Network Management

Interface state Error disabled alert on syslog event

This article describes the issue when you want to have an alert for the interface Error disabled.

First published date

10/19/2018 8:06 PM

Last published date

7/22/2026 10:50 PM

Overview

This article provides steps on how to create an alert for the interface Port Error disabled. 

Before you can setup this alert you need to
1) Ensure the Devices is configured to log Err-Disable Syslog messages
2) And these messages are sent to Solarwinds Server.

Product section

Network Performance Monitor

Cause

Currently this interface status monitoring is a feature request in the NPM, therefore, it's not available by default in NPM at this point.

Resolution

Note the following for each query below:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

 

You can create an Advanced SQL Alert and use the SQL query in order to get alerted once this syslog message is received within the Syslog service. 

1. Go to Manage Alerts > Create New Alert > Select Custom SQL Alert (Advances option).

2. Select following option as shown in the screenshot below:  

For an exiting console:

JOIN

[Syslog] s on Nodes.NodeID = s.NodeID

  where s.Message LIKE '%Configured from console%'


For 
 

JOIN

[Syslog] s on Nodes.NodeID = s.NodeID

  where s.Message LIKE '%err-disable state%'


~~ If you like to be more specific ~~ 
 

WHERE DATEDIFF(SECOND, DateTime, GETDATE()) 1.2)


Example below 
 

JOIN
[Syslog] s on Nodes.NodeID = s.NodeID
  WHERE s.Ip LIKE '172.18.60.34' 
    AND s.Message LIKE '%err-disable state%'
    AND DATEDIFF(SECOND, s.DateTime, GETDATE()) <= 58