Notify Someone of Situations of Interest

Instructions to send email, a message to a Syslog server, or an SNMP trap to indicate that a condition of interest has occurred

PacketWise offers several features to monitor for a condition of interest and then notify someone that the condition has occurred. This recommendation uses the older and less powerful user events feature.

Packeteer recommends new installations as well as new monitored conditions always use the adaptive response feature instead of the user events feature. Consult Monitor and Respond to Conditions of Interest Using Agent Templates for instructions on how to notify someone of a situation of interest with the adpative response feature.

Note that you must use the command-line interface (CLI) to configure events.

Steps:

1. Decide how you want to be notified when an event occurs: via SNMP traps, email, and/or syslog.
   
   SNMP traps are useful when using a network-management platform, such as HP OpenView, for event and alarm processing and notification. Email is an appropriate choice if you need fast, urgent notification that someone is likely to check more frequently.
   

2. If you want to be notified via SNMP traps, configure PacketWise for SNMP support and define the SNMP trap destination(s).
   

3. If you want to be notified via email, set up email notification by configuring an SMTP server and defining email recipients.

4. If you want a message to be sent to a syslog server, set up the syslog feature.
   

5. Define which metrics PacketWise will use when evaluating your situation of interest. Find a relevant predefined event or define a new event.
   
   For example, you could define the following event:
   event new WastedBandwidth tcp-retx-pkts%.link>$1 1m
   to define a new event called "WastedBandwidth" to be done on the link as a whole that tests the measurement variable called "tcp-retx-pkts%" for being more than something (>$1) as yet undefined. The default checking interval is one minute (1m).
   
   Note that you have defined only a potential event, as you still have to define the comparison value, as well as other information, and to tell PacketWise to start monitoring.

6. Register the event, giving PacketWise the rest of your instructions and telling it to start monitoring for your condition of interest.
   
   The types of information you specify include the comparison value or threshold, a specific instance of the link, partition, or class you want monitored, and criteria to help prevent a flood of notifications.
   
   For example, you could register the following events:
   event register WastedBandwidth(inbound,12, 4) 1m email trap limit=3
   event register WastedBandwidth(outbound,12, 4) 1m email trap limit=3
   to apply your wasted-bandwidth event to both Inbound and Outbound links, evaluate them every minute, send both an email and an SNMP trap when retransmissions grow to above 12 percent, avoid additional notification until after retransmissions decline to 4 percent, and never send more than three notifications in one day.
   

7. Keep tabs on all the armed events and their history by monitoring event status.