Network Interface ID Persistence or: How I Learned to Stop Worrying and Love SNMP_Network_Interfaces

RE issues like these:
How is everyone else handling network interface ID changes? | LogicMonitor - 14445 
Network Interface - Duplicates/Nulls | LogicMonitor - 15666 

This is a very common customer issue when the device either does not support, or is not enabled with, "snmp ifindex persist". This can cause duplicate DataSource instances being created when these IDs are updated. The ultimate fix here is to enable snmp ifindex persist, but that might not be an option. 

For just a bit of context, the ifIndex is the only thing that is guaranteed to be unique across all vendors which is why it is the WILDALIAS (unique identifier). All this to say, there is no one-size-fits-all solution. Our module team made this choice to lower the potential risk of losing data and to provide the most reliable core/supported solution. 

I'm creating this post in hopes of providing people with options and help lower the number of support tickets we see about this 😁. 

This post assumes the reader understands the basics of Active Discovery and the difference between wildalias and wildvalue. This is a great learning resource: Introduction to DataSources 

🚨 Now entering unsupported territory! 🚨

Since I am in Support, I am obligated to mention that the following solutions are not supported by the LM Support team. Customers should exercise caution and thoroughly test any and all workarounds within their sandbox portal. 

We highly highly recommend cloning the core "SNMP_Network_Interfaces" DS first! You will very likely lose historical data.

I'm also only going over this using "SNMP_Network_Interfaces" and not the DS for Windows or SSH interfaces. 

You have been warned.

Alright already... so what's the fix? Well, there are 2 main workarounds.

Option 1: WILDVALUE as ifName and unique identifier

Portal version 204 had an update for the DataSource "SNMP_Network_Interfaces" to allow using ifName instead of ifIndex for the instance WILDVALUE with the host property "interface.wildvalue.ifname".

Release note mention: https://www.logicmonitor.com/release-notes/v-204-release-notes#h-updated-logicmodules 

Mention in SMNP Network Interface Monitoring  support page:

Mention in "SNMP_Network_Interfaces" technical notes: 

So that's all cool, BUT (and this is crucial) the unique identifier for instances is still the WILDALIAS which remains unchanged by this whole thing... 

You will then need to toggle on "Use Wildvalue as Unique Identifier" within the DS settings:

*** This is NOT reversible and will result in loss of historical data. Also, enabling this on a core module will impact your ability to import updates to that module.  ***

Ok, sorry just really have to make sure that's super clear...

After that, you should be all set. If the ifIndex updates, the WILDALIAS will update with the new ID but the WILDVALUE will remain the same (unless for some reason the ifName also changes) and no new instance discovered. YAY! 🎉

Option 2: Change the Active Discovery script

This is certainly the more flexible workaround. I mean you can update the Active Discovery script to do literally anything. The simplest change is to just remove the ID from the WILDALIAS.

Again, be sure to CLONE the DataSource first! 

That would look something like this.

This line (around line 320):

def alias = "${ifEntry.description} [ID:${ifIndex}]"

would be updated to be:

def alias = "${ifEntry.description}"

of course there are other potential tweaks but this is all very much dependent on the environment and each device. For example, with this specific edit, the uniqueness is now dependent on the interface description which, as previously mentioned, might not be unique. You can set this 'alias' variable to the ifName or something totally different if you really want. 

But, again, you should be all set. YAY! 🎉

 

In both scenarios, I would recommend only applying this cloned version of the SNMP_Network_Interfaces to devices that don't have the option to persist the ifindex and keep the core version applied to all other devices. 

Feel free to share any other workarounds you may know of or are using!