How do you exclude certain switch port interfaces generating 'link down' triggers!

[zuf76]

Hi All, hope someone out there can help me?

'Template Module Interfaces SNMPv2: Interface {#IFNAME}({#IFALIAS}): Link down' - (trigger prototype)

The above trigger is executed when a device is shutdown or unplugged on the network.

How can I exclude certain devices triggering this alert?

A bit of background...

Switchport interfaces have a description that start with PC,WAP,Phone,Camera,Server,Trunk etc... See below sample from the problem dashboard.

Time Status Host Problem Severity
00:01 PROBLEM RiserSwitch1 Interface Fa0/1(PC1): Link Down <--------------don't trigger for this one!
00:02 PROBLEM RiserSwitch1 Interface Fa0/2(WAP1): Link Down
00:03 PROBLEM RiserSwitch2 Interface Gi0/1(Camera1): Link Down
00:04 PROBLEM RiserSwitch2 Interface Gi0/2(Phone2): Link Down
00:05 PROBLEM CoreSwitch1 Interface Gi2/1(Server1): Link Down
00:06 PROBLEM CoreSwitch1 Interface Gi3/2(Server2): Link Down
00:07 PROBLEM CoreSwitch1 Interface Gi3/3(Trunk1): Link Down

Risers are either Fa0 or Gi0 interfaces, while the Cores are Gi2 or Gi3 if that helps.

Firstly I only want these 'link down' stopped on riser switches, and only allow them if they have the word 'WAP,Phone or Camera' in the description part of the interface.

How do I create a regular expression for the above trigger that says....

1. match any of the words 'WAP,Phone or Camera'
2. for interfaces Fa0 or Gi0.
3. applies to only riser switches.
4. core switches should continue reporting all 'link down' alerts.

I'm scratching my head on this.

Is there a better way to do this?

Thanks

[zuf76]

Hi Seapro, my particular issue is these ports are actually being used, and when lesson change over happens or the school finishes, I just get huge amounts of link down alerts that I am not interested in. If they were not in use at all, then yes disabling them would definitely have been the way forward.

Still scratching my head how to do this :-(

I could create each device as a separate host and have icmp template running and not monitor the ports, but then I wouldn't see half duplex issues, devices that are using high bandwidth etc... ... very useful information lost..

[zuf76]

This has been resolved by user frankagricola (Frank) on another thread. https://www.zabbix.com/forum/zabbix-...-notifications

[hh_ph]

Frank's "solution" is manual and doesn't use a filter of any kind.
I'm also working on this and would love a filter or regex answer

[saaverdo]

Hi!

I used idea from Mikrotik's MUM video (https://youtu.be/JvwNmfIMPUw?t=719)

To mark interfaces to be reported i added '#watch' string to interface description. i.e. "Trunk to sw-office-1 port 0/48 #watch"
In template 'Template Module Interfaces Simple SNMP' -> discovery rule 'Network interfaces discovery' create new Item prototype:
name - "Interface {#IFDESCR}: Interface alias (description)":
key - net.if.alias[ifAlias.{#SNMPINDEX}]
snmp OID - .1.3.6.1.2.1.31.1.1.1.18.{#SNMPINDEX}
type - Character

Then add condition in Trigger prototype for Link down event:
{$IFCONTROL:"{#IFNAME}"}=1 and ({Template Module Interfaces Simple SNMP DK:net.if.status[ifOperStatus.{#SNMPINDEX}].last()}=2
and {Template Module Interfaces Simple SNMP DK:net.if.status[ifOperStatus.{#SNMPINDEX}].diff()}=1)
and {Template Module Interfaces Simple SNMP DK:net.if.alias[ifAlias.{#SNMPINDEX}].str(#watch)}=1

[netadmintx]

What I ended up doing was going to Configuration... Templates... Finding "Template Module Interfaces SNMP" ... Discovery Rules... Trigger Prototypes... "Interface {#IFNAME}({#IFALIAS}): Link down" and changing it from Average to Warning. We only get email alerts on Average and up. Then I deleted the Host and re-added it. It's still not a Mass Update , but at least it's not interface by interface.