That's what we ended up doing and it seems to be just fine. It was also a kick for me to rebuild all my checks, they're so old none of them had the ruleset builder available.
From: Mike Stupalov mike@stupalov.ru On Behalf Of Mike Stupalov Sent: Monday, October 21, 2019 12:06 PM To: Observium observium@observium.org; Ryan, Spencer via observium observium@observium.org Cc: Ryan, Spencer spencer.ryan@netscout.com Subject: Re: [Observium] Alert checkers triggering on down/0 speed interfaces
This message originated outside of NETSCOUT. Do not click links or open attachments unless you recognize the sender and know the content is safe. As I see, quick fix is append this to check condition:
ifSpeed gt 0
Ryan, Spencer via observium wrote on 20/10/2019 18:48:
Since updating to 10134 we've seen some odd behavior out of our high interface utilization alerts.
The alert itself is very simple, device matches *, entity is ifType equals ethernetCsmacd, and the test conditions are any of:
ifInOctets_perc ge 80 ifOutOctets_perc ge 80
Which has worked fine forever.
Now it's throwing alarms on an odd mix of devices (UBNT, Palo Alto, Arista, Kemp VLM, Infoblox) for ports that are down/down loopbacks or HA interfaces not connected.
All of the ports it is alarming on show this in the data (Speed 0, and down/down):
ifSpeed=>0 ifHighSpeed=>0 ifOperStatus=>down ifAdminStatus=>down
Any idea what changed or why it's alarming on these now? I'm guessing its trying to do the 80% math on....0 but I'd imagine that shouldn't even run if the port is admin+operationally down.
This is a mgmt interface on an arista (which is unconnected and admin down):
As you can see the *_perc calcs are 0, it almost seems some kind of divide by 0 error.
Thanks in advance!
Spencer Ryan | Senior Systems Administrator | spencer.ryan@netscout.commailto:spencer.ryan@netscout.com Arbor Networks | The security division of NETSCOUT +1.734.794.5033 (d) | +1.734.846.2053 (m) www.arbornetworks.comhttp://www.arbornetworks.com/
_______________________________________________
observium mailing list
observium@observium.orgmailto:observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Mike Stupalov Observium Limited, http://observium.org