Hello,
I am receiving SNMP traps. I need to create an alert when I receive a trap for a specific OID (.1.3.6.1.4.1.2620.1.3000.5.2.1), but only If I didn't receive any traps for that OID for a day.
I am receiving some traps very frequently (every 20 seconds), but I don't want the alert to be triggered every 20 seconds. I want to trigger the alert if I receive a trap that didn't come for 24 hours.
I.E:
I can search the traps with the following: index="snmp-trap-cust" snmp_index=.1.3.6.1.4.1.2620.1.3000.5.2.1
How can I achieve this?
Thank you very much.
Schedule your alert for something like every hour with a time frame from -24h@h
to @h
and trigger when # of events is equal to 1
:
index="snmp-trap-cust" snmp_index=.1.3.6.1.4.1.2620.1.3000.5.2.1
If more than one trap is been triggered when the alert is evaluating the conditions, It won't trigger.
Thanks again!!
Are you saying that this will work or that there is still a problem?
There's still a problem. Because I can not be sure that when the alert condition is evaluated, only 1 trap has been received. Maybe I received more then one and I still need to trigger the alert.
Thank you.
Only if the two are separated by the hour boundary, which I admit is possible. Now you are talking about a real-time alert based on a 24-hour window. This is VERY DANGEROUS to your cluster but you can set the timerange from rt-24h
to rt
. You will probably need to throttle this to 1 notification in 24-hours, but I am not sure as I do not run realtime alerts.
I was thinkning on non rt alerts. But scheduled every 5 minutes instead.
In that case if more than one trap arrives during those five minutes, # of events will be greater than 1
Yes, it is a question of granularity of concern for consecutive searches. You have a solution, now you just need to make a decision on your risk/granularity.
Try like this
index="snmp-trap-cust" snmp_index=.1.3.6.1.4.1.2620.1.3000.5.2.1 earliest=-25h latest=@m | streamstats current=f window=1 values(_time) as prev_time | where prev_time-_time>86400
When you save your search as an Alert
, there is a throttling mechanism that you can set for "Do not trigger again until 24 hours later".
Hi,
But I don't want to supress the alert for 24 hours.
I want to trigger the alert ONLY if there's been 24 hours without an event with the trap appears.