Alert for when member of a port-channel is down

Trying to create an alert for when a member of a port-channel is down. I have necessary OIDs to create UnDP(s), but I'm not sure how to get them to work together for this. Any help is appreciated.

This OID shows the port channel index (648) and the member interface indexes (24 and 73):

iso.2.840.10006.300.43.1.2.1.1.12.24 = INTEGER: 648
iso.2.840.10006.300.43.1.2.1.1.12.73 = INTEGER: 648

The port-channel and member interface names:

IF-MIB::ifName.648 = STRING: Po41

IF-MIB::ifName.24 = STRING: Te1/2/8
IF-MIB::ifName.73 = STRING: Te2/2/8

And finally, each one's status:

IF-MIB::ifOperStatus.648 = INTEGER: up(1)
IF-MIB::ifOperStatus.24 = INTEGER: up(1)
IF-MIB::ifOperStatus.73 = INTEGER: up(1)

If Te1/2/8 went down, ideally, the alert message would say something like "Po41 member Te1/2/8 is Down on switch1.

If I poll for all this, perhaps I could use a SWQL query to pull it all together?

Thanks.

Steve

Find more posts tagged with

port-channel member

port-channel

UnDP

Accepted answers

All comments

TerryHarding

Or maybe create groups for the port channels and use the Group Status root cause variable in your alert?

hebron1212

How would I determine the members that are a part of a particular port channel?

mesverrum

At former clients I've done exactly what you describe with the custom undp and swql. I don't have the exact code handy any more but it's doable to correlate the interface index to the port channel object and alert when there is a problem on one of the children. I added a custom property that tagged them so it was easier to build a swql widget to display on the interface details view if an interface was part of a channel group, and which other interfaces were also members of the same.

deverts

I sorta have this using syslog messages, however, I haven't been able to figure out the reset function. I trigger a syslog alert on "taken out of port-channel" and it works well to tell me when a member is down. I "had" another to process "added as member" but I can't get the 2 tasks correlated to each other and ended up with a down and a separate up alert.

stuartd

For me the solution is to ensure the device is configured properly - but this is probably like bolting the stable door after the horse has run.

What do I mean ...?

Well in your example I'd ensure the description on Te1/2/8 included it's Port Channel number, and then just alert on the up/down of the interface. The alert would include the port description so it should be clear to anyone reading that.

This is one of the reasons we "map out" all interfaces and port channels on Network Atlas and is one of many reasons we haven't migrated to Orion Maps yet.

routermonkey

I had a similar issue of trying to get a syslog message to act as a reset for an alert triggered by another syslog message. Asking the question here, I got a solution that is working for me for other syslog based alerts.

thwack.solarwinds.com/.../can-i-create-a-reset-condition-based-off-a-syslog-message