How can I ignore Idle (Admin) BGP neighbors in Alerts?

Problem: Until I find time to go through all my gear and delete unused peering sessions,  I'd like to make Solarwinds ignore BGP neighbors with the following state: Idle (Admin)

You'll see this if you do a sh ip bgp sum and you have an admin down BGP peer.

Currently I only have the first gray child condition, Routing Neighbors Protocol Orion Status is equal to Down.  The 3 gray child conditions listed under the AND statement are ones that I was considering tinkering with if it will accomplish the task.

I was thinking that all I need to do is tell the Alerts to IGNORE Idle (Admin) bgp states this would solve my problem for now.  It doesn't look like there is a way to do this.  Can anyone give a suggestion (besides delete the bgp peers bc yeah yeah it's on my list)?

pastedImage_1.png

Here are some other options to choose from:

pastedImage_0.png

  • I have been trying to figure this out as well, not only for BGP, but also for OSPF and EIGRP.  Basically I get from our WAN team that they know there will always be idle BGP links, waiting to be used in a backup scenario.  I think what they really want is an alert for when a BGP link drops from Established.  Not any that are already not Established.  I am asking them about the admin down type circuits though.

  • Did u end up working this out because i would love to know the solution?

  • I think we did find an SNMP OID that matched our intentionally idle states.  I was able to make a UNDP for this OID, but I can't figure out how to use the alert GUI with the built in alert to use it as a filter.

    This is from Cisco's SNMP Object Navigator.

    pastedImage_0.png

    SNMP walk against a couple of routes on one of our routers looks like this:

    .1.3.6.1.2.1.15.3.1.3.xxx.xxx.xxx.xx1 = INTEGER: 2

    .1.3.6.1.2.1.15.3.1.3.xxx.xxx.xxx.xx2 = INTEGER: 1

    where xxx.xxx.xxx.xx? is the BGP route IPv4 Address.  In this case, the route with INTEGER: 1 is supposed to be admin down as a reserved/backup route.

    Since the built in alert reports the IP address and this OID reports the same address, there should be a way to key these together and filter out any BGP routes in an Admin down state.  It might require an SWQL query.

    Tagging a couple of people from other BGP posts hoping they will tag some more.

    alexslvsuperfly99mikegale

  • Could you create a custom property and only alert if status is down & custom property equals primary connection. This would then ignore alerts from the standby peer?

  • Not really, at least not in all cases.  I have this situation going on right now due to a cut fiber somewhere.  The BGP down alerts that have fired originate from a different router, but cross a couple of routers to get to the end point.  The physical link is broken somewhere between, not at the point the BGP failed.  It also isn't very dynamic if things change, which they do.  There would be a lot of manual maintenance.  Dependencies don't look at the routing protocols either, so I can't build a protocol dependency on an interface.

    I might be able to attach custom properties to an interface, but what about the route itself.  Really, it would be best if SolarWinds just incorporated the Admin Down status to reference in the alert.  They mark admin down interfaces, we need that on routes, especially idle backup routes.  I need this feature for both BGP and OSPF in our very large network.

  • I've just stuck with using syslog for this (both OSPF and BGP). It's quick and reliable. Anything involving the alerting engine, comes with a time delay - so it doesn't pick up flapping links.

  • I have made that suggestion.  The network group currently isn't sending those messages to out SolarWinds or Kiwi syslog instance.

  • I was able to accomplish this with a Universal Device Poller and a Custom SQL Alert.

    In the Universal Device Poller app on my primary poller, I added the previously mentioned OID: 1.3.6.1.2.1.15.3.1.3

    UniversalDevicePoller.png

    Once the poller is defined, "Assign Pollers" to apply it to nodes. I selected all my Cisco inventory. I don't know if it will dynamically apply this poller to new devices or not.

    Next, create a new alert. The alert type is "Custom SQL Alert (Advanced)", then selected "Routing Neighbors" for "Set up your SQL condition".

    CustomSQLAlert.png

    When "Routing Neighbors" is selected, it will pre-populate the first part of the query. This part is not editable:

    SELECT NPM_RoutingNeighbor_V.NeighborIP, NPM_RoutingNeighbor_V.NeighborID FROM NPM_RoutingNeighbor_V

    Next, add more to the query. This will join the NPM_RoutingNeighbor_V table with the CustomPollerStatusTable. OrionStatus=2 means the neighbor is down. Value=2 means the admin status is enabled. ProtocolID=14 is to specify BGP only.

    LEFT JOIN CustomPollerStatusTable AS p

    ON NPM_RoutingNeighbor_V.NodeID=p.NodeID AND NPM_RoutingNeighbor_V.NeighborIP=p.RowID

    WHERE OrionStatus=2 AND p.Value=2 AND NPM_RoutingNeighbor_V.ProtocolID=14