4 ms·

At a guess, it's because you don't describe how it would help. "Just do a TopN report" is not a diagnosis, analysis, or furtherance of the discussion. If you w

At a guess, it's because you don't describe how it would help. "Just do a TopN report" is not a diagnosis, analysis, or furtherance of the discussion. If you want to do an effective shameless plug, write a few sentences about how your product would have helped from the beginning of the incident, through its resolution. Show how it would have saved time/effort and given more visibility into the problem. This was a multi-hour incident with code-level escalation to the network hardware vendor; assume complexity.

dkhenry 14y ago
So I see. I think I didn't take the time to define my terms, or give the full sales pitch around them. I am not going to give the sales pitch, but TopN is a style of report that can query in real time every metric across every performance metric available and find not only find and alert on ones outside of normal operating parameters, but predict which ones will go haywire in a given time frame. This means no going around to all your switches to figure out which ones are causing problems. In this specific instance if you had an indicator on an OID .1.3.6.1.2.1.17.4.3.1.1 you could see how big the MAC table was and have noticed when it dropped below the expected value. This would have alerted immediately letting you know not only that you had a problem, but on which switches there were issues. Alternatively you could have set alerts on any number of packet level indicators.