Chris-S ✭

I recently had my manager request for password-less access for certain monitoring personnel and I'm using the built in Guest account for the first time. After examining how it's set up, it appears that you can limit most listed pages in the account profile (granted you have to remove each one individually) but with the…

That snmp walk utility works, chad. I'm marking this as a solution, even though I discovered there is no OID that gives me the information I want (see my response to bobmarley below)

Unfortunately I discovered that there IS NO OID that gives me the information that I want, which is the number of active, dynamic NAT translations. Seems strange that there is no OID for this. It's a very valuable piece of information to know, for us, anyway.

Thanks Chad, I'll give that a try!

bump? Has anyone done something like this?

Adam: First let me say I really appreciate you trying to help me out! Here's the current status. The latest query you gave me: SELECT Nodes.Uri,Nodes.DisplayName FROM Orion.Nodes AS Nodes LEFT JOIN Orion.Routing.Neighbors AS Neighbors ON Neighbors.NodeID = Nodes.NodeID RIGHT JOIN Orion.ContainerMembers cm on nodes.Uri =…

Hi, Adam. Chad's query does work. However, it's missing something I added, which is to select only members of a certain group (container) (the post right after Chad's response, thanks Chad!). I got the new query to work in SWQL studio but I'm uncertain how to re-organize it to make it work as an alert.

Adam: The out of the box alerts for neighbors work for fine with BGP, they don't work for EIGRP. There are long threads in my history here on this topic. Hence, this kind of custom query. I'm still trying to figure out how to transform the query I posted above into something that will work in an alert.

Thank you, Chad. So, this works! Before I read your response, I had enhanced my original query (and tested it successfully in SWQL Studio) to only check devices in a certain group (container), which is what we want, and it looks like this: SELECT cm.Name FROM ( SELECT c.Caption FROM Orion.Routing.Neighbors AS n LEFT JOIN…

And this same custom SWQL WORKS as a widget on our home screen for Orion:

Example from SWQL Studio: Example from creation of alert:

Thank you, greskamh - that worked perfectly!

By cut-buffer I mean highlighting some text (in this case a query) and hitting Control-C to "copy" the text and then using Control-V to paste the text in another window.This doesn't work at all for me in SWQL, and I'm accessing the session via RDP. I can use the same sequence to cut and paste any to/from this machine in…

Thanks, Adam, I'll keep poking around in SWQL and see if I can find what I need.

Thanks Adam, that gives me a lot to think about. I can do a lot of what is needed programmatically. The parts I'm missing is what tables and fields contain latency (min max avg) values and what frequency of that data? Is it timestamped? What is the relationship between what I assume will be multiple tables?

Adam: Yep, it's selecting routers with EIGRP running as a protocol. Right now it's selecting all of them (when we only want ones matching a particular custom property). I just need help constructing the query itself at this point.

Hey, cnoborg! Custom property defining the scope of nodes is already set. Each router has a Tunnel10 and Tunnel20 interface. Each tunnel interface should have exactly one EIGRP neighbor. If Tunnel10 or Tunnel20 are NOT DOWN AND if either does NOT have an EIGRP neighbor (count=0) for X minutes, generate alert. The alert…

Adam: This query returns all routers with EIGRP neighbors. Is there a query that can be constructed that shows returns the router name if Tunnel10 or Tunnel20 are both: A) the interface name IS Tunnel10 OR Tunnel20 B) the interface is currently UP C) the interface has zero EIGRP neighbors D) this condition has existed for…

Bump to see if anyone has more ideas...

cnorborg: We are using DMVPN however, the entire nhrp setup is far too complex and involved to implement for this one purpose. Suffice to say, we cannot use this as a solution. I do thank you for bringing it to my attention. We do not need to know right away if a neighbor is missing on a tunnel. We only care if the…

cnorborg: I'm looking into this to see if it works for us - I will respond back later today.

flackovic: That query, run in SWQL, returns the following table (with Caption column removed), with two entries for each individual router, and all the routers currently have a single eigrp neighbor for each tunnel, and there are two tunnels per router, so we get 340 rows returned (I've only included the first ten rows for…

Stuart - Thank you for replying. I looked at that example and tried multiple variants of it on our network. Nothing ever triggered an EIGRP neighbor missing on any interface on any node. I specifically blocked neighbors on some test routers while keeping the tunnel interfaces up which should have triggered the alert. Would…

Stuart - thanks for replying.

bob: I see what you're doing there but there's an added component on my side. I don't want a conglomerate of all syslog entries for all nodes. I want to fire the alert if a SINGLE node experiences say, 10 events of a specific type within a specific time frame. The query you have above would show everything matching a…

I think I see what you're doing there, bob. Let me try to construct something based on syslog instead of traps and see if I can work it out. I'll post back here on the result.

Bob: I'm uncertain how to specify a trigger based upon the frequency of multiple entries in a specific time frame. No one syslog entry would cause the alert to fire, I need it to be greater than X syslog lines per Y amount of time.

Thank you, Adam: Which free log tool would you be referring to, specifically?

Thanks again, jm.... I added a DateTime range and was able to pull the data I needed.

Thank you jm!! This is the kind of thing I am looking for, however in the SWQL studio (and in a custom report object), I get the following error, probably due to too much data.... what would be the field parameters to add a date range? 2023-03-13 13:44:17,280 [113] ERROR…