Alerting on flapping interface

Is there a way to make alert on Interface which is flapping Up and Down in certain time window?

I have created SQL query which lists "interface down" messages from events table (i.e. 3 occurences from same interface in 30 minutes).

I cannot use that query in alert engine as Custom SQL Query limits search on certain tables and fields.

What are alternative approaches with alert engine?

Find more posts tagged with

npm

Alerts

sql_query

Accepted answers

All comments

vinay.by

Why aren't you using the default ways for interface up/down alerting ? Why a SQL Alert ? Is it something to do with the way its currently setup ?

Lets say suppose your polling devices once in 300 seconds (5 mins polling interval).

Create a alert for Interface and in your Trigger Condition use 'Condition must exist for more than 30 mins'

This does exactly the same that you are asking for.

lwri

Hi Vinay.by,

I think that alert configuration doesn't catch up situations where interface is pumping:
For example timeline for one interface which had issues:
08:22 If Down
08:18 If Up
08:14 If Down
08:10 If Up
08:08 If Down

Kuroneko

I use a syslog alert.

Note it’s also very good at finding lagged servers bouncing because I can’t differentiate interfaces in the syslog.

edprop

I know this is an old thread but
I am in need of the same thing, we have "chronic" interfaces that experience problems and in our case we integrate the alerts with our ticketing system. So an interface that goes down and back up generates a ticket and closes the ticket and it happens often. I'm looking to have an alert setup that would watch a particular interface for a period of time and report multiple events. For example if the interface goes down 5 times in 1 hour , or 4 hours or 1 day etc... Then i want to generate an alert that has some specific information noting that its a chronic issue. I would be fantastic if we could generate the alert and the "mute" the offending interface but i know that's asking for a lot, ill settle for identifying problem interfaces for now and manually mute them .

stuartd

We use a custom SQL alert for just this. The beauty is that you can adjust the parameters to suit your environments or requirements.

But see this thread for details: How to create an alert for Network Device Flapping