RMON – Remote MONitoring

RMON stands for Remote Monitoring. It is an extension to SNMP
that lets us enable event notifications when certain thresholds
are met. We can monitor the performance of interfaces or the CPU
and everything that has an OID in the SNMP MIB. We might want to
check for a high CPU utilization or the number of errors on an
interface.

When we monitor different parameters we can either look for
absolute values or delta values. Absolute values could be that
when the CPU hits 80% send an alarm. A delta value is the difference
between two measurements. If the number of errors on an interface
increases with more than 10 packets send an alarm.

There is not much configuration needed to setup RMON. We need to
configure alarms and events. When we configure the alarm we
set values to look for and a number of the event that we want to
trigger when the value is reached. The event will log the alarm
to syslog or send a SNMP trap when it is triggered.

We will use a very simple topology with two routers and a
FastEthernet link connecting them.

We want to monitor the change (delta) in octets in on the
FastEthernet interface. The value that correspends to octets
in is ifInOctets. We can see all the available parameters that
we can monitor with the show snmp mib command. This list is
huge and it may freeze your session for a while when you
scroll through it.

We need to find what ID our interface has so we can monitor it.
We can find this ID with the show snmp mib ifmib ifindex command.

We can see that the FastEthernet0/0 interface has an ID of 1.

We now have everything that we need to setup RMON. We start by
configuring an alarm. If the number of octets has increased with
less than 20000 an alarm wil be sent and if increasing with more
than 40000 then an alarm will also be sent.

You can see that we received a message directly because of the falling
threshold. The number 1 in rmon alarm 1 is an ID that identifies the
alarm. The number 30 is the sample interval. We check this value every
30 seconds. The number 1 after the rising- and falling-threshold is
what event to trigger.

We can check the parameters that we have configured with show rmon alarms
and show rmon events.

Now lets see if we can trigger the rising threshold. We need to generate
some traffic. We will do this with ping and a timeout of 0.

Has the event been triggered?

Yes it has. We can see the last value reported with the show rmon
alarms command. The rising threshold was triggered and later when
we stopped sending traffic the falling threshold was also met. The
log messages are send to console. If we want to send them to NVRAM
we need to use the logging buffered command.

Now you know how to configure RMON. RMON is very flexible and can
monitor a lot of different values.