...
| /var/local/healthbot/rules | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
telemetry sensor interface-status.rule file | | Code Block | | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
| Code Block | ||
|---|---|---|
| ||
jcluser@ubuntu:/var/local/healthbot/rules/juniper_official/Interfaces$ more interface-status.rule /* * Monitors interface link state and notifies when anomalies are found. * One input control detection * * 1) interface-name-variable, is a regular expression that matches the * interfaces that you would like to monitor. By default it's * '.*', which matches all interfaces. Use something like 'ge.*' to * match only gigabit ethernet interfaces. * */ iceberg { topic interface.statistics { description "Monitors and notify interface statistics i.e. link state, flaps, neighbor state, input & output traffic and errors"; synopsis "Interface |
statistics |
analyzer"; |
|
|
|
|
|
|
|
rule check-interface-status { |
|
|
synopsis |
"Tnterface |
state analyzer"; description "Collects interface link oper |
state |
periodically |
and notifies when neighbor sate is |
down"; |
|
|
/* * |
Monitors the interface |
link |
oper state. Notifies via the |
* dashboard colors when the *all* link oper |
state {{link-state}} |
* is down (red). Otherwise the color is set to green. |
|
|
|
|
|
|
|
|
* |
* Use interface name as key for rule. |
|
*/ |
|
|
|
keys interface-name; /* |
|
|
|
|
|
|
|
|
|
|
* Sensor configuration to get data from network devices. |
|
*/ sensor interfaces { |
|
synopsis "Interface open-config sensor definition"; |
|
description "Interfaces open-config sensor |
to collect telemetry data from network device"; |
open-config { |
|
|
|
|
sensor |
-name /interfaces/; |
|
|
frequency |
60s; |
|
|
|
|
|
} |
} |
|
|
/* |
|
|
* Fields defined using sensor path. Map the longer sensor names |
|
* to the shorter field names used in the rules. |
*/ |
|
field admin-state { |
|
|
|
sensor interfaces { |
|
path /interfaces/interface |
/state/admin-status; } |
|
|
type string; |
|
|
|
description "Interface admin status"; |
|
} field interface-name |
{ |
sensor |
interfaces { |
|
|
|
|
where "/interfaces/interface/@name =~ /{{interface-name-variable}}/"; |
|
path "/interfaces/interface/@name"; } |
|
type string; |
|
description "Interfaces to be monitored"; |
} |
|
field link-state { |
|
|
|
|
sensor interfaces { |
path |
/interfaces/interface/state/oper-status; |
|
|
|
} |
type string; |
|
|
description "Interfaces link operator status"; |
|
|
|
} /* |
|
|
|
|
|
|
* Anomaly detection logic. |
*/ |
|
trigger |
link-state |
{ |
|
|
|
synopsis "link state kpi"; |
description "Sets |
health |
based on link state"; |
|
|
/* * Skips |
evaluation |
for admin down state interfaces */ |
|
|
frequency 60s; |
term is-link-admin-down { |
when { |
|
|
|
|
matches-with "$admin-state" DOWN; } |
|
|
|
|
|
|
|
} |
/* |
|
|
* Sets color to red and sends out anomaly |
notification when |
* the interface oper |
state ($link-state |
) |
is down. */ |
|
|
term is-link-down { |
when { |
|
matches-with "$admin-state" UP; |
matches-with "$link-state" DOWN; } then { |
|
status { |
|
|
|
color red;
message "$interface-name link operator status is DOWN";
}
}
}
/*
* Defaults color to green.
*/
term link-up {
then {
status {
color green;
message "$interface-name link operator status is UP";
}
}
}
}
/*
* Variables with default values. Default values can be changed
* while deploying playbook instance.
*/
variable interface-name-variable {
value ".*";
description "Interface names to monitor, regular expression, e.g. 'ge-.*'";
type string;
}
rule-properties {
version 2;
contributor juniper;
supported-healthbot-version 1.0.1;
catalogue {
tier 1;
}
supported-devices {
juniper {
operating-system junos {
products MX {
releases 16.1R1 {
release-support min-supported-release;
platform [ MX240 MX480 MX960 MX2010 MX2020 ];
}
releases 17.3R1 {
release-support min-supported-release;
platform MX150;
}
}
products PTX {
releases 17.2R1 {
release-support min-supported-release;
platform [ PTX5000 PTX1000 PTX10000 ];
}
}
products QFX {
releases 17.2R1 {
release-support min-supported-release;
platform [ QFX10000 QFX5200 ];
}
releases 18.1R1 {
release-support min-supported-release;
platform QFX5100;
}
releases 18.3R1 {
release-support min-supported-release;
platform QFX5120-48Y;
}
}
products EX {
releases 17.3R1 {
release-support min-supported-release;
platform EX9200;
}
releases 18.3R1 {
release-support min-supported-release;
platform EX4650;
}
releases 18.4R1 {
release-support min-supported-release;
platform EX4600;
}
}
}
}
other-vendor cisco-IOS-XR {
vendor-name cisco;
operating-system IOS-XR;
}
}
}
}
}
}
|
topic interface.statistics
rule snmp-check-interface-flaps
sensor interfaces
snmp
fields flaps
fields index
rule-properties
juniper
operation-system junos
. . . .
| Code Block | ||
|---|---|---|
| ||
iceberg { topic interface.statistics { rule snmp-check-interface-flaps { |
description "Collects link flap count periodically"; |
synopsis "Interface flaps analyzer"; |
keys index; |
/* |
|
* |
Collects |
the link flap count on an interface |
* for every collected metric during a 60s time range (red). |
|
|
* Use snmp index of interface as key for rule. |
|
*/ sensor |
interfaces { synopsis "Interface snmp sensor definition"; |
|
description "Interfaces snmp sensor to collect data from network device"; |
snmp { table JUNIPER-IF-MIB::ifJnxTable; |
frequency 290s; } } |
/* |
* Fields defined using sensor path. Map |
the longer sensor names |
|
|
|
* |
to |
the |
shorter |
field |
names |
used in the rules. |
|
|
*/ field flaps |
{ |
|
|
sensor interfaces { |
|
path ifJnxCarrierTrans; |
|
|
|
|
|
|
|
} type |
integer; |
description "Number of interface flaps"; |
|
} |
|
field index { |
|
sensor interfaces { |
|
path index; |
|
} |
|
type string; } rule-properties { |
|
version 2; |
|
contributor juniper; |
supported-healthbot- |
version 1.0.1; supported-devices { |
|
|
juniper { |
operating-system junos { products EX { |
|
releases 17.3R1 { |
|
|
|
|
|
|
|
release-support min-supported-release; |
platform EX9200; |
|
|
} |
|
releases 18.3R1 { |
|
release-support min-supported-release; |
platform EX4650; |
|
|
|
} releases |
18. |
4R1 { release-support min-supported-release; platform |
EX4600; } } products |
MX { releases |
14. |
1R1 { release-support min-supported-release; platform [ |
MX2010 MX2020 MX240 MX480 MX960 ]; } releases |
17. |
3R1 { release-support min-supported-release; platform |
MX150; } } |
|
|
products PTX { |
|
releases 17.2R1 |
{ |
|
release-support min-supported-release; |
platform [ PTX1000 PTX10000 PTX5000 ]; |
|
|
} |
|
|
} |
|
products QFX { |
|
releases 17.2R1 { |
release-support min-supported-release; |
|
|
platform [ QFX10000 QFX5200 ]; |
|
} |
|
releases 18.1R1 { |
release-support min-supported-release; |
|
|
platform QFX5100; |
|
} |
|
releases 18.3R1 { |
release-support min-supported-release; |
|
platform QFX5120-48Y; |
|
} |
|
} |
} } } } } } } |