Glossary

This documentation applies to NMS version 5.4. An online version of the software can be found here.

The Glossary explains SevOne vocabulary.

Active Appliance - The SevOne appliance in a Hot Standby Appliance (HSA) peer pair that actively polls metrics for alerts and reports. Upon initial setup, the primary appliance is the active appliance in the HSA peer pair. If the primary appliance fails, the secondary appliance becomes the active appliance.
Aggregated Data - Aggregation is a process that stores data in "buckets" to enable the ability to manipulate the granularity of the data points in graphs, either in time or across resources. Aggregation provides the ability to define how to calculate each data point and to smooth a graph over a specified time span.
Alert - The notification of current, active messages that include threshold violations, trap notifications, and web site errors. The alert engine runs every three minutes to retest all thresholds.
Appliance - The hardware on which SevOne software runs. Peer an unlimited number of Performance Appliance Solution (PAS) appliances and Dedicated NetFlow Collector (DNC) appliances together into a cluster to monitor networks of any scale. When the cluster includes Hot Standby Appliance (HSA) peer pairs, there are two appliances that act as one peer to provide redundancy. A cluster can also include Performance Log Appliances (PLA) and Application Performance Appliances (APA) to monitor log data and large volumes of flow data in a network. PLA and APA appliances do not appear in the cluster hierarchy on the Cluster Manager.
Application Performance Appliance (APA) - A SevOne appliance dedicated to produce network flow data records in a NetFlow format to summarize the traffic observed by the APA appliance. The APA appliance sends data to a DNC appliance or a PAS appliance and does not run the SevOne NMS software.
Attachment - An individual collection of polled data collected into a section within a report. A report can contain multiple attachments and attachments can be chained to drill down to related data.
Automatic Discovery - A process that runs on a schedule (usually daily) to test the various plugin technologies on all devices in SevOne NMS even when the device is not marked for discovery. Cluster Manager settings enable the ability to schedule the frequency of the automatic discovery process. Automatic discovery runs in the low priority discovery queue.
Baseline – A snapshot of network performance for use as a point of reference to determine normal network behavior. Default baseline granularity takes all data points in a 15 minute time span, averages these data points, and stores each average data point for every 15 minutes of the week for a total of 672 data points.
Candidate - Something that a SevOne NMS network scan can find that has not been added into SevOne NMS and is not polled for metrics. Add a candidate into SevOne NMS where it becomes a device to poll metrics for reports and alerts.
Chained Attachment - An attachment in a report that uses the settings from a "parent" attachment in the report to create a related attachment that drills down to more specific data or to provide related data for the same set of devices, objects, interfaces, etc.
Cluster - An interconnected set of SevOne appliances that exchange information about the network devices from which they collect statistical data.
Cluster Master – The SevOne peer that stores the master copy of the Cluster Manager settings, security settings, and other global settings. All other active peers in the cluster pull the data from the cluster master peer config database.
Config Database - The database that stores the Cluster Manager settings, security settings, and other global settings. The cluster master peer stores the master copy of the config database from which all other active peers pull a copy for local use.
Data Database - A database on each peer that stores the data for the devices/objects the peer polls plus a local copy of the config database.
Dedicated NetFlow Collector (DNC) - A SevOne appliance that runs the SevOne NMS software on a hardware configuration that supports flow data collection. A typical cluster peers a DNC with a PAS to combine flow collection metrics with complimentary SNMP data.
Device - A container for the collection of objects that represents a self-contained entity of some kind.
Device Group – A way to organize devices for reports and security purposes.
Device Type – A way to organize devices for SNMP polling purposes to enable the ability to view devices as members of a device type similarly to the relationship that many individual objects can be viewed to belong to one platonic object type. A device type is more flexible than an object type.
Discovery - The process to query and update information about the devices that are in SevOne NMS. Device discovery can be performed manually and is scheduled to occur automatically. Device discovery creates new objects in SevOne NMS, updates existing objects, and ultimately deactivates and deletes unused objects.
Flow - SevOne NMS handles virtually all flow technologies. Flow technologies monitor data in layers 2 through 4 to provide visual details of over or under utilization of a network resource, application traffic, and port conversation activity. A flow interface is configured to send flow records to SevOne. SevOne receives a flow record that is a vendor-neutral flow update that describes the flows seen by a specific interface for a specific time period. A flow template provides the format that describes the structure of the flow record received.
FlowFalcon - The SevOne NMS flow collector for flow technologies such as NetFlow. The flow report suite is known as FlowFalcon.
Hot Standby Appliance (HSA) - A SevOne appliance that acts as a complete mirror of any other appliance (including the cluster master) in a SevOne cluster to provide redundancy in the event of an appliance failure.
Indicator - Object level metrics used in reports and for alerts. An object represents a logical entity that is some part of the device which can provide metrics about itself to enable the statistical measurements that pertain to a particular SevOne object instance. SevOne NMS collects metrics from network devices to populate the indicators used to report on data and to generate alerts.
Indicator Type - A way to classify indicators by plugin and organize indicators in a logical way to enable SevOne NMS to poll for plugin specific metrics.
Instant Graph – Provide a quick and easy way to view the status and performance of your network's devices, objects, and indicators.
Internet Protocol Service Level Agreement (IP SLA) – A feature embedded in the Cisco IOS software that SevOne NMS can monitor to help Cisco customers understand IP service levels, increase productivity, lower operational costs, and reduce the frequency of network outages.
Manual Discovery - A process that runs every two minutes to test the various plugin technologies on the devices marked for discovery. Manual discovery runs in the high priority discovery queue.
Neighbor - The other appliance in a Hot Standby Appliance peer pair. The primary appliance's neighbor is the secondary appliance and vice versa.
Network Management System (NMS) - The software developed by SevOne Inc. that runs on PAS appliances and on DNC appliances to monitor network data.
Object - An object or element is a discrete component of a device or a software component that has one or more performance indicators that can be monitored, trended, or alerted on. In SevOne NMS, an element is considered any performance object.
Object Group - A way to segment groups of enabled, visible objects on which to be report and alert. Object groups are mainly for filtering objects and have no effect on how objects are stored.
Object Type - The abstraction of like objects and the classification for a set of components within devices. All objects must have an object type. The object type describes objects as a concept, outside of their individual devices. An object can belong to only one object type. Object types can be further abstracted and the more abstract form of an object type is simply another object type.
Passive Appliance - The SevOne NMS appliance in a Hot Standby Appliance peer pair that replicates the databases of the active peer appliance. Upon initial setup the secondary appliance is the passive appliance.
Peer – Each SevOne NMS appliance in your implementation is either a peer within your SevOne NMS cluster or the Hot Standby Appliance to the active appliance in a Hot Standby Appliance peer pair. Each active peer pulls a full replica of the cluster master peer configuration database and maintains the performance data for the devices it polls. Your cluster can peer SevOne NMS PAS appliances and SevOne NMS DNC appliances and can include Hot Standby Appliance peer pairs.
Performance Appliance Solution (PAS) - A SevOne appliance that runs the SevOne NMS software to collect, analyze, and report on regular time-stamp metric data. This is SevOne's general purpose collection appliance that can be licensed for a range of capacities, and can be peered into a multi-appliance cluster.
Performance Log Appliance (PLA) - A PLA can exist as a peer within the SevOne Cluster with the SevOne Performance Appliance Solution (PAS) appliances and the SevOne Dedicated NetFlow Collector (DNC) appliances. Log analysis provides deep insight into the performance of both hardware and the services or applications running above.
Pin - To manually add a device to a device group/device type or to manually add an object to an object group in such a way that it cannot be removed from the device group/device type/object group via rule or discovery. You must manually unpin a pinned device/object to remove the device/object from the device group/device type/object group.
Plugin – The SevOne NMS mechanisms that poll (collect, ask for, etc.) data from technologies. A plugin defines the following:
- A way to get data - Usually via some protocol such as SNMP, ICMP, WMI, etc.
- Object Types - Define logical things to ask for information about.
- Indicator Types - Define kinds of metrics that object types can have.
Policy - The framework that enables you to define a threshold to apply for a device group/device type. A threshold is the value that triggers an alert or a trap.
Poll - The process of using the plugins you enable on a device to gather the metrics on which SevOne NMS can generate reports and alerts.
Primary - The appliance in a Hot Standby Appliance peer pair that is initially configured to be the active, normal, polling appliance. If the primary appliance fails, it is still the primary appliance but it becomes the passive appliance.
Process - The Process plugin enables you to collect performance and availability information about individual processes running on a device.
Raw Data - Actual unadulterated data polled by enabled plugins from the applicable indicators within each plugin specific object.
Report Template - Report Templates are similar to reports with the added ability to define template attachments that do not have a specific resource. You define the report template properties to enable applicable template attachments to derive their device resources from the Device Summary workflows or to derive their object resources from the Object Summary workflows. Report templates enable you to create a report that has template attachments without a specific resource and attachments with specific resources.
Secondary - The appliance in a Hot Standby Appliance peer pair that is initially configured to be the passive appliance. If the active appliance fails, this is still the secondary appliance but the secondary appliance assumes the active role.
Simple Network Management Protocol (SNMP) - A key technology for network management. Virtually all operating systems support SNMP. Devices that support SNMP run an agent that stores information about the device in a tree-like structure of Object Identifiers (OIDs). SevOne NMS displays OIDs as their corresponding Management Information Bases (MIBs). Devices send SevOne NMS SNMP traps and SevOne NMS can send traps to other trap destinations.
Threshold – The value that triggers an alert or trap. The Threshold Browser enables you to create thresholds for an individual device and the Policy Browser enables you to define a policy which is a threshold that applies to a device group/device type.
View - The report framework and template that that determines what indicator data is to appear in TopN reports and FlowFalcon reports.
xStats - The xStats plugin provides the ability to retrieve or import any data that can be made available in a flat file format into SevOne NMS for monitoring and reporting purposes. SevOne NMS supports the collection of xStats data from any format that provides the ability to programmatically parse the files to CSV, XML, JSON, and other common file types.

Concepts

SevOne deploys as a physical or virtual appliance. A single SevOne appliance monitors up to 200,000 objects. You can peer appliances together into a cluster to increase monitoring capacity. Each appliance you peer into your cluster collects, stores, and reports metrics from the devices you assign the peer to monitor.

The peer-to-peer, cluster approach enables users to log on to any SevOne peer and view information about the entire network. When a report spans the devices from multiple peers, each peer works on its part of the report and sends its metrics to the peer that made the request.

The SevOne NMS application monitors your network. Your network has many metrics. SevOne NMS can scan your network to find candidates. When you add candidates to SevOne NMS as a device, technology specific plugins discover the objects that are members of technology specific object types on the device. The plugin then polls those objects to gather metrics from the indicators that are contained in the object type specific indicator types. You can choose to turn on the plugins you deem relevant to gather metrics from the technologies that matter to you.

From the opposite perspective: Metrics are polled from indicators. Indicators are grouped into technology specific indicator types. Indicator types are conceptually grouped into object types. Each object type groups objects by technology. Objects are physical or virtual parts of a device that contain the indicators that generate metrics.

There are two ways to organizing devices. The typical SevOne NMS user with report view and alert management permissions will note that SevOne NMS treats both device groups and device types similarly.

Device Groups enable you to organize devices into logical entities for security, report, and alert purposes. A user with permissions to manage devices can manage device groups but cannot manage device types.
Device Types enable you to organize devices into technological entities based on the discovery of similar SNMP objects. Device type management is restricted to more administrative users because device types have additional device discovery aspects.

Candidate

A candidate is something that a network scan successfully pings. A candidate has not been added into SevOne NMS and is not polled for metrics. In order to poll metrics for reports and alerts, you must add a candidate into SevOne NMS where it becomes a device.

Device

A device is composed of a collection of objects that represents a self-contained entity of some kind.

Desktop Computer
Server in the Datacenter
Network Router
Network Switch
Network Firewall
Load Balancer
Car
House

Object

Each object is a part of a device. The relationship is deliberate and is not subject to change. An object represents a logical entity that is some part of the device which can provide metrics about itself. Object level metrics are called indicators. In the examples, an object is either a component of the device or an object represents some logical entity that makes sense within the context of the device.

Device - Desktop Computer
- Object - Ethernet Port
- Object - First Hard Drive
Device - Server in the Datacenter
- Object - First Ethernet Port
- Object - First RAID Array
Device - Network Router
- Object - First Ethernet Port
- Object - Routing Processor
Device - Network Switch
- Object - First Ethernet Port
- Object - Switching Processor
Device - Network Firewall
- Object - First Ethernet Port
- Object - Processor
Device - Load Balancer
- Object - First Ethernet Port
- Object - Site that is being load-balanced
Device - Car
- Object - Driver Side Tire
- Object - Main Processor
Device - House
- Object - Smoke Alarm
- Object - Thermostat

Object Type

Many devices in the examples have an Ethernet port object. These Ethernet ports are somehow related. They are all the same because they are all Ethernet ports. They are all different because each Ethernet port is physically distinct from the other Ethernet ports. This abstraction of like objects is called an object type. All objects must have an object type. The object type describes objects as a concept, outside of their individual devices. An object can belong to only one object type.

Object types can be further abstracted and the more abstract form of an object type is simply another object type. This generalization could continue indefinitely and hierarchically. The collection of all object types is called the object type hierarchy.

Object types can be grouped hierarchically by plugin. This enables object abstraction. All objects within each hierarchical grouping are treated equally (e.g., CPU), irrespective of collection method, which make it much easier to define thresholds and to create reports.

Object Group

A way of managing segmented groups of enabled, visible objects to be reported and alerted on. You should outline your object groups to best suit your report requirements. Object groups have no effect on how objects are stored. If you plan your implementation appropriately, object group membership rules enable you to automatically assign objects to object groups.

You can organize devices into device groups. Device groups are more flexible than device types and are generally based on factors such as device location, accessibility, manufacturer, function, etc. As an Internet Service Provider (ISP) you could group devices by customer. You could group each customer's network devices into separate device groups to prevent your other customer from seeing metrics polled from their competitor's network devices. You could work your way down the device group hierarchy to further group devices into regions, etc. Users with Can Manage Devices permission can manage device groups but cannot manage device types.

Indicator

Object level metrics are called indicators. Remember, an object represents a logical entity that is some part of the device which can provide metrics about itself.

Indicator Type

All indicators of an object must have an indicator type. This means that an object has indicators and an object type has indicator types. An actual object that provides actual indicators is a specific instance of an object type that has indicator types.

Device Type

You can view devices as members of a device type similarly to the relationship that many individual objects can be viewed as if they all belong to one platonic object type. A device type is more flexible than an object type. Device types enable you to use SNMP discovery to organize the polled metrics for reports and alerts. For example: A specific device could apply to each of the following:

A Computer
A Server
A Linux Box
A Web Host
A BitCoin Miner
A Database

All of these statements can be simultaneously true. Each of these statements about devices enables you to determine the type of things to consider and each could be a device type. A device can be a member of many device types. A device is a member of a device type and a device type contains that device. The separation of device types is dependent on what you expect to see when you look at the device. For example, here are the things that you might want to see for each device type:

A Computer
- CPU
- Hard Drive
- Memory
A Server
- RAID Array
- Ethernet Port
A Linux Box
- Kernel Status
- Users
- Quota
A Web Host
- Apache Service
- Web Sites
A BitCoin Miner
- Miner Processes
- Bank Accounts
A Database
- MySQL Service
- Oracle Services

A device type is primarily defined by its list of distinguishing object types. The things you expect to see are the defining characteristics of each device type. Any one of the things listed for one device type could be present for any other device type. However, each defining characteristic is listed under the most direct device type, the one that is most defined by those things. Device types may share object types with other device types.

The collection of device types and all of their associated object types is called the device type hierarchy. SevOne NMS supports a device type hierarchy that can extend more than twenty levels.

Users need administrative permissions to manage device types. Users only need the Can Manage Devices permissions to manage device groups.

Device Group

Users with Can Manage Devices permission can manage device groups but cannot manage device types.

Table of Contents (Start)

Glossary

Concepts

Candidate

Device

Object

Object Type

Object Group

Indicator

Indicator Type

Device Type

Device Group