Skip to content
Any configuration changes made locally on the switch won't be synchronized with Sophos Central. We recommend making changes from the Sophos Central control panel instead.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/switch/help/en-us/index.html?contextId=user-guide-features-monitor-RMON

RMON

Remote network monitoring (RMON) supports LAN monitoring and protocol analysis by extending SNMP capabilities to provide comprehensive network traffic analysis and monitoring. You can configure RMON on Sophos Switch using lists for statistics, events, alarms, and historical network data, as well as logs for the collected data and triggered events.

Statistics list

The Statistics list tab shows the following information about RMON entries on the switch:

  • Index: The primary key that uniquely identifies RMON entries. SNMP management stations use this to reference specific RMON instances.
  • Data source: Identifies the interface, SFP module, or LAG being monitored.
  • Owner: A string that identifies who created the RMON entry. The string can be from 1 to 127 characters and can't include ", \, %, &, ?, ', !, ;, |, +, or spaces.

To create a new entry, click Add, enter the required information, and click Apply.

To remove an entry, click Delete.

Event list

The Event list tab shows the following information about RMON events on the switch.

  • Index: The unique identifier for the event entry.

  • Event type: The action the switch takes when the event occurs. It can be one of the following values:

    • Nothing: Take no action.
    • Log: Log the event.
    • SNMP Trap: Send an SNMP trap.
    • Log & Trap: Log the event and send an SNMP trap.

  • Community: The SNMP community for the SNMP trap.

  • Description: A description of the event. The description can be from 1 to 127 characters and can't include ", \, %, &, ?, ', !, ;, |, +, or spaces.
  • Owner: A string that identifies who created the event entry. The string can be from 1 to 127 characters and can't include ", \, %, &, ?, ', !, ;, |, +, or spaces.
  • Last time sent: Shows the date and time that the event last occurred.

To create a new event, click Add, enter the required information, and click Apply.

To update an event, click Edit, enter the required information, and click Apply.

To remove an event, click Delete.

Event log table

On the Event log table tab, you can see information about specific event logs for the switch.

Choose an event index from the drop-down list to see the logs for that event index. The logs show the time the switch logged the event and a description of the event.

Click Refresh to refresh the log table for the specified event index.

Alarm list

On the Alarm list tab, you can configure the switch to monitor specific network variables and trigger events when values cross defined thresholds.

You can see the following information about your alarms:

  • Index: The unique identifier for the alarm entry.
  • Sample status: The port from which the alarm samples are taken.
  • Sample variable: The variable being sampled for the specified alarm.
  • Sample interval: How often the switch checks the value of the variable. The value must be between 1 and 2147483647 seconds.

  • Sample type: The sampling method for the selected variable and comparing the value against the thresholds. It can be Absolute or Delta.

    • Absolute: The switch checks the value of the variable at the specified interval.
    • Delta: The switch checks for a change in the variable's value at the specified interval.

  • Rising threshold: The upper threshold that triggers the alarm when the sample value exceeds it.

You can select additional information to show on the Alarm list tab. Click the ellipsis Ellipsis. and select the options you want to show. You can select from the following options:

  • Falling threshold: The lower threshold that triggers the alarm when the sample value falls below it.
  • Rising event: The event entry for the rising threshold.
  • Falling event: The event entry for the falling threshold.
  • Owner: A string that identifies who created the alarm entry. The string can be from 1 to 127 characters and can't include ", \, %, &, ?, ', !, ;, |, +, or spaces.

To create a new alarm, click Add, enter the required information, and click Apply.

To update an alarm, click Edit, enter the required information, and click Apply.

To remove an alarm, click Delete.

History list

The History list tab shows the following information about collections of historical network data:

  • Index: The unique identifier for the collection.
  • Sample port: The port from which the samples are taken.
  • Bucket requested: The number of samples to save. The range is from 1 to 50.
  • Interval: The frequency at which the switch takes samples from the port. The field range is from 1 to 3600 seconds.
  • Owner: A string that identifies who created the entry. The string can be from 1 to 127 characters and can't include ", \, %, &, ?, ', !, ;, |, +, or spaces.

To create a new collection, click Add, enter the required information, and click Apply.

To update a collection, click Edit, enter the required information, and click Apply.

To remove a collection, click Delete.

Historical log table

On the Historical log table tab, you can see information about specific historical collections for the switch.

Choose a history index from the drop-down list to see the logs for that event index. The logs show the following information:

  • Sample index: The unique identifier for the collection.
  • Interval start time: The time at which the switch began collecting data.
  • Drop events: The total number of packets dropped.
  • Octets: The total number of bytes received.
  • Packets: The total number of packets received.
  • Broadcast packets: The total number of broadcast packets received. This number doesn't include multicast packets.
  • Jabbers: The number of received oversized packets with a valid Cyclic Redundancy Check (CRC).

You can select additional information to show on the Historical log table tab. Click the ellipsis Ellipsis. and select the options you want to show. You can select from the following options:

  • Multicast packets: The number of good multicast packets received.
  • CRC alignment errors: The number of packets received with CRC errors.
  • Undersized packets: The number of received packets that are smaller than the minimum Ethernet frame size.
  • Oversized packets: The number of received packets that are larger than the defined MRU or MTU.
  • Fragments: The number of fragments received.
  • Collisions: The number of collisions received.
  • Utilization: The bandwidth utilization.

Click Refresh to refresh the log table for the specified history index.