major and minor aquisition in CM

[Rajiv Dasmohapatra]

i am having some problems regarding the minor and major aquisition. See i haven't changed anything like snmp configurations on my devices since i installed CW 3.1. But still it seems that minor acquisition is running every 60 mins. major is configured for twice a day at 0900 and 1500 hr.

but i dont seem to understand the working. could you please make me understand.

[Joe Clarke]

The default is to run minor acquisitions every 60 seconds. Go to Campus Manager > Administration > User Tracking > Acquisition > Schedule Acquisition, and make sure the schedule meets your needs. I typically tell people to disable minor acquisitions (set the time to 0) as they do not really provide much value unless the network infrastructure is changing rapidly. As for the scheduled major acquisitions, they should be done when users are typically at work.

[Rajiv Dasmohapatra]

my problem is i am not able to understand their working. i have port security enabled in my network and my network do keep changing a lot in terms of end hosts.

According to the docs, "Major acquisition fetches end hosts for all switches where as minor acquisition fetches end hosts from switches which were reported as to have changed in the last Data Collection or polling cycle."

I want to know what kind of trap reports to CM for this minor acquisition to run. and If CM doesn't get those traps within 60 mins, will it run major acquition instead.

[Joe Clarke]

Changing end hosts or access ports does not count in terms of minor acquisition. The changes only refer to infrastructure changes (e.g. inter-device links going down).

The detection of changes for minor acquisition does not come from traps. It can come from ANI devices and links polling and Data Collection. Both are configured under Campus Manager > Administration > Data Collection > Schedule Data Collection and Device Poller. I already gave the example of a topology link going down. Another example is a switch reloading.

If changed devices have been detected, and the 60 minute timer pops, ANI will dump the list of changed devices to a file, then start the UTMajorAcquisition daemon with arguments to do a minor acquisition as opposed to a major one.

If, however, it is time to run a major acquisition, the minor acquisition will be skipped. Additionally, a minor acquisition will not run if at least one Data Collection has not been done or one major acquisition has not been done.

Instead of using minor acquisitions, I typically recommend users enable Dynamic User Tracking. This mode uses the CISCO-MAC-ADDRESS-NOTIFICATION-MIB traps to get near instant notifications of when users enter and leave the network. In this mode, end host entries will be automatically added to UT without needing to run an acquisition.

[Joe Clarke · Accepted solution]

You might also be interested in this thread where I explain acquisitions a bit more:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&topicID=.ee71a02&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd428ae

[Rajiv Dasmohapatra]

thnks man.