Here's the thing. I have some people within the company that think it's perfectly alright to come to work and download massive quantities of "stuff" over the internet. Yes I could block every non-company oriented protocol known to man on my firewall but I'm looking for something a little more exciting.
I have all of my Cisco 4506 ports monitored and set to trigger a high-util alarm at 15% (out of 100Mb) At the same time I have BW util alarms set to all MPLS and Metro Circuits. I would like to write something to catches these two alerts and sends perhaps a seperate notification to the affect of "Internet bandwidth has increased to 75% and can be traced back to "HOSTNAME" "Fa7/2" I'm not sure it's a good idea to que off the alarm times, because I haven't seen them hit at the same time yet. I think the condition or severity is what I'm looking for.
Have any of you out there put this together yet? Please share if you have. I'm looking for ideas.