Advanced Cisco IOS

Data Collection

BRKDEV-1171

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 2

© 2006, Cisco Systems, Inc. All rights reserved. 1

Presentation_ID.scr
 Agenda

ƒ Current Data Collection Solution

ƒ Cisco Data Collection Services Components
ƒ Putting the Pieces Together
ƒ Benefit Summary
ƒ Q&A

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 3

Why Do We Care About Data Collection

Data Powers Your Operations

Long-Term Planning

Troubleshooting Monitoring

DATA
DATA

Reporting

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 4

© 2006, Cisco Systems, Inc. All rights reserved. 2

Presentation_ID.scr
 Typical Current Solution

ƒ Use SNMP to polling data

Periodic polling

ƒ External application controls

What to collect
How often/when to collect
All data processing of collected data

ƒ NMS/device—master/slave
ƒ Constant struggles between higher data granularity
and resource impacts

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 5

SNMP Data Collection

Periodic SNMP Polling

NMS
SNMP

SNMP

SNMP
SNMP

Device

SNMP Processing Data Access

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 6

© 2006, Cisco Systems, Inc. All rights reserved. 3

Presentation_ID.scr
 Sometimes …
Periodic SNMP Polling

NMS SNMP

SNMP

SNMP retry

SNMP
SNMP

Device

SNMP Processing Data Access

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 7

Still Sometimes …
Periodic SNMP Polling

Data is declared
Not available
NMS
SNMP

SNMP

SNMP retry
SNMP retry
SNMP retry
SNMP

Device

SNMP Processing Data Access

P.S. It only happens during the most inopportune time.

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 8

© 2006, Cisco Systems, Inc. All rights reserved. 4

Presentation_ID.scr
 Some Drawbacks of SNMP
Pulling Mechanism

ƒ Inefficient
NMS makes exactly the same requests periodically – device and
network resource impact
Data is processed (and mostly thrown away later) at NMS

ƒ Unreliable transfer/data availability

Based on UDP
Data collection depends on management link

ƒ Difficult to correlate data cross-devices

Usually round robin polling—network is not sampled at the same
time

The Device Is Assumed to Be a Dumb Box!

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 9

Why do We Poll Periodically?

ƒ Provides historical context for reporting and problem

analysis
If data is not polled, it would be overwritten
If data is not transferred, it would be lost

ƒ Polling allows timely and meaningful problem

identification
Threshold crossing alerts

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 10

© 2006, Cisco Systems, Inc. All rights reserved. 5

Presentation_ID.scr
 Data Collection Requirements
Building an efficient data collection solution

Provide historical context for reporting and problem

analysis
Allow timely and meaningful problem identification
Efficient
Reliable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 11

IOS Data Collection Agent

ƒ An embedded intelligent agent to provide an efficient

and reliable data collection service
ƒ User configure once, collect and transfer automatically
What to collect
When and how often to collect
Export URL to send data
Export Interval

ƒ Configured via CISCO-DATA-COLLECTION-MIB or CLI

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 12

© 2006, Cisco Systems, Inc. All rights reserved. 6

Presentation_ID.scr
 Advanced Data Collection
Cisco IOS Data Collection Agent

Key Benefits
ƒ Eliminates inefficient periodic
SNMP polling
Configure Once
CLI or Data Collection MIB Transfer ƒ Higher data availability—data
Periodically
and Reliably
collection continues even if the
management interface is
inaccessible
IOS
Data Collection ƒ More reliable and secure data
Agent
Collect
export with Secure Copy (SCP)
Periodically Store Locally
ƒ Allows time-synchronized data
collection for more accuracy
MIBs Memory
cross device analysis

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 13

Advanced Data Collection (Cont.)

Cisco IOS Data Collection Agent

NMS
SNMP

SNMP

Device

Config Mem

SNMP Processing Data Access

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 14

© 2006, Cisco Systems, Inc. All rights reserved. 7

Presentation_ID.scr
 Data Collection Agent
Example—Monitoring Memory Usage
Defines What to Collect:
snmp mib bulkstat object-list devHealth Collects Free Memory, Used
add 1.3.6.1.4.1.9.9.221.1.1.1.1.7 (memory used) Memory. The Agent Also
add 1.3.6.1.4.1.9.9.221.1.1.1.1.8 (memory free) Collects CPU Utilization by
Default

snmp mib bulkstat schema devHealth-schema How to Collect

object-list devHealth Collects Every 5 Minutes, for All
polling-interval 5 Memory Usage
instance wildcard oid 1
How to Store and Transfer
snmp mib bulkstat transfer dataCol Sets up Where to Send to and
schema devHealth-schema Transfer Every One Hour. The
url primary tftp://200.100.100.1/nms/dataCol Data Is Kept in Router an
format schemaASCII Additional 30 Minutes After
transfer-interval 20 Transfer
retain 30
enable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 15

Data Collection Agent

Output Data File
Schema-def devHealth-schema "%u, %s ,%u, %u, "
epochtime instanceOID 1.3.6.1.4.1.9.9.221.1.1.1.1.7 1.3.6.1.4.1.9.9.221.1.1.1.1.8
Schema-def GLOBAL "%s, %s, %u, %u, %u, %u, %u" File Heading
hostname date timeofday sysuptime cpu5min cpu1min cpu5sec Timestamp, memory utilization
devHealth-schema: 1209392684, .9.2, 446944, 33107488 The global default also collects
devHealth-schema: 1209392684, .9.3, 2852256, 30702176 CPU utilization
devHealth-schema: 1209392684, .9.4, 5100, 118221408
devHealth-schema: 1209392684, .9.1, 34112488, 117658400
devHealth-schema: 1209392984, .9.2, 446944, 33107488
Actual Data
devHealth-schema: 1209392984, .9.3, 2852256, 30702176
Four different types of memory
devHealth-schema: 1209392984, .9.4, 5100, 118221408
(result of the wildcard)
devHealth-schema: 1209392984, .9.1, 34122540, 117788500
devHealth-schema: 1209393284, .9.2, 446944, 33107488
devHealth-schema: 1209393284, .9.3, 2852256, 30702176
devHealth-schema: 1209393284, .9.4, 5100, 118221408
devHealth-schema: 1209393284, .9.1, 33992440, 117788500
devHealth-schema: 1209393584, .9.2, 446944, 33107488
devHealth-schema: 1209393584, .9.3, 2852256, 30702176
devHealth-schema: 1209393584, .9.4, 5100, 118221408
devHealth-schema: 1209393584, .9.1, 34122540, 117788500
Global Default
Global: 7200-12-7, 20080428, 142524, 1133, 13%, 12%, 10%
CPU Utilizations

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 16

© 2006, Cisco Systems, Inc. All rights reserved. 8

Presentation_ID.scr
 Data Collection Requirements
Building an efficient data collection solution

Provide historical context for reporting and problem

analysis
Allow timely and meaningful problem identification
Efficient
Reliable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 17

Event MIB

ƒ Allows in-device monitoring of changing network

conditions
Threshold crossing alerts
Monitoring Boolean parameters

ƒ IETF Event MIB (RFC 2981)

Provides superset of RMON (RFC 1757) for event/alarm
handling capabilities

ƒ Monitor capabilities
Any MIB OID existence
Any MIB OID integer/counters (Booleans and thresholds)
Allows wildcarding
BRKDEV_1171
Can set a MIB object upon a trigger
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 18

© 2006, Cisco Systems, Inc. All rights reserved. 9

Presentation_ID.scr
 Event MIB Example
Monitor CPU Utilization

CPU Util <

> 70%
90%

NMS
SNMP
Agent

Look at CPU Utilization

(CISCO-PROCESS-MIB)

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 19

Data Collection Requirements

Building an efficient data collection solution

Provides historical context for reporting and problem

analysis
Allow timely and meaningful problem identification
Efficient
Reliable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 20

© 2006, Cisco Systems, Inc. All rights reserved. 10

Presentation_ID.scr
 Expression MIB

ƒ Allows one to define new SNMP objects based upon

existing MIB OIDs and arithmetic formulas
Supports wildcards and delta
Transforms raw data into meaningful parameters

ƒ IETF Expression MIB (RFC 2982)

ƒ Very powerful feature especially when combined with
Event MIB

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 21

Data Collection Requirements

Building an efficient data collection solution

Provides historical context for reporting and problem

analysis
Allow timely and meaningful problem identification
Efficient
Reliable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 22

© 2006, Cisco Systems, Inc. All rights reserved. 11

Presentation_ID.scr
 Putting the Pieces Together
Traps FTP

IOS

Event
MIB Data Collection
Agent
Expression
MIB

Memory

Data

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 23

Data Collection Example

Monitoring Link Utilization

ƒ Define an expression to monitor link utilization for

physical interfaces
snmp mib expression owner pcn name exp5
expression $1 == 1
enable
object 1 Checking for physical interfaces only
id ifConnectorPresent
wildcard
snmp mib expression owner pcn name exp6
delta interval 120
expression (($1+$2)/($3/100))*800/$4
enable
object 1
id ifInOctets Link utilization =
wildcard (∆ifInOctets + ∆ifOutOctets) * 8* 100 / ifSpeed / ∆Time
sample delta
conditional object expValueCounter32Val.3.c.p.n.4.e.x.p.5 wildcard
object 2
id ifOutOctets
wildcard
sample delta
object 3
id sysUpTime.0
sample delta
object 4
id ifSpeed
BRKDEV_1171
wildcard
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 24

© 2006, Cisco Systems, Inc. All rights reserved. 12

Presentation_ID.scr
 Data Collection Example (Cont.)
Monitoring Link Utilization

ƒ Set up triggers for notifications

snmp mib event owner pcn name over70
enable
action notification

snmp mib event owner pcn name under50

enable
action notification

snmp mib event trigger pcn admin name trigger1

frequency 120
enable Monitors link utilization every 2 minutes with:
test threshold rising threshold = 70%
rising 70 falling threshold = 50%
falling 50
rising event owner pcn name over70
falling event owner pcn name under50
object id expValueCounter32Val.3.p.c.n..4.e.x.p.6
wildcard

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 25

Data Collection Example (Cont.)

Monitoring Link Utilization

ƒ Set up Data Collect Agent to collect data

Collects link utilization every 2 Minutes
snmp mib bulkstat object-list ifutil Transfer data to NMS every 10 minutes
add expValueCounter32Val Keep data in memory for 30 minutes
snmp mib bulkstat schema ifutil-schema
object-list ifutil
poll-interval 2
instance range start 3.p.c.n.4.e.x.p.6.0.0.1 end 3.p.c.n.4.e.x.p.6.0.0.4
snmp mib bulkstat transfer bulkstat1
schema ifutil-schema
url primary tftp://200.100.100.1/pcn/bulkstat1
format schemaASCII
transfer-interval 10
retain 30
enable

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 26

© 2006, Cisco Systems, Inc. All rights reserved. 13

Presentation_ID.scr
 Data Collection Example (Cont.)
Monitoring Link Utilization

ƒ Threshold crossing alerts—rising

Received SNMPv2c Trap:
Community: public
From: 9.28.12.7
sysUpTimeInstance = 349818
snmpTrapOID.0 = mteTriggerRising
mteHotTrigger.0 = trigger1
mteHotTargetName.0 =
mteHotContextName.0 =
mteHotOID.0 = expValueCounter32Val.3.112.99.110.4.101.120.112.54.0.0.6
mteHotValue.0 = 73

ƒ Threshold crossing alerts—falling

Received SNMPv2c Trap:
Community: public
From: 9.28.12.7
sysUpTimeInstance = 385823
snmpTrapOID.0 = mteTriggerFalling
mteHotTrigger.0 = trigger1
mteHotTargetName.0 =
mteHotContextName.0 =
mteHotOID.0 = expValueCounter32Val.3.112.99.110.4.101.120.112.54.0.0.6
mteHotValue.0 = 48

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 27

Data Collection Example (Cont.)

Monitoring Link Utilization

ƒ Data Collection File Output

Schema-def ifutil-schema "%u, %s ,%u"
epochtime instanceOID mib-2.90.1.3.1.1.2
Schema-def GLOBAL "%s, %s, %u, %u, %u, %u, %u"
hostname date timeofday sysuptime cpu5min cpu1min cpu5sec
ifutil-schema: 1193173162, .3.112.99.110.4.101.120.112.54.0.0.1, 12
ifutil-schema: 1193173162, .3.112.99.110.4.101.120.112.54.0.0.2, 19
ifutil-schema: 1193173162, .3.112.99.110.4.101.120.112.54.0.0.3, 34
ifutil-schema: 1193173162, .3.112.99.110.4.101.120.112.54.0.0.4, 61
ifutil-schema: 1193173282, .3.112.99.110.4.101.120.112.54.0.0.1, 10
ifutil-schema: 1193173282, .3.112.99.110.4.101.120.112.54.0.0.2, 19
ifutil-schema: 1193173282, .3.112.99.110.4.101.120.112.54.0.0.3, 33
ifutil-schema: 1193173282, .3.112.99.110.4.101.120.112.54.0.0.4, 73
Rising threshold
ifutil-schema: 1193173402, .3.112.99.110.4.101.120.112.54.0.0.1, 12
ifutil-schema: 1193173402, .3.112.99.110.4.101.120.112.54.0.0.2, 19
ifutil-schema: 1193173402, .3.112.99.110.4.101.120.112.54.0.0.3, 34
ifutil-schema: 1193173402, .3.112.99.110.4.101.120.112.54.0.0.4, 55
ifutil-schema: 1193173522, .3.112.99.110.4.101.120.112.54.0.0.1, 10
ifutil-schema: 1193173522, .3.112.99.110.4.101.120.112.54.0.0.2, 19
ifutil-schema: 1193173522, .3.112.99.110.4.101.120.112.54.0.0.3, 33
ifutil-schema: 1193173522, .3.112.99.110.4.101.120.112.54.0.0.6, 48
ifutil-schema: 1193173642, .3.112.99.110.4.101.120.112.54.0.0.1, 10 Falling threshold
ifutil-schema: 1193173642, .3.112.99.110.4.101.120.112.54.0.0.2, 19
ifutil-schema: 1193173642, .3.112.99.110.4.101.120.112.54.0.0.3, 33
ifutil-schema: 1193173642, .3.112.99.110.4.101.120.112.54.0.0.6, 57
Global: 7200-12-5, 20071023, 210110, 3685, 19%, 25%, 25%
BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 28

© 2006, Cisco Systems, Inc. All rights reserved. 14

Presentation_ID.scr
 Benefit Summary

ƒ Higher scalability with distributed data collection and

processing
ƒ Highly Efficient
Eliminates costly periodic SNMP polling
Reduces unnecessary data collection

ƒ Higher data availability

Continues to collect even if the management interface is
unavailable

ƒ Detects problem more reliably and quickly

ƒ Allows more accurate data correlation

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 29

Additional Information

ƒ Data Collection Agent

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/gdata
col.html

ƒ Event MIB
http://tools.ietf.org/html/rfc2981
http://www.cisco.com/en/US/docs/ios/12_1t/12_1t3/feature/guid
e/dtevent.html

ƒ Expression MIB
http://tools.ietf.org/html/rfc2982
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_con
figuration_example09186a008023267a.shtml

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 30

© 2006, Cisco Systems, Inc. All rights reserved. 15

Presentation_ID.scr
 Q and A

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 31

Recommended Reading

ƒ Continue your Cisco Live

learning experience with further
reading from Cisco Press
ƒ Check the Recommended
Reading flyer for suggested
books

Available Onsite at the Cisco Company Store

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 32

© 2006, Cisco Systems, Inc. All rights reserved. 16

Presentation_ID.scr
 Complete Your Online
Session Evaluation
ƒ Give us your feedback and you could win Don’t forget to activate
fabulous prizes. Winners announced daily. your Cisco Live virtual
account for access to
ƒ Receive 20 Passport points for each session all session material
evaluation you complete. on-demand and return
for our live virtual event
ƒ Complete your session evaluation online now in October 2008.
(open a browser through our wireless network Go to the Collaboration
to access our portal) or visit one of the Internet Zone in World of
stations throughout the Convention Center. Solutions or visit
www.cisco-live.com.

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 33

BRKDEV_1171
14590_05_2008_c1 © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 34

© 2006, Cisco Systems, Inc. All rights reserved. 17

Presentation_ID.scr