Operations Manager: Network Monitoring

Transcription

1 Operations Manager: Network Monitoring Phil Bracher Chris Maiden

2 Agenda

3 Network Monitoring Overview

4 Network Monitoring Features Out of the box discovery, monitoring, dashboards & reporting. Server to network dependency discovery. Multi-vendor supporter 80 vendors-2000 devices certified Multi protocol support SNMPv1/v2c/v3 IPv4 and IPv6

5 Support Device Types (SNMP) Bridges Firewalls Load Balancers Routers Hosts Switches Hubs 5

6 SNMP Overview

7 Main Concepts SNMP Components SNMP Communications MIB tree structure How are OID s formed?

8 SNMP Components Managed Devices SNMP Agents Network Management System (NMS) SNMP V1, SNMP V2c, SNMP V3

9 SNMP V1 and V2c Message Format

10 SNMP V1 and V2c Message Format Version Number (SNMPv2c) Community String PDU Control Files PDU

11 SNMP V3 Concepts Authentication - Determines the message is from a valid source by using RunAs Accounts. Encryption - Prevents network sniffing utilities from being able to see the contents of the packets. Message integrity- Ensures that a packet has not been tampered with while in-transit Level noauthnopriv authnopriv authpriv Definition Without authentication and without privacy With authentication, but without privacy With authentication and with privacy

12 SNMP V3 Message Format msgversion Scope of Authentication msgid msgmaxsize msgflags msgsecuritymodel msgglobaldata Or HeaderData User Security Model Security Parameters AuthoritativeEngineId AuthoritativeEngineBoots msgsecurityparameters Defined and used by Security Model AuthoritativeEngineTime UserName contextengineid AuthenticationParameters Scope of Encryption contextname PrivacyParameters msgdata or Scoped PDU PDU

13 SNMP v3 Why Unreadable? SNMP Version Unreadable Community String Unreadable PDU

14 MIB and OID MIB: Management Information Base. It is a collection of information organized hierarchically OID: Object Identifiers that uniquely identify managed objects in a MIB hierarchy.

15 OID Tree

16 How are OID s formed? Assigned in hierarchical fashion Each number identifies a node in the MIB tree IETF (Internet Engineering Task Force) Internet Community (IANA) Directory ( ) Mgmt ( ) Experimental ( ) Private ( )

17 Network Discovery

18 What s Discovered? Connectivity: server to switch, switch to switch VLAN membership HSRP groups Stitching of switch ports to server NICs Key components of a device: ports/interfaces, processor, memory

19 Discovery Methods Explicit discovery Customer knows the network devices. Manual process add ip address or import list Recursive Discovery Network topology unknown Discovered based on a set of seed devices Grabs ARP and IP tables and crawls network

20 Discovery Stages Initial Probing Sends an initial ICMP and/or SNMP request to identify the system. Processing Get components, IP addresses, VLAN memberships, resources, IP networks, netmasks, and neighboring devices. Topology is created Post Processing Creates Layer 2 (Physical MAC Address) and Layer 3 (Logical IPv4 and IPv6) connectivity between the devices in the topology. Port Stitching

21 Initial Probing Stage ICMP Ping and/or SNMP Get (v2 by default) ICMP ping first SNMP Get request If no response device added to pending If SNMPv2c fails -> SNMPv1

22 SNMP GetRequest The OID s are registered under the namespace, which define common MIB variables Version of SNMP being used Community String Type of SNMP request Request for sysdescr object If this fails it goes to pending mgmt - if success goes to queue to get processed. Request for sysobjectid Request for syscontact Request for sysname Request for syslocation

23 SNMP Get Response sysdescr sysobjectid (Catalyst 4506) syscontact sysname syslocation

24 Processing Stage Matches sysobjectid = OID in oid2type config files found C:\Program Files\System Center Operations Manager 2012\Server\NetworkMonitoring\conf\ Gets details on components, IP addresses, VLAN memberships, resources, IP networks, netmasks, and neighboring devices. Identify device type (Switch, Router, Hub, etc.), vendor, model, certification level What discovery probes to use, what classes to use to monitor Levels of Certification Certified - has been successfully tested using standard and proprietary MIBs supplied by the vendor. Generic - The OID is unknown, only the availability of the device will be monitored.

25 Post Processing Stage Creates Layer 2 and Layer 3 connectivity between the devices in the topology. "Port Stitching" - Mapping IP and MAC access points retrieved from the ARP cache to the appropriate devices. Removes MAC access points that do not belong to devices in the topology A MAC Access Point is the interface to which a device on an IP network connects Creates network connections to represent WAN, or logical connections Creates connections based on discovery protocols

26 Demo - Discovery

27 Discovery Events Full Discovery started for 1 request(s) Topology cleared successfully Proceeding to discover seed: <IP Address> Probing <IP Address> Probing completed for <IP Address> PostProcessing started PostProcessing completed No devices found in filtered list after discovery Discovery completed Start processing connections to computers Finished processing connections to computers <IP Address> discovered successfully

28 Network Device Monitoring

29 General Information Support Resource Pools for High Availability Monitoring. Network devices discovered as base class: System.NetworkManagement.Node Only certain ports will be monitored by default Ports connecting two network devices to each other Ports to which a managed server is connected

30

31 Basic Resource Pool Best Practices Perfect Failure 2 MS s + Observer or 3 MS s (no observer) Pools use Default observer: Disable for > 2 MS s For large implementations consider setting default pools to manual HKLM\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Poo Manager\ DWORD PoolLeaseRequestPeriodSeconds DWORD PoolNetworkLatencySeconds

32 Demo Setting AMSRP to Manual

33 Monitors and Rules: All Devices Monitor Name ICMP Ping Description Uses ICMP to determine whether the monitored network device is available SNMP Ping Uses SNMP to determine whether the monitored network device is available Rule Name Internal Network Management Node Discovery data collector Enabled by default Yes Description Internal rule for collecting discovery data on nodes for network management discovery ICMP Ping Response Time Yes Collects the time it takes a network device to respond to an ICMP Ping Trap Received (warm start) Yes Creates event for SNMP warm start trap when received from network device Internal Network Management Discovery Trap rediscovery No Internal rule to initiate discovery via trap requests Trap received (cold start) Yes Creates an event for the SNMP ColdStart trap when received from a network device

34 What s Monitored: Certified Devices Port/Interface Up/Down (operational & admin status) Volumes of inbound/outbound traffic % Utilization Discards, Drops, Errors Processor % Utilization Memory In depth memory counters (Cisco Only) Free memory

35 What s Monitored: Certified Devices. Connection Health Based on looking at both ends of a connection VLAN Health Based on health state of switches in VLAN HSRP Group Based on health state of individual HSRP end points

36 Certified Device Monitoring Example Monitor Name Target Description Free Memory (Cisco) Memory (Cisco) Monitors the level of free memory on this device Memory Pool Fragmentation (Cisco) Memory (Cisco) Monitors the level of memory fragmentation in the memory pool Processor Utilization (Cisco) Processor (Cisco) Monitors the level of processor utilization on this device Rule Name Target Description Memory (Cisco) Largest Free Buffer Percentage (Cisco) Collects the size of the largest number of contiguous bytes from the memory pool that are currently unused, expressed as a percentage of the free memory in the memory pool. Memory Pool Free Memory Percentage (Cisco) Memory (Cisco) Collects the percentage of free memory remaining on the device remaining on the device Processor Utilization (Cisco) Processor (Cisco) Collects the current processor utilization

37 Monitor properties

38 Visualization (Dashboards) Network Summary Network Node Network Interface Vicinity

39 Reporting Memory Utilization Processor Utilization Port Traffic Volume Port Error Analysis Port Packet Analysis

40 Network Summary Dashboard

41 Network Node Dashboard

42 DEMO Dashboards/Reports

43 Common Issues

44 Common Issues you may encounter Duplicate device entries: Bug Fix in next UR. Delete duplicate device. Ensure the discovery for that particular device hasn t been removed. Discovery of V2 device cannot receive V1 traps. Configure device to send V2 traps or create trap rule/monitor, export, then modify the MP SNMP suffix on load balancing device Virtual community suffix

45 Troubleshooting What do I do now?

46 Please don t forget your evaluations [email protected] [email protected] Need more information on DMVMUG Visit QUESTIONS?