Monitoring Device Administration › Manage Monitoring Device Incidents › Edit Monitoring Device Incident Thresholds

Edit Monitoring Device Incident Thresholds

Set monitoring device incident thresholds to ensure that all of your monitoring devices are sending data to the management console. Depending on the type of monitoring device, you can configure additional thresholds for dropped or fragmented packets.

Note that you cannot adjust the incident threshold for monitoring device availability.

Specify monitoring device thresholds for:

• Data inactivity. If the management console stops receiving data from any type of monitoring device, the management console creates a Major (orange) monitoring device incident.

  The management console considers a monitoring device to be inactive when it stops receiving performance data from the monitoring device. This can happen when:

  • The network is down; no data is being generated.
  • The monitoring device is down; data is generated, but the monitoring device is not active.
  • The SPAN is lost; data is generated, but the SPAN is not active.
• Packets dropped by the monitor. If a CA Standard Monitor or CA GigaStor is too busy to process all of the packets it receives, and the packet capture driver drops too many packets, the management console creates a Major (orange) monitoring device incident. The management console does not monitor packet loss at the switch port or the Monitor NIC on the monitor. This threshold is only applicable to a CA Standard Monitor or CA GigaStor.

  If the CA Standard Monitor or CA GigaStor consistently drops packets, troubleshoot dropped packets.

• Fragmented packets. If a CA Standard Monitor or CA GigaStor receives fragmented packets, the management console creates a Major (orange) monitoring device incident. By default, this threshold is disabled. This threshold is only applicable to a CA Standard Monitor or CA GigaStor.

  If fragmented packets occur consistently, one of the following conditions might exist:

  • A malicious attack has occurred on the network.
  • Devices on your network, such as routers or servers, might have improper maximum transmission unit (MTU) settings. Verify that you applied consistent MTU settings across the network to prevent fragmentation. If the MTU size is too large, retransmissions can occur if the packet encounters a router that is not able to handle that size. If the MTU size is too small, header overhead and the number of acknowledgments that need to be sent and handled increases.

Follow these steps:

1. Click the Administration page.
2. Click Policies, Performance Thresholds in the Show Me menu.

   The Monitoring Device Thresholds List opens.

3. Click to edit the thresholds for a monitoring device and click OK.

   Monitoring Device Thresholds opens.

   For information about setting incident thresholds for a monitoring device, click Help.