Need to poll the status of network interfaces instead of relying on traps?

Setting up Active Monitoring of Interface Status

Zenoss will monitor the throughput and errors on all network interfaces by default. One thing that surprises a lot of people is that it doesn't also monitoring the up/down status of the interfaces. The reason for this is that multi-interface devices are typically expected to send SNMP traps when their links go up and down. Zenoss will gladly accept these traps to give you an indication that you have a problem with a link.

Sometimes it just doesn't make sense to use traps for this purpose, or maybe you want to double-check by polling the status of your interfaces in addition to receiving the linkUp/Down traps. The following shows how you can use a threshold on the ifOperStatus value combined with an event class transform to accomplish this.

Setup the Interface Template

Use the following steps to start collection of the ifOperStatus value and threshold when it is anything but up (1). If you already have the ifOperStatus data source mentioned in step 3, you can skip that step.

1. Go to /Devices and click on the Templates tab.
2. Click into the ethernetCsmacd template.
3. Click the Data Sources menu and choose Add DataSource.
   1. Name it ifOperStatus, set the type to SNMP and click OK.
   2. Enter "1.3.6.1.2.1.2.2.1.8" without the quotes into the OID field and click Save.
   3. Set the  RRD minimum to 0 and the RRD maximum to 10 then click Save.
   4. Click on ethernetCsmacd in the breadcrumbs to go back to the template.
4. Click the Thresholds menu and choose Add Threshold.
   1. Name the threshold "operational status"
   2. Set the type to MinMaxThreshold and click OK.
   3. Choose ifOperStatus_ifOperStatus from the list of data points.
   4. Set the min and max values to 1.
   5. Set the event class to /Status/IpInterface (if this event class does not exist, create it).
   6. Set the severity to error or critical. This is really up to you.

Setup the Event Class Transform

This step is optional and only serves to make the resulting threshold events have an easier to understand summary.

1. Go to the /Events/Status/IpInterface event class (create the class if it doesn't exist).
2. Click on the menu and choose More->Transform.
3. Enter the following transform
   

   if evt.summary.startswith('threshold of operational status '):
       if evt.severity > 0:
           evt.summary = "interface operationally down"
           evt.message = "interface operationally down"
       else:
           evt.summary = "interface operationally up"
           evt.message = "interface operationally up"
   

4. Click Save.

Setting up Active Monitoring of Interface Last Change

Monitoring interface status with ifOperStatus is effective for detecting active issues, but not for detecting quick resets on interfaces.  For this, we need to use the ifLastChange value on interfaces.  If the ifLastChange value has increased since the last polling cycle then we know that the interface reset during that time.

Setup the Interface Template

Use the following steps to start collection of the ifLastChange value and threshold when the value increases. If you already have the ifLastChange data source mentioned in step 3, you can skip that step.

1. Go to /Devices and click on the Templates tab.
2. Click into the ethernetCsmacd template.
3. Click the Data Sources menu and choose Add DataSource.
   1. Name it ifLastChange, set the type to SNMP and click OK.
   2. Enter "1.3.6.1.2.1.2.2.1.9" without the quotes into the OID field and click Save.
   3. Change the type from GAUGE to DERIVE and click Save.
   4. Click on ethernetCsmacd in the breadcrumbs to go back to the template.
4. Click the Thresholds menu and choose Add Threshold.
   1. Name the threshold "last change"
   2. Set the type to MinMaxThreshold and click OK.
   3. Choose ifLastChange_ifLastChange from the list of data points.
   4. Set the max value to 1, leave the min value blank.
   5. Set the event class to /Net/Link (if this event class does not exist, create it).
   6. Set the severity to error or critical. This is really up to you.

Setup the Event Class Transform

1. Go to the /Events/Net/Link event class (create the class if it doesn't exist).
2. Click on the menu and choose More->Transform.
3. Enter the following transform
   

   if evt.summary.startswith('threshold of last change'):
    if evt.severity == 0:
     evt._action = 'drop'
    import re
    d = dmd.Devices.findDevice(evt.device)
    p = re.compile('(\d+)')
    m = p.search(evt.summary)
    int = float(m.group(1))
    evt.summary = "interface state change"
    evt.message = "interface state change"
    uptime = float(d.sysUpTime())
    if uptime != -1:
     if int > uptime:
      evt._action = 'drop'
   

4. Click Save.