H3C Technologies H3C Intelligent Management Center - Manual (Page 70)

60
3 Host session monitoring
This chapter provides you with information on Host Session Monitoring in NTA, beginning with how NTA
analyzes network flow records to report on network traffic from host session perspective. This chapter
looks at the reporting options for host session monitoring and reviews configuration issues around host
session monitoring and the reports they generate. This chapter concludes with a survey of the summary
reports for all NTA servers as well as a look at the more granular reports for the devices configured in
NTA server.
Host session monitoring overview
NTA analyzes network flow data for host sessions. Devices configured on an NTA server send flow data
to the server. The NTA server parses the flow data and provides statistics on device host sessions and
NTA server sessions. NTA then generates an NTA host session report according to the statistical data of
all NTA servers. NTA allows you to set threshold alarms for host sessions. If you want to generate alarms
based on the data collected by devices configured on NTA servers, set the threshold alarm function in the
device host sessions monitor. By setting the threshold alarm parameters, you can quickly identify the hosts
that have an abnormal number of connections on the network.
Host session monitoring reporting
After you enable the Host Session Monitor feature in the NTA traffic analysis parameters, NTA creates a
Sessions entry under the Traffic Analysis and Audit area of the left navigation tree. Click the Sessions link
to view the host session report of all NTA servers.
To view the host session report of a single NTA server, move your mouse pointer to the shortcut menu icon
to the right of the Sessions link. The Sessions shortcut menu displays the names of all NTA servers.
Click the link for a name to view the host session report of a single NTA server.
To view the host session report of a device attached to an NTA server, click the Expand icon next to
an NTA server on the shortcut menu to display the devices which send traffic statistics packets to the NTA
server. Click the device name link for a device to view the host session report of a single device.
Host session monitoring configuration considerations
Host session monitoring is a global configuration. By default, NTA does not provide statistics on host
sessions. Therefore, you must enable this feature in the NTA traffic analysis parameters. For instructions,
see " Configuring NTA traffic analysis parameters ."
You must enable network flow data on the devices you want to monitor and report on using NTA.
Managing host session monitoring
After host session monitoring is enabled, NTA can process, analyze, and report on network flow data.
The following information explains how to set threshold alarm parameters for host sessions in NTA.