...

• every X period of time, 5-15 minutes they want to collect the average interface utilisation for every interface being collected
• the average input and output interface utilisation will be calculated for the last X period of time 5 mins to X hours
• the highest utilisation of input or output will be selected, this is the interface utilisation
• the interface utilisation will be compared to a threshold level (should this be static or multi-level, e.g. just use the existing NMIS threshold values or other values)
• if the interface utilisation exceeds the threshold a special NOC event will be created.
• this can be the same as the existing NMIS events, but it needs to include the group name for the node
• all the regular features of NMIS interface alerts are excepted, which would include adding the interface description, bandwidth of the interface and the values of the threshold.

Sample event.
1388903720,NODENAME,Proactive Interface Utilisation,Critical,INTERFACENAME,INTERFACE DESCRIPTION Bandwidth=7168000: Value=93.17 Threshold=93,GROUPNAME

This event will either be sent as a syslog or logged to a file, either of which will be processed by NetCool.

Solution

An NMIS utility script which finds all the interfaces on all the nodes, performs the calculation on the interfaces and sends events to the configured syslog server.

...

To put into production, set a cron.d file, e.g. /etc/cron.d/interface_util_alerts

sudo cp /usr/local/nmis9/contrib/interface_util_alerts/interface_util_alerts.crond /etc/cron.d/interface_util_alerts 

Check the nmis.log for debug and info messages, check the configured syslog target to see the events.