Re: [Devmon] exception template to alarm only if ifAliasBox contains string "uplink"

[Nelis, W. <Wim...@nl...>]

Hello,

As far as I know, only the alarm definitions using the primary OID, that is the name of the variable shown in the left-most column, are used by Devmon. Thus lines in file exceptions starting with name other than the primary OID name are ignored. Thus, if I am right, you cannot enable or disable alarms based on the value of any of the other fields shown in the table.

An option using Devmon only could be to create a second table, using the MATCH operator. The second table will contain only the uplinks. You'll need to copy the variable(s) of interest to other variables, using the CHAIN operator. In this table you can enable alarms on all entries. Note however, that a switch without any uplinks will have an empty table. I do not know how Devmon will cope with that.

This being said, I solved a similar problem using an external script. This script would take information from the tests if_stat and If_load, select only the links to other networking equipment (switch, router, AP) and alarm on being down, and alarm on ingress being zero while egress is not. (This script does handle an empty set of uplinks correctly.)

Regards,
  Wim Nelis.
________________________________________
Van: Oliver <r.o...@we...>
Verzonden: woensdag 20 juli 2016 9:17
Aan: dev...@li...
Onderwerp: [Devmon] exception template to alarm only if ifAliasBox contains string "uplink"

Dear All,

can you please help me to form a exception template for cisco switches?
I'm looking for a template which should show all interfaces in the list
(if_stat column), but xymon should only trigger alerts, if one of the
uplink interfaces goes down. All other ports are client access ports and
if someone powers off his computer, the port should not become red in xymon.

I tried a lot of regex, but had no success. Unfortunately I'm not very
familiar with those expressions, so I'm forced to approach using trial
an error. So here is, what comes next to that, what i want, but as
mentioned, it does not work:

ifAliasBox : alarm : .*uplink.*
ifAliasBox : noalarm  : ((?!uplink).)*
ifName : ignore : Nu.+|Vl.+|Fa.+


A bonus feature would be, if the exclude statement could be multiple
values, e.g.:

ifAliasBox : noalarm : ((?!uplink|Stack).)*


These are my tries which did not work:

ifAliasBox : noalarm  : ((?!uplink).)*
ifAliasBox : noalarm  : .*((?!uplink).)*
ifAliasBox : noalarm  : .*((?!uplink).).*
ifAliasBox : noalarm  : (?:(?!uplink).)*
ifAliasBox : noalarm  : ^((?!uplink).)*$
ifAliasBox : noalarm  : ^(?:(?!uplink).)*$
ifAliasBox : noalarm  : ^(.(?!" + uplink + "))*$
ifAliasBox : noalarm  : ^(.*(?!" + uplink + "))*$

Thank you for your help!

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
Devmon-support mailing list
Dev...@li...
https://lists.sourceforge.net/lists/listinfo/devmon-support