This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

False Routing Neighbor Down Alerts

bhilgenkamp_botw over 8 years ago

I have alerts set up to notify me if a routing neighbor goes down on any router or switch in our network. There are some devices that have BGP neighbors that are shut down for various reasons and occasionally SolarWinds sends alerts on them because they appear as Idle. Normally this would be fine, but they are Idle for years so I'm not sure why the alerts are re-triggering. The alert settings seem fine but for some reason SolarWinds is seeing status changes on the routing neighbors when in fact there isn't. Example:

SolarWinds:

SW Neighbors.png

Router:

Router Neighbors.png

Alert trigger:

None of the times match up between the router and SolarWinds. Is this normal behavior, and is there any way to fix it? This is happening on multiple routers so the alerts always require additional research to make sure it's just not a false alert.

Top Replies

0 ken_cohen over 7 years ago

If the BGP link has been shut down, I would remove that interface from monitoring. That should prevent NPM from alerting and free up a bit of resources as well.
Cancel
Vote Up +1 Vote Down

Cancel
0 cfizz34 over 6 years ago in reply to ken_cohen

Is it possible to have a view/webpage that shows this verses alerting on it?
Cancel
Vote Up 0 Vote Down

Cancel
0 taslimuddin over 6 years ago in reply to cfizz34

Hi
I am also facing same issue, we are getting false alert where BGP kept in shutdown. I am using NPM 12.1
Cancel
Vote Up 0 Vote Down

Cancel
0 maruti.hv over 5 years ago in reply to taslimuddin

same here, is there any way to get rid of these false alerts?
Hi Solarwind Team,
is there any fix for this?
Cancel
Vote Up 0 Vote Down

Cancel
0 RichardLetts over 5 years ago

Having run a NOC, one of the questions is 'why is this still configured if it is not being used'
but, no, there's no easy way to do this.
The alternative is to have nodes for each of the BGP peers, external nodes for the ones you don't want to actively monitor.
you would then use alerts on the nodes if the BGP peering with them is down (may require a custom SQL alert)
Cancel
Vote Up 0 Vote Down

Cancel
0 bhilgenkamp_botw over 5 years ago in reply to RichardLetts

I totally agree with the "why is this still configured part" but I guess my main question was why does SolarWinds seemingly at random fire off the alerts when the status hasn't changed on the down neighbor?
Cancel
Vote Up 0 Vote Down

Cancel
0 nglynn over 5 years ago

I'm having the exact same issues and it is causing my network engineers to doubt NPM. I'm on NPM v12.3 and have an active ticket with support, but so far I've not been able to escape level 1 to get better help. I too see the the state changes on interfaces that have been shutoff per my engineers. There is clearly something going on here. I don't think I saw this problem prior to upgrading from v12.1 to v12.3 a few months back.
Worth noting, When I look at the 'Last Change' timestamps in NPM they are changing and its every 30 days-ish almost on the money. Which is where I'm at odds with my network folks as they claim it's shutdown and shouldn't be flapping at all. It should consistently be in idle.
Cancel
Vote Up 0 Vote Down

Cancel
0 bhilgenkamp_botw over 5 years ago in reply to nglynn

Heh yeah it doesn't exactly instill confidence when it does this. For what it's worth this has been happening to me since well before 12.x
Cancel
Vote Up 0 Vote Down

Cancel
0 rschroeder over 5 years ago

I alert on link status and Neighbor status changes in EIGRP and BGP. Seems to work well.
Cancel
Vote Up 0 Vote Down

Cancel
0 bhilgenkamp_botw over 5 years ago in reply to rschroeder

From what I can tell the only options for routing status are up and down so I'd think you would see the issue as well if you were affected. I don't have any criteria set to specify BGP or EIGRP but the only false alerts we get are for BGP so restricting the alert to those protocols shouldn't change the behavior we're seeing.
Cancel
Vote Up 0 Vote Down

Cancel