I keep getting alerts every time a port is down but the thing is most of these ports are access ports to PCs that are being turned on and off. I want to restrict alerts to ten gigabit. Even better if it can be certain ten gigabit interfaces. Is that possible and how should I set up my alerting (particularly the entity input)?
The way I do it is with a custom description parser. Although if you donât use the built in parsed descriptions (CORE, TRANSIT, etc), you could avoid the custom parser and get it done that way.
Either way, you then modify your rule to check the description type and only alert if it matches. So the logic looks something like this:
%macros.port_down = "1" && %ports.port_descr_type = "M"
Where âMâ is what my custom parser pulled out. If you use the builtins change it to CORE or w/e.
The downside is of course that you have to go back through your network and label anything you want to be alerted on, and then maintain the standard going forward.
Interesting⌠about the custom parser. Before I read that I made two alertsâŚ
%macros.port_down = â1â && %ports.ifDescr ~ âTenGigabitEthernetâ &&
also
%ports.ifOperStatus = âdownâ && %ports.ifOperStatus_prev = âupâ && %macros.device_up = â1â && %ports.ifName ~ âTenGigabitâ
Our environment is more static when it comes to aggregation and core links. If something was previously up, it shouldnât be down generally speaking if it is a TenGigabit port. Once I can test the second alert I thought about removing the macros.port_down one.
I may try the custom parser idea thoughâŚ
One thing is that I would love to be able to use teh OR operator but my alerts only show âAddâ which does an AND operator. Any thoughts.
Oh I hadnât even noticed they removed that functionality. Looks like they found it was broken and so removed it. Suggested to use macros instead.