Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Last 50 Route Changes Report

t1n0m3n

I know there is a Top 10 Route Flaps resource on the node details page.

I also know that there is a list of all routes in NCM reports.

Is there a way to show the last 50 (or whatever) route changes across the enterprise?

Nodename - IP Subnet - Age

Then sorted by age, limit to the 50 latest entries.

This is really all I am looking for.

I post this in NCM because that is where I found the route report. However, I don't care where the source comes from.

Thanks!

Kirk

Find more posts tagged with

Accepted answers

All comments

t1n0m3n

The intent of my request is to see at a glance of the most recent route changes.

Jenya

Do you mean to say that you want a report that shows new subnets being added or removed to the enterprise? As in which subnet showed up that didn't exist before and where is it?

I don't think what you're asking exists in SolarWinds products right now, but I could be wrong. Maybe its in IPAM which I don't have. I found that in the report builder you can make a report to combine "Top 10 route flap" resources from multiple nodes. So if you know a set of core nodes that do routing you could see flaps for those. This will help you catch routing table changes but they are sorted by number of changes. The resource can go back in time pretty far (30 days I think), but I'm not sure it's what you're looking for.

It might be worth putting in a feature request if there isn't one for this already.

t1n0m3n

"Do you mean to say that you want a report that shows new subnets being added or removed to the enterprise?"

Yes. I want at a glance look at the last 50 route changes across all nodes and be able to quickly see adds or removals during periods that are supposed to be quiet (e.g in a "change freeze" period.)

This will allow my engineers to quickly understand where an issue may be coming from.

Our core routers have a aggregated route entries. So we would not be able to catch all route changes with only a handful of nodes.

mesverrum

This is something I whipped up based on my lab environment. I'll admit my routing table skills are marginal so there may be some cleanup necessary depending on what you want to see but try it out and see if this gets you near where you want to be.

From whatever view you want to use this just customize the view, add a custom query resource and paste this into the box. You can set the number of lines to 50 or whatever other value you want.

SELECT nn.nodecaption, rt.Destination, rt.Mask, ni.InterfaceDescription, rt.NextHop, rt.RouteType, rt.RouteProtocol, rt.RouteAge, rt.NextHopAS, rt.Metric1, rt.Metric2, rt.Metric3, rt.Metric4, rt.Metric5, rt.LastDiscovery, rt.FirstDiscovery, rt.Missing

FROM NCM.RouteTable rt

join NCM.Nodes nn on nn.nodeid=rt.nodeid

left join NCM.Interfaces ni on rt.interfaceid=ni.interfaceid

order by routeage ASC

If you want to make it searchable then check the box to enable that and paste this version into the new text box that shows up

FROM NCM.RouteTable rt

join NCM.Nodes nn on nn.nodeid=rt.nodeid

left join NCM.Interfaces ni on rt.interfaceid=ni.interfaceid

Where nn.nodecaption like '%${SEARCH_STRING}%' or ni.InterfaceDescription like '%${SEARCH_STRING}%' or rt.Destination like '%${SEARCH_STRING}%'

order by routeage ASC

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems