Need assistance for Trap Alerts

Epinsky · 24 January 2020 16:08

Good morning community. I am new here. We started to use librenms recently. And I have probably a simple question. I am configuring alerts for incoming from eventlog traps from juniper/cisco routers and switches follow this configuration
(eventlog.type = “interface” AND eventlog.message LIKE ‘%(TRAP)%’)

The Template Alert is configured in such way.

{{ $alert->title }}
Severity: {{ $alert->severity }}
@if ($alert->state == 0) Time elapsed: {{ $alert->elapsed }}
@endif Timestamp: {{ $alert->timestamp }}
Unique-ID: {{ $alert->uid }}
Rule: @if ($alert->name) {{ $alert->name }} @else {{ $alert->rule }} @endif
@if ($alert->faults) Faults:
@foreach ($alert->faults as $key => $value) Faults :

     Trap Messsage :  {{ $value['message'] }}
     EventID:     {{ $value['eventiD'] }}
     Datetime:   {{ $value['datetime'] }}    
                               
  @endforeach

@endif
It works perfect, unfortunately I am getting trap messages for more than 10 days on every alert message ,Is there a way to filter the most recent traps according to the day/time instead of getting all traps of the week?
Appreciate for your help.

Kevin_Krumm · 24 January 2020 20:34

use macros.past_5m

Epinsky · 24 January 2020 20:49

Thank you Kevin, I will try and update you.

Epinsky · 27 January 2020 19:39

Good afternoon Kevin, I tried to add
eventlog.type = “interface” AND eventlog.message LIKE ‘%(TRAP)%’ AND syslog.timestamp >= “%macros.past_5m”)

still no luck.
However I didn’t see %macros.past_5m in the config.php. Should I add something to implement this ?

Kevin_Krumm · 27 January 2020 20:02

Can you post a screen shot of the alert rule

Epinsky · 28 January 2020 00:59

sure :

Kevin_Krumm · 28 January 2020 01:34

You have syntax error with the macro it should be

macros.past_5m

ionline · 28 January 2020 09:26

Try putting the Macros first with these back brackets ``

Epinsky · 28 January 2020 18:45

Thank you ionline,
I tried this as well but still no luck …
does eventlog.datetime and syslog.timestamp will do the same thing ?

Kevin_Krumm · 28 January 2020 19:43

greater than or equal

Epinsky · 29 January 2020 03:19

Thank you a lot. Kevin and Ionline …

this config is working for me