H3C Technologies H3C Intelligent Management Center - Manual (Page 232)

222
8 Host monitoring
This chapter describes host monitoring in NTA, including how NTA analyzes network flow records to
report on network traffic from a host perspective. It provides an overview of how NTA looks at network
flow data from the viewpoint of hosts; how it reviews the report structure for host traffic reports; and how
it manages configuration issues around host analysis tasks and the reports they generate. This chapter
describes the process for adding host traffic analysis tasks, and adding, modifying, and deleting host
tasks in NTA. It surveys the summary reports for all host tasks. Finally, it looks at the more detailed reports
for an individual host traffic analysis task.
Host traffic analysis overview
Host traffic analysis tasks analyze network flow data by the IP addresses of hosts configured in a host
traffic analysis task. NTA parses all network flow data and provides various statistical views of traffic that
was observed for the hosts configured in a host traffic analysis task. For example, NTA provides
application information reporting for a given host or set of hosts. NTA displays the rate of application
traffic attributed to the specified hosts observed sending or receiving application traffic. Because
analyses based on hosts are not tied to a specific interface, device, or probe network flow data sources,
host reports provide visibility for all areas of the network that generate network flow records.
The NTA host traffic analysis tasks provide traffic statistics for all hosts configured in the host traffic
analysis tasks. In general, the host traffic reports include rate of traffic for all hosts in all configured host
traffic analysis tasks and for the hosts in a task. Host statistics include per-second traffic rate for each host;
for application traffic observed for the configured host; and for distribution of host traffic generated by
source host, destination host, or by a session or source/destination host pair. These reports are
organized into multiple layers from summarized information for tasks to detailed reporting for specific
hosts configured for a host traffic analysis task.
Host traffic analysis reporting overview
After you create the first host traffic analysis task, NTA creates an entry called Host Traffic Analysis
Task under the Traffic Analysis and Audit area on the left navigation tree.
Click Host Traffic Analysis Task on the left navigation tree to view the summary report for all host traffic
analysis tasks.
Move your mouse pointer to the shortcut menu icon to the right of Host Traffic Analysis Task. The
Host Traffic Analysis Task shortcut menu appears to display all host traffic analysis tasks created in NTA.
Click the name link for a task to view the host traffic analysis report of the task.
The summary host traffic analysis report provides the following information:
• Average Rate (Last 1 Hour)—This bar graph provides summarized average rate per second
reporting for all hosts specified in all host traffic analysis tasks summarized by task name. Each bar
in the graph is a link to more detailed reporting for the selected task, including reporting for traffic
rates, application, source, destination, and session statistics. Each of these detailed report types
also include several reports: