Using ifDescr in rule conditions

Help
1

I am having some problems with a rule I’ve created. The rule has the following conditions:

%ports.ifOutErrors_delta > “1” || %ports.ifInErrors_delta > “1” && %ports.ifDescr !~ “AirFiber” &&

What I’m trying to do here is report error counts that are actively incrementing, but exclude any devices with ‘AirFiber’ in their description. This doesn’t seem to work. I’ve tried using ‘%Airfiber%’ as the description string, but that seems to match everything (that is, no alerts are ever raised).

Any ideas on what I’m doing wrong here?

2

Yeah, the rules aren’t grouped so it is
%ports.ifOutErrors_delta > "1"
or
%ports.ifInErrors_delta > "1" && %ports.ifDescr !~ "AirFiber"

Perhaps putting %ports.ifDescr !~ "AirFiber" first will work better

3

Thanks,

I think (but I’m not sure) that the errors part of the rule is grouped.

Is it grouped? I can certainly re-arrange it if needed.

4

You’ll be better off creating this as a macro as || don’t currently work well.

5

Got it, I’ll check out macros. Thanks!

6

So I tested this using macros and got the same results. I also tried creating a rule with only the criteria:
%ports.ifDescr !~ "AirFiber"
Also tried a few different variations on that theme including %ports.ifDescr ~ “@AirFiber@”

Nothing would match. So, I changed the description on the interface itself to “(AirFiber)” used: %ports.port_descr_notes = “AirFiber”

That worked. I’m thinking I must be misunderstanding the %ports.ifDescr criteria. Am I using it wrong?

Using the notes parser is a good workaround for now, but would be great if I could figure out what went wrong here.

-shane

7

try using ports.ifAlias. I use this to check interface names on switches. Likely it’ll work.

8

Thanks Pucle, that did the trick. Thank you very much!