NetXMS Support Forum

Looking for some suggestions on the best way to handle a situation we currently have in our alarm monitoring.  If a device is down it will generate the Critical alarm from SYS_NODE_DOWN and that is excellent and what we want.  However, it will also generate a Minor alarm from SYS_IF_DOWN on the switch that the device is connected to.  Looking for ideas on the best way to correlate these two events so that only the Critical one is triggered or when it triggers it clears / prevents the Minor interface alarm.

Thanks!

If you are not interested in port down events on switches you can block them in event processing policy. You can also block only those for switch ports where peer node is known (by using filter script that will check interface object for peer information) - that way you will have alarms for interfaces where something not monitored by NetXMS is connected but not for those where known nodes are connected.

Best regards,
Victor

I thought it would be best to only block where peer node is know, so I tried adding the following filter:

return ($object->peerNode == null);

That is causing issues and the EPP is logging errors to the alarm browser with unknown object's attribute. 

The problem here is that $object for SYS_IF_DOWN points to node object, not interface object. Correct script will look like this:


iface = $node->getInterface($event->parameters[5]);
return iface != null and iface->peerNode == null;


Best regards,
Victor

Victor,

Thanks for the code correction!  Seems now that we are seeing this issue:

https://www.netxms.org/forum/general-support/no-peer-in-object-details/

I looked at the switch of the device I was testing with and only 3 of the 15+ ports that have devices attached were showing a peer node.  Will wait for a release that addresses that issue and the do further testing.  Thanks!