SNMP monitoring: traps or thresholds?

[t.baranski]

(Accidentally posted this to the VPN Network Management forum earlier today.)

I'm in the process of deploying an SNMP infrastructure for our network using OpenNMS, and am wondering if I should use either traps or thresholds (or both?) to detect Cisco events such as high router/switch temperature, high CPU usage, etc.

I've always thought of traps as being the standard way to be notified of such things, but with UDP there's no guarantee that the NMS will ever see a given trap. By using thresholds (i.e., monitoring an OID an alarming when it exceeds a certain value), the NMS will detect the event on it's own and can react accordingly. So I am undecided on which method to use.

I'd appreciate any advice from those of you who use SNMP.

Thanks,

Terry

[donewald]

Terry,

Both traps and RMON (rising / falling ) alarms are both send via UDP trap/syslog. The NMS, in these settings has no idea this is happening without the agent/device sending an alarm to the NMS system or having a very aggressing polling interval gathering these stats. Event traps work but will not get you the granularity of events (CPU/errors/etc) that you might want. RMON will and can offer you the ability to get traps based on your needs. See this link for your information.

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094478.shtml

Hope this is what you are looking for, if not please repost.

Don

[t.baranski]

Don,

Thanks for the response. When I say "thresholds" I'm referring to the NMS regularly polling OID's and alarming if a pre-configured limit is reached (e.g., CPU usage above 75%). So in this case, there aren't any traps sent -- the NMS discovers the problem via regular polling.

The tradeoff to me when using thresholds instead of traps seems to be a higher assurance of an alert (because the NMS polls the OIDs every 5 minutes as opposed to traps which are only sent once) vs. a higher amount of traffic on the LAN (for the same reason). So I'm wondering how others handle alert monitoring. Do people tend to rely on traps, or NMS polling?