How can I ignore Idle (Admin) BGP neighbors in Alerts?

I have been trying to figure this out as well, not only for BGP, but also for OSPF and EIGRP.  Basically I get from our WAN team that they know there will always be idle BGP links, waiting to be used in a backup scenario.  I think what they really want is an alert for when a BGP link drops from Established.  Not any that are already not Established.  I am asking them about the admin down type circuits though.

Did u end up working this out because i would love to know the solution?

Anyone know how to resolve this yet?

Bump

I think we did find an SNMP OID that matched our intentionally idle states.  I was able to make a UNDP for this OID, but I can't figure out how to use the alert GUI with the built in alert to use it as a filter.

This is from Cisco's SNMP Object Navigator.

SNMP walk against a couple of routes on one of our routers looks like this:

.1.3.6.1.2.1.15.3.1.3.xxx.xxx.xxx.xx1 = INTEGER: 2

.1.3.6.1.2.1.15.3.1.3.xxx.xxx.xxx.xx2 = INTEGER: 1

where xxx.xxx.xxx.xx? is the BGP route IPv4 Address.  In this case, the route with INTEGER: 1 is supposed to be admin down as a reserved/backup route.

Since the built in alert reports the IP address and this OID reports the same address, there should be a way to key these together and filter out any BGP routes in an Admin down state.  It might require an SWQL query.

Tagging a couple of people from other BGP posts hoping they will tag some more.

alexslv​ superfly99​ mikegale​

Could you create a custom property and only alert if status is down & custom property equals primary connection. This would then ignore alerts from the standby peer?

Not really, at least not in all cases.  I have this situation going on right now due to a cut fiber somewhere.  The BGP down alerts that have fired originate from a different router, but cross a couple of routers to get to the end point.  The physical link is broken somewhere between, not at the point the BGP failed.  It also isn't very dynamic if things change, which they do.  There would be a lot of manual maintenance.  Dependencies don't look at the routing protocols either, so I can't build a protocol dependency on an interface.

I might be able to attach custom properties to an interface, but what about the route itself.  Really, it would be best if SolarWinds just incorporated the Admin Down status to reference in the alert.  They mark admin down interfaces, we need that on routes, especially idle backup routes.  I need this feature for both BGP and OSPF in our very large network.

I've just stuck with using syslog for this (both OSPF and BGP). It's quick and reliable. Anything involving the alerting engine, comes with a time delay - so it doesn't pick up flapping links.

I have made that suggestion.  The network group currently isn't sending those messages to out SolarWinds or Kiwi syslog instance.

I was able to accomplish this with a Universal Device Poller and a Custom SQL Alert.

In the Universal Device Poller app on my primary poller, I added the previously mentioned OID: 1.3.6.1.2.1.15.3.1.3

Once the poller is defined, "Assign Pollers" to apply it to nodes. I selected all my Cisco inventory. I don't know if it will dynamically apply this poller to new devices or not.

Next, create a new alert. The alert type is "Custom SQL Alert (Advanced)", then selected "Routing Neighbors" for "Set up your SQL condition".

When "Routing Neighbors" is selected, it will pre-populate the first part of the query. This part is not editable:

SELECT NPM_RoutingNeighbor_V.NeighborIP, NPM_RoutingNeighbor_V.NeighborID FROM NPM_RoutingNeighbor_V

Next, add more to the query. This will join the NPM_RoutingNeighbor_V table with the CustomPollerStatusTable. OrionStatus=2 means the neighbor is down. Value=2 means the admin status is enabled. ProtocolID=14 is to specify BGP only.

LEFT JOIN CustomPollerStatusTable AS p
ON NPM_RoutingNeighbor_V.NodeID=p.NodeID AND NPM_RoutingNeighbor_V.NeighborIP=p.RowID
WHERE OrionStatus=2 AND p.Value=2 AND NPM_RoutingNeighbor_V.ProtocolID=14