martinstenner ✭✭✭✭✭

Definitely. We've customised existing and created new to fit our needs over the years, but I was initially surprised by the lack templates for certain vendors.

There we go. Happy to help!

This now works. Thanks maria.bungau

Good Morning - getting an 'UNAUTHORIZED' error for this morning's question.

I went back through my answers and one of my original ones has worked! Thanks maria.bungau‌

Fair enough. I would take the first submission if you received multiple responses from me.

DanielleH maria.bungau - Might just be me, but day 8 (today) is not accepting any answers on any of the ratings. If I select a ranking, the selection doesn't take.

Hi everyone, thanks very much. Really looking forward to receiving this!

Ah, got it right! Go with your instinct.

That works fine now, thanks!

Ditto. Wondering if the wrong question/link has been posted. DanielleH‌?

Yes! I spent a frustrating hour on this exact thing earlier, only to realise all my efforts were futile.

I second Robert Browning's findings. Can't seem to submit the question despite having all tick boxes checked and text in the comments field.

Here we go!

NCM 6.1 device template assistant utility. Helpful video here: https://www.youtube.com/watch?v=VP4r0aQO35U

Ditto Robert Browning

Just playing around really. Would be good to see an output from the device's perspective if an interface alert it raised.

This has actually been a very useful process for me. I'm going to combine this action with an NCM script to give me 'sh ip int br' in the email results.

In that particular example, I don't believe you're going to see any flow data due to the lines: Firewall Events: Flow deleted (2) and Extended firewall event code: Unknown I would expect to see: Flow created (1) If you do a longer packet capture, do you see any flow created messages?

Excellent.

I would suggest you see if there's any standardisation across your estate with regards to interfaces, depends on how many devices you have to make it worthwhile of course. If you can build deployments in NCM for a few different interface mixes, then it's still a worthwhile process for future deployments.

I think I might be talking rubbish, doesn't look like you can add custom pollers at the web interface anyway, so UDP on the NPM server is the way to go.

Using a test Cisco 1841 router, I've added this into NPM along with interface fa0/1. From UDP have assigned poller to fa0/1. I've matched my alert condition and trigger to be the same as yours (apart from ${Interface.AlertInterface} and get the following email content when I admin shutdown fa0/1: Down RTR-1841-02 -…

OK. So to confirm you've done all the following: Node and specific interface added into NPM for monitoring Using Universal Device Poller you have assigned the interface(s) you want to monitor with this poller and have tested it returns a result (this is important, because I found this poller works for physical interfaces,…

I would suggest you're running a version of NPM where the custom pollers aren't yet integrated into the web console. Go through a remote desktop session on the server running your NPM instance: Start/All Programs->Solarwinds Orion->Network Performance Monitor->Universal Device Poller (UDP) File->Import UDP

You don't see the following if you go into 'settings'?

Manage Nodes, 'Manage Pollers' link (top-right) - you can also get there from 'Settings' under the NPM section 'Manage Pollers'. Click Import

Can you export the relevant portion of the packet capture and upload?

I have set the trigger as you have. But you're not going to get an alert unless you have a trigger and/or reset action. Trigger Condition: Trigger Actions:

Can you post an image of each tab for the alert in question?