Node Groups and Interfaces

we have setup a couple of Node Groups, and for the most part, it seems to be setup properly. However, from time to time, we will have emails from the Orion server showing a bunch of interfaces are "UP". Are interfaces ignoring the group stuff?

The understanding I have of the Node Groups is that if i create a node group, and any node in that group (except the parent) goes down, I would get alerted as normal. However, if the child AND parent go down, we should only be notified of the Parent going down. Am I mistaken on this?

If the above is true, does the same hold true for interfaces?

Find more posts tagged with

interfaces

npm

node_groups

Accepted answers

superfly

You are correct that when a parent and child go down, you'll only get an email from the parent. Interfaces are automatically considered a "child" of the node so when the node goes down, you only get an email from the node, not all the interfaces you are monitoring. Obviously when an interfaces goes up/down and the node is still up, you will get alerted only from the interface.

So when do you get the UP emails from interfaces? After you've had an outage? Can you give some more info please.

All comments

superfly

So when do you get the UP emails from interfaces? After you've had an outage? Can you give some more info please.

dclick

Ok. thats what I thought. I must have something misconfigured. We lost a circuit last night, and the system sent us quite a few emails, instead of one for the parent node - EVERYTHING under that node triggered an email.

I my groups, I have a Parent switch (say a Cisco 6509). As child NODES to that group, it could have 5-6 Cisco 3750's, some AP's, etc..

so -

Catalyst 6509 (PARENT) (location A - monitoring the node and interface g1/2 - a 1 gig fiber link to the first 3750-1)

3750-1 (Child)

3750-2 (Child)

3750-3 (Child)

3750-4 (Child)

If the 6509 node shows an INTERFACE down, and I used that interface to monitor the child nodes, I should still only get one email, right?

I opend a case with support to review my configuration.

superfly

No you will get multiple emails. You will get email from the 6509 interface as well as the 3750's behind it. The reason being is that the 6509 is still up and is the parent of the 3750's.

If you made the 6509 interface the parent of the 3750's, then you should only get an email from the interface when the 3750's behind it all go down. But if only 1 x 3750 goes down, you'll just get an email from that 3750.

I hope that makes sense.