Cisco IOS by SNMP - Network Interfaces discovery - Link Down Trigger Prototype

[Nick@Orora]

Hi All,

Hoping I can get some advice on an idea I have around modifying Network interface discovery in respect to the link down Trigger Prototype on Cisco IOS by SNMP.

In short, I have found that in my environment the issue is I see a lot of 'link down' problems on access ports, which basically is unimportant to me and all I want to see is an alert on a Trunk port. I have checked and can see I can disable the trigger with $IFCONTROL:"{#IFNAME}"}=0 Macro but this looks like it might stop it for all ports (at Host level) or on trigger per port level (which would take me about 2 months of work for the many switches/ports in our environment)!

So I did some checking and after a bit of research on the other things I can grab from SNMP it looks like I just need to modify the trigger prototype to check IOD 1.3.6.1.4.1.9.9.46.1.6.1.1.14 which returns a value status of VLAN Trunking (1) or Non Trunking (2) so I could only alert ONLY if it is VLAN Trunking.

Now I am trying to work out how to rewrite the Trigger to include that check. I'm not a great coder and new to Zabbix (and its ways) and am continuing to research on how to best implement this 'check', but lso thought I would put it out to the forum while I still have some hair left!

Does anyone have a) any awesome suggestions? b) an example where they have done a similar thing? c) and the big one, opinions on modifying the Trigger as mentioned above? (Will it break something, somewhere else or yup its a great idea/bad idea or the one I am hoping for is "that'd be super easy, just do this"! ).

TIA

Nick

[claros]

Hi!
I'm currently facing the same problem and found your post...
After all of this time, have you solved your issue?

Regards
Claudio

[claros]

Ok, I've solved it.
Walking that OID during network interface discovery, I add an item like this:
net.if.status[TrunkPortStatus.{#SNMPINDEX}]
Then in the trigger secrion a cloned trigger (from the official link down trigegr) do this job:
Trunk Interface {#IFNAME}({#IFALIAS}): Link down

{$IFCONTROL:"{#IFNAME}"}=1 and last(/Cisco IOS SNMP by Claros/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/Cisco IOS SNMP by Claros/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/Cisco IOS SNMP by Claros/net.if.status[ifOperStatus.{#SNMPINDEX}],#2)) and first(/Cisco IOS SNMP by Claros/net.if.status[TrunkPortStatus.{#SNMPINDEX}],3d)=1

As you can see, an interface is considered as a trunk to be monitored if it was a trunk for 3 days, at least.

It just works well on a test template, please let me know if you need further information.

Regards
Claudio

[Nick@Orora]

Hi Claros,

Good work and sorry I missed your first post..

I'll try and set this up in our environment and see how it works with 1000's of interfaces.

Cheers
Nick

[Nick@Orora]

OK. Having some trouble getting the item prototype working for net.if.status[TrunkPortStatus.{#SNMPINDEX}]

Can you screenshot your changes?

Cheers
Nick

[claros]

Hi
In the walk part of the discovery rule you should add the right OID (1.3.6.1.4.1.9.9.46.1.6.1.1.14)

walk[1.3.6.1.2.1.2.2.1.8,1.3.6.1.2.1.2.2.1.7,1.3.6.1.2. 1.31.1.1.1.18,1.3.6.1.2.1.31.1.1.1.1,1.3.6.1.2.1.2 .2.1.2,1.3.6.1.2.1.2.2.1.3,1.3.6.1.2.1.31.1.1.1.6, 1.3.6.1.2.1.31.1.1.1.10,1.3.6.1.2.1.2.2.1.14,1.3.6 .1.2.1.2.2.1.20,1.3.6.1.2.1.2.2.1.19,1.3.6.1.2.1.2 .2.1.13,1.3.6.1.2.1.31.1.1.1.15,1.3.6.1.4.1.9.9.46 .1.6.1.1.14]

Than add the Item, a screenshot is attached.



Bye

[claros]

The preprocessing step screenshot