3 Replies Latest reply on Mar 21, 2014 11:16 AM by mharvey

    Interface alerting on speed changes


      I am working on a way to auto acknowledge the event "Interface speed changed from ******* to ******* ".   I am aware that I could disable the entire event type with


      UPDATE EventTypes
      SET Record = 0
      WHERE Name = 'Interface Changed'


      but that seems like overkill.  I think they way to approch this is to just have the system clear the event.  The only way that I can come up with a way to do this automatically is to use an alert.  I have tried creating an advanced alert with the trigger being as such


      Trigger Alert when all of the following apply
           Interface Speed has changed


      I have no reset condition or Alert suppression
      I have the Trigger action of writing to a log file with the following statement




      If I test the Alert it does write out the log file as expected.
      The issue seems to be that I can not get the alert to trigger on its own.  I will get the events of the interface speed change but it does not seem to trip the alert.  Any ideas?

        • Re: Interface alerting on speed changes

          The issue is with the has changed condition.  This condition is literally only their for IOS changes or node reboots.  The code behind that condition is specifically coded for those two options.  What you would probably have to do is create a SQL component in SAM that queries the events table for that event, and if found sets the component to down, then trigger the alert.  Other than that, I'm not sure there would be a way to accomplish what you are looking for.

            • Re: Re: Interface alerting on speed changes

              Okay so I ended up going a different path  I created a SQL job that runs every 5 mins and auto acknowledges the events.


              UPDATE SolarwindsOrion.dbo.Events

              SET [Acknowledged] = 1

              WHERE [Message] Like '%Interface Speed changed from%'

              AND [Acknowledged] = 0

              AND [EventType] = 19


              This should keep the huge amounts of changes out of your immediate view.  For reports you will still need to figure out how to filter them out.   This seemed better than just turning off the entire event type to me.

              I know there is a lot of hubbub about not directly changing things in the database but an Admins got to do what an Admins got to do. 

              1 of 1 people found this helpful