Skip to content

Polling Interval

The field manual

Nineteen chapters on how network monitoring actually works, written to be useful whichever system you run: Zabbix, LibreNMS, Nagios or Icinga, Checkmk, Cacti, Prometheus, or an old PHP poller that has been humming in a closet since 2006. Read them in order for the whole picture, or jump to the chapter you need tonight.

Basics

  1. What a network monitoring system does, and the words it usesWhat a network monitoring system does: hosts and objects, state and values, polling and traps, events and alarms, with one check traced from poll to page.
  2. Setting up a self-hosted monitoring serverPlan a self-hosted monitoring server: sizing with a worked example, OS and stack choices, NTP, packages or containers, firewall ports, a checklist.
  3. Running a network monitoring server on WindowsMonitoring from Windows: Hyper-V, WSL 2, containers or native agents, PowerShell checks, firewall rules for SNMP and syslog, and a checklist.
  4. How monitoring data flows from raw input to alarms and actionsFollow one switch port going down through a monitor: traps, syslog and polls become events, events fold into one alarm, the alarm drives an action.
  5. Organizing monitored hosts: names, groups, maps and discoveryHow to name, group, map and discover the hosts in a network monitor, with parent and child dependencies and a worked layout for a three-site company.
  6. What you can monitor: ports, peers, sensors and servicesWhat a network monitor can watch, from switch ports and BGP peers to UPS runtime and certificate expiry, and how to collect, graph and alert on each.

Collecting data

  1. Polling explained: pollers, intervals, timeouts and keeping upHow monitoring polls work: SNMP, ICMP, TCP, HTTP and script pollers, choosing intervals, timeouts and retries, GETBULK, and spotting a poller that lags.
  2. SNMP traps and informs: receiving them with snmptrapdHow SNMP traps and informs work, the generic traps, an snmptrapd setup with authCommunity and traphandle, testing with snmptrap, and why you still poll.
  3. Feeding your monitor from outside programsHow traps, syslog, TACACS+ accounting, check scripts, passive results and webhooks get into a network monitor, with configs and security rules.
  4. Turning syslog lines into events with regular expressionsTurn raw syslog lines into monitoring events: syslog anatomy, PCRE patterns with capture groups, mapping fields, testing rules and ordering them.

Events and alerting

  1. Events, alarms and severities: reading what the console tells youWhat an event is, the fields it carries, severity scales from syslog to NMS tools, how events open and close alarms, acknowledgement and retention.
  2. Event filters: a console you can actually readEvent filters for a readable console: fields, operators and AND/OR logic, saved views per team, why filtering is not suppression, and five filters to save.
  3. Triggers and actions: turning alarms into the right notificationTriggers and actions in network monitoring: conditions, delays, repeats, escalation, quiet hours, dependencies, a small rule set and safe testing.

Running the system

  1. Working the monitoring console: a guide for shift operatorsHow to work a monitoring console: what to look at first, reading status colors, acknowledging well, drilling into graphs, quick checks and shift handover.
  2. Administering a monitoring server: reports, housekeeping and backupsRun a monitoring server month after month: honest availability reports, event purging, backups you have restored, upgrades and a heartbeat from outside.
  3. Users and customers: access control for a monitoring systemWho gets into your monitoring system and what they see: roles, host group scopes, customer views, single sign-on, safe sharing and audit logs.
  4. Satellites and distributed pollingWhen one monitoring server is not enough: satellites, proxies and federation, what flows where, buffering through WAN outages, clocks and security.
  5. Common monitoring errors and how to fix themTroubleshooting handbook for network monitoring: SNMP timeouts, missing MIBs, counter jumps, graph gaps, RRD errors, cron, permissions, locks and email.

Extending

  1. Worked example: graphing incoming ICMP on a Linux serverStep by step: poll ICMP counters from a Linux host with net-snmp, turn them into rates, store them in RRDtool, draw a graph and alert on a ping flood.
  2. Writing a custom check or poller, from plan to alertA tool-neutral method for custom checks: plan the object, find the data, write the collector, then graph and alert, with net-snmp and Python examples.