Cisco ASA: Tunnel Phase-1 global total traffic Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalTotalTraffic.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the Tunnel Phase-1 global total traffic if has changed its state.

Knowledge Base article:

Summary

Phase-1 Tunnel global total traffic is over threshold.

The total number of all active Phase-1 Tunnels incoming and outgoing Kbits per second is above the maximum threshold configured in Xian Network Manager 2012.

Causes

There is a high amount of octets being received by all active Phase-1 Tunnels.

Resolutions

Review the tunnels and sessions that are running into them in order to close the less priority sessions or tunnels.

Additional

Monitors the total traffic received and sent on all active IPsec Phase-1 IKE Tunnels, detecting when the average traffic is above normal values.

Element properties:

TargetJalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer
Parent MonitorSystem.Health.PerformanceState
AlgorithmWorstOf
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityLow
Alert Auto ResolveTrue
RemotableTrue
AccessibilityPublic
Alert Message
Tunnel Phase-1 global total traffic Alert
{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalTotalTraffic.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="TunnelPhase1GlobalTotalTraffic_AlertMessage">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Low</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<Algorithm>WorstOf</Algorithm>
</AggregateMonitor>