Novell Documentation: ZENworks 6.5 - Optimizing Traffic Analysis

Optimizing Traffic Analysis

The tools provided by Novell ZENworks Server Management to analyze your network performance have default settings. You can change the default settings of various views to display only the information you require.

The following sections provide information about how you can configure the Novell ZENworks Server Management tools to suit your networking environment:

Choosing Options to Display Stations on a Segment

You can configure the Stations view to display only the top 20 nodes or all nodes on the monitored segment. You can also choose the statistic based on which you want to display the top 20 nodes.

The following configuring options are available:

Displaying Statistics for All Nodes on a Segment

To display statistics for all nodes on a segment:

In Novell ConsoleOne, select a segment.
Click View > Stations.

To display all nodes on a segment, more time is required and more network traffic is generated.
From the Stations view, click View > Show All Stations.

Displaying Statistics for the Top 20 Nodes on a Segment

To display statistics for the top 20 nodes on a segment:

In Novell ConsoleOne, select a segment.
Click View > Stations.
From the Stations view, click View > Show Top N Stations.

Choosing a Statistic Based on Which Top 20 Nodes Are Displayed

Packets out per second is the default statistic based on which top 20 nodes are displayed in the Stations view. To choose a different statistic based on which you want the top 20 nodes to be displayed, do either of the following:

From the Stations view, click View, select Show Top N Stations, then choose a statistic from the list of statistics displayed.

Click the Top Nodes Statistics drop-down box in the toolbar of the Stations view, then choose a statistic from those displayed.

The available statistics are described in the following table.

Statistic	Explanation
Packets/s In	Packets per second received by a node
Packets/s Out	Packets per second transmitted by a node
Bytes/s In	Bytes per second received by a node
Bytes/s Out	Bytes per second transmitted by a node
Errors/s	Errors per second transmitted by a node
Broadcasts/s	Broadcast packets per second transmitted by a node
Multicasts/s	Multicast packets per second transmitted by a node (packets transmitted to a specific group of nodes)

If you close the Stations view after changing the default settings, you will be prompted to save the changes made to the default settings. If you want the Stations view to be displayed based on the statistic you chose, you can save the setting. The next time you open Novell ConsoleOne and launch the Stations view, you will be able to view the nodes on the monitored segment based on the statistic you specified.

Choosing Options to Display Trend Statistics

You can change the default settings based on which the segment performance trends are displayed in the Segment Trends view.

The following configuration options are available:

Choosing Statistics Based on Which Trend is Displayed

To change the statistics based on which segment performance trend is displayed:

Click the Profile button in the Segment Trends view.

Select a profile from the Select Profile list.

The default profile will display a trend with statistical information of total packets, good packets, and error packets on the monitored segment.

If you choose not to use the profiles listed in the Select Profile list, you can select the required statistics from the Select Statistics list.

The statistics list lets you examine the Ethernet, FDDI, and token ring statistics described in the following table.

Statistic	Media Support	Explanation
Abort Delimiter Errors/s	Token ring	Average number of abort delimiter errors observed per second. This error indicates that a node aborts a transmission.
AC Errors/s	Token ring	Average number of AC errors observed per second. This error is reported when an intended recipient of a packet fails to mark it as received or flags an error on it.
Beacons	FDDI and token ring	Average number of beacons per second observed in the sampling interval. A station transmits these packets when it detects a hard failure upstream.
Broadcast Packets/s	Ethernet, FDDI, token ring	Number of broadcast packets per second.
Burst Errors/s	Token ring	Average number of burst errors observed per second. This error indicates that a node detects the absence of transitions for the required time.
Claim Tokens/s	FDDI ring	Average number of times that the ring enters the claim token state from the normal ring state or ring purge state per second.
CRC/Alignment Errors/s	Ethernet and FDDI ring	Number of cyclic redundancy check (CRC)/alignment errors per second.
Echo Pkts/s	FDDI ring	Average number of echo frames received on the network per second.
Elasticity Buffer Errors/s	FDDI ring	Average number of elasticity buffer overflow errors reported by this station per second. This is due to the difference in the clock frequency between the transmitting and receiving stations.
Error Packets/s	Ethernet	Number of error packets per second.
Fragments/s	Ethernet	Number of fragments per second.
Frame Copied Errors/s	FDDI ring	Average number of frame copied error frames reported per second by the station.
Frequency Errors/s	Token ring	Average number of frequency errors observed per second. This error indicates that a token ring clock on a node differs too much from the clock on the active monitor.
Good Packets/s	Ethernet	Number of good packets per second.
Internal Errors/s	Token ring	Average number of internal errors observed per second. These errors generally indicate a network board failure.
Jabbers/s	Ethernet	Number of jabbers per second.
Line Errors/s	Token ring	Average number of line errors observed per second. These packets are of valid size but have a faulty Frame Check Sequence (FCS) and do not end on an 8-bit boundary.
Lost Frames/s	FDDI and token ring	Average number of lost frame errors on the network observed per second.
Monitor Contentions/s	Token ring	Average number of monitor contentions observed per second; these packets are transmitted by all active nodes when no active monitor is detected on the ring.
Multicast Packets/s	Ethernet, FDDI, and token ring	Number of multicast packets per second.
Oversize Packets/s	Ethernet	Number of oversize packets per second.
Packets	FDDI and token ring	Average number of packets observed per second in the sampling interval.
Receive Congestion Errors/s	Token ring	Average number of receive congestion errors observed per second. This error indicates that a node recognizes a frame addressed to its address, but has no available buffer space.
Ring Wraps/s	FDDI ring	Average number of times a wraparound condition has been detected at this interface per second. This entry does not indicate the number of times the ring has actually wrapped around. It only indicates the number of times the ring has wrapped around this physical path.
Token Errors/s	Token ring	Average number of token errors observed per second. This error indicates that a token is corrupted or the active monitor did not see a new frame in the required amount of time.
Total Bytes/s	Ethernet	Average number of total bytes per second.
Total Packets/s	Ethernet	Average number of total packets per second.
Undersize Packets/s	Ethernet	Number of undersize packets per second.
Unicast Packets/s	Ethernet	Number of unicast packets per second.
Utilization%	Ethernet, FDDI, and token ring	Percentage of maximum network capacity used by all packets in the sampling interval.

If you close the Segment Trends view after changing the default statistics based on which trend is displayed, you will be prompted to save the changes made to the default settings. If you want the segment performance trend to be displayed based on the profile or statistics you chose, you can save the settings that you define. The next time you open Novell ConsoleOne and launch the Segment Trends view, you will be able to view the trend based on the profile or statistics you defined.

Setting the Time-Scale Options

The segment performance trend is updated once every minute. You can set a different time scale based on which you want to update a graph. Select from the following time-scale options:

Real Time
One Hour
One Day
One Week
One Month
One Year

HINT: If you close the Segment Trends view after changing the default time-scale option based on which trend is displayed, you will be prompted to save the changes made to the default settings. If you do not want the trend to be updated in real time, you can save the time-scale setting you choose. The next time you open Novell ConsoleOne and launch the Segment Trends view, the trend will be updated based on the time-scale option you selected.

Choosing Options to Display the Top Nodes Graph

You can configure the Segment Dashboard view to display or disable the top nodes graph. For details, see Viewing the Graph of the Top Nodes on a Monitored Segment. The top nodes graph is displayed in the lower portion of the Segment Dashboard view. Packets out per second is the default statistic based on which the graph is displayed. You can choose a different statistic based on which you want the graph to be displayed.

The following configuring options are available:

Displaying the Top Nodes Graph in the Segment Dashboard View

To display the top nodes graph in the Segment Dashboard view:

From the Segment Dashboard view, click View > Show Top N Graph.

Choosing the Statistic Based on Which Top Nodes Graph Is Displayed

To display the top nodes graph based on a different statistic, do either of the following from the Segment Dashboard view:

Click View > Show Top N Graph, then choose a statistic.

Click the Top Nodes Statistics drop-down box in the toolbar of the Segment Dashboard view > select a statistic.

The statistics are described in the following table.

Statistic	Explanation
Broadcasts/min	Broadcast packets per minute transmitted by a node
Bytes/s in	Bytes per second received by a node
Bytes/s out	Bytes per second transmitted by a node
Errors/min	Errors per minute transmitted by a node
Packets/s in	Packets per second received by a node
Packets/s out	Packets per second transmitted by a node
Multicasts/min	Multicast packets per minute transmitted by a node

IMPORTANT: Errors per minute, broadcasts per minute, and multicasts per minute are updated every 60 seconds rather than every 5 seconds.

Disabling the Top Nodes Graph in the Segment Dashboard View

To disable the top nodes graph in the Segment Dashboard view:

From the Segment Dashboard view, click View > Disable Top N Graph.

Choosing Statistics to Display in the Unified Port Traffic View

Novell ZENworks Server Management provides statistics for each port on the switch. You can view port statistics and a list of nodes connected to each port using the Unified Port Traffic view. You can view Ethernet-specific statistics for Ethernet ports on a switch. Although statistics specific to FDDI and token ring ports will not be displayed with this version of Novell ZENworks Server Management, general port statistics are displayed for all ports on a switch regardless of the media type. For details, see Viewing Statistics for Ports in a Switch. You can choose to display only the selected statistics in the Unified Port Traffic view.

To select statistics to be displayed in the Unified Port Traffic view:

From the Unified Port Traffic view, click View > Settings.
Click the statistics from the Available Columns list > click Add.

The following table describes the general port statistics displayed for a port, regardless of the media type of the port.

Statistic	Explanation
Frames In/sec	Number of frames received by the port per second.
Frames Out/sec	Number of frames sent by port per second.
Port Link Status	Displays if the port is active or inactive. If the port is active, it can transmit and receive packets.
Speed	The speed at which packets are transmitted or received by the port.
Media Type	Media type of the selected port.
Local Traffic	Rate of traffic going towards nodes on the same port.

The following table describes the Ethernet-specific statistics displayed for an Ethernet port in addition to the general port statistics listed above.

Statistic	Explanation
Collisions/sec	Number of collisions per second
Utilization	Percentage of maximum network capacity currently consumed by packet traffic on the port
Broadcasts/sec	Number of broadcast packets per second currently received and sent by the port
Multicasts/sec	Multicast packets per second received and sent by the port
Packets/sec	Number of packets per second received and sent by the port
CRC Align Error	Total number of line errors reported by the port
Oversize Pkts	Number of oversize packets received and sent by the port

Choosing Options to Display a Captured Packet

Novell ZENworks Server Management provides default settings to display a captured packet in the Trace Display window.

To change the default settings and display the trace differently:

Open the Trace Display window.
From the Trace Display menu, click View > Options.
Select how you want to display the decoded packet.
- Full Protocol Decode: Provides information about each field in each protocol layer in a selected packet. This is the default decoding.
- One Line Per Protocol Layer: Provides a line of information for each protocol layer of a selected packet.
Select the level at which you want to display the initial highlight position.
- At Highest Protocol Layer: Places the initial highlighting at the highest protocol layer in a packet. This is the default.
- At Packet Header: Places the initial highlighting at the packet header.
Select the format in which you want to display the decoded packet.
- ASCII: Displays the hex data in ASCII format. This is the default.
- EBCDIC: Displays the hex data in EBCDIC format.

Configuring Alarm Options from the Set Alarm Dialog Box

Novell ZENworks Server Management provides default alarm threshold values for a segment. You can set threshold values for various error conditions on Ethernet, FDDI, and token ring segments to eliminate the need to constantly monitor the segments.

When a segment alarm is enabled, the RMON agent monitors the segment based on the alarm threshold settings. If the configured threshold value is exceeded, the RMON agent sends a trap to the management server, which forwards it to Novell ConsoleOne.

You should change the default values for alarm thresholds as appropriate for your organization. You can determine the appropriate value by observing average and peak traffic levels on your network using the Segment Trends view. For details, see Analyzing Trend Data for a Segment. You can do this as a part of creating a baseline of typical segment activity on your network.

To set an alarm threshold for a segment:

In Novell ConsoleOne, select a segment.
Click File > Properties > the Segment Alarms tab.
Select a segment statistic > click Edit.
Click Enable to enable the alarms set for the monitored segment.

When you click Enable, the text fields and the Default button will be enabled. However, if the default threshold values are not found, the Default button will not be enabled.
Enter the threshold value.
Specify the sampling time interval.

The RMON agent uses the sampling time interval to average the statistic to determine whether the alarm threshold was exceeded.

HINT: You can also use the Segment Dashboard view to define alarm threshold values for segment statistics. For details, see Defining Alarm Thresholds for Statistics Displayed in the Segment Dashboard View.

The following table describes the alarm statistics that Novell ZENworks Server Management tracks for Ethernet, FDDI, and token ring segments.

Statistic	Media Support	Explanation
Abort Errors	Token ring	Average number of abort errors observed per second in the sampling interval. These errors resemble line errors, but occur in the middle of a transmission.
AC Errors	Token ring	Average number of Address Recognition (and Frame Copied) errors observed per second in the sampling interval. This error is reported when an intended recipient of a packet fails to mark it as received or flags an error on it.
Beacons	FDDI and token ring	Average number of beacons per second observed in the sampling interval. A station transmits these packets when it detects a hard failure upstream.
Broadcasts	Ethernet, FDDI, and token ring	Average number of packets per second sent to the broadcast address FF-FF-FF-FF-FF-FF. Broadcast messages typically consist of general requests for information or transmission of status information to all stations.
Burst Errors	Token ring	Average number of burst errors observed per second in the sampling interval. A burst error is caused by a lack of signal transitions between stations for a short period of time.
Claim Tokens	FDDI ring	Average number of times that the ring enters the claim token state from the normal ring state or ring purge state per second.
Congestion Errors	Token ring	Average number of congestion errors observed per second in the sampling interval. The receiving station runs out of buffer space to store the packet.
CRC Errors	Ethernet and FDDI ring	Average number of CRC errors observed per second in the sampling interval. These packets are of valid size but have a faulty FCS.
Echo Pkts	FDDI ring	Average number of echo frames received on the network per second.
Elasticity Buffer Errors/s	FDDI ring	Average number of elasticity buffer overflow errors reported per second by this station. This is due to the difference in the clock frequency of the transmitting and receiving stations.
Fragments	Ethernet	Average number of fragments observed per second in the sampling interval. Fragments are packets that contain fewer than 64 bytes and have a faulty FCS. They are typically a result of collisions.
Frame Copied Errors	FDDI and Token ring	Average number of frame copied errors observed per second in the sampling interval. This error indicates that a station has detected that another station accepted a packet addressed to the first station.
Frequency Errors	Token ring	Average number of frequency errors observed per second in the sampling interval. This error indicates that a token ring clock on a station differs from the clock on the active monitor.
Internal Errors	Token ring	Average number of internal errors observed per second in the sampling interval. These errors generally indicate a network adapter board failure.
Jabbers	Ethernet	Average number of jabber packets observed per second in the sampling interval. A jabber consists of packets that contain more than 1518 bytes and have a faulty FCS.
Line Errors	Token ring	Average number of line errors observed per second in the sampling interval. These packets are of legal size but have a faulty FCS and do not end on an 8-bit boundary.
Lost Frames	FDDI and token ring	Total number of lost frame errors received on the network. A lost frame error indicates that the end delimiter of a frame is lost in the network.
Monitor Contentions	Token ring	Average number of monitor contentions observed per second in the sampling interval. These packets are transmitted when no active monitor is detected on the ring.
Multicasts	Ethernet, FDDI, and token ring	Average number of packets per second sent to multicast addresses.
Oversize	Ethernet	Average number of oversized packets observed per second in the sampling interval. Oversized packets contain more than 1518 bytes, including the FCS.
Packets	Ethernet, FDDI, and token ring	Total number of packets observed per second in the sampling interval.
Ring Wraps/s	FDDI ring	Average number of times a wraparound condition has been detected at this interface per second. This entry does not indicate the number of times that the ring has actually wrapped around. It only indicates the number of times the ring has wrapped around this physical path.
Token Errors	Token ring	Average number of token errors observed per second in the sampling interval. This error indicates that a token is corrupted or the active monitor did not detect a new frame transmitted during the current sampling interval.
Undersize	Ethernet	Average number of undersized packets observed per second in the sampling interval. Undersized errors are shorter than 64 bytes.
Utilization(%)	Ethernet, FDDI, and token ring	Percentage of maximum network capacity used by all packets in the sampling interval.

When you have set the appropriate threshold values for the segments in your network, you can use the Save As Default button on the Segment Alarms property page to save the values you defined as the default values. However, the default threshold values provided by Novell ZENworks Server Management will not be available after you apply the new values.

Configuring the Monitor Nodes for Inactivity View

By default, the poll interval for refreshing the Monitor Nodes for Inactivity view is zero seconds. You can configure the poll interval based on which you want the view to be refreshed. The agent monitoring nodes on a monitored segment declares a node as inactive after verifying it for a specified period of time. You can change the time duration for the agent to verify the node before declaring it inactive.

The following configuring options are available:

Specifying the Poll Interval for Refreshing the Monitor Nodes for Inactivity View

You can modify the PollInterval parameter in the lsmparameters.properties file to specify the poll interval for refreshing the Monitor Nodes for Inactivity view.

To specify a poll interval for refreshing the Monitor Nodes for Inactivity view:

Open the lsmparameters.properties file located in the operating_system_drive\install\novell consoleone\bin directory.
Specify a value for the PollInterval parameter.

The PollInterval value should be a positive value, in seconds. The default value is zero (0) seconds.

Specifying the Duration for the Agent to Determine if a Node Is Inactive

When a selected node becomes inactive, the agent monitoring the node verifies the state of the node for one minute before declaring it inactive. You can modify the HostTimeOut parameter in the lsmparameters.properties file to change the duration for the agent to verify the selected node before declaring it inactive. The agent verifies the inactive node for the specified period of time before declaring it inactive.

To change the duration for the agent to verify a node before declaring it inactive:

Open the lsmparameters.properties file located in the operating_system_drive\install\novell consoleone\bin directory.
Specify a value for the HostTimeOut parameter.

The HostTimeOut value should be a positive value, in minutes. The default value is one (1) minute.