Port changed from up to down help

Help
1

I have an alert rule defined as follows:

%ports.ifOperStatus = “down” && %ports.ifOperStatus_prev = “up” && %macros.device_up = “1” && %ports.ignore = “0”

So, We turned down an interface on one of our devices and it alerts as down. That is fine as I no longer will be using this port. I want the alert to go away after a couple of days though. If I just ignore the port and then at some point in the future someone turns back up that port, then I will not get an alert going forward that port would be ignored in monitoring.

Is there any way to add something to the alert rule that says if a port has been down for more than X time, then it would no longer trigger the alert rule?

2

Can you not just add %macros.past_15m equals “1” to only run for 15 minutes?

3

laf a combination of macros.port_down, macros.past_60m and macros.device_up really cleans up the Port Down rule. Maybe it should be default?