Community discussions

MikroTik App
 
User avatar
tomasi
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 84
Joined: Fri Oct 03, 2014 6:40 pm
Location: Brazil
Contact:

Alerts based on throughput threshold

Mon Sep 11, 2017 5:09 am

Hi,

Is it possible to generate alerts based on throughput thresholds?

e.g.: my upstream providers give us 1 Gbps each one.
I want to receive alerts when traffic is too high or low.

:D
 
User avatar
jspool
Member
Member
Posts: 425
Joined: Sun Oct 04, 2009 4:06 am
Location: Oregon

Re: Alerts based on throughput threshold

Mon Sep 11, 2017 5:31 am

Hi,

Is it possible to generate alerts based on throughput thresholds?

e.g.: my upstream providers give us 1 Gbps each one.
I want to receive alerts when traffic is too high or low.

:D
/tool traffic-monitor
https://wiki.mikrotik.com/wiki/Manual:T ... ic_Monitor
http://bfy.tw/Dr12

Just setup a script to email you and place it in the "on event"

https://wiki.mikrotik.com/wiki/Manual:Tools/email
 
User avatar
tomasi
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 84
Joined: Fri Oct 03, 2014 6:40 pm
Location: Brazil
Contact:

Re: Alerts based on throughput threshold

Tue Sep 12, 2017 8:36 pm

Thank you! This tool helps a lot :)

The only problem I see is:
the tool doesn't have a delay parameter to avoid congestion of alerts.

I've tried to generate a warning log every time interface traffic crosses thresholds (above 960M or below 1M).
The logs were generated correctly, but my Slack channel was overflowed.

Is there a way to improve the usage of this tool?
Which method do you use to send alerts to smartphone when traffic crosses these thresholds?

:D
 
User avatar
jspool
Member
Member
Posts: 425
Joined: Sun Oct 04, 2009 4:06 am
Location: Oregon

Re: Alerts based on throughput threshold

Tue Sep 12, 2017 9:42 pm

With scripting on Mikrotik's you can generally accomplish anything if you are willing to dive in and experiment a bit.

Just off the top of my head - Probably could do better with more time
You could place the following in your monitor script area:
Add your alerting code where indicated or call a script whatever method you prefer.

This code will check to see if it has already ran and if so it will discard the alert until the global variable is set to "Normal"
If the global is "Normal" and the bandwidth alert is triggered after executing will set the global to "Alerting" thus preventing additional runs until the scheduler makes its rotation and resets the global to "Normal" thus enabling alerts again.
:global lastbwStatus

# check to see if global exists and if not create default value
:if (($lastbwStatus != "Normal") && ($lastbwStatus != "Alerting")) do={
:set $lastbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastbwStatus = "Normal") do={
# alert script here
:log warning "Bandwidth Alert"
:set $lastbwStatus Alerting
} else={
:log info "System already has already alerted - discarding alert"
}

Now you can run system scheduler at the desired interval to clear the "Alerting" status and enable another alert.
/system scheduler
add interval=15m name=Bandwidth-Alerting-Interval on-event=":global lastbwStatus\r\
    \n:set \$lastbwStatus Normal;" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
 
User avatar
LatinSuD
Member Candidate
Member Candidate
Posts: 174
Joined: Wed Jun 29, 2005 1:05 pm
Location: Spain
Contact:

Re: Alerts based on throughput threshold

Wed Apr 17, 2019 3:13 pm

It does not work on 6.39.2

Nor does this:
https://wiki.mikrotik.com/wiki/Manual:S ... imitations
 
rustybike
just joined
Posts: 2
Joined: Mon Mar 09, 2020 11:49 pm

Re: Alerts based on throughput threshold

Sat Mar 14, 2020 2:54 pm

Here is what I have built from jspool's head start (thanks, I owe you a beer). I hope this helps someone else. It is a high bandwidth alert with secondary alert when bandwidth has returned to normal levels...

(it assumes you have Tools > Email worked out and you have created your own Traffic Monitor items for inbound / outbound, high / normal)
################ BW Alert Scheduler (enter in console) ################

/system scheduler add interval=5m name=High-BW-Alert-Int on-event=":global lastHbwStatus;\r\
    \n:set \$lastHbwStatus Normal;" policy=read,write,policy,test start-time=startup

################ In ether1 High Script (on event, Traffic Monitor)################

# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Inbound Traffic Too High on ether1 $rx Mbps";

/tool e-mail send body="Inbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}

################ In ehter1 Normalized Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}

# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Inbound Traffic Normalized on ether1 $rx Mbps";

/tool e-mail send body="Inbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}

################ Out ether1 High Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Too High on ether1 $tx Mbps";

/tool e-mail send body="Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}

################ Out ether1 Normalized Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}

# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Normalized on ether1 $tx Mbps";

/tool e-mail send body="Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}

 
jonathanxpeers
just joined
Posts: 5
Joined: Thu Aug 25, 2011 11:14 am
Location: South Africa
Contact:

Re: Alerts based on throughput threshold

Tue Apr 21, 2020 12:26 pm

Hi there

Thank you for this script, I am just having a few issues, but it is my lack of understanding



(it assumes you have Tools > Email worked out and you have created your own Traffic Monitor items for inbound / outbound, high / normal)
- Email = I have this working
- Traffic monitor items can you help me with this (I have a 100meg fibre at home, full duplex) high I would say if it ran at 40/50meg for to long and normal I would say and average of 20meg or less) if you can help with the below
- - inbound = tool traffic-monitor add name=ffff interface=ether1-fibre ?????????
- - outbound = tool traffic-monitor add name=ffff interface=ether1-fibre ?????????
- - high = tool traffic-monitor add name=ffff interface=ether1-fibre ?????????
- - normal = tool traffic-monitor add name=ffff interface=ether1-fibre ?????????
- - /system scheduler add interval=5m name=High-BW-Alert-Int. This is the schedule name, what is the script name ? ( I have call it High-BW-Alert-Int)

regards
 
tomislav91
Member Candidate
Member Candidate
Posts: 172
Joined: Fri May 26, 2017 12:47 pm

Re: Alerts based on throughput threshold

Mon Oct 12, 2020 4:26 pm

Here is what I have built from jspool's head start (thanks, I owe you a beer). I hope this helps someone else. It is a high bandwidth alert with secondary alert when bandwidth has returned to normal levels...

(it assumes you have Tools > Email worked out and you have created your own Traffic Monitor items for inbound / outbound, high / normal)
################ BW Alert Scheduler (enter in console) ################

/system scheduler add interval=5m name=High-BW-Alert-Int on-event=":global lastHbwStatus;\r\
    \n:set \$lastHbwStatus Normal;" policy=read,write,policy,test start-time=startup

################ In ether1 High Script (on event, Traffic Monitor)################

# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Inbound Traffic Too High on ether1 $rx Mbps";

/tool e-mail send body="Inbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}

################ In ehter1 Normalized Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}

# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Inbound Traffic Normalized on ether1 $rx Mbps";

/tool e-mail send body="Inbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}

################ Out ether1 High Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Too High on ether1 $tx Mbps";

/tool e-mail send body="Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}

################ Out ether1 Normalized Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}

# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Normalized on ether1 $tx Mbps";

/tool e-mail send body="Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}

i added 4 thresholds about 2M just to test. for In ether1 High Script i added above 2M threshold and for In ether1 Normalized i added below 2M threshold for traffic received, and for traffic transmitted i added Out ether1 Normalized and Out ether1-GW1 High Script I got 2 emails that one is that Inbound Traffic Too High and Inbound Traffic Normalized at the same time
 
mao
just joined
Posts: 1
Joined: Tue Oct 20, 2020 2:21 pm

Re: Alerts based on throughput threshold

Tue Oct 20, 2020 2:25 pm

Hello tomislav91
What do you mean by "created your own Traffic Monitor items for inbound / outbound, high / normal)"? What did you label/name the traffic monitor items in your example? Can you at least provide an example with screenshots? Thanks a lot. Regards, M
 
tomislav91
Member Candidate
Member Candidate
Posts: 172
Joined: Fri May 26, 2017 12:47 pm

Re: Alerts based on throughput threshold

Wed Oct 21, 2020 2:55 pm

Hello tomislav91
What do you mean by "created your own Traffic Monitor items for inbound / outbound, high / normal)"? What did you label/name the traffic monitor items in your example? Can you at least provide an example with screenshots? Thanks a lot. Regards, M


Thats it?
2020-10-21 13_45_37-Window.png
2020-10-21 13_47_34-Window.png
and for HIGH tx i am using
################ Out ether1 Normalized Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}

# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Normalized on ether1 $tx Mbps";

/tool e-mail send body="BG Master CCR Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="myemail@something.rs";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}
and for normaltx
################ Out ether1 High Script (on event, Traffic Monitor) ################

# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}

# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
	:local tx (tx-bits-per-second / 1024 / 1024);
	:local rx (rx-bits-per-second / 1024 / 1024);
	:local txp (tx-packets-per-second);
	:local rxp (rx-packets-per-second);

:log error "Outbound Traffic Too High on ether1 $tx Mbps";

/tool e-mail send body="BG Master CCR Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="myemail@something.rs";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}
You do not have the required permissions to view the files attached to this post.

Who is online

Users browsing this forum: No registered users and 8 guests