You can take a look at what all the network devices you're responsible for were doing during a problem. Figure 3 shows an example of an MRTG graph that covers 36 hours worth of traffic in 5-minute intervals. For instance, one of the metrics you can measure with MRTG is connections per second, which produces a graph such as the one shown in Figure 4. For a closer look at load balancers and MRTG, check out the MRTG site I maintain . Syslog Virtually every load-balancing product has some way to write to a syslog server, or, in some cases, to store syslog locally.
Logs are an invaluable tool in helping to diagnose problems when they arise.
Check the syslog documentation for your load balancer to learn more. It's critical that you have a way to quickly and easily analyze traffic as it passes through the network for troubleshooting purposes. To capture traffic just about any Unix machine will do. To monitor traffic on the sniffing machine, most switch vendors offer the ability to do something called port mirroring. Port mirroring is when one port duplicates the traffic of another port for the explicit purpose of monitoring traffic.