3 Replies Latest reply on Oct 3, 2012 9:50 AM by mharvey

    Rapid interface change detection

    gibjim01

      availability
      Hi,

       

      Is there a way to detect rapid interfaces status changes with NPM? I know there is a property called "Last Status Change" for every interface, but I can't find a way to set an advanced alert that will trigger when an interface goes down, and then quickly goes up. Polling interfaces is not very efficient to detect that kind of event.

       

      I tried to set an alert with these conditions, but not result:

      TRIGGER CONDITIONS:

      • Interface last change has changed

      I have no reset condition and no alert suppression set. Why this alert is not working?

       

      Thanks!

        • Re: Rapid interface change detection
          mharvey

          The has changed condition option is specifically built for node reboot and node IOS changes.  That condition cannot be used for other alerts unfortunately.  This is why the alert is not working.  What you would need to do is change the status polling on the interface from 120 seconds to says 30 seconds to detect this faster as interface polling for status is done via SNMP request.

           

          Regards,

          Matthew Harvey

          Loop1 Systems

            • Re: Rapid interface change detection
              gibjim01

              I understand your point, but what if someone unplugs and replugs en interface very quickly? Even with 30 seconds polling, NPM will not be able to detect it. It will also overload the servers (we have more than 40 000 elements to poll).

               

              Have any idea?

                • Re: Rapid interface change detection
                  mharvey

                  For situations like that, you are probably not going to be able to find out anything with NPM.  UDT might be more of a benefit to you at that point, but in this given scenario, not even NPM would be able to detect that, so the event would go missed in terms of polling.  However, if you could setup syslog to send a log when something like this occurred, you could create a syslog rule to send you an email when that log was recorded by NPM.

                   

                  Regards,

                  Matthew Harvey

                  1 of 1 people found this helpful