Investigate a live ACME network using SNMP polling and traps, syslog messages, and NTP-synchronized timelines. Identify failures, correlate events, and learn what each monitoring service actually contributes.
SNMP measures and reports device state. Polling is manager-initiated; traps/informs are agent-initiated.
ACME Corporation — select a device for metrics. Status text supplements color.
| Interface | Admin | Oper | Util % | InErr |
|---|---|---|---|---|
| Gi0/1Uplink to CORE1 | up | up | 22 | 0 |
| Gi0/2To APP1 | up | up | 15 | 0 |
| Gi0/3Finance POS endpoint | up | up | 8 | 0 |
| Gi0/4User access | up | up | 6 | 0 |
Poll agents, compare traps vs informs, and read interface state.
1.3.6.1.2.1.2.2.1.8 — Operational status of an interface (1=up, 2=down). Memorizing long OID strings is not required for CCNA; learn how the identifier maps to a monitored value.
Clocks disagree — device-local times may conflict
No events yet. Poll a device, generate syslog, or start the flapping-port scenario.
SNMP measures and reports state. Syslog records events. NTP makes timestamps trustworthy.
ACME NOC console ready. Select a mode to begin.
Measures and reports state.
Manager polls agents (GET). Agents can send traps (unacknowledged) or informs (acknowledged). MIBs/OIDs identify objects such as ifOperStatus.
Records events and device messages.
Severity 0–7 (0 most severe). A remote threshold forwards that level and all more severe levels. Destinations include console, local buffer, terminal monitor, and a logging host.
Synchronizes clocks so event timestamps can be trusted.
Lower stratum is closer to a reference clock. Stratum is not latency. NTP does not detect link failures — it makes SNMP and syslog records comparable.
