Create event in absence of "heartbeat" trap
We have a certain type of device that we are not allowed to do active SNMP monitoring, only traps. It sends us a heartbeat trap every minute as long as it is "up". Is there a way to make an event policy that alerts in the absence of an event? In this case, we would need to generate a critical event if the heartbeat hasn't been received for > 10 minutes. I currently have the heartbeat trap set as a "healthy" event policy. Apologies if there is some documentation about this topic that I have missed!Solved15Views0likes2CommentsTrap Threshold in a Event Policy
Hello SL community, I'm trying to create some events based on traps received. Some of the policies require a threshold to match an event. For example, the "tempOfSensor:" string should trigger a Critical event if the value is between 60 and 65. Is there a way to include a range of values in a trap-based alert, using either the result of an OID or a value inside that trap? Something similar to what we can do with a Dynamic Event Source.Solved52Views1like2CommentsSuppressing Specific BGP peers
There's been a number of times where we have come across customers who have BGP peers that are not in use or sporadically in use, but they do not wish to remove it from their configs. As a result we get perpetual alerts, but we cannot suppress them as the event suppressed would prevent all bgp peers from alerting. Anyone have thoughts on some ways to single out peers that can be ignored on a per device level? Side note: We are using Powerflow and ServiceNow so we can possibly do something in the path as well. ServiceNow could take care of it, but doesn't help with the peers that flap.98Views2likes2CommentsSuppress a syslog event on a specific interface
How might one go about suppressing a syslog event for a specific interface, but still receive all other events for that device and interface? For example, you have a syslog event message like: 5238379<187>267450: LC/0/1/CPU0:Aug 20 17:38:21.939 EDT: ifmgr[214]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/1/1/7, changed state to Down Your existing event policy uses regex match logic as follows: First Regular Expression: PKT_INFRA-LINK-[35]+-[^\s]+ Second Regular Expression: to.*(DOWN|Down|down) Identifier Pattern: Interface\s+([^ ,]+) Identifier Format: Interface: %1 Would you modify the event policy in some way? Is there other levers/knobs to in the system to tinker with that might get you the desired result?Solved174Views1like4CommentsHow do I format detailed Email Message from an Alert Formula
Hello ALL I have the following formula for an unhealthy alert object: result('o_31218', label="DataGuard is o_31218 logs behind in following Env: PrimaryDB:o_31214 SecondaryDB: o_31215 LastLogRec: o_31217 Difference: o_31218 ") >= 0 How can I get the Subject to contain object o_31214 and the body of the email to display what is listed in the above Policy Formula with the objects replaced with actual values ?Solved58Views1like2CommentsCisco Cat9500FixedSwitchStack Alerts
Cisco: Power Supply problem. Currently, Power Supply (TenGigabitEthernet */*/* Supply Voltage Sensor) status: unavailable Alerts from Cat9500FixedSwitchStack This is something not an usual alert for cisco devices. I am receiving this alert on Cat9500FixedSwitchStack (Cisco IOS Software [Bengaluru], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.6.4). Has any one receiving the same alerts and what's the fix applied.Solved180Views0likes6Comments