Forum Discussion
By default, the "Poller: Interface Admin down" event has a severity level of Notice (which is appropriate given that condition requires a manual configuration change). The "Poller: Interface operationally down" event has a severity level of Major. Any time an interface is administratively brought down, it also brings it operationally down (down/down). Since the operationally down condition is a higher severity level than the admin down condition, it is not being suppressed. This is the situation where the operationally down events are essentially causing false positives for our NOC. They have procedures in place to respond to all operationally down messages (up/down), and the ones being generated due to a network admin administratively bringing down the interface is essentially a big waste of time. When it comes to interface states, the current logic in SL1 just appears to be flawed. What we really need is the following:
Interface up/up = healthy
Interface up/down = major
Interface down/down = notice
Related Content
- 10 months ago