This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Interface alerting on speed changes

Mrjamet over 10 years ago

I am working on a way to auto acknowledge the event "Interface speed changed from ******* to ******* ". I am aware that I could disable the entire event type with

UPDATE EventTypes
SET Record = 0
WHERE Name = 'Interface Changed'

but that seems like overkill. I think they way to approch this is to just have the system clear the event. The only way that I can come up with a way to do this automatically is to use an alert. I have tried creating an advanced alert with the trigger being as such

Trigger Alert when all of the following apply
Interface Speed has changed

I have no reset condition or Alert suppression
I have the Trigger action of writing to a log file with the following statement

${AlertTriggerTime},${NodeID},${NetObjectID}

If I test the Alert it does write out the log file as expected.
The issue seems to be that I can not get the alert to trigger on its own. I will get the events of the interface speed change but it does not seem to trip the alert. Any ideas?

Top Replies

Mrjamet over 10 years ago in reply to mharvey +1

Okay so I ended up going a different path I created a SQL job that runs every 5 mins and auto acknowledges the events. UPDATE SolarwindsOrion.dbo.Events SET [Acknowledged] = 1 WHERE [Message] Like '%Interface…

0 mharvey over 10 years ago

The issue is with the has changed condition. This condition is literally only their for IOS changes or node reboots. The code behind that condition is specifically coded for those two options. What you would probably have to do is create a SQL component in SAM that queries the events table for that event, and if found sets the component to down, then trigger the alert. Other than that, I'm not sure there would be a way to accomplish what you are looking for.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mrjamet over 10 years ago in reply to mharvey

Okay so I ended up going a different path I created a SQL job that runs every 5 mins and auto acknowledges the events.
UPDATE SolarwindsOrion.dbo.Events
SET [Acknowledged] = 1
WHERE [Message] Like '%Interface Speed changed from%'
AND [Acknowledged] = 0
AND [EventType] = 19
This should keep the huge amounts of changes out of your immediate view. For reports you will still need to figure out how to filter them out. This seemed better than just turning off the entire event type to me.
I know there is a lot of hubbub about not directly changing things in the database but an Admins got to do what an Admins got to do.
Cancel
Vote Up +1 Vote Down

Cancel
0 mharvey over 10 years ago in reply to Mrjamet

That's actually a pretty cool workaround there.
Cancel
Vote Up 0 Vote Down

Cancel