This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to create an alert for interfaces down for a specified period of time

Good Day Gurus and Geeks,

I have Network Performance Monitor installed and it works great.

I want to create an alert that notifies me via e-mail of all administratively enabled interfaces that have been operationally down for more than a period of time (say 2 month).

The objective of this alert is to inform me of nodes that have monitored interfaces no longer connected to a device. e.g. PC, laptop or printer disconnected from the network or a PC that has be shutdown for 2 months, such that I can either re-assign the port to another device, administratively disable and unmanage it.

The problem that I am experiencing is to put the time variable in the trigger.

I have successfully created a trigger that alerts me to individual ports that are administratively enabled but operationally down and the last time that the operational status has changed:

Triger.JPG

I have configured the trigger action to e-mail me with the following message

Subject: ${NodeName} Interfaces Last Changed Status

Message:
Switch Name: ${NodeName}
Switch Status: ${Node.Status}
Switch Location: ${Node.Location}

Interface: ${InterfaceName}
Interface Administrative Status: ${AdminStatus}
Interface Operational Status: ${OperStatus}

Interface Last Changed: ${InterfaceLastChange}

I get the following in the e-mail result:

Subject: SWITCH_1 Interfaces Last Changed Status

Message:

Switch Name: SWITCH_1

Switch Status: Up
Switch Location: Building 1

Interface:SWITCH_1 - Port 1/0/28 · Printer_Accounts_Cheque
Interface Administrative Status: Up
Interface Operational Status: Down

Interface Last Changed: 12/5/2012 8:58:00 AM

I have configured the trigger to include a date, but it needs to be manually configured each time the report is run:

Triger2.JPG

Is there a away to insert a variable in the trigger conditions or e-mail message that lists a collection of ports instead of one per e-mail?

  • Hi shawn_b,

    to your first problem, there are two ways how it can be solved.

    1) use the "Do not trigger this action until condition exists for more than" condition. Just convert 2 moths into hours. This will delay the action for the time period from the point when the alert is triggered. It has one disadvantage and that you will wait the time period from now so you will not see the alert earlier than after 2 months (for your case). It doesnt work backwards.

    2) Use custom SQL alert. You can prepare the alert from the UI and then just change the "Type of Property to Monitor" to "Custom SQL Alert". You will se the sql then. Here you can use getdate function and transformation for the result so it fulfil your requirements.

    Anyway do not use Last Sync but Interface Last Change variable.

    to your second problem, unfortunatelly there is no way how to put list of ports into one email right now. You can create feature request here or via opening support ticket.

    Thanks,

    Pavel

  • Pavel,

    Thank you for the suggestion.

    I will try convering the time (2 months) into hours and test.

    For testing I will use a time of 168 hours (1 week). Once this works it should work for the 2 month time period.

    I have tried using the "Last Changed" variable instead of "Last Sync", which worked, however I still had to enter a fixed date for the time period.

    Trigger conditions:

    trigger_Last changed.JPG

    I want to be able to have NPM monitor and report on these conditions continuously without entering fixed date such as above.

    As per your suggestion on the second way to do it, via custom SQL script, the SQL for the above trigger condition works out to be:

    WHERE

    (

    (Nodes.Caption = 'SWITCH_1') AND

    (Interfaces.AdminStatus = 1) AND

    (Interfaces.OperStatus = 2) AND

    (Interfaces.InterfaceLastChange < '2012-12-01')

    )

    I would like the report to be something like:

    WHERE

    (

    (Nodes.Caption = 'SWITCH_1') AND

    (Interfaces.AdminStatus = 1) AND

    (Interfaces.OperStatus = 2) AND

    (Interfaces.InterfaceLastChange > '2 months')

    )

    to allow NPM to monitor and report continuously.

    Any guidance?

  • try this for your date Where statement

    Interfaces.InterfaceLastChange <= dateadd(month, -2, getdate())

  • Hi Shawn,

    bsciencefiction.tv suggestion seems perfect to me and should work for you.

    Let me know if you need any other assistance.

    Thanks,

    Pavel

  • bsciencefiction.tv, Thanx a lot

    That seems to work perfectly.

    I have created  a custom SQL trigger condition as follows:

    WHERE

    (

    (Interfaces.AdminStatus = 1) AND

    (Interfaces.OperStatus = 2) AND

    (Interfaces.InterfaceLastChange <= dateadd(month, -2, getdate()))

    )

    E-mail Results:

    Subject: SWITCH_1 Interfaces Last Changed Status

    Message:
    Switch Name: SWITCH_1
    Switch Status: Up
    Switch Location: Building 1

    Interface: SWITCH_1 - Port 1/0/14 · Unit: 1 Slot: 0 Port: 14 Gigabit - Level
    Interface Administrative Status: Up
    Interface Operational Status: Down

    Interface Last Changed: 9/22/2012 12:58:00 PM

    Date occured: Wednesday 12-12-2012
    Time Occured: 03:12

    Alert Name: Interface Last Changed Status < 1 month

    I ran this every minute and got some accurate results.

    There are several ports that are administratively enabled, but operationally down on the switch:

    Operationally Down: 1,2,4,6,7,8,10,14

    Alerts Received for: 1, 2, 4, 6, 8, 10, 14

    No Alert for: port 7 (last status was 12-10-2012)

    Tested for several other switches as well and reports accurately

    I have adjusted the alert to run for all switches every 1344 hours (8 weeks).

    Will monitor and see. I expect it to work

    Thank you for all your assistance.

  • An update to this,

    The custom SQL trigger condition works perfectly

    some results:

    Switch Name: SWITCH_1

    Switch Status: Up

    Switch Location: Building 1

    Interface: SWITCH_1 - Port 1/0/5 · Unit: 1 Slot: 0 Port: 5 Gigabit - Level

    Interface Administrative Status: Up

    Interface Operational Status: Down

    Interface Last Changed: 10/4/2012 6:04:00 PM

    Date occured: Wednesday 06-02-2013

    Time Occured: 03:02

    Alert Name: Interface Last Status Change < 2 months

    AND

    Switch Name: SWITCH_1

    Switch Status: Up

    Switch Location: Building 1

    Interface: SWITCH_1 - Port 1/0/8 · Unit: 1 Slot: 0 Port: 8 Gigabit - Level

    Interface Administrative Status: Up

    Interface Operational Status: Down

    Interface Last Changed: 10/4/2012 6:04:00 PM

    Date occured: Wednesday 06-02-2013

    Time Occured: 03:02

    Alert Name: Interface Last Status Change < 2 months

    Got lots more for different switches

    If only there were a way to get the results of all the interfaces for a specific switch consolidated into a single e-mail, so I would only get 8 e-mails for my eight switches instead of 100 e-mails with individual switch and interface . . . emoticons_cry.png