4 Replies Latest reply on Apr 1, 2014 8:54 AM by stuartwhyte

    Unplugged Interface Alert Acknowledgement

    ktulu037

      I have several interfaces on switches that are not used. I have them set to show as "Unplugged" rather than down. Right now, I am using the built in SolarWinds alert for unplugged interfaces that creates a log entry. On the node summary page under Active Alerts - All Unacknowledged Alerts, I have several alerts showing. I would like to be able to acknowledge these alerts and not have them display as active, however, each time I acknowledge an alert it seems to reset it and I get a new wave of alerts for interfaces that have been unplugged the entire time.

       

      I have read through the blogs and have found a few ideas that seemed like a good idea, but for whatever reason are not working for all of my devices.

       

      In the Advanced Alert Manager, I have modified the reset condition to be "Reset when trigger conditions are no longer true". That seemed to work on some switches but not all... I cannot get my Cisco 3560G switches to clear alerts without re-triggering.

       

      What is the best way to accomplish the following:

       

      1. Keep alerting on interfaces that have moved from an "Up" state to either a "Down" or "Unplugged" state

      2. Allow for someone to acknowledge an alert on an "Unplugged" interface to remove it from the "Active Alerts - All Unacknowledged Alerts" summary after they have confirmed that this interface will remained unplugged.

      3. Keep the Unplugged interface in SolarWinds for monitoring - I want to know if someone gains access to an interface that was previously unused without approval

       

      Thank you in advance for any advice.

        • Re: Unplugged Interface Alert Acknowledgement
          Sohail Bhamani

          The whole idea behind the status of "unplugged" is to not alert against them.  This is a status used so that the interface doesnt get marked down when folks go home after work.  I wouldnt create an alert based on unplugged.  Also, this is best used only for ports with user devices on them that go home at night. 

          • Re: Unplugged Interface Alert Acknowledgement
            stuartwhyte

            Hi,

             

            A couple of observations:

             

            1)  I wouldn't be alerting on an unplugged interface, as it will likely stay in alert state for an extended time.  When you acknowledge the alert, it will re-trigger after 10 days, so you'll be caught in a cycle.

             

            2)  Set your alert for "down" with a reset on "up".  To protect against ports coming up without approval, once an interface alerts on down, and is expected, set this interface to admin down on the device itself.  If you also set "status  = shutdown" to your reset trigger, this will also clear the alert.  you will need to set the port to "admin up" for anyone to use the port.

             

            3)  Unpluggable interfaces are generally set on interfaces that will go up and down and you do not wish to be alerted.

             

            HTH

             

            Stuart