Hello - quick question. I'm trying to figure out if this is possible. I've got a bunch of pairs of interfaces on switches that are primary / backup interfaces for the end devices. The issue we are having is that when the primary device has a heartbeat failure between the back up device, for whatever reason the primary doesn't stop sending traffic. So the symptom we see is the primary and secondary end device are both sending traffic which is overloading the device where the traffic is headed to. So I'm trying to build an alert when the traffic volumes are matching or very close to matching. Also, the primary/secondary interface pair may be on different switches and there are roughly 200ish interfaces in question, or roughly 100 pairs. I'm thinking custom properties to define the "paired" interfaces, and then build alarming off of that? Any ideas how to accomplish this?
If the secondary port normally only runs around 2-3KB/sec, you could just write an alert that alerts you when utilisation goes over say 1MB/sec.
If you add something unique to the "secondary" interfaces like the word paired and then write your alert to look for interfaces with the word paired including in the description. That would keep your alert nice and simple.