Trying to setup an alert for when bandwidth is above a certain amount

When trying to set up an alert to go off when the port on our firewall is above 10% it doesn’t go off when the bandwidth is clearly above that amount. We have the rules macros.port_up = 1 AND macros.port = 1 AND macros.port_in_usage_perc >= 10 AND ports.port_id = 154 . In action and still nothing is going off… please help.

Please check here:

I don’t think macros.port_up and macros.port don’t need conditions. Also, you could try just the port usage percentage test with the port ID to eliminate any other variables being incorrect.

So this should work ?

macros.port_in_usage_perc >= 5 AND ports.port_id = 154

Your original rule looked correct to me.

Keep in mind this relies on ifSpeed to figure out percent so if your device doesn’t supply that properly or it doesn’t match what you expect, you will have to set it in the device settings.

((ports.ifInOctets_rate*8) / ports.ifSpeed)*100

Still not going off… not sure why

What is ifSpeed and ifInOctets_rate for the port?

The macro is broke.

The ifSpeed is 1 Gig not sure on the other one