• State Verified Answer
  • Locked Locked
  • Replies 1 reply
  • Subscribers 38 subscribers
  • Views 825 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Help: Neighbor went down alert

pseudonetworker

Hello,

I have an alert in place for OSPF neighbor relationship being down. Does anyone know how to add the interface that's assigned the IP in this code if possible?

Typically we run in 2 uplinks between our core and distribution switches, so I wanted to get alerts if any of those links goes down and or the ospf relationship went from Full to Down.  Having the interface isn't a make or break, I thought it would be interesting to see if its possible. 

Example of what I am looking for:

Lab-r1 to lab-dist on xe-0/0/1 (10.1.0.1) went down.  

${N=SwisEntity;M=Router.Nodes.SysName} to ${SQL:SELECT Caption FROM NodesData left join NodeIPAddresses on NodesData.NodeID=NodeIPAddresses.NodeID where (NodeIPAddresses.IPAddress='${N=SwisEntity;M=NeighborIP}' OR NodesData.IP_Address='${N=SwisEntity;M=NeighborIP}')} (${N=SwisEntity;M=NeighborIP}) is down.

Parents
  • 0

    Hi Pseudonetworker,

    I don't have an alert version of this in our environment, but I've done some SWQL reporting on such things.
    Here's what I came up with:

    SELECT n.Caption AS Device,
                   n.IPAddress AS Device_IP,
                   rn.NeighborIP AS Neighbour_IP,
                   rn.Ip_Address_Type,
                   rn.ProtocolStatusDescription,
                   rn.IsDeleted,
                   rn.LastChange,
                   rn.DetailsUrl,
                   rn.Status
    FROM Orion.Routing.Neighbors rn
    INNER JOIN Orion.Nodes n ON rn.NodeID = N.NodeID
    WHERE rn.ProtocolName = 'OSPF'
    AND MINUTEDIFF(rn.LastChange, getUtcDate()) <= 5
    ORDER BY rn.LastChange DESC

    By only displaying the OSPF events for the past 5 minutes it should only show OSPF details for the device that has recently changed.

    Hope it helps,
    yaquaholic

Reply
  • 0

    Hi Pseudonetworker,

    I don't have an alert version of this in our environment, but I've done some SWQL reporting on such things.
    Here's what I came up with:

    SELECT n.Caption AS Device,
                   n.IPAddress AS Device_IP,
                   rn.NeighborIP AS Neighbour_IP,
                   rn.Ip_Address_Type,
                   rn.ProtocolStatusDescription,
                   rn.IsDeleted,
                   rn.LastChange,
                   rn.DetailsUrl,
                   rn.Status
    FROM Orion.Routing.Neighbors rn
    INNER JOIN Orion.Nodes n ON rn.NodeID = N.NodeID
    WHERE rn.ProtocolName = 'OSPF'
    AND MINUTEDIFF(rn.LastChange, getUtcDate()) <= 5
    ORDER BY rn.LastChange DESC

    By only displaying the OSPF events for the past 5 minutes it should only show OSPF details for the device that has recently changed.

    Hope it helps,
    yaquaholic

Children
No Data

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.