What I’m trying to do here is report error counts that are actively incrementing, but exclude any devices with ‘AirFiber’ in their description. This doesn’t seem to work. I’ve tried using ‘%Airfiber%’ as the description string, but that seems to match everything (that is, no alerts are ever raised).
So I tested this using macros and got the same results. I also tried creating a rule with only the criteria:
%ports.ifDescr !~ "AirFiber"
Also tried a few different variations on that theme including %ports.ifDescr ~ “@AirFiber@”
Nothing would match. So, I changed the description on the interface itself to “(AirFiber)” used: %ports.port_descr_notes = “AirFiber”
That worked. I’m thinking I must be misunderstanding the %ports.ifDescr criteria. Am I using it wrong?
Using the notes parser is a good workaround for now, but would be great if I could figure out what went wrong here.