22 Replies Latest reply on Feb 9, 2017 1:18 PM by Craig Norborg

    Interface name in UDT Alerts

    shawn_b

      I have a working UDT alert that e-mails me when a new MAC Address appears on the network

       

      I have the alert set to e-mail when triggered.

       

      The following is my e-mail response

       

      Subject: User Device Tracker alert when new MAC address is added.

      Message:

      MAC Address: ${MACAddress}

      Switch Name: ${NodeName}

      Alert Name: ${AlertName}

       

      I would like to include the interface name that the MAC is discovered e.g. Interface: Datacenter_Switch_1  Unit: 1 Slot: 0 Port: 3 Gigabit

       

      Can anyone assist me with the SQL variable for this?

       

      Also I do not get any results for ${NodeName}

       

       

      the following are my results

       

       

      User Device Tracker alert when new MAC address is added.

      MAC Address: 88:9F:FA:63:AF:56

      Switch Name:

      Alert Name:  Alert me when a new MAC address appears on network

       

        • Re: Interface name in UDT Alerts
          alangidlewski

          Same Problem,

           

          trying to create a email alert with following settings.

          ______________________

           

          A New MAC-Address appears on network

          Switch Name

          Switch Port

          Switch Port Name

          MAC-Address

          ____________________

          Some Ideas?

            • Re: Interface name in UDT Alerts
              alangidlewski

              Still no Update? SolarWinds Support also no help..

                • Re: Interface name in UDT Alerts
                  Craig Norborg

                  Try these:

                   

                  Port : ${SQL: SELECT Name from [dbo].[UDT_Port] WHERE  (PortID = ${N=SwisEntity;M=PortID})}

                   

                  Device : ${SQL: SELECT Caption FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                    • Re: Interface name in UDT Alerts
                      alangidlewski

                      Hi,

                       

                      thanks for the replay!

                       

                      But it didnt worked. Look at the screenshots.

                      thwack2.PNG

                      thwack.PNG

                      Here is the result from the email.

                      thwack4.PNG

                      I also cant find PortID in UDT_MovedMACAlert

                      thwack3.PNG

                        • Re: Interface name in UDT Alerts
                          Craig Norborg

                          Ah, so you did a custom query for your alert condition?  I didn't...  I just used the built in...   In the trigger condition I have:

                           

                          newmac.jpg

                           

                          and my email looks like

                           

                          newmac2.jpg

                          This works for me!

                            • Re: Interface name in UDT Alerts
                              alangidlewski

                              Thanks! It is working now!!! Great

                              • Re: Interface name in UDT Alerts
                                bladren

                                Can you tell me which variables you inserted to get those?  i am not seeing them.  I tried copying the syntax from your screen shot but got an error like this

                                 

                                Port : MACRO SQL
                                ERROR - Incorrect syntax near '{'.

                                Device : MACRO SQL ERROR - Incorrect syntax near '{'.

                                 

                                My SYNTAX after copying...

                                 

                                An issue on an object you are monitoring occurred at ${N=Alerting;M=AlertTriggerTime;F=DateTime}.

                                View full object details here: ${N=SwisEntity;M=DetailsUrl}.
                                View full alert details here: ${N=Alerting;M=AlertDetailsUrl}
                                Click here to acknowledge the alert: ${N=Alerting;M=AcknowledgeUrl}

                                Port : ${SQL: SELECT Name from [dbo].[UDT_Port] WHERE  (PortID = ${=SwisEntity;M=PortID}]}
                                Device : ${SQL: SELECT Caption FROM Nodes WHERE NodeID = ${N=SwisEntity;M=DeviceID}}

                                  • Re: Interface name in UDT Alerts
                                    alangidlewski

                                    Hi,

                                     

                                    for New MAC I'm using this

                                    _____________

                                    Anzeige der vollständigen Warnungsdetails: ${N=Alerting;M=AlertDetailsUrl}

                                     

                                    New MAC Address: ${N=SwisEntity;M=MACAddress}

                                    Port: ${SQL: SELECT Name from [dbo].[UDT_Port] WHERE  (PortID = ${N=SwisEntity;M=PortID})}

                                    Port Name: ${SQL: SELECT PortDescription from [dbo].[UDT_Port] WHERE  (PortID = ${N=SwisEntity;M=PortID})}

                                     

                                    IP: ${SQL: SELECT IP_Address FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    Device: ${SQL: SELECT Caption FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    Device Location: ${SQL: SELECT Location FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    Device Last Boot: ${SQL: SELECT LastBoot FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    Device CPU Load: ${SQL: SELECT CPULoad FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    Device Description: ${SQL: SELECT Description FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                    _____________

                                    And here ist the result:

                                    udt.png

                                     

                                    And for Rogue MAC this:

                                    _____________

                                    Anzeige der vollständigen Warnungsdetails: ${N=Alerting;M=AlertDetailsUrl}

                                     

                                    Rouge MAC-Address: ${N=SwisEntity;M=MACAddress}

                                    Port: ${SQL: SELECT Name from [dbo].[UDT_Port] WHERE  (PortID = ${SQL: SELECT PortID from [dbo].[UDT_PortToEndpointCurrent] WHERE  (EndpointID = ${N=SwisEntity;M=EndpointID})})}

                                    Port Name: ${SQL: SELECT PortDescription from [dbo].[UDT_Port] WHERE  (PortID = ${SQL: SELECT PortID from [dbo].[UDT_PortToEndpointCurrent] WHERE  (EndpointID = ${N=SwisEntity;M=EndpointID})})}

                                     

                                    Node ID: ${SQL: SELECT NodeID from [dbo].[UDT_Port] WHERE  (PortID = ${SQL: SELECT PortID from [dbo].[UDT_PortToEndpointCurrent] WHERE  (EndpointID = ${N=SwisEntity;M=EndpointID})})}

                                    _____________

                                    udt2.png

                                    the 'moving mac-address' is still not working... Hope for SolarWinds....

                                    1 of 1 people found this helpful
                                      • Re: Interface name in UDT Alerts
                                        bladren

                                        Thanks Alan,   What is the difference between using the "New MAC"? and the "Rogue MAC"?

                                        • Re: Interface name in UDT Alerts
                                          bladren

                                          Ok why can i not use this syntax for my rogue devices then?  I am not even seeing a DBO.NODES in my database.  I have a DB.UDT_Port table but not the nodes table.  What is up with this?

                                           

                                          IP: ${SQL: SELECT IP_Address FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                          Device: ${SQL: SELECT Caption FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                          Device Location: ${SQL: SELECT Location FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                          Device Last Boot: ${SQL: SELECT LastBoot FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                          Device CPU Load: ${SQL: SELECT CPULoad FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                          Device Description: ${SQL: SELECT Description FROM [dbo].[Nodes] WHERE (NodeID = ${N=SwisEntity;M=DeviceID})}

                                  • Re: Interface name in UDT Alerts
                                    agriffis

                                    This worked for me. But is there a way to limit the alerts from uplink ports? I'm just interested in those found on the edge ports or on the APs.

                              • Re: Interface name in UDT Alerts
                                donrobert5

                                I found out that this SQL query works.

                                 

                                Rouge MAC-Address: ${N=SwisEntity;M=MACAddress}

                                 

                                Port: ${SQL: SELECT Name from [dbo].[UDT_Port] WHERE  PortID IN ( SELECT PortID from [dbo].[UDT_PortToEndpointCurrent] WHERE  (EndpointID = ${N=SwisEntity;M=EndpointID}))}

                                 

                                Port ID: ${SQL: Select PortID from [dbo].UDT_RogueMacAlert}

                                 

                                Node Name: ${SQL: SELECT Caption from [dbo].[Nodes] WHERE NodeID IN (SELECT NodeID from [dbo].[UDT_Port] WHERE PORTID IN (Select PortID from [dbo].UDT_RogueMacAlert))}

                                3 of 3 people found this helpful
                                • Re: Interface name in UDT Alerts
                                  Craig Norborg

                                  I recommend NOT monitoring uplink ports in UDT.   UDT relates ARP tables (ie: IP addresses to MAC addresses) to MAC tables (ie: MAC addresses to ports) to domain controller logs (ie: IP address to Users).   This is the fundamentals of UDT.

                                   

                                  If you only monitor end-user ports with UDT, then there is a one-to-one relationship between MAC addresses and ports.   ie: one port has a given MAC address.  (Unless there are duplicate MAC addresses of course, which is unusual depending on the size of your network). 

                                   

                                  If you monitor uplink ports, that increases the # of ports that a MAC address is seen on.   Lets say you have a classic network architecture.   Core L3 switch, distribution layer, distribution switches in each building and maybe a stack of switches.      If you monitor the uplinks, the MAC address for a given end-user will show up not only on their given port, but one or more of the stack switch uplinks, the building distribution switch(es), the distribution layer and maybe even your core.   Odds are you've flattened this architecture a bit depending on your network size, but its still quite a few more ports than needed for a given mac address.

                                   

                                  Your choice though, the program only gives you back the information you feed it.  Its your choice if you just feed it end-user port info, or uplink info too...