Executing a command file triggered by a threshold exceeded event

In this example, we will demonstrate how to setup a system that switches off port 21 of a switch when the load (in bytes/10s) on the port exceeds a certain threshold. The example described here is not very realistic and you'll probably never use it in a real-life situation but is however very instructive!

The instructions given below are based on the following assumptions:

1. The switch is up-and-running
2. The switch is reachable by SNMP
3. The switch is added to the network map and has a name: "Switch20"
4. The IP address of the switch = 192.168.2.20

Step 1) Build the threshold Shooter.

The threshold Shooter can be build with the Shooter-wizard. Switch to Designer mode, right-click the switch object/icon on the map for which to build the Shooter (be aware that Shooters are build at the class level, not for an individual device!) and select Define Shooters (Wizard).

1. Click Next
2. Click Next, the device is being inspected
3. Select B. Interfaces
4. Select B. Transmitted and Received bytes per Interface
5. Select F. Threshold Shooter
6. Select B. 10 seconds
7. Select A. Fixed and enter “.21” in the edit box
8. Enter the threshold value (we entered 100000 = 100000 bytes/10 sec!!!) and a name for the Shooter
9. Click Build
10. Select B. Start the new Shooter for the right-clicked device

The new Shooter should now be active. Verify this by choosing Options|Threshold control from the menu on the main window

Step 2) Modify the Threshold message

The threshold that we just built will display a system generated message in case the threshold value is exceeded (the Shooter wizard" did not allow us to specify a custom message!). Because it is possible to have more than one threshold Shooter running for a switch at the same time, we need a unique "threshold exceeded" message to test on! The following steps describe how to specify a unique message.

1. Right-click the device object on the map for which we created the Shooter and select Define Shooters (manually)
2. Click the threshold Shooter in the Shooters box
3. Right-click the "&Formula1" target in the Shooter-targets box and select Modify this Shooter-target
4. Click the Custom message checkbox and enter “Port21 overload!” in the edit box
5. Press Save to save the configuration
6. Close the Define ..Shooters window

Step 3) Create the commandfile to execute

Open notepad.exe and create a command file “EventScript.cmd” with the code as shown below and save the command file in a directory on disk (we chose “c:\Temp”):

Step 4) Verify the Alert-table and enable the "Execute a program or script triggered by an event" option

1. Choose Option|Global configuration from the menu on the main window and select the Alerting tab
2. Ensure that the entry in the Alert-table representing the Class for which you have built the threshold Shooter displays “Alert” in the “Threshold” column. Eventually modify the “Class Priority Level”, the “Event Priority Level” or the “Alerting threshold”.
3. Check the Execute a program or script checkbox and click the Customize control
4. Check and/or Uncheck the controls on the page so that it matches the screenshot below:

   

Note that in the commandfile we test on the device-name (%2 = "Switch20") and the event-message (%5 = "Port21 overload!")

Step 4) Download and install FineSNMPSet.exe

FineSNMPSet is a small and simple free-ware program, developed by FineConnection that can be used to set an arbitrary SNMP object to a specified value. FineSNMPSet can be downloaded here . Install FineSNMPSet.exe in your Monitor one installation directory (“c:\Program Files\FineConnection\Monitor one\”. More information on FineSNMPSet can be found at: http://www.fineconnection.com/SNMPSet

You can now test the configuration. If the load on port 21 of the switch exceeds 100000 bytes/10s then the switchport is switched off.

P.S. Port21 can be switched on again by entering the following command in a shell/command box: