Cisco PI 3.0.2 interface up/down events and alarms.

[Richard Murphy]

Pet bug bear with me and Prime is that its not very easy to tell it which interfaces you care about and which ones you do not. So you end up getting critical alerts for them all. Unless you invest the time to go to the source device and suppress it from ever sending an snmp trap or syslog for the interfaces going up and down that you don't care about.

In earlier versions of Prime you have the option under Administration / Settings / System Settings/ Alarm Severity to change severity given to an interface down/up alarm. I change all mine to Minors until I could figure out what I was going to do about the whole thing.

Now since version 3.0 this option is no longer there. So I am again back to having 1000's of critical alerts for interfaces going down that I do not care about.

I have just come across "Custom Trap Events". From what I am reading I should be able to select the MIB and notification name that interface up/down would come in on and change the default severity for that event. This should put me back to a lower severity for all interface up/down events. All sounds good.

My problem is, looking through the MIB list I can not find the MIB PI uses for interface up/down.

I have seen in the latest Tech pack (I have not installed it yet) the Alarm policy template, I am hoping in the future (if it actually works) to put a description on all my critical interface and then add any interface with that description into a port group and have the alarm policy template work on the port group. All other interface up/down alerts should be ignored.

Am I barking up the wrong tree and what does everyone else do with interface up/down events and alarms ?

cheers

Rich

[johanfogel]

I think you are attacking this from the wrong direction. That ports goes down could sometimes be very importent (trunk-links, etherchannels etc)

However as you already notice you only wants the critical ones...

I would suggest you configure your client-ports and other no-importent one to not send an alarm to PI

on each client-ports insert this two lines

no snmp trap link-status
no logging event link-status

[Richard Murphy]

johanfogel, in a small network I would agree, however the network estate is massive, retro fitting that config is not something I want to try if there are other options open to me.

[Richard Murphy]

I have the tech pack installed and have created a port group that looks for a text string in the interface description of my devices.

I have created my Alarm Policy to look at my switching estate and port group only. So far testing has shown that it doesn't work.

I can see the interfaces I have the description on in the preview pane of the port group settings so I know PI can see the interfaces I am interested in.

I'll keep trying.

[marce1000]

 - Yes, that is cumbersome; TECH PACK 1.0.0 has improved this handling off interface alarm with it's new alarm policies. I have now, for instance, using this feature, selected to receive interface up /down alarms from datacenter-switctes (ONLY!).

M.

[Richard Murphy]

Marce1000, I have had a disaster with installing the tech pack, my secondary instance still needs to be rebuilt :-(

I see Cisco have released a new version of the TECH PACK and I am hopefully going to get in installed next week.

My plan then is to set up an Alarm policy that looks for a tag in the interface description. I know I'll have to go round and put the tag on the interfaces descriptions that all ready exist but I am only interested in alarms for inter network connected interfaces so it should be a lot less up front effort.

I'll let you know how I get on.