Arista NetVisor UNUM 6.3.3

Use Cases

There are features and functions used in Arista NetVisor UNUM and Insight Analytics that are common throughout the user interface (UI). Please refer to the Common Functions section for more information on the use of these functions and features.

The following Use Cases are examples of configuring Alerts in NetVisor UNUM.

•Switch CPU Exceed Limit Alert

•Switch Memory Limit Exceed Alert

•Link Down Alert

•Link Up Alert

•Multiple Login Failure Alert

•Fabric Node State Change Alert

•Excessive Packet Drops Alert

•Port Scanning / SYN Attack / SYN Flood Alert

•MAC Move Exceeded Alert

•Port Utilization Alert

•Port Errors

•Port Congestion Drops

Alert Details

Create Alerts using the following parameters. The interface prompts you for mandatory fields.

•Classification allows the user to identify the severity of the alert sent, i.e., Critical / Warning / Information.

•Alert Name of your choice.

•Index Name, choose the appropriate indices from Elasticsearch.

•Optionally, you can select the Index Type for the selected Elasticsearch index.

•Select the Time Field for the index.

•Optionally, enter the Alert Tags which helps you to search the Alert based on the tags.

Please refer to the menu configuration settings in the Alerts section for more information.

Available Index Patterns

The Use Cases are built upon the following Index Patterns.

Before configuring Alerts, first enter the Index Patterns based on the type of data you require.

Please refer to the menu configuration settings in the Alerts section for more information.

Alert Condition

Configure different types of alerts using the Rule Type parameter. Below are the details on the supported Rule Type and the corresponding settings.

•Rule type – monitoring pattern for a rule

•Threshold – Match on any event matching a given filter

•Spike – Match when the rate of events increases or decreases

•New value – Match when a never before seen value appears in a field

•Repeated value – Match when a repeated value appears in a field

•Flatline – when event threshold attains dead state i.e., threshold < 1

Please refer to the menu configuration settings in the Alerts section for more information.

Schedule Detail

If you would like to schedule the alerts, enable the Schedule section checkbox, and specify the following details.

If you don’t want your alert generated, uncheck the Schedule section checkbox.

1.Set up the schedule for the alert by selecting the Frequency Type as “Hourly,” “Daily,” “Weekly,” “Monthly,” “Yearly,” or “Custom.”

2.Enter the scheduled frequency time in the Schedule Frequency Time section to schedule alert generation.

3.Enter the start time to generate the alert from the Start Time field

Please refer to the menu configuration settings in the Alerts section for more information.

Alert Action

Set Alert notifications by selecting the Alert action checkbox option. If you do not want the alert, clear the checkbox.

The supported alert actions include:

1.Send alerts to Email.

2.Send alerts to the Elasticsearch index.

Please refer to the menu configuration settings in the Alerts section for more information.

Use Case # 1 - Switch CPU Exceed LIMIT ALERT

In this example, NetVisor UNUM generates an alert if the CPU load rises above 80% at least 20 times in the last 15 minutes running at a scheduled interval of one minute. To distinguish whether or not the CPU load is a temporary spike or the CPU is continuously overburdened, we recommend these settings.

Settings

Result: A generated Alert for "CPU Load" with a threshold greater than 80%  when it hit more than 10 times for the last 15 minutes.

Use Case # 2 - SWITCH MEMORY LIMIT EXCEED ALERT

In this example, NetVisor UNUM generates an alert if memory capacity exceeded 70% at least 10 times in the last week, running at a scheduled interval of one minute. This alert helps monitor for switch memory load.

Settings

Result: Alert for "Memory Load" with a threshold set to greater than 70% generated when it hit more than 10 times for the last 1 week scheduled to check every 1 min.

Use Case # 3 - LINK DOWN ALERT

In this example, NetVisor UNUM generates a Link Down Alert when a specific port goes down more than 5 times, scheduled to check every single minute daily. This alert triggers whenever a port flaps due to software or hardware issues.

Settings

Result: Alert for Link Down generated when a specific port or any Port went down more than 5 times for the given schedule.

Use Case # 4 - LINK UP ALERT

In this example, NetVisor UNUM generates a Link UP Alert when a specific port goes up more than 5 times, scheduled to check every minute daily. This alert triggers whenever a port flaps due to software or hardware issues.

Settings

Result: Alert for Link Up generated when a specific port or any Port went up more than 5 times for the given schedule.

Use Case # 5 - MULTIPLE LOGIN FAILURE ALERT

In this example, NetVisor UNUM generates a Login Failed Alert when a specific unauthorized user attempts to login more than 5 times, and the user failed to login. Scheduled to check every minute this alert triggers immediately as long as the unauthorized user continues to attempt a login to the device.

Settings

Use Case # 6 - FABRIC Node State CHANGE ALERT

In this example, NetVisor UNUM generates a Fabric Node State Change Alert when specific node state changes occur, scheduled to check every minute. This alert triggers whenever a switch goes down or problems exist with the NetVisor OS OS on a particular switch due to software or hardware issues if it happens more than 5 times daily.

Settings

Result: Alert for Fabric Node Change Alert generated when specific Node state changes for more than 5 times scheduled to check every single minute. 

Use Case # 7 - Excessive Packet Drops Alert

In this example, NetVisor UNUM generates an Excessive Drop Alert when there are excessive packet drops measured in iDiscards/oDiscards, scheduled to check every minute daily. This alert triggers when a physical port is not functioning correctly or a specific software queue or the CPU is dropping packets.

Settings

Result: Alert for Excessive Packet Drop generated when packets dropped observed in terms of iDiscard/oDiscards for specific threshold configured and scheduled to check every single minute.

Use Case # 8 - PORT SCANNING / SYN ATTACK / SYN FLOOD ALERT

In this example, NetVisor UNUM generates a Port Scanning Alert when there are 50 sync connections within 15 minutes, scheduled to check every minute daily. 

Settings

Result: Alert for Port Scan/Syn Attach generated when there are continuous SYN messages for more than 15 minutes, and scheduled to check every minute.

Use Case # 9 - MAC MOVE EXCEEDED ALERT

In this example, NetVisor UNUM generates a MAC Move Exceeded Alert when there are more than 10 moves in a day, scheduled to check every minute daily. When a MAC address appears in a different physical interface or within a different unit of the same physical interface, and if this behavior occurs frequently, it is considered a MAC move. Configuration errors in the Layer 2 network can force traffic into never-ending circular paths.

Settings

Result: Alert for MAC Move Exceeded generated when there are continuous MAC MOVE messages in Syslog more than 10 and scheduled to check every single minute.

Use Case # 10 - Port Utilization

In this example, NetVisor UNUM generates a Port Utilization Alert when port usage exceeds 80% more than 20 times in 15 minutes.

Result: Alert for Port Utilization gets generated when there is a match based on the above criteria, scheduled to check every single minute.

Use Case # 11 - Port Errors

In this example, NetVisor UNUM generates a Port Errors Alert when port errors exceed 50 in 15 minutes.

Result: Alert for Port Errors gets generated when there is a match based on the above criteria, scheduled to check every single minute.

Use Case # 12 - Port Congestion Drops

In this example, NetVisor UNUM generates a Port Congestion Drops Alert when port congestion exceeds 50 more than 5 times in 15 minutes.

Result: Alert for Port Congestion Drops gets generated when there is a match based on the above criteria, scheduled to check every single minute.