Monitoring Network Interfaces

This section describes how to monitor network interfaces in SL1.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

Discovering Interfaces

During the discovery process, SL1 discovers all interfaces on each discovered device. SL1 applies a default monitoring policy to every discovered interface (excluding loopback interfaces). The default policy collects inbound and outbound bandwidth statistics every 5 minutes.

The Network Interfaces page (Registry > Networks > Interfaces) allows you to view a list of all discovered interfaces, view details about each interface, edit the monitoring policy for an interface, and view bandwidth reports for each interface.

Viewing a List of All Interfaces Discovered by SL1

During discovery, SL1 discovers all interfaces on each discovered device. The list of all interfaces is displayed in the Network Interfaces page.

The Network Interfaces page allows you to view a list of all interfaces, view details about each interface, define a monitoring policy for an interface, and view bandwidth reports for each interface.

To view a list of all interfaces discovered by SL1:

Go to the Network Interfaces page (Registry > Networks > Interfaces).

The Network Interfaces page displays a list of all network interfaces discovered by SL1.

The Network Interfaces page displays the following for each interface.

To sort the list of interfaces, click on a column heading. The list will be sorted by the column value, in ascending order. To sort the list by descending order, click the column heading again.

Device Name. Name of the device where the interface resides.
Port/Sub. Port and sub-port (if applicable) of the interface.

IF Name. The name of the network interface. The auto-name, generated by SL1, is device_name:interface_number. You can define a different name in the Interface Properties page.
Tags. Displays a comma-delimited list of descriptive tags that have been manually defined for the interface. Interface tags are used to group interfaces in an IT service policy. To add or edit the tags for an interface, click its wrench icon (). In the Edit Network Interface Tags modal that appears, supply a comma-delimited list of tags in the Tags field, and then click the Save button.
Organization. Organization associated with the network interface. This can be the organization associated with the device where the interface resides, or it can be an organization that has emissary rights to the interface.
Alias. User-defined name assigned to the interface.
MAC Address. A unique number that identifies the interface. MAC Addresses are defined by the hardware manufacturer.
IF Index. A unique number (greater than zero) that identifies each interface on a device. These numbers are defined within the device.
IF Type. A string that describes the type of interface, as defined by the standards group Internet Assigned Numbers Authority (IANA).

Status. Consists of two parts:

Administration Status. Specifies how the network interface has been configured on the device. Can be one of the following:

Up. Network interface has been enabled.
Down. Network interface has been disabled.

Operation Status. Specifies current state of the network interface. Can be one of the following:

Up. Network interface is transmitting and receiving data.
Down. Network interface cannot transmit or receive data.

NOTE: SL1 generates an event when a network interface has an administrative status of "up" and an operation status of "down".

Measure. Unit of measurement for bandwidth reports for the interface. The choices are:

Mega
Giga
Kilo
Tera
Peta

Interface Speed. The number of megabits per second that can pass through the network interface.

Alerting. Specifies whether or not internal collection events will be generated for the selected interfaces.

Yes. SL1 monitors the network interface and generates internal collection events when the required conditions are met.
No. SL1 monitors the network interface, but internal collection events are not generated for the interface.

Auto-Name Update. Specifies whether or not SL1 will update and/or overwrite the interface name during auto-discovery.

Yes. SL1 can update and/or overwrite the interface name during auto-discovery.
No. SL1 will not update and/or overwrite the interface name during auto-discovery.

Collection Frequency. When you define a monitoring policy for an interface, you must specify how frequently you want SL1 to collect data from the interface. Your choices are every:

1 Minute
5 Minutes
10 Minutes
15 Minutes
30 Minutes
60 Minutes
120 Minutes

Collect Errors. Specifies whether or not SL1 will collect data about packet errors on the interface. Packet errors can occur when packets are lost due to network outages or faulty adapter hardware. Your choices are:

Yes. SL1 will collect data on packet errors that occur on the interface.
No. SL1 will not collect data on packet errors that occur on the interface.

Collect Discards. Specifies whether or not SL1 will collect data about interface discards. Discards can occur when an interface receives more traffic than it can handle. Discards can also occur when an interface has been specifically configured to discard packets. For example, a network administrator might configure a router's interface to discard packets from an unauthorized IP. Your choices are:

Yes. SL1 will collect data about packet discards that occur on the interface.
No. SL1 will not collect data about packet discards that occur on the interface.

Collect CBQoS. Specifies whether SL1 will collect CBQoS (Class-Based Quality-of-Service) data for this interface. This column appears only if you have enabled the field Enable CBQoS Collection in the Behavior Settings page (System > Settings > Behavior). If Collect CBQoS is enabled for an interface, SL1 will display the collected CBQoS data in Device Performance reports associated with the device that contains this interface. Choices are:

Yes. SL1 will collect CBQoS data for this interface.
No. SL1 will not collect CBQoS data for this interface.

For more information about CBQoS, see the section on Class-Based Quality of Service (CBQoS).

Collect Packets. Specifies whether SL1 will collect network traffic data, in packets, for this interface. If Collect Packets is enabled for an interface, SL1 will display the collected data in Device Performance reports associated with the device that contains this interface. Choices are:

Yes. SL1 will collect packet data for this interface.
No. SL1 will not collect packet data for this interface.

Counter Setting. Specifies whether the interface uses a 32-bit counter or a 64-bit counter to measure bandwidth on the interface.

NOTE: If an interface has a status of "down" during initial discovery, SL1 will discover the interface but assign the interface the default Counter Setting of "32". During re-discovery or nightly auto-discovery, SL1 will update Counter Setting to "64" if applicable.

State. Specifies whether SL1 monitors the network interface and collects data about the network interface for reports. Can be either Enabled or Disabled.

Edit Date. Date and time the monitoring policy for the interface was created or last edited. If the interface is using the default monitoring policy, the edit date reflects the date that the interface was discovered by SL1.

Viewing Interfaces for a Single Device

You can view detailed data about a specific device by clicking the device name on the Devices page () to open the Device Investigator page for that device.

On the Interfaces tab of the Device Investigator page, you can view information about each network interface on the device. From this tab, you can also define monitoring policies for interfaces on the device.

You can view an interface's network utilization graph in a new window by clicking the bar graph icon () next to the name of the interface.

The data displayed on this tab is read-only.

You can adjust the size of the rows and the size of the row text on this inventory page. For more information, see the section on Adjusting the Row Density.

The Interfaces tab displays the following for every interface used by a device:

Name. The name of the network interface. You can open the Interface Properties page in a pop-up window by clicking the interface name from the list.
Alias. The name assigned by SL1 to the interface.
Hardware Description. Description of the network interface. Usually a description of a network interface card.
Port. The interface port.
MAC Address. A unique number that identifies the interface. MAC Addresses are defined by the hardware manufacturer.
Connection Speed. The amount of data, in Megabytes per second, that the interface can process.
Collection State. Specifies whether the platform monitors the network interface and collects data from the network interface for reports. Can be either Enabled or Disabled.

Admin Status. Specifies how the network interface has been configured on the device. Can be one of the following:

Up. Network interface has been enabled.
Down. Network interface has been disabled.

Operational Status. Specifies current state of the network interface. Can be one of the following:

Up. Network interface is transmitting and receiving data.
Down. Network interface cannot transmit or receive data.

Collection Rate. Specifies (in minutes) how often SL1 collects data from the interface.
Collect Errors. Specifies whether SL1 will collect data about packet errors on the interface. Packet errors can occur when packets are lost due to network outages or faulty adapter hardware.
Collect Discards. Specifies whether SL1 will collect data about interface discards. Discards occur when an interface receives more traffic than it can handle. Discards can also occur when an interface has been specifically configured to discard. For example, a network administrator might configure a router's interface to discard packets from an unauthorized IP address.
Alerts. Specifies whether SL1 will generate internal collection events for the interface. Can be Enabled or Disabled. When disabled, the interface is monitored, but internal collection events are not generated for the interface.
Rollover Alerts. Specifies whether SL1 will generate an event when the counter for the interface rolls over.
Index. A unique number greater than zero that identifies each interface on a device. These numbers are defined by the device.

Clicking an interface Name opens the Interface Properties page for that interface. This page enables you to view the properties for that interface and define a monitoring policy for the interface.

You can also access the Interface Properties page by clicking the Actions button () for that interface and selecting Manage Interface.

When you define a monitoring policy for an interface, SL1 will monitor the interface and gather usage data from the interface. SL1 uses the data retrieved from the interface to generate bandwidth reports for the interface.

Viewing Interfaces for a Single Device in the Classic User Interface

In the Device Administration panel for a device, you can view the Device Interfaces page. The Device Interfaces page displays detailed information about each network interface on the device and allows you to define monitoring policies for interfaces on the device. When you define a monitoring policy for an interface, SL1 will monitor the interface and gather usage data from the interface. SL1 uses the data retrieved from the interface to generate bandwidth reports for the interface.

In the Device Reports panel for a device, you can view the Interfaces Found page. The Interfaces Found page displays detailed information about each network interface on the device. The Interfaces Found page allows you to view a list of all interfaces on the device, view details about each interface, and view bandwidth usage reports for each interface.

To view details about the network interfaces on a device:

Go to the Device Manager page (Devices > Device Manager).
Find the device for which you want to view the list of network interfaces, then do one of the following:

Click its wrench icon (), followed by the Interfaces tab, to view the Device Interfaces page.
Click the bar graph icon (), followed by the Interfaces tab, to view the Interfaces Found page.

Both pages display icons to represent the interfaces on the device.
The page displays an icon for each interface on the device. Each icon provides a visual overview of the interface.
For details on interface icons, click the Legend button, or in the Actions menu, select Interface Legend. The Interface Legend modal page displays each type of interface icon with explanatory callouts.
When you mouse over the icon for that interface, the Interface Details pop-up window appears. This window displays details about the interface and its current monitoring policy.
The Interface Details pop-up window displays the following about an interface:

Port / Sub. Port and sub-port (if applicable) of the interface.

Interface Name. The name of the network interface. The auto-name, generated by SL1, is device_name:interface_number.
Alias. Easy-to-remember, human-readable name for the network interface.
Hardware Desc. Description of the network interface. Usually a description of a network-interface card.
MAC Address. A unique number that identifies network hardware. MAC Addresses are defined by the hardware manufacturer.
MAC Vendor. Manufacturer of the network interface.
Connection Speed. The amount of data per second that can pass through the network interface.
Collect State. Specifies whether or not SL1 monitors the network interface and collects data from the network interface for reports.

Admin Status. Specifies how the network interface has been configured on the device. Can be one of the following:

Up. Network interface has been configured to be up and running.
Down. Network interface has been disabled.

Operational Status. Specifies current state of the network interface. Can be one of the following:

Up. Network interface is transmitting and receiving data.
Down. Network interface cannot transmit or receive data.

Collect Freq. Frequency at which SL1 will poll the interface to collect data. Choices are 1 minute, 5 minutes, 10 minutes, 30 minutes, 60 minutes, and 120 minutes.
Collect Errors. Specifies whether or not SL1 will collect data about packet errors on the interface. Packet errors occur when packets are lost due to hardware problems such as network outages or faulty adapter hardware.

Collect Discards. Specifies whether or not SL1 will collect data about interface discards. Discards occur when an interface receives more traffic than it can handle. Discards can also occur when an interface has been specifically configured to discard. For example, a network administrator might configure a router's interface to discard packets from an unauthorized IP address.
Alerts. Specifies whether or not SL1 will generate internal collection events for the interface. When disabled, the interface is monitored, but internal collection events are not generated for the interface.
Rollover Alerts. Specifies whether or not SL1 will generate an event when the counter for the interface rolls over.

NOTE: Rollovers and Rollover Alerts apply only to 32-bit counters and not to 64-bit counters.

IP. IP address and network mask assigned to the interface.
Counter Type. Specifies whether the interface uses a 32-bit counter or a 64-bit counter to measure bandwidth on the interface.

NOTE: If an interface has a status of "down" during initial discovery, SL1 will discover the interface but assign the interface the default Counter Type of "32". During re-discovery or nightly auto-discovery, SL1 will update the Counter Type to "64" if applicable.

IANA Type. A string that describes the type of interface, as defined by the standards group Internet Assigned Numbers Authority.
Interface Index. A unique number (greater than zero) that identifies each interface on a device. These numbers are defined by the device.

In the Device Interfaces page, clicking on an interface icon leads to the Interface Properties page, where you can define a monitoring policy for an interface.
In the Interfaces Found page, clicking on an interface icon leads to the Network Bandwidth Usage report in the Device Performance page.

Global Settings that Affect Interfaces

The following pages contain settings that affect interfaces:

Behavior Settings

The Behavior Settings page (System > Settings > Behavior) allows you to define global parameters that affect:

User Logins
Discovery
Data collection
Settings that affect the display and behavior of the user interface
Expiration warnings for asset warranties and SSL certificates

The parameters in the Behavior Settings page affect all pages, devices, and discovery functionality in SL1. For most settings, you can define a one-time, manual override in the affected page. You can also override many of these settings per device. For example, you can define global parameters for nightly discovery in this page, but you can override these settings for a specific device on the Settings tab of the Device Investigator page or the Device Properties page (Devices> Device Manager > wrench icon) in the classic user interface.

To define or edit the settings in the Behavior Settings page:

Go to the Behavior Settings page (System > Settings > Behavior).
In the Behavior Settings page, the following fields affect how SL1 manages all interfaces:

Initially Discovered Interface Poll Rate. This field specifies the frequency with which SL1 will poll newly discovered interfaces. This setting does not affect interfaces that have been previously discovered with a different value in this field or interfaces for which the Frequency field has been manually edited in the Interface Properties page. Choices in this field are:

1 min. SL1 will poll the newly discovered interfaces every minute.
5 mins. SL1 will poll the newly discovered interfaces every five minutes. This is the default value for this field.
10 mins. SL1 will poll the newly discovered interfaces every 10 minutes.
15 mins. SL1 will poll the newly discovered interfaces every 15 minutes.
30 mins. SL1 will poll the newly discovered interfaces every 30 minutes.
60 mins. SL1 will poll the newly discovered interfaces every 60 minutes.
120 mins. SL1 will poll the newly discovered interfaces every 120 minutes.

Event Interface Name Format. Specifies the format of the network interface name that you want to appear in events. If you selected Interface Alias for the deprecated Interface Name Precedence field in a previous release of SL1, the format for existing interfaces is set to {alias}. If you selected “Interface Name” for the deprecated Interface Name Precedence field in a previous release of SL1, the format for existing interfaces is set to {name}. The default format is {name}.
Enable CBQoS Collection. If selected, SL1 will collect configuration data about Class-Based Quality-of-Service (CBQoS) from interfaces that are configured for CBQoS. If selected, you can enable collection of CBQoS metrics per-interface. The collected CBQoS metrics are displayed in Device Performance reports associated with the device that contains those interfaces. This setting is disabled by default. (For more information about CBQoS, see the section on Class-Based Quality of Service.)
Enable Variable Rate Interface Counters. If selected, enables more accurate collection of data from interfaces. If enabled, when SL1 retrieves data from an interface, that data is stored in the ScienceLogic database along with the timestamp associated with the exact collection time. Before normalization occurs, SL1 applies an interpolation function that spaces the data at regular time intervals. For example, suppose you have specified that SL1 should collect interface data every five minutes. However, due to network traffic across the Data Collectors, SL1 might collect data from an interface at 13:01 and then 13:05. Because the ScienceLogic normalization process expects data that has been collected every five minutes, SL1 first applies an interpolation to the data to prepare the data for normalization.
Enable Concurrent Network Interface Collection. If selected, enables asynchronous concurrent SNMP collection for all network interfaces. This provides better scalability for large networks by allowing multiple collection tasks to run at the same time with a reduced load on Data Collectors. (For more information, see the section on Concurrent Network Interface Collection.)

You can also enable or disable concurrent network interface collection for individual collector groups using the Enable Concurrent Network Interface Collection field on the Collector Group Management page (System > Settings > Collector Groups). This setting overrides the global setting for concurrent network interface collection for the selected collector group. For more information, see the section on Configuring Concurrent Network Interface Collection for a Collector Group.

If you do not enable concurrent network interface collection, then ScienceLogic recommends that you maintain a limit of no more than 10,000 interfaces per SL1 Data Collector; there is no recommended limit to the number of interfaces you can monitor per Data Collector if concurrent network interface collection is enabled.

If the "Data Collection: SNMP Collector" process is disabled on the Process Manager page (System > Settings > Admin Processes), this concurrent network interface collection option is disabled.

Concurrent network interface collection is not available in military unique deployments (MUD) or STIG-compliant deployments.

Click the Save button to save any changes in this page.

Interface Threshold Defaults

The Interface Thresholds Defaults page (System > Settings > Thresholds > Interface) allows you to define global thresholds for interfaces.

The settings in the Interface Thresholds Defaults page apply to all interfaces. However, you can override these system settings on a case-by-case basis for each interface in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).

If you have specified that SL1 should monitor an interface, SL1 will collect data about the interface and also monitor performance thresholds for the interface. SL1 will use either the default thresholds defined in the Interface Thresholds Defaults page (System > Settings > Thresholds > Interface or the custom threshold you define in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon). When the values for an interface exceed one or more thresholds, SL1 will generate an event.

To define global thresholds for interfaces:

Go to Interface Thresholds Defaults page (System > Settings > Thresholds > Interface.

The following global thresholds are defined by default in the Interface Thresholds Defaults page:

NOTE: You can specify the unit of measure for all the metrics in Bandwidth In and Bandwidth Out. You can select bps, kbps, Mbps (the default), or Gbps.

Threshold	Default Value	Default Status
Utilization % In > Inbound Percent	65.000	Enabled
Utilization % Out > Outbound Percent	65.000	Enabled
Bandwidth In > Inbound Bandwidth	0.000	Disabled
Bandwidth Out > Outbound Bandwidth	0.000	Disabled
Errors % In > Inbound Error Percent	1.000	Enabled
Errors % Out > Outbound Error Percent	1.000	Enabled
Errors In > Inbound Errors	1000.000	Enabled
Errors Out > Outbound Errors	1000.000	Enabled
Discard % In > Inbound Discard Percent	1.000	Enabled
Discards % Out > Outbound Discard Percent	1.000	Enabled
Discards In > Inbound Discards	1000.000	Enabled
Discards Out > Outbound Discards	1000.000	Enabled
Multicast % In > Rising Medium	30.000	Disabled
Multicast % In > Rising Low	20.000	Disabled
Broadcast % Out > Rising Medium	30.000	Disabled
Broadcast % Out > Rising Low	20.000	Disabled

Selecting the Show Hidden Thresholds checkbox displays the following default thresholds:

NOTE: You can specify the unit of measure for all the metrics in Bandwidth In and Bandwidth Out. You can select bps, kbps, Mbps (the default), or Gbps.

Threshold	Default Value	Default Status
Utilization % In > Rising High	0.000	Hidden
Utilization % In > Rising Medium	0.000	Hidden
Utilization % In > Rising Low	0.000	Hidden
Utilization % In > Falling Low	0.000	Hidden
Utilization % In > Falling Medium	0.000	Hidden
Utilization % In > Falling High	0.000	Hidden
Utilization % In > Inbound Percent	65.000	Enabled
Utilization % Out> Rising High	0.000	Hidden
Utilization % Out > Rising Medium	0.000	Hidden
Utilization % Out > Rising Low	0.000	Hidden
Utilization % Out > Falling Low	0.000	Hidden
Utilization % Out > Falling Medium	0.000	Hidden
Utilization % Out > Falling High	0.000	Hidden
Utilization % Out > Outbound Percent	65.000	Enabled
Bandwidth In > Rising High	0.000	Hidden
Bandwidth In > Rising Medium	0.000	Hidden
Bandwidth In > Rising Low	0.000	Hidden
Bandwidth In > Falling Low	0.000	Hidden
Bandwidth In > Falling Medium	0.000	Hidden
Bandwidth In > Falling High	0.000	Hidden
Bandwidth In > Inbound Bandwidth	0.000	Disabled
Bandwidth Out > Rising High	0.000	Hidden
Bandwidth Out > Rising Medium	0.000	Hidden
Bandwidth Out > Rising Low	0.000	Hidden
Bandwidth Out > Falling Low	0.000	Hidden
Bandwidth Out > Falling Medium	0.000	Hidden
Bandwidth Out > Falling High	0.000	Hidden
Bandwidth Out > Outbound Bandwidth	0.000	Disabled
Errors % In > Rising High	0.000	Hidden
Errors % In > Rising Medium	0.000	Hidden
Errors % In > Rising Low	0.000	Hidden
Errors % In > Falling Low	0.000	Hidden
Errors % In > Falling Medium	0.000	Hidden
Errors % In > Falling High	0.000	Hidden
Errors % In > Inbound Error Percent	1.000	Enabled
Errors % Out > Rising High	0.000	Hidden
Errors % Out > Rising Medium	0.000	Hidden
Errors % Out > Rising Low	0.000	Hidden
Errors % Out > Falling Low	0.000	Hidden
Errors % Out > Falling Medium	0.000	Hidden
Errors % Out > Falling High	0.000	Hidden
Errors % Out > Outbound Error Percent	1.000	Enabled
Errors In > Rising High	0.000	Hidden
Errors In > Rising Medium	0.000	Hidden
Errors In > Rising Low	0.000	Hidden
Errors In > Falling Low	0.000	Hidden
Errors In > Falling Medium	0.000	Hidden
Errors In > Falling High	0.000	Hidden
Errors In > Inbound Errors	1000.000	Enabled
Errors Out > Rising High	0.000	Hidden
Errors Out > Rising Medium	0.000	Hidden
Errors Out > Rising Low	0.000	Hidden
Errors Out > Falling Low	0.000	Hidden
Errors Out > Falling Medium	0.000	Hidden
Errors Out > Falling High	0.000	Hidden
Errors Out > Outbound Errors	1000.000	Enabled
Discards % In > Rising High	0.000	Hidden
Discards % In > Rising Medium	0.000	Hidden
Discards % In > Rising Low	0.000	Hidden
Discards % In > Falling Low	0.000	Hidden
Discards % In > Falling Medium	0.000	Hidden
Discards % In > Falling High	0.000	Hidden
Discards % In > Inbound Discard Percent	1.000	Enabled
Discards % Out > Rising High	0.000	Hidden
Discards % Out > Rising Medium	0.000	Hidden
Discards % Out > Rising Low	0.000	Hidden
Discards % Out > Falling Low	0.000	Hidden
Discards % Out > Falling Medium	0.000	Hidden
Discards % Out > Falling High	0.000	Hidden
Discards % Out > Outbound Discard Percent	1.000	Enabled
Discards In > Rising High	0.000	Hidden
Discards In > Rising Medium	0.000	Hidden
Discards In > Rising Low	0.000	Hidden
Discards In > Falling Low	0.000	Hidden
Discards In > Falling Medium	0.000	Hidden
Discards In > Falling High	0.000	Hidden
Discards In > Inbound Discards	1000.000	Enabled
Discards Out > Rising High	0.000	Hidden
Discards Out > Rising Medium	0.000	Hidden
Discards Out > Rising Low	0.000	Hidden
Discards Out > Falling Low	0.000	Hidden
Discards Out > Falling Medium	0.000	Hidden
Discards Out > Falling High	0.000	Hidden
Discards Out > Outbound Discards	1000.000	Enabled
Broadcast % In > Rising High	0.000	Hidden
Broadcast % In > Rising Medium	30.000	Disabled
Broadcast % In > Rising Low	20.000	Disabled
Broadcast % In > Falling Low	0.000	Hidden
Broadcast % In > Falling Medium	0.000	Hidden
Broadcast % In > Falling High	0.000	Hidden
Broadcast % Out > Rising High	0.000	Hidden
Broadcast % Out > Rising Medium	30.000	Disabled
Broadcast % Out > Rising Low	20.000	Disabled
Broadcast % Out > Falling Low	0.000	Hidden
Broadcast % Out > Falling Medium	0.000	Hidden
Broadcast % Out > Falling High	0.000	Hidden
Broadcast In > Rising High	0.000	Hidden
Broadcast In > Rising Medium	0.000	Hidden
Broadcast In > Rising Low	0.000	Hidden
Broadcast In > Falling Low	0.000	Hidden
Broadcast In > Falling Medium	0.000	Hidden
Broadcast In > Falling High	0.000	Hidden
Broadcast Out > Rising High	0.000	Hidden
Broadcast Out > Rising Medium	0.000	Hidden
Broadcast Out > Rising Low	0.000	Hidden
Broadcast Out > Falling Low	0.000	Hidden
Broadcast Out > Falling Medium	0.000	Hidden
Broadcast Out > Falling High	0.000	Hidden
Multicast % In > Rising High	0.000	Hidden
Multicast % In > Rising Medium	00.000	Hidden
Multicast % In > Rising Low	00.000	Hidden
Multicast % In > Falling Low	0.000	Hidden
Multicast % In > Falling Medium	0.000	Hidden
Multicast % In > Falling High	0.000	Hidden
Multicast % Out > Rising High	0.000	Hidden
Multicast % Out > Rising Medium	00.000	Hidden
Multicast % Out > Rising Low	00.000	Hidden
Multicast % Out > Falling Low	0.000	Hidden
Multicast % Out > Falling Medium	0.000	Hidden
Multicast % Out > Falling High	0.000	Hidden
Multicast In > Rising High	0.000	Hidden
Multicast In > Rising Medium	0.000	Hidden
Multicast In > Rising Low	0.000	Hidden
Multicast In > Falling Low	0.000	Hidden
Multicast In > Falling Medium	0.000	Hidden
Multicast In > Falling High	0.000	Hidden
Multicast Out > Rising High	0.000	Hidden
Multicast Out > Rising Medium	0.000	Hidden
Multicast Out > Rising Low	0.000	Hidden
Multicast Out > Falling Low	0.000	Hidden
Multicast Out > Falling Medium	0.000	Hidden
Multicast Out > Falling High	0.000	Hidden
Unicast % In > Rising High	0.000	Hidden
Unicast % In > Rising Medium	00.000	Hidden
Unicast % In > Rising Low	00.000	Hidden
Unicast % In > Falling Low	0.000	Hidden
Unicast % In > Falling Medium	0.000	Hidden
Unicast % In > Falling High	0.000	Hidden
Unicast % Out > Rising High	0.000	Hidden
Unicast % Out > Rising Medium	00.000	Hidden
Unicast % Out > Rising Low	00.000	Hidden
Unicast % Out > Falling Low	0.000	Hidden
Unicast % Out > Falling Medium	0.000	Hidden
Unicast % Out > Falling High	0.000	Hidden
Unicast In > Rising High	0.000	Hidden
Unicast In > Rising Medium	0.000	Hidden
Unicast In > Rising Low	0.000	Hidden
Unicast In > Falling Low	0.000	Hidden
Unicast In > Falling Medium	0.000	Hidden
Unicast In > Falling High	0.000	Hidden
Unicast Out > Rising High	0.000	Hidden
Unicast Out > Rising Medium	0.000	Hidden
Unicast Out > Rising Low	0.000	Hidden
Unicast Out > Falling Low	0.000	Hidden
Unicast Out > Falling Medium	0.000	Hidden
Unicast Out > Falling High	0.000	Hidden

For each threshold, you can edit the following:

Value. The value at which the threshold will trigger an event.

For thresholds that include the word Rising, when a value exceeds the specified value, SL1 triggers an event.
For thresholds that include the word Falling, when a value falls below the specified value, SL1 triggers an event.
For thresholds that do not include the word Rising or Falling, when a value exceeds the specified value, SL1 triggers an event.

Status. Specifies whether the threshold is active and whether the threshold will appear in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon). Choices are:

Enabled. The threshold is applied to all interfaces and is monitored by SL1. The threshold appears in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon). Users can edit the Value and Status of the threshold.

Disabled. The threshold is applied to all interfaces but is not monitored by SL1. The threshold appears in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon) with a status of Disabled. In the Thresholds tab on the Interface Properties page, users can edit the Value and Status of the threshold.
Hidden. The threshold is not applied to all interfaces, and is not monitored by SL1. The threshold does not appear in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).

Unit of Measure. For all the metrics under Bandwidth In and Bandwidth Out, you can select the unit of measure. Choices are:

kbps
Mbps
Gbps

Quality of Service Threshold Defaults

The Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service) allows you to define global thresholds for CBQoS objects.

The settings in the Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service) apply to all CBQoS objects. However, you can override these system settings on a case-by-case basis for each interface in the Quality of Service (QoS) page (Registry > Networks > Quality of Service).

If you have specified that SL1 should monitor an interface, SL1 will collect data about the interface and also monitor performance thresholds for the interface. For interfaces that are part of a CBQoS class, SL1 will use either the global CBQoS thresholds defined in the Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service) or the custom threshold you define in the Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon). When the values for an interface exceed one or more thresholds, SL1 will generate an event.

To edit the global thresholds for a CBQoS object:

Go to the Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service.

The following global thresholds are defined by default in Quality of Service Threshold Defaults page:

Threshold	Default Value	Default Status
Drop Rate > Rising High	1.000	Disabled
Drop Rate > Rising Medium	0.500	Disabled
Violation Rate > Rising High	1.000	Disabled
Violation Rate > Rising Medium	0.500	Disabled
Pre-Policy Inbound Utilization % > Rising High	60.000	Disabled
Pre-Policy Inbound Utilization % > Rising Medium	40.000	Disabled
Pre-Policy Outbound Utilization % > Rising High	60.000	Disabled
Pre-Policy Outbound Utilization % > Rising Medium	40.000	Disabled
Discard Rate > Rising High	1.000	Disabled
Discard Rate > Rising Medium	0.500	Disabled

Selecting the Show Hidden Thresholds checkbox displays the following default thresholds:

Threshold	Default Value	Default Status
Pre-Policy Rate > Rising High	0.000	Hidden
Pre-Policy Rate > Rising Medium	0.000	Hidden
Pre-Policy Rate > Rising Low	0.000	Hidden
Pre-Policy Rate > Falling Low	0.000	Hidden
Pre-Policy Rate > Falling Medium	0.000	Hidden
Pre-Policy Rate > Falling High	0.000	Hidden
PostPolicy Rate > Rising High	0.000	Hidden
Post-Policy Rate > Rising Medium	0.000	Hidden
Post-Policy Rate > Rising Low	0.000	Hidden
Post-Policy Rate > Falling Low	0.000	Hidden
Post-Policy Rate > Falling Medium	0.000	Hidden
Post-Policy Rate > Falling High	0.000	Hidden
Drop Rate > Rising High	1.000	Disabled
Drop Rate > Rising Medium	0.500	Disabled
Drop Rate > Rising Low	0.000	Hidden
Drop Rate > Falling Low	0.000	Hidden
Drop Rate > Falling Medium	0.000	Hidden
Drop Rate > Falling High	0.000	Hidden
Conforming Rate > Rising High	0.000	Hidden
Conforming Rate > Rising Medium	0.000	Hidden
Conforming Rate > Rising Low	0.000	Hidden
Conforming Rate > Falling Low	0.000	Hidden
Conforming Rate > Falling Medium	0.000	Hidden
Conforming Rate > Falling High	0.000	Hidden
Non-Conforming Rate > Rising High	0.000	Hidden
Non-Conforming Rate > Rising Medium	0.000	Hidden
Non-Conforming Rate > Rising Low	0.000	Hidden
Non-Conforming Rate > Falling Low	0.000	Hidden
Non-Conforming Rate > Falling Medium	0.000	Hidden
Non-Conforming Rate > Falling High	0.000	Hidden
Violation Rate > Rising High	1.000	Disabled
Violation Rate > Rising Medium	0.500	Disabled
Violation Rate > Rising Low	0.000	Hidden
Violation Rate > Falling Low	0.000	Hidden
Violation Rate > Falling Medium	0.000	Hidden
Violation Rate > Falling High	0.000	Hidden
Current Queue Depth > Rising High	0.000	Hidden
Current Queue Depth > Rising Medium	0.000	Hidden
Current Queue Depth Current Queue Depth > Rising Low	0.000	Hidden
Current Queue Depth > Falling Low	0.000	Hidden
Current Queue Depth > Falling Medium	0.000	Hidden
Current Queue Depth > Falling High	0.000	Hidden
Pre-Policy Inbound Utilization > Rising High	60.000	Disabled
Pre-Policy Inbound Utilization > Rising Medium	40.000	Disabled
Pre-Policy Inbound Utilization > Rising Low	0.000	Hidden
Pre-Policy Inbound Utilization > Falling Low	0.000	Hidden
Pre-Policy Inbound Utilization > Falling Medium	0.000	Hidden
Pre-Policy Inbound Utilization > Falling High	0.000	Hidden
Post-Policy Inbound Utilization > Rising High	60.000	Disabled
Post-Policy Inbound Utilization > Rising Medium	40.000	Disabled
Post-Policy Inbound Utilization > Rising Low	0.000	Hidden
Post-Policy Inbound Utilization > Falling Low	0.000	Hidden
Post-Policy Inbound Utilization > Falling Medium	0.000	Hidden
Post-Policy Inbound Utilization > Falling High	0.000	Hidden
Discard Rate > Rising High	1.000	Disabled
Discard Rate > Rising Medium	0.500	Disabled
Discard Rate Discard Rate > Rising Low	0.000	Hidden
Discard Rate > Falling Low	0.000	Hidden
Discard Rate > Falling Medium	0.000	Hidden
Discard Rate > Falling High	0.000	Hidden

For each threshold, you can edit the following:

Value. The value at which the threshold will trigger an event.

For thresholds that include the word Rising, when a value exceeds the specified value, SL1 triggers an event.
For thresholds that include the word Falling, when a value falls below the specified value, SL1 triggers an event.
For thresholds that do not include the word Rising or Falling, when a value exceeds the specified value, SL1 triggers an event.

Status. Specifies whether the threshold is active and whether the threshold will appear in the Quality of Service (QoS) page (Registry > Networks > Quality of Service) page. Choices are:

Enabled. The threshold is applied to all CBQoS-enabled interfaces and is monitored by SL1. The threshold appears in the Quality of Service (QoS) page (Registry > Networks > Quality of Service). Users can edit the Value and Status of the threshold.

Disabled. The threshold is applied to all CBQoS-enabled interfaces but is not monitored by SL1. The threshold appears in the Quality of Service (QoS) page (Registry > Networks > Quality of Service) with a status of Disabled. In the Quality of Service (QoS) page), users can edit the Value and Status of the threshold.
Hidden. The threshold is not applied to all interfaces, and is not monitored by SL1. The threshold does not appear in the Quality of Service (QoS) page (Registry > Networks > Quality of Service).

Defining Interface Monitoring Policies and Thresholds

A monitoring policy for an interface tells SL1 how frequently to poll the interface for data and which data to collect. SL1 uses this collected data to generate bandwidth reports and trigger events.

NOTE: By default, SL1 monitors each discovered interface. By default, SL1 will poll the interface every 15 minutes, will not collect data on errors, will not collect data on discards, enables alerting, and allows SL1 to update the interface name during discovery.

There are two ways to define monitoring policies for interfaces:

Define a detailed policy for a single interface at a time.
Define a single policy setting for multiple interfaces at a time.

The following sections describe both methods.

Defining a Detailed Monitoring Policy for a Single Interface

To define a monitoring policy for one or more interfaces on a single device:

Go to the Device Manager page (Devices > Device Manager).
In the Device Manager page, find the device for which you want to define interface monitoring. Click its wrench icon ().
In the Device Administration panel, click the Interfaces tab.
In the Device Interfaces page, find the icon for the interface you want to monitor. Click on the icon.
The Interface Properties page appears. In this page, you can define a detailed monitoring policy for the selected interface.
To define a monitoring policy in the Interface Properties page, supply a value in each of the following fields in the Monitoring Options pane:

NOTE: For SL1 to monitor an interface, you must set Collect State to Enabled.

Interface Name. The name of the network interface. The auto-name, generated by SL1, is "device_name". You can supply a different name in this field.
Disable Discovery Name Update. When selected, prevents SL1 from updating and/or overwriting the interface name during auto-discovery.

In the Network Interfaces page (Registry > Networks > Interfaces), the option "Select Action > Auto-Name Update > Enable" will unselect the Disable Discovery Name Update field for each interface selected in the Network Interfaces page.

Interface Event Display Name. The name of the network interface that you want to appear in events.

NOTE: If Disable Discovery Name Update is selected for an interface in its Interface Properties page, SL1 cannot change the interface name during nightly auto-discovery and during re-discovery, regardless of the settings in the Interface Event Display Name field. To apply a new naming convention to interfaces, you must first ensure that Disable Discovery Name Update is not selected for those interfaces. You can do this in the Network Interfaces page (Registry > Networks > Interfaces): select the interfaces you want to rename, select the Select Actions field (in the lower right), and choose Auto-Name Update > Enable.

Interface Tags. Displays a comma-delimited list of descriptive tags that have been manually defined for this interface. Interface tags are used to group interfaces in an IT service policy. To add or edit the tags for this interface, click the wrench icon (). In the Edit Network Interface Tags modal that appears, supply a comma-delimited list of tags in the Tags field, and then click the Save button.
Interface Speed. The speed of the network interface reported by the device. If the device reported an incorrect speed, you can supply a different speed in this field. In the drop-down list to the right of this field, you can select the unit of measurement for the speed you specified.
Disable Interface Speed Update. When selected, prevents SL1 from updating and/or overwriting the interface speed during nightly auto-discovery.

In the Network Interfaces page (Registry > Networks > Interfaces), the option "Select Action > Interface Speed / Counter Type Update > Enable" will unselect the Disable Discovery Name Update field for each interface selected in the Network Interfaces page.

Linked Device. Device to associate with this interface. You can select from the drop-down list of all devices in SL1.
Linked Interface. Interface to be associated with this interface. You can select from a drop-down list of interfaces on the selected device (specified in the Linked Device field).

NOTE: The Linked Device and Linked Interface fields let you manually create relationships that will be reflected in the topology maps in the Views tab.

Collect State. This field can have one of two values:

Enabled: SL1 monitors the network interface and collects data on the network interface for reports.
Disabled: SL1 does not monitor the network interface and collect data on the network interface for reports.

Frequency. When you enable monitoring (collection) for an interface, you must specify how frequently you want SL1 to collect data from the interface. Your choices are every:

1 Minute
5 Minutes
10 Minutes
15 Minutes
30 Minutes
60 Minutes
120 Minutes

The Network Interface reports will display the average incoming and outgoing bandwidth-usage for the current day in the time-intervals specified in the Frequency field.

Alerting. Alerting for this interface can be enabled or disabled. When disabled, the interface is monitored, but internal collection events are not generated for the interface.
Rollovers. Specifies whether or not SL1 will generate an event when the counter for the interface rolls over. This field does not affect the Network Usage graphs. This field is most helpful for interfaces that are busy and require frequent monitoring, but for which the device supports only 32-bit counters (instead of 64-bit counters). The counters on such interfaces roll over frequently.

NOTE: Rollovers and alerting for Rollovers apply only to 32-bit counters and not to 64-bit counters.

Event Severity Adjust. Allows you to specify a severity for this interface. You can then configure one or more interface events to use this custom severity when creating events for this interface. For example, if this interface is part of a mission-critical operation, you might want all events associated with this interface to have a severity of "critical". Choices are:

Sev -3. Reduces the severity by 3.
Sev -2. Reduces the severity by 2.
Sev -1. Reduces the severity by 1.
Default Severity. Uses the default severity for each event.
Sev +1. Increases the severity by 1.
Sev +2. Increases the severity by 2.
Sev +3. Increases the severity by 3. The highest possible severity is "Critical".

Errors. Specifies whether or not SL1 will collect data on packet errors on the interface. Packet errors occur when packets are lost due to hardware problems such as breaks in the network or faulty adapter hardware. Choices are:

Enabled. If Errors is enabled for an interface, the Thresholds tab for the interface will display thresholds for errors in and errors out. If Errors is enabled for an interface, SL1 will display the collected data in the Device Performance page (Registry > Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface.
Disabled. SL1 will not collect data about errors for this interface.

Discards. Specifies whether or not SL1 will collect data on interface discards. Discards occur when an interface receives more traffic than it can handle (either a very large message or many messages simultaneously). Discards can also occur when an interface has been specifically configured to discard. For example, a user might configure a router's interface to discard packets from a non-authorized IP. Choices are:

Enabled. If Discards is enabled for an interface, the Thresholds tab for the interface will display thresholds for discards in and discards out. If Discards is enabled for an interface, SL1 will display the collected data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface.
Disabled. SL1 will not collect data about discards this interface.

Quality of Service. Specifies whether SL1 will collect CBQoS (Class-Based Quality-of-Service) configuration data for this interface. This option appears only if you have enabled the field Enable CBQoS Collection in the Behavior Settings page (System > Settings > Behavior). If Collect CBQoS is enabled for an interface, SL1 will display the collected CBQoS data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface. Choices are:

Enable. SL1 will collect CBQoS configuration data for this interface.
Disable. SL1 will not collect CBQoS configuration data for this interface.

NOTE: If you set Collect CBQoS to Enable for an interface that is not configured for CBQoS, SL1 will display an error message. For more information about CBQoS, see the section on Class-Based Quality of Service (CBQoS).

Packets. Specifies whether SL1 will collect data for unicast, multicast, and broadcast traffic in packets, for this interface. Choices are:

Enabled. If Packets is enabled for an interface, the Thresholds tab for the interface will display thresholds for unicast, multicast, and broadcast traffic. If Packets is enabled for an interface, SL1 will display the collected data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface.

Disabled. SL1 will not collect data for unicast, multicast, and broadcast traffic, in packets, for this interface.

Measurement. Unit of measurement for bandwidth reports for the interface. The choices are:

Mega
Giga
Kilo
Tera
Peta

Percentile. The basis for bandwidth billing for this interface. The choices are:

Accumulative. Customer is billed for total inbound and outbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.
Inbound. Customer is billed for the total inbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.

Outbound. Customer is billed for the total outbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.
Highest Poll. Customer is billed for either the total inbound or total outbound, whichever is highest, for each applicable interface. Billing is at the specified percentile point.

Display on Summary. If selected, a usage graph for this interface will appear in the Device Summary page.

NOTE: Only one interface per device can be displayed on the Device Summary page.

Emissary. Select an organization from the list to enable all users in that organization to view this interface. The members of the selected organization will be able to view reports about the interface, include the interface in dashboards, and view bandwidth billing policies associated with the interface.

Click Save.

Defining Thresholds for a Single Interface

The Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon) allows you to define custom thresholds for the monitored interface. If you have specified that SL1 should monitor an interface, SL1 will collect data about the interface and also monitor performance thresholds for the interface. SL1 will use either the global thresholds defined in the Interface Thresholds Defaults page (System > Settings > Thresholds > Interface or the custom threshold you define for a specific interface in the Thresholds tab. When the values for an interface exceed one or more thresholds, SL1 will generate an event.

NOTE: The thresholds defined in the Interface Thresholds Defaults page (System > Settings > Thresholds > Interface) determine which thresholds will appear in this page. For a list of all possible thresholds that can appear in this page, see the section on Global Settings that Affect Interfaces.

NOTE: The thresholds defined for a specific interface in the Thresholds tab on the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon) override the global thresholds defined in the Interface Thresholds Defaults page (System > Settings > Thresholds > Interface.

To define custom thresholds for an interface:

Go to the Device Manager page (Devices > Device Manager).
In the Device Manager page, find the device for which you want to define custom interface thresholds. Click its wrench icon ().
In the Device Administration panel, click the Interfaces tab.
In the Device Interfaces page, find the interface you want to monitor and click its icon. The Interface Properties page appears.
Click the Thresholds tab.
The following global thresholds are defined in the Interface Thresholds Defaults page (System > Settings > Thresholds > Interface) and also appear in the Thresholds tab:

NOTE: You can specify the unit of measure for all the metrics in Bandwidth In and Bandwidth Out. You can select bps, kbps, Mbps (the default), or Gbps.

Threshold	Default Value	Default Status
Utilization % In > Inbound Percent	65.000	Enabled
Utilization % Out > Outbound Percent	65.000	Enabled
Bandwidth In > Inbound Bandwidth	0.000	Disabled
Bandwidth Out > Outbound Bandwidth	0.000	Disabled
Errors % In > Inbound Error Percent	1.000	Enabled
Errors % Out > Outbound Error Percent	1.000	Enabled
Errors In > Inbound Errors	1000.000	Enabled
Errors Out > Outbound Errors	1000.000	Enabled
Discard % In > Inbound Discard Percent	1.000	Enabled
Discards % Out > Outbound Discard Percent	1.000	Enabled
Discards In > Inbound Discards	1000.000	Enabled
Discards Out > Outbound Discards	1000.000	Enabled
Multicast % In > Rising Medium	30.000	Disabled
Multicast % In > Rising Low	20.000	Disabled
Broadcast % Out > Rising Medium	30.000	Disabled
Broadcast % Out > Rising Low	20.000	Disabled

NOTE: To edit thresholds for errors in and errors out, you must enable Errors in the Properties tab for the interface. To edit thresholds for discards, you must enable Discards in the Properties tab for the interface. To edit thresholds for unicast, multicast, and broadcast traffic, you must enable Packets in the Properties tab for the interface.

For each threshold in the Thresholds tab, you can edit the following:

Value. The value at which the threshold will trigger an event.

For thresholds that include the word Rising, when a value exceeds the specified value, SL1 triggers an event.
For thresholds that include the word Falling, when a value falls below the specified value, SL1 triggers an event.
For thresholds that do not include the word Rising or Falling, when a value exceeds the specified value, SL1 triggers an event.

Status. Specifies whether the threshold is active and whether the threshold will appear in the Thresholds tab of the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon). Choices are:

Enabled. The threshold is applied to the interface and is monitored by SL1.
Disabled. The threshold appears in the Thresholds tab but it not monitored by SL1.

Unit of Measure. For all the metrics under Bandwidth In and Bandwidth Out, you can edit the unit of measure. Choices are:

bps
kbps
Mbps
Gbps

Defining Monitoring Settings for Multiple Interfaces

In the Network Interfaces page, the Select Actions drop-down menu (in the lower right corner of the page) allows you to apply or change the monitoring settings for one, multiple, or all interfaces in the Network Interfaces page.

To apply a monitoring option to one or more interfaces:

Go to the Network Interfaces page (Registry > Networks > Interfaces).
In the Network Interfaces page, find each interface to which you want to apply a monitoring option and select its checkbox.

To select all checkboxes, select the red checkbox icon () in the column heading.

In the Select Action drop-down, select the option you want to apply to the checked interfaces. Your choices are:

Report Measurement. Unit of measurement for bandwidth reports for the interface. The choices are:

Mega
Giga
Kilo
Tera
Peta

Interface Alerting. Specifies whether or not internal collection events should be generated for the selected interfaces. Choices are:

Enabled. SL1 monitors the network interface and generates internal collection events when the required conditions are met.
Disabled. SL1 monitors the network interface, but internal collection events are not generated for the interface.

Rollover Alerting. This checkbox is for interfaces that are busy and require frequent monitoring, but for which the device supports only 32-bit counters (instead of 64-bit counters). The counters on such interfaces roll over frequently. If enabled, each time the counter rolls over (is set back to zero), SL1 will generate an event. Choices are:

Enabled. SL1 monitors the network interface and generates an event when the counter rolls over and is reset to zero.
Disabled. SL1 monitors the network interface, but does not generate an event when the counter rolls over and is reset to zero.

NOTE: Rollovers and Rollover Alerting apply only to 32-bit counters and not to 64-bit counters.

Auto-Name Update. Specifies whether or not events should be generated for the selected interfaces. Choices are:

Enable. Allows nightly auto-discovery to update the interface name of each selected interface. For each interface selected in the Network Interfaces page, the Disable Discovery Name Update fieldfield will be unselected in the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).
Disable. Does not allow nightly auto-discovery to update the interface name of each selected interface. For each interface selected in the Network Interfaces page, the Disable Discovery Name Update field will be selected in the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).

Tags. For each interface in SL1, you can manually define a comma-delimited list of descriptive tags. Interface tags are used to group interfaces in an IT service policy. The following options allow you to manage interface tags:

Clear all Tags. Removes all existing tags from the selected interfaces.
Remove Tags. Displays the Bulk Remove Network Interface Tags modal, where you can remove one or more tags from the selected interfaces. In the Bulk Remove Network Interface Tags modal, select the checkbox for each tag that you want to remove, and then click the Remove button.
Add Tags. Displays the Bulk Add Network Interface Tags modal, where you can add one or more tags to the selected interfaces. In the Bulk Add Network Interface Tags modal, select the checkbox for each existing tag that you want to add and/or supply a comma-delimited list of new tags, and then click the Save button.

Collection Frequency. When you define a monitoring policy for an interface, you must specify how frequently you want SL1 to collect data from the interface. Your choices are every:

1 Minute
5 Minutes
10 Minutes
15 Minutes
30 Minutes
60 Minutes
120 Minutes

Collection State. Specifies whether collection should be active or disabled. Choices are:

Enabled. SL1 monitors the network interface and collects data on the network interface for reports.
Disabled. SL1 does not monitor the network interface and collect data on the network interface for reports.

NOTE: For SL1 to monitor an interface, you must define Collect State as enabled.

Collection Errors. Specifies whether or not SL1 will collect data on packet errors on the interface. Packet errors occur when packets are lost due to hardware problems such as breaks in the network or faulty adapter hardware. Choices are:

Enabled. SL1 will collect data on packet errors that occur on the interface.
Disabled. SL1 will not collect data on packet errors that occur on the interface.

Collection Discards. Specifies whether or not SL1 will collect data on interface discards. Discards occur when an interface receives more traffic than it can handle (either a very large message or many messages simultaneously). Discards can also occur when an interface has been specifically configured to discard. For example, a user might configure a router's interface to discard packets from a non-authorized IP. Choices are:

Enabled. SL1 will collect data on packet discards that occur on the interface.
Disabled. SL1 will not collect data on packet discards that occur on the interface.

Collect CBQoS. Specifies whether SL1 will collect CBQoS (Class-Based Quality-of-Service) data for this interface. This option appears only you have enabled the field Enable CBQoS Collection in the Behavior Settings page (System > Settings > Behavior). If Collect CBQoS is enabled for an interface, SL1 will display the collected CBQoS data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) for the device that contains this interface. Choices are:

Enable. SL1 will collect CBQoS data for this interface.
Disable. SL1 will not collect CBQoS data for this interface.

NOTE: If you set Collect CBQoS to Enable for an interface that is not configured for CBQoS,SL1 will display an error message.

Packets. Specifies whether SL1 will collect data for unicast, multicast, and broadcast traffic, in packets, for this interface. If Collect Packets is enabled for an interface, SL1 will display the collected data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface. Choices are:

Enabled . SL1 will collect data for unicast, multicast, and broadcast traffic, in packets, for this interface.
Disabled. SL1 will not collect data for unicast, multicast, and broadcast traffic, in packets, for this interface.

Collection Counter Setting. Specifies whether the interface uses a 32-bit counter or a 64-bit counter to measure bandwidth on the interface. During auto-discovery, SL1 automatically discovers which type of counter is associated with each interface. A 32-bit counter will roll-over (restart at 0) after about four billion octets (bytes) have passed through the interface. A 64-bit counter will roll-over after 1.85 x 1016 octets (bytes) have passed through the interface. Most high-speed interfaces use a 64-bit counter to measure bandwidth on the interface. If a 64-bit counter is available, SL1 will use it by default. Choices are:

Counter 32. Specify that the interface uses a 32-bit counter.
Counter 64. Specify that the interface uses a 64-bit counter.

Interface Speed / Counter Type Update. Specifies whether SL1 can update or over-write the interface name during nightly auto-discovery. This field also specifies whether nightly auto-discovery can update the interface speed and counter type of an interface. Options are:

Enable. Allows nightly auto-discovery to update the interface speed and counter type of each selected interface. For each interface selected in the Network Interfaces page, the Disable Interface Speed Update field will be unselected in the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).
Disable. Does not allow nightly auto-discovery to update the interface speed and counter type of each selected interface. For each interface selected in the Network Interfaces page, the Disable Interface Speed Update field will be selected in the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon).

Percentile Factor. Many service providers use a percentile bandwidth measure when billing customers for bandwidth usage. In this field, you can select the percentile factor, and SL1 will perform the calculations for you at billing time. For example, if a provider chose the percentile factor "95", SL1 would collect bandwidth data every 5 minutes for an entire month. At billing time, the highest 5% of readings are dropped. The customer is charged for the 95% highest reading. This prevents customers from being billed for unusual spikes. Choices are:

100% - 1%, in increments of 1%.

Event Severity Adjust. Allows you to specify a severity for this interface. You can then configure one or more interface events to use this custom severity when creating events for this interface. For example, if this interface is part of a mission critical operation, you might want all events associated with this interface to have a severity of "critical". Choices are:

Sev -3. Reduces the severity by 3.
Sev -2. Reduces the severity by 2.
Sev -1. Reduces the severity by 1.
Default Severity. Uses the default severity for each event.
Sev +1. Increases the severity by 1.
Sev +2. Increases the severity by 2.
Sev +3. Increases the severity by 3. The highest possible severity is "Critical".

NOTE: Event severities have the following numeric values:

5 = Healthy
4 = Notice
3 = Minor
2 = Major
1 = Critical

In the Event Severity Adjust field, you cannot change a severity of "Notice" or higher to a severity of "Healthy". In the Event Severity Adjust field, you also cannot change the severity of a "Healthy" event.

Click the Go button.
You can repeat these steps to change another monitoring option for the selected interface or for a different group of interfaces.

Class-Based Quality of Service (CBQoS)

Class-Based Quality of Service (CBQoS) is a Cisco technology, available on Cisco devices. CBQoS allows you to manage and prioritize network traffic. SL1 can retrieve configuration information about CBQoS from Cisco devices that are configured to use CBQoS.

To collect CBQoS data about an interface, you must enable CBQoS monitoring in two places in SL1:

In the Behavior Settings page (System > Settings > Behavior), enable the field Enable CBQoS Collection. This setting allows SL1 to collect configuration data from interfaces that are configured for CBQoS. SL1 will check for new CBQoS interfaces during initial discovery, during manual discovery, and once a day when the process Data Collection: CBQoS Inventory runs.

In the Network Interfaces page (Registry > Networks > Interfaces) or the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon, enable CBQoS reporting for each interface for which you want to view CBQoS data. This setting allows SL1 to collect performance data for interfaces that are configured for CBQoS and generate performance graphs for those interfaces.

You must enable CBQoS for the SL1 System and also for each interface.

If both settings are enabled, the SL1 System will display the collected CBQoS configuration data in the reports in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) for the device that contains this interface.

Viewing the List of Discovered CBQoS Objects

The Quality of Service (QoS) page displays a list of all Class-Based Quality of Service (CBQoS) classes and policies that are aligned with devices and interfaces discovered by SL1.

SL1 collects CBQoS data only if you have enabled the field Enable CBQoS Collection in the Behavior Settings page (System > Settings > Behavior).

If Quality of Service is enabled for an interface in the Interface Properties page (Registry > Networks > Interfaces > interface wrench icon), SL1 will display:

graphs about the collected CBQoS data in the Device Performance page (Devices > Device Manager > bar-graph icon > Performance) associated with the device that contains this interface.
a list all CBQoS classes and policies that are aligned with the interface in the Quality of Service (QoS) page (Registry > Networks > Quality of Service).

To view the list of all CBQoS classes and policies that are aligned with devices and interfaces discovered by SL1:

Go to the Quality of Service (QoS) page (Registry > Networks > Quality of Service).

The Quality of Service (QoS) page displays the following for each QoS object:

TIP: To sort the list of QoS objects, click on a column heading. The list will be sorted by the column value, in ascending order. To sort by descending order, click the column heading again.

Quality of Service Object. Name of the CBQoS class or policy. Can be the name of a class map, policing policy, sets policy, match statement, queuing policy, traffic shaping policy, WRED policy, or RED value.

Index. Index value for the CBQoS object on a specific device. This value is generated by the CISCO-CLASS-BASED-QOS-MIB.
Policy. Name of the parent CBQoS policy.

Type. CBQoS object type. Possible values are:

ClassMap

MatchStatement
Policing
PolicyMap
Queuing
REDValue
Set
TrafficShaping
WRED

Device Name. Name of the device where SL1 found the CBQoS object.
IF Name. If applicable, name of the interface where SL1 found the CBQoS object.
IF Alias. If applicable, alias for the interface where SL1 found the CBQoS object.

Filtering the List of Quality of Service (QoS) Objects

You can filter the list on the Quality of Service (QoS) page by one or more parameters. Only CBQoS objects that meet all the filter criteria will be displayed in the Quality of Service (QoS) page.

To filter by parameter, enter text into the desired filter-while-you-type field. The Quality of Service (QoS) page searches for CBQoS objects that match the text, including partial matches. By default, the cursor is placed in the left-most filter-while-you-type field. You can use the <Tab> key or your mouse to move your cursor through the fields. The list is dynamically updated as you type. Text matches are not case-sensitive.

You can also use special characters to filter each parameter.

Filter the list by one or more of the following parameters:

Quality of Service Object. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects with a matching name.
Index. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects with a matching index value.
Policy. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects aligned with a matching policy.
Type. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects of the specified type.
Device Name. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects aligned with the specified device.
IF Name. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects aligned with the specified interface name.
IF Alias. You can enter text to match, including special characters, and the Quality of Service (QoS) page will display only CBQoS objects aligned with the specified interface alias.

Editing Thresholds for a Quality of Service (QoS) Object

From the Quality of Service (QoS) page (Registry > Networks > Quality of Service), you can access the Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon) and edit the thresholds for a CBQoS object. The threshold will apply to that specific CBQoS object on a specific device and specific interface.

NOTE: The thresholds defined in the Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service) determine which thresholds will appear in Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon. For a list of all possible thresholds that can appear in this page, see the section on Global Settings that Affect Interfaces.

NOTE: The thresholds defined in the Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon) for a specific interface override the global thresholds defined in the Quality of Service Threshold Defaults page (System > Settings > Thresholds > Quality of Service).

To edit the interface thresholds for a CBQoS object on a specific device and specific interface:

Go to the Quality of Service (QoS) page (Registry > Networks > Quality of Service).

Find the CBQoS object for which you want to edit interface thresholds.

Click the wrench icon (). The Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon) appears.

On this page, you can edit one or more thresholds, which are applied to the interfaces aligned with the CBQoS object. SL1 examines the thresholds in the Quality of Service Object Thresholds page and generates events when the thresholds are exceeded.

NOTE: The thresholds defined in the Quality of Service Object Thresholds page (System > Settings > Thresholds > Quality of Service) determine which thresholds will appear in this page. For a list of all possible thresholds that can appear in this page, see the section on Global Settings that Affect Interfaces.

The following global thresholds are defined in the Quality of Service Object Thresholds page (System > Settings > Thresholds > Quality of Service and also appear in the Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon):

Threshold	Default Value	Default Status
Drop Rate > Rising High	1.000	Disabled
Drop Rate > Rising Medium	0.500	Disabled
Violation Rate > Rising High	1.000	Disabled
Violation Rate > Rising Medium	0.500	Disabled
Pre-Policy Inbound Utilization % > Rising High	60.000	Disabled
Pre-Policy Inbound Utilization % > Rising Medium	40.000	Disabled
Pre-Policy Outbound Utilization % > Rising High	60.000	Disabled
Pre-Policy Outbound Utilization % > Rising Medium	40.000	Disabled
Discard Rate > Rising High	1.000	Disabled
Discard Rate > Rising Medium	0.500	Disabled

For each threshold in the Thresholds tab, you can edit the following:

Value. The value at which the threshold will trigger an event.

For thresholds that include the word Rising, when a value exceeds the specified value, SL1 triggers an event.
For thresholds that include the word Falling, when a value falls below the specified value, SL1 triggers an event.
For thresholds that do not include the word Rising or Falling, when a value exceeds the specified value, SL1 triggers an event.

Status. Specifies whether the threshold is active. Choices are:

Enabled. The threshold is applied to the interface and is monitored by SL1.
Disabled. The threshold appears in the Quality of Service Object Thresholds page (Registry > Network > Quality of Service (QoS) > wrench icon) but it not monitored by SL1.

Concurrent Network Interface Collection

The standard network interface collection process uses the SL1 SNMP API to collect data directly from interfaces, one device at a time. Because this data is collected in a serial fashion, any issue or delay in collecting metrics can have a domino effect. For this reason, you should monitor no more than 10,000 interfaces per SL1 Data Collector using this standard interface collection process.

However, to increase the scale at which you can collect data for network interfaces, you can enable Concurrent Network Interface Collection. Concurrent network interface collection uses asynchronous SNMP collection for all network interfaces. This provides better scalability for large networks by allowing multiple collection tasks to run at the same time with a reduced load on Data Collectors.

With concurrent network interface collection, SL1 can run thousands of SNMP collection tasks in parallel and wait for the results to be returned independently. A single failed task will not prevent other tasks from completing. Therefore, there is no recommended limit to the number of interfaces you can monitor per Data Collector with concurrent network interface collection enabled.

Because concurrent network interface collection requires each Data Collector to do additional work, you should consider device latency when determining whether to enable concurrent network interface collection. Generally speaking, if your device latencies are under 10 ms, then legacy network interface collection will likely outperform concurrent collection across vital key performance measures such as CPU, memory utilization, and elapsed time.

Concurrent network interface collection is not available in military unique deployments (MUD) or STIG-compliant deployments.

Enabling Concurrent Network Interface Collection for All Interfaces

This feature is disabled by default.

Concurrent network interface collection is not available in military unique deployments (MUD) or STIG-compliant deployments.

To enable concurrent network interface collection for all interfaces:

Go to the Behavior Settings page (System > Settings > Behavior).
Select the Enable Concurrent Network Interface Collection checkbox.

If the "Data Collection: SNMP Collector" process is disabled on the Process Manager page (System > Settings > Admin Processes), this concurrent network interface collection option is disabled.

Click Save.

Configuring Concurrent Network Interface Collection for a Collector Group

You can enable or disable concurrent network interface collection for individual collector groups. When you do so, this setting overrides the global setting for concurrent network interface collection for the selected collector group.

Concurrent network interface collection is not available in military unique deployments (MUD) or STIG-compliant deployments.

To configure concurrent network interface collection for a collector group:

Go to the Collector Groups page (Manage > Collector Groups).
Click the Actions icon () of the collector group you want to edit and then select Edit. The Edit Collector Group modal appears.
Select an option in the Concurrent Network Interface Collection field:

Use Systemwide Default. The collector group will use the global settings for concurrent network interface collection that has been configured on the Behavior Settings page (System > Settings > Behavior).
Enabled. Concurrent network interface collection is enabled on this collector group regardless of the global setting on the Behavior Settings page.
Disabled. Concurrent network interface collection is disabled on this collector group regardless of the global setting on the Behavior Settings page.

If the "Data Collection: SNMP Collector" process is disabled on the Process Manager page (System > Settings > Admin Processes), this concurrent network interface collection option is disabled.

Click Save.

Configuring Concurrent Network Interface Collection for a Collector Group in the Classic SL1 User Interface

You can enable or disable concurrent network interface collection for individual collector groups in the classic SL1 user interface on the Collector Group Management page (System > Settings > Collector Groups). When you do so, this setting overrides the global setting for concurrent network interface collection for the selected collector group.

Concurrent network interface collection is not available in military unique deployments (MUD) or STIG-compliant deployments.

To configure concurrent network interface collection for a collector group:

Go to the Collector Group Management page (System > Settings > Collector Groups).
Click the wrench icon () for the collector group you want to edit. The fields at the top of the page are updated with the data for that collector group.
Select an option in the Enable Concurrent Network Interface Collection field:
- Use system-wide default. Select this option if you want this collector group to use or not use concurrent network interface collection based on the Enable Concurrent Network Interface Collection field on the Behavior Settings page (System > Settings > Behavior). This is the default.
- Yes. Select this option to enable concurrent network interface collection for this collector group, even if you did not enable it on the Behavior Settings page.
- No. Select this option to prevent this collector group from using concurrent network interface collection, even if you did enable it on the Behavior Settings page.
If the "Data Collection: SNMP Collector" process is disabled on the Process Manager page (System > Settings > Admin Processes), this concurrent network interface collection option is disabled.
Click Save.

Additional Configuration for Concurrent Network Interface Collection

There are several configuration settings that can affect the concurrent network interface collection performance.

By default, the asynchronous SNMP service will send a single SNMP OID per PDU request. While asynchronous collection will generally perform well without it, you can improve your chances of better performance by packing more than one SNMP OID in a PDU.

Several methods for doing so are described below.

Enabling PDU Packing

You can enable the asynchronous SNMP service to pack up to five OIDs into a single PDU by enabling PDU packing in SNMP-enabled device classes.

To do so:

Go to the Device Class Editor page (System > Customize > Device Classes).
Click the wrench icon () for the SNMP-enabled device class that you want to edit. The fields at the top of the page are updated with the properties for that device class.
Select the PDU Packing checkbox.
Click Save.

Increasing the Maximum Number of PDUs in a Single SNMP Request

When an SNMP device class has PDU packing enabled, the default maximum number of OIDs that the asynchronous SNMP service will pack up into a single PDU is five. However, you can change the maximum number of PDUs that are packed into a single SNMP GET request by editing the GETMULTI_CHUNK_SIZE value in the /opt/em7/services/snmp_collector/snmp_collector_shared.env file.

To set the maximum number of PDUs in a single SNMP request:

Either go to the console of the SL1 server or use SSH to access the SL1 appliance.
Log in as user em7admin.
At the command line, use the vi editor to edit the SNMP collector file for one of the SNMP collectors (containers) on your Data Collector:
- sudo vi /opt/em7/services/snmp_collector/snmp_collector_shared.env, to set the value across all service replicas on the Data Collector and for all devices with PDU packing enabled.
- sudo vi /opt/em7/services/snmp_collector/snmp_collector<collector_number>.env, where you replace <collector_number> with the number of the container, to set the value over an individual service replica's PDU packing limit.

If you set the value across all service replicas, then you cannot customize the GETMULTI_CHUNK_SIZE setting per device. On the other hand, if you set the value for an individual service replica, you cannot control which device uses which PDU packing limit.

Edit the value for the GETMULTI_CHUNK_SIZE setting to represent the maximum number of PDUs you want the asynchronous SNMP service to pack into a single SNMP GET request. This value must be an integer. The default value is 5.
Optionally, you can update the USE_GETMULTI setting to True to pack multiple PDUs into a single SNMP GET request for all devices, regardless of the PDU Packing setting for each device class. The default value is False, which causes the service to consider the PDU Packing setting for each device class.
Save your changes and exit the file (:wq).

Troubleshooting Concurrent Network Interface Collection

For information about troubleshooting concurrent network interface collection, which uses asynchronous SNMP collection, see the section on Troubleshooting Concurrent SNMP Collection.

Viewing Performance Graphs and Reports About Interfaces

SL1 enables you to view a number of performance graphs and generate text-based reports about interfaces.

The following sections describe how to generate the text-based reports that are available for interfaces.

For information about interface performance graphs, see the section on Viewing Performance Graphs.

Generating a Report for a Single Network Interface

From the Network Interfaces page, you can generate a text-based, bandwidth-usage report for a single interface. You can choose to generate a report on outbound traffic, inbound traffic, all traffic, errors, discards, or all.

To generate the report:

Go to Network Interfaces (Registry > Networks > Interfaces).
In the Network Interfaces page, find the interface for which you want to generate a bandwidth report. Click its printer icon (). The Report Creator modal page is displayed.
Select from the following list of formats to select a format in which to generate the report:

Create Report as HTML Document
Create Report as PDF Document
Create Report as MS Word Document
Create Report as MS Excel Document
CSV - Comma Separated Values

Select one of the following buttons to specify the information to include in the device report:

Full Report. Include all information about outbound data through the interface, inbound data through the interface, combined bandwidth through the interface, errors on the interface, and discards on the interface.
Outbound. Include all information about outbound data through the interface.
Inbound. Include all information about inbound data through the interface.
Usage. Include all information about inbound data and outbound data through the interface.
Errors. Include all information about errors on the interface.
Discards. Include all information about discards on the interface.

SL1 will generate the report. You can immediately view the report or save it to your local computer.

Generating a Report for Multiple Network Interfaces

On the Network Interfaces page (Registry > Networks > Interfaces) you can generate a report on all, multiple, or a single interface in SL1. The report will contain all the information displayed in the Network Interfaces page.

To view a report on all or multiple discovered interfaces:

Go to the Network Interfaces page (Registry > Networks > Interfaces).

NOTE: If you want to include only certain interfaces in the report, use the "search as you type" fields at the top of each column. You can filter the list by one or more column headings. You can then click the Report button, and only the interfaces displayed in the Network Interfaces page will appear in the report.
Click the Report button. The Export current view as a report modal page appears.
Select the format in which SL1 will generate the report. Your choices are:

Acrobat document (.pdf)
Web page (.html)
Excel spreadsheet (.xlsx)
OpenDocument Spreadsheet (.ods)
Comma-separated values (.csv)

Click the Generate button. The report will contain all the information displayed in the Network Interfaces page. You can immediately view the report or save it to a file for later viewing.