Fine-Tuning the Discovery Filter

First discovery is quite a thrill. Watching the Internet submap as NNM discovers a new network is always a fresh experience. Once that discovery is complete, it’s time to assess what’s in the database. The discovery filter is often initially left open to identify every IP addressable device. This bloats the NNM database. So now it’s time to inventory all the OIDs on the network. Many familiar OIDs will be present, but some unexpected ones are found that have to be tracked down. NNM ships with a large, helpful list of well-known vendor OIDs, but your network may host some mystery vendors.

Armed with fresh insight into the network components, you will probably have to modify the filters file to include additional sysObjectIDs and reject others. Using the sysObjectID in the discovery filter is a good idea because it offers a simple, elegant method to define devices independently of other difficult-to-define and hard-to-manage attributes such as IP addresses, which are subject to change in a real network. You have to decide what devices you want to discover and place on the map. Recall from Chapter 3 that a map filter determines what devices are shown on a given map, while a discovery filter determines what devices netmon admits into the database.

Note that it’s not necessary to scrub the database and rediscover the network merely to remove devices that you’ve decided not to include in the filters file. Executing ovtopofix -f filtername will subject the current database to the revised discovery filter filtername and remove devices that don’t pass the filter.

One strategy for developing a discovery filter is to define all network equipment by OID. A note of caution: Some vendors include the O/S version as part of their sysObjectID. If you upgrade the O/S on one of these systems, then your filter may no longer work. Use wildcards to get around this, i.e., wildcard the O/S part of the OID. This technique works well for network managers who want to manage only their infrastructure. Administrators of file and print servers will usually want to see only their file servers, network printers, and network scanners on the map, so their NNM system will have a different discovery filter. If both users share the same NNM system, then the discovery filter will have to pass both sets of devices, and a map filter can be defined to give each user the view of the devices they want to manage.