How to create an alert for Network Device Flapping

Is there a way to create an Alert for when a Network Device is Flapping? For example, If an Access Point is triggering 20 Down events within 7 days.

Thank you for your help,

Tom

Find more posts tagged with

npm

Alerts

Accepted answers

KMSigma.SWI

Here's an alert you can probably use as a base - you'd just need to tweak it a little bit to specify for it for your own devices (Access Points).

Seashore

Hi
I Think this will work, alerting on nodes that have more than 20 node down events last 48 hours:

Create a custom SQL alert with node as base and add below code:

INNER JOIN
(select
Count(Eventid) as nroftimes
,NetworkNode
FROM Events
Where
EventType=1 --Node down
AND EventTime>GETUTCDATE()-48 --Events last 48 hours
Group BY NetworkNode
HAVING Count(Eventid)>20
) AS E ON Nodes.NodeID=E.NetworkNode

You could also use that code if you want a report instead.

All comments

KMSigma.SWI

Here's an alert you can probably use as a base - you'd just need to tweak it a little bit to specify for it for your own devices (Access Points).

Seashore

Hi
I Think this will work, alerting on nodes that have more than 20 node down events last 48 hours:

Create a custom SQL alert with node as base and add below code:

You could also use that code if you want a report instead.

edgar.hill

Is there an alert for Specific Interfaces flapping defined by a custom property called XYZ as true?

stuartd

This is the alert we have for flapping interfaces....

Adjust adjust the figures to suit yourself but above 'as is' will trigger an alert if an interface goes down 5 times in 1hr.

If you want to narrow it down to a specific interface(s) then you will need to create a WHERE filter to select them. If it's based on a custom property, then you will most likely need to do a join to the interface (or node) CP and reference that in your WHERE statement.

HTH?

sunvad

Hi, can this be used to set up alerts for flapping BGP routes?

KMSigma.SWI

This inquiry should probably be built as a separate thread (best placed in the Alert Lab) so that we don't muddy the waters and solutions.

jlescano

if I wanted to change it to day and see how many times it flaps..how can I convert the code below to add a count? so far I have the following.

SELECT count (*) as qty, Interfaces.Fullname, Interfaces.InterfaceID
from Interfaces
join events on interfaces.InterfaceID = events.netobjectid
where eventtime > dateadd(day,-1,GETDATE()) and eventtype ='10'
group by eventtype, interfaceid, fullname, message
having count (eventid)>=3
Order by qty desc

however as any of you know, I'm only allowed the following header in the alert manager

SELECT Interfaces.FullName, Interfaces.InterfaceID FROM Interfaces

thoughts?

webbdom

Great - this is just the question I was coming to ask! Looks as though I'll be able to make use of some of these answers despite being an SQL/SWQL ignoramus.