4 Replies Latest reply on Sep 10, 2014 8:35 AM by karedia

    EIGRP Neighbor Alerting Issues in NPM 10.7


      Hello everyone,


      We've been working with Solarwinds (ticket # 573121 + 597398) regarding a specific issue we're experiencing with EIGRP Neighbor alerting on our scenario, which unfortunately didn't get any resolution -so this is why I'm posting the question here, maybe someone smarter than me already figured this out


      So, a few points about our scenario:

      * We have approximately 30 sites, each one with routers connected in full mesh

      * All of our routers' share the same AS number

      * The routers are connected to each other through GRE Tunnels

      * All sites have redundant connectivity, so Orion will always be aware of the neighbors' table situations.

      * Our routers' eigrp neighbors table have usually 2x neighbors in the 10.x.x.x space (local uplinks) and many others in the 172.20.x.x space (remote peers over GRE tunnels to other sites)

      * Whenever there is a circuit outage on the site, the 10.x.x.x peers stay up (being local), the physical interfaces remain up (as they're Ethernet) and GRE Tunnel remains up (as it's a virtual interface) but all the 172.20.x.x peers go away, as evidently they become unreachable.


      Our ultimate goal is to receive 1 email alert when all the 172.20.x.x neighbors disappear from the eigrp routing neighbors table of a router, so to identify when a circuit outage happens -and this is where we found a roadblock. We’ve been trying countless approaches and alerting conditions, but none of the tests worked.

      We want to be alerted when *all* the 172.20.x.x peers go down from a router's eigrp neighbor table, not only one -otherwise this would generate a great number of emails and many false positives: for example if 1 sites goes down, we do not want to receive 29 emails from the other routers saying that 1x peer went down, but just 1x email from that one router saying that it lost all the other peers.

      We have been told by Solarwinds (ticket 597398) that the actual Routing Neighbors feature does not support this kind of scenario -which is highly disappointing, as we have been anxiously waiting for NPM 10.7 to support EIGRP routing neighbors, as we were told that this release would have fixed this issue (initial ticket #573121).


      Concluding: has any of you experienced the same  issue? Is there a solution for this specific alerting need in a scenario like this?


      Many thanks in advance,



        • Re: EIGRP Neighbor Alerting Issues in NPM 10.7



          How are your devices connected? Are you running DMVPN using MPLS, BGP and EIGRP?


          I have over 150 sites and we monitor the tunnels and if they go down it will be displayed in our NOC but it will not send an alert. We created an alert that will only send an alert if the link flaps more than 10 times in an hour this way we do not get too many alerts. I do not do alerts on routing tables because they can change really quick.



          • Re: EIGRP Neighbor Alerting Issues in NPM 10.7

            This should be possible with Custom SQL Alert. When neighbor disappear from routing table NPM_RoutingNeighbor.IsDeleted=1. This alert will be triggered only once - for the router. The reset condition will be the same but you have to change HAVING clause to HAVING SUM(CONVERT(int,IsDeleted))<>COUNT(*)).


            • Re: EIGRP Neighbor Alerting Issues in NPM 10.7

              Dear JiriPsota,


              There are simply not enough words in my vocabulary for thanking you from the deepest part of my soul! I have been banging my head on this for (almost) ever, and you've given us the solution in a few hours!!!


              Your mastery on SQL and Solarwinds is absolutely outstanding -if there's anything I can do for you a part of keeping on saying "thanks/gracias/grazie/merci/danke", please let me know!


              I'll forward your reply to the 2 Solarwinds engineers who were not able to give me this solution over the course of several days and 2 tickets opened!


              thanks, thanks again!