RMON groups
Among the RMON groups defined by RMON specifications (RFC 2819), the device uses the statistics group, history group, event group, and alarm group supported by the public MIB. In addition, HP defines and implements a private alarm group, which enhances the functions of the alarm group. This section describes the five kinds of groups.
Ethernet statistics group
The statistics group defines the statistics that the system collects on various traffic information on a particular interface (at present, only Ethernet interfaces are supported) and saves the statistics in the Ethernet statistics table (ethernetStatsTable) for query convenience of the management device. It provides statistics about network collisions, CRC alignment errors, undersize/oversize packets, broadcasts, multicasts, bytes received, packets received, and so on.
After the creation of a statistics entry on an interface, the statistics group starts to collect traffic statistics on the interface. The result of the statistics is a cumulative sum.
History group
The history group defines the statistics that the system periodically collects on traffic information at a particular interface and saves the statistics in the history record table (ethernetHistoryTable) for query convenience of the management device. The statistics includes bandwidth utilization, number of error packets, and total number of packets.
A history group collects statistics on packets received on the interface during each period, which can be configured through the command line interface (CLI).
Alarm group
The RMON alarm group monitors specified alarm variables, such as total number of received packets (etherStatsPkts) on an interface. After you define an alarm entry, the system gets the value of the monitored alarm variable at the specified interval. When the value of the monitored variable is greater than or equal to the rising threshold, a rising event is triggered; when the value of the monitored variable is smaller than or equal to the falling threshold, a falling event is triggered. The event is then handled as defined in the event group.
If the value of a sampled alarm variable surpasses the same threshold multiple times, only the first one can cause an alarm event. In other words, the rising alarm and falling alarm are alternate. As shown in a, the value of an alarm variable (the black curve in the figure) surpasses the threshold value (the blue line in the figure) for multiple times, and multiple crossing points are generated, but only crossing points marked with the red crosses can trigger alarm events.
96