This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Unplugged Interface Alert Acknowledgement

ktulu037 over 10 years ago

I have several interfaces on switches that are not used. I have them set to show as "Unplugged" rather than down. Right now, I am using the built in SolarWinds alert for unplugged interfaces that creates a log entry. On the node summary page under Active Alerts - All Unacknowledged Alerts, I have several alerts showing. I would like to be able to acknowledge these alerts and not have them display as active, however, each time I acknowledge an alert it seems to reset it and I get a new wave of alerts for interfaces that have been unplugged the entire time.

I have read through the blogs and have found a few ideas that seemed like a good idea, but for whatever reason are not working for all of my devices.

In the Advanced Alert Manager, I have modified the reset condition to be "Reset when trigger conditions are no longer true". That seemed to work on some switches but not all... I cannot get my Cisco 3560G switches to clear alerts without re-triggering.

What is the best way to accomplish the following:

1. Keep alerting on interfaces that have moved from an "Up" state to either a "Down" or "Unplugged" state

2. Allow for someone to acknowledge an alert on an "Unplugged" interface to remove it from the "Active Alerts - All Unacknowledged Alerts" summary after they have confirmed that this interface will remained unplugged.

3. Keep the Unplugged interface in SolarWinds for monitoring - I want to know if someone gains access to an interface that was previously unused without approval

Thank you in advance for any advice.

Top Replies

0 Sohail.Bhamani over 10 years ago

The whole idea behind the status of "unplugged" is to not alert against them. This is a status used so that the interface doesnt get marked down when folks go home after work. I wouldnt create an alert based on unplugged. Also, this is best used only for ports with user devices on them that go home at night.
Cancel
Vote Up +1 Vote Down

Cancel
0 stuartwhyte over 10 years ago

Hi,
A couple of observations:
1) I wouldn't be alerting on an unplugged interface, as it will likely stay in alert state for an extended time. When you acknowledge the alert, it will re-trigger after 10 days, so you'll be caught in a cycle.
2) Set your alert for "down" with a reset on "up". To protect against ports coming up without approval, once an interface alerts on down, and is expected, set this interface to admin down on the device itself. If you also set "status = shutdown" to your reset trigger, this will also clear the alert. you will need to set the port to "admin up" for anyone to use the port.
3) Unpluggable interfaces are generally set on interfaces that will go up and down and you do not wish to be alerted.
HTH
Stuart
Cancel
Vote Up +1 Vote Down

Cancel
0 ktulu037 over 10 years ago in reply to Sohail.Bhamani

The thought behind keeping unplugged interfaces in SolarWinds is to keep an inventory of open ports vs used ports. Also, it is an easy way for our helpdesk to quickly identify when a user has accidentally unplugged their device from the network. I would just like to be able to acknowledge these alerts and not have them re-trigger.
Cancel
Vote Up 0 Vote Down

Cancel
0 stuartwhyte over 10 years ago in reply to ktulu037

The alert re-trigger is something that is an underlying "feature" in the product. It can be changed with some modifications in the config files, however the maximum is 90 days.
Cancel
Vote Up +2 Vote Down

Cancel