First Lines of Defense: Active Directory, WhatsUp Gold & MRTG Network Telemetry

“Before Grafana or Datadog existed, network operations relied on MRTG green-and-blue SNMP graphs and WhatsUp Gold acoustic alerts.”

The Setup

In November 2008 at HCL Infosystems Ltd, I began my career as a Network Administrator (On-the-Job Training). We managed the enterprise campus network, Windows Active Directory Domain Controllers (Windows Server 2003), and EPABX voice trunks.

To maintain visibility across 80+ network switches and routers, we deployed WhatsUp Gold v12 for SNMP ping polling and MRTG (Multi Router Traffic Grapher) for interface bandwidth graphs.

The Mess

Without proactive SNMP monitoring, network outages were only reported when hospital department heads phoned the helpdesk.

One Monday morning, the central Active Directory Domain Controller froze due to a corrupted SYSVOL replication log, locking 500 medical staff out of their workstations:

[CRITICAL] 2008-11-10 08:30:15 IST - Windows Event Viewer (DC-01.artemis.local)
Event ID: 13559 | Source: NtFrs
The File Replication Service has detected that the replica root path is changed from "c:\windows\sysvol\domain" to "c:\windows\sysvol\domain".
Result: User Authentication Frozen across all 30 Hospital Department OUs.
WhatsUp Gold Alert: Device DC-01 (192.168.1.5) Status: DOWN (No SNMP Response for 300 seconds).

Because MRTG and WhatsUp Gold were running on a neglected desktop PC without proper alert thresholds, the team wasted 45 minutes diagnosing physical cable connections instead of identifying the AD service lock.

The Solution

I upgraded the network telemetry stack and hardened Active Directory Group Policies (GPO):

1. WhatsUp Gold SNMP Alarm Engine: Configured threshold-based email and acoustic alerts for CPU >90%, Memory >95%, and ICMP packet loss >5%.
2. High-Frequency MRTG Polling: Tuning MRTG SNMP v2c polling intervals to 5 minutes across all Cisco 3750 switch trunks.
3. Active Directory SYSVOL Cleanup & GPO Hardening: Repaired FRS replication stanzas and standardized domain login scripts across all department OUs.

# MRTG Configuration File Fragment (mrtg.cfg)
Target[switch_core_gi0_1]: 1.3.6.1.2.1.2.2.1.10.1&1.3.6.1.2.1.2.2.1.16.1:public@192.168.1.1
MaxBytes[switch_core_gi0_1]: 125000000
Title[switch_core_gi0_1]: Core Switch GigabitEthernet 0/1 Bandwidth
PageTop[switch_core_gi0_1]: <h1>Artemis Core Switch Trunk Traffic</h1>
Options[switch_core_gi0_1]: gauge, nopercent

# WhatsUp Gold SNMP Polling Diagnostic Log
[WHATSUP GOLD LOG] 2008-11-18 09:00:00 IST
Device: Core-Switch-3750 (192.168.1.1)
Poll Method: SNMP v2c (Community: public)
Active Monitors: Ping (UP), Interface 10101 (UP), CPU Utilization (12% - OK)
Alert Action Triggered: Email Sent to NOC-Team@artemis.local on Status Change.

The Results

Modernizing WhatsUp Gold SNMP monitoring and Active Directory replication restored NOC confidence:

• Outage Detection Speed: Reduced average incident detection time from 45 minutes to 60 seconds via SNMP polling.
• Domain Authentication Uptime: Achieved 99.95% Active Directory login availability across 500+ workstations.
• Bandwidth Bottleneck Visibility: MRTG traffic graphs identified 3 over-utilized 100Mbps trunk links, prompting an immediate Gigabit upgrade.

Key Takeaway

Observability fundamentals do not change across decades. Whether using 2008-era MRTG SNMP graphs or 2026-era Cloudflare Worker telemetry, real-time threshold alerting is the difference between proactive engineering and reactive firefighting.

Architecture and decisions: mine. MRTG configs & AD troubleshooting: mine. AI assistance: structure, syntax, first draft. — Sachin