In event-based system, the network management protocols, work very differently to query-based systems.
In any event-based system, the network management system simply listens for possible announcements
or events to be sent over the wire.
Typically, network management protocols that leverage these types of events are either syslog based or
SNMP Trap based.
Now, they are controllable in terms of the amount of detail that you receive from devices on your network.
So as an example, on a Cisco router, you could enable debugging, which produces a very large amount
of data.
There's a lot of low-level detail that's generated with the debugging.
You may not necessarily want that amount of data pushed to your network management system.
One of the issues here is if you receive a large amount of data, who's going to sift through the data
to make meaningful decisions on the data that was received?
So you don't want to just enable lots of event-based information that's sent to you a Syslog server.
One of the advantages of event-based systems is that they can react very quickly.
In other words, if any event takes place on the network, the network management system can act on that
event immediately rather than waiting for a polling interval to expire.
As an example, if you were polling a router interface for its status every five minutes, then you would
know that that interface is up whenever the poll is done or query is done in a query-based system.
But if the interface goes down just after you pulled it, it may take another five minutes for you to
realize that the interface went down.
When your network management system polls the router every five minutes, it will receive back a positive
response from the router, confirming that the interface is up as an example that's typically done using
a network management protocol such as SNMP.
So you know the interface is operational because you've queried the router.
If you don't get a response from the router, then you know there's a problem.
But the downside of a query-based system is that you're only polling it every five minutes.
If the interface went down immediately after you had pulled the router, it could take up to five minutes
for you to realize that there's a problem on the interface of that router. Whereas in an event-based
system and SNMP Trap or Syslog message is sent immediately when the interface goes down.
So in this case, the router is informing the network management system that there's a problem rather than
the network management system having to wait a five minute interval to query the router for the status
of an interface.
Now, there is a downside to event-based systems, the network management protocols are not reliable
because the network management system is simply passively waiting and listening for events to be sent
to it.
It wouldn't know if there was a problem on the network if that event didn't reach the network management
system.
So there's a network issue or an interface went down that prevents the Syslog message or SNMP Trap
from getting to the network management system.
The network management system would be unaware of the problem without explicitly polling the network
device.