Interface down expression help

[IJG]

Hello

We monitor 100's of Switches as well as 100's of AP's via interfaces on a Controller. These are monitored and create problems via a trigger prototype that has an expression which looks to see if the last value is down and the value before that was up. We've found that this is a bit too sensitive and therefore would like it to only alert once the interface has been down for 3 consecutive values. Is anybody able to advise on the best way of adjusting the expression to achieve this?

Currently it is: {$IFCONTROL:"{#IFNAME}"}=1 and last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))

with a recovery of: last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}])<>2 or {$IFCONTROL:"{#IFNAME}"}=0

Thanks

[SanMonitor]

Hey IJG,

I think you'll just need to change the first 'last' statement to min with a count of 3. A netstatus = 2 is offline and a netstatus = 1 is online. So if the minimum value for the last 3 values is 2 it can trigger.

This would look like this:
{$IFCONTROL:"{#IFNAME}"}=1 and min(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#3)=2 and (last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))

The recovery statement you could either leave as is or change to max count of 3 not equals 2. This would look like this:
max(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#3)<>2 or {$IFCONTROL:"{#IFNAME}"}=0

-SanMonitor

[IJG]

Hi SanMonitor

Thanks for the response. I gave this a go and tested it but it didn't seem to work. I'm wondering if this is because by the time "min(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#3)=2" is satisfied, "(last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))" is no longer satisfied because the last two values are the same?

So I changed it to be <> #5 instead of #2 so:

{$IFCONTROL:"{#IFNAME}"}=1 and min(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#3)=2 and (last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/ESNEFT - Extreme EXOS for 450 and 5420 Acute Switches/net.if.status[ifOperStatus.{#SNMPINDEX}],#5))

Which now works as intended. Thank you for setting me on the right track with this.

[cyber]

last(,#1) and last(,#5) ... you are comparing last value with the 5th value from the last... and also expect one of 3 last values to be 2 (min(,#3)=2), I do not see a reason why this should not work also with #1 and #2. #5 is definitely out of range here ...