RMON provides a highly efficient solution to monitor sub-networks. This function decreases the volume of traffic between the NMS and agents and facilitates large-size network management.
RMON is implemented based on the SNMP architecture. Two components are involved in RMON: the NMS and the agent located on each device.
- A Network Management System (NMS) collects network management information on devices using SNMP.
- An agent collects traffic statistics, such as the number of packets on a network segment in a specific period of time and the number of correct packets sent to a host.
Configuring RMON
Configuring RMON helps to monitor network status and traffic.
Applicable Environment
RMON allows the NMS to remotely manage and monitor devices. It provides traffic statistics and alarm functions.
Statistics function
Traffic statistics function enables a managed device to periodically or continuously collect traffic statistics on its connected network segment. The statistics include the total number of received packets and the number of received long packets.
Alarm function
This function allows a managed device to generate a log and send a trap message to the NMS after the managed device finds that a bound variable of a MIB object exceeds the alarm threshold (for example, an interface rate or the percentage of broadcast packets reaches a specific value).
RMON can be used to monitor or collect statistics about traffic on a network segment.
There are no restrictions on the start time of RMON. It can be started to monitor a specific interface, or can be started when the traffic of the sub-network to which an interface connects is suspected of being abnormal. RMON provides two functions:
- Traffic statistics function: is deployed on interfaces that have abnormal traffic.
- Alarm function: is used to measure one or more indexes. After upper and lower thresholds are set for an index, an alarm is generated if the index exceeds the upper threshold or falls below the lower threshold.
RMON provides traffic statistics and information about abnormalities, but cannot prevent them. Other management methods are required to eliminate the abnormalities.
Configuring the RMON Statistics Function
Configuring the RMON statistics function helps to collect and record statistics of an interface.
Context
- Ethernet statistics function (corresponding to the statistics group in RMON MIB): The system collects the statistics about basic traffic on monitored interfaces.
- Historical sampling function (corresponding to the history group in RMON MIB): The system samples the interface statuses on the network periodically and stores the information for later queries.
Procedure
- Run system-view
The system view is displayed.
- Run interface interface-type interface-number
The interface on which traffic statistics are collected is specified and the view of the interface is displayed.
- Run rmon-statistics enable
The RMON statistics function is enabled on the interface.
If the RMON statistics function is not enabled, the Ethernet statistics and historical sampling functions cannot be enabled.
- Run rmon statistics entry-number [ owner owner-name ]
The Ethernet statistics function is configured.
- Run rmon history entry-number buckets number interval sampling-interval [ owner owner-name ]
The historical sampling function is configured.
To reduce the impact of RMON on system performance, the sampling interval should be set to be longer than 10 seconds, and the historical sampling function should not be configured multiple times on an interface. RMON suggests that each monitored interface can be configured with more than two historical samples and the sampling interval should be 30 seconds.
- Run commit
The configuration is committed.
Configuring the RMON Alarm Function
After the RMON alarm function is configured on a device, the device will generate a log or an alarm if the sampling value exceeds the alarm threshold.
Context
- Event table (corresponding to the event group in RMON MIB): When an event occurs, the system generates a log or sends a trap message to the NMS.
- Alarm table (corresponding to the alarm group in RMON MIB): A specified alarm variable identified by its OID is monitored at a specified sampling interval. A log or an alarm is generated when the monitored variable exceeds the defined threshold.
Procedure
- Run system-view
The system view is displayed.
- Run rmon event entry-number [ description string ] { log | trap object | log-trap object | none } [ owner owner-name ]The event function is configured. The parameters in the command are described as follows:
log: The system only generates a log.
log-trap: The system generates a log and sends a trap message to the NMS.
none: The system does not take any action.
trap: The system only sends a trap message to the NMS.
- Run rmon alarm entry-number alarm-OID sampling-time { absolute | changeratio | delta } rising-threshold threshold-value1 event-entry1 falling-threshold threshold-value2 event-entry2 [ startup-alarm { falling | rising | risingorfalling } ] [ owner owner-name ]
The alarm threshold function is configured. If the events corresponding to the upper and lower alarm threshold (event-entry1 and event-entry2) are not configured, no alarm is generated even if the alarm conditions are satisfied. At this time, the alarm is in the Undercreation state rather than in the Valid state.
If the event corresponding to either the upper or lower alarm threshold is configured, an alarm is triggered once the alarm conditions are satisfied. At this time, the alarm is in the Valid state. If an incorrect monitored object is configured, for example, a nonexistent OID is specified, the alarm is in the invalid state and no alarm is generated.
- Run commit
The configuration is committed.
Verifying the RMON Configuration
After configuring RMON, you can view the traffic statistics collected by RMON.
Procedure
- Run the display rmon statistics [ interface-type interface-number ] command to check RMON statistics.
- Run the display rmon history [ interface-type interface-number ] command to check RMON historical sampling information.
- Run the display rmon event [ entry-number ] command to check the RMON event processing mode: recording a log or sending a trap.
- Run the display rmon eventlog [ entry-number ] command to check details about RMON logs.
- Run the display rmon alarm [ entry-number ] command to check RMON alarm configurations.
Configuration Examples for RMON
Each configuration example consists of the networking requirements, configuration roadmap, configuration procedures, and configuration files.
Example for Configuring RMON
When the volume of traffic on an interface exceeds a configured upper threshold, an alarm is sent to the NMS.
Networking Requirements
On the network shown in Figure 25-1, the subnet connected to GE 3/0/0 of the Device needs to be monitored, including:
Collect real-time and historical statistics about various packets.
Monitor broadcast and multicast traffic on the subnet and enable the alarm function for the total number of broadcast and multicast packets. When the total number of broadcast and multicast packets exceeds the configured threshold, the system actively reports alarm information to the NMS.
Interface 1 and Interface 2 in this example are GE 1/0/0 and GE 3/0/0 respectively.
Configuration Roadmap
The configuration roadmap is as follows:
Ensure that the router and NMS are reachable.
Configure SNMP and community names and ensure that the router can send trap messages to the NMS.
Configure the RMON statistics function and collect traffic statistics on interfaces.
Configure the RMON alarm function so that a trap message is sent to the NMS when the sampling value exceeds the set threshold.
Data Preparation
To complete the configuration, you need the following data:
Index (1) of the RMON statistics function
Owner (userA) for the RMON statistics function
Sampling interval (30 seconds)
Index (1) of the RMON alarm function
OID ID (1.3.6.1.2.1.2.2.1.4.3.5) of a monitored object
Upper threshold (1000) and lower threshold (100) for triggering an event
Owner (userA) for the RMON alarm function
Procedure
- Configure the router and the NMS to be reachable.
- Configure the router to send trap messages to the NMS.
# Enable SNMP to send trap messages to the NMS.
<HUAWEI> system-view[~HUAWEI] sysname Device
[*HUAWEI] commit
[~Device] snmp-agent
[*Device] snmp-agent trap enable
# Configure the router to send trap messages to the specified NMS.
[*Device] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public
[*Device] commit
- Configure the RMON statistics function.
# Enable the RMON statistics function.
[~Device] interface gigabitethernet 3/0/0
[~Device-GigabitEthernet3/0/0] rmon-statistics enable
[*Device-GigabitEthernet3/0/0] commit
# Configure the Ethernet statistics function.
[~Device-GigabitEthernet3/0/0] rmon statistics 1 owner userA
[*Device-GigabitEthernet3/0/0] commit
# Configure the historical traffic sampling function to sample the traffic on the subnet at an interval of 30 seconds and save the 10 most recent historical entries.
[~Device-GigabitEthernet3/0/0] rmon history 1 buckets 10 interval 30 owner userA
[*Device-GigabitEthernet3/0/0] commit
[~Device-GigabitEthernet3/0/0] quit
- Configure the RMON alarm function.
# Configure the router to send trap messages to the NMS when RMON event 1 occurs.
[~Device] rmon event 1 description alarmofinterface trap public owner userA
[*Device] commit
# Set a sampling interval and thresholds for triggering event 1.
[~Device] rmon alarm 1 1.3.6.1.2.1.2.2.1.4.3 5 absolute rising-threshold 1000 1 falling-threshold 100 1 owner userA
[*Device] commit
[~Device] quit
- Verify the configuration.
# Check data traffic information on the subnet.
<Device> display rmon statistics gigabitethernet 3/0/0
Statistics entry 1 owned by userA is valid. Interface : GigabitEthernet3/0/0<ifEntry.402653698> Received : Octets :4294966296, Packets:316091 Broadcast packets :311839 , Multicast packets:666 Undersize packets :0 , Oversize packets :0 Fragments packets :0 , Jabbers packets :0 CRC alignment errors:0 , Collisions :0 Dropped packets (insufficient resources):0 Packets received according to length (octets): 64 :0 , 65-127 :0 , 128-255 :0 256-511:0 , 512-1023:0 , 1024-1518:0# Check historical sampling records.
<Device> display rmon history gigabitethernet 3/0/0
History control entry 1 owned by userA is valid Sampled interface : GigabitEthernet3/0/0<ifEntry.402653698> Sampling interval : 30(sec) with 10 buckets max Last Sampling time : 0days 05h:17m:26s.30th Latest sampled values : Octets :1000 , Packets :100 Broadcast packets :100 , Multicast packets :100 Undersize packets :0 , Oversize packets :0 Fragments packets :0 , Jabbers packets :0 CRC alignment errors :0 , Collisions :0 Dropped packet :0 , Utilization :0 History record: Record No.1 (Sample time: 0days 05h:13m:56s.56th) Octets :1000 , Packets :100 Broadcast packets :100 , Multicast packets :100 Undersize packets :0 , Oversize packets :0 Fragments packets :0 , Jabbers packets :0 CRC alignment errors :0 , Collisions :0 Dropped packets :0 , Utilization :0# Check RMON event information.
<Device> display rmon eventEvent table 1 owned by userA is valid. Description: alarmofinterface. Will cause snmp-trap when triggered, last triggered at 1days 04h:00m:00s.04th
# Check RMON alarm configurations.
<Device> display rmon alarm 1Alarm table 1 owned by userA is valid. Samples absolute value : 1.3.6.1.2.1.2.2.1.4.3 Sampling interval : 5(sec) Rising threshold : 1000(linked with event 1) Falling threshold : 100(linked with event 1) When startup enables : risingOrFallingAlarm Latest value : 1500
Configuration Files
# sysname Device # interface GigabitEthernet1/0/0 undo shutdown ip address 10.2.2.1 255.255.255.0 interface GigabitEthernet3/0/0 undo shutdown ip address 10.3.3.1 255.255.255.0 rmon-statistics enable rmon statistics 1 owner userA rmon history 1 buckets 10 interval 30 owner userA # ip route-static 10.1.1.0 255.255.255.0 10.2.2.2 # snmp-agent # snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public # rmon event 1 description alarmofinterface trap owner userA rmon alarm 1 1.3.6.1.2.1.2.2.1.4.3 5 absolute rising-threshold 1000 1 falling-threshold 100 1 owner userA # return