HP E4510-48G Command Reference Manual page 1155

If the result is equal to or smaller than the falling threshold, triggers the event specified by the
event-entry2 argument.
Before creating an alarm entry, define the events to be referenced in the event table with the
rmon event command.
When you create an entry, if the values of the specified alarm variable formula (prialarm-formula),
sampling type (absolute changeratio or delta), rising threshold (threshold-value1) and falling
threshold (threshold-value2) are identical to those of the existing alarm entry, the system
considers their configurations are the same and the creation fails.
You can create up to 50 pri-alarm entries.
Related commands: display rmon prialarm, rmon event, rmon history, rmon statistics.
Examples
# Create entry 5 in the private alarm table. Calculate the private alarm variables with the
(1.3.6.1.2.1.16.1.1.1.6.1*100/.1.3.6.1.2.1.16.1.1.1.5.1)
variables at intervals of 10 seconds. Rising threshold of 80 corresponds to event 1 (and record the
event into the log table); falling threshold of 5 corresponds to event 2 (but neither log it nor send a trap).
Set the lifetime of the entry to forever and owner to user1.
<Sysname> system-view
[Sysname] rmon event 1 log
[Sysname] rmon event 2 none
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] rmon statistics 1
[Sysname-GigabitEthernet1/0/1] quit
[Sysname] rmon prialarm 1 (1.3.6.1.2.1.16.1.1.1.6.1*100/.1.3.6.1.2.1.16.1.1.1.5.1)
packet GigabitEthernet1/0/1 10 absolute rising_threshold 80 1 falling_threshold 5 2 entrytype
forever owner user1
1.3.6.1.2.1.16.1.1.1.6.1 is the OID of the node etherStatsBroadcastPkts.1, and 1.3.6.1.2.1.16.1.1.1.5.1
is the OID of the node etherStatsPkts.1. 1 indicates the serial number of the interface statistics entry.
Therefore, if you execute the rmon statistics 5 command, you should use 1.3.6.1.2.1.16.1.1.1.6.5 and
1.3.6.1.2.1.16.1.1.1.5.5.
The above configuration implements the following:
Sampling and monitoring interface GigabitEthernet1/0/1
If the portion of broadcast packets received in the total packets is greater than or equal to 80%,
the system will log the event; if the portion is less than or equal to 5%, the system will take no
action.
You can view the event log using the display rmon eventlog command.
formula and sample the corresponding
12-16