Custom Alert for Combined Interface Transmit + Receive Mbps for >= 1 hour

dongam

Short Story - ISP charges for sustained bursts above 150 Mbps (total throughput TX + RX) for more than an hour.  We need an email alert to both monitor and if needed, adjust traffic.  I have looked through KBs and can't find any 'out-of-box' solutions to satisfy this requirement.  I opened ticket with support and they were not able to provide me with custom SQL query that would validate.  I am not a dB guy and need some help.  I also found several articles that I *think* come close.  See below.  thanks y'all!

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Interface - ASA5520 - Outside Interface - Internet (interfaceid = 253)
Interface Bandwidth -
Transmit - 150.0 Mbps
Receive  - 150.0 Mbps

SCOPE of Alert
Trigger condition - Alert triggers when combined % of Transmit + Receive >= 100%  (150 Mbps Total) for > 1 Hour
Repeat every 30 minutes or until ACK
Reset Condition - Reset this alert when trigger condition is no longer true (Recommended)
Trigger Actions - 1) Log event 2) Email Web Page
Reset Actions - 1) Log event 2) Send Email

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

What about these articles?
Build complex conditions alerts - https://support.solarwinds.com/Success_Center/Orion_Platform/Orion_Documentation/Orion_Platform_Administrator_Guide/Use_alerts_to_monitor_your_environment/Build_complex_conditions
Wait for multiple objects to meet the trigger condition before alerting
Evaluate multiple condition blocks
Evaluate multiple object types

Single alert with multiple conditions on the same object - https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Single_alert_with_multiple_conditions_on_the_same_object

bps

Same Problem here, best would be if we have alert's out of the box for this kind of problems.

Like:

- Burst Traffic Alert (if interfacetraffic hit's a definde amount of traffic

- Drop Traffic Alert (if a interface had traffic an drop's to below a definde amount (<=1Mb)

- Anomaly Traffic Alert (if interface traffic is (to be defind) 10% different then the Traffic of the last 1h then alert

or

- Anomaly Traffic Alert (if interface traffic is (to be defind) 10% different then the Traffic of the last 1h (avarage from the last 7 day's) then alert