Recovery from eventlog alert rule (SNMP trap)

finally I set up SNMP linkUp and linkDown traps. They appear in eventlog. The both kinds:
1)“SNMP Trap: linkDown” and “Interface went Down”
2) SNMP Trap: linkUp up/up and Interface went Up

I have an alert rule with condition:
%eventlog.message ~ “Interface went Down”

For now it works well: an alert comes active and transport sends messages.

But I have no idea how to set a recovery rule. It looks like an alert wants to stay with me forever.
Acknowledgment of the alert doesn’t help.
Maybe I should have used macros or different type of condition?
Could you help me and give some ideas?

Thanks for reading :slight_smile:

1 Like

try using macros past 5 min

Dear @Kevin_Krumm
Thank you for your hint with macros. I’ve done some tests with macros and this one works perfectly so far:
%eventlog.message ~ “Interface went Down” && %macros.port_now_down = "1"
Recovery has come as it should :slight_smile:

1 Like

Perfect glad to hear that it worked :slight_smile: