BGP route flap alert

jeffnorton

We are in need of way to trigger an alert based on certain number of BGP backward transitions in a time period.  For instance 4 BGP flaps in 30 min.  Support indicated there was a possibility of doing as a customsql alert, however, I don't profess to be anywhere close to literate with sql,  I had the alert manager translate a bare bones bgp down alert into sql as shown below.  So has anyone out there in Thwack land done anything like this?  Please share or if you know how to code sql to do this please share.  I have submitted a feature request on this because the latest NPM has the ability to actually show route flaps under the Node but for what ever reason the developers never added the ability to alert on it.

RichardLetts

The best way to do this is to:

a) send traps from your routers to Solarwinds for BGP events

[that depends on your model of routers and persuading your sysadmin to send to the data directly]

b) add rules to the TRAPviewer to TAG traps for BGP backward transition (see idea http://thwack.solarwinds.com/ideas/3023 for the definitions of the BGP backward transition traps that cope with both v1 and v2 type traps -- I happened to use BGP backwards transition as the example of a trap that is common and differs between SNMPv1 and SNMPv2. You will need the rule to cope with both cases; I can't export these to show you how to do this, but it's pretty obvious in the trap receiver how to tap a trap that as a particular trap type.

c) use a custom SQL alert and/or custom SWQL query to identify these types of traps.

WHERE  nodeid IN (SELECT nodeid                  FROM   traps                  WHERE  datetime>Dateadd(hour,-1, Sysdatetime())                   and tag='IPv6_BGP_FLAP'                 )

Select Caption,count(T.TrapID) as TrapCountfrom orion.nodes N inner join Orion.Traps Ton T.Nodeid=N.Nodeidwhere tag='IPV6_BGP_FLAP' anddatetime >  (getdate()-0.01)group by Captionorder by count(*) desc

the out of the box route flap detection works on polling the actual route tables, and on the routers here I've around 12,000 or over 500,000 routes in them, so this isn't terribly helpful for detecting a BGP session resetting (since I can get route flapping without a BGP backwards transition)

/RjL