I was wondering if anyone out there has any advice/tips/experience on monitoring interfaces/subinterfaces and alerting. We have a lot of sites with a serial interface containing multiple sub-interfaces. All of these interfaces are being monitored by NPM. Additionally, we have an alert configured that triggers off an interface going down and sends an email to our ticketing system.
The problem is what happens when the physical interface goes down. The system generates a lot of incidents when only one is necessary to say the physical interface is down.
For example, we have Serial0/0 and two subinterfaces S0/0.101 and S0/0.201.
Case 1: Sub-interface S0/0.101 goes down. One email/ticket generated.
Case 2: Physical interface S0/0 goes down. Three emails/tickets generated - is it possibly for the system to detect this and only send a single ticket for the physical?
I thought about adding in interface dependencies but with at least several hundred sites similar to this scenario, I don't think the system could cope checking these dependencies all the time, not to mention the administrative headache.
Am I limited to reporting on all the interfaces or a subset (all the subs, or all the physicals)?
Comments would be appreciated.