Simple alert for interface down

I have a switch that I have created an alert to tell me when any of three interfaces are down. It looks straightforward, but when I get to the last page, it tells me it would not be triggered by any nodes, when one of three interfaces is currently down.

Here is a screenshot of the trigger condition:

Here is the status as shown in the node:

I don't see where my error is. I would rather not create a Universal Device Poller for this, if I can do it with the built-in poller.

Find more posts tagged with

poller

alert triggers

Alerting

Accepted answers

All comments

TerryHarding

Can you just use Status rather than the selected "Operational Status ((Interface via"? I can't make out what the full condition is, but that looks to be the issue.

John-AVUSD

I think I have tried just simple "status". I chose the operational version because I saw that term elsewhere in SolarWinds for the status of the port.

I changed the value on the condition for the port I know is down to Status ( Interface via Interface on Node ) and still no devices will trigger the alert when I get to the summary page of the alert.

John-AVUSD

There is a way to find out what the variables do in the Trigger Actions section. You can add a variable to the email and then simulate the action by selecting a device to simulate on. Such as this new switch. I have not found any of the interface status variables that will show the interface status as down. Clearly, SW can tell because it's red in the interface list. It shouldn't be this hard to find the variable it is polling to see that state.

donrobert5

Try putting in the full interface name example xe-0/2/2 - CENIC VLAN 702 LACP LAG to CENIC Switch

John-AVUSD

That's a description not the interface name.

Physical interface: xe-0/2/2, Enabled, Physical link is Up
Interface index: 708, SNMP ifIndex: 565, Generation: 204
Description: CENIC VLAN 702 LACP LAG to CENIC Switch.

Tyndl

try this out.

John-AVUSD

That looks simpler. I'll give it a try. I'm working on a UDP method too.

John-AVUSD

Tyndl,

No change. I'll add a variable that is simple, like the Node Name and see if the simulation at least can return that.

donrobert5

@John-AVUSD how about adding a custom property on those 3 interfaces and then make that the condition instead of putting in the interface name?

It is not about the variables, What I'm trying to achieve here is simplying the alert by shortening the running sql in the background

pratikjajal

Hi @John-AVUSD ,

What I am suggesting is to create a custom property for Interfaces, for example, i_criticality=yes (where “Yes” indicates a critical interface). You can then assign this custom property to the three interfaces in question. While creating the Interface Down alert, you can select this custom property, which will allow you to manage these interfaces—and any future critical interfaces—more efficiently.

If you’d like, I can guide you through the SOP or provide step-by-step instructions with screenshots. I’d be happy to assist you.

Regards,
Pratik Jajal

John-AVUSD

I don't see the benefit of using a custom property when I should be able to just choose an interface on a node and trigger an alert by its state. It should be an easy alert.

TehAj87

Have you tried using the Interface ID rather than Interface Name (Interface)? I've had better luck using the Interface ID than the Interface Name before.

John-AVUSD

I haven't tried that for this alert. I recall using it in the past. I will need to dig up how to see an interface ID on the Juniper switch and match it with the info SW sees.

John-AVUSD

I've gone the most detailed route and created a Universal Device Poller on the SW server. Then I made really basic conditions for the trigger.

Trigger Condition:

Edit

Alert on all objects where:
Custom Pollers - Unique Name - is equal to - Juniper_4100_Interfaces
The actual trigger condition:
All child conditions must be satisfied (AND)
Custom Pollers - OID - is equal to - 1.3.6.1.2.1.2.2.1.1
Custom Pollers - Column Number - is equal to - 1
Custom Poller Current Stats - Current Numeric Value - is equal to - 564
Custom Pollers - OID - is equal to - .1.3.6.1.2.1.2.2.1.8
Custom Pollers - Column Number - is equal to - 1
Custom Poller Current Stats - Current Numeric Value - is equal to - 1

The first OID is the interface index. The second OID is the operation status. I've verified with an NSMPWalk and with the UDP test that these ports I want to watch have the indexes listed on the switch and reported in the MIB walk, and that the status is a numerical value of 1, right now. When I do a simulation with the trigger action email, I get the value of one, and the interface name shows up. What I have never gotten is that at the end of creating the alert, it says 0 for the number of objects that would trigger this alert.

bourlis

Personally, this alert it too ridged and locks you in to the 'box. Personally I prefer the opt in approach, where you set the alerting values that is fluid and people can opt in or opt out of alerting.

In my SW instance my network interface alerts are built like (see below). As the SW admin this approach is easy, i built the alert, I advertise the mechanics and the alerting responsibility is on the team if they want alerts or not.

This would easily cover the example you provided, but it can grow with your organization or requirements. If the your node gets replaced with a new node with a new name, all you need to to is set the interface custom property to 'yes' and Bob's your uncle you have alerting.

John-AVUSD

That sounds slick, but my issue is making an alert work. If I don't have an "Alarm_on_Interface" event, then I can't get creative on who gets it. Besides, most the alerts just come to me and my Director, so it will stay very simple.