Chapter 8 – Monitoring the Network
Study Guide
After completion of this chapter, you should be able to:







Explain syslog operation in a small-to-medium-sized business network.
Configure syslog to compile messages on a small-to-medium-sized business network management device.
Explain syslog operation in small-to-medium-sized business network.
Configure SNMP to compile messages on a small-to-medium-sized business network.
Describe NetFlow operation in a small-to-medium-sized business network.
Configure NetFlow data export on a router.
Examine sample NetFlow data to determine traffic patterns.
1. What is the most common method of accessing system messages provided by networking devices?
syslog
2. Syslog uses __UDP____ port __514____ to send event notification messages across IP networks to event
message collectors.
3. What are the three primary functions of the syslog logging service?
a.
The ability to gather logging info for monitoring and troubleshooting
b.
The ability to select the type of logging info that is captured
c.
The ability to specify the destinations of captured syslog messages
4. List the Syslog message destination options:
a. Logging Buffer (RAM)
b. Console Line
c. Terminal Line
d. Syslog Server
5. Explain the following Syslog severity levels:
a. Warning Level – Emergency Level – error messages about software/hardware malfunctions,
functionality of the device is affected.
b. Notification Level – only for information, device functionality is not affected.
c. Debugging Level – messages are output generated from issuing various debug commands.
6. What are the most common Syslog messages?
Link up and down messages
7. Label the parts of the sample output:
00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up
Timestamp Facility Severity Level Mnemonic Description
8. What happens when the command: service timestamps log datetime is entered in global config mode?
It forces each logged event to display the date and time associated with the event.
9. What is the function of the Network Time Protocol (NTP)?
Allows network devices to synchronize their time settings with an NTP server
10. Complete Activity 8.1.1.5 – Interpret Syslog Output
11. Where do Cisco routers and switches send log messages for all severity levels, by default? To the console
12. What is the function of the logging trap command?
It limits the syslog messages sent to the syslog server based on severity.
13. What happens to syslog messages that are a higher severity level then what is configured in the logging trap
command?
The messages appear on the router console output, but do not appear on the syslog server output.
14. SNMP uses __UDP____, port number ___162____, to retrieve and send management information.
15. Explain the following SNMP actions:
a. Get – collect information from an SNMP agent
b. Set – change configurations on an SNMP agent
c. Traps – SNMP agents can forward information directly to an NMS
16. What is the purpose of SNMP traps?
Traps are used to inform the NMS immediately of certain events, this helps to eliminate the disadvantages of
SNMP polling.
17. What is the function of SNMP community strings?
To authenticate access to the MIB objects, community strings are plaintext passwords used by SNMPv1 and
SNMPv2c
18. Complete Activity 8.2.1.7 – Identify Characteristics of SNMP Versions
19. How can access lists be used in SNMP configurations?
To specify a community string and to restrict access to SNMP managers
20. What happens if there are no notification-types specified when using the snmp-server enable traps command?
All trap types are sent
21. What is the focus of NetFlow?
Providing statistics on IP packets flowing through network devices
22. What are some features of NetFlow in contrast to SNMP?
NetFlow uses a “push-based model”, NetFlow only gathers traffic statistics (more detailed than SNMP).
23. Complete Activity 8.3.1.4 – Compare SNMP and NetFlow
24. How can NetFlow be adjusted if a Cisco networking device has memory constraints?
The size of the NetFlow cache can be pre-set so that it contains a smaller number of entries.
25. A NetFlow flow is unidirectional, how does this affect user connections?
For every one user connection there are two NetFlow flows, one for each direction (ingress and egress).
26. What is the purpose of a NetFlow collector?
To support critical flows associated with consumer applications.