74CHAPTER 9: USING EVENT RULES
Traffic Event Rules These types of event rule help you to detect significant changes in the behavior of a machine or connection. Such changes are often causes or indicators of problems on the network. They may also indicate that some part of the network is overloaded, and could give advance warning that the load on a device is increasing.
Monitor Network Resource Usage
You use this type of event rule to detect machines that are using more than their share of the network. You can configure an event rule to monitor the whole network, individual devices or specific WAN links.
When an event rule of this type is active, Traffix Manager estimates the available bandwidth of the network, device or WAN link that is being monitored. If one machine uses up more than a certain percentage of the available bandwidth, then an event is generated.
By applying the protocol filter to an event rule of this type, you can use it to monitor the usage of specific network services.
For example, you can use this event rule to:
■Monitor for devices which use an excessive amount of Novell bandwidth.
■Monitor for devices which are using the Internet connection excessively.
Monitor Critical Devices
You use this type of event rule to monitor a set of devices and generate an event if the network traffic of those devices changes significantly. You can spot changing loads on server machines, and prevent problems with response times and overloading.
Once data collection has begun, you can start to build up a picture of typical traffic patterns and network usage. Based on this information, Traffix Manager will automatically guess which are the critical devices on your network. However, you will get more predictable results from this event rule if you specify server devices yourself.
An event rule of this type can detect changes in the traffic levels of a device, and changes in the usage of different protocols. It works by comparing the present activity of the specified devices with their historical behavior.
