Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

How do I create the interface utilization alert if I want 2 interfaces make over the threshold at the same time?

Say there is an SDWAN router interface A and Interface B (both connected to Inet)

- I want to be notified when both of them reach the same Transmit or Receive threshold utilization together?

0 Kudos
3 Replies
Level 15

are you saying you want to know if they are equal, or only when both are above a threshold at the same time?


Alert me when Interface A XMT = Interface B XMT


Alert me when XMT or RCV critical threshold is breached for BOTH Interface A and B for XX minutes

I'm assuming the 2nd option, which austinzak​ put you on the right path towards.

The trick is to combine your conditions with a nested "AND" statement.


you can validate your logic by clicking the small "down" arrow on the right of your top-level "AND" (where the big red arrow is pointing in the image), and selecting "Show SWQL"

This brings up the SWQL behind the scenes that will be used to evaluate your alert condition:

SELECT E0.[Uri], E0.[DisplayName]
FROM Orion.NPM.Interfaces AS E0
    ( E0.[Caption] = 'Interface A' )
    ( E0.[OutPercentUtilizationThreshold].[IsLevel2State] = 'True' )

        ( E0.[Caption] = 'Interface B' )
        ( E0.[OutPercentUtilizationThreshold].[IsLevel2State] = 'True' )

This is an example for the Critical Threshold on the Transmit side, you would do the same thing for Receive, just flip the appropriate value in the drop down on your 2nd alert.

Note that you could combine these into a single alert with a top-level "OR", but honestly it's almost always a better idea to keep your alert logic as simple as possible.

0 Kudos

This has to be applied to the same Node interfaces (how to condition that if we are talking about hundreds of nodes)?

Also unable to replicate "Netflow Receiving Enabled (Netflow Source): condition = 1 (cannot set 1)

0 Kudos
Level 9

Don't know specifically, but here is a link to a video about advanced alerts: Success Center .