I'm not sure if you're talking about switches or routers... but here's
the solution I use for routers.
1) Write a script that gets the next-hop address from every
non-router node you're monitoring.
2) When that node goes down... you ping the next-hop address
to see if its up.
3) If the next-hop address is down, then you just toss out
the original event... because you're assuming the router
interface is down, and not the node.
If the next-hop does respond... then you assume the
event is real... and process it like you would any other
The next-hop address is a MIB-II variable, and just about
every agent supports it.
Gary Boyles, Intel Corp.
From: Dillard, Anthony G [mailto:anthony.g.dillard AT LMCO DOT COM]
Sent: Friday, August 06, 1999 6:48 AM
To: NV-L AT UCSBVM.UCSB DOT EDU
I have what may be a simple problem, but need asst. in getting a correct
fix. I have several sites that I'am unable to ping any routers, and I what
netview to forward to TEC just the switch down without reporting all the
nodes assoc. with the the switch. I tried having a rule query the database
field for a normal status on the switch but this is the answer because
several nodes will come in before the switch is reported. This becomes a
problem when these node down are forwarded to TEC and several problem tkts
are open for one true problem