Table of contents

Summary

The NOC team of a service provider needed to get very specific alerts sent to their instance of NetCool from NMIS.

This solution leverages the nocSyslog.nmis from the related solution.

Requirement

• every X period of time, 5-15 minutes they want to collect the average interface utilisation for every interface being collected
• the average input and output interface utilisation will be calculated for the last X period of time 5 mins to X hours
• the highest utilisation of input or output will be selected, this is the interface utilisation
• the interface utilisation will be compared to a threshold level (should this be static or multi-level, e.g. just use the existing NMIS threshold values or other values)
• if the interface utilisation exceeds the threshold a special NOC event will be created.
• this can be the same as the existing NMIS events, but it needs to include the group name for the node
• all the regular features of NMIS interface alerts are excepted, which would include adding the interface description, bandwidth of the interface and the values of the threshold.

...

This event will either be sent as a syslog or logged to a file, either of which will be processed by NetCool.

Solution

An NMIS utility script which finds all the interfaces on all the nodes, performs the calculation on the interfaces and sends events to the configured syslog server.

...

Aug 25 17:55:01 volla interface_util_alerts.pl[4264]: NMIS_Event::volla::1661414101,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/0,123 -- Opmantek LAN -- Bandwidth=100000000 -- Value=11.95 Threshold=10
Aug 25 17:55:01 volla interface_util_alerts.pl[4264]: NMIS_Event::volla::1661414101,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/1,123 -- WAN -- Bandwidth=100000000 -- Value=11.92 Threshold=10
Aug 25 18:23:06 volla interface_util_alerts.pl[7621]: NMIS_Event::volla::1661415786,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/0,123 -- Opmantek LAN -- Bandwidth=100000000 -- Value=6.48 Threshold=5
Aug 25 18:23:06 volla interface_util_alerts.pl[7621]: NMIS_Event::volla::1661415786,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/1,123 -- WAN -- Bandwidth=100000000 -- Value=6.45 Threshold=5

Installation

The code for this solution is included in the NMIS9 contrib folder which is available in the installation or from NMIS9@GitHub, it will be in the folder nmis9/contrib/interface_util_alerts

...

%hash = (
  'syslog' => {
    'syslog_facility' => 'local3',
    'syslog_server' => 'localhost:udp:514',
    'extra_logging' => 1,
  }
);

Run it

To run it on a single node.

...

Check the nmis.log for debug and info messages, check the configured syslog target to see the events.

Local Syslog Testing

To test locally, add the following to /etc/rsyslog.conf for testing and restart syslogd.

...