Cisco Switch ErrDisabled Status on Port | LM Exchange

sawyer_lef · 2018-07-17T17:55:55Z

Datasource that uses active discover to find ports in errdisabled state and create an Error in LogicMonitor LM Exchange: GR4XMN

LM User

·4 years ago

57 minutes ago, mnagel said:

Feature requests rarely result in any constructive activity and they lack basic support for escalation, voting, etc.

We are working on this and should have some news to share next quarter. Hint hint, the communities are finally getting official attention/sponsorship from LM.

mnagel

·4 years ago

1 minute ago, Stuart Weenig said:

Agreed, a DataSource would fix the multiple alerts that results from an EventSource running.

Although i think the larger question of alert correlation (multiple alerts being statically or dynamically grouped into incidents) is something you should be requesting from your CSM. Even something like occurrence counts on alerts would be good. The same problem happens with SNMP traps; traps can come in every minute and be about the same thing still in an unwanted state. Each one should just increment a counter on the alert. Counter thresholds should be something we can add to alert rules. Even regular datapoints could benefit from this, counting the number of poll cycles/minutes that a particular metric has been over threshold.

Sounds like submitting to CSM should work, but here is usually what happens. "You should submit a feature request or feedback item." To me, those have a pretty small chance of success, so I have stopped trying except in a few cases. I once was able to peer into the feedback tickets via export and discuss with our CSM, but those are normally complete blackholes. Feature requests rarely result in any constructive activity and they lack basic support for escalation, voting, etc. Really we need one ticket system to be able to track all of these things with suitable categories (which I have also suggested that multiple times).

And yes, every event source should have the ability to correlate new events with open events. I have been pushing for this for a long time, but I suspect now the answer is "get LMLogs" and this will never get any traction.

Being able to get data averages datapoints over time has also been a long-time open request. This is important to look for issues where the status might oscillate, but overall levels are high (e.g., resource usage like CPU, bandwidth, etc.).

LM User

·4 years ago

2 hours ago, mnagel said:

I think the only reasonable solution is to redo the code into a datasource, like originally discussed in this thread.

Agreed, a DataSource would fix the multiple alerts that results from an EventSource running.

Although i think the larger question of alert correlation (multiple alerts being statically or dynamically grouped into incidents) is something you should be requesting from your CSM. Even something like occurrence counts on alerts would be good. The same problem happens with SNMP traps; traps can come in every minute and be about the same thing still in an unwanted state. Each one should just increment a counter on the alert. Counter thresholds should be something we can add to alert rules. Even regular datapoints could benefit from this, counting the number of poll cycles/minutes that a particular metric has been over threshold.

mnagel

·4 years ago

2 minutes ago, Shack said:

This is doing exactly what we want but with one problem. How do you stop a scripted event source from creating duplicate alerts every time it connects and runs? Hmmm I wonder if I can do something with my Escalation Chain.

It would be awesome to be able to suppress these IF it detected the same port was disabled and an existing alert was already active based on message matching or something. I need a checkbox similar to the checkbox on the Windows Event Logging type Event Source.

Event sources are a poor solution for generate alerts, though it is very desirable that they can. I have requested for a long time there be a way to correlate events via a key extracted from the event so you know it is the same event (this is trivial with many event solutions, including the incredibly awesome FOSS SEC tool). Among other things, you cannot even ACK an event effectively since the next run is a brand new result, but the email instructions still list ACK as an option and our clients believe it works.

I think the only reasonable solution is to redo the code into a datasource, like originally discussed in this thread.

Shack

·4 years ago

This is doing exactly what we want but with one problem. How do you stop a scripted event source from creating duplicate alerts every time it connects and runs? Hmmm I wonder if I can do something with my Escalation Chain.

It would be awesome to be able to suppress these IF it detected the same port was disabled and an existing alert was already active based on message matching or something. I need a checkbox similar to the checkbox on the Windows Event Logging type Event Source.

mnagel

·4 years ago

Should be fixed now. I still would like to redo this as a datasource with per-port instances. Event sources are not very useful without inter-event correlation, but better than not knowing what is going on :).

Shack

·4 years ago

On 9/28/2021 at 7:57 PM, Michael Rodrigues said:

It's out of review now.

Still getting the below error when searching on H4T9GH

ERROR

LogicModule belongs to another private repository.

Michael Rodrigues

·4 years ago

It's out of review now.

mnagel

·4 years ago

OK, cool. It has only been there for years now, so I am sure it will be reviewed very soon :). More seriously, I have requested from the LM Exchange developers before an "escalate" button to get more attention on these, but so far I think there is no reliable process for getting code approved.

Shack

·4 years ago

H4T9GH apparently is in a security review state and not available in the exchange. I get an error when attempting to look it up. Support has given me a different version to test with.

mnagel

·4 years ago

2 hours ago, Shack said:

Mind sharing yours? I think I may have a need for this and I am licensed for LMConfig

It was published to the Exchange as H4T9GH, but it is basically what LM support provided with some tweaks. As an Event Source, it has the same poor behavior as all Event Sources, that is, you cannot practically ACK them, only add SDT. It also is not universal since there are different ways to get this info on different platforms.

I like the idea of converting to a DS version with instances like the first post mentioned, and of course we are all still waiting for that promised core LM release real soon now :).

Shack

·4 years ago

On 11/30/2018 at 8:12 PM, mnagel said:

The one I am using has an ugly side effect -- if you only want to do this and you have LMConfig, you will activate LMConfig since you must define ssh.user and ssh.pass for this, just like what is needed for LMConfig. I recommended to our CSM that LMConfig should require a specific activation property as it is a premium feature that should not be inadvertently activated, but that did not seem to go anywhere. The only option otherwise is to manually edit every CS to adjust the applies-to formula, which then must be updated every time a new version arrives (though I am told better merging is just around the corner...fingers crossed!)

Mind sharing yours? I think I may have a need for this and I am licensed for LMConfig

mnagel

·7 years ago

The one I am using has an ugly side effect -- if you only want to do this and you have LMConfig, you will activate LMConfig since you must define ssh.user and ssh.pass for this, just like what is needed for LMConfig. I recommended to our CSM that LMConfig should require a specific activation property as it is a premium feature that should not be inadvertently activated, but that did not seem to go anywhere. The only option otherwise is to manually edit every CS to adjust the applies-to formula, which then must be updated every time a new version arrives (though I am told better merging is just around the corner...fingers crossed!)

sawyer_lef

OP8 years ago

Sounds good. What new features will be coming along?

Andrey_Kitsen

·8 years ago

@sawyer.lef funny enough, we're close to releasing our core version of this.

I'l let you know when it becomes available.