Recovery from eventlog alert rule (SNMP trap)

Help
1

Hi,
finally I set up SNMP linkUp and linkDown traps. They appear in eventlog. The both kinds:
1)“SNMP Trap: linkDown” and “Interface went Down”
and
2) SNMP Trap: linkUp up/up and Interface went Up

I have an alert rule with condition:
%eventlog.message ~ “Interface went Down”

obraz
obraz603×699 16.3 KB

For now it works well: an alert comes active and transport sends messages.

But I have no idea how to set a recovery rule. It looks like an alert wants to stay with me forever.
Acknowledgment of the alert doesn’t help.
Maybe I should have used macros or different type of condition?
Could you help me and give some ideas?

Thanks for reading :slight_smile:

1 Like
2

try using macros past 5 min

3

Dear @Kevin_Krumm
Thank you for your hint with macros. I’ve done some tests with macros and this one works perfectly so far:
%eventlog.message ~ “Interface went Down” && %macros.port_now_down = "1"
Recovery has come as it should :slight_smile:

1 Like
4

Perfect glad to hear that it worked :slight_smile: