4.2.3. Monitoring Solutions
| Solution Type | Function |
|---|---|
| Network discovery | Find devices on network (scheduled or ad-hoc scans) |
| Traffic analysis | Understand what's on the network and where it flows |
| Performance monitoring | Track speed, utilization, latency, errors |
| Availability monitoring | Verify devices are reachable (ping, service checks) |
| Configuration monitoring | Detect unauthorized changes |
Baseline: Documented "normal" behavior. Without baselines, you can't distinguish abnormal performance from acceptable variation. Before/after baseline comparisons of latency and throughput are how an upgrade is proven objectively.
Polling granularity: Short intervals (e.g., 1 minute) expose brief spikes and time-of-day patterns that 5-minute averages or simple up/down status checks hide.
Synthetic monitoring: Scripted test transactions that replay real application workflows measure end-to-end response time; comparing it with network latency shows whether delay lies in the network or the application.
Alerting: Threshold-based alerts fire when a metric crosses a set value (e.g., WAN utilization above 80%). To avoid alert fatigue, tune thresholds against the baseline, assign severity levels, suppress alerts during known maintenance windows, and deduplicate/correlate related alerts into a single incident.
