Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 15:58:18 Michael Vieth MVieth@nexatech.com wrote:
When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
2015-04-15 12:22 GMT-03:00 Adam Armstrong adama@memetic.org:
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
Every bgp session has a max prefix-limit, I dont know if there is in the MIB.
-- Eduardo Schoedler
It isn't.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 16:30:24 Eduardo Schoedler listas@esds.com.br wrote:
2015-04-15 12:22 GMT-03:00 Adam Armstrong adama@memetic.org:
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
Every bgp session has a max prefix-limit, I dont know if there is in the MIB.
-- Eduardo Schoedler
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
+/- based on a percentage or fixed number change from the last polled number? Factored by the delay count?
I have no idea how others would do it. I wouldn’t care if one or two routes changed, but if Verizon de-aggredated a /22 into /24s I’d like to know. Again.
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 8:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
First let me start with I am not a developer and therefore do not know if this is helpful or not. We have tried this in the past with other solutions and what we came up with is to use the MiB For Cisco IOS, total number of routes can be monitored through SNMP OID 1.3.6.1.2.1.4.24.3.0. This returns a value that we can then measure a percent or value change and alert based on this number.
I do recognize that this is not a silver bullet answer and therefore if you have a mixed table this might not work, but if you are looking for full routes via BGP (~500k) and you want to know if you have lost a large number via a provider, this solution has helped.
Might not be worth 2 cents, but it is what I got.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/FZsS93gsrhojd7aaab2r9KVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPtxOrTFLLZvCn7DDXEZuVtdcs_MVxNZ4QsLsJt6OaqGdQul3PWApmU6CQjqpK_8K6zBV55BeXNKVI05EITFsjVsTkxjUCpdGBO5mUm-waGgFYjcCRu00CQn3hOqekPobZ8Qg6BIc4av4P9JkQKCy0gf-cVg8Cy2I3h0cx8b6y09SSAPh0J7Tp1_QdIe6U54-So4vaV8e
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr6x8gdEI9CzB555xdATsSztcsevd7bdQPqdQNMVOW9EVjdETj73DPhOPtASztOVEVsd79EVpd79LisF-2HlFY9NbsKrJmDMD4JOVKMVdXQTT-LPbzPPZQuLsKCCevUsMU-yqenKmKzp5dl6WfaxVZicHs3jqpJcTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqbxEVd7apI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73pPyi
Full table sessions are easy, the trouble is sessions with a subset of routes, since the threshold for each is different.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 16:42:58 Aaron Hite ahite@cosentry.com wrote:
First let me start with I am not a developer and therefore do not know if this is helpful or not. We have tried this in the past with other solutions and what we came up with is to use the MiB For Cisco IOS, total number of routes can be monitored through SNMP OID 1.3.6.1.2.1.4.24.3.0. This returns a value that we can then measure a percent or value change and alert based on this number.
I do recognize that this is not a silver bullet answer and therefore if you have a mixed table this might not work, but if you are looking for full routes via BGP (~500k) and you want to know if you have lost a large number via a provider, this solution has helped.
Might not be worth 2 cents, but it is what I got.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/FZsS93gsrhojd7aaab2r9KVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPtxOrTFLLZvCn7DDXEZuVtdcs_MVxNZ4QsLsJt6OaqGdQul3PWApmU6CQjqpK_8K6zBV55BeXNKVI05EITFsjVsTkxjUCpdGBO5mUm-waGgFYjcCRu00CQn3hOqekPobZ8Qg6BIc4av4P9JkQKCy0gf-cVg8Cy2I3h0cx8b6y09SSAPh0J7Tp1_QdIe6U54-So4vaV8e
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr6x8gdEI9CzB555xdATsSztcsevd7bdQPqdQNMVOW9EVjdETj73DPhOPtASztOVEVsd79EVpd79LisF-2HlFY9NbsKrJmDMD4JOVKMVdXQTT-LPbzPPZQuLsKCCevUsMU-yqenKmKzp5dl6WfaxVZicHs3jqpJcTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqbxEVd7apI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73pPyi
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Not sure I am tracking? IPv4 vs IPv6?
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:56 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Full table sessions are easy, the trouble is sessions with a subset of routes, since the threshold for each is different.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/2DRPoArhojd7aabb2bVKVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPrz6LuC-_R-vsoK-yeWZOWqrzD8EI3xMVdzBHEShhlKUzOEuvkzaT0QSyrodTV5MQsL8EIFTudTdw0J5CZbyvbCWAav4P9JkKgGT2TQ1li5fypASHM04SCPtyVI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73oaikR4zL
On 15 April 2015 16:42:58 Aaron Hite <ahite@cosentry.commailto:ahite@cosentry.com> wrote:
First let me start with I am not a developer and therefore do not know if this is helpful or not. We have tried this in the past with other solutions and what we came up with is to use the MiB For Cisco IOS, total number of routes can be monitored through SNMP OID 1.3.6.1.2.1.4.24.3.0. This returns a value that we can then measure a percent or value change and alert based on this number.
I do recognize that this is not a silver bullet answer and therefore if you have a mixed table this might not work, but if you are looking for full routes via BGP (~500k) and you want to know if you have lost a large number via a provider, this solution has helped.
Might not be worth 2 cents, but it is what I got.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/FZsS93gsrhojd7aaab2r9KVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPtxOrTFLLZvCn7DDXEZuVtdcs_MVxNZ4QsLsJt6OaqGdQul3PWApmU6CQjqpK_8K6zBV55BeXNKVI05EITFsjVsTkxjUCpdGBO5mUm-waGgFYjcCRu00CQn3hOqekPobZ8Qg6BIc4av4P9JkQKCy0gf-cVg8Cy2I3h0cx8b6y09SSAPh0J7Tp1_QdIe6U54-So4vaV8e
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr6x8gdEI9CzB555xdATsSztcsevd7bdQPqdQNMVOW9EVjdETj73DPhOPtASztOVEVsd79EVpd79LisF-2HlFY9NbsKrJmDMD4JOVKMVdXQTT-LPbzPPZQuLsKCCevUsMU-yqenKmKzp5dl6WfaxVZicHs3jqpJcTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqbxEVd7apI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73pPyi
_______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/avndy0scxNJ5xcQsEEII8LCXCQrFzxPVEVpKCrhKCe7enhd7apJ6WoUs-qemrICQrKnd7bxEVd7b9EVdWjBfMlqJfxe9rBPtGQ-4UBKndKcqZWrX_nVZNyXW8XHTbFFKesyyMe73ASemKzp55mXyfaxVZicHs3jqpJwTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqrdSbCMnWhEwdboo8k-9CjqFFtd40wvYpOwhd45o6y0p2gmd40jJJ9Cy1qfKO3_ErosdyuG_AijoQNRL
No. Our original user base is composed of people who have hundreds of external bgp sessions, mostly with 1-500 routes each.
Monitoring changes on these is trickier.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 17:01:46 Aaron Hite ahite@cosentry.com wrote:
Not sure I am tracking? IPv4 vs IPv6?
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:56 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Full table sessions are easy, the trouble is sessions with a subset of routes, since the threshold for each is different.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/2DRPoArhojd7aabb2bVKVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPrz6LuC-_R-vsoK-yeWZOWqrzD8EI3xMVdzBHEShhlKUzOEuvkzaT0QSyrodTV5MQsL8EIFTudTdw0J5CZbyvbCWAav4P9JkKgGT2TQ1li5fypASHM04SCPtyVI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73oaikR4zL
On 15 April 2015 16:42:58 Aaron Hite <ahite@cosentry.commailto:ahite@cosentry.com> wrote:
First let me start with I am not a developer and therefore do not know if this is helpful or not. We have tried this in the past with other solutions and what we came up with is to use the MiB For Cisco IOS, total number of routes can be monitored through SNMP OID 1.3.6.1.2.1.4.24.3.0. This returns a value that we can then measure a percent or value change and alert based on this number.
I do recognize that this is not a silver bullet answer and therefore if you have a mixed table this might not work, but if you are looking for full routes via BGP (~500k) and you want to know if you have lost a large number via a provider, this solution has helped.
Might not be worth 2 cents, but it is what I got.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/FZsS93gsrhojd7aaab2r9KVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPtxOrTFLLZvCn7DDXEZuVtdcs_MVxNZ4QsLsJt6OaqGdQul3PWApmU6CQjqpK_8K6zBV55BeXNKVI05EITFsjVsTkxjUCpdGBO5mUm-waGgFYjcCRu00CQn3hOqekPobZ8Qg6BIc4av4P9JkQKCy0gf-cVg8Cy2I3h0cx8b6y09SSAPh0J7Tp1_QdIe6U54-So4vaV8e
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr6x8gdEI9CzB555xdATsSztcsevd7bdQPqdQNMVOW9EVjdETj73DPhOPtASztOVEVsd79EVpd79LisF-2HlFY9NbsKrJmDMD4JOVKMVdXQTT-LPbzPPZQuLsKCCevUsMU-yqenKmKzp5dl6WfaxVZicHs3jqpJcTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqbxEVd7apI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73pPyi
observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/avndy0scxNJ5xcQsEEII8LCXCQrFzxPVEVpKCrhKCe7enhd7apJ6WoUs-qemrICQrKnd7bxEVd7b9EVdWjBfMlqJfxe9rBPtGQ-4UBKndKcqZWrX_nVZNyXW8XHTbFFKesyyMe73ASemKzp55mXyfaxVZicHs3jqpJwTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqrdSbCMnWhEwdboo8k-9CjqFFtd40wvYpOwhd45o6y0p2gmd40jJJ9Cy1qfKO3_ErosdyuG_AijoQNRL
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Got it.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 11:10 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
No. Our original user base is composed of people who have hundreds of external bgp sessions, mostly with 1-500 routes each.
Monitoring changes on these is trickier.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/2DRPoO83hJ5xcQsEEI9Ie6XCQrFzxPVEVpKCrhKCe7enhd7apJ6WoUs-qemrICQrKnd7bxEVd7b9EVdWjBfMlqJfxe9rBPtGQ-4UBKndIf8fuC-_R-od7b1EVppWZOWrbwXArFLI6zBXBHFShhlKCNOEuvkzaT0QSyrsdTV5MQsL8EIFTudTdw0J5CZbyvbCWAav4P9JkKgGT2TQ1li5fypASHM04SCe7cf6MnWhEwdboo8k-9CjqFFtd40wvYpOwhd45o6y0p2gmd40jJJ9Cy1qfKO3_ErosdAvvb
On 15 April 2015 17:01:46 Aaron Hite <ahite@cosentry.commailto:ahite@cosentry.com> wrote:
Not sure I am tracking? IPv4 vs IPv6?
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:56 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Full table sessions are easy, the trouble is sessions with a subset of routes, since the threshold for each is different.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/2DRPoArhojd7aabb2bVKVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPrz6LuC-_R-vsoK-yeWZOWqrzD8EI3xMVdzBHEShhlKUzOEuvkzaT0QSyrodTV5MQsL8EIFTudTdw0J5CZbyvbCWAav4P9JkKgGT2TQ1li5fypASHM04SCPtyVI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73oaikR4zL
On 15 April 2015 16:42:58 Aaron Hite <ahite@cosentry.commailto:ahite@cosentry.com> wrote:
First let me start with I am not a developer and therefore do not know if this is helpful or not. We have tried this in the past with other solutions and what we came up with is to use the MiB For Cisco IOS, total number of routes can be monitored through SNMP OID 1.3.6.1.2.1.4.24.3.0. This returns a value that we can then measure a percent or value change and alert based on this number.
I do recognize that this is not a silver bullet answer and therefore if you have a mixed table this might not work, but if you are looking for full routes via BGP (~500k) and you want to know if you have lost a large number via a provider, this solution has helped.
Might not be worth 2 cents, but it is what I got.
Aaron
From: Adam Armstrong Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 10:22 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
Hah. A scalable way of remembering and using y number of previous measurements would be a good start!
It doesn't help that prefix data is held separate to session data, since not all sessions have all address families.
There are two possibilities, changing the bgp entity so that it also included prefix information from the other tables (slow), or adding per-afi bgp as an entity type to the alerting, which might be too cumbersome.
Also, how does one define the thresholds? -/+ a percentage based on the first seen? Still might get noisy.
We dislike implementing things which are likely to be suboptimal for any reason. Its better to get things right from the start.
Adam.
Sent with AquaMail for Android http://www.aqua-mail.comhttp://cp.mcafee.com/d/FZsS93gsrhojd7aaab2r9KVJ6WoUs-qemrFCQrFzxPBQjhOCrhKCe7fCzBCX9J6XBPhOUqejhOOqejuAVjY5mHjUjymVsTqJfxe9rBPtxOrTFLLZvCn7DDXEZuVtdcs_MVxNZ4QsLsJt6OaqGdQul3PWApmU6CQjqpK_8K6zBV55BeXNKVI05EITFsjVsTkxjUCpdGBO5mUm-waGgFYjcCRu00CQn3hOqekPobZ8Qg6BIc4av4P9JkQKCy0gf-cVg8Cy2I3h0cx8b6y09SSAPh0J7Tp1_QdIe6U54-So4vaV8e
On 15 April 2015 15:58:18 Michael Vieth <MVieth@nexatech.commailto:MVieth@nexatech.com> wrote: When reading the metrics and attributes wiki it seemed not possible. At least not with my toolset.
And agreed on the potential chattiness, I envisioned an alert where the if the # routes changed by more the x% of the y(time) average, then send an alert.
Cheers, Michael Vieth
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Pedersen, Sean Sent: Wednesday, April 15, 2015 9:52 AM To: Observium Network Observation System Subject: Re: [Observium] Alerting on BGP Ucast prefixes
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation. _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr6x8gdEI9CzB555xdATsSztcsevd7bdQPqdQNMVOW9EVjdETj73DPhOPtASztOVEVsd79EVpd79LisF-2HlFY9NbsKrJmDMD4JOVKMVdXQTT-LPbzPPZQuLsKCCevUsMU-yqenKmKzp5dl6WfaxVZicHs3jqpJcTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqbxEVd7apI5-Aq83iS625fypASGqnjh087_6sE4jh1m1Ew6gA5zh04XripEwmzXIw_W6S73pPyi
_______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/avndy0scxNJ5xcQsEEII8LCXCQrFzxPVEVpKCrhKCe7enhd7apJ6WoUs-qemrICQrKnd7bxEVd7b9EVdWjBfMlqJfxe9rBPtGQ-4UBKndKcqZWrX_nVZNyXW8XHTbFFKesyyMe73ASemKzp55mXyfaxVZicHs3jqpJwTvAn3hOYyyODtUTsS03mHiqKMVnRvDaT00s0gKgB31dnoovaAVgtHBi5fypASGrGgFYjcCRiV2Hsbvg5l8k-9CjqL00jqrdSbCMnWhEwdboo8k-9CjqFFtd40wvYpOwhd45o6y0p2gmd40jJJ9Cy1qfKO3_ErosdyuG_AijoQNRL
_______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observiumhttp://cp.mcafee.com/d/k-Kr41Ee43qb2pEVhhojosdTdETj73DPhOPtcSztcsesKyqekPqdQNMVYQsITpdETsKqen3hOqemjhOrQDavwGRqv2siTbCXlFY9NbsKrouguZdZ_HYMqem3hOOPRXBQSn1T8Tjvod7bTbnjIyyHtdzBgY-F6lK1FJcSUrLObxEVuhhpjKYrKr01HlFdnosHWLPBrw0e08n8ixwCHIcfBisEeROF2DNcOrldR8k-9CjqFsxlK5LE2GAav4P9Jnw09JcseoudwLQzh0qmMMgFYjcCRjiWq810_UPB0yq8aMd40O4wIq80Drqjd42QvtA7_gSMUrFSMbqzdW
Hi,
I need to work out the best way of doing this, since the per-af prefixes are kept in a separate set of structures to the session stats.
Most of the ways of doing it seem to have problems (separating v4 and v6 only sessions, etc).
Adam.
Sent with AquaMail for Android http://www.aqua-mail.com
On 15 April 2015 15:52:22 "Pedersen, Sean" spedersen@io.com wrote:
The only BGP-related metrics at the moment are bgpPeerState, bgpPeerAdminStatus, and bgpFsmEstablishedTime.
The prefix data might be graphed, but the same data might not necessarily be available via the alerting system.
I’d like to see that kind of alerting as well! Though I don’t think it’d replace something more robust like BGPMon. Plus, it could get quite chatty unless you could set limits on route changes.
From: Michael Vieth Reply-To: Observium Network Observation System Date: Wednesday, April 15, 2015 at 7:48 AM To: Observium Network Observation System Subject: [Observium] Alerting on BGP Ucast prefixes
I am ecstatic that unicast prefix is graphed on Observium.
Is there a way to alert on a change in the number of routes being advertised?
For example, say I am receiving 500 routes from a peer, and that drops to 430, is that an alert-able event?
(Sorry if this is a repeated question, I am having difficulty finding detailed information on alerts outside of the wiki that just has general alerts documented.)
Cheers, Michael Vieth
Founded in 2007, IO provides the data center as a service to businesses and governments around the world.
The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (5)
-
Aaron Hite -
Adam Armstrong -
Eduardo Schoedler -
Michael Vieth -
Pedersen, Sean