Network monitoring for a small agency: what to watch and why

Reference article · 6 min read

Most city, county, and special district IT shops run the network with a small team that also handles the help desk, the phone system, and a stack of vendor-hosted applications. Monitoring earns its cost only when it shortens the distance between a failure and a competent response. A dashboard nobody reads, or an alert stream that pages for every interface flap, does not do that. A short, well-chosen set of checks does.

What follows is a practical baseline: what to watch on a small agency network, what each signal actually tells you, and how to size a tool to your inventory before you sign anything. It assumes a few dozen to a few hundred monitored devices, one or two data closets, some remote sites, and a handful of resident-facing pages the public notices immediately when they break.

Three ways to collect a signal

Nearly every product is some mix of three collection methods. Knowing the difference keeps you from buying two tools that do the same job.

Polling. The monitoring server asks each device on a schedule for its current state, usually SNMP for network gear, ICMP for reachability, and an agent or SSH for servers. Polling answers "is it up, and what are its counters right now." It is the backbone of any baseline, and its blind spot is whatever happens between polls.
Flow. Switches, routers, and firewalls export summaries of the conversations passing through them using NetFlow, sFlow, IPFIX, or a vendor variant. Flow answers "who is using the circuit and for what." It is how you tell a saturated link caused by backups from one caused by a misbehaving workstation. It says nothing about device health and produces far more data than polling, so plan retention deliberately.
Synthetic checks. The system performs the transaction a user would: load a page, resolve a name, complete a TLS handshake, sign in to a portal. Synthetic checks answer "does the service work from where people use it," and they are the only method that catches a site that is technically up and functionally broken, such as an expired certificate or a payment page returning an error.

Polling and synthetic checks belong in every baseline. Flow can wait until the first two are steady.

The baseline: reachability and the path outward

Circuits and ISP reachability. Monitor the WAN interface, and separately monitor reachability to a stable external target through that circuit. An interface stays up while the provider's upstream path is broken. Track latency and loss over time, not only up and down, so you have evidence when you open a ticket.
DNS and DHCP. Test actual resolution and lease behavior, not only whether the service is running. A DNS server can be up and answering wrongly.
VPN tunnels. Small agencies typically carry tunnels to state systems for justice, health, motor vehicle, or benefits data, plus tunnels to remote sites such as a water plant, library, or fire station. Watch tunnel state and traffic volume through it. A tunnel that is nominally up but passing nothing is a common and expensive failure.
Switches and wireless. Poll uptime, CPU, memory, interface errors, and Power over Ethernet load. For wireless, watch controller reachability, access points dropping out of the controller, and client counts per site. Rising interface errors usually mean a cable or optic about to fail, which is a problem you want to fix on a Tuesday rather than during a council meeting.
Resident-facing services. Pick the few pages the public would notice within minutes: the main site, utility payments, permits, agendas, the non-emergency report form. Check them from outside your own network, and include certificate expiration dates.

Power, cooling, and the closet nobody visits

Environmental monitoring prevents a class of outage that takes far longer to recover from than a software failure.

UPS status. Watch input power state, battery charge, estimated runtime, and self-test results. Battery age is the most predictable failure in a small closet.
Generator status. Where one exists, watch run state, transfer switch position, and fuel level if the controller exposes it.
Temperature and humidity. Place sensors in every closet holding active gear, including rooms in remodeled buildings never designed for equipment. Alert on rate of rise as well as absolute temperature, because a failed closet air conditioner shows as a slope before it shows as a number.
Door and water sensors. Inexpensive, and worth it in basements and mechanical rooms.

Sizing a tool before you buy it

Build the inventory first, then shop.

Count monitored elements, not devices. Most licensing counts interfaces, sensors, or metrics, so one 48 port switch is a single device and many elements.
Add remote sites, cameras, wireless controllers, UPS units, and facilities systems that already sit on your network. These are routinely forgotten and they drive the quote.
Decide polling interval and retention. Short intervals and long history drive storage and license cost as much as device count does.
Add known growth: a building coming online, a camera expansion, a plant upgrade.

What to ask vendors and require in the contract

Ask exactly how licenses are counted, and get the count applied to your inventory in writing before award.
Ask what happens when your element count grows mid-term, and what the overage mechanism and price are.
Ask whether collected data stays in your environment or goes to the vendor's cloud, and confirm any hosted option is acceptable for the data involved. State requirements and the terms of state system agreements vary and change, so verify with the system owner or your counsel rather than relying on a vendor's summary.
Require export of configuration and historical data in a documented format, so a future migration does not start from zero.
Require role based access and an audit record of who acknowledged or silenced an alert.
Ask for a short evaluation on your own network with your own devices, not a scripted demonstration.

Finally, decide who receives which alert and at what hour before turning notifications on. A baseline that pages the right person for the right five things is more useful than full coverage nobody trusts.

HQT works with state and local agencies on network and infrastructure monitoring design, including inventory baselining and requirements development for procurement.

Frequently asked questions

What should a small city IT department monitor first if it has never had a monitoring tool?

Start with reachability and the paths out of your network: WAN circuits, internet reachability through each circuit, DNS and DHCP, VPN tunnels to the state and to remote sites, and core switches. Add synthetic checks on the handful of resident-facing pages the public would notice within minutes, including certificate expiration. Environmental and UPS monitoring in equipment closets should follow close behind, since power and cooling failures take the longest to recover from.

What is the difference between SNMP polling and NetFlow, and do I need both?

SNMP polling asks devices on a schedule for their current state and counters, which tells you whether something is up and how hard it is working. Flow data, exported as NetFlow, sFlow, or IPFIX, summarizes the conversations crossing a device, which tells you who is consuming a circuit and for what. Most small agencies should get polling and synthetic checks working reliably first, then add flow when they need to explain link saturation rather than just detect it.

How do monitoring vendors count licenses, and why do quotes vary so much?

Licensing is usually based on monitored elements such as interfaces, sensors, or metrics rather than on physical devices, so a single large switch can consume many license units. Polling interval and data retention also affect storage and tier pricing. Build your element inventory first, then ask each vendor to apply its counting method to that inventory in writing before award, and ask what the mechanism and price are if your count grows during the contract term.

Why should I monitor VPN tunnel traffic and not just tunnel status?

A tunnel can report itself as established while passing no usable traffic, which happens after routing changes, policy mismatches, or a rekey failure on one side. If you only watch tunnel state, the first sign of trouble is a user unable to reach a state system. Watching traffic volume or running a synthetic check against a host on the far side catches the condition before the phone rings.

Should environmental sensors be part of network monitoring or handled by facilities?

Both groups have an interest, but IT should have its own visibility into the closets holding active equipment, because a cooling failure there becomes an IT outage regardless of who owns the air conditioner. Temperature, humidity, UPS state, and water detection are inexpensive to monitor and integrate with most network monitoring tools. Agree with facilities on who responds to what, and document that in writing so an after-hours alert has a clear owner.