Linking Passive Monitors

To the Ipswitch web site

Ipswitch Forums
Home      Members   Calendar   Who's On
Welcome Guest ( Login | Register )
      



Linking Passive MonitorsExpand / Collapse
Author
Message
Posted 2/17/2005 9:07:09 AM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 12/5/2008 12:00:20 PM
Posts: 17, Visits: 3

I would like to know if it will be possible in the future to link Passive Monitors. What I eventually want to do is have the devices in my network, voice and data, send traps to the WUP server and the server will alert, change state, etc, based on traps received. Having links on my maps gives anyone monitoring the network an immediate visual of what's happening in the network. I would prefer not to have to poll every interface on every device in my network if I don't have to. What's Up is designed to work with SNMP compatible devices and therefore should be able to accept traps and alert on these traps.

Will we see the ability to associate a particular trap event with a monitor? This is very important. We are trying to move from WUG asap and need this ability soon.

R. Mason

Mid-Maine Communications

Post #4822
Posted 2/17/2005 3:54:14 PM


Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: WhatsUp Gold Expert
Last Login: Today @ 1:49:13 PM
Posts: 1,513, Visits: 5,018
Of course this can already be done in WUP ! Just use a PASSIVE MONITOR.
The only small missing item is that WUP will NOT change the state of your object upon receiving a trap -but alerting is possible and will work.


Reading, writing and arithmetic - If you need to choose, please take option 1.
Post #4831
Posted 2/18/2005 8:39:27 AM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 12/5/2008 12:00:20 PM
Posts: 17, Visits: 3

Maybe, I'm missing something. I have already added passive monitors to my devices in preperation for upgrades to WUP. When I right-click on a device and then choose 'Link to' no passive monitors show up in the list of monitors to choose from.

Rob

Mid-Maine Communications

Post #4848
Posted 3/3/2005 3:31:10 PM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 12/5/2008 12:00:20 PM
Posts: 17, Visits: 3

I STILL CAN'T LINK PASSIVE MONITORS ON MY MAPS. WHEN CHOOSING THE LINK TO OPTION ON THE DEVICE, NO OPTION FOR PASSIVE COMES UP, ONLY ACTIVE MONITORS. AGAIN, I DON'T WANT MY MACHINE POLLING EVERY INTERFACE ON EVERY DEVICE. THE WHOLE PURPOSE OF SNMP IS TO NOTIFY MY NETWORK MONITORING SYSTEM OF EVENTS AND THEN THE MONITORING SYSTEM SHOULD BE ABLE TO MANIPULATE THOSE IN WHATEVER WAY THE ADMINSTRATOR CHOOSES. IF YOU ARE CONSIDERING ANY PATCHES TO THIS SOFTWARE IN THE NEAR FUTURE, IT WOULD BE GREATLY APPRECIATED. THANKS.

 

Rob Mason

Mid-Maine Communications

Post #5296
Posted 3/3/2005 4:42:44 PM


Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: WhatsUp Gold Expert
Last Login: Today @ 1:49:13 PM
Posts: 1,513, Visits: 5,018
Hi,

If I understand correctly, you are talking about the graphical representation of your network. You would like to draw a line between two devices, representing an interface. And you would like the color of this line to change when you receive a "link down" trap. Am I right ?

Well if this is the case, my opinion about this is that you will never get this feature, because it makes no sense. Here is why : an Snmp trap is an UDP packet, and by nature the delivery of these packets is unreliable. Now let's imagine that you do receive the "link down" trap, but for some reason the "link up" trap is missed. This is very likely ! For instance if you are running an Ethernet Lan with Spanning tree on it, chances are that the spanning tree will take some time to reconverge and that you will miss the trap.

Final result would be that your link on the map would become red, but would never go back to green, because WUP would be waiting for the Up trap to change the colour back... Which is (I think) a good reason to not implement what you ask for.

Still, keep in mind that when you apply a passive monitor to a device, you can assign an action policy to it so that some notification warns you of the trap...

HTH


Reading, writing and arithmetic - If you need to choose, please take option 1.
Post #5301
Posted 3/3/2005 5:18:13 PM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 12/5/2008 12:00:20 PM
Posts: 17, Visits: 3

Allow me to retort. So far what we have built in What'sUp Gold that we have been using for years has been working just fine. The percentage of missed traps is negligible at best. I can actually count on one hand the number of traps we've missed in over a year. If your network is so bad that you lose data all the time then maybe you need a new network engineer. Personally, polling every interface in our network to determine the state of that interface is ridiculous. What is the purpose of traps if not to allow you to use them as you wish. If they do not want to keep features in WUP that worked just fine in Gold then we will be going back to Gold.

Tell me something. What is the use of having a map of your network if you can't change the state of the objects or links between objects. Not so smart I think.

If you have anything constructive to add please let me know.

 

R. Mason

Mid-Maine Communications.

Post #5304
Posted 3/3/2005 8:48:48 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 2/4/2008 9:12:03 AM
Posts: 4, Visits: 2

I'm glad to hear someone else trying to make sense of this.  I see the passive monitors (both SNMP traps and WinEvent/Syslog messages) as being incomplete and significantly less functional without the ability to affect the state of a device or link on the map.  To achieve a moderate level of realtime-ness in my notifications and map, I have to decrease the polling interval and increase the monitoring overhead across the network.  If that's the only way, I understand, but as was mentioned, this feature existed and worked well in WUG.

As for "Which is (I think) a good reason to not implement what you ask for.":
Take that reasoning one step further - if true, you have proven that SNMP traps also have no value.  Even if that turned out to be valid, WinEvent messages and queued tcp syslog messages are guaranteed delivery and could still justify the implementation of this feature.  That aside, link states monitored passively by traps can/are still be/being monitored by active monitors which would handle resetting the state in event of a lost trap.  The traps fill a need extremely well when we need immediate notice of an outage but can't afford to run active monitoring at 15 second intervals. 

As for the linkup/linkdown/spanning tree example - when the link goes down, two traps are triggered - a linkdown on both devices, of which one (barring other outages) can see the monitoring server.  When the link comes back up, even if the link itself is still blocking pending the convergence of the spanning tree, the local device is capable of passing its linkup.  If the topology's dependencies are set correctly, when the local side of that link goes down, the far side of that link is down and not being checked (there is no expectation of a down message from the far side of a down link).  It is also presumed up (or in its last state) when the linkup trap is received.

Though I'm sure there are scenarios where passive monitoring can trip over "environmental" conditions of the network, it's not fair to say "you will never get this feature, because it makes no sense".  I'm very excited to see this subject receive attention and discussion from different viewpoints - I thought it had been excluded from WUP and nobody missed it.

Post #5312
Posted 3/3/2005 11:46:03 PM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 11/11/2008 9:42:22 AM
Posts: 12, Visits: 14

Fortunately another NMS has already realized how passive monitors should be allowed to impact the device state instead of relying solely on active monitors.

Nagios addresses this issue and documentation can be found at:
http://nagios.sourceforge.net/docs/2_0/passivechecks.html

There are pro/cons to either NMS, but after using Nagios, I feel there are significant features missing from Whatup Pro that I've come to expect in a network monitoring solution.  Maybe after Gold and Professional, Enterprise is around the corner and will address everyone's needs.

Post #5316
Posted 3/4/2005 3:26:15 AM


Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: WhatsUp Gold Expert
Last Login: Today @ 1:49:13 PM
Posts: 1,513, Visits: 5,018
Hi everybody,

Looks like answers to my previous post are getting aggressive !!! What a pity. Sorry to all of you, I read back my text and I think it is also a bit aggressive. Please understand that English is not my language so I am doing my best...

Well, I think everybody is right here. What I did reading your answers was to go back to Gold -had almost forgotten it. Now I remember that in the recent versions they added this "event state" monitor, where you can change state of a fake active monitor upon receiving a trap.

Now, to make everything clear on my opinion :

* When I say you can't rely on traps, I am not saying "don't use them". I'm just saying that you can have a scenario where you receive the traps changing the monitor to "down" but not the trap changing it to "up". Here is a real example I am facing : I have a small remote site I am monitoring. There is an UPS there that sends me a trap if there is only a 5-minute autonomy left. Then it switches off until power is back. When that happens the UPS will send me another trap saying "hey I'm providing power again". Trouble is that the Cisco router -which is powered by the UPS- has not finished booting when the UPS sends the trap... So, it's unreliable.

* I also believe that my opinion is different from yours because I almost never look at the NMS maps. We simply have no time for that. We just react to an alarm we receive. Which means that for me, having a VISUAL indication like the one you request is not so important -although I do admit that it can be important for you, since every person has her own way to use the software.

So my purpose was just to say that although WUP gives no VISUAL indication of a trap, you can still use passive monitors and get an alarm if you receive a trap... Nothing more.

Personally I do use traps a lot, for instance I am monitoring a network where there is a layer-3 chassis at the core and this switch has an integrated denial-of-service-attacks feature. When it detects one it sends me a trap. It's very nice to receive an alarm when this happens !


Reading, writing and arithmetic - If you need to choose, please take option 1.