Deployment Guide

Sub-flow rule violation summaries
In the MAPS dashboard you can view a summary of all sub-flows that have rule
violations.
When a rule is triggered, the corresponding RASLog rule trigger appears in the
“Rules Affecting Health” sub-section of the dashboard as part of the Traffic
Performance category. In this category, the five flows or sub-flows with the
highest number of violations since the previous midnight are listed.
The naming convention for “Object” in sub-flows has the format Flow
(flowName:sub-flow parameters), where flowName is the name of the imported
flow.
The following extract provides an illustration of violations of the
“thruputflow_thput_10” rule. The output has been split (at \) to allow the example
to display clearly.
switch:admin> mapsdb --show
…
3.2. Rules Affecting Health:
=================================
Category(Rule Count) |Repeat Count|Rule Name |Execution Time| \
Traffic Performance(10) |5 | thruputflow_thput_10|2/21/13 1:30:6| \
2/21/13 1:30:6| \
2/21/13 1:28:6| \
2/21/13 1:26:6| \
2/21/13 1:24:6| \
\|Object |Trigger Value(Units)
\|Flow (thruputflow:SID=011000,DID=011200,Rx=10)| 860 MBps
\|Flow (thruputflow:SID=012000,DID=011200,Rx=10)| 707 MBps
\|Flow (thruputflow:SID=012100,DID=011200,Rx=10)| 812 MBps
\|Flow (thruputflow:SID=012200,DID=011200,Rx=10)| 753 MBps
\|Flow (thruputflow:SID=012300,DID=011200,Rx=10)| 736 MBps
(output truncated)
• For learning flows, in addition to the name of the flow being monitored by the
rule, the source and destination values for each individual sub-flow that
violated the threshold are included in the RASLog entry. These values replace
the learning parameters specified in the flow definition. The specific type of
values (such as SID, DID, SFID, DFID, Rx, Tx and so on) are derived from the
flow definition. In the following example, “(SID=039c00,DID=040700,Rx=10)”
is the flow identifier for the learned flow “flows_to_did” (which was defined
using "*" for the source and destination devices).
2014/04/07-07:20:01, [MAPS-1003], 11131, SLOT 4 | FID 128, WARNING,
SWAT_TUHIN_PLUTO, Flow (flows_to_did:SID=039c00,DID=040700,Rx=10), Condition=
flows_to_did (TX_FCNT/hour>=10), Current Value:[TX_FCNT,698366979],
RuleName=flow2, Dashboard Category=Traffic Performance.
• For static flows, the name of the flow is provided as part of the RASLog. In the
following example, “max_thruput_flow” is the name of the problematic flow.
2013/12/21-11:50:00, [MAPS-1003], 1225, FID 128, WARNING, sw0, Flow
(max_thruput_flow), Condition=max_thruput_flow(TX_FCNT/min>=10), Current Value:
[TX_FCNT,42654538], RuleName=thruputflow_thput_10, Dashboard Category=Traffic
Performance.
Viewing a detailed switch status report
The detailed switch status displays historical data for port performance errors in addition to the
summary view.
To view a detailed switch status report, complete the following steps.
Viewing a detailed switch status report
Monitoring and Alerting Policy Suite Administrator's Guide 81
53-1003147-01