Troubleshooting Tools. Tools for Gathering Information

Transcription

1 Internetwork Expert s CCNP Bootcamp Troubleshooting Tools Tools for Gathering Information Before implementing a fix, information must be gathered about a problem to eliminate as many variables as possible IOS offers both proactive and reactive tools for gathering information Proactive monitoring can inform you about problems that need more reactive research to isolate

2 Proactive Monitoring IOS supports both passive and event driven monitoring to observe the current network status Examples are SNMP RMON Syslog NetFlow EEM SNMP Simple Network Management Protocol Used to report conditions of managed device to management station (NMS) Two ways to collect data Trapping Managed device reports event to NMS Polling NMS asks managed device to report a variable Management Information Base (MIB) Variable used to report a network condition SNMPv2c vs. SNMP3

3 SMMP Polling Define SNMP Community String Password for NMS to poll device Two types of community strings Read Only Information gathering only Read Write Gather info and set values snmp-server community string [ro rw] [acl] access-list defines who can poll device SNMP Trapping: Step 1 Define events to trap All traps snmp-server enable traps Specific traps snmp-server enable traps [notification-type]

4 SNMP Trapping: Step 2 Define NMS to trap to All enabled traps snmp-server host host-addr communitystring Subset of enabled traps snmp-server host host-addr communitystring [notification-type] RMON Remote Monitoring Used to report a MIB value to SNMP NMS or syslog server Two components Alarm Condition that triggers event CPU exceeds 90% Free memory drops below 20Mb Event Message to send to NMS / syslog Help! My CPU is over 90%!

5 RMON RMON alarm defines how MIB is sampled Delta sampling Difference between MIB value at time index A compared to MIB value at time index B Packets sent out E0/0 each minute CRC errors received every hour Used for values that only increase Absolute sampling RMON Exact value of MIB at time index A CPU Utilization Memory Utilization Used for value that increase and decrease

6 RMON Example Configure RMON to track the five minute CPU average (lsystem.58.0) If the utilization is over 90% generate the event CPU Above 90% If the utilization is below 30% generate the event CPU Below 30% Sample the MIB every 60 seconds Trap the events to the SNMP NMS at using the community string CISCO Logging IOS can log messages to Console Monitor (VTY / AUX) Buffer Trap (syslog) show log to check logging condition

7 Logging Severity Level or severity determines what log messages will be sent Logging at severity 3 means 0, 1, 2, and 3 Rack1R1(config)#logging console? <0-7> Logging severity level alerts Immediate action needed (severity=1) critical Critical conditions (severity=2) debugging Debugging messages (severity=7) emergencies System is unusable (severity=0) errors Error conditions (severity=3) guaranteed Guarantee console messages informational Informational messages (severity=6) notifications Normal but significant conditions (severity=5) warnings Warning conditions (severity=4) xml Enable logging in XML <cr> Syslog Logging logging [host] global command Syslog defaults to informational severity 6 logging trap debugging to send all messages Logging facility controls format of syslog messages Used to ease parsing of logs from different devices on the syslog server

8 Logging Timestamps Log timestamps can be formatted as Uptime Time since last reload service timestamps {debug log} uptime Localtime Clock s time service timestamps {debug log} datetime [msec] [localtime] [showtimezone] [year] NTP considerations NetFlow Used to collect traffic statistics for inbound or outbound flows Flow defined as an individual session between a source & destination plus protocol/port pairs/markings Flows data is exported to a collection station for further analysis E.g. Cisco NetFlow Collector, NetQoS, Cacti, etc. Configured with ip flow interface & global command Local verification by show ip cache flow

9 Embedded Event Manager EEM allows custom event actions to be defined in IOS E.g. if CPU exceeds 90% send me an Includes several built in applets to simplify configuration Supports Tool Command Language (TCL) shell for advanced programming External repository hosted at Embedded Event Manager (EEM) Scripting Community Reactive Monitoring Once you are alerted of a problem, more research is generally needed Examples are show commands E.g. show processes cpu history Uses pipe for redirect options debug commands E.g. debug ip ospf adj SPAN/RSPAN packet capture Requires outside analysis with offline tools, e.g. Wireshare/Ethereal

10 Q&A