Monitoring and Reporting
What you must understand
Monitoring is about knowing what normal looks like and where to look. At Layer 2, interface counters tell the story: CRC and alignment errors point to cabling or duplex problems, runts and giants to frame size issues, and discards to congestion or policy. MAC address table size and flapping indicate loops or misbehavior. Spanning tree topology changes are a signal of instability.
At Layer 3 and above, track reachability with ping and path with traceroute, and monitor routing adjacency state. For wireless, key metrics are client count, channel utilization, retries, and SNR; high retries with low SNR suggests coverage problems, while high utilization with good SNR suggests capacity problems.
Know the difference between syslog severity levels (0 emergency through 7 debugging), SNMP polling versus traps, and NTP as the foundation for correlating logs. Without synchronized time, event correlation across devices fails. Reports should be baselined and trended, not read as single snapshots.
Traps to expect
- Reading a single counter snapshot instead of a rate over time.
- Confusing SNMP polling (manager requests) with traps (agent-initiated).
- Forgetting that logs without NTP have unreliable timestamps.
- Treating high channel utilization as always a coverage issue.
- Ignoring that a syslog severity of 0 is the most severe, not the least.
Rule of thumb
Diagnose by symptom-to-metric mapping: errors mean physical, discards mean congestion or policy, retries mean RF quality, and topology changes mean Layer 2 instability.
Worked example
Users complain of slow wireless in one area. Check channel utilization and retries per AP. If utilization is high and SNR is good, it is a capacity or co-channel interference issue; add capacity or change channel plan. If SNR is low with high retries, it is a coverage issue; adjust power or add an AP.