# Network Performance Monitoring

These are the questions asked during Network Performance Monitoring Training

## FAQ's

- **Is there any way to find out the name and location of the person who is using too much bandwidth or can we only find the IP address?**  
  OpManager uses SNMP to fetch interface details. Using the NetFlow add-on, which is flow-based, you should be able to track the usage based on IP.

- **What type reports can I get on traffic monitoring?**  
  You can get InTraffic and OutTraffic reports, Utilization reports, and reports on Errors and Discards.

- **Why should we re-discover a device?**  
  You should rediscover the device if there are any additional changes in the device. For example, if you replace the device RAM from 2GB to 4GB and you want to see the same in OpManager, you can rediscover the device and see the new RAM details in OpManager. Likewise, it is applicable for all device properties.

- **How to disable receiving specific traps of few devices in OpManager?**  
  We can create a specific customized SNMP trap processor that matches the incoming OID and then select the option to "Disable" when created. This would avoid unnecessary traps that are received in the application or from a specific device.

- **How to ignore specific error conditions like 'attention'/'trouble'/'critical' for a specific device so that alarms don't get generated for the specified condition of that device?**  
  You can uncheck the option provided at the bottom of the Notifications page that includes options such as "Attention", "Trouble", "Service down", "Critical", "Clear", etc. Once you uncheck this option, you will be provided with an option to send emails based on severity.

- **What are vendor MIBs?**  
  Cisco devices support Cisco MIBs, which are provided by the Cisco vendor. Similarly, other vendors also have their own MIBs.

- **How is Total traffic utilization calculated?**  
  In-traffic utilization per sec = (InOctet * 8000 * 1000 * 100) / Delta time  
  Out-traffic utilization per sec = (OutOctet * 8000 * 1000 * 100) / Delta time  
  Total traffic utilization = In-traffic + Out-traffic

- **Is it possible to generate a weekly or monthly uptime report of a particular interface when my ISP is terminated?**  
  An uptime report can be generated in the interface snapshot page. Click on the interface name in device snapshot, and click on Availability dial to generate an uptime report.

- **How to import and use a MIB file in .txt format for Sophos XG firewall in OpManager?**  
  You can copy that MIB file to the `OpManager\mibs` directory and load it using MIB browser to identify the OIDs that are used for monitoring performance of the firewall. Once you have the OIDs, you can create a custom template for the device in OpManager. To know more about device templates, refer to:  
  [http://help.opmanager.com/device_templates_api-v12](http://help.opmanager.com/device_templates_api-v12)

- **Is it possible to add a Blue Coat device in OpManager?**  
  We have a few templates readily available in OpManager for Blue Coat WAN Accelerators as well as switches. If you are looking for a template for some other new Blue Coat device, we have to get the required MIBs/OIDs from the vendor and add a custom template in OpManager. Learn more about creating device templates here:  
  [http://help.opmanager.com/device_templates_api-v12](http://help.opmanager.com/device_templates_api-v12)

- **How can we monitor Riccoh printers using OpManager?**  
  You can monitor the Riccoh printer by creating a custom device template and then creating performance monitors. Please check the below link to know more about creating a device template in OpManager:  
  [http://help.opmanager.com/device_templates_api-v12](http://help.opmanager.com/device_templates_api-v12)

- **We use a device called NetBox Blue by Cyberhound which is software-based firewall. What is the best way to add and monitor a virtual appliance running in VMware?**  
  You can monitor NetBox Blue Firewall by creating a new device template and associating a performance monitor in the template. Also, make sure you enable SNMP in the firewall. Learn more about creating device templates here:  
  [http://help.opmanager.com/device_templates_api-v12](http://help.opmanager.com/device_templates_api-v12)

- **Will it monitor an exchange/Office 365 hybrid environment?**  
  OpManager can monitor Exchange servers. For Office 365 monitoring, we recommend the APM plugin:  
  [https://www.manageengine.com/products/applications_manager/office-365-monitoring.html](https://www.manageengine.com/products/applications_manager/office-365-monitoring.html)

- **Is file monitoring only available for Windows?**  
  Yes. Since it is limited to WMI, it is available only for Windows.

- **Nutanix runs in a CentOS environment, would it be able to monitor that?**  
  We can monitor if it responds to SNMP OID. As per this link:  
  [https://portal.nutanix.com/index.html?targetId=Web-Console-Guide-Prism-v50:wc-system-snmp-wc-t.html#/page/docs/details](https://portal.nutanix.com/index.html?targetId=Web-Console-Guide-Prism-v50:wc-system-snmp-wc-t.html#/page/docs/details)  
  we can configure SNMP and add a few metrics. Please refer to this video:  
  [https://www.youtube.com/watch?v=I76WqNfE-Ss](https://www.youtube.com/watch?v=I76WqNfE-Ss)  
  and contact support for further assistance.

- **What is exactly total traffic for an interface? Is it the total traffic from the specific point in time until another point in time?**  
  It is based on the polling interval. If the interface polling interval is 15 minutes, then the last polled value is the traffic between the two consecutive polls.

- **How can I know the total amount of traffic through an interface from time 1 to time 2? Is there a report?**  
  You can choose the time period in reports and pull the data based on this.

- **Is it possible to make a script run from a specific device instead of the monitoring server (Microsoft Windows devices)?**  
  For Windows devices, the script has to be executed locally, but there are workarounds like PsExec (third party) or an option in *PowerShell* where a block of code can be executed on a remote server. This PsExec or *PowerShell* script might run locally on a Windows server but can call the remote script or run the block of code on a remote server.  
  [https://pitstop.manageengine.com/portal/kb/articles/how-to-run-commands-on-remote-machines-using-pstools](https://pitstop.manageengine.com/portal/kb/articles/how-to-run-commands-on-remote-machines-using-pstools)

- **What should I do when I discover a vCenter and in "virtual details" it shows the ESXi host, but it doesn't start monitoring automatically?**  
  Deleting and rediscovering vCenter will not help if the DNS name is not updated. If you update the DNS name, then in the next scheduled discovery of vCenter, it will automatically start monitoring the corrected ESX Server.  

  If correcting DNS records is not possible, you can force start monitoring by going to the vCenter snapshot page → Host List Widget → Monitoring column. From there, you can provide the IP and start monitoring it. In future releases, DNS name dependency will be removed and Entity Name will be used instead.

- **I have 6 ESX hosts, however one doesn't show up under Virtualization / VMware-Host. How do I add it to that section?**  
  That section only shows the monitored ESX servers. You can go to the vCenter snapshot page and see the complete list of ESX servers mapped to that vCenter.

- **Why does SNMP write have to be enabled for IPSLA?**  
  OpManager needs to push the IPSLA settings on the network device using SNMP write.

- **What permissions are required by the VMware vCenter credentials?**  
  HTTPS credentials for VMware vCenter with ReadOnly permission are enough to monitor vCenter.

- **What is the quickest/easiest way to identify against which IP or interface the DOS attack is against from my main router (using NetFlow)?**  
  In NetFlow, you can see the source IPs in the "Offender" tab under attacks event drill down. You can see the interface details under the "Field Details" tab (Unique IN interfaces and Unique OUT interfaces).

- **What happens if the OpManager Server Hard Disk goes full, how can we free space on Server?**  
  NFA-specific hard disk space usage reduction can be done by setting proper data retention period under Settings → NetFlow → Storage Settings. Data retention period for raw data, aggregated data, and one-minute data can be set there.

- **If someone DOS attacks me, how can I see the network utilization in the last 3 minutes instead of last 1 hour?**  
  - Note down the offender IP and interface name from attacks drill down.  
  - Go to Reports → Custom Search Reports.  
  - Select that interface and give the offender IP value for "Source Address" criteria and select the desired time frame.  
  - Click "Generate report".  
  - If raw data is enabled, then a more detailed report can be seen under Reports → Forensics Reports.

- **What constitutes a license for a monitored device (Physical Server / Virtual Host / Virtual Machines)?**  
  The license for a monitored virtual host or virtual machine is the same as a physical server. One device equals one license.

- **How can we monitor VPN connections in a Cisco ASA and create a view of this?**  
  You can create your own monitors for SNMP-enabled devices. Detailed steps are available here:  
  [http://help.opmanager.com/add_custom_monitors_api-v12](http://help.opmanager.com/add_custom_monitors_api-v12)

- **Do you provide updated or new device templates, especially network templates in the ManageEngine Portal?**  
  We have a dedicated user community who share templates regularly. You may send us an email and we shall help get this done. We will also share the community link.

- **As we get the string value from SNMP, can we have device serial number in device snapshot page using SNMP response value?**  
  Custom dial is not supported for string monitors currently. We are going to track the OID response and show it as a custom field value in device snapshot page in future.

- **How to configure bulk bandwidth RX and TX bps for particular group of interfaces?**  
  We can configure IN/OUT speed via Device Snapshot → Configure Interface for switch and router devices.

- **Is VoIP monitoring supported only on Cisco devices?**  
  Yes.

- **Are device templates available for Cisco Switches - Cisco 3850 Firmware 3.7.4, IOS-XE?**  
  Please create this using the custom template option and share the OID list with OpManager support. We will integrate this in future releases.

- **How to schedule Switch Ports Utilization Report on OpManager?**  
  All interface utilization reports are available under Reports → Health and Response. You can schedule the reports there.

- **While monitoring via ICMP and TCP, when TCP is selected, it asks for a port - which port number should we assign?**  
  You can assign a port that is open on the device. OpManager will telnet into the port, and if the port is available, it considers the device as available.

- **Can we set Latency Threshold parameters for each monitor instead of from a template (in IPSLA Protocol)?**  
  It is not currently possible. We will take it as a requirement and try bringing it into the product.

- **Do hardware sensors support Palo Alto firewall?**  
  As of now, it is not supported.

- **Where is the backup of the devices saved?**  
  OpManager does not save the device backup. NCM will save and store it in the database.

- **Is there any feature available in OpManager that can collect data from all components monitored in Azure?**  
  Yes, this feature is in our roadmap.

- **When using Dell N3024F Switch, I am getting alarm: network interfaces is 94 nos, threshold value for this monitor is 85 nos. Why is this happening?**  
  It means that the number of interfaces exceeds 85. Please query `ifNumber` in MIB Browser to check the number of interfaces. If you do not need the alarm, you can disable the threshold for the monitor.

- **What is the meaning of network interfaces for a switch and how does this value reach the threshold value?**  
  Network interfaces mean the total number of interfaces available in a device. When the network interface count increases and if a threshold is configured, an alarm will be generated. It is purely based on SNMP.

- **Even though the firewall is monitored, the dashboard does not show the CPU usage and memory usage. Why?**  
  This could happen if data collection for the respective monitor on the device is failing. The cause could be credential failure or the device not responding to the respective OIDs.

- **What is the performance of discards?**  
  Discards mean the number of inbound/outbound packets which were chosen to be discarded even though no errors had been detected, to prevent them from being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space.

- **Does licensing depend on number of devices monitored or the number of performance monitors?**  
  Licensing depends on the number of devices monitored in OpManager. Performance monitors are not considered for licensing.

- **In the OID browser, is that value already existing there, or is it entered or imported manually?**  
  By default, the OID value will be available. We just need to select the OID. We can also enter it manually.

- **What is OID?**  
  An OID is a globally unique ISO identifier. There are multiple ways this identifier may be represented, and HL7 has chosen to represent OIDs registered and used in HL7 models using a form that consists only of numbers and dots (e.g., "2.16.840.1.113883.3.1"). It is used for monitoring the performance of a device.

- **What are MIB files?**  
  MIB files are a collection of OIDs defined by the device vendor. These OIDs provide performance metric values from the device.

- **On network maps, can we customize the global map without country name?**  
  In Business View, you can import a custom image without country name. In Zoho Maps, you can drag the devices to the respective country.

- **What is OpUtils?**  
  OpUtils is an IP address and switch port management software that helps engineers efficiently monitor, diagnose, and troubleshoot IT resources. OpUtils complements existing management tools by providing troubleshooting and real-time monitoring capabilities.

- **Can you import custom background images for the map?**  
  You cannot import custom background images for maps directly. However, you can do it in Business View by going to Maps → Business Views → Create New Business View and selecting "Select background image".

- **Can you share how to set up SNMP on VMware host so I can monitor in OpManager?**  
  VMware technicians can help with step-by-step instructions on enabling SNMP on a VMware host. Once SNMP is enabled, you can discover and start monitoring.  
  https://www.manageengine.com/network-monitoring/help/vmware-discovery.html

- **I thought Cisco IPSLA required a customer to modify the device configuration. Is OpManager automating this process with a standard set of monitors?**  
  We can monitor IPSLA using standard set of monitors like Availability, RTT, etc. Please check this link for IPSLA monitor addition:  
  https://www.manageengine.com/network-monitoring/help/add-new-wan-monitor.html