Menu
▾
▴
devmon-support
|
From: Oliver <r.o...@we...> - 2016-07-20 07:18:02
|
Dear All, can you please help me to form a exception template for cisco switches? I'm looking for a template which should show all interfaces in the list (if_stat column), but xymon should only trigger alerts, if one of the uplink interfaces goes down. All other ports are client access ports and if someone powers off his computer, the port should not become red in xymon. I tried a lot of regex, but had no success. Unfortunately I'm not very familiar with those expressions, so I'm forced to approach using trial an error. So here is, what comes next to that, what i want, but as mentioned, it does not work: ifAliasBox : alarm : .*uplink.* ifAliasBox : noalarm : ((?!uplink).)* ifName : ignore : Nu.+|Vl.+|Fa.+ A bonus feature would be, if the exclude statement could be multiple values, e.g.: ifAliasBox : noalarm : ((?!uplink|Stack).)* These are my tries which did not work: ifAliasBox : noalarm : ((?!uplink).)* ifAliasBox : noalarm : .*((?!uplink).)* ifAliasBox : noalarm : .*((?!uplink).).* ifAliasBox : noalarm : (?:(?!uplink).)* ifAliasBox : noalarm : ^((?!uplink).)*$ ifAliasBox : noalarm : ^(?:(?!uplink).)*$ ifAliasBox : noalarm : ^(.(?!" + uplink + "))*$ ifAliasBox : noalarm : ^(.*(?!" + uplink + "))*$ Thank you for your help! |
|
From: Ken C. <kco...@ry...> - 2016-07-20 12:35:26
|
I too have wanted to do the same and like you didn't get too far. I ended up writing an external script which is basically does SNMP polls for ifAlias, ifDescr, & ifOperStatus and grep out whatever I'm interested and trigger on link down and then update the Xymon display. On Jul 20, 2016 3:18 AM, "Oliver" <r.o...@we...> wrote: > Dear All, > > can you please help me to form a exception template for cisco switches? > I'm looking for a template which should show all interfaces in the list > (if_stat column), but xymon should only trigger alerts, if one of the > uplink interfaces goes down. All other ports are client access ports and > if someone powers off his computer, the port should not become red in > xymon. > > I tried a lot of regex, but had no success. Unfortunately I'm not very > familiar with those expressions, so I'm forced to approach using trial > an error. So here is, what comes next to that, what i want, but as > mentioned, it does not work: > > ifAliasBox : alarm : .*uplink.* > ifAliasBox : noalarm : ((?!uplink).)* > ifName : ignore : Nu.+|Vl.+|Fa.+ > > > A bonus feature would be, if the exclude statement could be multiple > values, e.g.: > > ifAliasBox : noalarm : ((?!uplink|Stack).)* > > > These are my tries which did not work: > > ifAliasBox : noalarm : ((?!uplink).)* > ifAliasBox : noalarm : .*((?!uplink).)* > ifAliasBox : noalarm : .*((?!uplink).).* > ifAliasBox : noalarm : (?:(?!uplink).)* > ifAliasBox : noalarm : ^((?!uplink).)*$ > ifAliasBox : noalarm : ^(?:(?!uplink).)*$ > ifAliasBox : noalarm : ^(.(?!" + uplink + "))*$ > ifAliasBox : noalarm : ^(.*(?!" + uplink + "))*$ > > Thank you for your help! > > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and > traffic > patterns at an interface-level. Reveals which users, apps, and protocols > are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity > planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > Devmon-support mailing list > Dev...@li... > https://lists.sourceforge.net/lists/listinfo/devmon-support > |
|
From: Nelis, W. <Wim...@nl...> - 2016-07-20 16:55:50
|
Hello, As far as I know, only the alarm definitions using the primary OID, that is the name of the variable shown in the left-most column, are used by Devmon. Thus lines in file exceptions starting with name other than the primary OID name are ignored. Thus, if I am right, you cannot enable or disable alarms based on the value of any of the other fields shown in the table. An option using Devmon only could be to create a second table, using the MATCH operator. The second table will contain only the uplinks. You'll need to copy the variable(s) of interest to other variables, using the CHAIN operator. In this table you can enable alarms on all entries. Note however, that a switch without any uplinks will have an empty table. I do not know how Devmon will cope with that. This being said, I solved a similar problem using an external script. This script would take information from the tests if_stat and If_load, select only the links to other networking equipment (switch, router, AP) and alarm on being down, and alarm on ingress being zero while egress is not. (This script does handle an empty set of uplinks correctly.) Regards, Wim Nelis. ________________________________________ Van: Oliver <r.o...@we...> Verzonden: woensdag 20 juli 2016 9:17 Aan: dev...@li... Onderwerp: [Devmon] exception template to alarm only if ifAliasBox contains string "uplink" Dear All, can you please help me to form a exception template for cisco switches? I'm looking for a template which should show all interfaces in the list (if_stat column), but xymon should only trigger alerts, if one of the uplink interfaces goes down. All other ports are client access ports and if someone powers off his computer, the port should not become red in xymon. I tried a lot of regex, but had no success. Unfortunately I'm not very familiar with those expressions, so I'm forced to approach using trial an error. So here is, what comes next to that, what i want, but as mentioned, it does not work: ifAliasBox : alarm : .*uplink.* ifAliasBox : noalarm : ((?!uplink).)* ifName : ignore : Nu.+|Vl.+|Fa.+ A bonus feature would be, if the exclude statement could be multiple values, e.g.: ifAliasBox : noalarm : ((?!uplink|Stack).)* These are my tries which did not work: ifAliasBox : noalarm : ((?!uplink).)* ifAliasBox : noalarm : .*((?!uplink).)* ifAliasBox : noalarm : .*((?!uplink).).* ifAliasBox : noalarm : (?:(?!uplink).)* ifAliasBox : noalarm : ^((?!uplink).)*$ ifAliasBox : noalarm : ^(?:(?!uplink).)*$ ifAliasBox : noalarm : ^(.(?!" + uplink + "))*$ ifAliasBox : noalarm : ^(.*(?!" + uplink + "))*$ Thank you for your help! ------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev _______________________________________________ Devmon-support mailing list Dev...@li... https://lists.sourceforge.net/lists/listinfo/devmon-support |
|
From: Oliver <r.o...@we...> - 2016-07-21 05:17:58
|
Hallo, I currently use another solution, that is not fully does, what I need, but is good for now: ifAliasBox : only : .*uplink.* This line causes that only interfaces are listed, which hold the word "uplink" in their alias field. Thank you for your answers! I will come back to your hint with forming another table. You said, that only the primary oid is valid for alarm definitions. Is the primary one the first line in the oids file the corresponding template? If so, would you think it is possible to simply switch ifName with ifAlias and then use one of my alarm definition from my first message? Regards Oliver Am 20.07.2016 um 18:35 schrieb Nelis, Wim: > Hello, > > As far as I know, only the alarm definitions using the primary OID, that is the name of the variable shown in the left-most column, are used by Devmon. Thus lines in file exceptions starting with name other than the primary OID name are ignored. Thus, if I am right, you cannot enable or disable alarms based on the value of any of the other fields shown in the table. > > An option using Devmon only could be to create a second table, using the MATCH operator. The second table will contain only the uplinks. You'll need to copy the variable(s) of interest to other variables, using the CHAIN operator. In this table you can enable alarms on all entries. Note however, that a switch without any uplinks will have an empty table. I do not know how Devmon will cope with that. > > This being said, I solved a similar problem using an external script. This script would take information from the tests if_stat and If_load, select only the links to other networking equipment (switch, router, AP) and alarm on being down, and alarm on ingress being zero while egress is not. (This script does handle an empty set of uplinks correctly.) > > Regards, > Wim Nelis. > ________________________________________ > Van: Oliver <r.o...@we...> > Verzonden: woensdag 20 juli 2016 9:17 > Aan: dev...@li... > Onderwerp: [Devmon] exception template to alarm only if ifAliasBox contains string "uplink" > > Dear All, > > can you please help me to form a exception template for cisco switches? > I'm looking for a template which should show all interfaces in the list > (if_stat column), but xymon should only trigger alerts, if one of the > uplink interfaces goes down. All other ports are client access ports and > if someone powers off his computer, the port should not become red in xymon. > > I tried a lot of regex, but had no success. Unfortunately I'm not very > familiar with those expressions, so I'm forced to approach using trial > an error. So here is, what comes next to that, what i want, but as > mentioned, it does not work: > > ifAliasBox : alarm : .*uplink.* > ifAliasBox : noalarm : ((?!uplink).)* > ifName : ignore : Nu.+|Vl.+|Fa.+ > > > A bonus feature would be, if the exclude statement could be multiple > values, e.g.: > > ifAliasBox : noalarm : ((?!uplink|Stack).)* > > > These are my tries which did not work: > > ifAliasBox : noalarm : ((?!uplink).)* > ifAliasBox : noalarm : .*((?!uplink).)* > ifAliasBox : noalarm : .*((?!uplink).).* > ifAliasBox : noalarm : (?:(?!uplink).)* > ifAliasBox : noalarm : ^((?!uplink).)*$ > ifAliasBox : noalarm : ^(?:(?!uplink).)*$ > ifAliasBox : noalarm : ^(.(?!" + uplink + "))*$ > ifAliasBox : noalarm : ^(.*(?!" + uplink + "))*$ > > Thank you for your help! > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > Devmon-support mailing list > Dev...@li... > https://lists.sourceforge.net/lists/listinfo/devmon-support > > > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > Devmon-support mailing list > Dev...@li... > https://lists.sourceforge.net/lists/listinfo/devmon-support > |
|
From: W.J.M. N. <Wim...@nl...> - 2016-07-22 13:21:07
|
Hallo,
> I currently use another solution, that is not fully does, what I need,
> but is good for now:
>
> ifAliasBox : only : .*uplink.*
>
> This line causes that only interfaces are listed, which hold the word
> "uplink" in their alias field.
Ok, I understand that. In module dm_tests.pm at about line 2220, it checks
all the OIDs on the row in the table for an 'ignore' or an 'only'
directive. Thus you can select only certain rows to appear in the table.
This is new for me.
> Thank you for your answers! I will come back to your hint with forming
> another table.
>
> You said, that only the primary oid is valid for alarm definitions. Is
> the primary one the first line in the oids file the corresponding
> template? If so, would you think it is possible to simply switch ifName
> with ifAlias and then use one of my alarm definition from my first message?
>
Yes. In the same module, at about line 2109, you can find:
# Make the first oid (from left to right) the primary one
my $pri = $1 if $line =~ /\{(.+?)\}/;
in which $line contains the row definition of the table. It assigns the
first name enclosed between curly brackets to $pri. Further on this
variable is used in the alarms selection:
my $pri_val = $oids->{$pri}{'val'}{$leaf};
my $alarm = 1; # Alarm by default
my $a_val = $dev->{'except'}{$test}{$pri}{'alarm'} ||
$dev->{'except'}{'all'}{$pri}{'alarm'} ||
$tmpl->{'oids'}{$pri}{'except'}{'alarm'};
$alarm = ($pri_val =~ /^(?:$a_val)$/) ? 1 : 0 if defined $a_val;
my $na_val = $dev->{'except'}{$test}{$pri}{'noalarm'} ||
$dev->{'except'}{'all'}{$pri}{'noalarm'} ||
$tmpl->{'oids'}{$pri}{'except'}{'noalarm'};
$alarm = 0 if defined $na_val and $pri_val =~ /^(?:$na_val)$/;
So your proposal should work.
Regards,
Wim Nelis.
|
|
From: KING, K. <KK...@at...> - 2016-07-22 16:06:15
|
I am working on this as well. So far it is not working as advertised. :)
I moved ifAliasBox to the first left position in the table define of the message. I can now use the ifAliasBox in the exception. Funny result is so far anything I put in the ifAliasBox : alarm : .+Avalib.+ just blanks out the alarmed list. As I try more things I will post back.
-Kevin
-----Original Message-----
From: W.J.M. Nelis [mailto:Wim...@nl...]
Sent: Friday, July 22, 2016 9:21 AM
To: dev...@li...
Subject: Re: [Devmon] exception template to alarm only if ifAliasBox contains string "uplink"
Hallo,
> I currently use another solution, that is not fully does, what I need,
> but is good for now:
>
> ifAliasBox : only : .*uplink.*
>
> This line causes that only interfaces are listed, which hold the word
> "uplink" in their alias field.
Ok, I understand that. In module dm_tests.pm at about line 2220, it checks all the OIDs on the row in the table for an 'ignore' or an 'only'
directive. Thus you can select only certain rows to appear in the table.
This is new for me.
> Thank you for your answers! I will come back to your hint with forming
> another table.
>
> You said, that only the primary oid is valid for alarm definitions. Is
> the primary one the first line in the oids file the corresponding
> template? If so, would you think it is possible to simply switch
> ifName with ifAlias and then use one of my alarm definition from my first message?
>
Yes. In the same module, at about line 2109, you can find:
# Make the first oid (from left to right) the primary one
my $pri = $1 if $line =~ /\{(.+?)\}/;
in which $line contains the row definition of the table. It assigns the first name enclosed between curly brackets to $pri. Further on this variable is used in the alarms selection:
my $pri_val = $oids->{$pri}{'val'}{$leaf};
my $alarm = 1; # Alarm by default
my $a_val = $dev->{'except'}{$test}{$pri}{'alarm'} ||
$dev->{'except'}{'all'}{$pri}{'alarm'} ||
$tmpl->{'oids'}{$pri}{'except'}{'alarm'};
$alarm = ($pri_val =~ /^(?:$a_val)$/) ? 1 : 0 if defined $a_val;
my $na_val = $dev->{'except'}{$test}{$pri}{'noalarm'} ||
$dev->{'except'}{'all'}{$pri}{'noalarm'} ||
$tmpl->{'oids'}{$pri}{'except'}{'noalarm'};
$alarm = 0 if defined $na_val and $pri_val =~ /^(?:$na_val)$/;
So your proposal should work.
Regards,
Wim Nelis.
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev
_______________________________________________
Devmon-support mailing list
Dev...@li...
https://lists.sourceforge.net/lists/listinfo/devmon-support
|
×
Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.
Thanks for helping keep SourceForge clean.
X