Interface Traffic Alert: Compare previous poll to current

This will need some sort of fancy custom SQL alert. How many links are we talking about?

Number of links? about  a hundred or more? as long as the traffic drops a certain bps from the previously polled traffic.

All,

I could see this being something for the reverse as well. If the receive traffic jumped by "x"% or "y"bps. This would help identify potential traffic and application issues due to massive changes in behavior. This would also need to include a window to ignore, because of traffic like backups, but that is already there in the Alert engine.

Best Regards,

Derik Pfeffer

Loop1 Systems: SolarWinds Training and Professional Services

• LinkedIN: Loop1 Systems
• Facebook: Loop1 Systems
• Twitter: @Loop1Systems

Yes I am planning to use the alert on both ways, either increase or decrease, hopefully solarwinds could make this alert as one of the default alerts.

The sudden increases *should* be covered by using the baselines and dynamic thresholds feature of NPM. Simply edit the interface(s), and if you scroll down all the way to the bottom you will see options to set warning and critical thresholds based on baseline data. It uses 2x standard deviation for warning, and 3x standard deviation for critical threshold. The trigger condition in  your Alert is going to be something like 'Transmit % utilisation has exceeded critical threshold'

If dynamic thresholds are enabled, the thresholds should get updated in the InterfacesThresholds table. There *may* be a way to extract the average and the standard deviation (standard deviation should be the difference between critical and warning thresholds) from this table to determine the low bars to determine traffic drops. I haven't had a chance to dig into the required SQL to see if it's possible

have you god a sollution for this problem?