From 4685ea13ccf06ea2ab21428d8d1c833613e7b601 Mon Sep 17 00:00:00 2001 From: Tony Murray Date: Mon, 18 Oct 2021 02:59:33 -0500 Subject: [PATCH] Port Speed degraded alert rule (#13371) * Port Speed degraded alert rule * don't include disabled ports either --- misc/alert_rules.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/misc/alert_rules.json b/misc/alert_rules.json index 2e5409f2f0..4de1c4a2d6 100644 --- a/misc/alert_rules.json +++ b/misc/alert_rules.json @@ -522,5 +522,9 @@ { "rule": "eventlog.message ~ \"Deleted\" && eventlog.datetime >= `DATE_SUB(NOW(),INTERVAL 12 Hour)`", "name": "A Device sensor has been deleted" + }, + { + "builder": {"condition":"AND","rules":[{"id":"ports.ifSpeed","field":"ports.ifSpeed","type":"string","input":"text","operator":"greater","value":"0"},{"id":"ports.ifSpeed","field":"ports.ifSpeed","type":"string","input":"text","operator":"less","value":"`ports.ifSpeed_prev`"},{"id":"eventlog.message","field":"eventlog.message","type":"string","input":"text","operator":"begins_with","value":"ifSpeed:"},{"id":"eventlog.datetime","field":"eventlog.datetime","type":"datetime","input":"text","operator":"greater_or_equal","value":"`macros.past_10m`"},{"id":"ports.port_id","field":"ports.port_id","type":"string","input":"text","operator":"equal","value":"`eventlog.reference`"},{"id":"ports.ifOperStatus","field":"ports.ifOperStatus","type":"string","input":"text","operator":"equal","value":"up"},{"id":"ports.disabled","field":"ports.disabled","type":"string","input":"text","operator":"equal","value":"0"}],"valid":true}, + "name": "Port Speed Degraded" } ]