Rule name: Devices up/down
Alert rule: macros.device_down = 1
Alert query: SELECT * FROM devices WHERE (devices.device_id = ?) && (((devices.status = 0 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1” )
Rule match: no match
Rule name: Device rebooted
Alert rule: macros.device = 1 AND devices.uptime < 900
Alert query: SELECT * FROM devices WHERE (devices.device_id = ?) && (((devices.disabled = 0 && devices.ignore = 0)) = “1” && devices.uptime < "“900"” )
Rule match: no match
Rule name: BGP Session down
Alert rule: bgpPeers.bgpPeerState != “established” AND macros.device_up = 1
Alert query: SELECT * FROM bgpPeers,devices WHERE (( devices.device_id = bgpPeers.device_id ) && bgpPeers.device_id = ?) && (bgpPeers.bgpPeerState != “established” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1”)
Rule match: no match
Rule name: BGP Session established
Alert rule: bgpPeers.bgpPeerFsmEstablishedTime < 300 AND bgpPeers.bgpPeerState = “established” AND macros.device_up = 1
Alert query: SELECT * FROM bgpPeers,devices WHERE (( devices.device_id = bgpPeers.device_id ) && bgpPeers.device_id = ?) && (bgpPeers.bgpPeerFsmEstablishedTime < “300” && bgpPeers.bgpPeerState = “established” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1”)
Rule match: no match
Rule name: Port utilisation over threshold
Alert rule: macros.port_usage_perc >= 80 AND macros.port_up = 1 AND macros.port = 1
Alert query: SELECT * FROM devices,ports WHERE (devices.device_id = ? AND devices.device_id = ports.device_id) AND ((ports.ifInOctets_rate*8) / ports.ifSpeed)*100 && (ports.deleted = 0 && ports.ignore = 0 && ports.disabled = 0) >= 80 AND (ports.ifOperStatus = “up” && ports.ifAdminStatus = “up” && (ports.deleted = 0 && ports.ignore = 0 && ports.disabled = 0)) = 1 AND (ports.deleted = 0 && ports.ignore = 0 && ports.disabled = 0) = 1
Rule match: no match
Rule name: Sensor over limit
Alert rule: sensors.sensor_current > sensors.sensor_limit AND sensors.sensor_alert = 1 AND macros.device_up = 1
Alert query: SELECT * FROM sensors,devices WHERE (( devices.device_id = sensors.device_id ) && sensors.device_id = ?) && (sensors.sensor_current > sensors.sensor_limit && sensors.sensor_alert = “1” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1” )
Rule match: no match
Rule name: Sensor under limit
Alert rule: sensors.sensor_current < sensors.sensor_limit_low AND sensors.sensor_alert = 1 AND macros.device_up = 1
Alert query: SELECT * FROM sensors,devices WHERE (( devices.device_id = sensors.device_id ) && sensors.device_id = ?) && (sensors.sensor_current < sensors.sensor_limit_low && sensors.sensor_alert = “1” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1” )
Rule match: no match
Rule name: Service up/down
Alert rule: services.service_status != 0 AND macros.device_up = 1
Alert query: SELECT * FROM services,devices WHERE (( devices.device_id = services.device_id ) && services.device_id = ?) && (services.service_status != “0” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1”)
Rule match: no match
Rule name: Wireless Sensor over limit
Alert rule: wireless_sensors.sensor_current >= wireless_sensors.sensor_limit AND wireless_sensors.sensor_alert = 1 AND macros.device_up = 1
Alert query: SELECT * FROM wireless_sensors,devices WHERE (( devices.device_id = wireless_sensors.device_id ) && wireless_sensors.device_id = ?) && (wireless_sensors.sensor_current >= wireless_sensors.sensor_limit && wireless_sensors.sensor_alert = “1” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1”)
Rule match: no match
Rule name: Wireless Sensor under limit
Alert rule: wireless_sensors.sensor_current <= wireless_sensors.sensor_limit_low AND wireless_sensors.sensor_alert = 1 AND macros.device_up = 1
Alert query: SELECT * FROM wireless_sensors,devices WHERE (( devices.device_id = wireless_sensors.device_id ) && wireless_sensors.device_id = ?) && (wireless_sensors.sensor_current <= wireless_sensors.sensor_limit_low && wireless_sensors.sensor_alert = “1” && ((devices.status = 1 && ((devices.disabled = 0 && devices.ignore = 0)))) = “1”)
Rule match: no match
Rule name: Port status change
Alert rule: ports.ifOperStatus = “down” AND ports.ifOperStatus_prev = “up” AND ports.ifAdminStatus = “up” AND ports.deleted = 0 AND ports.ignore = 0 AND ports.disabled = 0
Alert query: SELECT * FROM ports WHERE (ports.device_id = ?) && (ports.ifOperStatus = “down” && ports.ifOperStatus_prev = “up” && ports.ifAdminStatus = “up” && ports.deleted = 0 && ports.ignore = 0 && ports.disabled = 0 )
Rule match: no match
Found 1 transports to send alerts to.
Transport: mail
Maybe the problem is in …
committed 09:39PM - 05 Apr 18 UTC
* fix: Updated ports macros to use %macros.port
* small updates
“port_usage_perc”: “((%ports.ifInOctets_rate*8) / %ports.ifSpeed)*100”
“port_usage_perc”: “((%ports.ifInOctets_rate*8) /
%ports.ifSpeed)*100 && %macros.port”,