SNMP Performance Data in MIB2 and Private MIBs
There are hundreds of useful variables in the industry standard MIB-2. Most are located in the interfaces section, and a few more can be found in the IP section. It is prudent to limit the amount of data you collect to the bare essentials. This avoids overloading SNMP agents, taxing the network, and storing a lot of unnecessary performance data on the hard drive.
Often, a single variable does not tell the whole story by itself. For example, the number of input errors on an interface is meaningless by itself. You have to divide it by the number of received packets and multiply by 100 before it’s possible to judge if the error rate is too high.
NNM lets you form mathematical formulas comprised of MIB values. These formulas are called MIB expressions, which are generally much more useful than raw SNMP values. Table 9-2 lists some recommendations plus some threshold settings to get you started.
| NNM MIB Expression | Suggested Threshold Settings | Explanatory Notes |
|---|---|---|
| avgBusy5 | Alarm 90% for 4 samples. Rearm 50% for 2 samples. | CPU router utilization five-minute average. High router CPU utilization may not be a bad thing. |
| If%util | Alarm 90% for 4 samples. Rearm 60% for 2 samples. | The interface is treated as a full duplex. High utilization by itself is not a bad thing. |
| If%inErrors | Alarm 1% for 4 samples. Rearm 0% for 2 samples. | Small but consistent errors are a bad thing. |
| If%outErrors | Alarm 1% at 4 samples. Rearm 0% for 2 samples. | Small but consistent errors are a bad thing. |
| IP%PacketLoss | Alarm 1% for 4 samples. Rearm 0% for 2 sample. | Packet loss in the router due to buffer overflow and other maladies reduce application performance. For Cisco routers, it counts the number of packets the router could not forward because no ARP reply was received for a hop. |
Note that the first entry in this table is not a MIB expression, it is part of the Cisco enterprise MIB. For all table values the recommended sample interval is five minutes. The thresholds given are rules of thumb. The alarm sample duration of four samples ensures the condition is persistent while the two-sample rearm ensures that you detect return to normal situations quickly.