Cisco Switch ErrDisabled Status on Port


sawyer.lef
 Share

Recommended Posts

  • 4 months later...

The one I am using has an ugly side effect -- if you only want to do this and you have LMConfig, you will activate LMConfig since you must define ssh.user and ssh.pass for this, just like what is needed for LMConfig.  I recommended to our CSM that LMConfig should require a specific activation property as it is a premium feature that should not be inadvertently activated, but that did not seem to go anywhere.  The only option otherwise is to manually edit every CS to adjust the applies-to formula, which then must be updated every time a new version arrives (though I am told better merging is just around the corner...fingers crossed!)

Link to comment
Share on other sites

  • 2 years later...
On 11/30/2018 at 8:12 PM, mnagel said:

The one I am using has an ugly side effect -- if you only want to do this and you have LMConfig, you will activate LMConfig since you must define ssh.user and ssh.pass for this, just like what is needed for LMConfig.  I recommended to our CSM that LMConfig should require a specific activation property as it is a premium feature that should not be inadvertently activated, but that did not seem to go anywhere.  The only option otherwise is to manually edit every CS to adjust the applies-to formula, which then must be updated every time a new version arrives (though I am told better merging is just around the corner...fingers crossed!)

Mind sharing yours?  I think I may have a need for this and I am licensed for LMConfig

Link to comment
Share on other sites

2 hours ago, Shack said:

Mind sharing yours?  I think I may have a need for this and I am licensed for LMConfig

It was published to the Exchange as H4T9GH, but it is basically what LM support provided with some tweaks.  As an Event Source, it has the same poor behavior as all Event Sources, that is, you cannot practically ACK them, only add SDT.  It also is not universal since there are different ways to get this info on different platforms.

I like the idea of converting to a DS version with instances like the first post mentioned, and of course we are all still waiting for that promised core LM release real soon now :).

  • Like 1
Link to comment
Share on other sites

OK, cool.  It has only been there for years now, so I am sure it will be reviewed very soon :).  More seriously, I have requested from the LM Exchange developers before an "escalate" button to get more attention on these, but so far I think there is no reliable process for getting code approved.

  • Haha 1
Link to comment
Share on other sites

On 9/28/2021 at 7:57 PM, Michael Rodrigues said:

It's out of review now.

 

Still getting the below error when searching on H4T9GH

ERROR

LogicModule belongs to another private repository.

Link to comment
Share on other sites

Should be fixed now.  I still would like to redo this as a datasource with per-port instances.  Event sources are not very useful without inter-event correlation, but better than not knowing what is going on :).

Link to comment
Share on other sites

This is doing exactly what we want but with one problem.  How do you stop a scripted event source from creating duplicate alerts every time it connects and runs?  Hmmm I wonder if I can do something with my Escalation Chain.

It would be awesome to be able to suppress these IF it detected the same port was disabled and an existing alert was already active based on message matching or something.  I need a checkbox similar to the checkbox on the Windows Event Logging type Event Source.

Link to comment
Share on other sites

2 minutes ago, Shack said:

This is doing exactly what we want but with one problem.  How do you stop a scripted event source from creating duplicate alerts every time it connects and runs?  Hmmm I wonder if I can do something with my Escalation Chain.

It would be awesome to be able to suppress these IF it detected the same port was disabled and an existing alert was already active based on message matching or something.  I need a checkbox similar to the checkbox on the Windows Event Logging type Event Source.

Event sources are a poor solution for generate alerts, though it is very desirable that they can.  I have requested for a long time there be a way to correlate events via a key extracted from the event so you know it is the same event (this is trivial with many event solutions, including the incredibly awesome FOSS SEC tool).  Among other things, you cannot even ACK an event effectively since the next run is a brand new result, but the email instructions still list ACK as an option and our clients believe it works.

I think the only reasonable solution is to redo the code into a datasource, like originally discussed in this thread.

Link to comment
Share on other sites

  • Administrators
2 hours ago, mnagel said:

I think the only reasonable solution is to redo the code into a datasource, like originally discussed in this thread.

Agreed, a DataSource would fix the multiple alerts that results from an EventSource running.

Although i think the larger question of alert correlation (multiple alerts being statically or dynamically grouped into incidents) is something you should be requesting from your CSM. Even something like occurrence counts on alerts would be good. The same problem happens with SNMP traps; traps can come in every minute and be about the same thing still in an unwanted state. Each one should just increment a counter on the alert. Counter thresholds should be something we can add to alert rules.  Even regular datapoints could benefit from this, counting the number of poll cycles/minutes that a particular metric has been over threshold. 

Link to comment
Share on other sites

1 minute ago, Stuart Weenig said:

Agreed, a DataSource would fix the multiple alerts that results from an EventSource running.

Although i think the larger question of alert correlation (multiple alerts being statically or dynamically grouped into incidents) is something you should be requesting from your CSM. Even something like occurrence counts on alerts would be good. The same problem happens with SNMP traps; traps can come in every minute and be about the same thing still in an unwanted state. Each one should just increment a counter on the alert. Counter thresholds should be something we can add to alert rules.  Even regular datapoints could benefit from this, counting the number of poll cycles/minutes that a particular metric has been over threshold. 

Sounds like submitting to CSM should work, but here is usually what happens. "You should submit a feature request or feedback item."  To me, those have a pretty small chance of success, so I have stopped trying except in a few cases. I once was able to peer into the feedback tickets via export and discuss with our CSM, but those are normally complete blackholes.  Feature requests rarely result in any constructive activity and they lack basic support for escalation, voting, etc.  Really we need one ticket system to be able to track all of these things with suitable categories (which I have also suggested that multiple times).

And yes, every event source should have the ability to correlate new events with open events. I have been pushing for this for a long time, but I suspect now the answer is "get LMLogs" and this will never get any traction.

Being able to get data averages datapoints over time has also been a long-time open request.  This is important to look for issues where the status might oscillate, but overall levels are high (e.g., resource usage like CPU, bandwidth, etc.).

Link to comment
Share on other sites

  • Administrators
57 minutes ago, mnagel said:

Feature requests rarely result in any constructive activity and they lack basic support for escalation, voting, etc.

We are working on this and should have some news to share next quarter. Hint hint, the communities are finally getting official attention/sponsorship from LM.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share