2 Replies Latest reply on Apr 15, 2016 11:30 AM by vjerez4129

    How do I create an alert based off the sum of the Total Bps of two interfaces?

    vjerez4129

      I was tasked to create a report that would show the total internet bandwidth usage of our network, which I believe i did in the following:

       

      bandwidth.PNG

       

      Now I have been tasked with creating an alert that would trigger when the sum of both is over a certain amount.

      Any ideas how i could do this? i've been kinda poking around creating an alert that would simulate it but any feed back or ideas would be appreciated!

        • Re: How do I create an alert based off the sum of the Total Bps of two interfaces?
          mesverrum

          I feel like there is probably a way to make this happen through the GUI if you get very creative.  I was considering building some kind of UnDP's and a transform so we could set an alarm when that combined value went above the threshold, and I'm pretty sure that would work but this SWQL based alert does it so much faster and isn't as complicated for you to set up on your end.

           

          Go to alerts and set up a custom SWQL alert like so, and in the lower box paste in the text I have here

           

          join (SELECT nodeid, sum(outbps) as [totalout]
          FROM Orion.NPM.Interfaces
          where (fullname like '%%%%%' -- FULL NAME OF FIRST INTERFACE HERE
          or fullname like '%%%%%') -- FULL NAME OF SECOND INTERFACE HERE
          group by nodeid) t2 on t2.nodeid=nodes.nodeid
          where t2.totalout>800000 -- SET BPS THRESHOLD HERE
          

           

          This assumes that both interfaces are on the same node, if they weren't then it will get a little more complicated to write up the logic but in my test environment this works for what you have in your picture.  If it was me I would probably include a link to that report as part of the message or include something like "Combined bps of WAN interfaces is ${SQL: SELECT sum(outbps) as [totalout] FROM Orion.NPM.Interfaces where (fullname like '%%%%%' or fullname like '%%%%%')}

           

          You would also want to set up another alert for inbps to let you know if you were getting hammered on that end.

           

           

          -Marc Netterfield

              Loop1 Systems: SolarWinds Training and Professional Services

          1 of 1 people found this helpful