Create Default Traffic Agents

The Default Traffic agent alerts you when the traffic in a default traffic class (such as Inbound/Default) exceeds a certain percentage of all traffic in a specific time interval. For example, if more than 15 percent of all traffic is not getting classified and therefore being placed into the /default class, you would want to know about this situation and perhaps take action on it. What could be causing a Default class to have so much traffic? You may have turned off traffic discovery, perhaps because you have fine tuned your traffic tree with just the classes you care about monitoring and controlling; if new applications are being run on your network, they will get classified into Default. Another possible reason for a large amount of traffic in a Default class is that you have auto-discovery on, but the PacketShaper has created the maximum number of classes — no more classes can be discovered so the traffic gets classified into Inbound/Default or Outbound/Default.

The standard alert is a red indicator on the info tab (PacketWise) or configuration tab (PolicyCenter). In addition, you can have an email, SNMP trap, or syslog message sent when the Default class' utilization crosses a predefined threshold; this method requires that you create an action file — a text file of PacketWise commands. The action file can take other actions, as well, such as enabling traffic discovery or turning on top talkers/listeners, and can include any CLI command that can run without additional user input. See Action File Overviews for more information.

In order to create agents, the adaptive response feature must be enabled.

Create a New Agent

To create a Default Traffic agent:

Note: If you want to monitor Inbound/Default or Outbound/Default, you don't need to create a new agent. You can simply check the status of the predefined Inbound Default Traffic and Outbound Default Traffic agents.

1. On the setup tab, click the Adaptive Response Settings link.
   
   
2. Click add. The Add Agent Entry window will open.
   
   
3. Click the create a new agent from this agent template drop-down list, and choose Default Traffic.
   
   
4. Enter a unique identifying name for the new agent in the Name field, for example Citrix Default Traffic.
   
   
5. If desired, change the evaluation interval, in minutes (how often the agent should measure its target).
   
   
6. Click OK and Edit Parms. This will open the Edit Agent Entry window where you can define the parameter values for your new agent.
   
   
7. In the ClassName field, enter the name of the class to be monitored (for example, Inbound/Citrix/Default). Note that this must be a Default class.
   
   
8. If desired, modify the threshold values:
   
   RedThreshold — The value at which the status of the agent turns red, and a red action file is triggered, if present. For a Default Traffic agent, this number represents the Default class' percent utilization of all traffic during the evaluation interval. For instance, if the RedThreshold is set to 15, the agent's status will change to red when the utilization of the class is more than 15 percent of all traffic.
   
   
   GreenThreshold — The value at which the status of the agent turns green, and a green action file is triggered, if present. For instance, if the GreenThreshold is set to 7, the agent's status will be green when the utilization of the Default class is less than 7 percent of all traffic.
   
   
9. Click OK to save your changes.

After creating the agent, you will want to monitor it to see whether usage in the class has come close to or exceeded the threshold.

Check the Agent Status

To check the status of the Default Traffic agent:

1. Click the info tab. The PacketShaper’s info tab shows an icon for each agent category, and a colored status indicator for each. The Default Traffic agents are in the Application Health category.
   
   
2. To see the status of each individual agent in the Application Health category, hover your mouse over the colored status indicator, as shown below.
   
   
   
   
3. In the pop-up window, locate the Default Traffic agents. What colors are its status indicators?
   
   Green — During the last evaluation interval, usage did not exceed the red threshold you defined. In other words, an acceptable amount of traffic is being classified into the Default class.
   Yellow — During the last evaluation interval, usage was approaching the red threshold (yellow is the range between the red and green thresholds).
   Red — During the last evaluation interval, usage exceeded the defined red threshold. In other words, too much traffic is getting classified into Default. In this situation, you may want to consider taking some action, such as enabling traffic discovery or turning on top talkers/listeners. If the status indicator is red, you should look at the incident report for details.
   
   If the agent has ever changed status (from green/yellow to red or from red/yellow to green, a report icon with a link to a detailed report will be available for that agent.
   
   
4. If there is a report for the Default Traffic agent, click the report icon. The incident report appears in a separate browser window.
   
   
   
   

Create an Action File that Sends an Email Notification

If you would like to be notified by email when the Default class' usage has exceeded the red threshold, you can create a command file that contains a single line: the send email command. By designating this command file as the red action file, an email will be sent when the red threshold is crossed. In addition, the action file can contain CLI commands for taking corrective action (enabling traffic discovery) or diagnostic action (turning on top talkers/listeners).

Note: In order to send email notification, you must configure an SMTP server in PacketWise.

To create an action file that sends an email notification:

1. If the info tab is currently displayed, click the Settings link; otherwise, go to the setup tab and click the Adaptive Response Settings link.

2. Click the edit button next to the partition agent.

3. Click the browse files button. The File Browser window opens and shows the contents of the 9.258/agent/cmd directory (where action files need to be stored).

4. Click the new cmd file button. A command file window opens.

5. In the File Name field, enter a unique name for your action file up to eight characters long, including 0-9, a-z, AZ, -,_, and . (period). Spaces are not allowed. Example: red-def

6. In the Contents area, enter the following commands:

#Title: red action file for Default Traffic agent
send email <address> "<subject>" ["<body>"]

where <address> is the email address of the recipient. For example:

send email raltman@test.com "Inbound/Default class exceeds threshold" "The utilization for inbound/default exceeded 15% of all traffic."

Note: If you want to send an email notification to more than one recipient, repeat the send email command for each email address.

Alternatively, you can include the variables for the class name ($class-id), average utilization ($avg-bps), and the red threshold ($RedThreshold) in the <subject> or <body>, as the following example shows:

send email raltman@test.com "$class-id exceeds threshold" "Average utilization for the evaluation interval was $avg-bps bps. The utilization for $class-id exceeded $RedThreshold percent of all traffic."

When the message is sent, the body of the email message would look something like this:

Average utilization for the evaluation interval was 383047 bps. The utilization for /Inbound/default exceeded 15 percent of all traffic.

If you want the action file to enable traffic discovery, include the following command in the file:

setup discover on

Or, if you want the action file to turn on top talkers/listeners for the Default class:

hostdb topusers start $class-id listen
hostdb topusers start $class-id talk

7. Click save.

8. Enter the name of your action file in the Red Action File field (for example, red-def.cmd).

9. Click OK.

After the next evaluation interval, an email will be sent if and when the agent's red threshold is crossed.

If the action file turned on top talkers/listeners for the class, you will want to wait a period of time for PacketWise to gather host information. Then you can view the Top Talkers and Top Listeners reports for the class to discover the hosts that are the top bandwidth consumers; from this information you might decide to manually create classes for some of these hosts, in order to reduce the amount of unclassified traffic.

You may also want to create a green action file to notify you when the Default Traffic agent returns to a green status. This action file could turn off traffic discovery (setup discover off) or turn off top talkers/listeners (hostdb topusers stop $class-id talk).