Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

What could the reason for the alert to miss ?

We have missed alert for bgp neighbor down, that flapped for few seconds,

logs from node:

May 15 17:55:48.194 UTC: %BGP-5-ADJCHANGE: neighbor 10.228.226.1 Down BGP Notification received

May 15 17:55:59.346 UTC: %BGP-5-ADJCHANGE: neighbor 10.228.226.1 Up

May 15 18:00:22.346 UTC: %BGP-5-ADJCHANGE: neighbor 10.228.226.1 Down BGP Notification received
May 15 18:00:32.361 UTC: %BGP-5-ADJCHANGE: neighbor 10.228.226.1 Up

As seen on both logs, both happened for quite few seconds.

but in SolarWinds there were no alerts, alert condition are:

any suggestion or ideas what could be the reason?

NOTE: Alert for BGP are there for other nodes but on one node we have not received.

Find more posts tagged with

Accepted answers

All comments

stuartd

Without having any idea on your environment it could simply be that the alert for the node in question didn't exist for long enough. Even though you have the "alert must exist for" box unticked, there is still the polling cycle you have to consider.

It could simply be that it went down/up in between one poll and the next.

NetDev_sol

Sorry missed to put the polling information, the polling interval for nodes is 5 Mins.

bobmarley

Perhaps consider using Syslog or SNMP traps alerts from the routers in addition to the polling alerting. From your logs it appears that the outage was just a few seconds and the SNMP polling didn't catch it as @stuartd stated.

NetDev_sol

So, the conclusion would be In SolarWinds, alerts are triggered based on the conditions set and the polling interval. If any flap occurred and resolved within the polling interval (5 minutes in our case), it’s possible that SolarWinds didn’t detect the issue because it occurred between polls, the nature of SNMP polling means that brief issues might not be detected if they resolve between poll cycles.

So to overcome, Syslog or SNMP traps are recommended.

Thanks @stuartd & @bobmarley .

Just by any chance, it is nothing to do with the alert evaluation frequency on missing the alert right or is there ?