MARS and SNMP

[clausonna]

Hi folks,

I have about 80 remote sites in my network, each with a T1 or less connected to a 2821 router and a 3560 switch. I have a 45Mbps pipe at Corporate HQ where my MARS box is located.

The docs say that on both the routers and switches I need to do a "snmp-server enable traps". On the routers, this generates about a one and a half pages of resulting config (e.g. snmp-server enable traps bgp; snmp-server enable traps eigrp; snmp-sever enable traps frame-relay, etc) On the switches it generates about a half-page of config.

I know this is a subjective question, but how much load on my network are all of these traps going to produce? Can I selectively enable traps (either to reduce load on the network, or to just reduce the size of my config?)

Any comments on NetFlow in this environment?

I'd be interested in hearing from other MARS users that have similiar setups.

- Neil

[Collin Clark]

Just enable traps that are necessary. For example the only place I have BGP enabled traps are on my internet router. I've found that debug logging is fine with MARS (no traps). I have netflow reporting to it as well, but I don't see it doing much and I can't find too much info on what/where I should be seeing events.

[wiluszm]

Neil,

I operate in a similar environment as you. I have 113 fractional T1 sites (256 kbps) with 2 x 2811 and 3-6 2950s per site. The 2811s have netflows exporting, syslogs, and snmp traps all going to MARS. The 2950s are configured for just SNMP traps and syslogs. I see a negligible amount of bandwidth utilized for this. If you ever are fearful that this is utilizing too much bandwidth I'd recommend using IOS rate-limiting to throttle traffic destined for your MARS box. I think that would be overkill as I do not see any more that 10kbps ever being used for MARS reporting from remote sites. Anymore questions let me know.

-Mike

http://cs-mars.blogspot.com