5.02021-11-21T21:38:13ZTemplatesenhanced_snmp_interface_discoveryEnhanced SNMP Interface Discovery## Description
Enhanced SNMP interface discovery 1.0.1 Template made by Twan Kamans. https://www.twan-it.nl This template searches for 4 different categories: - Interfaces that are administratively disabled - Interfaces that are working onder normal condition - Interfaces with priority, such as switch uplink - Virtual interfaces such as tunnel, port channel and vlan interfaces. Revision 0.7 - Added support for virtual interfaces Revision 0.7.1 - Added support for (filtering) stack switch ports - Fixed a bug in which VLAN interfaces with the number 0 in them would still be discovered by the normal LLD rule Revision 0.7.2 - Filtering VLAN's 1002 - 1005 interfaces - Added support for subinterfaces for Junos Revision 0.8 - Completely revisited the filtering of items using Regex due to introduction of Junos devices. You can adjust the regex for physical devices using a macro. Revision 0.9 - Added support for enduser ports. Triggers will not activate if port description contains macro value. Revision 1.0 - Tested template on posible errors. Revision 1.0.1 - Added bandwidth statistics for virtual interfaces. Revision 1.0.2 - Bandwidth triggers now make use of user macro context, making individual port bandwidth limits posible. - The interface changed state severity has been lowered by default. The new default severity for all interfaces is "warning". Exceptions to this are the priority interfaces which are "average".
## Overview
This template is a replacement for the great default SNMP interface template. It uses the default SNMP interface library and OID's, meaning that it's compatible with a lot of devices.
The template has the following features:
* Priority interfaces (assign higher severity triggers to your important interfaces)
* Get notified when a user no-shut’s a port
* Get notified when a port is in the not-connected state
* Get notified when the bandwidth of a port reaches a specific threshold in percentage (port specific using user macro context)
* Get notified when a port changes that (up / down)
* Adjustable LLD timer for working on port configurations which quickly need to be discovered by Zabbix
* Only gather data for items and interfaces that are important: i don’t want to monitor loopback interfaces and the amount of incoming errors on a port-channel (notsupported items)
* Don’t trigger on (switch)ports which have users behind them. I don’t want to know when someone turns their computer off.
Most of these features can be adjusted and enabled / disabled using macro's:
* {$INT\_BANDWIDTH\_WARNING}
* {$INT\_ERRORS\_WARN}
* {$INT\_LLD\_UPDATE\_INTERVAL}
* {$INT\_NAME\_PHYSICAL}
* {$INT\_NO\_TRIGGER\_STRING}
* {$INT\_PRIO\_STRING}
* {$SEARCH\_FOR\_INACTIVE\_PORTS}
| Macro name | Default value | Type | Description |
| {$INT\_BANDWIDTH\_WARNING} | 80 | Percentage | Percentage when trigger fires |
| {$INT\_ERRORS\_WARM} | 2 | #Amount | Max error value for "interface errors trigger" |
| {$INT\_LLD\_UPDATE\_INTERVAL} | 30m | Time | Update interval for LLD rules |
| {$INT\_NAME\_PHYSICAL} | ^[A-Z|a-z]{2}-?[0-9]+\/[0-9]{1,2}(\/[0-9]+)?$ | Regex | Regex that filters the physical interfaces |
| {$INT\_NO\_TRIGGER\_STRING} | ^(EDGEPORT)$ | Regex | Regex for edge ports (computers turning on / off) |
| {$INT\_PRIO\_STRING} | UPLINK | Regex | Description keyword for priority interfaces |
| {$SEARCH\_FOR\_INACTIVE\_PORTS} | 0 | Bolean | 0 = Does not trigger for notconnected ports (1 does) |
With the default values, interface descriptions that start with "UPLINK" will be discovered by the Priority LLD. Interfaces that contain the keyword EDGEPORT will not generate a trigger when turned on / off.
If you miss some interfaces: run a SNMPWALK over the device to check if it matches the {$INT\_NAME\_PHYSICAL} regex!
## Author
Twan Kamans
TemplatesNetwork Interfaces- Total amount of interfacesSNMP_AGENTIF-MIB::ifNumber.0net.if.total10m1w0Shows the total amount of interfaces.Network Interfaces
Network Interfaces Discovery - NormalSNMP_AGENTdiscovery[{#SNMPVALUE},1.3.6.1.2.1.2.2.1.8,{#IFADMINSTATUS},1.3.6.1.2.1.2.2.1.7,{#IFALIAS},1.3.6.1.2.1.31.1.1.1.18,{#IFNAME},1.3.6.1.2.1.31.1.1.1.1,{#IFDESCR},1.3.6.1.2.1.2.2.1.2,{#IFTYPE},1.3.6.1.2.1.2.2.1.3]net.if.discovery{$INT_LLD_UPDATE_INTERVAL}{#IFALIAS}^(?!{$INT_PRIO_STRING}).*B{#IFADMINSTATUS}(1|3)A{#IFNAME}{$INT_NAME_PHYSICAL}C8hInterface {#IFNAME}: Admin statusSNMP_AGENT1.3.6.1.2.1.2.2.1.7.{#SNMPINDEX}net.if.status[ifAdminStatus.{#SNMPINDEX}]1w0Network InterfacesIF-MIB::ifAdminStatusInterface {#IFNAME}: AliasSNMP_AGENT1.3.6.1.2.1.31.1.1.1.18.{#SNMPINDEX}net.if.status[ifAlias.{#SNMPINDEX}]1h1w0TEXTNetwork InterfacesInterface {#IFNAME}: Inbound packets discardedSNMP_AGENT1.3.6.1.2.1.2.2.1.13.{#SNMPINDEX}net.if.status[ifInDiscards.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME}: Inbound packets with errorsSNMP_AGENT1.3.6.1.2.1.2.2.1.14.{#SNMPINDEX}net.if.status[ifInErrors.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME}: Bits receivedSNMP_AGENT1.3.6.1.2.1.2.2.1.10.{#SNMPINDEX}net.if.status[ifInOctets.{#SNMPINDEX}]3m30dFLOATbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME}: Operational statusSNMP_AGENT1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}net.if.status[ifOperStatus.{#SNMPINDEX}]1w0Network InterfacesIF-MIB::ifOperStatusInterface {#IFNAME}: Outbound packets discardedSNMP_AGENT1.3.6.1.2.1.2.2.1.19.{#SNMPINDEX}net.if.status[ifOutDiscards.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME}: Outbound packets with errorsSNMP_AGENT1.3.6.1.2.1.2.2.1.20.{#SNMPINDEX}net.if.status[ifOutErrors.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME}: Bits sentSNMP_AGENT1.3.6.1.2.1.2.2.1.16.{#SNMPINDEX}net.if.status[ifOutOctets.{#SNMPINDEX}]3m30dFLOATbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME}: SpeedSNMP_AGENT1.3.6.1.2.1.2.2.1.5.{#SNMPINDEX}net.if.status[ifSpeed.{#SNMPINDEX}]5m1wbpsSpeed of the interfaceNetwork Interfaces{enhanced_snmp_interface_discovery:net.if.status[ifOperStatus.{#SNMPINDEX}].avg(3600)}<>2 and {enhanced_snmp_interface_discovery:net.if.status[ifOperStatus.{#SNMPINDEX}].last()}=2 and
{enhanced_snmp_interface_discovery:net.if.status[ifAlias.{#SNMPINDEX}].regexp({$INT_NO_TRIGGER_STRING},#3)}=0RECOVERY_EXPRESSION{enhanced_snmp_interface_discovery:net.if.status[ifOperStatus.{#SNMPINDEX}].last(#5)}<>2Interface status has changed on port {#IFNAME}WARNINGTriggers when the interface state changes.{enhanced_snmp_interface_discovery:net.if.status[ifInOctets.{#SNMPINDEX}].avg(10m)}>(({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}/100)*{enhanced_snmp_interface_discovery:net.if.status[ifSpeed.{#SNMPINDEX}].last()}) or
{enhanced_snmp_interface_discovery:net.if.status[ifOutOctets.{#SNMPINDEX}].avg(10m)}>(({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}/100)*{enhanced_snmp_interface_discovery:net.if.status[ifSpeed.{#SNMPINDEX}].last()}) and {enhanced_snmp_interface_discovery:net.if.status[ifSpeed.{#SNMPINDEX}].last()}>0RECOVERY_EXPRESSION{enhanced_snmp_interface_discovery:net.if.status[ifInOctets.{#SNMPINDEX}].avg(10m)}<((({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}-3)/100)*{enhanced_snmp_interface_discovery:net.if.status[ifSpeed.{#SNMPINDEX}].last()}) or
{enhanced_snmp_interface_discovery:net.if.status[ifOutOctets.{#SNMPINDEX}].avg(10m)}<((({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}-3)/100)*{enhanced_snmp_interface_discovery:net.if.status[ifSpeed.{#SNMPINDEX}].last()})Interface {#IFNAME}: Bandwidth usage over {$INT_BANDWIDTH_WARNING:"{#IFNAME}"}%WARNINGTriggers when incoming or outgoing traffic exceeds limit of the INT_BANDWIDTH_WARNING macro.{enhanced_snmp_interface_discovery:net.if.status[ifInErrors.{#SNMPINDEX}].avg(5m)}>{$INT_ERRORS_WARN} or
{enhanced_snmp_interface_discovery:net.if.status[ifOutErrors.{#SNMPINDEX}].avg(5m)}>{$INT_ERRORS_WARN}Interface {#IFNAME}: High error rateWARNINGTriggers when incoming or outgoing errors exceeds limit of the INT_ERRORS_WARN macro.{enhanced_snmp_interface_discovery:net.if.status[ifAdminStatus.{#SNMPINDEX}].last()}<>2 and {enhanced_snmp_interface_discovery:net.if.status[ifOperStatus.{#SNMPINDEX}].avg(1w)}=2 and {$SEARCH_FOR_INACTIVE_PORTS}=1Port {#IFNAME} is enabled but not connected!INFOZabbix detects a "notconnected" port on {HOST.NAME} Interface {#IFNAME}.Interface {#IFNAME}: Network statisticsGRADIENT_LINE1A7C11- enhanced_snmp_interface_discoverynet.if.status[ifInOctets.{#SNMPINDEX}]
1BOLD_LINE2774A4- enhanced_snmp_interface_discoverynet.if.status[ifOutOctets.{#SNMPINDEX}]
2F63100RIGHT- enhanced_snmp_interface_discoverynet.if.status[ifInDiscards.{#SNMPINDEX}]
3FC6EA3RIGHT- enhanced_snmp_interface_discoverynet.if.status[ifOutDiscards.{#SNMPINDEX}]
4A54F10RIGHT- enhanced_snmp_interface_discoverynet.if.status[ifInErrors.{#SNMPINDEX}]
56C59DCRIGHT- enhanced_snmp_interface_discoverynet.if.status[ifOutErrors.{#SNMPINDEX}]
Network Interfaces Discovery - DisabledSNMP_AGENTdiscovery[{#SNMPVALUE},1.3.6.1.2.1.2.2.1.8,{#IFADMINSTATUS},1.3.6.1.2.1.2.2.1.7,{#IFALIAS},1.3.6.1.2.1.31.1.1.1.18,{#IFNAME},1.3.6.1.2.1.31.1.1.1.1]net.if.down.discovery{$INT_LLD_UPDATE_INTERVAL}{#IFALIAS}^(?!{$INT_PRIO_STRING})B{#IFADMINSTATUS}(2)A{#IFNAME}{$INT_NAME_PHYSICAL}C1hInterface {#IFNAME}: Admin statusSNMP_AGENT1.3.6.1.2.1.2.2.1.7.{#SNMPINDEX}net.if.down.status[ifAdminStatus.{#SNMPINDEX}]3m1d0Shows if interface is administrative disabled.Network InterfacesIF-MIB::ifAdminStatus{last()}=1Port {#IFNAME} has gone UP!INFOInterface state has changed. This is most likely due to enabeling an interface.Network Interfaces Discovery - PrioritySNMP_AGENTdiscovery[{#SNMPVALUE},1.3.6.1.2.1.2.2.1.8,{#IFADMINSTATUS},1.3.6.1.2.1.2.2.1.7,{#IFALIAS},1.3.6.1.2.1.31.1.1.1.18,{#IFNAME},1.3.6.1.2.1.31.1.1.1.1,{#IFDESCR},1.3.6.1.2.1.2.2.1.2,{#IFTYPE},1.3.6.1.2.1.2.2.1.3]net.if.prio.discovery{$INT_LLD_UPDATE_INTERVAL}AND{#IFALIAS}^({$INT_PRIO_STRING}).*A{#IFNAME}{$INT_NAME_PHYSICAL}BInterface {#IFNAME} (priority): Admin statusSNMP_AGENT1.3.6.1.2.1.2.2.1.7.{#SNMPINDEX}net.if.prio.status[ifAdminStatus.{#SNMPINDEX}]30s1w0Network InterfacesIF-MIB::ifAdminStatusInterface {#IFNAME} (priority): AliasSNMP_AGENT1.3.6.1.2.1.31.1.1.1.18.{#SNMPINDEX}net.if.prio.status[ifDescription.{#SNMPINDEX}]1h1w0TEXTNetwork InterfacesInterface {#IFNAME} (priority): Inbound packets discardedSNMP_AGENT1.3.6.1.2.1.2.2.1.13.{#SNMPINDEX}net.if.prio.status[ifInDiscards.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME} (priority): Inbound packets with errorsSNMP_AGENT1.3.6.1.2.1.2.2.1.14.{#SNMPINDEX}net.if.prio.status[ifInErrors.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME} (priority): Bits receivedSNMP_AGENT1.3.6.1.2.1.2.2.1.10.{#SNMPINDEX}net.if.prio.status[ifInOctets.{#SNMPINDEX}]3m30dbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME} (priority): Operational statusSNMP_AGENT1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}net.if.prio.status[ifOperStatus.{#SNMPINDEX}]30s1w0Network InterfacesIF-MIB::ifAdminStatus{avg(3600)}<>2 and {last()}=2Interface status has changed on host {HOST.NAME} port {#IFNAME}: {#SNMPVALUE}AVERAGEInterface {#IFNAME} (priority): Outbound packets discardedSNMP_AGENT1.3.6.1.2.1.2.2.1.19.{#SNMPINDEX}net.if.prio.status[ifOutDiscards.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME} (priority): Outbound packets with errorsSNMP_AGENT1.3.6.1.2.1.2.2.1.20.{#SNMPINDEX}net.if.prio.status[ifOutErrors.{#SNMPINDEX}]5m1wNetwork InterfacesCHANGE_PER_SECONDInterface {#IFNAME} (priority): Bits sentSNMP_AGENT1.3.6.1.2.1.2.2.1.16.{#SNMPINDEX}net.if.prio.status[ifOutOctets.{#SNMPINDEX}]3m30dbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME} (priority): SpeedSNMP_AGENT1.3.6.1.2.1.2.2.1.5.{#SNMPINDEX}net.if.prio.status[ifSpeed.{#SNMPINDEX}]5m1wbpsNetwork Interfaces{enhanced_snmp_interface_discovery:net.if.prio.status[ifInOctets.{#SNMPINDEX}].avg(10m)}>(({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}/100)*{enhanced_snmp_interface_discovery:net.if.prio.status[ifSpeed.{#SNMPINDEX}].last()}) or
{enhanced_snmp_interface_discovery:net.if.prio.status[ifOutOctets.{#SNMPINDEX}].avg(10m)}>(({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}/100)*{enhanced_snmp_interface_discovery:net.if.prio.status[ifSpeed.{#SNMPINDEX}].last()}) and {enhanced_snmp_interface_discovery:net.if.prio.status[ifSpeed.{#SNMPINDEX}].last()}>0RECOVERY_EXPRESSION{enhanced_snmp_interface_discovery:net.if.prio.status[ifInOctets.{#SNMPINDEX}].avg(10m)}<((({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}-3)/100)*{enhanced_snmp_interface_discovery:net.if.prio.status[ifSpeed.{#SNMPINDEX}].last()}) or
{enhanced_snmp_interface_discovery:net.if.prio.status[ifOutOctets.{#SNMPINDEX}].avg(10m)}<((({$INT_BANDWIDTH_WARNING:"{#IFNAME}"}-3)/100)*{enhanced_snmp_interface_discovery:net.if.prio.status[ifSpeed.{#SNMPINDEX}].last()})Interface {#IFNAME}: Bandwidth usage over {$INT_BANDWIDTH_WARNING:"{#IFNAME}"}%WARNINGTriggers when incoming or outgoing traffic exceeds limit of the INT_BANDWIDTH_WARNING macro.{enhanced_snmp_interface_discovery:net.if.prio.status[ifInErrors.{#SNMPINDEX}].avg(5m)}>{$INT_ERRORS_WARN} or
{enhanced_snmp_interface_discovery:net.if.prio.status[ifOutErrors.{#SNMPINDEX}].avg(5m)}>{$INT_ERRORS_WARN}Interface {#IFNAME}: High error rateWARNINGInterface {#IFNAME} (priority): Network trafficGRADIENT_LINE1A7C11- enhanced_snmp_interface_discoverynet.if.prio.status[ifInOctets.{#SNMPINDEX}]
1BOLD_LINE2774A4- enhanced_snmp_interface_discoverynet.if.prio.status[ifOutOctets.{#SNMPINDEX}]
2F63100RIGHT- enhanced_snmp_interface_discoverynet.if.prio.status[ifInDiscards.{#SNMPINDEX}]
3FC6EA3RIGHT- enhanced_snmp_interface_discoverynet.if.prio.status[ifOutDiscards.{#SNMPINDEX}]
4A54F10RIGHT- enhanced_snmp_interface_discoverynet.if.prio.status[ifInErrors.{#SNMPINDEX}]
56C59DCRIGHT- enhanced_snmp_interface_discoverynet.if.prio.status[ifOutErrors.{#SNMPINDEX}]
Network Interfaces Discovery - VirtualSNMP_AGENTdiscovery[{#SNMPVALUE},1.3.6.1.2.1.2.2.1.8,{#IFADMINSTATUS},1.3.6.1.2.1.2.2.1.7,{#IFALIAS},1.3.6.1.2.1.31.1.1.1.18,{#IFNAME},1.3.6.1.2.1.31.1.1.1.1,{#IFDESCR},1.3.6.1.2.1.2.2.1.2,{#IFTYPE},1.3.6.1.2.1.2.2.1.3]net.if.virt.discovery{$INT_LLD_UPDATE_INTERVAL}{#IFNAME}^bond[0-9]+$B{#IFNAME}^[A-Z|a-z]{2}-?[0-9]\/[0-9]{1,2}(\/[0-9]{1,2})?\.[A-Z|0-9]+$C{#IFNAME}^VLAN-(?!100[2-5])[0-9]+$D{#IFNAME}^irb\.[0-9]{1,4}$E{#IFNAME}^(Po|VI|Vl|Tu)[0-9]*$F{#IFALIAS}^(?!{$INT_PRIO_STRING}).*AInterface {#IFNAME}: Admin statusSNMP_AGENT1.3.6.1.2.1.2.2.1.7.{#SNMPINDEX}net.if.virt.status[ifAdminStatus.{#SNMPINDEX}]1w0Network InterfacesIF-MIB::ifAdminStatusInterface {#IFNAME}: AliasSNMP_AGENT1.3.6.1.2.1.31.1.1.1.18.{#SNMPINDEX}net.if.virt.status[ifAlias.{#SNMPINDEX}]1h1w0TEXTNetwork InterfacesInterface {#IFNAME}: Bits receivedSNMP_AGENT1.3.6.1.2.1.2.2.1.10.{#SNMPINDEX}net.if.virt.status[ifInOctets.{#SNMPINDEX}]3m30dFLOATbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME}: Operational statusSNMP_AGENT1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}net.if.virt.status[ifOperStatus.{#SNMPINDEX}]1w0Network InterfacesIF-MIB::ifOperStatus{avg(3600)}<>2 and
{last()}=2RECOVERY_EXPRESSION{last(5m)}<>2Interface status has changed on port {#IFNAME}WARNINGTriggers when the interface state changes.Interface {#IFNAME}: Bits sentSNMP_AGENT1.3.6.1.2.1.2.2.1.16.{#SNMPINDEX}net.if.virt.status[ifOutOctets.{#SNMPINDEX}]3m30dFLOATbpsNetwork InterfacesCHANGE_PER_SECONDMULTIPLIER8Interface {#IFNAME}: Network trafficGRADIENT_LINE1A7C11- enhanced_snmp_interface_discoverynet.if.virt.status[ifInOctets.{#SNMPINDEX}]
1BOLD_LINE2774A4- enhanced_snmp_interface_discoverynet.if.virt.status[ifOutOctets.{#SNMPINDEX}]
{$INT_BANDWIDTH_WARNING}80{$INT_ERRORS_WARN}2{$INT_LLD_UPDATE_INTERVAL}30m{$INT_NAME_PHYSICAL}^[A-Z|a-z]{2}-?[0-9]+\/[0-9]{1,2}(\/[0-9]+)?${$INT_NO_TRIGGER_STRING}^(EDGEPORT)${$INT_PRIO_STRING}UPLINK{$SEARCH_FOR_INACTIVE_PORTS}0IF-MIB::ifAdminStatus1up2disabled3testingIF-MIB::ifOperStatus1up2down3testing4unknown5dormant6notPresent7lowerLayerDown