Alerting on utilization threshold violations in ReporterAnalyzer

Products

• CA Application Delivery Analysis MTP (NetQoS / ADA)
• CA Infrastructure Performance

Issue/Introduction

Description:

This article discusses how to set up e-mail notifications based on interface utilization thresholds in ReporterAnalyzer.

Typically, customers should use NetVoyant for threshold alerting, but in the event they don't have NetVoyant, here's how you can do it with ReporterAnalyzer. NOTE: This type of configuration isn't a support task.

Solution:

Prerequisites

• ReporterAnalyzer 8.3+
  
  
• NPC 6
  
  
• EventManager 2.0+
  
  
• An SMTP server

Steps

ReporterAnalyzer

First, configure RA to send traps whenever a threshold is crossed. This is done in the webpage.

1. In RA 8.3, go to Administration -> Traps (under Analysis). In RA 9, go to Administration -> Alerts.
   
   
2. Click "Add" under Trap Definitions.
   
   
3. Give a Description, select an interface or group, pick the levels to alert on, and select a protocol. A decent general threshold is as follows:
   
   
   • Description: Interface Above 70% utilization
     
     
   • Interface Group: All Interfaces
     
     
   • Thresholds: Utilization
     
     
     • In: 70% for 5 minutes
       
       
     • Out: 70% for 5 minutes
       
       
4. Protocol: All
   
   
5. Time Filter: None
   
   
6. Click Submit.

Next, configure RA to send traps to EventManager.

1. Go to Administration -> Application Settings.
   
   
2. Set the trap destination to the IP address of the NPC/EM server. This is typically the same IP address as the RA Master Console.
   
   
3. Save

NPC

NPC needs to be configured to send e-mails.

1. Open the NPC webpage.
   
   
2. Go to Admin -> Email Server.
   
   
3. Check the box next to "Enable e-mail."
   
   
4. Put in the Server Address and desired source/reply-to address for e-mails sent from NPC/EM.
   
   
5. Select Save.

EventManager

Now that ReporterAnalyzer is configured to send traps to EventManager, you need to configure EventManager to respond to those traps.

1. Open the NPC webpage.
   
   
2. Go to Admin -> Notifications
   
   
3. Click "Add Notification"
   
   
4. Give it a name and a description, like "RA threshold violation."
   
   
5. Filter on "from data source," and select EventManager.
   
   Trap events are all shown as coming from EventManager, not from the actual source of the trap.
   
   Also, if other sources are sending traps, this notification will send e-mails for those traps as well, so some filtering will need to be done to notify only on RA traps.
   
   
6. Click Next twice.
   
   
7. For action, select "send e-mail."
   
   
8. Fill out the To address.
   
   
9. Click OK.
   
   
10. Click Done.

Now, whenever an interface spikes above 70% utilization for more than 5 minutes, an e-mail will be sent out.

Environment

Release:
Component: NQRPTA