| 1 | # you can disable an alarm notification by setting the 'to' line to: silent |
| 2 | |
| 3 | # --- Availability: Peer Down (SNMP) --- |
| 4 | |
| 5 | template: snmp_bgp_peer_down |
| 6 | on: snmp.bgp.peers.availability |
| 7 | chart labels: neighbor=* |
| 8 | class: Availability |
| 9 | type: Network |
| 10 | component: BGP |
| 11 | lookup: average -2m unaligned of admin_enabled,established |
| 12 | calc: ($admin_enabled == 1 AND $established == 0) ? (1) : (0) |
| 13 | units: status |
| 14 | every: 30s |
| 15 | crit: $this == 1 |
| 16 | delay: down 2m multiplier 1.5 max 30m |
| 17 | summary: SNMP BGP peer ${label:neighbor} down |
| 18 | info: SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) is administratively enabled but has remained out of Established for the full 2-minute evaluation window |
| 19 | to: sysadmin |
| 20 | |
| 21 | # --- Availability: Peer-Family Down (SNMP) --- |
| 22 | |
| 23 | template: snmp_bgp_peer_family_down |
| 24 | on: snmp.bgp.peer_families.availability |
| 25 | chart labels: neighbor=* address_family=* subsequent_address_family=* |
| 26 | class: Availability |
| 27 | type: Network |
| 28 | component: BGP |
| 29 | lookup: average -2m unaligned of admin_enabled,established |
| 30 | calc: ($admin_enabled == 1 AND $established == 0) ? (1) : (0) |
| 31 | units: status |
| 32 | every: 30s |
| 33 | crit: $this == 1 |
| 34 | delay: down 2m multiplier 1.5 max 30m |
| 35 | summary: SNMP BGP peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family} down |
| 36 | info: SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family} has remained out of Established for the full 2-minute evaluation window |
| 37 | to: sysadmin |
| 38 | |
| 39 | # --- Errors: Established Transition Anomaly (SNMP) --- |
| 40 | |
| 41 | template: snmp_bgp_peer_transitions_anomaly |
| 42 | on: snmp.bgp.peers.established_transitions |
| 43 | chart labels: neighbor=* |
| 44 | class: Errors |
| 45 | type: Network |
| 46 | component: BGP |
| 47 | lookup: average -10m anomaly-bit of transitions |
| 48 | calc: $this |
| 49 | units: % |
| 50 | every: 30s |
| 51 | warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 52 | crit: $this > (($status == $CRITICAL) ? (20) : (40)) |
| 53 | delay: down 10m multiplier 1.5 max 1h |
| 54 | summary: SNMP BGP transition anomaly on peer ${label:neighbor} |
| 55 | info: Rolling ML anomaly rate for established-transition counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}); sustained anomalies usually indicate flaps or unstable reachability |
| 56 | to: sysadmin |
| 57 | |
| 58 | # --- Errors: Peer-Family Established Transition Anomaly (SNMP) --- |
| 59 | |
| 60 | template: snmp_bgp_peer_family_transitions_anomaly |
| 61 | on: snmp.bgp.peer_families.established_transitions |
| 62 | chart labels: neighbor=* address_family=* subsequent_address_family=* |
| 63 | class: Errors |
| 64 | type: Network |
| 65 | component: BGP |
| 66 | lookup: average -10m anomaly-bit of transitions |
| 67 | calc: $this |
| 68 | units: % |
| 69 | every: 30s |
| 70 | warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 71 | crit: $this > (($status == $CRITICAL) ? (20) : (40)) |
| 72 | delay: down 10m multiplier 1.5 max 1h |
| 73 | summary: SNMP BGP transition anomaly on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family} |
| 74 | info: Rolling ML anomaly rate for established-transition counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually indicate flaps or unstable reachability |
| 75 | to: sysadmin |
| 76 | |
| 77 | # --- Errors: Update Churn Anomaly (SNMP) --- |
| 78 | |
| 79 | template: snmp_bgp_peer_updates_anomaly |
| 80 | on: snmp.bgp.peers.update_traffic |
| 81 | chart labels: neighbor=* |
| 82 | class: Errors |
| 83 | type: Network |
| 84 | component: BGP |
| 85 | lookup: average -10m anomaly-bit of received,sent |
| 86 | calc: $this |
| 87 | units: % |
| 88 | every: 30s |
| 89 | warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 90 | crit: $this > (($status == $CRITICAL) ? (20) : (40)) |
| 91 | delay: down 10m multiplier 1.5 max 1h |
| 92 | summary: SNMP BGP update anomaly on peer ${label:neighbor} |
| 93 | info: Rolling ML anomaly rate for BGP UPDATE traffic on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}); sustained anomalies usually indicate route churn or unstable adjacencies |
| 94 | to: sysadmin |
| 95 | |
| 96 | # --- Errors: Peer-Family Update Churn Anomaly (SNMP) --- |
| 97 | |
| 98 | template: snmp_bgp_peer_family_updates_anomaly |
| 99 | on: snmp.bgp.peer_families.update_traffic |
| 100 | chart labels: neighbor=* address_family=* subsequent_address_family=* |
| 101 | class: Errors |
| 102 | type: Network |
| 103 | component: BGP |
| 104 | lookup: average -10m anomaly-bit of received,sent |
| 105 | calc: $this |
| 106 | units: % |
| 107 | every: 30s |
| 108 | warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 109 | crit: $this > (($status == $CRITICAL) ? (20) : (40)) |
| 110 | delay: down 10m multiplier 1.5 max 1h |
| 111 | summary: SNMP BGP update anomaly on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family} |
| 112 | info: Rolling ML anomaly rate for BGP UPDATE traffic on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually indicate route churn or unstable adjacencies |
| 113 | to: sysadmin |
| 114 | |
| 115 | # --- Errors: Accepted Prefix Drift (SNMP) --- |
| 116 | |
| 117 | template: snmp_bgp_peer_family_prefixes_accepted_anomaly |
| 118 | on: snmp.bgp.peer_families.route_counts.current |
| 119 | chart labels: neighbor=* address_family=* subsequent_address_family=* |
| 120 | class: Errors |
| 121 | type: Network |
| 122 | component: BGP |
| 123 | lookup: average -15m anomaly-bit of accepted |
| 124 | calc: $this |
| 125 | units: % |
| 126 | every: 30s |
| 127 | warn: $this > (($status >= $WARNING) ? (5) : (15)) |
| 128 | crit: $this > (($status == $CRITICAL) ? (15) : (30)) |
| 129 | delay: down 10m multiplier 1.5 max 1h |
| 130 | summary: SNMP BGP accepted-prefix drift on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family} |
| 131 | info: Rolling ML anomaly rate for accepted prefix counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually mean unexpected route loss or route growth after policy |
| 132 | to: sysadmin |