Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Troubleshooting Threshold Crossing Alerts

    The following items address troubleshooting threshold crossing alert behavior:

    Event Severity Level

    If the threshold crossing alert does not display, check that the event type is not INFO. Events of severity INFO will only be displayed when the Event Browser is opened and will not be stored.

    Units

    Check that you are interpreting the attribute with the correct units. For example, the utilization should be represented as a percentage (75, for 75%) rather than a fraction (0.75), and the ingressBytesDelta represents Bytes per second rather than bits per second. See Available Keys on page 272 for more information about expected units. You can print the value in the description for confirmation. For example, use [ingressUtil] and [egressUtil] for interface ingress and egress utilization.

    Rule ordering

    If there are multiple rules within a scope, the last rule is evaluated first. In that case, rules must go from general to specific. It might be safer to add in both > and < checks for safety. For example, suppose we have the following settings. Then a memUtil of 75 will use rule c, not rule a or b. This is the expected rule behavior.

    • Rule a: memUtil > 50, MINOR
    • Rule b: memUtil > 60, MAJOR
    • Rule c: memUtil > 70, CRITICAL
    • If a rule d is added, which is more general than the preceding rules, then rules a, b, and c will never get used.
    • Rule d: memUtil > 5, Severity WARNING
    • To get around this, you can qualify rules with both < and > checks.
    • Rule d: memUtil > 5 && memUtil < 50
    Whole Numbers

    Be careful with whole numbers, as the fraction may get ignored. For example, better to use 1.0 instead of 1. If the rule > 60 should include 60.3, then it should be changed either to > 60.0 or >= 60. This should be changed in the memUtil rules. Otherwise, 60.3 will fail the > 60 rule but succeed the >50 rule. This is because if you specify an integer, our software will evaluate in terms of integers, and truncates any floating point to integer before doing the evaluation. Thus, 60.3 is truncated to 60, and then fails rule > 60.

    Timestamps

    Note that the time stamp of a threshold event can differ by up to two collection cycles, depending upon when the event is processed by IP/MPLSView.

    • If no threshold crossing alerts are displayed as expected, rerun the Scheduling Live Network Collection task. It is possible that some information regarding interface bandwidth needs to be updated.
    • Read the /u/wandl/log/threshold.log.0 file and verify that there are no diagnostic error messages.

    Modified: 2016-09-28