Alarm whenever a route disappears/appears on routing table

gfalconx

I'm new to Solarwinds Orion and would like to get an Alert whenever there are route changes on our route table via BGP.

Currently I'm using the built in Neighbor down Alert but it doesn't work.

The Alert I am looking at should show which router and what routes have been added and deleted.

Thanks!

Find more posts tagged with

Alerts

Accepted answers

All comments

bobmarley

Possibly try something of this sort.

gfalconx

Thanks @bobmarley

I have setup this alarm already but like is it possible that when it sends an alarm via email, it gives us the details of what have been added or removed?

Im trying to look for the right variable to use but just can't figure it out.

On my message for the email i have this variable placed at least so it can give us the device that is alerting - ${N=SwisEntity;M=Router.Nodes.DisplayName}

But just cant figure out if its possible and if a variable of such exists that it can give us details on what was added or removed in the routing table.

bobmarley

This is what I use in my subject line of my emails for this alert. You will need to fill in your own domains and match the code to the number of them you have. You could also pull the variables out.

Alert ${N=Alerting;M=AlertName} is ${SQL:SELECT StatusName FROM StatusInfo WHERE StatusID='${OrionStatus}'} : ${N=SwisEntity;M=ProtocolName} on ${SQL: select replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(n.caption,'.net',''),'.org',''),'.oakhealth',''),'.ad',''),'.bh',''),'.beaumonthealth',''),'.ohsnet',''),'.beaumont',''),'.edu',''),'.ms','') from nodes n where n.nodeid=${nodeid} } is ${N=SwisEntity;M=ProtocolStatusDescription} with Neighbor ${N=SwisEntity;M=NeighborIP} ${SQL: select top 1 isnull((SELECT top 1 replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(n.caption,'.net',''),'.org',''),'.DOMAIN1',''),'.DOMAIN2',''),'.DOMAIN3',''),'.DOMAIN4',''),'.DOMAIN5',''),'.DOMAIN6',''),'.DOMAIN7',''),'.DOMAIN8','') FROM nodes n join NodeIPAddresses nip on nip.nodeid = n.nodeid WHERE nip.IPAddress like '${N=SwisEntity;M=NeighborIP}'),'No Node found') from nodes}

The resulting email looks like this: (Names changed to protect the innocent)

Subject: Alert Router Neighbor Status is Unknown : Cisco EIGRP on SOURCENODENAME is with Neighbor 10.12.45.99 REMOTENEIGHBORNAME

gfalconx

Thanks @bobmarley I will try this string.