Software

The important aspects of Mutiny's functionality

The information below provides an overview of the Mutiny software, its capabilities and its aims.

SNMP (Simple Network Management Protocol) polling
In order for Mutiny to be able to monitor nodes on a network, it needs to contact each one and request information on its current state. This process is known as polling. Mutiny sends a small packet of information, over the network, to a node requesting the status of a specific property, eg. the length of time that the node has been running.

If the node is running an SNMP software agent, and the correct password (aka community string) has been used, it will send a response to Mutiny providing the information requested.
The group of nodes being communicated with in this manner constitutes the Monitored Domain.

The Monitoring Functions

ICMP
An elementary form of polling communication that operates over any network running IP (Internet Protocol) and is more commonly known as a ping. Mutiny pings a node's interface or interfaces and records the RTT (Round Trip Time) of these communications. Mutiny will log an Event (change of state) should one or more of the monitored interfaces start failing to respond to a ping.

SNMP
A form of polling communication operates over IP-based networks and requires the nodes to be running an SNMP v1 or v2 agent. Mutiny will log an Event should a node start failing to respond to this form of communication.

Note: The failure of a previously healthy system to respond to SNMP communications is often an early indication of a major node failure. This is because a node generally treats SNMP communications as a low priority on the use of its resources. In other words, if a node is becoming starved of resources, it will ignore any SNMP communications.

System
Using SNMP-based communications, Mutiny is able to monitor the following properties of a node that supports the SNMPV1 Enterprises MIB (Management Information Base):

• Processor (CPU) System Usage*
• Memory Usage*
• Disk Usage (per drive)*
• Processes running

Those properties marked with an asterisk (*) allow both warning and critical threshold values to be applied. Should the usage exceed the warning threshold value, a Warning Event will occur and any usage value passing the critical threshold will trigger a Critical Event.

Threshold values can be configured on a per property and a per node basis, as well as per drive in the case of Disk Usage.

The usage values of these properties are constantly recorded and made available through Mutiny's Graphing feature. This enables the data to be plotted against a range of time-scales to provide an indication of long-term and short-term trends.

Processes are monitored on a working/not working basis; should the latter occur, a Critical Event will be triggered.

Note: In order to gather data on these properties, the node must be running the net-SNMP agent. This agent is available for almost all flavours of UNIX operating systems and is the standard agent used by Linux. In the case of Windows NT, 2000 and XP, software extensions are available to the standard Microsoft SNMP agent.

Remote Agents
These are designed to gather information on the performance of the services running on a node. In Mutiny terminology, it is a small software application that actually runs on the node being monitored. Each remote agent is specific to a particular service or application, eg. Microsoft Exchange, SQLServer, IIS, and they perform a cycle of tests to check whether the service is operating correctly and efficiently.

As an example, a Microsoft Exchange Remote Agent would check that the application was able to send outgoing email and respond in a timely and correct manner to incoming messages. An Event would be triggered if a Remote Agent reports that the application had exceeded either warning or threshold values.

Network Traffic Data
Mutiny monitors the rate at which data is transmitted from the interfaces of any node connected to the network, eg. a router. This is a particularly useful measure for planning capacity upgrades as it can locate bottlenecks on the network that lead to degradation in performance. As with the system properties, Mutiny is able to display the data rates for each monitored interface in graphical format plotted against time.

IP Services
Mutiny will also test services running on the nodes being monitored. Tests include;

• HTTP ­ Tests if a text string is returned from a web page
• SMTP ­ Test to make sure the service is responding to incoming email
• IMAP ­ Simulated login by a user
• POP3 ­ Simulated login by a user
• DNS ­ Test to alert to changes in DNS configuration

Cisco Routers
We monitor;

• Interface status
• SNMP agent
• CPU Load
• Buffer Memory Pool utilisation
• Traffic statistics on all interfaces (KBits/s)