Network Telemetry, Monitoring, and Observability
Streaming telemetry is the core idea
Arista's observability model is push-based. TerminAttr runs on the switch and streams state to CloudVision (or to a gNMI collector). This replaces polling with continuous, high-frequency updates. Candidates should understand the difference between:
- Streaming telemetry - push, continuous, high resolution, driven by TerminAttr/gNMI.
- Polling (SNMP) - pull, interval-based, lower resolution, and increasingly legacy for state monitoring.
- Syslog - event-driven logs, not metrics.
- sFlow - packet sampling for traffic analysis, not state telemetry.
What CloudVision gives you
CloudVision aggregates telemetry into dashboards, alerts, and device/interface health views. It also supports event correlation and network-wide compliance views. The key mental model: CloudVision is the collector and analyzer; TerminAttr is the exporter; EOS is the source.
Traps
- sFlow is not telemetry. sFlow samples packets for flow analysis; it does not stream device state to CloudVision.
- SNMP is still supported but is not the streaming path. A question that says "CloudVision collects state via SNMP" is wrong.
- TerminAttr must be running for a device to stream. A device that is reachable but not streaming usually has a TerminAttr/auth problem.
- Telemetry is not the same as logging. Syslog events are not metrics; they are discrete log records.
Worked example
A device appears in CloudVision as "inactive" or shows no telemetry. The diagnostic order is: (1) is TerminAttr running on the switch? (2) is it authenticated to the CloudVision cluster? (3) is the device in a container with the right configlet? If all three are true, telemetry should flow. This sequence is a common exam scenario.