Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Suppression of alerts on interfaces connected to a neighboring device (NOT dependencies)

fleahops

Scenario:

Have "node down" alert and also have "interface down" alert

Node A goes down (power outage)

Node A has interfaces connected to 10 other nodes

Topology knows that:

Node A Interface 1 is connected to Node B Interface 1
Node A Interface 2 is connected to Node C Interface 1
Node A interface 3 is connected to Node D Interface 1
and so on

Since Orion knows that Node A is down (sends an alert for node down, suppresses interface down alerts on its own interfaces (child entities))

Does anyone know of a way to NOT trigger the "interface down" alerts for Nodes B - K interfaces?

Thanks!

Find more posts tagged with

Accepted answers

All comments

maciej.sandecki

What is your trigger condition for the Interface Down alert? In my environment I can see for nodes that are Unreachable that their interfaces are Unreachable too, not Down.

If you are using the Out-of-the-box Interface Down alert, note that it's 'Condition must exist for more than' is not enabled, so the alert will action immediately and sometimes (depending on polling order by the engine), the interface may be noticed as Down for a short period before it transitions to Unreachable (after parent was noted as Down).

fleahops

Excellent question - and sorry, I should have mentioned the B-K devices a bit more in the scenario.

All B-K Nodes are UP as they are dual connected to Node Z. So, those nodes are not Unreachable. This is why I mentioned that dependencies can't be a part of this but I should have clarified that so thank you for bringing that up. I appreciate it.

maciej.sandecki

I tried to leverage data in Orion.TopologyData entity. I wasn't able to test this extensively, but I think it works fine. Please see if this works for you.

Change the trigger condition to SWQL and put this:

LEFT JOIN Orion.TopologyData AS td ON (
		(Interfaces.NodeID = td.SrcNodeID AND Interfaces.InterfaceID = td.SrcInterfaceID)
		OR (Interfaces.NodeID = td.DestNodeID AND Interfaces.InterfaceID = td.DestInterfaceID)
		)
LEFT JOIN Orion.Nodes AS n ON td.SrcNodeID = n.NodeID
LEFT JOIN Orion.Nodes AS n2 ON td.DestNodeID = n2.NodeID
WHERE Interfaces.Status = 2 AND (n.Status IS NULL OR n.Status <> 2) AND (n2.Status IS NULL OR n2.Status <> 2)

Full code will look like this:

SELECT Interfaces.Uri, Interfaces.DisplayName
FROM Orion.NPM.Interfaces AS Interfaces
LEFT JOIN Orion.TopologyData AS td ON (
		(Interfaces.NodeID = td.SrcNodeID AND Interfaces.InterfaceID = td.SrcInterfaceID)
		OR (Interfaces.NodeID = td.DestNodeID AND Interfaces.InterfaceID = td.DestInterfaceID)
		)
LEFT JOIN Orion.Nodes AS n ON td.SrcNodeID = n.NodeID
LEFT JOIN Orion.Nodes AS n2 ON td.DestNodeID = n2.NodeID
WHERE Interfaces.Status = 2 AND (n.Status IS NULL OR n.Status <> 2) AND (n2.Status IS NULL OR n2.Status <> 2)

The idea is that for interfaces that have topology data available, it will check if the peer node is down and trigger alert only if it is not.

fleahops

Interesting. I configured this in our Dev environment. It immediately triggered on some StackSub interfaces that are down (which is good).

It did NOT however trigger on neighboring devices of a node that I made DOWN
The DOWN node has 5 of it's own interfaces that it put into "unreachable" (expected)

The neighboring 5 interfaces (on 5 other nodes) are, however, still showing as UP - which is COMPLETELY unexpected behavior as that is NOT what I have seen in my Prod environment.

For what it is worth, our existing "interface down" alert did not trigger either because the 5 neighboring interfaces are not DOWN.

Ha! Now I don't know what to think.