We have an alert configured for interface down but what if we unplugged something and it should be down?

Greetings Everyone -

I have found various Thwack articles on this issue not sure if there have been any updates on how to handle.

We have an alert that covers our networking equipment to send out an alert if an interface goes down. This goes off if anything is unplugged or removed. So even if someone unplugged something on purpose we get an alert.

I found this article - it discusses setting the ports to unplugged so if they will not alert. It also discusses to only monitor important ports -

https://thwack.solarwinds.com/products/network-performance-monitor-npm/f/forum/59250/interface-down-when-not-used

Has anyone else done anything creative for an interface down alert?

Thanks -Dave

Find more posts tagged with

network_monitoring

npm

interface

Accepted answers

All comments

chad.every

There is an option to switch the interface to 'unpluggable' so that it does not go into a down state. So if your alert is set to Status = Down, then these interfaces will not trigger it.

https://documentation.solarwinds.com/en/success_center/npm/content/npm-setting-interface-management-states-sw668.htm

Edit an interface and check the box for 'Display interface as unplugged rather than down.

It'll set the icon to a blue plug when the interface is down.

stuartd

I'm on the fence with regards to having every interface 'visible' **

Our documented approach is that we only monitor links to other networking kit. So switch to Switch/FW/Router/LB/etc of FW or even one of our servers. That way we know if something goes down then either it is a fault, or an ABC. ABC = Another Bad Change - as in a change engineer hasn't followed process and muted or unmanaged the node prior to commencing work.

** if we didn't have NCM then I would absolutely push for us to use 'unplugged' so as to be able to report on such. FWIW, I like the approach WhatsUp Gold takes in that you can "hide" interfaces, etc that you aren't monitoring but they are there if you wish to see them.

stuartd

OOI Chad, does unplugged count towards your license elements total?

chad.every

For NPM licensing yes, Observability Self-Hosted (Formerly HCO), no. My screenshots are from a lab. In production, i never cared much for access ports, I only monitored by trunk/uplink ports.

FreshPresence

[deleted]

stuartd

Not weighing anything... literally sitting on the fence here

Let's put my thinking another way. I don't like the idea of flood monitoring. You end up with waaaaay too many alerts for irrelevancies.

The only situation, when using SW software, that I could countenance the idea is if we/the client didn't have NCM backing up all their devices. Especially when said client wants what they call a "Volumetrics Report" because they are being charged for ports in use. Without NCM and flood monitoring you wouldn't have that data. With NCM and restricted monitoring you do get that data because you are interrogating the config of a device rather than extracting info from a DB.