132 Chapter 8 RMON214393-AFigure 65 How alarms fireIt is important to note that the alarm fires during the first interval that the samplegoes out of range. No additional events are generated for that threshold until theopposite threshold is crossed. Therefore, it is important to carefully define therising and falling threshold values for alarms to work as expected. Otherwise,incorrect thresholds causes an alarm to fire at every alarm interval.A general guideline is to define one of the threshold values to an expected,baseline value, and then define the opposite threshold as the out-of-bounds limit.Because of sample averaging, the value may be equal to ±1 of the baseline units.For example, assume an alarm is defined on octets going out of a port as thevariable. The intent of the alarm is to provide notification to the systemadministrator when excessive traffic occurs on that port. If spanning tree isenabled, then 52 octets are transmitted out of the port every 2 seconds, which isequivalent to baseline traffic of 260 octets every 10 seconds. This alarm shouldprovide the notification the system administrator needs if the lower limit of octetsgoing out is defined at 260 and the upper limit is defined at 320 (or at any valuegreater than 260 + 52 = 312).The first time outbound traffic other than spanning tree Bridge Protocol DataUnits (BPDUs) occurs, the rising alarm fires. When outbound traffic other thanspanning tree ceases, the falling alarm fires. This process provides the systemadministrator with time intervals of any nonbaseline outbound traffic.If the alarm is defined with a falling threshold less than 260 (assuming the alarmpolling interval is 10 seconds), say 250, then the rising alarm can fire only once(Figure 66). The reason is that for the rising alarm to fire a second time, the fallingalarm (the opposite threshold) must fire. Unless the port becomes inactive or7821EAAlarm firesNo firingFalling valueRising value
