Need some suggestions and good practice about root cause of alerts

[Tao Yang]

We have some devices, especially those ISP facing interfaces, once they have any unexpected Interface down/flapping issue, it will always cause Interface alerts, then OSPF/BGP related alerts coming from this interface or failover equipment. Especially when the flapping happened a lot, Networking Operating Center people were overwhelmed by tons of similar alerts/sets/sequence of alerts. They might also come with BFD, BFDD, LLDP which made the noise worse.

I am wondering if there's a good method that if we can automatically identify the root cause then kind of filter the succeeding alerts? Or what is good practice for these kind of scenario.

We cannot just filter OSPF BGP ... alerts as if they are not cause by other issue then we should still receive the alerts.

Thanks!

[Joseph Ackley]

Tao,

The only thing I can think of is to use the Condition Correlation Editor to create a Condition Rule to decide which condition is the Root Cause condition. Then, only display the Root Cause condition in the Alarms tab and ir you are sing AlarmNotifier, only send out e-mail for root cause alarms.

Joe

[Tao Yang]

Joe, I really appreciate your help!
I will start to study Condition Correlation Editor . Again Thank you so much!

[Joseph Ackley]

Glad to help.