Interface Status Alerting

Last updated on 17 January, 2023

LogicMonitor provides out-of-the-box SNMP-based monitoring for interfaces through the SNMP_Network_Interfaces module.  This DataSource provides interface monitoring across vendors with a uniform, robust dataset.  There are several ways to customize your interface monitoring with this module using device or instance level properties to determine status alerting, filtering, bandwidth utilization, and collection method.

Requirements for Interface Status Alerting

Ensure that the latest version of the the SNMP_Network_Interfaces module is installed. For more information, see Logic Module Updates.

Status Change Alert Properties

Note: The features described in this section are available starting in version 2.0 of this module.

LogicMonitor generates alerts when interfaces change status from up to down. This is helpful for alerting about switch ports that connect to servers, routers, or inter-switch links, but is less useful if the ports connect to workstations that you expect to shut off everyday. By default, LogicMonitor detects all active interfaces, on all devices, and alerts if an interface changes status. The following properties are available:


You can set one or more of the properties listed on a device or device group to set which interfaces alert on status. If a device has this property set, or if it inherits this property, it will only trigger status alerts for interfaces where the corresponding instance level property (ILP) matches the regular expression contained in that property. All other active ports will be discovered and monitored, but not have their status changes (or flapping) alerted on.

Note: Confirm the regular expression before modifying the properties above to ensure that the alerting changes provide the expected result.

Sample Property Configurations

Alert for status changes based on keywordSet interface.description.alert_enable property to the value core|uplink on a group to cause all network devices in that group to alert for status changes on interfaces with the words core or uplink in the auto.interface.description property. All other interfaces are monitored, but status alerting is not enabled. Other alerts, such as for excessive discards or graphing of data, are still active.
Exclude status monitoringSet the property interface.alias.alert_enable=^((?!bridge).)*$ to exclude status monitoring for all interfaces with the word bridge in the auto.interface.alias property.

Interface Usage Based on Configured Speed

By default, LogicMonitor monitors interface bandwidth usage as a percentage of the interface’s physical capacity. This is a percentage of your physical link speed, which may not reflect any configured limits imposed by your uplink provider. You can manually override the detected link speed by setting one of the following properties on the interface level:

Property NameValueDescription
ActualSpeedNumeric value in megabits per second (Mbps)The speed for both downstream and upstream for a given interface.
ActualSpeedUpstreamNumeric value in MbpsThe upstream speed for a given interface. When set in conjunction with ActualSpeed, this property overrides the upstream value set by Actual Speed.
in_speedNumeric value in bits per second (bps)The in speed for a given interface.
out_speedNumeric value in bpsThe out speed for a given interface.

For more information on assigning properties at the instance level, see Resource and Instance Properties.

Interface Filtering

Some interfaces, such as loopback, VLAN, or other Layer 2 and Layer 3 virtual ports, are automatically filtered and may not be visible on network devices. Use the following setting to disable interface filtering, so that you can view these interfaces:

Filtering SettingDescription
interface.filtering = trueDisables all automatic filters. Only Active Discovery filters within the module settings will apply. The Active Discovery filters can further be disabled through the Filters settings within the Active Discovery module settings.

For more information, see Active Discovery and Filtering.

Interface Collection Method

Some devices may experience high CPU usage or slow SNMP response times due to the SNMP implementation or hardware specifications. By default, interfaces are discovered by walking object identifiers (OIDs). However, it is possible to individually retrieve interfaces using get or in parallel with getconcurrent. The following interface.snmp.method configurations are available:

interface.snmp.method = walkDefault configuration for most devices. This configuration retrieves all interfaces at once, regardless of the Active Discovery instances retrieved.
interface.snmp.method = getRetrieves known interfaces one at a time. Only discovered interfaces are retrieved.
interface.snmp.method = getconcurrentRetrieves known interfaces in parallel. Only discovered interfaces are retrieved.

Interface Status Alerting Customizations

The following customizations may be helpful for blocking metrics or adjusting the number of threads.

  • Set a CSV list of metrics to interface.blockedMetrics to block specific metrics from being extracted in Active Discovery and Collection.
  • Set interface.poolsize to adjust the number of threads used to extract data via concurrent GET requests (default is 20, max allowed is 30).
In This Article