Operating Notes - HP 3500yl Series Access Security Manual

Standard Date/Time Prefix
for Event Log Messages
W 05/27/06 12:10:16 inst-mon: Limit for MAC addr count (300) is exceeded (321)
Figure 11-8. Example of Event Log Message generated by Instrumentation Monitor
W 01/01/90 00:05:00 inst-mon: Limit for MAC addr count (300) is exceeded (321)
W 01/01/90 00:10:00 inst-mon: Limit for MAC addr count (300) is exceeded (323)
W 01/01/90 00:15:00 inst-mon: Limit for MAC addr count (300) is exceeded (322)
W 01/01/90 00:20:00 inst-mon: Limit for MAC addr count (300) is exceeded (324)
W 01/01/90 00:20:00 inst-mon: Ceasing logs for MAC addr count for 15 minutes
Figure 11-9. Example of rate limiting when multiple messages are generated

Operating Notes

To generate alerts for monitored events, you must enable the instru-
■
mentation monitoring log and/or SNMP trap. The threshold for each
monitored parameter can be adjusted to minimize false alarms (see
"Configuring Instrumentation Monitor" on page 11-36).
When a parameter exceeds its threshold, an alert (event log message
■
and/or SNMP trap) is generated to inform network administrators of
this condition. The following example shows an event log message
that occurs when the number of MAC addresses learned in the
forwarding table exceeds the configured threshold:
"inst-mon" label indicates an
Instrumentation Monitor event
Alerts are automatically rate limited to prevent filling the log file with
■
redundant information. The following is an example of alerts that
occur when the device is continually subject to the same attack (too
many MAC addresses in this instance):
In the preceding example, if a condition is reported 4 times (persists for
more than 15 minutes) then alerts cease for 15 minutes. If after 15 minutes
the condition still exists, the alerts cease for 30 minutes, then for 1 hour,
2 hours, 4 hours, 8 hours, and after that the persisting condition is reported
once a day. As with other event log entries, these alerts can be sent to a
syslog server.
Known Limitations: The instrumentation monitor runs once every
■
five minutes. The current implementation does not track information
such as the port, MAC, and IP address from which an attack is
received.
Configuring Advanced Threat Protection
Using the Instrumentation Monitor
Threshold
Monitored
Value
Parameter
Current
Value
11-35