H3C S9500 Series User manual

Operation Manual – RMON
H3C S9500 Series Routing Switches Table of Contents
i
Table of Contents
Chapter 1 RMON Configuration...................................................................................................1-1
1.1 RMON Overview................................................................................................................1-1
1.1.1 Introduction..............................................................................................................1-1
1.1.2 RMON Groups.........................................................................................................1-2
1.2 Configuring RMON ............................................................................................................1-3
1.2.1 Configuration Prerequisites.....................................................................................1-3
1.2.2 Configuration Procedure.........................................................................................1-3
1.3 Displaying and Maintaining RMON....................................................................................1-5
1.4 RMON Configuration Example ..........................................................................................1-6

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-1
Chapter 1 RMON Configuration
When configuring RMON, go to these sections for information you are interested in:
zRMON Overview
zConfiguring RMON
zDisplaying and Maintaining RMON
zRMON Configuration Example
1.1 RMON Overview
This section covers these topics:
zIntroduction
zRMON Groups
1.1.1 Introduction
Remote Monitoring (RMON) is a type of IETF-defined MIB. It is the most important
enhancement to the MIB II standard. It allows you to monitor traffic on network
segments and even the entire network.
RMON is implemented based on the Simple Network Management Protocol (SNMP)
and is fully compatible with the existing SNMP framework.
RMON provides an efficient means of monitoring subnets and allows SNMP to monitor
remote network devices in a more proactive and effective way. It reduces traffic
between network management station (NMS) and agent, facilitating large network
management.
RMON comprises two parts: NMSs and agents running on network devices.
zEach RMON NMS administers the agents within its administrative domain.
zAn RMON agent resides on a network monitor or probe for an interface. It monitors
and gathers information about traffic over the network segment connected to the
interface to provide statistics about packets over a specified period and good
packets sent to a host for example.
RMON allows multiple monitors.A monitor provides two ways of data gathering:
zUsing RMON probes. NMSs can obtain management information from RMON
probes directly and controlnetwork resources. In this approach, RMON NMSs can
obtain all RMON MIB information.
zEmbedding RMON agents in network devices such as routers, switches, and hubs
to provide the RMON probe function. RMON NMSs exchange data with RMON
agents with basic SNMP commands to gather network management information,

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-2
which, due to system resources limitation, may not cover all MIB information but
four groups of information, alarm, event, history, and statistics, in most cases.
S9500 series adopts the second way. By using RMON agents on network monitors, an
NMS can obtain information about traffic size, error statistics, and performance
statistics for network management.
1.1.2 RMON Groups
RMON categorizes objects into ten groups. This section describes only the major
implemented five groups.
I. Event group
The event group defines event indexes and controls the generation and notifications of
the events triggered by the alarms defined in the alarm group and the private alarm
group. The events can be handled in one of the following ways:
zLogging events in the event log table
zSending traps to NMSs
zBoth logging and sending traps
zNo action
II. Alarm group
The RMON alarm group monitors specified alarm variables, such as statistics on a port.
If the sampled value of the monitored variable is bigger than or equal to the rising
threshold, a rising alarm event is triggered; if the sampled value of the monitored
variable is lower than or equal to the falling threshold, a falling alarm event is triggered.
The event is then handled as defined in the event group.
The following is how the system handles entries in the RMON alarm table:
1) Samples the alarm variables at the specified interval.
2) Compares the sampled values with the predefined threshold and triggers events if
all triggering conditions are met.
Note:
If a monitored variable overpasses the same threshold multiple times, only the first one
can cause an alarm event. That is, the rising alarm and falling alarm are alternate.
III. Private alarm group
The private alarm group calculates the sampled values of alarm variables and
compares the result with the defined threshold, thereby realizing a more
comprehensive alarming function.

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-3
System handles the prialarm alarm table entry (as defined by the user) in the following
ways:
zPeriodically samples the prialarm alarm variables defined in the prialarm formula.
zCalculates the sampled values based on the prialarm formula.
zCompares the result with the defined threshold and generates an appropriate
event.
IV. History group
The history group controls the periodic statistical sampling of data, such as bandwidth
utilization, number of errors, and total number of packets.
Note that each value provided by the group is a cumulative sum during a sampling
period.
V. Ethernet statistics group
The statistics group monitors port utilization. It provides statistics about network
collisions, CRC alignment errors, undersize/oversize packets, broadcasts, multicasts,
bytes received, packets received, and so on.
After the creation of a valid event entry on a specified interface, the Ethernet statistics
group counts the number of packets received on the current interface. The result of the
statistics is a cumulative sum.
Note:
Currently, S9500 series switches do not support statistics about oversize frames and
bytes received.
1.2 Configuring RMON
1.2.1 Configuration Prerequisites
Before configuring RMON, configure the SNMP agent as described in SNMP
Configuration in the System Volume.
1.2.2 Configuration Procedure
Follow these steps to configure RMON:

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-4
To do… Use the command… Remarks
Enter system view system-view —
Create an event entry
in the event table
rmon event entry-number [ description
string ] { log |trap trap-community |
log-trap log-trapcommunity | none }
[ owner text ]
Optional
Enter Ethernet
interface view interface interface-type
interface-number —
Create an entry in the
history table
rmon history entry-number buckets
number interval sampling-interval
[ owner text ] Optional
Create an entry in the
statistics table rmon statistics entry-number [ owner text ] Optional
Exit Ethernet interface
view quit —
Create an entry in the
alarm table
rmon alarm entry-number
alarm-variable sampling-interval
{ absolute |delta } rising-threshold
threshold-value1 event-entry1
falling-threshold threshold-value2
event-entry2 [ owner text ]
Optional
Create an entry in the
private alarm table
rmon prialarm entry-number
prialarm-formula prialarm-des
sampling-interval { absolute |
changeratio | delta }rising-threshold
threshold-value1 event-entry1
falling-threshold threshold-value2
event-entry2 entrytype { forever | cycle
cycle-period } [ owner text ]
Optional
Note:
zTwo entries with the same configuration cannot be created. If the parameters of a
newly created entry are identical to the corresponding parameters of an existing
entry, the system considers their configurations the same and the creation fails.
Refer to Table 1-1 for the parameters to be compared for different entries.
zThe system limits the total number of all types of entries (Refer to Table 1-1 for the
detailed numbers). When the total number of an entry reaches the maximum
number of entries that can be created, the creation fails.

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-5
Table 1-1 Limitations on the configuration of RMON
Entry Parameters to be compared Maximum number of
entries that can be
created
Event
Event description (description string),
event type (log, trap, logtrap or none)
and community name (trap-community
or log-trapcommunity)
60
History Sampling interval (interval
sampling-interval) 100
Statistics Only one statistics entry can be
created on an interface. 100
Alarm
Alarm variable (alarm-variable),
sampling interval (sampling-interval),
sampling type (absolute or delta),
rising threshold (threshold-value1) and
falling threshold (threshold-value2)
60
Pri-alarm
Alarm variable formula
(alarm-variable), sampling interval
(sampling-interval), sampling type
(absolute, changeratio or delta),
rising threshold (threshold-value1) and
falling threshold (threshold-value2)
50
1.3 Displaying and Maintaining RMON
To do… Use the command… Remarks
Display RMON statistics display rmon statistics
[ interface-type interface-number ] Available in any view
Display RMON history
information and the latest
history sampling
information
display rmon history
[ interface-type interface-number ] Available in any view
Display RMON alarm
configuration information display rmon alarm [ entry-number ] Available in any view
Display RMON prialarm
configuration information display rmon prialarm [entry-number ] Available in any view
Display RMON events
configuration information display rmon event [entry-number ] Available in any view
Display RMON event log
information display rmon eventlog [ event-number ] Available in any view

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-6
1.4 RMON Configuration Example
I. Network requirements
Agent is connected to a configuration terminal through its console port and to a remote
NMS across the Internet.
Create an entry in the RMON Ethernet statistics table to gather statistics on
GigabitEthernet 4/2/2, and logging is enabled after received bytes exceed the specified
threshold.
II. Network diagram
Figure 1-1 Network diagram for RMON
III. Configuration procedure
# Configure RMON to gather statistics for interface GigabitEthernet 4/2/2.
<Sysname> system-view
[Sysname] interface GigabitEthernet 4/2/2
[Sysname-GigabitEthernet4/2/2] rmon statistics 1 owner user1-rmon
[Sysname-GigabitEthernet4/2/2] quit
# Display RMON statistics for interface GigabitEthernet 4/2/2.
<Sysname> display rmon statistics GigabitEthernet 4/2/2
Statistics entry 1 owned by user1-rmon is VALID.
Interface : GigabitEthernet4/2/2<ifIndex.157>
etherStatsOctets : 0 , etherStatsPkts : 0
etherStatsBroadcastPkts : 0 , etherStatsMulticastPkts : 0
etherStatsUndersizePkts : 0 , etherStatsOversizePkts : 0
etherStatsFragments : 0 , etherStatsJabbers : 0
etherStatsCRCAlignErrors : 0 , etherStatsCollisions : 0
etherStatsDropEvents (insufficient resources): 0
Packets received according to length:
64 : 0 , 65-127 : 0 , 128-255 : 0
256-511: 0 , 512-1023: 0 , 1024-1518: 0
# Create an event to start logging after the event is triggered.
<Sysname> system-view

Operation Manual – RMON
H3C S9500 Series Routing Switches Chapter 1 RMON Configuration
1-7
[Sysname] rmon event 1 log owner 1-rmon
[Sysname] display rmon event 1
Event table 1 owned by 1-rmon is VALID.
Description: null.
Will cause log when triggered, last triggered at 2day(s) 03h:56m:06s.
# Configure an alarm group.
[Sysname] rmon alarm 1 1.3.6.1.2.1.16.1.1.1.4.1 delta rising-threshold 1000
1 falling-threshold 100 1 owner 1-rmon
[Sysname] display rmon alarm 1
Alarm table 1 owned by 1-rmon is VALID.
Samples type : delta
Variable formula : 1.3.6.1.2.1.16.1.1.1.4.1<etherStatsOctets.1>
Sampling interval : 10(sec)
Rising threshold : 1000(linked with event 1)
Falling threshold : 100(linked with event 1)
When startup enables : risingOrFallingAlarm
Latest value : 2552