Pls help to check tick to detect port up and down

1

Hi there,

I am new to Kapacitor, and testing to alert port state change, either up or down.

var value=0
stream
|from()
.database(‘mdt_db’)
.measurement(‘generic-counters’)
.where(lambda: “interface-name” == ‘GigabitEthernet0/1/0/18’)
|eval(lambda: int(“carrier-transitions”) % 2)
.as(‘value’) // 1 is up, 0 is down
.keep(‘value’)
|window()
.period(5m)
.every(1m)
.where(lambda: int(“carrier-transitions”) % 2 != value)
|alert()
.crit()
.exec(’/usr/bin/python’, ‘/home/test/lineup.py’,‘carrier-transitions’ )
.log(’/home/test/lineup.log’)

I am keep getting this error msg “no property method “where” on *pipeline.WindowNode, but chaining method does exist. Use ‘|’ operator instead: ‘node|where(…)’.”

Can anyone give a hint?

2

I change to this one, it is accepted, but it still don’t trigger the alert

var value1 = 0

stream
|from()
.database(‘mdt_db’)
.measurement(‘generic-counters’)
.where(lambda: “interface-name” == ‘GigabitEthernet0/1/0/18’)
|eval(lambda: int(“carrier-transitions”) % 2)
.as(‘value1’)
// 1 is up, 0 is down
.keep(‘value1’)
|window()
.period(10m)
.every(1m)
|alert()
.crit(lambda: int(“carrier-transitions”) % 2 != value1)
.exec(’/usr/bin/python’, ‘/home/test/lineup.py’, ‘interface-name’, ‘carrier-transitions’)
.log(’/home/test/lineup.log’)

DOT:
digraph lineup {
graph [throughput=“0.00 points/s”];

stream0 [avg_exec_time_ns=“0s” errors=“0” working_cardinality=“0” ];
stream0 -> from1 [processed=“1798”];

from1 [avg_exec_time_ns=“3.621µs” errors=“0” working_cardinality=“0” ];
from1 -> eval2 [processed=“29”];

eval2 [avg_exec_time_ns=“21.257µs” errors=“0” working_cardinality=“1” ];
eval2 -> window3 [processed=“29”];

window3 [avg_exec_time_ns=“1.298µs” errors=“0” working_cardinality=“1” ];
window3 -> alert4 [processed=“4”];

alert4 [alerts_triggered=“0” avg_exec_time_ns=“398.837µs” crits_triggered=“0” errors=“60” infos_triggered=“0” oks_triggered=“0” warns_triggered=“0” working_cardinality=“1” ];
}

3

I’m not 100% and am quite new to TICK but i would have written that line as

.crit(lambda: "carrier-transitions != value1)

I have a script similar in the sense that it checks for the value 1 or 0 and alerts if 1 appears more than 3 times. I haven’t declared it as an int or anything in my script.

The other error just means .where should have been |where - cant offer much more clarification on that other than it creates a child node in the pipe line based on the parent/calling node.

Maybe you figured it out anyway, if not hope it helps.

4

I have find another workaround, but not really fix the issue. Do you mind to share the script of “alerts if 1 appears more than 3 times.” Is it have to use UDF for this purpose?

5

Hi,

No i haven’t used any UDF stuff as far as i know. The script it as follows

var data = stream
|from()
.database(db)
.retentionPolicy(rp)
.measurement(measurement)
.groupBy(groupBy)
|eval(lambda: "value")
.as('value')
|stateCount(lambda: "value" > crit)

var trigger = data
|alert()
.crit(lambda: "state_count" >= 3)
.stateChangesOnly()
.details(details)
.message(message)
.id(idVar)
.idTag(idTag)
.levelTag(levelTag)
.messageField(messageField)
.durationField(durationField)
.email('email.address@domain.com')

Trigger
|influxDBOut()
.create()
.database(outputDB)
.retentionPolicy(outputRP)
.measurement(outputMeasurement)
.tag('alertName', name)
.tag('triggerType', triggerType)

Trigger
|httpOut('output')

I’ve left out the stuff from the top of my script (database and RP’s and such). The countState node is what i use to count the occurrences and alert. The CRIT value (variable at the top of the script) should be whichever value you want to check so if for example in mine i’m looking for anything greater than 0

VAR crit = 0
Then this will count the occurrence of value greater than 0.

 |eval(lambda: "value")
    .as('value')
    |stateCount(lambda: "value" > crit)

And then instead of alerting on the actual value you check, you alert based on the stateCount being 3 or more. Or which ever you set the count to be. If it counts two occurrences of the value 1 in there and then picks up a 0 as the third value then it resets the count and starts again.

.crit(lambda: "state_count" >= 3)

It might not be of much use to you i don’t really know your full use case but that’ how i have been counting them. It’s worth mentioning that the stateCount property is only available from Kapacitor 1.3 on wards.

Also, where do the 60 errors come from in the line ‘Alert4’? or have you fixed that part?

PhilB

6

This is very helpful, use the statecount and alert.stateChangesOnly. I think this can help to solve my issue.

many thanks,

7

No problem hope it helps you out.

PhilB