Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Interfaces Down with No Alerts or Events

Dears,

We have Orion 10 installed in Windows Server 2008 R2 , All things working normally except for the following logs captured on one of our Cisco Switches and have and have no events or alerts recorded on our system .. ( Polling interval every 60 seconds ) .. please advise

Oct 22 11:59:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to down

Oct 22 11:59:37: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down

Oct 22 11:59:40: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to up

Oct 22 11:59:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to up

Oct 22 12:01:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to down

Oct 22 12:01:37: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down

Oct 22 12:01:41: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to up

Oct 22 12:01:43: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to up

Oct 22 12:03:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to down

Oct 22 12:03:37: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down

Oct 22 12:03:40: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to up

Oct 22 12:03:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to up

Oct 22 12:05:39: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to down

Oct 22 12:05:40: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down

Oct 22 12:05:42: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to up

Oct 22 12:05:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to up

Find more posts tagged with

Accepted answers

All comments

rob.hock

If I am reading that correctly, it appears those interfaces are only in a down state for a couple seconds. Even at 60 second polling interval, it would be statistically improbable for us to see the interface in the down state.

stuartwhyte

These log entries are showing a "flapping" interface (one which goes up and down within a few seconds) and as Rob mentions will not be detected using traditional polling. The way to alert on these events is to send either syslog or SNMP traps to the NPM server, parse them and generate an alert in near real time.

By using a combination of regular polling and syslog/traps you will be able to cover almost all eventualities,

Hope this helps

Stuart

RichardLetts

1. Have the switch direct IFstate traps to the solarwinds trap server. 9you may have to open up port 162 if you're not processing traps already)

2. create a rule in the trap viewer that changes the interface state on receipt of ifstate traps ( IF-MIB:linkUp and IF-MIB:linkDown) to change the interface state to Up and Down respectively. (these are not exportable, otherwise I'd attach them here)

3. Update the rule in the alert manager to run more frequently to generate ifstate alerts (this can add load to your database and server depending on the number of interfaces)

SNMP has a rich notification protocol (traps) where network devices can asynchronously tell network management systems that they need to pay attention to things. I'd really like support for protocols to include processing the standard traps from those protocols. e.g. OSPF support should include handling the OSPF/OSPFv3 traps and doing something with them (generating an alert, triggering polling, etc). the same for BGP neighbour traps, VRRP traps, LLDP traps.

</soapbox>

/RjL

shetoshandasa

Thanks for all of you ,, already we have no traps enabled yet , and have realized that the 60 seconds polling time will not discover such a flap

i will enable traps on both server and Switch and will provide you with feedback very soon