2 questions about issues with monitoring and dashboard

ChrisR

I am going through the SNSA training program and have made some small changes on our NSa2650 to help me understand how the system works by monitoring the packets and using a a trace to view them. I have a basic "wrap capture buffer" monitor going so I can refer to something if I have complaints about the network. I started the capture last friday and monday morning our dashboard multi-core view was showing a much heavier load than normal. It was showing around 50% usage and normally it shows 1-3%, show the SNSA wanted the capture stopped. Right now it shows normal with it running but I am wondering why it starts using resources after the buffer is full.

My 2nd question is the dashboard view shows connections, what connections do these represent? I normally show 200-400, but if I open a web based yahoo mail session it will show 500-600 connections and slowly return back to the normal range. Am I reading this correctly? Is this normal? I have tried it a fgew times to be sure it was my doing and every time I open a yahoo mail page it shoots the connections up to over 500.

Thanks in advance for any help or documentation you can provide. 😎

BWC

Hi @ChrisR

I cannot tell you in that specific case why the CPU load went up on your NSa over time, but rule of tumb is do run the packet-monitor only for the time needed, maybe logging to FTP is better for "long-term". Packet-Monitor usually causes some extra load, probably in the wrap situation it's more heavy because it has to reorganize the buffer somehow.

Connections on a web page can raise rapidly because of the huge amount of resources who probably got loaded, for comparison open the developer tools of your browser and see how many connections are getting created, this should reflect somehow what you're seeing in the connections on your NSa.

Connections will stick there til they get a FIN or RST.

--Michael@BWC

ChrisR

Did I place this in the wrong section?

ChrisR

Awesome @Micheal. I starting monitoring because the SNSA test questions logging should be done at all times but the output isn't very useful from what I am seeing. Most of the time I get "Did you see an issue at X:XXPM?" It really only shows if a packet was dropped, or made it so I am still trying to find a better tool to monitor the connection to the ISP.

Thanks again for the help!