Spanning tree/loop detection alerts
I’m looking to see if anyone has a way they are detecting network loops or generally using spanning tree information to alert that a loop has been detected. It would seem like something that would be built in but I can’t find anything. I’m mostly trying to catch end users that plug in things they shouldn’t
Needed Features for Network Topology Mapping
We need the ability to create topology map of our switches and routers showing the actual links between interfaces on the devices and showing the latest InMbps / OutMbps datapoints for each interface. The goal is to have a live network map for networks likeInternet Service Provider networks, to be able to visualize the active state of the network and the bandwidth utilization and alert status of each device and interface / link. We need to be able to do the following: - Manually add the switch and router resources to the map. - Once the resource is on the map, click on the resource on the map and select an interface instance from the "network interfaces" LogicModule to add to a "Link". Then drag over to, or select, the connected resource, and select the associated interface instance from the "network interfaces" LogicModule on the second device. - This will visually show a link between the two devices, and the InMbps and/or OutMbps datapoints should be displayed over the link on each end of the link. - The color of each half or end of the link should also change based on the highest active alert level for the associated "network interfaces" instance on that end of the link. So for example, If we have Router1 interface GigEth0/1 connected to Router2 GigEth0/2, and Router1 GigEth0/1 has an active warning level alert for InBroadcastPkts, then that half of the line representing the link, should turn to yellow. - It's not enough to simply outline the resource with a color based on the alert level of the resource. We need to visually see each desired interface / link on the map and see visually which interface(s) is/are alerting. LogicMonitor has done an absolutely outstanding job of giving us immense flexibilty in how we can represent any datapoint on widgets on dashboards. But when it comes to the Topology mapping, we’re severely limited in how we can represent the exact same datapoints visually on the map. Also, for these kind of use-cases, people managing these kinds of network generally already know how their devices are connected, or can easily identify the connectivity. We don’t really need LogicMonitor to automatically detect connections between devices, because that’s too big of a challenge to automate that well. We just need to be able to manually say, “This interface on this device connects to this interface on this device. That’s a link.” The link itself is actually comprised of two sides, each being an instance on theresource’s LogicModule. And it could be “Interfaces 64 bit” or “Network Interfaces” or whatever other LogicModule we need. When we make w widget, we can select whatever LogicModule and Instance we need. We should be able to do the same thing on the topology map.
Finding the culprit for TCP_StatsCollector ConnectionsEstablished alert for Windows collectors
From the collector’s device page in the LM Portal or the collectors page, get to a debug console, then here’s your !POSH one-liner to get info about the destination device that is holding your ports captive. netstat -an| sls establish | foreach { ($_ -split "\s+")[3] } | group | sort count | select count, name -last 10 In the Netstat, a shows all, n shows IP addresses rather than solving the DNS for it. TheSelect-String (aliased as sls)passes only the “Established” connection entries from the netstat down the pipeline. The foreach{} splits each line ($_ is the current object being iterated by the foreach loop) on contiguous whitespace (I use this a lot!) and takes the third element (remote address:port) to passdown the pipeline It then passes Group-Object (aliased as group) which bundles identical strings and Sort-Object (aliased as sort)by the count property of the group object. The select displays grabs the calculated match count and the name properties to limit display and just shows the -last 10 of them (which are the biggest number of matched lines due to the sort previously applied. This should give you the target/s for troubleshooting further.
