Advanced Alerts - using Interface Names that are monitored

KMNRuser

We are currently in the process of moving all of our Basic Alerts into Advanced Alerts.

We currently have a Basic Alert configured called "Interface Status Change".  This alert is configured so that "Property to Monitor" is set for "Interface Status".  Monitored Network Objects Tab has listed all of the Interfaces that are elements that we monitor.  We simply have the ones that we want to monitor selected with a check mark. 

 

The Advanced Alert is not letting me configure this in the same manner.  The issue I am having is that in the Tab "Trigger Condition", I need to set it up so that the condition alerts if "Interface Status" is "not equal to" UP.  That part was easy.  But I also have to set up the Trigger condition so that when "any" apply to the Interface Names for any one of the interfaces, it will fire.

I was expecting that when I selected "Interface Name", it would give me a pull down menu, listing all of the interfaces which are monitored elements, and then let me select from the list.  Unfortunantly it just provided a blank box in which I am supposed to write in the Name.  This is problematic in that if I even type in one wrong character, there will not be a match and the alert will not fire.

How can I build this Alert so tha I have a choice given to me of Interfaces to select that are monitored?

Thank you.

euphorik

Interesting. I checked my Advanced Alert editor and I get a drop down list for both Interface Name & Interface Alias, but I get a free text box for Interface Caption and Full Name.

In my experience, trying to check off individual interfaces in Advanced Alert editor is a bit tedious. If you are relatively consistent with your naming, it's often easier to match based on a combination of Node and Interface descriptions. (ie. node contains -fw- and interface caption contains 'eth0' or something to that effect...then you have the upside of automatically including any new device that fits the criteria into your alert.  This is often overlooked in basic alerts, once the initial interfaces are checked, all new devices are often forgotten to get added to the alert.

Also, I would also consider changing your logic such that you fire the alert when "Interface Status equal to Down" and/or Unknown. Otherwise, if you Admin shut an interface, it will continue to show up as an active alert since it's not "UP".  Unknown being bad in that Orion can't get the status and down is pretty obvious. You likely don't want to constantly alerted of interfaces that are Unmanaged for whatever reason.

 

-Ryan