Alcatel-Lucent 7950 SR, System Management Manual

Page: 200 / 462

Distributed CPU Protection Commands
Page 200 7950 SR OS System Management Guide
- the policer state to be updated as normal
- all packets to be marked (if the action is “low-priority”) or dropped (action = discard)
regardless of the results of the policing decisions/actions/state.
The hold-down is cleared after approximately the configured time in seconds after it was set.
The hold-down seconds option should be selected for protocols that receive more than one
packet in a complete handshake/negotiation (for example, DHCP, PPP). hold-down is not
applicable to a local monitoring policer. The “detection-time” will only start after any hold-
down is complete. During the hold-down (and the detection-time), the policer is considered as
in an “exceed” state. The policer may re-enter the hold-down state if an exceed packet is detected
during the detection-time countdown. The allowed values are [none|1..10080|indefinite].
Values 1-10080 in seconds
none — no hold-down
indefinite — hold down is in place until the operator clears it manually using a tools command
(tools perform security dist-cpu-protection release-hold-down) or removes the dist-cpu-
protection policy from the object.
log-events
Syntax [no] log-events [verbose]
Context config>system>security>dist-cpu-protection>policy>static-policer
Description This command controls the creation of log events related to static-policer status and activity.
Default default = log-events
log-events: send the Exceed (Excd) and Conform events (e.g. sapDcpStaticExcd)
Parameters
verbose — (optional) Sends the same events as just “log-events” plus Hold Down Start and Hold
Down End events. The optional “verbose” includes some events that are more likely used during
debug/tuning/investigations.
local-monitoring-policer
Syntax [no] local-monitoring-policer policer-name [create]
Context config>system>security>dist-cpu-protection>policy>local-monitoring-policer
Description
This command configures a monitoring policier that is used to monitor the aggregate rate of several
protocols arriving on an object (for example, SAP). When the
local-monitoring-policer is deter-
mined to be in a non-conformant state (at the end of a minimum monitoring time of 60 seconds) then
the system will attempt to allocate dynamic policers for the particular object for any protocols associ-
ated with the local monitor (for example, via the “protocol xyz enforcement” CLI command).
If the system cannot allocate all the dynamic policers within 150 seconds, it will stop attempting to
allocate dynamic policers, raise a LocMonExcdAllDynAlloc log event, and go back to using the local