This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to alert only on "interconnect" interfaces

We are testing Solarwinds NPM for monitoring a LAN&WAN network of over 2000 devices (routers, switches, firewalls). The network is highly resilient with dual connections to most sites and between routers and switches, so we need to rely heavily on interface alerts, not just node down.

All the network devices will be in NPM, but PC / Laptop / Server devices that connect into the switches at the sites are not in NPM (they are not our responsibility)

We want interface down alerts for any interfaces that are used to connect the device we have in NPM together - i.e. (inter site links, router to switch links, switch to switch links etc) but we do not want interface down alerts for the switch interfaces used to connect to PCs / laptops etc.

Obviously, we could use a custom property to mark each interface we wanted to alert on, but that's going to be a massive job to trawl through all the devices and manually mark the interfaces we are interested in.

Given that all the interfaces we want to alert on connect nodes that are in NPM, and that we are using Network Topology Mapper to generate maps, is there any way we can use the topology information to help enable alerts on the interfaces used for interconnects and ignore the "end user device" interfaces?

  • I think some manual editing is unavoidable.

    When you have identified the unimportant interfaces, set them for one of these modes:

    Maintenance mode

    To temporarily stop collecting data or triggering alerts for interfaces, put the interface or the parent node into a maintenance mode. Go to Manage Nodes, and navigate to the interfaces. Select the interfaces, and select a maintenance mode option: Mute alerts: data for the interface is collected, but alerts do not trigger. Stop collecting data: data for the interface is not collected and alerts do not trigger. Schedule a maintenance period: specify a period of time to stop collecting data or mute alerts for the interface. The maintenance mode settings change according to your settings. For information about resuming alerts, starting collecting statistics, or editing the scheduled maintenance, see the section on Maintenance Mode for nodes.

    Set the interface status as Unpluggable If you do not want to be notified when an interface is down, you can specify that the interface is Unpluggable. The interface status is reflected in the status of the parent node and in alerts. 1=. On the Node Management view, select the interface, and click Edit Properties. 2. Select Display Interface as Unplugged Rather Than Down, and click Submit. The interface status does not influence the status of the parent node.

  • Thanks for the reply.  I understand how to tell NPM to only alert on some interfaces.  The problem I have is the first step...

    "When you have identified the unimportant interfaces....."

    Solarwinds effectively already has this information through topology mapper, i.e. any interface that connects to another node in NPM needs alerts, any interface that does not connect to another node in NPM is "Unpluggable"

    Without being able to use the topology info somehow, we need to go through nearly 2000 devices and for each one, manually reference the NTM maps to decide which interfaces are "unpluggable" and which need alerts, and then manually set them.

    Surely there has to be a more efficient way than that? That's days of manual work to transfer information about node connections from one part of Solarwinds (NTM) to another (NPM)

    Is there perhaps some way of accessing the topology data through a script, and setting an interface that does not connect to another node within the map to "unpluggable"?

  • I also agree that this should be implemented. As you said, Solarwinds has the info in the topology map. Some competitor's products allow you to group interfaces based on topology information, and therefore include / exclude those interfaces from alerts.

  • Is there a particular reason you monitor all ports? If you don't care about them going down, you could just only monitor important links. That way you don't have to set any to "unplugged".

  • My bigger question would be if you're managing a network estate that big, how come the uplink ports are:

    a) Not the same across your entire estate, meaning you only monitor those particular interfaces (ie Gig0/0 or 0/1 or Fe0/24 etc).

    b) Why do the uplink ports not have a unique interface description that you could use to batch them all together. (This could be used in the Alert itself or to create a Dynamic Group or Custom Property).

    Do your normal Edge ports use switch-port mode access or switch-port mode trunk? If you only use Trunk for uplink ports, then you could use that as an identifier as any access ports will only be user devices.

  • Groups is the way to go! We have two Redundant Firewalls and 4 interfaces (2 on each firewall). We only wanted after hour alerts if ALL 4 interfaces went down. We created a Group with those 4 interfaces. The key is you have to change in Advanced Settings of the group to "show best status" The group remains in an up state until all interfaces are down. It is then easy to set up a simple alert with that group as the object being monitored and then alert on group status being down.