So what are the best practices, what should you be doing in a live environment? Now
best practices state that you should use both.
You should use polling-based or query-based as well as event-based network management protocols as part
of your network management solution.
Now, it doesn't help just to receive a large amount of data, you need to make meaningful decisions
on that data.
So you'll also want to build and leverage alerts and reports so that you're both notified when an issue occurs,
whether it was based on a polling-based detection mechanism or an event-based detection.
And in addition, you're going to want some kind of reporting capability that provides you with detail
of performance, not only in real-time at this point in time, but over a period of time.
So you want historical data available so that you can make meaningful decisions.
As an example, if an interface on a router has a utilization of 70% is that good or is that bad?
That's difficult to know if you don't have historical data that allows you to build a baseline of what
your network typically runs at.
If that interface in the last three months has been running at 2% utilization and now suddenly
it's running at 90% utilization, you'll know that something has happened on your network that
has changed the interface utilization dramatically.
So you're going to want reports to give you performance detail over time, as well as notify you of
issues and the availability of devices in your network.
You're going to want to, at a glance, be able to see if there's a problem with a network device such
as a router or if there's a problem with an individual interface on one of your routers.
Don't forget to set the polling frequency and how granular your event notifications are.
This will vary from one environment to another and often depends on the type of topology that you have,
the bandwidth available and the resources you have to detect and then act on the information that you're
receiving.
In addition, you might need to make decisions on how quickly you need to react to an issue on your
network.
If something happens on your network and it effects an entire building or the entire organization,
you're going to want to act on that quickly.
But if something happens and it only affects a single device, that's not important, it's probably
not as important that you get woken up at three o'clock in the morning to tell you that the port on the
switch has gone down.