Hi,
Is it possible to generate alerts based on throughput thresholds?
e.g.: my upstream providers give us 1 Gbps each one.
I want to receive alerts when traffic is too high or low.
/tool traffic-monitorHi,
Is it possible to generate alerts based on throughput thresholds?
e.g.: my upstream providers give us 1 Gbps each one.
I want to receive alerts when traffic is too high or low.
:global lastbwStatus
# check to see if global exists and if not create default value
:if (($lastbwStatus != "Normal") && ($lastbwStatus != "Alerting")) do={
:set $lastbwStatus Normal
}
# check to see if it has already alerted this cycle & if so discard alert
:if ($lastbwStatus = "Normal") do={
# alert script here
:log warning "Bandwidth Alert"
:set $lastbwStatus Alerting
} else={
:log info "System already has already alerted - discarding alert"
}
/system scheduler
add interval=15m name=Bandwidth-Alerting-Interval on-event=":global lastbwStatus\r\
\n:set \$lastbwStatus Normal;" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
################ BW Alert Scheduler (enter in console) ################
/system scheduler add interval=5m name=High-BW-Alert-Int on-event=":global lastHbwStatus;\r\
\n:set \$lastHbwStatus Normal;" policy=read,write,policy,test start-time=startup
################ In ether1 High Script (on event, Traffic Monitor)################
# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}
# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Inbound Traffic Too High on ether1 $rx Mbps";
/tool e-mail send body="Inbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}
################ In ehter1 Normalized Script (on event, Traffic Monitor) ################
# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}
# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Inbound Traffic Normalized on ether1 $rx Mbps";
/tool e-mail send body="Inbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}
################ Out ether1 High Script (on event, Traffic Monitor) ################
# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}
# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Outbound Traffic Too High on ether1 $tx Mbps";
/tool e-mail send body="Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="email@yourcompany.com";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}
################ Out ether1 Normalized Script (on event, Traffic Monitor) ################
# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}
# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Outbound Traffic Normalized on ether1 $tx Mbps";
/tool e-mail send body="Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="email@yourcompany.com";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}
i added 4 thresholds about 2M just to test. for In ether1 High Script i added above 2M threshold and for In ether1 Normalized i added below 2M threshold for traffic received, and for traffic transmitted i added Out ether1 Normalized and Out ether1-GW1 High Script I got 2 emails that one is that Inbound Traffic Too High and Inbound Traffic Normalized at the same timeHere is what I have built from jspool's head start (thanks, I owe you a beer). I hope this helps someone else. It is a high bandwidth alert with secondary alert when bandwidth has returned to normal levels...
(it assumes you have Tools > Email worked out and you have created your own Traffic Monitor items for inbound / outbound, high / normal)
Code: Select all################ BW Alert Scheduler (enter in console) ################ /system scheduler add interval=5m name=High-BW-Alert-Int on-event=":global lastHbwStatus;\r\ \n:set \$lastHbwStatus Normal;" policy=read,write,policy,test start-time=startup ################ In ether1 High Script (on event, Traffic Monitor)################ # check to see if global exists and if not create default value :if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={ :global lastHbwStatus :set $lastHbwStatus Normal } # check to see if it has already alerted this cycle & if so discard alert :if ($lastHbwStatus = "Normal") do={ # alert script /interface monitor-traffic [/interface find name=ether1] once do={ :local tx (tx-bits-per-second / 1024 / 1024); :local rx (rx-bits-per-second / 1024 / 1024); :local txp (tx-packets-per-second); :local rxp (rx-packets-per-second); :log error "Inbound Traffic Too High on ether1 $rx Mbps"; /tool e-mail send body="Inbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Too High on ether1" to="email@yourcompany.com"; } :set $lastHbwStatus Alerting :set $lastNbwStatus Ready } else={ :log info "System already has already alerted - discarding alert" } ################ In ehter1 Normalized Script (on event, Traffic Monitor) ################ # check to see if global exists and if not create default value :if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={ :global lastNbwStatus :set $lastNbwStatus Paused } # check to see if it has high alert has triggered & if not discard alert :if ($lastNbwStatus = "Ready") do={ # alert script /interface monitor-traffic [/interface find name=ether1] once do={ :local tx (tx-bits-per-second / 1024 / 1024); :local rx (rx-bits-per-second / 1024 / 1024); :local txp (tx-packets-per-second); :local rxp (rx-packets-per-second); :log error "Inbound Traffic Normalized on ether1 $rx Mbps"; /tool e-mail send body="Inbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Inbound Traffic Normalized on ether1" to="email@yourcompany.com"; } :set $lastNbwStatus Paused } else={ :log info "High alert not triggered - discarding alert" } ################ Out ether1 High Script (on event, Traffic Monitor) ################ # check to see if global exists and if not create default value :if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={ :global lastHbwStatus :set $lastHbwStatus Normal } # check to see if it has already alerted this cycle & if so discard alert :if ($lastHbwStatus = "Normal") do={ # alert script /interface monitor-traffic [/interface find name=ether1] once do={ :local tx (tx-bits-per-second / 1024 / 1024); :local rx (rx-bits-per-second / 1024 / 1024); :local txp (tx-packets-per-second); :local rxp (rx-packets-per-second); :log error "Outbound Traffic Too High on ether1 $tx Mbps"; /tool e-mail send body="Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="email@yourcompany.com"; } :set $lastHbwStatus Alerting :set $lastNbwStatus Ready } else={ :log info "System already has already alerted - discarding alert" } ################ Out ether1 Normalized Script (on event, Traffic Monitor) ################ # check to see if global exists and if not create default value :if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={ :global lastNbwStatus :set $lastNbwStatus Paused } # check to see if it has high alert has triggered & if not discard alert :if ($lastNbwStatus = "Ready") do={ # alert script /interface monitor-traffic [/interface find name=ether1] once do={ :local tx (tx-bits-per-second / 1024 / 1024); :local rx (rx-bits-per-second / 1024 / 1024); :local txp (tx-packets-per-second); :local rxp (rx-packets-per-second); :log error "Outbound Traffic Normalized on ether1 $tx Mbps"; /tool e-mail send body="Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="email@yourcompany.com"; } :set $lastNbwStatus Paused } else={ :log info "High alert not triggered - discarding alert" }
Hello tomislav91
What do you mean by "created your own Traffic Monitor items for inbound / outbound, high / normal)"? What did you label/name the traffic monitor items in your example? Can you at least provide an example with screenshots? Thanks a lot. Regards, M
################ Out ether1 Normalized Script (on event, Traffic Monitor) ################
# check to see if global exists and if not create default value
:if (($lastNbwStatus != "Paused") && ($lastNbwStatus != "Ready")) do={
:global lastNbwStatus
:set $lastNbwStatus Paused
}
# check to see if it has high alert has triggered & if not discard alert
:if ($lastNbwStatus = "Ready") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Outbound Traffic Normalized on ether1 $tx Mbps";
/tool e-mail send body="BG Master CCR Outbound Traffic Normalized on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Normalized on ether1" to="myemail@something.rs";
}
:set $lastNbwStatus Paused
} else={
:log info "High alert not triggered - discarding alert"
}
################ Out ether1 High Script (on event, Traffic Monitor) ################
# check to see if global exists and if not create default value
:if (($lastHbwStatus != "Normal") && ($lastHbwStatus != "Alerting")) do={
:global lastHbwStatus
:set $lastHbwStatus Normal
}
# check to see if it has already alerted this cycle & if so discard alert
:if ($lastHbwStatus = "Normal") do={
# alert script
/interface monitor-traffic [/interface find name=ether1] once do={
:local tx (tx-bits-per-second / 1024 / 1024);
:local rx (rx-bits-per-second / 1024 / 1024);
:local txp (tx-packets-per-second);
:local rxp (rx-packets-per-second);
:log error "Outbound Traffic Too High on ether1 $tx Mbps";
/tool e-mail send body="BG Master CCR Outbound Traffic Too High on ether1 at $[/system clock get time] \r\n \r\n Inbound BW: $rx Mbps \r\n Inbound PPS: $rxp \r\n Outbound BW: $tx Mbps \r\n Outbound PPS: $txp" subject="Outbound Traffic Too High on ether1" to="myemail@something.rs";
}
:set $lastHbwStatus Alerting
:set $lastNbwStatus Ready
} else={
:log info "System already has already alerted - discarding alert"
}