Nov 13, 2013 3:59 PM
Remodel a single Cisco switch interface on alert?
-
Like (0)
Zenoss version: 3.2.1
My situation:
When a computer is turned off or put in sleep mode, its port speed goes down to 10Mb/s. So at 10PM when Zenoss remodels the devices a lot of the users have gone home for the day and their computers are off or sleeping and in the morning I get a slew of false/positive "Warning threshold of high utilization exceeded" from these ports that are actually operating at a Gigabit, but Zenoss sees them as 10Mb/s until the 10AM remodel.
What I would like accomplish:
I would like to make it so that when one of these "Warning threshold of high utilization exceeded" alerts comes in Zenoss will kick off a script that will perform the following workflow:
Does the observed bandwidth utiliziation exceed the port speed according to the device database?
If "yes / true" then <Remodel switch port>
If "no / false" then <Alert is legit - send notification as normal>
What I would like to know:
1) Is it possible to remodel just a single port? I found documentation on remodeling an entire device but not an individual element of a device (ie a single port).
2) How do I hook into the alerting system to kickoff a script before the email goes out?
Thanks!
You can remodel only single set of device components, i.e. you can run single modeler plugin and it will update only components it's responsible for. However, this is tricky, will take a lot of resources and will not do the job by the end of the day.
I would suggest to configure switch to send traps on ifOperUp/ifOperDown and to create an event transform in snmp_linkUp trap mapping which will update the parameters of specific interface and set the actual speed. (Don't forget to use commit() at the end of transform). The simplest case will be to set statically 100Mbps or 1Gbps just to avoid alarming or you can do snmp query from transform using specific interface index and set the actual speed. However, in this case you shall be a bit careful, as traps are very fast and switch may not yet update snmp table with new speed.
In case interface is not actually goes down or switch is not capable to send traps you still can you the above solution, but shall apply it to /Perf/Interface class transform. Make sure you check event severity in the begining of transform script and do queries/updates only in case of alarm, otherwise the performance will be severily degraded.
This isn't really an up/down event though - the NIC is never disconnected, it just autonegotiates a new speed.
I have hundreds of computers that change locations often, it's just not practical for me to lock each port and/or configure the port speed statically. I need this process to be automated.
What about this:
1) "High threshold utilization" alert is generated
2) Use SNMP to query the port speed on the switch
3) Query the Zenoss database to find out what Zenoss thinks the port speed is
4) Compare the two:
If the actual port speed is != to what Zenoss says then update the Zenoss database with the proper port speed and abort the notification
If the actual port speed == what Zenoss says then the alert is legit and send notication
Follow Us On Twitter »
|
Latest from the Zenoss Blog » | Community | Products | Services Resources | Customers Partners | About Us | ||
Copyright © 2005-2011 Zenoss, Inc.
|
||||||||