Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Interface Flapping/Repetitive Events

I would like to report on flapping interfaces and have not found a solution. I found this sql syntax that counts node events and wonder how to create a query for interface events. The goal is to find the most frequent interface events over time. Doing this manually, i found that one particular interface accounted for 65% of all the interface alerts. Techs have complained about missing important alerts because they were getting so many nuisance alerts.

here is the node event count script

select caption,count(*) as total
from events inner join nodes on (networknode=nodeid)
where eventtime >dateadd(hour,-24,getdate()) and eventtype=1
group by caption
having count(*)>=2

Find more posts tagged with

repetitive_events

icmpnterface_flapping

Accepted answers

darryld

Something based on this should work

select cast(message as varchar(200)) as EventMsg, COUNT(*) as Occurances

from Events

where eventtime >dateadd(hour,-24,getdate())AND Message like '%Interface%'

group by cast(message as varchar(200)), EventType

having count(*)>=2

set the "message like" and count threshold to meet your requirements, check the event viewer to find the text required

All comments

scottd

Hmmm, I dont believe that information is located in the Events table(Flapping Interfaces). I may be wrong but, it sounds like you are after some syslog information, and that would be stored in the SysLog table.

This query will return a list of HostNames that had flapping interfaces(2 or more), with the Severity of Alert(1), the MessageType contains the string 'flap', and occured within the last 24 hours, and it will show you a total of alerts recorded.

Select HostName,Count(*) AS Total

From SysLog

Where (DateTime Between DATEADD(HOUR,-24,GETDATE()) AND GETDATE()) AND (SysLogSeverity=1) AND (MessageType LIKE '%flap%')

Group By HostName

Having Count(*)>=2

Return data will resemble;

HostName | Total

<ServerName> | 7

<ServerName> | 15

You can also play with the MessageType to get exactly what you are after if this query is too broad...

Hopefully i did not misinterpret your request...

mgibson

Thank you for your response, and you are correct. However, I still would like to tackle this from an "Events" perspective, because my goal is to reduce the number of "problem" interface Alerts the Technicians recieve. Unless it is a critical syslog event, i do not typically notify our techs using the syslog event notification as I could quickly overburden them with Alerts this way. I suppose I would like to attack this from a reporting aspect. Based on the Node Count script I submitted, would you know how to gain the same type infor from the interfaces? I am light on SQL scripting.

scottd

To the best of my knowledge, the flapping events are only logged to the syslog table and would not be found in the events table which is why i replied the way i did...

Maybe i am not understanding completely...

What kind of alerts are you being overburdened with? Interface down/unknown/shutdown/warning, etc???

mgibson

I failed to mention, I beleive the interface goes into error disable at 5 times/10 seconds. What happens if it is less often, say 6 times in 60 minutes?

So in essence I want to be able to report on those which occur on a repetitive basis

mgibson

Interface ups/downs. Evidently less than that which causes the interface to go into error disable.