Interface Status Alerting
Last updated on 17 March, 2023LogicMonitor provides out-of-the-box SNMP-based monitoring for interfaces through the SNMP_Network_Interfaces module. This DataSource provides interface monitoring across vendors with a uniform, robust dataset. There are several ways to customize your interface monitoring with this module using device or instance level properties to determine status alerting, filtering, bandwidth utilization, and collection method.
Requirements for Interface Status Alerting
Ensure that the latest version of the the SNMP_Network_Interfaces module is installed. For more information, see Logic Module Updates.
Status Change Alert Properties
Note: The features described in this section are available starting in version 2.0 of this module.
LogicMonitor generates alerts when interfaces change status from up to down. This is helpful for alerting about switch ports that connect to servers, routers, or inter-switch links, but is less useful if the ports connect to workstations that you expect to shut off everyday. By default, LogicMonitor detects all active interfaces, on all devices, and alerts if an interface changes status. The following properties are available:
Property | ILP |
interface.description.alert_enable | system.instanceDescription |
interface.alias.alert_enable | auto.interface.alias |
interface.wildalias.alert_enable | auto.interface.wildalias |
You can set one or more of the properties listed on a device or device group to set which interfaces alert on status. If a device has this property set, or if it inherits this property, it will only trigger status alerts for interfaces where the corresponding instance level property (ILP) matches the regular expression contained in that property. All other active ports will be discovered and monitored, but not have their status changes (or flapping) alerted on.
Note: Confirm the regular expression before modifying the properties above to ensure that the alerting changes provide the expected result.
Sample Property Configurations
Condition | Description |
Alert for status changes based on keyword | Set interface.description.alert_enable property to the value core|uplink on a group to cause all network devices in that group to alert for status changes on interfaces with the words core or uplink in the auto.interface.description property. All other interfaces are monitored, but status alerting is not enabled. Other alerts, such as for excessive discards or graphing of data, are still active. |
Exclude status monitoring | Set the property interface.alias.alert_enable=^((?!bridge).)*$ t o exclude status monitoring for all interfaces with the word bridge in the auto.interface.alias property. |
Interface Usage Based on Configured Speed
By default, LogicMonitor monitors interface bandwidth usage as a percentage of the interface’s physical capacity. This is a percentage of your physical link speed, which may not reflect any configured limits imposed by your uplink provider. You can manually override the detected link speed by setting one of the following properties on the interface level:
Property Name | Value | Description |
ActualSpeed | Numeric value in megabits per second (Mbps) | The speed for both downstream and upstream for a given interface. |
ActualSpeedUpstream | Numeric value in Mbps | The upstream speed for a given interface. When set in conjunction with ActualSpeed , this property overrides the upstream value set by Actual Speed. |
in_speed | Numeric value in bits per second (bps) | The in speed for a given interface. |
out_speed | Numeric value in bps | The out speed for a given interface. |
For more information on assigning properties at the instance level, see Resource and Instance Properties.
Interface Filtering
Some interfaces, such as loopback, VLAN, or other Layer 2 and Layer 3 virtual ports, are automatically filtered and may not be visible on network devices. Use the following setting to disable interface filtering, so that you can view these interfaces:
Filtering Setting | Description |
interface.filtering = true | Disables all automatic filters. Only Active Discovery filters within the module settings will apply. The Active Discovery filters can further be disabled through the Filters settings within the Active Discovery module settings. |
For more information, see Active Discovery and Filtering.
Interface Collection Method
Some devices may experience high CPU usage or slow SNMP response times due to the SNMP implementation or hardware specifications. By default, interfaces are discovered by walking object identifiers (OIDs). However, it is possible to individually retrieve interfaces using get
or in parallel with getconcurrent
. The following interface.snmp.method
configurations are available:
Configuration | Description |
interface.snmp.method = walk | Default configuration for most devices. This configuration retrieves all interfaces at once, regardless of the Active Discovery instances retrieved. |
interface.snmp.method = get | Retrieves known interfaces one at a time. Only discovered interfaces are retrieved. |
interface.snmp.method = getconcurrent | Retrieves known interfaces in parallel. Only discovered interfaces are retrieved. |
Interface Status Alerting Customizations
The following customizations may be helpful for blocking metrics or adjusting the number of threads.
- Set a CSV list of metrics to
interface.blockedMetrics
to block specific metrics from being extracted in Active Discovery and Collection. - Set
interface.poolsize
to adjust the number of threads used to extract data via concurrent GET requests (default is 20, max allowed is 30).