Alert on interface error percent

I would like to have an alert on interface errors/discards as a percentage of all packets passed, instead of on an absolute number of errors.

Absolute error statistics are not nearly as useful. 1k errors out of 1B packets is nothing, 1k errors out of 100k is a huge problem.

Find more posts tagged with

npm - network performance monitor

Alerts

Accepted answers

All comments

nerengm

I struggled with the same thing for a long time. This is what I came up with. Give it a try and let me know what you think.

This alert runs every 5 minutes, and triggers when an interface has more than 2 % errors for at least 30 minutes:

Trigger Condition:

Custom SWQL Alert (Advanced)

Interface

SELECT Interfaces.Uri, Interfaces.DisplayName FROM Orion.NPM.Interfaces AS Interfaces

Join Orion.npm.InterfaceErrors as IE on Interfaces.interfaceid=ie.interfaceid
Where DATETIME > ADDMINUTE(-10,GETUTCDATE()) AND (ie.ReceivePercentErrors > 2 or ie.TransmitPercentErrors > 2)

Trigger Action Email Body:

Event Time: ${N=Alerting;M=AlertTriggerTime;F=DateTime}
Alert Triggered: ${N=Alerting;M=AlertName}
Alert URL: ${N=Alerting;M=AlertDetailsUrl}

RX Percent Errors: ${N=SWQL;M=SELECT Round(ie.ReceivePercentErrors, 2) as RXPercentError FROM Orion.NPM.Interfaces AS Interfaces JOIN Orion.npm.InterfaceErrors as IE on Interfaces.interfaceid=ie.interfaceid WHERE ie.interfaceid ='${N=SwisEntity;M=InterfaceID}'}%
TX Percent Errors: ${N=SWQL;M=SELECT Round(ie.TransmitPercentErrors, 2) as TXPercentError FROM Orion.NPM.Interfaces AS Interfaces JOIN Orion.npm.InterfaceErrors as IE on Interfaces.interfaceid=ie.interfaceid WHERE ie.interfaceid ='${N=SwisEntity;M=InterfaceID}'}%

Node: <a href="${N=SwisEntity;M=Node.DetailsUrl}">${N=SwisEntity;M=Node.Caption}</a>
Interface: <a href="${N=SwisEntity;M=DetailsUrl}">${N=SwisEntity;M=Caption} </a>

stuartd

Not being a S(W)QL guru can I just confirm that the 2 in > (ie.ReceivePercentErrors > 2 or ie.TransmitPercentErrors > 2) is where the 2% comes from? So if we wanted to do this, we could say change the figures to 5 and get 5% ?

Secondly, the "over a 30 minute period" comes from the "condition must exist for" section of the alert - yes?

nerengm

Yes to both. Also, this is a better query for the action. The 'Top 1' and 'Order by datetime desc' are essential for getting the right value:

RX Percent Errors: ${N=SWQL;M=SELECT top 1 Round(ie.ReceivePercentErrors, 2) as RXPercentError FROM Orion.NPM.Interfaces AS Interfaces JOIN Orion.npm.InterfaceErrors as IE on Interfaces.interfaceid=ie.interfaceid WHERE ie.interfaceid ='${N=SwisEntity;M=InterfaceID}' order by datetime desc}%