Alcatel-Lucent 7450 System Management Manual page 226

Distributed CPU Protection Commands
local-monitoring-policer
Syntax [no] local-monitoring-policer policer-name [create]
Context config>system>security>dist-cpu-protection>policy>local-monitoring-policer
Description
This command configures a monitoring policier that is used to monitor the aggregate rate of several
protocols arriving on an object (for example, SAP). When the local-monitoring-policer is deter-
mined to be in a non-conformant state (at the end of a minimum monitoring time of 60 seconds) then
the system will attempt to allocate dynamic policers for the particular object for any protocols associ-
ated with the local monitor (for example, via the "protocol xyz enforcement" CLI command).
If the system cannot allocate all the dynamic policers within 150 seconds, it will stop attempting to
allocate dynamic policers, raise a LocMonExcdAllDynAlloc log event, and go back to using the local
monitor. The local monitor may then detect exceeded packets again and make another attempt at allo-
cating dynamic policers.
Once this policer-name is referenced by a protocol then this policer will be instantiated for each
"object" that is created and references this DDoS policy. If there is no policer free then the object will
be blocked from being created.
Parameters policy-name — Specifies name of the policy.
log-events
Syntax [no] log-events [verbose]
Context config>system>security>dist-cpu-protection>policy>local-monitoring-policer
Description
This command controls the creation of log events related to local-monitoring-policer status and
activity.
Default log-events: send the DcpLocMonExcdOutOfDynRes events
Parameters verbose — This parameter sends the same events as just "log-events" plus DcpLocMonExcd,
protocol
Syntax [no] protocol name [create]
Context config>system>security>dist-cpu-protection>policy
Description This command creates the protocol for control in the policy.
Control packets that are both forwarded (which means they could be subject to normal QoS policy
policing) and also copied for extraction are not subject to distributed cpu protection (including in the
all-unspecified bucket). This includes traffic snooping (for example, PIM in VPLS) as well as con-
Page 226
Values [32 chars max]
DcpLocMonExcdAllDynAlloc, and DcpLocMonExcdAllDynFreed. The optional "verbose"
includes some events that are more likely used during debug/tuning/investigations
7450 ESS System Mangement Guide