nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Basic or Advanced Alert for 'errdisabled' ports?

sodonnel

I saw a post without a response to this question back on '04.

Can I setup Orion to send an alert when a switchport goes into an 'errdisable' state?

Find more posts tagged with

Alert

errdisable

Accepted answers

All comments

njoylif

Good idea. please submit results --

should be able to if you can determine what Orion's status is for that in the DB. If you have some ports in that state, find out what the NodeID is using the Nodes table in the DB. Then run the below query agains the Interfaces table to find the appropriate interface:

SELECT InterfaceID, Caption, Status, OperStatus FROM Interfaces WHERE NodeID = 'x'

x=<NodeID from Nodes Table> search through the table and find your interface and note the Operational Status and Status (not sure which it will be) and compare with others. One of those values should indicate errdisabled.

Hope that helps

sodonnel

Thanks for the info. I unfortunately don't have any in that state at present and want to capture them if/when they do, thus my inquiry. In the Alert Configurator, they list 'unknown', 'up', 'down', but I don't see 'errdisabled'.

Thanks again.

njoylif

yea, that's my issue too. Don't have any there. great idea though. Anyone please post if you know/get this info... Thx

Malvado

I would love to get this information as well

Here is the OID for that information

1.3.6.1.4.1.9.5.1.4.1.1.23

Object	portAdditionalOperStatus
OID	1.3.6.1.4.1.9.5.1.4.1.1.23
Type	BITS
Permission	read-only
Status	current
Values	0 : other 1 : connected 2 : standby 3 : faulty 4 : notConnected 5 : inactive 6 : shutdown 7 : dripDis 8 : disabled 9 : monitor 10 : errdisable 11 : linkFaulty 12 : onHook 13 : offHook 14 : reflector
MIB	CISCO-STACK-MIB ;
Description	"The current operational status of the port which is showing additional detailed information of the port."

I tried to setup a custom poller but OID IS NOT SUPPORTED, I do have one port that is err-disabled and I have been trying to find a way to notify me when this happens.

bleearg13

I am pretty certain you'd have to set up a Custom Poller to get this info. The Orion interface SNMP poller really only shows a few different statuses:

Up, Down, Unknown, Shutdown, Warning, Testing

If an interface is in 'err-disable' state, I believe that Orion will report it as 'Down'.

Network_Guru

You should be able to use the Syslog Alerting to notify you when a port goes into error-disable stat.

Here are some examples of the e-mail alerts I have configured:

ERROR: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet2/17 with BPDU Guard enabled. Disabling port.
SEVERITY: Critical

HOST: 10.10.100.1
ERROR: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0009.be0d.18e7 on port FastEthernet4/8.
Orion QuickLink:
Orion/.../SearchNodes.Action.asp

"%IP-4-DUPADDR: Duplicate address 172.31.28.179 on Ethernet0, sourced by 001a.8cb9.46a5"

ERROR: %RTD-1-LINK_FLAP: FastEthernet0/9 link down/up 6 times per min
SEVERITY: Alert

ERROR: Jul 16 21:16:37 PDST: loopback error detected on Fa0/1, putting Fa0/1 in err-disable state

billfisher

Is there an update to this post?

mcbridea

Which portion are you looking for an update on? The feature request?

billfisher

Yes, I figured out how to do this by:

Syslog Viewer, creating a new Alert/Filter, and then defining *ERR_DISABLE* under Message Type Pattern.

Is there another way within NCM/NPM to do this? Is there a report that I can generate with all the errdisable ports on it?

mcbridea

I'm not sure about those items but I have marked this for the PM to look at.

macnugetz

Bill,

One of our former SE's posted a UnDP to the content exchange (see his post earlier in this thread) that will monitor these statistics, from which you can generate a report.

HTH,

Craig

mrxinu

I had this question in a training class I did recently and after looking at it a bit we discovered the same thing you did - error disabled ports look just like shutdown to Orion.

To work around that, since legitimately shutdown ports were few and far between, we created a yes/no interface custom property called "Actually_Shutdown" and populated it. At that point our advanced interface alert could read 'interface.status is shutdown and interface.actually_shutdown is no' to let us know when one had been disabled due to policy.

It adds a little maintenance overhead, but it takes the temporary report fix one step further to real-time alerting.