Previous Topic: Manage Collector ThresholdsNext Topic: Assign Collector Thresholds


What are the Default Collector Thresholds?

Collector thresholds are used to enable notifications of poor collector performance, which can indicate a problem with the SPAN port or with the collector itself. When crossed, these thresholds trigger the incident responses that you configure.

You can set the following thresholds to monitor collector performance.

Duplicate Packets

(Cisco only) The maximum percentage of traffic that can be composed of duplicate packets.

Packets are retransmitted when a response to a previous transmission is not received in time. These duplicate packets can indicate a network problem or a SPAN misconfiguration that causes the collector to see packets twice.

Discarded Packets

(Cisco only) The maximum percentage of packets passing through the SPAN port that the collector intentionally discards.

Packets are discarded due to traffic bursts that exceed the UC Monitor capacity for analysis given the current configuration. Packets are dropped because they arrive for processing when the collector is too busy to receive them.

Lost Bytes

(Cisco only) The maximum percentage of traffic that the collector can lose.

Bytes of data are lost due to traffic bursts that exceed the UC Monitor capacity for analysis given the current configuration. Some messages are too large to fit in one packet and must be split into separate packets. Packets can also arrive out of order. To handle these situations, the collector contains a reassembly engine that reassembles packets using their sequence numbers. Non-sequential sequence numbers indicate that expected bytes were not received. These bytes are counted as lost.

A high number of lost bytes usually indicates a “one-way” spanning problem. The collector sees only the packets from one side of a conversation. Therefore, the collector counts the data traveling in the other direction as lost because it cannot see that data.

Abnormal Termination

(Cisco and Avaya) Creates an incident when a service on the collector logs a fatal exception.

An incident report contains the paths to the crash dump file and the packet capture file. You can send this information to CA Technical Support.