The results of the correlation were less than overwhelming, however. "Repeated Event" correlation suppresses duplicate events, improving their consolidation by adjusting the time for correlation. But downstream event suppression, which recognizes layer topology relationships and suppresses events for devices that cannot be reached because an intervening router fails, didn't work.
We yanked a cable, and sat back and waited. And waited. And waited. Talked with tech support. Relearned our network, even started reading the manual. But we could not get the downstream suppression to correlate. The best guess as of this writing is that the glitch was due to missing route information in the database. This information is created during the discovery of devices and is not a separate manual configuration step.
NNM enables real-time and historical data collections, and a MIB expression tool provides the ability to calculate data collected to display performance stats, like utilization.
NNM has very nice controls for setting and maintaining thresholds. Canned threshold templates include utilization, availability and error. The thresholds support flexible targeting of devices by type, capability and through regular expression queries. NNM supports static thresholds, such as .02 percent error packets or based on statistical standard deviations, which helps to catch interfaces that are having major shifts in usage but not experiencing sustained server problems.
Rearming thresholds--the point at which the system prepares to issue a threshold violation--can be set by static, percentage, or threshold and/or statistical deviations. This fine-tuning helps dampen the reissue of threshold violations when, for example, interface utilization is hovering just above and below the threshold value.