Interface Status Alerting, Filtering, and Bandwidth Utilization

LogicMonitor uses the snmp_network_interfaces module to collect data. Make sure that you have installed the most recent version of this module in your portal.

Controlling Which Interfaces Trigger Status Change alerts

LogicMonitor alerts when interfaces change status from up to down. This is helpful for alerting about switch ports that connect to servers or routers, or inter-switch links, but is less useful if the ports connect to workstations that you expect to shut off everyday.

By default, LogicMonitor will detect all active interfaces, on all devices, and alert if they change status. In order to limit this behavior to a certain set of ports, you can set the property interface.description.alert_enable on a device or group. If a device has this property set, or if it inherits this property, it will only trigger status alerts for interfaces where the auto.interface.alias property matches the regular expression contained in that property. All other active ports will be discovered and monitored, but not have their status changes (or flapping) alerted on.

For example, setting the interface.description.alert_enable property to the value “core|uplink” on a group will cause all network devices in that group to alert for status changes on interfaces with the words “core” or “uplink” in the auto.interface.alias property. All other interfaces will be monitored, but will not have status alerting enabled. Other alerts, such as for excessive discards or graphing of data, will still be active.

To exclude status monitoring for all interfaces with the word “bridge” in the auto.interface.alias property, set the following property: interface.description.alert_enable=^((?!bridge).)*$

The auto.interface.alias property retrieves the interface description for a particular network interface. For example, the port GigabitEthernet 1/1 might be the official name of the interface on the switch, but a network administrator can add a description, such as “Core Link”, to the interface. This description would populate into the auto.interface.alias instance property automatically when active discovery runs and polls OID on the device.

Recommendation: Confirm the regular expression before modifying the interface.description.alert_enable property. Incorrect regex lines will break the collection script and cause threads to queue.

Monitoring Interface Utilization Based on Configured Speed

By default, LogicMonitor monitors interface bandwidth utilization as a percentage of the interface’s physical capacity. Note that this is a percentage utilization of your physical link speed, which may not reflect any configured limits imposed by your uplink provider. You can manually override the detected link speed by setting properties on the interface level.

Setting an instance level property ActualSpeed in Mbps will override the detected speed. Optionally, if downstream speed is different than upstream, you can also set the ActualSpeedUpstream property in Mbps. Graphs and alerts will reflect bandwidth utilization as a percentage of the configured speeds set in the properties.

Alternatively, you can override the detected speed by setting an instance level property in_speed and out_speed in bits per second (bps). Graphs and alerts will reflect bandwidth utilization as a percentage of the configured speeds set in the properties.

If both ActualSpeed and in_speed are set on a device or group, ActualSpeed takes precedence. Similarly, if both AcualSpeedUpstream and out_speed are set on a device or group, AcualSpeedUpstream takes precedence.

For more information on assigning properties at the instance level, see Resource and Instance Properties.

Disabling Interface Filtering to Detect Hidden Interfaces

Some interfaces, such as loopback, VLAN, or other Layer 2 and Layer 3 virtual ports, are automatically filtered out and may not be visible on network devices.

You can disable interface filtering to view these interfaces. To disable interface filtering, set interface.filtering = true as a device or group property. This disables all automatic filters and only Active Discovery filters within the module settings will apply. The Active Discovery filters can further be disabled through the Filters settings within the Active Discovery module settings. For more information, see Active Discovery and Filtering.

Changing the Interface Collection Method

Some devices may experience high CPU utilization or slow SNMP response times due to the SNMP implementation or hardware specifications. By default, interfaces are discovered by walking OIDs. However, it is possible to individually retrieve interfaces using get or in parallel with getconcurrent.

To change the collection method, set the device or group property interface.snmp.method to one of the following:

  • interface.snmp.method = walk — This is the default configuration for most devices. This configuration retrieves all interfaces at once, regardless of the Active Discovery instances retrieved.
  • interface.snmp.method = get — This configuration retrieves known interfaces one at a time. Only discovered interfaces are retrieved.
  • interface.snmp.method = getconcurrent — This configuration retrieves known interfaces in parallel. Only discovered interfaces are retrieved.
In This Article