Resource Thresholding Notification
Always monitor the resource usage of infrastructure devices for unusual sustained high levels of CPU utilization, low free memory, and large volumes of dropped packets. These practices ease the detection and classification of attacks and outbreaks.
NOTE Chapter 3, "Identifying and Classifying Security Threats," details numerous techniques to successfully identify and classify network attacks and outbreaks.
Several Cisco platforms provide automatic notification mechanisms that are generally based on SNMP or syslog. These mechanisms generate alarms when unusual levels of CPU or memory are detected. It is recommended that you use the Cisco IOS CPU thresholding notification and memory thresholding notification.
NOTE The CPU thresholding notification was introduced in Cisco IOS Software Version 12.0(26)S.
You can configure two types of thresholds:
• Rising CPU threshold: Specifies the percentage of CPU utilization that will trigger a notification.
• Falling CPU threshold: Specifies the percentage of CPU resources that triggers a CPU threshold notification when CPU usage falls below this level for a configured period.
The following are the steps required to configure CPU threshold notification.
Step 1 Enable CPU threshold violation notification as traps and inform requests with the snmp-server enable traps cpu threshold command as follows:
myrouter(config)# snmp-server enable traps cpu threshold
Step 2 Configure the router to send CPU traps to a trusted SNMP server (10.10.10.123 in this example).
myrouter(config)# snmp-server host 10.10.10.123 traps mycommunitystring cpu
Step 3 Configure the threshold notification parameters. In the following example, the CPU utilization threshold is set to 80 percent for a rising threshold notification and 20 percent for a falling threshold notification with a 5-second polling interval.
myrouter(config)# process cpu threshold type total rising 80 interval 5 falling 20 interval 5
You can also configure memory threshold notifications. You can configure the router to send notifications to a trusted SNMP server to indicate that free memory has fallen below a configured threshold. In addition, you can reserve memory to ensure that sufficient memory is available to issue critical notifications.
NOTE Memory threshold notifications were introduced in Cisco IOS Software Version 12.2(18)S.
You can configure processor memory or input/output memory thresholds. To configure a processor memory threshold, use the memory free low-watermark processor threshold global command. You can specify input/output memory thresholds with the memory free low-watermark io threshold command.
In addition, you can mitigate low-memory conditions by reserving a region of memory for the router to use for the issuing of critical notifications. Reserving a block of memory for these functions is useful because when a router is overloaded by processes the amount of available memory might fall to levels insufficient for it to issue critical notifications. Use the memory reserve critical kilobytes command to accomplish this.
NOTE You can obtain more information about Cisco IOS memory thresholding notification at http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/ products_feature_guide09186a00801b1bee.html.
Continue reading here: CPU Protection
Was this article helpful?