NETSCREEN-RESOURCE-MIB

All MIBs › NETSCREEN-RESOURCE-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-05-03

Category: Firewall

Description: Monitors CPU utilization, memory usage, session table capacity, and system resource thresholds on NetScreen firewalls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-RESOURCE-MIB?

NETSCREEN-RESOURCE-MIB is a Juniper NetScreen firewall MIB dedicated to monitoring internal system resource utilization on the security appliance. It exposes CPU load averages over multiple intervals, memory allocation/free/fragmentation statistics, and session table capacity and failure counts, organized under CPU, memory, and session object groups. This is squarely a hardware/software health monitoring MIB: nsResCpuLast1Min/5Min/15Min let an admin track CPU load trending toward saturation, nsResMemAllocate/nsResMemLeft/nsResMemFrag reveal memory pressure or fragmentation that could precede instability, and nsResSessAllocate/nsResSessMaxium/nsResSessFailed expose whether the firewall's session table is nearing capacity and dropping new connections. It is a NetScreen vendor-private MIB commonly polled alongside NETSCREEN-NAT-MIB and standard host-resource style MIBs on the same device. It is deployed on Juniper NetScreen/SSG firewalls at network perimeters where capacity planning and early-warning resource alerting are critical. Engineers can download the NETSCREEN-RESOURCE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-RESOURCE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper NetScreen/SSG firewall appliance

Monitoring Examples

An admin would graph nsResCpuAvg alongside nsResCpuLast1Min, nsResCpuLast5Min, and nsResCpuLast15Min to detect a sustained CPU spike indicating a possible attack or misconfigured policy causing excessive processing. nsResMemAllocate rising while nsResMemLeft falls toward zero, especially with high nsResMemFrag, would warn of an impending out-of-memory condition. nsResSessAllocate approaching nsResSessMaxium, or a rising nsResSessFailed counter, would indicate the firewall's connection table is saturated and new sessions are being rejected, a common symptom during DDoS traffic.

What Can Be Monitored

CPU utilization (1/5/15-minute averages)
memory allocation and fragmentation
session table utilization
failed session allocations

Imported Objects

From NETSCREEN-SMI

netscreenResource

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using nsResCpuAvg OID:

Select a Juniper NetScreen/SSG firewall appliance (CPU/memory/session resource utilization) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsResCpuAvg into the Find box to locate it in the OID tree, then select it and click OK. It reports the average System CPU utilization in percentage. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if utilization exceeds 85%, a common warning threshold before sustained high load affects performance. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenResourceMibModule	1.3.6.1.4.1.3224.16.0			This module defines the object that are used to monitor resource in netscreen box
nsResCPU	1.3.6.1.4.1.3224.16.1
I32 nsResCpuAvgEx	1.3.6.1.4.1.3224.16.1.1	Integer32	read-only	Average System CPU utilization in percentage.
I32 nsResCpuLast1Min	1.3.6.1.4.1.3224.16.1.2	Integer32	read-only	Last one minute CPU utilization in percentage.
I32 nsResCpuLast5Min	1.3.6.1.4.1.3224.16.1.3	Integer32	read-only	Last five minutes CPU utilization in percentage.
I32 nsResCpuLast15Min	1.3.6.1.4.1.3224.16.1.4	Integer32	read-only	Last fifteen minutes CPU utilization in percentage.
nsResMem	1.3.6.1.4.1.3224.16.2
I32 nsResMemAllocate	1.3.6.1.4.1.3224.16.2.1	Integer32	read-only	Memory allocated.
I32 nsResMemLeft	1.3.6.1.4.1.3224.16.2.2	Integer32	read-only	Memory left.
I32 nsResMemFrag	1.3.6.1.4.1.3224.16.2.3	Integer32	read-only	Memory fragment.
nsResSession	1.3.6.1.4.1.3224.16.3
I32 nsResSessAllocate	1.3.6.1.4.1.3224.16.3.2	Integer32	read-only	Allocate session number.
I32 nsResSessMaxium	1.3.6.1.4.1.3224.16.3.3	Integer32	read-only	Maxium session number system can afford.
I32 nsResSessFailed	1.3.6.1.4.1.3224.16.3.4	Integer32	read-only	Failed session allocation counters.
nsResModTable	1.3.6.1.4.1.3224.16.4		not-accessible	System status for multiple modules.
nsResModEntry	1.3.6.1.4.1.3224.16.4.1		not-accessible	Each entry in the table holds a session status parameters associated with an instance of security module.
I32 nsResModModId	1.3.6.1.4.1.3224.16.4.1.1	Integer32	read-only	Module ID for security module. Each ID uniquely identifies a single Security Module.
I32 nsResModCpuId	1.3.6.1.4.1.3224.16.4.1.2	Integer32	read-only	CPU Identifier. Each ID uniquely identifies a single CPU residing on a Security Module.
I32 nsResModCpuCurr	1.3.6.1.4.1.3224.16.4.1.3	Integer32	read-only	Current System CPU utilization in percentage.
I32 nsResModCpuLast1Min	1.3.6.1.4.1.3224.16.4.1.4	Integer32	read-only	Last one minute CPU utilization in percentage.
I32 nsResModCpuLast5Min	1.3.6.1.4.1.3224.16.4.1.5	Integer32	read-only	Last five minutes CPU utilization in percentage.
I32 nsResModCpuLast15Min	1.3.6.1.4.1.3224.16.4.1.6	Integer32	read-only	Last fifteen minutes CPU utilization in percentage.
I32 nsResModMemAllocated	1.3.6.1.4.1.3224.16.4.1.7	Integer32	read-only	Current memory allocated for this cpu
I32 nsResModMemLeft	1.3.6.1.4.1.3224.16.4.1.8	Integer32	read-only	Current free memory for this security module. Since this is shared memory the same value is returned for both the cpus.
I32 nsResModSessAllocated	1.3.6.1.4.1.3224.16.4.1.9	Integer32	read-only	Number of sessions currently allocated for this Security Module's cpu.
I32 nsResModSessMaximum	1.3.6.1.4.1.3224.16.4.1.10	Integer32	read-only	Maximum number of sessions supported by this Security Module's cpu.
I32 nsResModSessFailed	1.3.6.1.4.1.3224.16.4.1.11	Integer32	read-only	Number of sessions failed for this Security Module's cpu.

RFC description

Juniper NetScreen firewall resource management MIB monitoring system resources (CPU, memory, sessions, throughput) on NetScreen security appliances (vendor product-specific).

Start monitoring Juniper NetScreen/SSG firewall appliance (CPU/memory/session resource utilization) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-RESOURCE-MIB