How to alert on any Cisco router when 2 specific interfaces are both down

NormousCNK

Hi, I am trying to set up an Alert on any Cisco Router that has 2 specific interfaces (Tunnel11 and Tunnel12) simultaneously not up (effectively down for whatever reason). If either Tunnel is operational, while not ideal, I am ok with it. Its only when both Tunnels are down that is an issue I want an alert on.

I have tried different iterations and from my testing I am able to get triggered results when I state an OR when specifying the interfaces in question. (See example below)

SELECT E0.[Uri], E0.[DisplayName]
FROM Orion.NPM.Interfaces AS E0
WHERE ( ( ( E0.[Node].[NodeProperties].[NodeGroup] = 'Branch Routers' ) ) AND ( ( E0.[InterfaceName] LIKE '%Tunnel11%' ) AND ( ( E0.[Status] != '1' ) ) OR ( E0.[InterfaceName] = 'Tunnel12' ) AND ( ( E0.[Status] != '1' ) ) ) )

This tells me the logic makes sense up to this point. However, the moment I change the OR to an AND it stops working when I know I have at least 16 matches.

SELECT E0.[Uri], E0.[DisplayName]
FROM Orion.NPM.Interfaces AS E0
WHERE ( ( ( E0.[Node].[NodeProperties].[NodeGroup] = 'Branch Routers' ) ) AND ( ( E0.[InterfaceName] LIKE '%Tunnel11%' ) AND ( ( E0.[Status] != '1' ) ) AND ( E0.[InterfaceName] = 'Tunnel12' ) AND ( ( E0.[Status] != '1' ) ) ) )

Also, I cant make a Alert for a specific device as we have several hundred this Alert needs to work for. Additionally from my understanding, enabling the complex conditions would create a different problem which is that I would somehow need to make sure the trigger is matching the same device instead of Tunnel 11 Down at location 1234 and Tunnel 12 Down at location 4321 and I have no idea where I would even begin or if its possible at all.

dodo123

You could create a group for the 2 interfaces then alert on the group instead. If these are high priority tunnels which I assume they are it may be worth the time to create as you can also use those groups on a map or within a swql widget later on.