The event console is the raw stream: every timestamped fact the monitor received from polls, traps and syslog, newest first. Typical columns are time, host, object, event type, severity and a short message. An event is something that happened; it is not yet a problem someone has to own.

Scan it for patterns rather than single lines. Twenty events in the same minute from different hosts usually share one cause upstream. A down and up pair repeating every few minutes on the same port is a flap, and the cable or the far-end device deserves attention more than the alerts do. A steady trickle of authentication failures from one address is worth a ticket of its own.

What good looks like: saved filters for each team, so the core network group is not reading printer toner warnings; restrained use of color, so critical still stands out; every row linked to its host and interface; and one time zone across the whole console, with the zone shown. Common mistakes include treating the console as the to-do list (that is the alarm list's job), letting debug-level messages in until the screen scrolls faster than anyone can read, and mixing local time with UTC so events from two sources appear out of order. The guide to events and severities covers how events become alarms.

The traffic graph

The traffic graph shows how much an interface carried over time, inbound and outbound, against what it can carry. It is the screen people open when someone says "the network is slow".

Check three things before you believe it. First the units: bits per second is the norm, but some tools default to bytes, a factor of eight. Then the direction: "in" is from the device's point of view, so inbound on a switch uplink is traffic arriving at that switch, which is outbound on the router at the other end. Finally the averaging step. A five-minute average of 400 Mbit/s on a 1 Gbit/s port can hide one-minute bursts at line rate, and over a year the stored history is averaged into coarse steps that flatten peaks unless the maxima are kept as well.

A good graph scales its vertical axis to the port speed or draws a capacity line, shows both directions, and lists current, average and peak values (often the 95th percentile too). An errors and discards graph sits next to it, because a link can look half empty and still drop packets. The classic mistakes are an auto-scaled axis that makes 2 Mbit/s of background noise look like a crisis, and a sudden spike that is really a 32-bit counter wrapping or resetting at reboot. Interface counters explained shows why that happens and how 64-bit counters avoid it.

The alarm list