H3C Technologies H3C Intelligent Management Center - Manual (Page 325)

315
• Trigger—This field indicates under what conditions the threshold is triggered. This
condition has two configuration parameters, the time interval and the number of times
that the threshold must be exceeded.
• In Threshold—This field indicates the threshold value or volume of inbound traffic that
must be exceeded before NTA generates an alarm. Configure this field when you specify
the Direction field as In or In/Out.
• Out Threshold—This field indicates the threshold value or volume of outbound traffic that
must be exceeded before NTA generates an alarm. Configure this field when you specify
the Direction field as Out or In/Out.
• Severity—This field indicates the severity level of the triggered threshold alarms. The
value must be Major.
• Discard Length—This field specifies the time interval in which a triggered alarm will not
be sent again. Options are None, Last 30 minutes, Last 1 hour, and Last 2 hours. The
default setting is Last 30 minutes.
If the Threshold Alarm list is not displayed, the Threshold Alarm feature has been disabled on
the NTA server. For more information on configuration options for the NTA server, including
the Threshold Alarm feature, see " Configuring NTA traffic analysis parameters ."
In a traffic analysis task, you add a combination of hosts and applications that define a
business service. For each business service you create, you specify whether or not you want
NTA to include or exclude traffic from the hosts and applications.
e. To include traffic from the hosts and applications you specify as a business service, select
Include from the IP Stat. Direction list. To exclude traffic from the hosts and applications you
specify as a business service, select Exclude.
f. You can add one or more IP hosts or IP address ranges to a traffic analysis task. However, you
must have at least one host defined, and no more than 10 host entries defined for each task.
You can add multiple businesses in a traffic analysis task.
You can configure a traffic analysis task to include traffic for one or more hosts defined by IP
address. Alternatively, you can enter a range of IP addresses to be included in the analysis, or
you can enter a combination of IP host addresses and IP address ranges. However, no two
addresses or address ranges entered in the Host IP field can overlap.
g. Add IP address entries in the Host IP field.
To enter the IP address for a single host, use dotted decimal notation.
An example of a valid IP address entry is as follows:
10.153.89.10
An example of a valid network/subnet mask in dotted decimal notation is as follows:
10.153.89.0/255.255.255.0
An example of a valid network/subnet mask entry using CIDR notation is as follows:
10.153.89.0/24
An example of a valid IPv6 address entry is as follows:
a001:410:0:1::1
An example of a valid IPv6 address and subnet mask using CIDR notation is as follows:
a001:410:0:1::1/64
h. Click the Add button to the right of the Host IP field.
The addresses and masks you entered are added to the Host IP List field below the Host IP field.
12. To add applications to the task, click the Add button to the right of the Application List field.