Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam. On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively,
Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
I've had a think about this.. As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Once a neighbour disappears, it disappears, there's nothing to alert on anymore.
adam. On 20/02/2015 01:21:35, Ben Hohnke settra+observium@gmail.com wrote: I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong <adama@memetic.org [mailto:adama@memetic.org]> wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam. On 20/02/2015 01:02:53, Ben Hohnke <settra+observium@gmail.com [mailto:settra%2Bobservium@gmail.com]> wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively,
Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
That's why I knew it would be difficult.
I was thinking if you could define a list, you could alert if entries were missing from that list. I haven't been able to think of any other way to do it.
It's looking like I'll have to do some syslog parsing as suggested by Colin.
Thanks,
Ben
On Fri, Feb 20, 2015 at 6:33 AM, Adam Armstrong adama@memetic.org wrote:
Once a neighbour disappears, it disappears, there's nothing to alert on anymore.
adam.
On 20/02/2015 01:21:35, Ben Hohnke settra+observium@gmail.com wrote: I've had a think about this.. As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
_______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Yes, I think this is something perhaps better solved by us improving our syslog support, and then doing regexp matches.
Since OSPF sessions aren't stateful and are kinda transient, it's difficult to build rules and have static alert entries for.
adam. On 20/02/2015 01:39:50, Ben Hohnke settra+observium@gmail.com wrote: That's why I knew it would be difficult.
I was thinking if you could define a list, you could alert if entries were missing from that list. I haven't been able to think of any other way to do it.
It's looking like I'll have to do some syslog parsing as suggested by Colin.
Thanks,
Ben
On Fri, Feb 20, 2015 at 6:33 AM, Adam Armstrong <adama@memetic.org [mailto:adama@memetic.org]> wrote:
Once a neighbour disappears, it disappears, there's nothing to alert on anymore.
adam. On 20/02/2015 01:21:35, Ben Hohnke <settra+observium@gmail.com [mailto:settra%2Bobservium@gmail.com]> wrote: I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong <adama@memetic.org [mailto:adama@memetic.org]> wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam. On 20/02/2015 01:02:53, Ben Hohnke <settra+observium@gmail.com [mailto:settra%2Bobservium@gmail.com]> wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively,
Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org [mailto:observium@observium.org] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [http://postman.memetic.org/cgi-bin/mailman/listinfo/observium]
_______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this.. As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
For any Metro/carrier circuit, you will not lose link if the circuit goes down. I can't think of anything else to monitor, other than bps across the link to catch this.
Ben
On Fri, Feb 20, 2015 at 12:24 PM, Eduardo Schoedler listas@esds.com.br wrote:
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
You need to monitor physical interface, on the switch.
2015-02-19 23:28 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
For any Metro/carrier circuit, you will not lose link if the circuit goes down. I can't think of anything else to monitor, other than bps across the link to catch this.
Ben
On Fri, Feb 20, 2015 at 12:24 PM, Eduardo Schoedler listas@esds.com.br wrote:
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
If a carrier circuit goes down, and hands off on an NTU, no interface goes down if the carrier circuit drops.
Ben
On Fri, Feb 20, 2015 at 12:30 PM, Eduardo Schoedler listas@esds.com.br wrote:
You need to monitor physical interface, on the switch.
2015-02-19 23:28 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
For any Metro/carrier circuit, you will not lose link if the circuit goes
down. I can't think of anything else to monitor, other than bps across the link to catch this.
Ben
On Fri, Feb 20, 2015 at 12:24 PM, Eduardo Schoedler listas@esds.com.br wrote:
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
I'd be kicking the carrier to ensure they're using equipment that can adjust link state to your CPE based on at the very least link state on the other side. Most decent media converters/NTU's have features like that to pass link state from one side to the other.
Regardless of whether they do or don't,you should really consider using Bi-Directional Forwarding and/or Uni-Directional Link Detection if they're available.
BFD should be available with all routing protocols these days on halfway decent routing implementations. Even Mikrotik supports it for BGP and OSPF.
Hit google if you're not aware of what they are and how they work.
-Colin
On 20 February 2015 at 11:32, Ben Hohnke settra+observium@gmail.com wrote:
If a carrier circuit goes down, and hands off on an NTU, no interface goes down if the carrier circuit drops.
Ben
On Fri, Feb 20, 2015 at 12:30 PM, Eduardo Schoedler listas@esds.com.br wrote:
You need to monitor physical interface, on the switch.
2015-02-19 23:28 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
For any Metro/carrier circuit, you will not lose link if the circuit goes
down. I can't think of anything else to monitor, other than bps across the link to catch this.
Ben
On Fri, Feb 20, 2015 at 12:24 PM, Eduardo Schoedler listas@esds.com.br wrote:
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
How would one go about alerting for these?
The problem we have with most of the things we don't currently alert on is simply that it's not obvious *how* we should alert on them.
adam.
On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com wrote: Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Yeah, I'm running BFD with super low timers, however it would be nice to be alerted of a topology change. Our topology is fully redundant, so topology changes aren't always immediately realised, or have a negative affect.
Ben
On Fri, Feb 20, 2015 at 12:52 PM, Colin Stubbs < colin.stubbs@equatetechnologies.com.au> wrote:
I'd be kicking the carrier to ensure they're using equipment that can adjust link state to your CPE based on at the very least link state on the other side. Most decent media converters/NTU's have features like that to pass link state from one side to the other.
Regardless of whether they do or don't,you should really consider using Bi-Directional Forwarding and/or Uni-Directional Link Detection if they're available.
BFD should be available with all routing protocols these days on halfway decent routing implementations. Even Mikrotik supports it for BGP and OSPF.
Hit google if you're not aware of what they are and how they work.
-Colin
On 20 February 2015 at 11:32, Ben Hohnke settra+observium@gmail.com wrote:
If a carrier circuit goes down, and hands off on an NTU, no interface goes down if the carrier circuit drops.
Ben
On Fri, Feb 20, 2015 at 12:30 PM, Eduardo Schoedler listas@esds.com.br wrote:
You need to monitor physical interface, on the switch.
2015-02-19 23:28 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
For any Metro/carrier circuit, you will not lose link if the circuit
goes down. I can't think of anything else to monitor, other than bps across the link to catch this.
Ben
On Fri, Feb 20, 2015 at 12:24 PM, Eduardo Schoedler <listas@esds.com.br
wrote:
OSPF/ISIS are link-state. Why don't you monitor only the interface that is running it?
2015-02-19 23:21 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
I've had a think about this..
As it's not BGP, you can't alert on peer state, but if you define a neighbour's via entity match, such as "router-id match 10.10.*", you could do a "exists eq true" for the test, or "status eq full"
ISIS would be pretty much the same as OSPF
Thoughts?
On Fri, Feb 20, 2015 at 6:13 AM, Adam Armstrong adama@memetic.org wrote:
> How would one go about alerting for these? > > The problem we have with most of the things we don't currently alert > on is simply that it's not obvious *how* we should alert on them. > > adam. > > On 20/02/2015 01:02:53, Ben Hohnke settra+observium@gmail.com > wrote: > Are there any plans to add an alert checker for OSPF/IGP Neighbor > state changes? The BGP alerts checkers are great, however I'm looking for a > similar thing for IGP. > > Alternatively, > Does anyone know of a solution for alerting IGP neighbour state > changes? I have 100-200 routers I would need to monitor. > > Thanks in advance, > > Ben > _______________________________________________ observium mailing > list observium@observium.org > http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > > > _______________________________________________ > observium mailing list > observium@observium.org > http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Maybe something for ISIS too?
-- Eduardo Schoedler
2015-02-19 23:02 GMT-02:00 Ben Hohnke settra+observium@gmail.com:
Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben
Syslog. Splunk or ELK based processing and alert generation from that.
router ospf %{ID}% log-adjacency-changes detail ! logging %{DESTINATION}%
etc
-Colin
On 20 February 2015 at 11:02, Ben Hohnke settra+observium@gmail.com wrote:
Are there any plans to add an alert checker for OSPF/IGP Neighbor state changes? The BGP alerts checkers are great, however I'm looking for a similar thing for IGP.
Alternatively, Does anyone know of a solution for alerting IGP neighbour state changes? I have 100-200 routers I would need to monitor.
Thanks in advance,
Ben
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (4)
-
Adam Armstrong -
Ben Hohnke -
Colin Stubbs -
Eduardo Schoedler