Interface Errors Alerting

[jsdurling]

In testing, I’ve found that the general interface alert for interface errors pretty much alerts for any interface that has taken errors, ever.

I’ve attempted to modify the alert rules to take into account a change between:
ifInErrors:
ifInErrors_prev:

Meaning, alert me if ifInErrors is greater than ifInErrors_prev but I can’t seem to figure out how to do that using the alert building tool.

Has anyone done this, or have an example to alert on actively incrementing interface errors, vs. just alerting on an interface that took errors at some point in history?

Thanks,
J

[Chas]

Not tried it, but this could work?

enclose with this ` so `ports.ifInErrors_prev` otherwise will become literal.

Should look like this on the alert page:

[jsdurling]

I tested this, and though I think it makes sense, it doesn’t seem to work, which I’m not real sure why. I didn’t spend a lot of time testing, so I will circle back and verify what is/was happening and reply.

-J

[murrant]

How about ifInErrors_delta or ifInErrors_rate?