Trying to figure out how to setup alerts for "err-disable, arp inspection" in Orion

Has anyone gotten err-disable alerts for: link-flap, Arp Inspection, Port Security Violation's? I have been working on this for about a month or so. The only thing I have figured out is the OID (1.3.6.1.4.1.9.9.548.1.3.1.1.2). I would like alerts for a select few of the OID options or at least these are my main focus..

6:linkFlap

9:portSecurityViolation

16:arpInspection

I figured I would need to choose "Custom Interface Poller" for the "I want to alert on:". I am not having any luck with it.

My "scope of alert" is: Node -> is equal to -> Cisco

I can't seem to figure out the "The actual trigger condition:" settings.

Object	cErrDisableIfStatusCause
OID	1.3.6.1.4.1.9.9.548.1.3.1.1.2
Type	CErrDisableFeatureID 1:udld 2:bpduGuard 3:channelMisconfig 4:pagpFlap 5:dtpFlap 6:linkFlap 7:l2ptGuard 8:dot1xSecurityViolation 9:portSecurityViolation 10:gbicInvalid 11:dhcpRateLimit 12:unicastFlood 13:vmps 14:stormControl 15:inlinePower 16:arpInspection 17:portLoopback 18:packetBuffer 19:macLimit 20:linkMonitorFailure 21:oamRemoteFailure 22:dot1adIncompEtype 23:dot1adIncompTunnel 24:sfpConfigMismatch 25:communityLimit 26:invalidPolicy 27:lsGroup 28:ekey 29:portModeFailure 30:pppoeIaRateLimit 31:oamRemoteCriticalEvent 32:oamRemoteDyingGasp 33:oamRemoteLinkFault 34:mvrp 35:tranceiverIncomp 36:other 37:portReinitLimitReached 38:adminRxBBCreditPerfBufIncomp 39:ficonNotEnabled 40:adminModeIncomp 41:adminSpeedIncomp 42:adminRxBBCreditIncomp 43:adminRxBufSizeIncomp 44:eppFailure 45:osmEPortUp 46:osmNonEPortUp 47:udldUniDir 48:udldTxRxLoop 49:udldNeighbourMismatch 50:udldEmptyEcho 51:udldAggrasiveModeLinkFailed 52:excessivePortInterrupts 53:channelErrDisabled 54:hwProgFailed 55:internalHandshakeFailed 56:stpInconsistencyOnVpcPeerLink 57:stpPortStateFailure 58:ipConflict 59:multipleMSapIdsRcvd 60:oneHundredPdusWithoutAck 61:ipQosCompatCheckFailure
Permission	read-only
Status	current
MIB	CISCO-ERR-DISABLE-MIB ; - View Supporting Images
Description	"This object specifies the feature/event that caused the {interface, vlan} (or the entire interface) to be error-disabled."

Find more posts tagged with

arpinspection

err-disable

linkflap

portsecurityviolation

Accepted answers

All comments

tony.johnson

Hi Joe,

Have you created the UNDP to poll this OID? How to create an UnDP for your devices using Solarwinds Orion.pdf

Alerting and reporting are very similar in Orion and so this may helpHow to report on a UnDP (universal device poller)

raksasas

@tony.johnson

I believe I now have a UNDP made for the OID: 1.3.6.1.4.1.9.9.548.1.3.1.1.2.

Now I need to work on the Alert. When i use "Custom Pollers - OID - is equal to - 1.3.6.1.4.1.9.9.548.1.3.1.1.2" I end up with 6000+ Alerts. At this point I need to work out how to narrow it down to just the "16:arpInspection" part.

I have tried to narrow it down with the following but I end up with, "This alert would be immediately triggered on 0 object(s) in alert scope" on the last summary page.

"Custom Pollers - OID - is equal to - 1.3.6.1.4.1.9.9.548.1.3.1.1.2"

AND

"Custom Poller Current Stats - Current Numeric Value - is equal to - 16"

There should be at least a "1" there since I have it triggered on the switch at my desk... I even changed the "Current Numeric Value" to "Current Value" and I still end up with: "This alert would be immediately triggered on 0 object(s) in alert scope"

tony.johnson

When creating the UNDP have you set the Polling Type to Interface? Define Your Universal Device Poller

raksasas

Correct, I did.

aLTeReGo

Have you considered using Syslog or SNMP Traps to monitor these conditions? I'll assume you have a recovery condition defined on the switch so those interfaces should return to a forwarding state automatically after a period of time, so this is likely more about identifying recurring trends?

raksasas

We do not use Auto Recovery and have no plans to at tttttttttthis time. We want to know when it happens and deal with it when it does. Our main focus is Port Security Violations and Arp Inspection.

cnorborg

I'd still believe that looking for the SYSLOG message for when the errdisable took effect might be easier than creating a UnDP and alerting on it. Have you looked into what SYSLOG messages are generated when that state occurs?

raksasas

Syslog... IMO isn't totally reliable.

I could be wrong here: For one, does seem to alert when the condition is cleared. . If you bounce(on/off) the alert it responds to older entries in the syslog. You have to manually acknowledge (clear) the alerts when using it.