Configuring RMON

Enable RMON1 and RMON2 globally, and configure RMON1 alarms, events, history, statistics, and whether port utilization is calculated in half or full duplex. By default, RMON1 and RMON2 are disabled globally.

For RMON1, you enable RMON globally, and then you can use RMON1 alarm, history, events, and statistics for the MAC layer in the network. You cannot use RMON1 history or statistics for application and network layer protocols.

For RMON2, you enable RMON globally, and then you enable RMON on the host interfaces you want to monitor.

Procedure

  1. Enter Global Configuration mode:

    enable

    configure terminal

  2. Enable RMON1 and RMON2 globally:

    rmon

  3. Configure an RMON1 alarm:

    rmon alarm <1-65535> WORD <1-1536> <1-3600> {absolute|delta} [falling-threshold <-2147483647-2147483647> event <1-65535>] [owner WORD<1–127>] [rising-threshold <–2147483647-2147483647> event <1-65535>]

  4. Configure an RMON1 event:

    rmon event <1-65535> [community WORD<1-127>] [description WORD<0-127>] [log] [owner WORD<1-127>] [trap] [trap_dest [{A.B.C.D}]] [trap_src [{A.B.C.D}]]

  5. Configure RMON1 history:

    rmon history <1-65535> {slot/port [/sub-port][-slot/port[/sub-port][,...]}[buckets <1–65535>][interval <1–3600>][owner WORD<1–127>]

  6. Configure RMON1 statistics:

    rmon stats <1-65535> {slot/port [/sub-port][-slot/port[/sub-port][,...]} [owner <1–127>]

  7. Configure whether the system calculates port utilization in half or full duplex:

    rmon util-method [half|full]

Example

Configure RMON globally, an RMON1 alarm, and RMON1 event:

Switch:1>enable
Switch:1#configure terminal
Switch:1(config)#rmon
Switch:1(config)#rmon event 60534 community public description "Rising Event" log trap
Switch:1(config)#rmon alarm 4 rcCliNumAccessViolations.0 10 absolute rising-threshold 2 event 60000

Variable Definitions

Use the data in this table to use the rmon command.

Variable

Value

alarm <1-65535> WORD <1-1536> <1-3600> {absolute|delta} [falling-threshold <-2147483647-2147483647> event <1-65535> ] [owner WORD<1-127> ] [rising-threshold <–2147483647-2147483647> event <1-65535>]

Creates an alarm interface.

  • <1-65535>— Specifies the interface index number from 1 to 65535. Each entry defines a diagnostics sample at a particular interval for an object on the device. The default is 1.

  • WORD <1-1536>— Specifies the variable name or OID. The entry is case sensitive and can have a string length of 1 to 1536.

  • {absolute | delta} — Specifies the sample type.

  • rising-threshold <-2147483648-2147483647> [<event:1-65535>] — Specifies the rising threshold from -2147483648 to 2147483647, which is a threshold for the sampled statistic. After the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, the system generates a single event. The system also generates a single event if the first sample after this entry that becomes valid is greater than or equal to the rising alarm, or the rising or falling alarm. After the system generates a rising event, the system does not generate another such event until the sampled value falls below this threshold and reaches the alarm falling threshold. You cannot modify this object if the associated alarm status is equal to valid.

    <1-65535>— Specifies the rising event index, which the system uses after the system crosses a rising threshold. The event entry identified by a particular value of this index is the same as identified by the same value of the event index object. If no corresponding entry exists in the event table, no association exists. In particular, if this value is zero, the system does not generate an associated event, as zero is not a valid event index. You cannot modify this object if the associated alarm status is equal to valid.

  • falling-threshold <-2147483648-2147483647> [<event:1-65535>] — Specifies the falling threshold from -2147483648 to 2147483647, which specifies a threshold for the sampled statistic. If the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, the system generates a single event. The system also generates a single event if the first sample after this entry that becomes valid is less than or equal to this threshold and the associated alarm startup alarm is equal to falling alarm or rising or falling alarm. After the system generates a falling event, the system does not generate another such event until the sampled value rises above this threshold, and reaches the alarm rising threshold. You cannot modify this object if the associated alarm status is equal to valid.

    <1-65535> – Specifies the index of the event entry that the system uses after a falling threshold is crossed. The event entry identified by a particular value of this index is the same as identified by the same value of the event index object. If no corresponding entry in the event table exists, no association exists. In particular, if this value is zero, the system does not generate an event, as zero is not a valid event index. You cannot modify this object if the associated alarm status is equal to valid. The default is 60535.

  • owner WORD<1-127> — Specifies the name of the owner, with a string length 1 to 127.

Use the default operator to reset the RMON alarms to their default configuration: default rmon alarm <65535>
Note:

When configuring from CLI, the default owner is cli; when configuring with SNMP, the default owner is snmp. The default command only sets the owner to default. No other parameters can be changed after you create the alarm.

Use the no operator to disable RMON alarms: no rmon alarm [<1-65535>]

event <1-65535> [community WORD<1-127>] [description WORD<0-127>] [log] [owner WORD<1-127> ] [trap]

Create an event.

  • <1-65535>— Specifies the event index number. Each entry defines one event that the system generates after the appropriate conditions occur. The default is 1.

  • log — Specifies if this event stores a log when the event is triggered by the alarm.

  • trap — Specifies if this event sends a trap when the event is triggered by the alarm. The trap will be sent to all the snmp-server hosts configured in the snmp table.

  • description WORD<0-127>— Specifies the event description, with a string length of 0 to 127.

  • owner WORD<1-127> — Specifies the name of the owner, with a string length of 1 to 127.

  • community WORD<1-127> — Specifies the SNMP community where you can send SNMP traps, with a string length 1 to 127.

    You can set the community, but the trap is not filtered out. The trap is sent to all configured snmp-server hosts, regardless of the value of this field.

Use the no operator to delete a RMON event: no rmon event [<1-65535>] [log]

history <1-65535> {slot/port [/sub-port][-slot/port[/sub-port][,...]}[buckets <1–65535>][interval <1–3600>][owner WORD<1–127>]

Configures RMON history.

  • <1-65535> — Specifies the history index number that uniquely identifies an entry in the history control table. Each entry defines a set of samples at a particular interval for an interface on the default. The default value is 1.

  • {slot/port [/sub-port][-slot/port[/sub-port][,...]} — Specifies the single port interface. Identifies the source for which the system collects and places historical data in a media-specific table on behalf of this history control entry. The source is an interface on this device. The statistics in this group reflect all packets on the local network segment that attaches to the identified interface.

  • buckets <1–65535>— Specifies the requested number of discrete time intervals where the system saves data in the part of the media-specific table associated with this history control entry. The default value is 50.

  • interval <1–3600>— Specifies the time interval in seconds over which the system samples the data for each bucket in the part of the media-specific table associated with this history control entry. Because the counters in a bucket can overflow at their maximum value with no indication, you must take into account the possibility of overflow in all the associated counters. Consider the minimum time in which a counter can overflow on a particular media type, and then set the history control interval to a value less than this interval, which is typically most important for the octets counter in a media-specific table. The default value is 1800.

  • owner WORD<1–127>— Specifies the name of the owner.

stats <1-65535> {slot/port [/sub-port][-slot/port[/sub-port][,...]} owner WORD<1–127>

Configures RMON statistics.

  • <1-65535>— Specifies the control Ether statistics entry index number.

  • {slot/port [/sub-port][-slot/port[/sub-port][,...]}— Specifies the single port interface.

  • owner WORD<1–127> — Specifies the name of the owner.

Use the no operator to delete a RMON Ether stats control interface: no rmon stats[<1-65535>]

util-method [half|full]

Configures whether port utilization is calculated in half or full duplex to calculate port usage.

  • half—Configures the string to half duplex.

  • full—Configures the string to full duplex.

After you select half for half duplex, RMON uses InOctets and the speed of the port to calculate port usage (this is the standard RMON RFC 1271 convention). After you select full for full duplex, RMON uses InOctets and OutOctets, and 2X the speed of the port to calculate port usage. If you select full, but the port operates in half-duplex mode, the calculation defaults to the RFC1271 convention. The default is half.
9037147-00 Rev AB