check if traffic moving or not (no traffic)

[zaji_nms]

Dear Expert

Previously I have requested for feature: Low Bandwidth Threshold Alert and if not possible at least ZERO Traffic.

Me tried for Total Zero Traffic Alert (successful on testing environment), please go through (attached) and advice if its okay or any major contribution with your detail comments (me novice to perl , its my first script managed from here and there).

FYI, in Cisco sub-interfaces never goes down and if we monitor the IfOperStatus meaningless. Also if interface not directly connected it will never go down, if interface in UP and goes to hung, will never trigger any DOWN ALERT. So please let me know how this my script will work? Any adverse effect?

Command:
$USER1$/check_if_no_traffic.pl $ARG1$ $HOSTADDRESS$ $ARG2$

$ARG$1 : public
$ARG$2 : if-index of the interface/sub-interface

This will be added as a new services on required interfaces, is there any better way to incorporate in existing check_rrdtraf? If fifth parameter get include with value 0 then will check same manner? Sixth parameter will be community. Index will get after parsing first $ARG1$ _ifindex, so no need to add as a new services but just to modify check_rrdtraf.

If its trigger False Alarm in rare case, no issue, because our 24x7 NMS Monitoring Team will look into the matter when Alert is older enough (more than 10 minutes) and they know how to check from device.

Regards

[tmcdonald]

The first thing I notice is the sleep(10) and sleep(20) which is at least 30 seconds of sleep. By default Nagios will kill off any check that runs for more than 30 seconds:

http://support.nagios.com/knowledgebase ... wdesc=true

For the status of sub-interfaces and interfaces not directly connected, being hung, etc. your current script likely will not account for that since the returned data will not be an amount of traffic. Currently this will cause the check to show OK since the text output will be the same before and after the 10-second sleep, which will trigger the "Traffic Moving" section.

As for editing check_rrdtraf, this is something we would need to consider carefully on our end as that sounds like a fairly major change.

[zaji_nms]

Dear Tmcdonald

Thanks to notify for timeout (kill off), I will change sleep(20) with sleep(15)

Can I use safely this script? Initially I will use on 10 interfaces and later will increase depend on the success. Is there any adverse effect?

Command Type : I have to use MISC Command or CHECK Command?

Regards

[tmcdonald]

I don't see any problems with it as long as you understand the possibility of a timeout (in the case of the snmp queries taking a long time).

For the command type, make it a CHECK.

[zaji_nms]

Dear Tmcdonald

Thanks for quick reply, let me apply and will update the result.

Regards

[cmerchant]

Let us know how this works out.