Basic and Advanced Thresholds in NMIS8
NMIS8 includes powerful capabilities for performance and operational thresholding, which greatly enhance network management capabilities. These thresholds result in alerts/events/notifications which NMIS can send when it sees a threshold breached. The thresholds have very granular controls which by default have been configured fairly broadly.
A list of standard thresholds NMIS includes is available in NMIS Threshold Configuration
A simple example of this is that you will likely need to be notified when the CPU is high on a Core device, vs an Access switch in Timbuktu. This is part of the NMIS idea of relevance of information in general, not all devices are created equal, some devices deserve better alerting, people of course are created equal.
If you want to just modify and add new thresholds read the first section "Using the NMIS GUI to Configure Thresholds", the second section "About Threshold Controls" goes into more details about thresholds.
As always thanks to our commercial customers who support everyone who use NMIS8, including the creation of documentation and these great features, if you are interested in commercial support, please email contact@opmantek.com
Using the NMIS GUI to Configure Thresholds
Access the NMIS Models GUI
Access the GUI by clicking on the menu "System -> System Configuration -> NMIS Models", the "NMIS Models" widget will be displayed as shown below. Now this is a BIG form, so clicking on the POP OUT button will place it in its own browser TAB/Window. This is applicable in NMIS 8.4.8G and onwards.
NMIS 8.4 Example
NMIS 8.6 Example
Select the Section to Modify
I have selected NMIS 8.6 Common-threshold.nmis to edit, we now just search for the "item" we want to change the threshold for.
Note: in older model formats e.g NMIS8.4 and before and in some older Modelling of devices you need to select the Nodes Model- file and the threshold section
Select the Threshold to Add a Controlled Select
In this example we will add a select section, which will be controlled to only work on a specific device named "meatball" and the interface is "Dialer1". To do this we are going to hi-jack the threshold in the first position and edit the control. This is because these selects are executed in order and we need ours to be first, this is like an access list on a router or firewall. We will add another in position 10 when we are done. I will also update the default models to have gaps in the orders.......
Editing the Control
Now we just change the control to be the string "$node eq "meatball" and $ifDescr eq "Dialer1"" and click "Edit".
A New Control is Available
Now we can tune the thresholds by clicking "edit" on the one we want to change,
Changing a Threshold
Lets change the warning to be 65%, then click "Edit"
Updated Threshold for Warning
Now the warning level is set to 65%
Applying the Thresholds
The thresholds will be run on the next poll cycle or when they have been configured to run. You can run them on demand from the command line, with the following command (meatball is my router here, so change for your device).
/usr/local/nmis8/bin/nmis.pl type=threshold debug=true node=meatball
Adding a New Select Block
Now we need to add back the one we hi-jacked. So we add a new select block, click "add".
Setting the Order and Thresholds
I am going to set this one as 10, it will happen after the others but before the default, complete all the details you require in the form and click "Edit"
Adding a Control
We need to add a control field now, so on the new select section 10, click add
Complete the details in the control "$ifSpeed <= 5000000 and $ifSpeed >= 1000000" and click add.
New Threshold Select Added
Now we have the old hi-jacked threshold created anew ready for low speed thresholding.
About Threshold Controls
Simple Thresholds
In NMIS a simple threshold is defined by the following:
- the name
- the event name (which must begin with the phrase "
Proactive
" for correct event handling) - a select (with a default and optionally more)
- default threshold values
In the file /usr/local/nmis8/models/Common-threshold.nmis this looks like this:
'cpu' => { 'item' => 'avgBusy5min', 'event' => 'Proactive CPU', 'select' => { 'default' => { 'value' => { 'critical' => '70', 'fatal' => '80', 'minor' => '50', 'warning' => '40', 'major' => '60' } } } },
Have a set of thresholds for Core CPU
- 'critical' => '60',
- 'fatal' => '70',
- 'minor' => '40',
- 'warning' => '30',
- 'major' => '50'
Advanced Thresholds with Controls
- $name
- $node
- $host
- $group
- $roleType
- $nodeModel
- $nodeType
- $nodeVendor
- $sysDescr
- $sysObjectName
- others for interface
- Almost unlimited possibilities.
So we can create a more specific threshold for core devices (NMIS has this already configured by default).
'cpu' => { 'item' => 'avgBusy5min', 'event' => 'Proactive CPU', 'select' => { '10' => { 'value' => { 'critical' => '60', 'fatal' => '70', 'minor' => '40', 'warning' => '30', 'major' => '50' }, 'control' => '$roleType =~ /core/' }, --snip-- 'default' => { 'value' => { 'critical' => '70', 'fatal' => '80', 'minor' => '50', 'warning' => '40', 'major' => '60' } } } },
These are executed in the select order, and if no control is matched, then the default set is used.
Advanced Control Options
The following are the available control options
Node Properties
- $name
- $node
- $host
- $group
- $roleType
- $nodeModel
- $nodeType
- $nodeVendor
- $sysDescr
- $sysObjectName
Indexed Objects like interfaces
- $ifAlias
- $Description
- $ifDescr
- $ifType
- $ifSpeed
- $ifMaxOctets
- $maxBytes
- $maxPackets
$entPhysicalDescr
Newly added indexed objects in NMIS 8.6G
$hrStorageDescr
$hrStorageType
$hrStorageUnits (disk block size)
$hrStorageSize (disk size in blocks)
$hrStorageUsed (disk used in blocks)
$hrDiskSize (disk size in bytes, hrStorageSize * hrStorageUnits)
$hrDiskUsed (disk used in bytes, hrStorageUsed * hrStorageUnits)
$hrDiskFree (disk free in bytes)
Sample Controls
The controls are little pieces of code which will be evaluated when needed, so you might want to do the following sorts of things
Result | Control |
---|---|
Apply the threshold to all devices in the group "Sales" | $group eq "Sales" |
Apply the threshold to all devices starting with the IP address 192.168 | $host =~ /192\.168/ |
Apply the threshold to all Cisco IOS devices | $sysDescr =~ /Cisco IOS/ |
Use this threshold if the interface speed is between 1 and 5 megabits/second | $ifSpeed <= 5000000 and $ifSpeed >= 1000000 |
Use this threshold if the interface speed is 10 megabits | $ifSpeed == 10000000 |
Use this threshold if the interface speed is 100 megabits | $ifSpeed == 100000000 |
Use this threshold if the interface speed is 1 gigabits | $ifSpeed == 1000000000 |
Use this threshold if the disk is larger than 100 gigabytes | $hrDiskSize >= 104857600000 |
Threshold Dampening in NMIS
We have a feature in NMIS called threshold dampening, NMIS will only clear a threshold event when it passes the threshold + the dampening factor, this is configured with the configuration options threshold_rising_reset_dampening and threshold_falling_reset_dampening.
We added this feature because many times the threshold would drop a little, and clear the threshold, and then rise again, causing a new threshold event. So we provided an threshold clearing dampening factor to prevent the flaps.
There are two choices here, reduce the damping setting to a lower level, e.g. 1% which should be enough or disable the feature. You can edit this in the GUI it is in the section globals, or modify the Configuration directly nmis8/conf/Config.nmis
To reduce it to 1%, change the config values to be:
threshold_falling_reset_dampening = 1.01
threshold_rising_reset_dampening = 0.99
To disable it completely:
threshold_falling_reset_dampening = 1.0
threshold_rising_reset_dampening = 1.0