Monitoring, Observability and Operations
What this domain covers
Monitoring, observability and operations tests how you know a network is healthy: telemetry collection, alert design, SLOs and incident response on Junos.
Core rules and concepts
- Monitoring answers known questions; observability lets you ask new ones. Metrics, logs and traces - plus, for networks, configuration and flow data - are the raw material.
- Collection methods on Junos: syslog for events, SNMP polling and traps for counters and alarms, sFlow for traffic sampling, and the Junos Telemetry Interface (JTI) for high-rate streaming over gRPC or UDP using OpenConfig or native sensors.
- Streaming beats polling. SNMP at 60-second intervals misses short BGP flaps and microbursts; a JTI sensor on BGP neighbour state at 10 seconds catches them.
- SLO-driven alerting. Define SLIs (for example BGP session availability), set an SLO and an error budget, and page on budget burn rather than on every syslog line. Juniper HealthBot/Paragon Insights applies rule-based KPI collection and anomaly detection.
- Operational readiness: runbooks, blameless postmortems and a tested rollback.
Worked example
Users report intermittent packet loss to a peer. SNMP interface counters show nothing because the polling interval is too coarse. Enabling JTI for interface and queue statistics at a five-second cadence reveals queue drops correlating with a scheduled backup. The fix - a policer change - ships through the pipeline, and the alert is rewritten as an SLO burn-rate alert on drop percentage rather than a static counter threshold.
Traps
- Equating observability with having a dashboard.
- Alerting on every syslog message and drowning the on-call engineer.
- Assuming SNMP traps reliably capture transient state changes.
- Setting an SLO with no error budget or burn-rate policy.