This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How do I create the interface utilization alert if I want 2 interfaces make over the threshold at the same time?

Say there is an SDWAN router interface A and Interface B (both connected to Inet)

- I want to be notified when both of them reach the same Transmit or Receive threshold utilization together?

  • Don't know specifically, but here is a link to a video about advanced alerts: Success Center .

  • are you saying you want to know if they are equal, or only when both are above a threshold at the same time?

    e.g.;

    Alert me when Interface A XMT = Interface B XMT

    vs

    Alert me when XMT or RCV critical threshold is breached for BOTH Interface A and B for XX minutes

    I'm assuming the 2nd option, which austinzak​ put you on the right path towards.

    The trick is to combine your conditions with a nested "AND" statement.

    pastedImage_6.png

    you can validate your logic by clicking the small "down" arrow on the right of your top-level "AND" (where the big red arrow is pointing in the image), and selecting "Show SWQL"

    This brings up the SWQL behind the scenes that will be used to evaluate your alert condition:

    SELECT E0.[Uri], E0.[DisplayName]
    FROM Orion.NPM.Interfaces AS E0
    WHERE
    (
        ( E0.[Caption] = 'Interface A' )
        AND
        ( E0.[OutPercentUtilizationThreshold].[IsLevel2State] = 'True' )

        AND
        (
            ( E0.[Caption] = 'Interface B' )
            AND
            ( E0.[OutPercentUtilizationThreshold].[IsLevel2State] = 'True' )
        )
    )

    This is an example for the Critical Threshold on the Transmit side, you would do the same thing for Receive, just flip the appropriate value in the drop down on your 2nd alert.

    Note that you could combine these into a single alert with a top-level "OR", but honestly it's almost always a better idea to keep your alert logic as simple as possible.

  • This has to be applied to the same Node interfaces (how to condition that if we are talking about hundreds of nodes)?

    Also unable to replicate "Netflow Receiving Enabled (Netflow Source): condition = 1 (cannot set 1)