net surveillance

[HEMA1]

Does any one have any experience (that you want to share :-) ) creating triggers for net surveillance like:

net.if.in[eth0,bytes]
net.if.collisions[eth0]
net.if.in[eth0,dropped]


TNX
Hema1

[nelsonab]

If you can, try and get the drop and collision stats at the switch. You should ideally never see collisions or dropped packets in a full duplex packet switched network. Thus you can safely set a trigger to something like host:if.x.collisisions.last(300)>0. If you are unfortunate enough to be in a half duplex then you'll want to pay closer attention to dropped packets. Either way dropped packets can help alert you to a failed NIC or bad network.