-
Notifications
You must be signed in to change notification settings - Fork 90
Expand file tree
/
Copy pathcheck-isis-flap-detection.rule
More file actions
177 lines (177 loc) · 7.1 KB
/
check-isis-flap-detection.rule
File metadata and controls
177 lines (177 loc) · 7.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
/*
* Detects ISIS flaps and notifies when anomalies are found.
*/
healthbot {
topic routing.isis {
rule check-isis-flap-detection {
keys interface-name;
synopsis "ISIS adjacency flap detector";
description "Collects ISIS adjacency state periodically and notify anomaly when flap count increases";
sensor isis-netconf {
synopsis "ISIS netconf sensor definition";
iAgent {
file IsisAdjacencyTable.yml;
table IsisAdjacencyTable;
frequency 180s;
}
}
sensor isis-oc {
synopsis "ISIS open-config sensor definition";
description "Open-config sensor to collect telemetry data from network device";
open-config {
sensor-name /network-instances/network-instance/protocols/protocol/isis/interfaces;
frequency 60s;
}
}
field flap-threshold {
constant {
value "{{flap-threshold}}";
}
type integer;
description "Adjacency flap count";
}
field interface-name {
sensor isis-netconf {
where "interface-name =~ /{{interface-name}}/";
path interface-name;
}
sensor isis-oc {
where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
path "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id";
}
type string;
description "Isis interface name";
}
field transition-count {
sensor isis-netconf {
path transition-count;
data-if-missing {
value 1;
}
}
sensor isis-oc {
path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/circuit-counters/state/adj-changes;
}
type integer;
description "Isis neighbor flap count";
}
/*
* Anomaly detection logic.
*/
trigger isis-adjacency-flap {
alert-type routing.isis.flaps.isis-adjacency-flap;
frequency 1offset;
/*
* Sets color to green when flap count is not increasing
*/
term neighbor-stable {
when {
matches-with-previous "$transition-count"{
time-range 2.5offset;
latest;
}
}
then {
status {
color green;
message "ISIS neighbor $interface-name flap count($transition-count) is normal";
}
}
}
/*
* Sets color to red and sends out an anomaly notification when
* the isis flaps count increases for all points in 5offset period.
*/
term is-flap-count-abnormal {
when {
increasing-at-least-by-value "$transition-count" {
value "$flap-threshold";
time-range 2.5offset;
latest;
}
}
then {
status {
color red;
message "ISIS neighbor $interface-name flap count($transition-count) is abnormal";
}
}
}
}
variable flap-threshold {
value 1;
description "Enter flap count threshold value in number";
type int;
}
variable interface-name {
value .*;
description "Enter interface name in regex i.e. ge-.* ";
type string;
}
rule-properties {
version 1;
contributor juniper;
supported-healthbot-version 2.1.0;
supported-devices {
sensors isis-oc;
juniper {
operating-system junos {
products ACX {
platforms All {
releases 22.1R1 {
release-support min-supported-release;
}
}
}
products EX {
sensors isis-oc;
platforms EX4300-48MP {
releases 22.4R2.8 {
release-support min-supported-release;
}
}
}
products MX {
platforms All {
releases 15.1R1 {
release-support min-supported-release;
}
}
}
products PTX {
platforms All {
releases 15.1R1 {
release-support min-supported-release;
}
}
}
products QFX {
platforms All {
releases 15.1R1 {
release-support min-supported-release;
}
}
}
products ACX {
platforms All {
releases 22.1R1 {
release-support min-supported-release;
}
}
}
}
operating-system junosEvolved {
products ACX {
platforms All {
releases 22.3R1 {
release-support min-supported-release;
}
}
}
}
}
}
}
}
}
}