I’ll second that. 1100 alerts this morning
😊
From: observium <observium-bounces@observium.org>
On Behalf Of Adam Armstrong via observium
Sent: Monday, 21 October 2019 05:48
To: Ryan, Spencer via observium <observium@observium.org>
Cc: Adam Armstrong <adama@memetic.org>
Subject: Re: [Observium] Alert checkers triggering on down/0 speed interfaces
ifHighSpeed => 0
This seems to be because ifspeed and ifhighspeed are both zero.
You might see why this is in the debugging output.
Adam.
Sent from
BlueMail
On 20 Oct 2019, at 16:49, "Ryan, Spencer via observium" <observium@observium.org> wrote:
Since updating to 10134 we’ve seen some odd behavior out of our high interface utilization alerts.
The alert itself is very simple, device matches *, entity is
ifType equals ethernetCsmacd,
and the test conditions are any of:
ifInOctets_perc ge 80
ifOutOctets_perc ge 80
Which has worked fine forever.
Now it’s throwing alarms on an odd mix of devices (UBNT, Palo Alto, Arista, Kemp VLM, Infoblox) for ports that are down/down loopbacks or HA interfaces not connected.
All of the ports it is alarming on show this in the data (Speed 0, and down/down):
ifSpeed=>0
ifHighSpeed=>0
ifOperStatus=>down
ifAdminStatus=>down
Any idea what changed or why it’s alarming on these now? I’m guessing its trying to do the 80% math on….0 but I’d imagine that shouldn’t even run if the port is admin+operationally down.
This is a mgmt interface on an arista (which is unconnected and admin down):
As you can see the *_perc calcs are 0, it almost seems some kind of divide by 0 error.
Thanks in advance!
Spencer Ryan | Senior Systems Administrator | spencer.ryan@netscout.com
Arbor Networks | The security division of NETSCOUT
+1.734.794.5033 (d) | +1.734.846.2053 (m)
observium mailing list
observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium