Archived community.zenoss.org | full text search
Skip navigation
945 Views 2 Replies Latest reply: Nov 14, 2013 12:46 PM by digidt RSS
digidt Newbie 4 posts since
Jul 10, 2013
Currently Being Moderated

Nov 13, 2013 3:59 PM

Remodel a single Cisco switch interface on alert?

Zenoss version:  3.2.1

 

My situation:

When a computer is turned off or put in sleep mode, its port speed goes down to 10Mb/s.  So at 10PM when Zenoss remodels the devices a lot of the users have gone home for the day and their computers are off or sleeping and in the morning I get a slew of false/positive "Warning threshold of high utilization exceeded" from these ports that are actually operating at a Gigabit, but Zenoss sees them as 10Mb/s until the 10AM remodel.

 

What I would like accomplish:

I would like to make it so that when one of these "Warning threshold of high utilization exceeded" alerts comes in Zenoss will kick off a script that will perform the following workflow:

Does the observed bandwidth utiliziation exceed the port speed according to the device database?
If "yes / true" then <Remodel switch port>

If "no / false" then <Alert is legit - send notification as normal>

 

What I would like to know:

1)  Is it possible to remodel just a single port?  I found documentation on remodeling an entire device but not an individual element of a device (ie a single port).

2)  How do I hook into the alerting system to kickoff a script before the email goes out?

 

Thanks!

  • alex0cy Rank: White Belt 58 posts since
    May 13, 2008
    Currently Being Moderated
    1. Nov 14, 2013 1:50 AM (in response to digidt)
    Re: Remodel a single Cisco switch interface on alert?

    You can remodel only single set of device components, i.e. you can run single modeler plugin and it will update only components it's responsible for. However, this is tricky, will take a lot of resources and will not do the job by the end of the day.

     

    I would suggest to configure switch to send traps on ifOperUp/ifOperDown and to create an event transform in snmp_linkUp trap mapping which will update the parameters of specific interface and set the actual speed. (Don't forget to use commit() at the end of transform). The simplest case will be to set statically 100Mbps or 1Gbps just to avoid alarming or you can do snmp query from transform using specific interface index and set the actual speed. However, in this case you shall be a bit careful, as traps are very fast and switch may not yet update snmp table with new speed.

     

    In case interface is not actually goes down or switch is not capable to send traps you still can you the above solution, but shall apply it to /Perf/Interface class transform. Make sure you check event severity in the begining of transform script and do queries/updates only in case of alarm, otherwise the performance will be severily degraded.

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points