Snmp Trap Alert not properly giving Recovery Alert

Help
1

I have set up a rule in LibreNMS to look at the snmp trap event logs to push an alert to a slack channel for us to view. The rule I set is as follows

SELECT * FROM devices,eventlog,ports WHERE (devices.device_id = ? AND devices.device_id = eventlog.device_id AND devices.device_id = ports.device_id) AND ((eventlog.type = “trap” AND eventlog.message LIKE ‘%linkDown%’ AND eventlog.datetime >= “%macros.past_5m”) OR ((ports.ifOperStatus != ports.ifOperStatus_prev && ports.ifOperStatus_prev = “up” && ports.ifAdminStatus = “up” && (ports.deleted = 0 && ports.ignore = 0 && ports.disabled = 0)) = 1))

I also have recovery alerts turned on.

I get alerts sent correctly when the ports go down. When I turn them back on It doesn’t send a recovery alert. Also it does this weird thing saying in the link down alert “Got Worse” if it is a port the rule has previously sent an alert on. If you toggle the rule off and back on it will just alert normal till it surpasses the max alert limit then start saying “got worse” again.

2

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.