Technical Clarification on High Utilization Alarm Behavior for AggregatePort and AggregateLink Interfaces

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

• You need explicit technical clarification regarding how the SMARTS topology model handles High Utilization threshold evaluation and alarm generation for logical bundle interfaces and their underlying physical member links. Specifically, seeking details on the behavior of the AggregatePort and AggregateLink classes during topology post-processing and alarm generation.

• You need confirmation regarding the following questions:

  • High Utilization on Individual Physical Member Links

    • If a High Utilization threshold (for example, 90%) is exceeded on an individual physical constituent interface within a link aggregation group due to traffic hashing or uneven load distribution, while the cumulative utilization on the parent AggregatePort remains below the configured threshold:

      • Does SMARTS generate a High Utilization alarm for the individual physical interface?

         

      • Is the physical member link evaluated independently of the parent AggregatePort for utilization threshold monitoring?

         

      • Are there any topology correlation or suppression rules that affect alarm generation in this scenario?

 

• • High Utilization on the AggregatePort

    • If the total cumulative throughput across all member links exceeds the configured threshold on the parent AggregatePort:

      • Does SMARTS generate a distinct High Utilization alarm for the AggregatePort object itself?

         

      • If one or more underlying physical member interfaces are also above the threshold, will SMARTS generate concurrent alarms for both the AggregatePort and the individual physical interfaces?

         

      • Is any suppression or correlation applied between the AggregatePort and AggregateLink objects?

Environment

All supported releases of Smarts

Resolution

• AggregatePort index is also a part of IF-MIB, These indexes are specifically categorised as AggregatePort or AggregateInterface only based on the LAG MIB details.

• Below OID does expose the if-Index that is taking part in the LAG configuration, Based on this exposure, Smarts does creates those indexes as AggregatePort or AggregateInterface:

  • dot3adAggMACAddress          {".1.2.840.10006.300.43.1.1.1.1.2"}

• The underlying physical interfaces/ports are also associated based on the same LAG/LACP details retrieved from the MIB.

• So essentially, AggregatePort will have composedOf-> Ports.

• At this juncture, both Ports and AggregatePorts will be unmanaged since there is no connection detected.

• Once the connections is detected at the physical layer (via the ports), then Cable/TrunkCalbles will be created at the port level (via connectedVia relationship), this can be based on CDP / LLDP /LACP based connectivity.

• These connectedPorts will be managed for both Fault and Performance (current Utilization), this currentUtilization crossing the Threshold will lead to HighUtilization event at the port level (physical).

• When LACP does expose the Aggregation connectivity with the connected device, then AggregateLink will be created between the AggregatePorts followed by the respective connected AggregatePorts being managed. Now, we have AggregatePorts having connectedVia Aggregatelink connection which is managed followed by the underlying ports having connectedVia relation and both will be managed for fault and performance.

• The high Utilization event will be generated for every index (that includes at the port level as well as at the Aggregateport level).

• There is no correlation between these entities when raising the high utilization events.

• Topology: How a LAG is built: Discovery rule ic-lag-dot3ad.asl creates each AggregatePort and wires member ports in via ComposedOf. Companion rule ic-post-lag.asl then creates the AggregateLink between the two peer AggregatePorts, and bundles the physical cables underneath it into the AggregateLink's own ComposedOf set. 
  

 

• Utilization computation — Port vs. AggregatePort: Both layers use the same formula, but each polls its own SNMP counters independently — the AggregatePort's utilization is not a sum/average of member port traffic. Only the bandwidth denominator (MaxSpeed) is derived bottom-up from active members.