Alert On Interface (on a node) in group

We have our devices in specific groups (IE Transport, Access, etc). We want to build an alert that factors in two criteria.

- Interface Down on a devices AND that the node is in the "Ciena" group

I've built this as a "Complex Condition" but it doesn't trigger when we put an interface down (screenshot below).

Do we have to specifically put the interfaces in the group or can we match based on the node being in the group?

Is there another way this should be setup? It seems like just a simple alert but nothing that I've tried seems to be working correct.

Find more posts tagged with

Accepted answers

All comments

acf6276

Instead of creating it as a secondary section add the interface to to the first trigger under group member as "and".

Another way I do certain alerts is that I gave them a custom text field and I can manually edit multiple interfaces at once by putting that trait in there, I then use that "custom text" as an alert trigger for a report.

Ckesey

So once I choose group at the top of that section I can't chose interface in that section. There seems to be a real divide between interfaces, groups and nodes and you can't mix them.

acf6276

Try building another one with a different parameter to identify Cienna.

Another prebuilt field I use is Vendor- I set to Cisco

I was able to build this one out and when I go to the submit page I can see it works based on the ports I have currently down in my env.

Ckesey

I've thought about doing it this way however we have different groups that both use the same vendor and would like to alert differently

Ckesey

So I've found a query that works however I'd like to take it one step further....but I'm a little stuck.

SELECT Nodes.DisplayName FROM Orion.Nodes AS Nodes

INNER JOIN Orion.ContainerMemberSnapshots cms ON CMS.EntityID = nodes.NodeID

INNER JOIN Orion.Container c ON cms.ContainerID = c.ContainerID AND C.Name = '##GROUP NAME###'

INNER JOIN Orion.NPM.Interfaces b on b.NodeID=nodes.NodeID

where b.status='2'

This query will give me a list of interfaces (that are down) belonging to Nodes that are in the specific "group name". No need to put the specific interfaces in the group....only need to put the nodes.

I'd like to also include nodes that are down in this list (-2) however this does not give me the expected results:

SELECT Nodes.DisplayName FROM Orion.Nodes AS Nodes

INNER JOIN Orion.ContainerMemberSnapshots cms ON CMS.EntityID = nodes.NodeID

INNER JOIN Orion.Container c ON cms.ContainerID = c.ContainerID AND C.Name = '##GROUP NAME###'

INNER JOIN Orion.NPM.Interfaces b on b.NodeID=nodes.NodeID

where b.status='2' or nodes.status='2'

bobmarley

Give this a try, it is pulling the Node status and Interface status tables. I don't have any interfaces down to test with at the moment so adjust the query to fit your needs. The Node status should always be a 1 if it is up, then the interface status will be something other than a 1 if the node is up AND an interface is down. The Where should probably be like this

where Nodes.status NOT LIKE '1' or b.AdminStatus LIKE '2'

SELECT Nodes.DisplayName, Nodes.status AS NodeStatus, b.AdminStatus AS InterfaceStatus

FROM Orion.Nodes AS Nodes

INNER JOIN Orion.ContainerMemberSnapshots cms ON CMS.EntityID = nodes.NodeID

INNER JOIN Orion.Container c ON cms.ContainerID = c.ContainerID AND C.Name = 'YOURGROUP'

INNER JOIN Orion.NPM.Interfaces b on b.NodeID=nodes.NodeID

where Nodes.status NOT LIKE '1' or b.AdminStatus NOT LIKE '1'

Ckesey

Thanks for the feedback....I'm trying to tell what exactly I'm querying with this but can't seem to figure it out.

I of course get several nodes/interfaces that are shutdown but I'm not seeing the node in my list that I've put down for testing.