check-isis-statistics.rule

/*
 * Detects ISIS packet drops and notifies when anomalies are found.
 * Two input control detection
 * 
 *   1) drops-threshold, is the threshold that causes the rule to report an
 *      anomaly. By default it's 1. This rule will set a dashboard color to
 *      red when packet drop count is greater than 'drops-threshold' for 3
 *      minutes period, otherwise color is set to green.
 *
 *   2) interface-name, is a regular expression that matches the interfaces
 *      that you would like to monitor.  By default it's '.*', which matches
 *      all interfaces. Use something like 'ge.*' to match only ISIS
 *      adjacencies contains gigabit ethernet interfaces.
 *
 */
 healthbot {
    topic routing.isis {
        description "Monitors isis statitics i.e. adjacency state& statistics and notify anomalies";
        synopsis "ISIS adjacency statistics analyzer";
        rule check-isis-statistics {
            description "Collects ISIS session statistics(lsp, csnp, esh, iih, ish, psnp and unknown drops) periodically and notify anomaly when breaches threshold";
            synopsis "ISIS adjacency statistics analyzer";
            /*
             * Monitors ISIS adjacency statistics. Notifies via the dashboard
             * colors when the lsp, csnp, esh, iih, ish, psnp and unknown drops
             * increase by {{drops-threshold}} for  every collected metric during
             * a 3ms time range (red). Otherwise the color is set to green.
             * 
             * Use interface name as key for rule.
             */
            keys interface-name;
            /*
             * Sensor configuration to get data from network devices
             */
            sensor isis-sensor {
                synopsis "ISIS open-config sensor definition";
                description "Open-config sensor to collect telemetry data from network device";
                open-config {
                    sensor-name /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/;
                    frequency 60s;
                }
            }
            /*
             * Fields defined using sensor path. Map the longer sensor names
             * to the shorter field names used in the rules.
             */
            field csnp-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/csnp/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of csnp drops";
            }
            field esh-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/esh/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of esh drops";
            }
            field iih-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/iih/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of iih drops";
            }
            field interface-name {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id";
                }
                type string;
                description "Interfaces to be monitored";
            }
            field ish-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/ish/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of ish drops";
            }
            field lsp-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/lsp/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of lsp drops";
            }
            field psnp-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/psnp/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of psnp drops";
            }
            field threshold {
                constant {
                    value "{{drops-threshold}}";
                }
                type integer;
                description "Packet drops threshold";
            }
            field unknown-drops {
                sensor isis-sensor {
                    where "/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/@interface-id =~ /{{interface-name}}/";
                    path /network-instances/network-instance/protocols/protocol/isis/interfaces/interface/packet-counters/unknown/state/dropped;
                    zero-suppression;
                }
                type integer;
                description "Number of unknown drops";
            }
            /*
             * Anomaly detection logic to detect frame discards
             */
            trigger isis-csnp-drops {
                alert-type routing.isis.drops.csnp.isis-csnp-drops;
                synopsis "ISIS csnp drops kpi";
                description "Sets health based on increase in ISIS session's csnp drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the csnp drop ($csnp-drops) count is not increasing
                 */
                term csnp-drops-normal {
                    when {
                        matches-with-previous "$csnp-drops"{
                            time-range 2.5offset;
                            latest;
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS CSNP packet drops $csnp-drops are not increasing on $interface-name";
                        }
                    }
                }
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the csnp drop ($csnp-drops) count increases
                 */
                term csnp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$csnp-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS CSNP packet drops $csnp-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-esh-drops {
                alert-type routing.isis.drops.esh.isis-esh-drops;
                synopsis "ISIS esh drops kpi";
                description "Sets health based on increase in ISIS session's esh drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the esh-drops ($esh-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$esh-drops"{
                            time-range 2.5offset;
                            latest;
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS ESH packet drops $esh-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the esh drop ($esh-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$esh-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS ESH packet drops $esh-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-iih-drops {
                alert-type routing.isis.drops.iih.isis-iih-drops;
                synopsis "ISIS iih drops kpi";
                description "Sets health based on increase in ISIS session's iih drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the iih-drops ($iih-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$iih-drops"{
                            time-range 2.5offset;
                            latest;	
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS IIH packet drops $iih-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the iih drop ($iih-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$iih-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS IIH packet drops $iih-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-ish-drops {
                alert-type routing.isis.drops.ish.isis-ish-drops;
                synopsis "ISIS ish drops kpi";
                description "Sets health based on increase in ISIS session's ish drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the ish-drops ($ish-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$ish-drops"{
                            time-range 2.5offset;
                            latest;	
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS ISH packet drops $ish-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the ish drop ($ish-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$ish-drops" {
                            value "$threshold";
                            time-range 2.5offset;	
                            latest;						
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS ISH packet drops $ish-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-lsp-drops {
                alert-type routing.isis.drops.lsp.isis-lsp-drops;
                synopsis "ISIS lsp drops kpi";
                description "Sets health based on increase in ISIS session's lsp drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the lsp-drops ($lsp-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$lsp-drops"{
                            time-range 2.5offset;
                            latest;	
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS LSP packet drops $lsp-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the lsp drop ($lsp-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$lsp-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS LSP packet drops $lsp-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-psnp-drops {
                alert-type routing.isis.drops.psnp.isis-psnp-drops;
                synopsis "ISIS psnp drops kpi";
                description "Sets health based on increase in ISIS session's psnp drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the psnp-drops ($psnp-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$psnp-drops"{
                            time-range 2.5offset;
                            latest;	
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS PSNP packet drops $psnp-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * the psnp drop ($psnp-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$psnp-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS PSNP packet drops $psnp-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            trigger isis-unknown-drops {
                alert-type routing.isis.drops.unknown.isis-unknown-drops;
                synopsis "ISIS unknown drops kpi";
                description "Sets health based on increase in ISIS session's unknown drop count and notify anomaly";
                frequency 1offset;
                /*
                 * Sets color to green when the unknown-drops ($unknown-drops) count is not increasing
                 */
                term lsp-drops-normal {
                    when {
                        matches-with-previous "$unknown-drops"{
                            time-range 2.5offset;
                            latest;	
                        }
                    }				
                    then {
                        status {
                            color green;
                            message "ISIS unknown packet drops $unknown-drops are not increasing on $interface-name";
                        }
                    }
                }				
                /*
                 * Sets color to red and sends out an anomaly notification when
                 * unknown drop ($unknown-drops) count increases
                 */
                term lsp-drops-increasing {
                    when {
                        increasing-at-least-by-value "$unknown-drops" {
                            value "$threshold";
                            time-range 2.5offset;
                            latest;							
                        }
                    }
                    then {
                        status {
                            color red;
                            message "ISIS unknown packet drops $unknown-drops are increasing on $interface-name";
                        }
                    }
                }
            }
            variable drops-threshold {
                value 1;
                type int;
                description "Packet drops threshold: Increase between metrics, before we report anomaly";
            }
            variable interface-name {
                value .*;
                type string;
                description "Interface names to monitor, regular expression, eg 'ge-.*'";
            }
            rule-properties {
                version 2;
                contributor juniper;
                category advanced;
                is-scaling-rule {
                    description "Fields:interface-name ; Directly impacted by number of interfaces running in each network device";
                }				
                supported-healthbot-version 1.0.1;
                supported-devices {
                    juniper {
                        operating-system junos {
                            products MX {
                                platforms MX240 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms MX480 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms MX960 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms MX2010 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms MX2020 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }							
                            }
                            products PTX {
                                platforms PTX5000 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms PTX1000 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }
                                platforms PTX10000 {
                                    releases 17.4R1 {
                                        release-support min-supported-release;
                                    }
                                }							
                            }
                            products ACX {
                                platforms All {
                                    releases 22.1R1 {
                                        release-support min-supported-release;
                                    }
                                }
                            }
                            products EX {
                                sensors isis-sensor;							
                                platforms EX4300-48MP {
                                    releases 22.4R2.8 {
                                        release-support min-supported-release;
                                    }
                                }
                            }							
                        }
                        operating-system junosEvolved {
                            products ACX {
                                platforms All {
                                    releases 22.3R1 {
                                        release-support min-supported-release;
                                    }
                                }
                            }
                        }						
                    }
                }
            }
        }
    }
}