An event based systems the network management protocols work very differently to query based systems.
In any event based system the network management system simply listens for possible announcements or
events to be sent over the wire.
Typically network management protocols that leverage these types of events.
So either source log based or S&P trap based.
Now they all controllable in terms of the amount of detail that you receive from devices on your network.
So as an example on a Cisco Rada you could enable debugging which produces a very large amount of data.
There's a lot of low level detail that's generated with the debugging.
You may not necessarily want that amount of data pushed to your network management system.
One of the issues here is if you receive a large amount of data who's going to sift through the data
to make meaningful decisions on the data that was received so you don't want it just enable lots of
event based information that's sent to you as a slog server one of the advantages of event based systems
is that they can react very quickly.
In other words if any event takes place on the network the network management system can act on that
event immediately rather than waiting for a polling interval to expire as an example.
If you are polling a rowdy interface for its status every five minutes then you would know that that
interfaces up whenever the poll is done or query is done in a query based system.
But if the interface goes down just after you pulled it it may take another five minutes for you to
realize that the interface went down when your network management system pulls the router every five
minutes it will receive back a positive response from the router confirming that the interfaces up as
an example.
That's typically done using a network management protocol such as an MP so you know the interface is
operational because you've queried the Rada if you don't get a response from the router then you know
there's a problem.
But the downside of a query based system is that you're only polling at every five minutes.
If the interface went down immediately after you had pulled the router it could take up to five minutes
for you to realize that there's a problem on the interface of that rudder where as in an event based
system and S&P trap or source log messages sent immediately when the interface goes down.
So in this case the road is informing the network management system that there's a problem rather than
the network management system having to wait a five minute interval to query the Rada for the status
of an interface.
Now there is a downside to event based systems.
The network management protocols are not reliable because the network management system is simply passively
waiting and listening for events to be sent to it.
It wouldn't know if there was a problem on the network if that event didn't reach the network management
system.
So if there's a network issue or an interface went down that prevents the source log message or S&P
trap from getting to the network management system the network management system would be unaware of
the problem without explicitly polling the network device.