Hello,
What "trigger condition" should I use to make Alert Manager send emails when a port status changes to Err-Disabled for any reason ?
Thank you.
Interface = not up
That doesnt work
Interface = not up = any other reason (Down/Warning/Shutdown/Unplugged/Testing...)
I'm looking for something to trigger when Err-Disabled activated only.
From Network Guru
You should be able to use the Syslog Alerting to notify you when a port goes into error-disable stat.
Here are some examples of the e-mail alerts I have configured:
ERROR: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet2/17 with BPDU Guard enabled. Disabling port.SEVERITY: Critical
HOST: 10.10.100.1ERROR: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0009.be0d.18e7 on port FastEthernet4/8.Orion QuickLink:Orion/.../SearchNodes.Action.asp
"%IP-4-DUPADDR: Duplicate address 172.31.28.179 on Ethernet0, sourced by 001a.8cb9.46a5"
ERROR: %RTD-1-LINK_FLAP: FastEthernet0/9 link down/up 6 times per minSEVERITY: Alert
ERROR: Jul 16 21:16:37 PDST: loopback error detected on Fa0/1, putting Fa0/1 in err-disable state
I've been using Syslog alert, but still searching for a way to do it with Alert Manager, its more flexible for me that way. I've searched the forum and saw someone else has asked for the feature since 2008. I guess SolarWinds still have no plan to implement this useful feature.
there is another post somewhere that shows that Solarwind currently only knows about up/down states.. It doesnt know what "Err-disabled" is, so its not an option in the advanced alert manager. I think when they finally integrate Syslog/Traps into Orion, we will be able to do this - I know I am looking forward to that day.
Syslog alerts are currently the only way, unless you create a custom poller to check the numerical equivilent.
I do this with syslog.
In my mind there is no other way.
Reason being is because if you are not monitoring syslog or traps for your switches (at least the important ones) you might as well not be monitoring anything because you are missing the most critical messages.