ill Series on
`
`HwmGCM
`
`001
`
`ServiceNow's Exhibit No. 1006
`
`

`

`HP OpenView:
`A Manager’s Guide
`
`Jill Huntington-Lee
`Kornel Terplan
`Jeffrey A. Gibson
`
`McGraw-Hill
`New York San Francisco Washington, D.C. Auckland Bogo‘lfi
`Caracas Lisbon London Madrid Mexico City Milan
`Montreal New Delhi San Juan Singapore
`Sydney Tokyo Toronto
`
`002
`
`ServiceNow's Exhibit No. 1006
`
`002
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Library of Congress Cataloging-in—Publication Data
`Huntington—Lee, Jill.
`HP’s OpenView : a manager’s guide / Jill Huntington-Lee, Kornel
`Terplan, Jeffrey A. Gibson
`p.
`cm. — (McGraw-Hill series on computer communications)
`Includes index.
`ISBN 0—07-031382—2
`3. TCP/IP
`2. OpenView.
`1. Computer networks—Management.
`(Computer network protocol)
`4. Clientfserver computing.
`1. Terplan, Kernel.
`11. Gibson, Jeffrey A.
`III. Title.
`IV. Series.
`TK5105.5.H86 1996
`005.7'13—dc21
`
`96-39021
`CIP
`
`McGraw~Hill
`
`£2
`
`A Division of The McGraw-Hifl Companies
`
`Copyright © 1997 by The McGraw-Hill Companies, Inc. All rights reserved. Printed in
`the United States of America. Except as permitted under the United States Copyright
`Act of 1976, no part of this publication may be reproduced or distributed in any form or
`by any means, or stored in a data base or retrieval system, without the prior written
`permission of the publisher.
`
`456789 DOC/DOC 90098
`
`ISBN 0—07-031382-2
`
`The sponsoring editor for this book was Steve Elliot, the editing supervisor was Sally
`Glover, and the production supervisor was Pamela Patton. This book was set in New
`Century Schoolbook. It was composed in Hightstown, N.J.
`
`Printed and bound by R. R. Donnelly & Sons Company.
`
`McGraw-Hill books are available at special quantity discounts to use as premiums
`and sales promotions, or for use in corporate training programs. For more information,
`please write to the Director of Special Sales, McGraw-Hill, 11 West 19th Street,
`New York, NY 10011. Or contact your local bookstore.
`
`Product or brand names used in this book may be trade names or trademarks. Where
`we believe that there may be proprietary claims to such trade names or trademarks,
`the name has been used with an initial capital or it has been capitalized in the style
`used by the name claimant. Regardless of the capitalization used, all such names have
`been used in an editorial manner without any intent to convey endorsement of or other
`affiliation with the name claimant. Neither the author nor the publisher intends to
`express any judgment as to the validity or legal status of any such proprietary claims.
`
`Information contained in this work has been obtained by McGraw—Hill from
`sources believed to be reliable. However, neither McGraw-Hill nor its authors
`guarantee the accuracy or completeness of any information published herein
`and neither McGraw-Hill nor its authors shall be responsible for any errors,
`omissions, or damages arising out of use of this information. This work is pub-
`lished with the understanding that McGraw-Hill and its authors are supply-
`ing information but are not attempting to render engineering or other
`professional services. If such services are required, the assistance of an appro-
`
`priate professional should be sought.
`
`003
`
`ServiceNow's Exhibit No. 1006
`
`003
`
`ServiceNow's Exhibit No. 1006
`
`

`

`___________—_______—
`
`Co nte nts
`
`Foreword xiii
`Introduction xv
`
`Part I Introduction
`
`Chapter 1. Why HP OpenView‘?
`
`The HP OpenView Product Set
`HP OpenView for Windows—Workgroup Node Manager
`HP OpenView Network Node Manager (NNM)
`NNM Competitors
`SunSoft Solstice Site Manager
`Cabletron Spectrum -
`Fault and Legacy System Managers
`Boole 8: Babbage Commanleost
`OSI NetExpeIt
`MAXIEnterprise
`HP OpenView Distributed Manager (DM)
`HP OpenView Systems Management Products
`The Growing Importance of Systems Management
`Summary
`
`Chapter 2. HP OpenView and Standards
`
`TCPIIP
`SNMPv1 and SNMPvZ
`HMON
`CMIP and TMN
`NMlForum OMNIPoint and Spirit
`DMTF
`lEEE Posix 1337.2
`Summary
`
`Part II Network Management
`
`Chapter 3. An Open Framework
`
`Gaps in OpenView Functionality
`Using Third-Party Applications to Fill the Gaps
`HP OpenView Certification Testing
`Integration between NNM, ITIOperations, MeasureWarefPeerlew, and
`lTIAdministration
`Operational and architectural integration
`Strategic integration
`
`1
`
`3
`
`4
`5
`9
`11
`12
`13
`14
`16
`17
`19
`20
`21
`23
`24
`
`25
`
`25
`31
`35
`37
`41
`43
`44
`44
`
`47
`
`49
`
`50
`53
`62
`
`63
`63
`64
`
`004
`
`ServiceNow's Exhibit No. 1006
`
`004
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Evolution toward Distributed Management
`Summary
`
`Chapter 4. Using HP OpenVlew Network Node Manager
`
`NNM Processes
`Background processes
`Foreground processes
`Network Discovery
`Network Mapping
`Loading MlBs
`M13 Browsing and Graphing
`Handling SNMP Traps
`SNMP Data Collection
`Processes and filters for distributed management
`Processes and filters for distributed discovery
`Topology Filter
`Map filters
`Persistence filters
`Orr-demand submaps
`Event Forwarding and Distributed Threshold Monitoring
`Summary
`
`Chapter 5. Data Collection Using HP OpenView
`
`Network Node Manager and Data Collection
`Node Auto-discovery
`Mapping
`Events, alarms, and traps
`Collecting SNMP MIB data
`Collecting non-IF data
`Remote Monitoring and Data Collection
`RMON
`HP Data Collectors
`HP Netmetrix
`HP LanProbes
`HP Power Agent
`
`HP Embedded Advanced Sampling Environment (EASE)
`Sampling segments
`Sampling devices
`HP EASE Servers
`EASE applications
`Collecting Data from Routers and Hubs
`Routers
`Hubs and concentrators
`Other devices
`Summary
`
`Chapter 6. Diagnosing Faults
`
`Introduction to the Fault Management Process
`Messages, events, and alarms
`Filtering
`
`HP OpenView as Focal Point for Diagnosing Faults
`Hub diagnostics applications
`
`55
`72
`
`75
`
`75
`75
`77
`77
`79
`60
`31
`81
`83
`64
`64
`86
`87
`87
`90
`90
`91
`
`93
`
`93
`94
`94
`94
`95
`96
`97
`97
`98
`99
`100
`160
`
`190
`102
`103
`104
`104
`107
`108
`108
`110
`116
`
`111
`
`111
`113
`115
`
`116
`116
`
`005
`
`ServiceNow's Exhibit No. 1006
`
`005
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Configuring local area networks using the hub
`Threshold alarms
`SNMP and RMON Support
`Using Expert Systems
`Unsolved questions with expert systems
`G2 real-time expert system
`FiTWorks from Talarian
`Summary
`
`Chapter 7. Fine-Tuning the Fault Management Process
`
`Management by Exception
`Adjusting Thresholds
`Policy-Based Management
`Thresholding with NerveCenter
`State diagram examples
`Feeding Results into Trouble Ticket Systems
`Summary
`
`Chapter 8. Analyzing Data
`
`The Importance of Baselining and Capacity Planning
`Automated Performance Reporting Tools
`Concord Communications' Network Health
`DeskTalk TRENDsnrnp+
`SEN StatsWise
`SAS CPE for Open Systems
`Product comparisons
`Capacity Planning
`Out-Tasking Alternatives
`Summary
`
`Chapter 9. Maintaining the Network
`
`Planning the Network for Effective Maintenance
`Planning the management system
`Planning the addressing and subnetting
`Choosing Management Tools
`Maintaining the CiientiServer Architecture
`Maintaining Network Elements
`Maintaining the router
`Cisco Systems: CiscoWorks
`Maintaining the network concentrator
`Bay Networks: Optivity 5.0
`ChipCom Corporation: ONdemand
`Maintaining SNA Environments
`Peregrine OpenSNA
`NeTech EView
`Maintaining DECnet Environments
`Ki Networks: DEC Network Manager
`Physical Layer Planning and Maintenance
`Accugraph: MT923
`ISICAD: COMMAND
`Summary
`
`122
`123
`124
`127
`127
`129
`132
`136
`
`137
`
`137
`139
`139
`140
`144
`146
`147
`
`149
`
`149
`150
`150
`151
`154
`155
`15?
`159
`161
`161
`
`163
`
`164
`1 64
`166
`166
`167
`167
`168
`166
`170
`171
`171
`172
`173
`174
`175
`175
`177
`177
`178
`179
`
`006 ServiceNow's Exhibit No. 1006
`
`006
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Chapter 10. Telecommunications Management
`
`New Requirements for the Management Framework
`Object orientation
`Expert analysis
`Standards and open systems
`Flapld deployment
`Current Status of Telecommunication Management Networks
`Operations Systems Functions (OSF)
`Workstation Function (WSF)
`Mediation Function (MF)
`Q Adapter Function (OAF)
`Capabilities of HP OpenVlew Distributed Management Products
`Public Switching System from Alcatel
`Managing PBXs with HP OpenView DM
`Managlng Wireless Networks with HP OpenView Element Management Framework
`(OEMF)
`Fault management
`Trouble-ticketing
`Performance management
`Graphical topology management
`Generic command facility
`Summary
`
`Part III Unix Systems Administration
`
`Chapter 11. Unix and NT Fault and Performance Management
`
`The HP OpenView Solution Framework
`An Introduction to Unix Fault and Performance Management
`
`HP leOperations
`Automation
`
`History and logging
`Customization and APIs
`An Overview of MeasureWarelPertView
`HP MeasureWare
`PertView
`Peeriew RX
`GlancePlus
`
`Summary
`
`Chapter 12. HP lTIAdministration
`
`”(Administration Concepts
`Objects
`Roles
`Domains
`Policies
`Modes
`
`Synchronization
`Queries
`
`Integration with HP OpenView NNM and Other Systems
`HP Software Distributor
`
`HP OpenView NNM
`Third-Party Applications
`ITIAdministration for Workgroups
`
`181
`
`181
`182
`182
`183
`184
`185
`186
`186
`186
`187
`190
`196
`198
`
`200
`203
`203
`203
`288
`288
`209
`
`211
`
`213
`
`213
`214
`
`218
`220
`
`221
`221
`223
`224
`224
`226
`227
`
`227
`
`229
`
`230
`230
`233
`235
`235
`235
`
`237
`237
`
`237
`237
`
`238
`238
`239
`
`007
`
`ServiceNow's Exhibit No. 1006
`
`007
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Competing Alternatives
`Summary
`
`Part IV Interconnected Workgroup Management
`
`Chapter 13. OpenView Workgroup Node Manager and Other HP Workgroup
`Products
`
`An Introduction to HP OpenView Workgroup Node Manager
`Using WNM
`Discovery
`SNMP polling and trap facilities
`Alarms
`Customization
`Registration
`
`ITIAdministration for Workgroups
`HP AssetView
`AssetView applications
`
`Agent Support for Workgroup Environments
`Summary
`
`Chapter 14. HP OpenView and Internet and intranet Management
`
`.
`
`Web Technology
`UFIL
`HTl'P
`HTML
`Web browsers
`
`HP’s lnternetllntranet Management Strategy
`Using ITIOperations for Internet Management
`Monitoring Web page availability with ITIOperations
`Tivoli’s Internetllntranet Management Strategy
`Products
`Third-Party Application Support
`Internet Management Standards
`Web-Enabling TME products
`Platinum Web Application Testing Tools
`Summary
`
`Part V HP OpenView Derivatives
`
`Chapter 15. IBM NetView for AIX (SystemView AIX)
`
`Introduction to NetView for AIX
`Product Overview: NetView for AIX
`Strengths
`Limitations
`Basic Platform Services of NetView for At):
`NetView for AIX Entry
`Value-Added Applications from IBM
`Intelligent Hub Manager for AIX
`Router and Bridge Manager for AIX
`Systems Monitor for AIX
`Performance Reporter for AIX
`
`239
`239
`
`241
`
`243
`
`243
`245
`245
`247
`247
`249
`250
`
`251
`252
`254
`
`256
`256
`
`261
`
`262
`262
`262
`263
`263
`
`264
`265
`266
`267
`267
`269
`269
`269
`270
`270
`
`273
`
`275
`
`275
`282
`263
`264
`264
`266
`266
`268
`269
`269
`296
`
`
`
`008 ServiceNow's Exhibit No. 1006
`
`008
`
`ServiceNow's Exhibit No. 1006
`
`

`

`NetView Distribution Manager (DM) for AIX
`Trouble Ticket for AIX
`
`AIX Systems Network Architecture Manager16000
`AIX LAN Mane ement Utilities for AIX
`LMU for GS!
`
`LAN Network Manager for AIX
`RMONitor for AIX
`NetVlew tor AIX Service Point
`TMN Workbenchlfioou
`
`Management Applications from Tlvoli
`Enterprise Management
`Summary
`
`Chapter 16. Digital Polycenter Manager on NetView
`
`Digital ValuewAdded Applications
`Path Doctor
`
`System Watchdog
`Console Manager
`FullSall
`HUBwatch
`
`DECnet Manager
`Digital Products for Windows and Windows NT Environments
`ManageWorks
`Polycenter AssetWorks (PAW)
`Summary
`
`Chapter 17. NCR OneVision and OperationsAdvantage; AT&T OneVision
`
`NCR OneVision Components
`OperationsAdvantage and Bundled Solutions
`Management Bundles
`Complementary Products for 0A 2.0
`NCFI management applications
`Third-party applications
`AT&T OneVision
`
`Architectural Platform for Telecommunications Management Development
`AT&T OneVision Overview
`Levels of integration
`Selected architecture features
`TMN Services
`
`Object services and object communication
`Summary
`
`Part VI Looking Ahead
`
`Chapter 18. Distributed Management and Data Integration
`
`Distributed Capabilities in Tornado Release ll (NNM 4.1)
`Event correlation and management
`Integrating network visualization
`Synchronization of databases
`HP MetaSchema
`
`Topology Schema
`Managed Objects Schema
`Historical Trend Schema
`
`Developments In Distributed Event Correlation: HP ECS
`Summary
`
`290
`291
`
`291
`
`292
`
`292
`292
`292
`293
`
`294
`295
`295
`
`297
`
`299
`299
`
`304
`304
`304
`305
`
`305
`306
`306
`307
`303
`
`309
`
`309
`310
`311
`313
`314
`317
`31 0
`
`319
`321
`321
`323
`326
`
`3215
`327
`
`329
`
`331
`
`332
`334
`338
`337
`333
`
`339
`341
`343
`
`343
`344
`
`009
`
`ServiceNow's Exhibit No. 1006
`
`009
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Chapter 19. Cost-Justifying HP OpenView
`
`The True Cost of HP OpenView
`Estimating Software Costs
`Estimating Hardware Costs
`How to estimate hardware costs
`
`Summary
`
`Chapter 20. The HP OpenView User’s Forum
`
`The Founding of the OpenView Forum
`HP OpenView Forum Conference
`
`1996 HP OpenView User’s Survey
`Customer perceptions of technical support
`Wish list of OpenView NNM enhancements
`User confidence in HP
`
`Summary
`
`Case Study 1: An ATM Network
`
`Remedy AR System
`SAS CPE for Open Systems
`
`Case Study 2: A Bridgelelouted IP, AppletTalk, DECnet Network
`
`CMU's Networking Philosophy
`CMU’s Network Management Applications
`
`Case Study 3: A Frame Relay Network
`
`Case Study 4: A Telecommunications Network
`
`Hardware Topologies of ALMAP
`
`ALMAP Services and Management Applications
`Managed Objects and SMF Services
`Management services and communication services
`Presentation services
`Distributed services
`Management services
`Operating system services
`Management applications
`Advantages of ALMAP and the Alcatel 1300 Product Family
`
`Appendix A. Acronyms
`
`Appendix B. Selected Vendors
`
`References
`
`Index
`
`347
`
`343
`349
`350
`351
`
`352
`
`355
`
`355
`356
`
`356
`356
`357
`360
`
`361
`
`363
`
`354
`366
`
`369
`
`370
`370
`
`373
`
`377
`
`37B
`
`379
`379
`382
`1383
`364
`385
`386
`386
`388
`
`391
`
`397
`
`403
`
`405
`
`
`
`010 ServiceNow's Exhibit No. 1006
`
`010
`
`ServiceNow's Exhibit No. 1006
`
`

`

`
`
`Chapter
`
`Data Collection Using HP
`OpenView
`
`Data collection is a broad term with many different connotations. There are as
`many different types of data collection as there are types of data. For our pur-
`poses, We define data collection as the logical and/or physical retrieval and
`storage of information on the network and/or network elements. Using this
`definition, we can examine the types of data that HP OpenView Network Node
`Manager (NNM) collects from the network. As we have seen in earlier chap-
`ters, NNM manages node status for TCP/IP networks. However, NNM also is
`the building block for management and data collection of other protocols and
`environments.
`
`In this chapter, we will focus on how NNM polls the network using SNMP
`for node discovery and topology changes, as well as for gathering current sta-
`tus of devices throughout the network. We will see how NNM uses SNMP to
`collect data for both IP and non-IP nodes. We also will see how remote moni-
`toring and segment—level data collections are supported. Finally, we will exam-
`ine how data is collected from various interconnect devices, and how the
`element manager applications for these interconnect devices aid NNM with
`device management.
`
`Network Node Manager and Data Collection
`
`HP OpenView NNM is a platform for configuration, fault, and performance
`management of TCP/IP networks. However, NNM can only provide these man-
`agement functions if the management system can communicate with network
`devices, and the devices include SNMP agents that are actively collecting data
`using the Management Information Bases (MIB, RFC 1212). The main func-
`tions of NNM are as follows:
`
`I Automatically discover network devices throughout the network.
`
`I Map these discovered devices in a logical layout.
`
`011
`
`ServiceNow's Exhibit No. 1006
`
`93
`
`011
`
`ServiceNow's Exhibit No. 1006
`
`

`

`94 Network Management
`
`I Regularly poll the devices to maintain information about their current oper-
`ating status.
`
`Node Auto-discovery
`
`Node auto-discovery is the process by which NNM collects information on the
`network devices, and automatically displays the devices in a logical map show-
`ing current operating status. Several factors are critical for auto-discovery to
`produce an accurate map. First, it is essential for the subnet mask to be cor-
`rect for the management station and the default gateway (router). Second, the
`default gateway must be configured correctly and support SNMP. Finally, in
`order for the network nodes to be discovered, the nodes must be able to
`
`respond to a ping request.
`Auto-discovery typically works best when there are many routers on the net-
`work and the routers are configured with SNMP agents. As we examine the
`details of the auto-discovery process, it is easy to understand why the routers
`are so important.
`As Chaps. 3 and 4 discuss, when NNM starts it launches a process called net-
`mon, which discovers nodes on the network. The netmon process is aided by a
`special file known as the seed file. The seed file is a manually created data file
`that consists of a list of network addresses, including the default router. After
`netmon discovers the default router, netmon uses information from the default
`routers” arp cache and route tables to discover additional nodes. Depending on
`the size of the network, auto-discovery can take up to 8 hours or more. After
`each node is discovered, it is placed on the map in its logical location.
`
`The NNM map is a collection of submaps arranged in a hierarchy from the
`root, or internetwork, to the networks, segments, nodes, and interfaces. For
`example, when an icon of an IP network is selected, it explodes into a submap
`showing the different segments on that network. This hierarchical view makes
`network navigation relatively easy and intuitive. The submaps are a collection
`of windows that contain common menu bars and a palette for displaying nodes
`(Fig. 5.1). The nodes are displayed as icons using shapes, symbols, and colors
`to display the network objects and their status.
`NNM uses the application IP Map to produce the map of the discovered
`nodes. This application combines the netmon process with the topology man-
`ager, ovtopmd, to update and display the network maps. IP Map automatical-
`1y loads when NNM starts and continually monitors the network, discovers
`new nodes, and automatically makes the necessary updates to the map.
`
`Mapping
`
`Events, alarms, and traps
`
`One of the most important features of NNM is the ability to alert the user
`when a problem occurs on the network by changing the colors of the node or
`nodes on the map. NNM accomplishes this by polling the SNMP agents of the
`
`012
`
`ServiceNow's Exhibit No. 1006
`
`012
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Data Collection Uslng HP OpenVlew 95
`
`5
`Map
`Monitor
`
`Edit. Locate
`Diagnose
`
`Root
`Performance
`Configuration
`View
`Administer Help
`
`Fault Misc
`
`Option
`
`IP Internet default [Head-Write]
`
`"IE
`
`Root [Auto-Layout]
`
`
`Figure 5.1 HP OpenView NNM Icons
`
`devices to determine their operating status. If there is a problem, or a given
`condition exists, the agent on the managed device generates an alarm. An
`alarm is a specific condition that occurs when a preset value of a particular
`MIB variable is exceeded. The alarm triggers an event, which in turn deter-
`mines the type and number of event notifications to send to the management
`station, as well as altering the color of the icon. A trap is an alarm sent from
`the SNMP agent to the manager, without an explicit request from the manag—
`er, when an error occurs or threshold exceeds.
`
`Collecting SNMP MIB data
`
`NNM contains predefined data-collection tools under the Options: Data
`Collection & Thresholds: SNMP... menu item. These data-collection tools
`allow you to collect MIB information from nodes at regular intervals and store
`the collected MIB data on the management station (RFC 1155). This type of
`data collection is useful in determining thresholds for a MIB variable that
`causes the generation of alarms, which in turn creates events that alert the
`user that a threshold has been exceeded. The prerequisites and requirements
`necessary for using the data-collection tools are as follows:
`
`I The node for which data is being collected must support SNMP.
`
`I The MIBs to be collected must be identified.
`
`013
`
`ServiceNow's Exhibit No. 1006
`
`E
`
`013
`
`ServiceNow's Exhibit No. 1006
`
`

`

`96 Network Management
`
`I The data collection, or threshold monitoring, may use only numeric MIB
`values. MIB objects can be Counter, Gauge INTEGER, IPAddress, and
`TimeTicks.
`
`l The enterprise-specific MIB for which data collection is to be performed
`must be loaded into the MIB database using the Option: Load! Unload
`MIBS menu item.
`
`I The managing system must have enough disk space to store the data col-
`lection.
`
`It is important to understand the purpose and definition of the MIB or
`MIBs being collected. Most MIBs have description fields that are available
`via the MIB Browser utility using the Describe button. One aspect of these
`data-collection tools that often is overlooked is that a collection using a short
`polling interval can fill up disk space rapidly. Be aware of all active data col-
`lections and gauge their disk usage.
`
`Collecting non-IP data
`The predefined collection tools described in the previous section are effective
`for IP devices, but What about collecting data on non-1P devices? This type of
`data is a little more difficult for NNM because it is designed for IP devices
`using SNMP. In order for these non-IP devices to be manageable, an SNMP
`MIB extension must be available. Fortunately NNM supports this type of non-
`IP data collection and management using the HP OpenView extensible SNMP
`
`Agent.
`The Extensible SNMP Agent is a superset of the HP OpenView TCP/IP
`Agent. The Extensible SNMP Agent supports MIB-II
`(RFC 1213), HP
`Enterprise-Specific MIBS, and custom user-defined MIB objects (Fig. 5-2).
`
`Non-SNMP
`Devices or
`Subsystems
`
`
`
`Agent
`
`
`
`
`Application
`Software
`
`
`
`
` Execute Command
`
`
`
`Manager
`
`
`snmp Requests FsnrnpFieplies Extensible I
`
`
`
`Agent
`I
`snmp Generic Traps
`
`
`Enterprise Specific Traps
`
`
`
`Figure 5.2 HP OpenView SNMP Extensible Agent
`
`Unattended
`
`System
`
`014
`
`ServiceNow's Exhibit No. 1006
`
`014
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Data Collection Using HP OpenVIew 97
`
`These custom MIB objects can include non-IP devices such as printers, appli-
`cations, databases, etc. Using the Extensible Agent, MIB objects can be
`added to the agent without programming by defining a MIB module using
`concise Abstract Syntax Notation One (ASN.1) format (ISO 8824), which
`extends the MIB already existing in the agent. For each object defined, a
`command or script executes when the agent receives an SNMP request for
`that object.
`Allowing non-1P, custom-defined objects to be managed via SNMP makes the
`Extensible SNMP Agent a powerful complement to the NNM environment.
`These custom objects can be used in conjunction with the Data Collector to col—
`lect and display non-IP data.
`
`Remote Monitoring and Data Collection
`
`The network is really a framework. For instance, from a top-down view there
`is the internetwork, which is made up of multiple networks. These networks
`consist of multiple segments, and each segment is made up of multiple nodes.
`NNM is fine for collecting data on individual nodes, but what about collecting
`data about the relationships of those nodes? Perhaps data collection is needed
`from the segments, monitoring the traffic between networks. As networks and
`internetworks become more and more geographically disbursed and distrib-
`uted, managing them becomes increasingly more difficult. The emerging solu-
`tion to this distributed network management problem is the Remote
`Monitoring Management Information Base (RMON MIB).(RFC 1271).
`
`RMON
`
`As Chap. 2 notes, RMON defines and standardizes the MIBs sent to and from
`devices known as segment monitors, or probes, which are deployed throughout
`the network (Fig. 5.3). The probes gather information for the segment to which
`they are attached and report back to the management system (i.e., NNM) via
`SNMP. The segment, either local or remote, is defined as the collection of
`nodes between bridges or switches, whereas the network is defined as the seg-
`ments or nodes between routers. One probe is required per segment.
`The Ethernet RMON MIB contains nine groups (the Token-Ring RMON MIB
`makes ten). Following is a brief summary of the nine groups (Miller 1993):
`
`I Statistics: Packet-based statistics, broadcasts, collisions, CRO errors, etc.
`
`I History: Periodic statistics samples over preset or user-defined time used for
`trending.
`
`I Alarms: Compare samples with preset thresholds generating alarms when
`threshold values are exceeded.
`
`l Host: Maintains host information including MAC address.
`
`I HostTopN: Provides host table statistics of various categories indicating
`host activity.
`
`015
`
`ServiceNow's Exhibit No. 1006
`
`015
`
`ServiceNow's Exhibit No. 1006
`
`

`

`98 Network Management
`
`Central Site
`
`HP LanProbe _
`
`HP LanProbe
`
`HP LanProbe
`
`Enterprise
`Management
`_
`Station
`Flunning
`HP NetMetrix
`
`Token Hing
`
`/Remow.Stes\
`
`HP LanProbe
`
`HP LanProbe
`
`Figure 5.3 HP LanProbe RMON Data Collectors
`
`I Matrix: Statistics on the traffic matrix tracking host-to-host conversations.
`
`l Filters: Allow packets to be filtered according to preset values.
`
`I Capture: Allows packets to be captured based on a filtered equation.
`
`I Events: Control generation and notification of events including SNMP trap
`messages and alarms.
`
`NNM can be used to browse the RMON MIBs and query the MIBS, but NNM
`does not include a built-in application to easily manage the RMON devices.
`Fortunately, HP developed the NetMetrix applications to integrate with NNM
`and provide this functionality.
`
`HP Data Collectors
`
`There are three HP tools that can be applied to the task of data collection: HP
`NetMetrix, HP LanProbes, and HP Power Agent. They are descibed in suc-
`ceeding paragraphs.
`
`O16
`
`ServiceNow's Exhibit No. 1006
`
`016
`
`ServiceNow's Exhibit No. 1006
`
`

`

`HP NetMetrix
`
`Data Collection Using HP OpenView 99
`
`HP Netmetrix is an integrated suite of applications providing comprehensive
`distributed monitoring and analysis using standards-based (RMON) data col-
`lectors. The applications are tightly integrated with the NNM platform and
`support Ethernet, Token-Ring, and FDDI. The NetMetrix suite consists of the
`following applications:
`
`I Enterprise utilities, which consist of historical statistics/baseline, automat-
`ed trending, reporting, alarms, node statistics, traffic matrix, RMON status,
`and Token-Ring RMON Extensions.
`
`I Load monitor, which provides graphical view of network traffic load by mul-
`tiple parameters including time, source nodes, destination nodes, protocol
`types, and packet sizes.
`
`I Internetwork monitor, which provides relational information on data from
`multisegment networks. Provides end-to—end analysis of network traffic
`within segments as well as traffic between routers.
`
`I Protocol analyzer, which provides packet filter and capture capability dis-
`playing detail, hexadecimal, and summary decodes. Supports real-time
`analysis as well as saved trace files to allow postprocessing.
`
`I NFS monitor, which measures the Network File System (NFS) traffic on the
`segment. Also provides measurements such as response times, rejects, and
`errors for both the NFS server and clients.
`
`I Traffic generator, which allows the generation of traffic in order to simulate
`a specific traffic pattern.
`
`The NetMetrix applications can be launched standalone without NNM. In
`the Standalone mode, applications are launched from a window called the
`Agent Toolbox. Each RMON device in the database is represented by a trian-
`gle. Standalone mode is useful for smaller networks, but is not recommended
`for larger networks because the mapping and event configuration that NNM
`provides are not available. The NetMetrix applications are much more effec—
`tive as a complement to NNM and together provide a powerful integrated net-
`work management and monitoring platform.
`HP NetMetrix is compatible with any RMON-standard data collector. This is
`important as more and more interconnect vendors such as Bay Networks,
`Cabletron, 3Com/Chipcom, and Cisco, to name a few, are integrating RMON-
`based data collectors in their network devices. As we have seen, the RMON
`offers an effective way to collect data and monitor internetwork segments.
`However, RMON is only part of the solution and does not provide all of the nec-
`essary data. Fortunately, NetMetrix offers more complete distributed moni-
`toring capabilities using the RMON extensions provided by the HP LanProbes
`and HP Power Agents.
`
`017
`
`ServiceNow's Exhibit No. 1006
`
`017
`
`ServiceNow's Exhibit No. 1006
`
`

`

`100 Network Management
`
`HP LanProbes
`
`HP LanProbes are stand-alone devices that are RMON-based data collectors
`that support Ethernet and Token-Ring. The LanProbes are noninvasive
`devices that are connected to the network segment and monitor all traffic on
`that network segment. LanProbes support all groups of RMON, but more
`importantly, provide the HP RMON extensions that enhance their monitoring
`capabilities. The LanProbes are available in a variety of memory configura-
`tions ranging from 1MB to 16MB of RAM, depending on the number and com-
`plexity of the data collection necessary for the segment. LanProbes are easily
`configurable using a terminal or terminal emulation on a PC, and the new
`LanProbe III probes support in-band, as well as out-of-band Serial Line
`Internet Protocol (SLIP) connections.
`
`HP Power Agent
`The HP NetMetrix Power Agent is an RMON-standard software agent that
`runs on either an HP or Sun workstation. The Power Agent supports all nine
`groups of Ethernet RMON, as well as 'Ibken—Ring and FDDI. The Power Agent
`extensions do the following:
`
`I Provide support for 64-bit counters, allowing the agent to handle rollover
`values that increase rapidly.
`l Implement three extended groups for monitoring upper-layer protocols
`(RMON is limited to the data-link layer of the 081 model).
`
`I Provide unique method for MIB access via query group extensions allowing
`the correlation of time, host, and protocol statistics.
`
`The Power Agent consists of two cooperating Unix daemons, netmd and
`rmond (Fig. 5.4). The netmd process monitors the segment, collects the data,
`and stores the data in shared memory. The rmond process receives the SNMP
`requests, accesses the collected data in shared memory, and responds to the
`SNMP request.
`‘
`One final note on the relationship between the HP NetMetrix applications
`and the LanProbe/Power Agents: Not all applications are currently supported
`by both data collectors. For instance, applications such as NFS Monitor and
`Traffic Generator are supported by the Power Agents, but not LanProbes. On
`the other hand, some statistics, especially Token-Ring statistics are supported
`by LanProbes, but not Power Agents. It’s important to know which Netmetrix
`applications are necessary for the specific network environment in order to
`know which data collectors are best suited.
`
`HP Embedded Advanced Sampling Environment (EASE)
`
`HP EASE is an architecture that uses statistical sampling to gather informa-
`tion about network traffic. Through the use of statistical algorithms, EASE
`captures network traffic information to recognize traffic patterns and to esti-
`
`018
`
`ServiceNow's Exhibit No. 1006
`
`018
`
`ServiceNow's Exhibit No. 1006
`
`

`

`Data Collection Using HP OpenView 101
`
`mate actual traffic activity from the information contained in the sampled
`packets. Statistical sampling is a method commonly used in industrial quality
`control, financial auditing, and other areas where exhaustive analysis is not
`feasible or is too expensive to perform.
`EASE provides a macroscopic view of traffic analysis on the entire network
`and can quickly identify the source of network problems. EASE is designed to
`monitor traffic characteristics that include bandwidth utilization, frame rates,
`broadcast or multicast storms, as well as error rates on the entire network.
`EASE does not collect and report data about every packet passing through the
`network. To look at every packet on high-speed networks would require a great
`deal of processing power for the monitoring and processing device. A huge
`amount of disk storage would be required to maintain data on every packet
`and to store it over a period of time. Fast computers with lots of memory can
`be very expensive. Detailed analysis is best applied when problems have been
`isolated and further information is required.
`
`(A) NetMetrix Accessing Power via SNMP
`Display
`
`
`
`
`Powar Agent
`
`
` @-
`
`Data
`Collection X Protocol Traffic
`SNMP Traffic
`
`
`Network
`
`(B) NetMetrix Accessing Power Agent via Shared Memory
`Display
`
`
`
` Power Agent
`
`
`Management
`
`Application
`
` Data
`
`
`
`
`X Protocol Traffic
`
`
`
`Collection
`
`Figure 5.4 HP Power Agent Processes
`
`i
`
`ServiceNow's Exhibit No. 1006
`
`019
`
`Network
`
`019
`
`ServiceNow's Exhibit No. 1006
`
`

`

`102 Network Management
`
`EASE Server
`(Dallas)
`
`
`
`
`Traffic Monitor
`
`Access any EASE
`Server on the network
`
`
`
`/
`
`eased2.ini file
`
`
`
`Accounting
`Sampl