This paper examines the categories of network events and event-based transactions that trigger alarms and alerts within network management systems. It focuses on RMON (Remote Network Monitoring) alarms as a common alert mechanism, explaining how CPU utilization thresholds, polling intervals, and rate-based monitoring can generate notifications for network managers. The paper also explores multi-level alarm structures, including alarm chains where the failure of an expected secondary alarm itself triggers a notification. Together, these examples illustrate the complexity and breadth of network event monitoring and underscore the importance of informed network management practices.
It is not at all difficult to name and describe an event category or event-based transaction that can trigger an alert, alarm, or otherwise cause a network management system to bring something to the attention of a network manager; the difficulty is in limiting the scope of such categories and transactions. Depending on the specific needs and architectures of the network and its users, the type of event or event-based transaction that might lead to the notification of a network manager could be virtually anything. There are, however, some common event categories and event-based transactions that will trigger alarms or other notifications in the network management system and require attention from network managers. Several of these event and transaction types are identified and described below, with their relevance discussed.
One broad category of events that commonly triggers alarms are RMON (Remote Network Monitoring) alarms, which are typically created when an automatic function built into the information system measures a variable outside of set parameters (Cisco, 2007). For example, the RMON could be configured to monitor the level of central processing unit (CPU) utilization and to create a record of utilization levels through continual polling. If utilization drops below or rises above a certain level, an alarm would be triggered that would notify the network manager. This type of alarm is used to ensure that optimal levels of CPU utilization — as defined by network administrators and applied to the system's parameters — remain in place during system operations.
This specific type of event category can actually cause an unnecessary drain on network bandwidth, thereby limiting other capabilities. Better alternatives that represent a slightly different type of event can therefore be built into the network architecture to serve the same purpose. Using specified time intervals and a measurement of rates in the rise and fall of CPU utilization, an RMON can be implemented to trigger an alarm in a manner that is both more proactive — a level of utilization potentially above or below the set threshold limits can be detected before it actually occurs — and more efficient, using less bandwidth and fewer network resources to accomplish the same task (Cisco, 2011). The alarms triggered by either method fall under the basic category of performance monitoring, which is one of the essential functions of a network management system and, when needed performance adjustments cannot be automated, of the network manager.
"Alarms that trigger further layered alarm events"
"Missing secondary alarms themselves generate notifications"
It would be impossible to classify all potential causes for alarms in all existing network systems — they are simply too numerous. The few examples and categories described above should be a clear indication of the immensity of such a task, as there are interactions and transactions in all parts of a network that could trigger an alarm. Understanding some common issues is essential for any network manager, however.
You’re 53% through this paper. Sign up to read the remaining 2 sections.
Sign Up Now — Instant Access Already a member? Log inAlways verify citation format against your institution’s current style guide requirements.