Interface Down When Not Used

I have an alert configuration where the intention is to alert on an interface on a switch or router when the interface is down. This issue I have is that an enabled interface reports down when nothing is plugged into it. That is, it is Administratively UP and Operationally DOWN because nothing is plugged into it. One thing I've done to filter some of the noise this creates is to add a condition that the total transmit + receive bps is > 0. The thought being that an enabled interface that gets used from time to time would have throughput and therefor if the status is down and there's been traffic then I should alert. This kind of works in that I have eliminated a lot of the down alerts from enabled unused/never used interfaces. But, this doesn't help in the immediate aftermath of unplugging something from the interface. While poking around I found a trigger condition variable called "Interface Responding" but, I don't really know what that means. If anyone has any input I'd love to be better educated about how I can produce an alert that triggers on an interface that is effectively dead.

Find more posts tagged with

Accepted answers

superfly

I'm a network engineer and I don't deem all interfaces important. i believe the only important interfaces are uplinks, portchannels, interfaces for portchannels and links to servers. Anything on the access layer is not important.

As mentioned you can use the unplugged version but really you should only have things show as hard down when you are actually interested in it being hard down. Otherwise your monitoring console will be filled with errors you are not interested in seeing.

All comments

superfly

Why not just monitor the interfaces you are interested in or deem important? And delete all the other interfaces. No point in monitoring something if you're not interested in it.

jameslindsay

Yes, that would be ideal. Better yet, why don't the Network Admins set them to disabled? They have their reasons.The short answer is that they deem all of them important. In some cases they want to know if they come up when they know they shouldn't, meaning someone has plugged into it that perhaps shouldn't. We have about 100K interfaces which includes switch ports. I just need to alert on an interface/port that is actually dead and this "Interface Responding" Boolean sounds promising but, I have no context around its meaning.

d09h

jameslindsay

Would this work for you?

Set the interface status as Unpluggable

If you do not want to be notified when an interface is down, you can specify that the interface is Unpluggable. The interface status is reflected in the status of the parent node and in alerts.

On the Node Management view, select the interface, and click Edit Properties.
Select Display Interface as Unplugged Rather Than Down, and click Submit.

The interface status does not influence the status of the parent node.

. Ref: https://documentation.solarwinds.com/en/Success_Center/NPM/Content/NPM-Setting-Interface-Management-States-sw668.htm

superfly

jameslindsay

Is this what you are referring to?

superfly

Yes that what d09h is referring too.

jameslindsay

I can see where that's useful but, requires coordination or action from the network admins to set or communicate port status' in SW. I might as well go to the dentist and have a tooth pulled.