NOOB Question: I need to know more about the issue detected...

NOOB Question: I need to know more about the issue detected... "An issue has been detected at Monday, May 19, 2025 22:46 on Cisco Catalyst C8500-12X device named blah.blah.local (DNS: )

Is there a variable I can put in the alert that gives me a clue about the "issue" ????

I'm currently using

$(N=SwisEntity;M=SysObjectId)

Which tells me I have an issue on a Cisco Catalyst C8500

Are there other variables that will tell me more?

I am running NPM, NTA 2025.1

Thanks

Find more posts tagged with

Accepted answers

All comments

TerryHarding

Hi Alan,

It depends what you are alerting on. Generally ${N=SwisEntity;M=Status} will give more detail. A useful list of variables can be found here: solarwindscore.my.site.com/.../Commonly-Used-Alert-Email-Variables

bourlis

It appears your alert message is a generic message and if that's the case its entirely possible that alert covers a wide range of issues. So to answer your question, yes you can technically put an insanely large number of variables to cover an equally large number of issues. However, that would not be a wise choice.

I agree with Terry, use ${SWISEntity;M=Status} as a base rather than SysObject. I would also suggest investing time in your alerting schemas so that you have a solid alerting structure. For example here's that I have in my SW instance.

Explicit node up/down alerts with custom property intelligent alerting.
Explicit node hardware issues with custom property intelligent alerting.
Explicit node CPU/Memory issues with custom property intelligent alerting.
Explicit BGP alerting.
Explicit OSPF alerting.
Explicit EIGRP alerting
- we have plans to merge the above routing alerts and then add custom property intelligent alerting.
Config change alerting

The list goes on from there, but you can see based on the alerting structure there's little to no room for questions regarding the alerts.

alanrdailey

Thank you for the hints.

alanrdailey

Thanks you for the hints.
Good News .. I tweaked using $(N=SwisEntity;M=Status)
Bad news...My event hasn't triggered.
Event is a Tunnelled Ethernet WAN link that drops every once in a while....