HP ProCurve J8766A Release Note page 63

Parameter Name
mac-moves/min
learn-discards/min
Operating Notes
■ To generate alerts for monitored events, you must enable the instrumentation monitoring
log and/or SNMP trap. The threshold for each monitored parameter is configurable and can
be adjusted to minimize false alarms (see
■ When a parameter exceeds its threshold, an alert (event log message and/or SNMP trap) is
generated to inform network administrators of this condition. The following example shows
an event log message that occurs when the number of MAC addresses learned in the
forwarding table exceeds the configured threshold:
Standard Date/Time Prefix
for Event Log Messages
W 05/27/06 12:10:16 inst-mon: Limit for MAC addr count (300) is exceeded (321)
Figure 26. Example of Event Log Message generated by Instrumentation Monitor
■ Alerts are automatically rate limited to prevent filling the log file with redundant information.
The following is an example of alerts that occur when the device is continually subject to
the same attack (too many MAC addresses in this instance):
W 01/01/90 00:05:00 inst-mon: Limit for MAC addr count (300) is exceeded (321)
W 01/01/90 00:10:00 inst-mon: Limit for MAC addr count (300) is exceeded (323)
W 01/01/90 00:15:00 inst-mon: Limit for MAC addr count (300) is exceeded (322)
W 01/01/90 00:20:00 inst-mon: Limit for MAC addr count (300) is exceeded (324)
W 01/01/90 00:20:00 inst-mon: Ceasing logs for MAC addr count for 15 minutes
Figure 27. Example of the rate limiting that occurs when multiple messages are generated
In the preceding example, if a condition is reported 4 times (persists for more than 15 minutes)
then alerts cease for 15 minutes. If after 15 minutes the condition still exists, the alerts cease for
30 minutes, then for 1 hour, 2 hours, 4 hours, 8 hours, and after that the persisting condition is
reported once a day. Note that ProCurve switches also have the ability to send event log entries
to a syslog server.
Description
The average number of MAC address moves from one port to another per minute.
This usually indicates a network loop, but can also be caused by DoS attacks.
Number of MAC address learn events per minute discarded to help free CPU
resources when busy.
"inst-mon" label indicates an
Instrumentation Monitor event
"Configuring Instrumentation Monitor" on page
Monitored
Parameter
Enhancements
Release L.10.20 Enhancements
Threshold
Value
58).
Current
Value
57