Netwatch: How to avoid receiving continuous up and down emails

RouterOS General
1

Good morning everyone. I need to monitor some Mikrotik ATL devices, connected to my main router via Wireguard. With netwatch I created a rule that checks the reachability of the wireguard IP every 3 minutes, if the status changes it sends me an email.
The problem is that on some sites this status changes several times in a few minutes, therefore I receive dozens of down/up down/up emails, even if in reality the ATL device does not really lose the connection, since it continues to be reachable. It may be that it has a slight packet loss…
I tried to set thr. loss percent: 90.0 and thr. loss count: 50 but the situation has not improved.
Do you have any ideas to solve it?
I would like the system to try two or three times, and if all the times were negative it would send me the email, otherwise no.
Could I do this with TheDude? Or does not even Dude have this function?
Thanks to everyone

2

Then show off your netwatch configuration. We don’t see it.

3 



add comment="Script ATL LTE18" disabled=no down-script=":log error \"ATL18 is DOWN\"; \r\
    \n/tool e-mail send to=\"***ale@***ons.it\" subject=\"ATL LTE18 is DOWN at \$[/system clock get time]\" from=\"\$[/system identity get name] \
    \"\r\
    \n" host=10.100.90.106 http-codes="" ignore-initial-down=yes ignore-initial-up=yes \
    interval=30m name="ATL18" test-script="" thr-loss-count=50 \
    thr-loss-percent=90% type=icmp up-script=":log info \"ATL18 is UP\"; \
    \r\
    \n /tool e-mail send to=\"****le@***ons.it\" subject=\"ATL LTE18 is UP at \$[/system clock get time]\" from=\"\$[/system identity get name] \"\
    "
4

According to your export the interval is 30m (not “every 3 minutes” as claimed in original post). But this is not your problem.

I would start over new. Or at least remove “thr-loss-percent=90%” and “thr-loss-count=50”. The defaults are way more tolerant.

thr-loss-percent (Default: 85.0%)	Fail threshold for loss-percent
thr-loss-count (Default: 4294967295(max))

I don’t know about your connection to the wireguard device (how stable it is, how fast, how reliable, etc.), but keep in mind these defaults for the ICMP probe: https://help.mikrotik.com/docs/spaces/ROS/pages/8323208/Netwatch#Netwatch-icmp

Maybe it is your “thr-avg” exceeding the default 100ms and this is your issue. I guess you need to troubleshoot this step by step. Do manual pinging an see how it behaves. Then adjust netwatch ICMP probe options.

5

You can see which threshold gets breached, if you add Netwatch logging topic.

6

Thanks for your reply. How netwatch logging do you mean this?

Thank you
Simone

7

You are right! When doing single pings, sometimes the thr-avg reaches values ​​of 240-370 ms, for this reason netwatch triggers it as down.
I removed all the manual values ​​previously set and set a manual thr-avg of 700 ms. A threshold much higher than the maximum recorded in these tests, and I set the interval again every 3 minutes (I had set it to 30 minutes to avoid being inundated with emails)
Thank you

8

By logging I meant “/system logging add topics=netwatch”, in log you will be able to see which values were OK and which ones failed, if there are any.