I am looking to create an alert checker to send an alert when an Ethernet interface on a Cisco IOS router goes down- for example when the router is still up and available in monitoring, but a physical link is down due to a local switch failure, carrier CPE down, peer (unamanaged) router down... We receive syslogs of course, but these can occasionally get lost in the flood and not noticed as actionable by NOC staff.
Is there an effective way to make a device match for Cisco routers, but not Cisco switches? The OS type both show up as "ios", and I haven't found something router-specific to successfully match on. I can do this individually by device name, but unfortunately our naming scheme isn't specific enough to match them all with *rt* or *wan or similar.
As you can see below, I set the device match to "os equals ios" which includes switches that have a ton of link-down-but-enabled ports on them!
Thank you, Andrew
[image: Inline image 2]
