From 1f1c11ee3249e417dbda4f4dd89cae81e36dba0e Mon Sep 17 00:00:00 2001 From: Ahmed Sajid Date: Tue, 19 Oct 2021 10:43:24 -0400 Subject: [PATCH] Added Unpolled Devices rule to collection (#12896) * Added Unpolled Devices rule to collection * fixing the incorrect syntax * Using different approach for determining if devices aren't polled * Update alert_rules.json * Update alert_rules.json * Update alert_rules.json Co-authored-by: Tony Murray --- misc/alert_rules.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/misc/alert_rules.json b/misc/alert_rules.json index 4de1c4a2d6..0b31461849 100644 --- a/misc/alert_rules.json +++ b/misc/alert_rules.json @@ -433,7 +433,7 @@ "rule": "%applications.app_type='portactivity' && %applications_metrics.imaps_total_from>'0'", "name": "IRCD Connections From" }, - { + { "rule": "customoids.customoid_current >= `customoids.customoid_limit` && customoids.customoid_alert = \"1\" && macros.device_up = \"1\"", "name": "CustomOID over limit" }, @@ -523,6 +523,10 @@ "rule": "eventlog.message ~ \"Deleted\" && eventlog.datetime >= `DATE_SUB(NOW(),INTERVAL 12 Hour)`", "name": "A Device sensor has been deleted" }, + { + "name": "Unpolled Devices", + "builder": {"condition":"AND","rules":[{"id":"macros.device","field":"macros.device","type":"integer","input":"radio","operator":"equal","value":"1"},{"id":"devices.last_polled","field":"devices.last_polled","type":"datetime","input":"text","operator":"less","value":"`DATE_SUB(NOW(), INTERVAL 6 MINUTE)`"}],"valid":true} + }, { "builder": {"condition":"AND","rules":[{"id":"ports.ifSpeed","field":"ports.ifSpeed","type":"string","input":"text","operator":"greater","value":"0"},{"id":"ports.ifSpeed","field":"ports.ifSpeed","type":"string","input":"text","operator":"less","value":"`ports.ifSpeed_prev`"},{"id":"eventlog.message","field":"eventlog.message","type":"string","input":"text","operator":"begins_with","value":"ifSpeed:"},{"id":"eventlog.datetime","field":"eventlog.datetime","type":"datetime","input":"text","operator":"greater_or_equal","value":"`macros.past_10m`"},{"id":"ports.port_id","field":"ports.port_id","type":"string","input":"text","operator":"equal","value":"`eventlog.reference`"},{"id":"ports.ifOperStatus","field":"ports.ifOperStatus","type":"string","input":"text","operator":"equal","value":"up"},{"id":"ports.disabled","field":"ports.disabled","type":"string","input":"text","operator":"equal","value":"0"}],"valid":true}, "name": "Port Speed Degraded"