Hello all, I was wondering if anyone could provide some help with a few alert checkers. I've tried a number of different values for these rules with no luck, hoping someone out there could give me a hand. In return I've shared a few working checkers at the bottom :).
The ones I'm having issues with are below. The first two alert on session utilization for Juniper/Palo Alto firewalls, the last is meant to watch an Aruba controller and alert if a registered AP goes up or down. [cid:image002.png@01D05326.8709E660]
[cid:image004.png@01D05327.A5241660] [cid:image003.png@01D05327.55396880]
Here are a few goodies for you guys (keep in mind, a number of these are vague and include all devices - you'll probably want to make the match more specific): [cid:image005.png@01D05328.066A9570] [cid:image006.png@01D05328.066A9570] [cid:image007.png@01D05329.04914C20]
Thanks, David Roush
None of those 3 things are sensors :)
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 28 February 2015 08:35:17 David Roush DRoush@denovo-us.com wrote:
Hello all, I was wondering if anyone could provide some help with a few alert checkers. I've tried a number of different values for these rules with no luck, hoping someone out there could give me a hand. In return I've shared a few working checkers at the bottom :).
The ones I'm having issues with are below. The first two alert on session utilization for Juniper/Palo Alto firewalls, the last is meant to watch an Aruba controller and alert if a registered AP goes up or down. [cid:image002.png@01D05326.8709E660]
[cid:image004.png@01D05327.A5241660] [cid:image003.png@01D05327.55396880]
Here are a few goodies for you guys (keep in mind, a number of these are vague and include all devices - you'll probably want to make the match more specific): [cid:image005.png@01D05328.066A9570] [cid:image006.png@01D05328.066A9570] [cid:image007.png@01D05329.04914C20]
Thanks, David Roush
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
On 2/28/2015 8:23 AM, Adam Armstrong wrote:
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
I would think something along the lines of Graphite's queries for moving averages over a timespan would be a good start. Which of course begs the question -- does it make any sense to use Graphite as the backend instead of RRD? Huge change, granted, but it is much more scalable among other nice attributes. More machinery, though. Without actually using Graphite, would it be even reasonable to add a checker type linked to a RRD query? I am guessing it would be too much load past a handful of checks.
Regards, Mark
I looked at using Graphite/Ceres a couple of years ago, but I couldn't get graphs out of it with good enough layout so I gave up.
It would be a colossal amount of work, and at this point, I don't think it would bring benefits greater than other things we would spend our time on.
adam. On 02/03/2015 02:52:28, Mark D. Nagel mnagel@willingminds.com wrote: On 2/28/2015 8:23 AM, Adam Armstrong wrote:
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
I would think something along the lines of Graphite's queries for moving averages over a timespan would be a good start. Which of course begs the question -- does it make any sense to use Graphite as the backend instead of RRD? Huge change, granted, but it is much more scalable among other nice attributes. More machinery, though. Without actually using Graphite, would it be even reasonable to add a checker type linked to a RRD query? I am guessing it would be too much load past a handful of checks.
Regards, Mark
Oh, and it's utterly irrelevant to any question about alerting.
adam. On 02/03/2015 02:57:39, Adam Armstrong adama@memetic.org wrote: I looked at using Graphite/Ceres a couple of years ago, but I couldn't get graphs out of it with good enough layout so I gave up.
It would be a colossal amount of work, and at this point, I don't think it would bring benefits greater than other things we would spend our time on.
adam. On 02/03/2015 02:52:28, Mark D. Nagel mnagel@willingminds.com wrote: On 2/28/2015 8:23 AM, Adam Armstrong wrote:
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
I would think something along the lines of Graphite's queries for moving averages over a timespan would be a good start. Which of course begs the question -- does it make any sense to use Graphite as the backend instead of RRD? Huge change, granted, but it is much more scalable among other nice attributes. More machinery, though. Without actually using Graphite, would it be even reasonable to add a checker type linked to a RRD query? I am guessing it would be too much load past a handful of checks.
Regards, Mark
OK, I suppose, but I was thinking the issue was "how do you alert on a point in time graph reading?" and my take was "don't, alert on a recent trend reading". But I definitely appreciate that a change in graphing backend would be monumental!
Thanks, Mark
On 3/1/2015 12:57 PM, Adam Armstrong wrote:
Oh, and it's utterly irrelevant to any question about alerting.
adam.
On 02/03/2015 02:57:39, Adam Armstrong adama@memetic.org wrote:
I looked at using Graphite/Ceres a couple of years ago, but I couldn't get graphs out of it with good enough layout so I gave up.
It would be a colossal amount of work, and at this point, I don't think it would bring benefits greater than other things we would spend our time on.
adam.
On 02/03/2015 02:52:28, Mark D. Nagel mnagel@willingminds.com wrote:
On 2/28/2015 8:23 AM, Adam Armstrong wrote:
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
I would think something along the lines of Graphite's queries for moving averages over a timespan would be a good start. Which of course begs the question -- does it make any sense to use Graphite as the backend instead of RRD? Huge change, granted, but it is much more scalable among other nice attributes. More machinery, though. Without actually using Graphite, would it be even reasonable to add a checker type linked to a RRD query? I am guessing it would be too much load past a handful of checks.
Regards, Mark
This message has been scanned by CanIt-PRO.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
The problem with alerting on the multitude of poller modules which live under the "graphs" section is that they all have nothing in common, so its difficult to fit them in to how we alert on everything else.
I think we were planning to have the concept of subtypes, which would mean a sub-type per graph type.
Now sure how well that would work, and the uncertainty is why its not done yet.
We got burned pretty bad with our first attempts at alerting and we learned that doing it in a dumb way is a costly mistake.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 1 March 2015 21:38:43 "Mark D. Nagel" mnagel@willingminds.com wrote:
OK, I suppose, but I was thinking the issue was "how do you alert on a point in time graph reading?" and my take was "don't, alert on a recent trend reading". But I definitely appreciate that a change in graphing backend would be monumental!
Thanks, Mark
On 3/1/2015 12:57 PM, Adam Armstrong wrote:
Oh, and it's utterly irrelevant to any question about alerting.
adam.
On 02/03/2015 02:57:39, Adam Armstrong adama@memetic.org wrote:
I looked at using Graphite/Ceres a couple of years ago, but I couldn't get graphs out of it with good enough layout so I gave up.
It would be a colossal amount of work, and at this point, I don't think it would bring benefits greater than other things we would spend our time on.
adam.
On 02/03/2015 02:52:28, Mark D. Nagel mnagel@willingminds.com wrote:
On 2/28/2015 8:23 AM, Adam Armstrong wrote:
We don't have the ability to alert on metrics polled as 'graphs' yet. I'm still trying to work out how best to do it.
I would think something along the lines of Graphite's queries for moving averages over a timespan would be a good start. Which of course begs the question -- does it make any sense to use Graphite as the backend instead of RRD? Huge change, granted, but it is much more scalable among other nice attributes. More machinery, though. Without actually using Graphite, would it be even reasonable to add a checker type linked to a RRD query? I am guessing it would be too much load past a handful of checks.
Regards, Mark
This message has been scanned by CanIt-PRO.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Mark D. Nagel, CCIE #3177 Emeritus mnagel@willingminds.com Principal Consultant, Willing Minds LLC (http://www.willingminds.com) cell: 949-279-5817, desk: 714-495-4001, fax: 714-646-8277
** For faster support response time, please ** email support@willingminds.com or call 714-495-4000
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (3)
-
Adam Armstrong -
David Roush -
Mark D. Nagel