Interface Status Alerting

LogicMonitor provides out-of-the-box SNMP-based monitoring for interfaces through the SNMP_Network_Interfaces module.  This DataSource provides interface monitoring across vendors with a uniform, robust dataset.  There are several ways to customize your interface monitoring with this module using device or instance level properties to determine status alerting, filtering, bandwidth utilization, and collection method.

Requirements for Interface Status Alerting

Ensure that the latest version of the the SNMP_Network_Interfaces module is installed. For more information, see Logic Module Updates.

Status Change Alert Properties

LogicMonitor generates alerts when interfaces change status from up to down. This is helpful for alerting about switch ports that connect to servers, routers, or inter-switch links, but is less useful if the ports connect to workstations that you expect to shut off everyday. By default, LogicMonitor detects all active interfaces, on all devices, and alerts if an interface changes status. The following properties are available:

Property	ILP
interface.description.alert_enable	system.instanceDescription
interface.alias.alert_enable	auto.interface.alias
interface.wildalias.alert_enable	auto.interface.wildalias

You can set one or more of the properties listed on a device or device group to set which interfaces alert on status. If a device has this property set, or if it inherits this property, it will only trigger status alerts for interfaces where the corresponding instance level property (ILP) matches the regular expression contained in that property. All other active ports will be discovered and monitored, but not have their status changes (or flapping) alerted on.

Sample Property Configurations

Condition	Description
Alert for status changes based on keyword	Set interface.description.alert_enable property to the value core|uplink on a group to cause all network devices in that group to alert for status changes on interfaces with the words core or uplink in the auto.interface.description property. All other interfaces are monitored, but status alerting is not enabled. Other alerts, such as for excessive discards or graphing of data, are still active.
Exclude status monitoring	Set the property interface.alias.alert_enable=^((?!bridge).)*$ to exclude status monitoring for all interfaces with the word bridge in the auto.interface.alias property.

Interface Usage Based on Configured Speed

By default, LogicMonitor monitors interface bandwidth usage as a percentage of the interface’s physical capacity. This is a percentage of your physical link speed, which may not reflect any configured limits imposed by your uplink provider. You can manually override the detected link speed by setting one of the following properties on the interface level:

Property Name	Value	Description
ActualSpeed	Numeric value in megabits per second (Mbps)	The speed for both downstream and upstream for a given interface.
ActualSpeedUpstream	Numeric value in Mbps	The upstream speed for a given interface. When set in conjunction with ActualSpeed, this property overrides the upstream value set by Actual Speed.
in_speed	Numeric value in bits per second (bps)	The in speed for a given interface.
out_speed	Numeric value in bps	The out speed for a given interface.

For more information on assigning properties at the instance level, see Resource and Instance Properties.

Interface Filtering

Some interfaces, such as loopback, VLAN, or other Layer 2 and Layer 3 virtual ports, are automatically filtered and may not be visible on network devices. Use the following setting to disable interface filtering, so that you can view these interfaces:

Filtering Setting	Description
interface.filtering = true	Disables all automatic filters. Only Active Discovery filters within the module settings will apply. The Active Discovery filters can further be disabled through the Filters settings within the Active Discovery module settings.

For more information, see Active Discovery and Filtering.

Interface Collection Method

Some devices may experience high CPU usage or slow SNMP response times due to the SNMP implementation or hardware specifications. By default, interfaces are discovered by walking object identifiers (OIDs). However, it is possible to individually retrieve interfaces using get or in parallel with getconcurrent. The following interface.snmp.method configurations are available:

Configuration	Description
interface.snmp.method = walk	Default configuration for most devices. This configuration retrieves all interfaces at once, regardless of the Active Discovery instances retrieved.
interface.snmp.method = get	Retrieves known interfaces one at a time. Only discovered interfaces are retrieved.
interface.snmp.method = getconcurrent	Retrieves known interfaces in parallel. Only discovered interfaces are retrieved.

Interface Status Alerting Customizations

The following customizations may be helpful for blocking metrics or adjusting the number of threads.

• Set a CSV list of metrics to interface.blockedMetrics to block specific metrics from being extracted in Active Discovery and Collection.
• Set interface.poolsize to adjust the number of threads used to extract data via concurrent GET requests (default is 20, max allowed is 30).