Hyper monitoring

jprinz

So, I don't profess to be any sort of network God, I can barely spell tcp/ip so please excuse the relatively basic and high level question here about extensively monitoring a circuit on a remote site.  We have been experiencing short periods of downtime on this internet/vpn connected site which has caused some pretty expensive disruption.  While we have a failover path over wireless, it takes a little time to decide to do just that and in the mean time we have angry customers who cannot make purchases and can easily go elsewhere next time around.

So this my question; we monitor the ISP's gateway via ICMP and our firewall via SNMP, as well as our switch and other hosts inside the vpn but the quickest I can ask NPM to poll is 10 seconds.  What if we have 9 seconds of downtime for whatever reason? Is that not important? Can I somehow use snmp to see within a device at a more granular level?  FWIW our firewalls at the site which support the VPN or fortinet devices..  Ive looked at the snmp data but it doesn't seem to be any more granular.

Anyone else need to do this?

Any advise would be very helpful.

tallyrich

That's a firm "it depends" SNMP will poll the device on whatever it can provide. Some devices poll more frequently than others. So the best answer will be to do a mib walk on the device in question and see what it offers.

Just for example, I've seen devices that report CPU performance per second, per minute and then I've seen some that report on an average i.e. the last 5 minute average, last 30 minute average, etc.

The other thing to keep in mind about polling is that when you set up your alerting you need to keep the timing in mind To use your number as an example if you say to alert if polling is down for 1 poll interval then you could see frequent alerts if the line fails to respond frequently. If however you decide that it should not alert every time and instead only if the device fails to respond 3 times then you could potentially be down for around 30 seconds. A key element of SNMP (on any network) is that it is generally considered a low priority so if more important traffic is taking the bandwidth then SNMP will be one of the first to drop. So if you alert on every missed poll then a heavily utilized line or device will give a lot of false positives.