Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Need assistance with NPM alert for EIGRP Routing Neighbors

We have a DMVPN network of around 20 routers.

We have an alert setup so that when one of our three "hub" routers loses a route to one of the routing neighbors, it will email us.

The problem is that the email only lists the IP address of the routing neighbor, not the Node Name.

I am trying to figure out how to get the alert to list the Node Name of the router instead of its IP.

This is the message in the Email action:

EIGRP neighbor ${N=SwisEntity;M=NeighborIP} has gone down for longer than configured threshold.

${N=SwisEntity;M=Router.Nodes.DisplayName}

${N=SwisEntity;M=NeighborID}

When I try to insert a variable in to the message, I have no option to select a Neighbor Node Name. I can only select from Neighbor ID GUID and Neighbor IP.

When I view the Network tab for the DMVPN Hub Router in Orion and scroll down to look at Routing Neighbors, it displays both the Name and IP of the neighbors.

How can I modify the alert to show the name instead?

I have attached an image of the alert trigger condition and the email action.

attachments.zip

Find more posts tagged with

Accepted answers

cnorborg

Good idea! Try something like this, a Custom SWQL query based off the IP address of the neighbor leveraging the NodeIPAddresses table...

EIGRP neighbor ${N=SwisEntity;M=NeighborIP} (${N=SWQL;M=SELECT NIP.Node.Caption FROM Orion.NodeIPAddresses NIP WHERE (IPAddress = '${N=SwisEntity;M=NeighborIP}')}) has gone down for longer than configured threshold

Node Name: ${N=SWQL;M=SELECT NIP.Node.Caption FROM Orion.NodeIPAddresses NIP WHERE (IPAddress = '${N=SwisEntity;M=NeighborIP}')}

${N=SwisEntity;M=Router.Nodes.DisplayName}

${N=SwisEntity;M=NeighborID}

All comments

cnorborg

Good idea! Try something like this, a Custom SWQL query based off the IP address of the neighbor leveraging the NodeIPAddresses table...

Node Name: ${N=SWQL;M=SELECT NIP.Node.Caption FROM Orion.NodeIPAddresses NIP WHERE (IPAddress = '${N=SwisEntity;M=NeighborIP}')}

${N=SwisEntity;M=Router.Nodes.DisplayName}

${N=SwisEntity;M=NeighborID}

brian.trotter

Thank you!!!!

This worked perfectly!

cnorborg

Glad to be of help, thinking of integrating it into our environment too, so thanks for your initial legwork on it!

cnorborg

You may or may not find this of interest. Kind of leveraged the alerts you were producing to create a resource for our DMVPN.

SELECT NIP.Node.Caption AS [Device], AA.AlertObjects.EntityCaption AS [IP Address], NIP.Node.DetailsUrl AS [_LinkFor_Device], AA.AlertObjects.RelatedNodeCaption AS [Lost EIGRP To], NIP.Interface.IfName, AA.TriggeredDateTime AS [Alert Time]

FROM Orion.AlertActive AA

JOIN Orion.NodeIPAddresses NIP ON (AA.AlertObjects.EntityCaption = NIP.IPAddress)

WHERE (AA.AlertObjects.AlertConfigurations.Name = 'EIGRP neighbor down on DMVPN')

ORDER BY NIP.Node.Caption

If you go to "Customize Page" and then add a resource of "Custom Query" type and pop this in it should work. I should note that my configuration name is "EIGRP neighbor down on DMVPN", you will need to change the WHERE clause to reflect the name of your Alert.

So, we have dual DMVPN hubs, and each hub has a Tunnel interface for the primary links at the remote sites and another Tunnel interface for the Secondary links at the remote sites. So, a remote site with two physical links has two tunnels, lets say Tunnel10 and Tunnel20. Tunnel10 has the source interface of the primary link, and connects to both hub routers on their primary tunnels. Tunnel20 has the source interface of the secondary link, and connects to both hub routers on their secondary tunnels. So, on a remote site that has 2 physical links, and 2 tunnel interfaces I end up with 4 EIGRP neighbors. That way if one of the physical interfaces on a remote router fails, that router still has tunnels to both DMVPN hubs that I have. If I had 3 DMVPN hub routers, I'd have 6 EIGRP neighbors with this setup.

But, this resource lists all the routers that have active alerts (using your alert), and shows what tunnel the alert is on. So, lets say RemoteRouterA is showing loss of EIGRP on both Tu10 and Tu20, its not a huge deal most likely since each physical interface on the remote routers should still have an EIGRP neighbor on them. However, if RemoteRouterA is showing loss of EIGRP on Tu10 on two lines, that can be a problem which is most likely loss of connectivity on the remote interface.

This is useful for me because most of our circuits are DIA links, which instead of getting the status of T1's, all I see is an "up" connection to the remote cable-modem or Cienna box.

The Alerts are useful, but as I said a single EIGRP neighbor being lost on a remote interface isn't that bad, its when two are lost that I can be pretty sure the link is down.

Let me know if you find it useful?