Supress Alerts for Multiple Syslog Messages

Thwackerians,

We're interested in alerts for port security violations. However, when they occur they happen by the hundreds -- we don't want to get an alert for every one. Has anyone figured out a way to suppress an alert until a threshold is passed, say 500 port security violations?

Thanks
Brent Papworth

Find more posts tagged with

Alert

Accepted answers

All comments

d09h

I'm fighting this as well. I get syslog messages approximately every two minutes hitting NPM syslog. This for one switch with one port security violation.

I've also polled cpsIfPortSecurityStatus (OID 1.3.6.1.4.1.9.9.315.1.2.1.1.2). I have not gotten per-instance (per port security violation) alerting working here. I do see believable results that match what I see in CLI.

What I do have working is a syslog report that shows a port security violation almost every minute for the one interface on the one switch with a port security violation. Until I can summarize this, I can't really use this method for all of my user switches.

d09h

(edit-- this is no longer a syslog solution, and requires a per-node custom property of type True/False or Yes/No...in the case of the below, that custom property is named PortSecurityApplied)

As a temporary workaround, I have a report shown on a web page that I email in response to an alert on my Universal Device Poller. The report and alert work. I created the report in "Current Status of Nodes, Intefaces, etc." It isn't pretty, and wasn't generated as SQL, but here it is in SQL format:

SELECT NodeName, CAST(MAX_of_Status AS varchar) AS MAX_of_Status, NodeID, Object_Type, IP_Address, Interface_Name, Physical_Address FROM (

SELECT TOP 10000 Nodes.Caption AS NodeName, MAX(CAST(CustomNodePollerStatus_CustomPollerStatus.Status AS real)) AS MAX_of_Status, Nodes.NodeID AS NodeID, Nodes.ObjectSubType AS Object_Type, Nodes.IP_Address AS IP_Address, Interfaces.InterfaceName AS Interface_Name, Interfaces.PhysicalAddress AS Physical_Address
FROM ((((((Nodes INNER JOIN Interfaces ON (Nodes.NodeID = Interfaces.NodeID)) INNER JOIN CustomPollerAssignment ON (Nodes.NodeID = CustomPollerAssignment.NodeID AND Interfaces.InterfaceID = CustomPollerAssignment.InterfaceID)) INNER JOIN CustomPollers ON (CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID)) INNER JOIN CustomPollerStatus ON (CustomPollerAssignment.CustomPollerAssignmentID = CustomPollerStatus.CustomPollerAssignmentID)) INNER JOIN CustomPollerAssignment CustomNodePollerAssignment_CustomPollerAssignment ON (Nodes.NodeID = CustomNodePollerAssignment_CustomPollerAssignment.NodeID)) INNER JOIN CustomPollers CustomNodePollers_CustomPollers ON (CustomNodePollerAssignment_CustomPollerAssignment.CustomPollerID = CustomNodePollers_CustomPollers.CustomPollerID)) INNER JOIN CustomPollerStatus CustomNodePollerStatus_CustomPollerStatus ON (CustomNodePollerAssignment_CustomPollerAssignment.CustomPollerAssignmentID = CustomNodePollerStatus_CustomPollerStatus.CustomPollerAssignmentID)
WHERE
(
(CustomPollerStatus.Status = '3') AND
(Nodes.PortSecurityApplied = 1) AND
(Interfaces.Status <> '0') AND
(CustomNodePollers_CustomPollers.MIB LIKE '%cpsIfPortSecurityStatus%') AND
(CustomPollers.MIB LIKE '%cpsIfPortSecurityStatus%')
)
AND
(
(CustomNodePollerAssignment_CustomPollerAssignment.InterfaceID = 0)
)

AND isnumeric(CustomNodePollerStatus_CustomPollerStatus.Status) = 1
GROUP BY Nodes.Caption, Nodes.NodeID, Nodes.ObjectSubType, Nodes.IP_Address, Interfaces.InterfaceName, Interfaces.PhysicalAddress
ORDER BY 2 DESC
) A UNION ALL
SELECT NodeName, CAST(MAX_of_Status AS varchar) AS MAX_of_Status, NodeID, Object_Type, IP_Address, Interface_Name, Physical_Address FROM (

SELECT TOP 10000 Nodes.Caption AS NodeName, MAX(CustomNodePollerStatus_CustomPollerStatus.Status) AS MAX_of_Status, Nodes.NodeID AS NodeID, Nodes.ObjectSubType AS Object_Type, Nodes.IP_Address AS IP_Address, Interfaces.InterfaceName AS Interface_Name, Interfaces.PhysicalAddress AS Physical_Address
FROM ((((((Nodes INNER JOIN Interfaces ON (Nodes.NodeID = Interfaces.NodeID)) INNER JOIN CustomPollerAssignment ON (Nodes.NodeID = CustomPollerAssignment.NodeID AND Interfaces.InterfaceID = CustomPollerAssignment.InterfaceID)) INNER JOIN CustomPollers ON (CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID)) INNER JOIN CustomPollerStatus ON (CustomPollerAssignment.CustomPollerAssignmentID = CustomPollerStatus.CustomPollerAssignmentID)) INNER JOIN CustomPollerAssignment CustomNodePollerAssignment_CustomPollerAssignment ON (Nodes.NodeID = CustomNodePollerAssignment_CustomPollerAssignment.NodeID)) INNER JOIN CustomPollers CustomNodePollers_CustomPollers ON (CustomNodePollerAssignment_CustomPollerAssignment.CustomPollerID = CustomNodePollers_CustomPollers.CustomPollerID)) INNER JOIN CustomPollerStatus CustomNodePollerStatus_CustomPollerStatus ON (CustomNodePollerAssignment_CustomPollerAssignment.CustomPollerAssignmentID = CustomNodePollerStatus_CustomPollerStatus.CustomPollerAssignmentID)
WHERE
(
(CustomPollerStatus.Status = '3') AND
(Nodes.PortSecurityApplied = 1) AND
(Interfaces.Status <> '0') AND
(CustomNodePollers_CustomPollers.MIB LIKE '%cpsIfPortSecurityStatus%') AND
(CustomPollers.MIB LIKE '%cpsIfPortSecurityStatus%')
)
AND
(
(CustomNodePollerAssignment_CustomPollerAssignment.InterfaceID = 0)
)

AND isnumeric(CustomNodePollerStatus_CustomPollerStatus.Status) != 1
GROUP BY Nodes.Caption, Nodes.NodeID, Nodes.ObjectSubType, Nodes.IP_Address, Interfaces.InterfaceName, Interfaces.PhysicalAddress
ORDER BY 2 DESC
) B