MARS Incident not triggered on interface flap

[Akhtar Samo]

Hi,

MARS did not triggered an incident when interface flapped. I can see the event in raw messages. I have checked following rule, the count settings for this rule is set to 5, so this is getting triggered when interface flaps 5 times. Its not possible to modify the count settings.

SystemRule: State Change: Network Device

Event: OperationalStatusChange/CiscoIOS

Is there any other way so that an incident is triggered if an interface flaps once, or I have to configure a custom rule for this ?

Regards,

Akhtar

[mwinnett]

You can select the rule and then click on edit to change the count. My preference is to leave the Cisco supplied rules as they are. In this case, click on duplicate instead of edit and a copy will be made. At the top, change the group to "user rules" and you will see your copy. You can then select and edit this and change the parameters as you wish to have them. Once in the edit, click on the value to change (eg: the "5" under "count") and you can configure as required. Pay attention to the "time range" to be sure that you are getting the quantity of alerts you want. Bear in mind that for IOS there are a number of messages for each down/up fluctuation. You might want to add a qualifier in the "keyword" field (freeform text of the message) to qualify the exact message.

Matthew