How to Restrict Port Down Alerts To Only Certain Switch Interfaces

I keep getting alerts every time a port is down but the thing is most of these ports are access ports to PCs that are being turned on and off. I want to restrict alerts to ten gigabit. Even better if it can be certain ten gigabit interfaces. Is that possible and how should I set up my alerting (particularly the entity input)?

Try rule mapping ->

The way I do it is with a custom description parser. Although if you don’t use the built in parsed descriptions (CORE, TRANSIT, etc), you could avoid the custom parser and get it done that way.

Either way, you then modify your rule to check the description type and only alert if it matches. So the logic looks something like this:

%macros.port_down = "1" && %ports.port_descr_type = "M"

Where ‘M’ is what my custom parser pulled out. If you use the builtins change it to CORE or w/e.

The downside is of course that you have to go back through your network and label anything you want to be alerted on, and then maintain the standard going forward.

1 Like

Interesting… about the custom parser. Before I read that I made two alerts…

%macros.port_down = “1” && %ports.ifDescr ~ “TenGigabitEthernet” &&


%ports.ifOperStatus = “down” && %ports.ifOperStatus_prev = “up” && %macros.device_up = “1” && %ports.ifName ~ “TenGigabit”

Our environment is more static when it comes to aggregation and core links. If something was previously up, it shouldn’t be down generally speaking if it is a TenGigabit port. Once I can test the second alert I thought about removing the macros.port_down one.

I may try the custom parser idea though…

One thing is that I would love to be able to use teh OR operator but my alerts only show “Add” which does an AND operator. Any thoughts.

Oh I hadn’t even noticed they removed that functionality. Looks like they found it was broken and so removed it. Suggested to use macros instead.