Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Troubleshooting Threshold Crossing Alerts

 

The following items address troubleshooting threshold crossing alert behavior:

Event Severity LevelIf the threshold crossing alert does not display, check that the event type is not INFO. Events of severity INFO will only be displayed when the Event Browser is opened and will not be stored.
UnitsCheck that you are interpreting the attribute with the correct units. For example, the utilization should be represented as a percentage (75, for 75%) rather than a fraction (0.75), and the ingressBytesDelta represents Bytes per second rather than bits per second. See Available Keys in the IP/MPLSView Java-Based Management and Monitoring Guide for more information about expected units. You can print the value in the description for confirmation. For example, use [ingressUtil] and [egressUtil] for interface ingress and egress utilization.
Rule orderingIf there are multiple rules within a scope, the last rule is evaluated first. In that case, rules must go from general to specific. It might be safer to add in both > and < checks for safety. For example, suppose we have the following settings. Then a memUtil of 75 will use rule c, not rule a or b. This is the expected rule behavior.
  • Rule a: memUtil > 50, MINOR

  • Rule b: memUtil > 60, MAJOR

  • Rule c: memUtil > 70, CRITICAL

  • If a rule d is added, which is more general than the preceding rules, then rules a, b, and c will never get used.

  • Rule d: memUtil > 5, Severity WARNING

  • To get around this, you can qualify rules with both < and > checks.

  • Rule d: memUtil > 5 && memUtil < 50

Whole NumbersBe careful with whole numbers, as the fraction may get ignored. For example, better to use 1.0 instead of 1. If the rule > 60 should include 60.3, then it should be changed either to > 60.0 or >= 60. This should be changed in the memUtil rules. Otherwise, 60.3 will fail the > 60 rule but succeed the >50 rule. This is because if you specify an integer, our software will evaluate in terms of integers, and truncates any floating point to integer before doing the evaluation. Thus, 60.3 is truncated to 60, and then fails rule > 60.
TimestampsNote that the time stamp of a threshold event can differ by up to two collection cycles, depending upon when the event is processed by IP/MPLSView.
  • If no threshold crossing alerts are displayed as expected, rerun the Scheduling Live Network Collection task. It is possible that some information regarding interface bandwidth needs to be updated.

  • Read the /u/wandl/log/threshold.log.0 file and verify that there are no diagnostic error messages.