List of Preconfigured Alerts and Default Settings for each in Auvik Alerts v2

This alert will notify when an Auvik Collector has disconnected from your network.

Possible causes for this include:

• Auvik is performing routine maintenance to upgrade the collector.
• Device running the collector has powered down.
• Collector has been powered down or stopped.
• Device running the collector has lost connection to the network.

In order to resolve this alert:

• Check the status of the collector or device the collector is running on (hypervisor, Windows desktop, or Windows server) and power it on again.

This alert will notify when a CPU module is reported as bad or degraded by a VMware hypervisor hardware sensor.

Possible causes for this include:

• Hardware sensors for an on-board CPU module have identified a bad or degraded state for the component.

In order to resolve this alert:

• Replace affected components as soon as possible. This can potentially cause application degradation and/or an outage for your clients.

This alert will notify when a hard drive is reported as bad or degraded by a VMware hypervisor hardware sensor.

Possible causes for this include:

• The hardware sensor and/or RAID controller is reporting a bad or degraded status for a specific drive.

In order to resolve this alert:

• Replace the degraded hard drive. You’ll need to schedule a maintenance window for the physical swap. If the drives are in a RAID array, account for time for data replication to occur on the new drive.

This alert will notify when a power supply is reported as bad or degraded by a VMware hypervisor hardware sensor.

Possible causes for this include:

• The hardware sensor for the hypervisor’s power supply is reporting a bad or degraded status.

In order to resolve this alert:

• Order a replacement power supply if a spare isn’t in storage. Replace the power supply as soon as possible.

This alert will notify when a RAM module is reported as bad or degraded by a VMware hypervisor hardware sensor.

Possible causes for this include:

• The hardware sensor for the hypervisor’s RAM module is reporting a bad or degraded status.

In order to resolve this alert:

• Replace the affected module.

This alert will notify when the amount of broadcast traffic is greater than the defined thresholds on a device.

Possible causes for this include:

• A malfunction or misconfiguration that’s pushing a lot of traffic.
• A new (possibly rogue) DHCP server that’s been plugged in.
• A loop in the network that’s causing a broadcast storm.

In order to resolve this alert:

• Check the device the interface is connected to in order to see what could be causing high broadcast traffic. A malfunction or misconfiguration could be pushing a lot of traffic.
• Check for network loops. Hardware loops can be seen on Auvik’s network map. Unplug where necessary.
• If the alert is on a managed switch, check logs for spanning tree errors.
• Check for new switches or hubs that may have be added by the client and not configured properly.
• For advanced troubleshooting and where the switch permits, set up a port mirror on the port reporting high broadcast traffic. Use a laptop to perform a packet capture on traffic traversing the mirrored port. Inspect the traffic from the switch for further insight.

This alert will notify when a stack member is in an unexpected state.

Possible causes for this include:

• New stack member has been added

• Stack member has gone offline or been rebooted and is going through typical stack sequence to determine priority.

In order to resolve this alert:

• Check on the status of the device and determine why it’s in the unexpected state

This alert will notify when a fan is no longer in a good state.

Possible causes for this include:

• A fan has failed or is operating below its expected speed.
• A fan module is loose, disconnected, or has been removed.
• Dust, debris, or another obstruction is restricting the fan or airflow.
• A power supply or power delivery issue is affecting the fan.
• High device temperatures or increased load are causing abnormal fan operation.
• The device is reporting an incorrect or temporary hardware status.

In order to resolve this alert:

• Check the device temperature and ensure its vents and airflow are not obstructed.
• Verify that the fan or fan module is securely installed and receiving power.
• Clean, reseat, or replace the affected fan according to the manufacturer’s instructions.
   

This alert will notify when a power supply unit is no longer in a good state.

Possible causes for this include:

• A power supply unit has failed or is beginning to fail.
• The power supply is disconnected, loose, or not fully seated.
• Power to the unit has been interrupted by an outlet, circuit, UPS, or power distribution unit.
• A redundant power supply has been removed or is not receiving power.
   

In order to resolve this alert:

• Verify that the power cable is secure and that the outlet, UPS, or power distribution unit is providing power.
• Replace the power supply if it continues to report a degraded or failed status. Follow the manufacturer’s documentation and safety procedures.
   

This alert will notify when all VPN tunnels on the firewall are no longer up.

Possible causes for this include:

• Gateway configuration has changed
• The firewall is down due to a power down or link down
  VPN appliance is down

In order to resolve this alert:

• Confirm that the firewall and its WAN interface are online and can reach the internet.
• Review the firewall’s logs for authentication, IKE, IPsec, routing, or connectivity errors.
• Review recent configuration, firewall policy, NAT, DNS, routing, or ISP changes that may affect all tunnels.
   

This alert will notify when a new primary has been detected in an HA cluster.

Possible causes for this include:

• The previous primary device restarted, shut down, or lost power.
• The previous primary device experienced a hardware, software, or configuration issue.
• HA settings or cluster membership were changed.

In order to resolve this alert:

• Check the previous primary device for power, hardware, software, connectivity, or resource issues.
• Review the devices’ logs for the reason and time of the failover.
• Verify that HA heartbeat and synchronization connections are operating normally.
• Confirm that the active and standby devices are synchronized.
   

This alert will notify when a HA synchronization is not in a healthy state.

Possible causes for this include:

• Loss of network connectivity between HA peers.
• An HA peer is offline.
• Mismatched configurations, firmware versions, or licenses between HA peers.
• Incorrect HA settings, such as authentication, interface, or synchronization configuration.
• A synchronization process that is stalled or has encountered an error.
• High resource utilization or a hardware issue affecting an HA peer.

In order to resolve this alert:

• Confirm that all HA peers are online and operational.
• Verify connectivity over the interfaces used for HA synchronization.
• Review the HA status and system logs on each device to identify synchronization errors.
• Confirm that the HA configuration, firmware version, and licensing are compatible across the peers.
   

This alert will notify when a stack member is in an unexpected state.

Possible causes for this include:

• Bad or loose cable

• Faulty stack port

In order to resolve this alert:

• Check on the status of the device and determine why the port is no longer accessible.

This alert will notify when a network element has gone offline.

Possible causes for this include:

• Power outage or brownout.
• Upstream switch or router on the network is also having issues.
• Device misconfiguration.
• ICMP traffic to device blocked.
• Emergency maintenance.
• Hardware malfunction.
• Crash related to the operating system.
• Device removed from network.

In order to resolve this alert:

• Check the status of the device to determine why it’s no longer online.

This alert will notify when your internet connection has been lost for more than 5 minutes.

Possible causes for this include:

• Connectivity issues from the ISP.
• Malfunction in an edge network device (e.g., firewall).
• Power outage or brownout.

In order to resolve this alert:

• Check with your ISP to confirm if they’re having any connectivity issues.

This alert will notify when a power outage has occurred and the UPS is running on battery power.

Possible causes for this include:

• Power outage or brownout.
• Power disconnection.
• UPS was powered off.

In order to resolve this alert:

• If a power outage occurred, power down all devices connected to the UPS before they power down as a result of the UPS running out of battery power. Check any breakers to confirm the power outage wasn’t a result of a breaker trip.

This alert will notify when a UPS battery is getting low.

In order to resolve this alert:

• Charge or replace the battery.

This alert will notify when a VPN remote gateway is no longer available.

Possible causes for this include:

• Gateway configuration has changed.
• One side of the tunnel is down due to a power down or link down.
• VPN appliance is down.

In order to resolve this alert:

• Check the VPN remote gateway connection to determine why it’s no longer reporting as available.

This alert will notify when a new Auvik collector has been powered on and requires your approval.

In order to resolve this alert:

• Approve the new collector so it can start discovering details about your network.

This alert will notify when the firmware on a network element has changed (upgrade or downgrade).

In order to resolve this alert:

• Check that the change completed correctly.

This alert will notify when the CPU utilization has been greater than the defined thresholds on a device for several minutes.

Possible causes for this include:

• A runaway process on the affected device.

In order to resolve this alert:

• Check the device to see what could be causing high CPU utilization. Stop the process if necessary.

This alert will notify when the interface utilization is greater than the defined thresholds on a device.

Possible causes for this include:

• Bandwidth hogs.
• An attached device performing a backup.
• Misconfigured device sending out multiple ARP requests.

In order to resolve this alert:

• Check the device to see what could be causing high interface utilization.

This alert will notify when the memory utilization is greater than the defined thresholds on a device.

Possible causes for this include:

• Memory leaks.
• Processes running on a device to see what’s using memory.
• Memory size not large enough to support OS image (if you upgraded recently).
• Memory fragmentation.

In order to resolve this alert:

• Check the device to see what could be causing high memory utilization.

This alert will notify when the packet discards for a device are greater than the defined thresholds.

Possible causes for this include:

• Network congestion.
• Interface receiving tagged traffic for a VLAN it’s not configured to use.
• Spanning tree with blocked port.
• Faulty hardware.
• Port authentication or port-security violations.
• Frames exceeding storm control limits.
• All zero MAC addresses for either the source or the destination.
• MAC address of source and destination are equal.
• ARP requests with all zeros for the IP address.
• Hardware ACL dropping traffic.
• Hardware queue on the interface is full (overbooking).
• Software buffer is full (CPU doesn’t have enough resources to process traffic).
• Multi-path fading (if device is an access point or wireless).

In order to resolve this alert:

• Check the device to see what could be causing excessive packet discards.

This alert will notify when the packet errors for a device are greater than the defined thresholds.

Possible causes for this include:

• Alignment errors.
• FCS (frame check sequence) errors.
• CRC (cyclic redundancy check) errors.
• Too long/too short errors.
• Overloaded device.

In order to resolve this alert:

• Check the device logs to see what type of packet errors are occurring.

This alert will notify when storage utilization is running high on a device.

In order to resolve this alert:

• Check the device to confirm if it’s running low on storage resources. Removing unwanted items to clear space will help.

This alert will notify when an infrastructure device has gone offline.

Possible causes for this include:

• Device is no longer responding to pings from the Auvik collector.
• Device has been powered down.
• Device has crashed.
• Power outage or brownout.
• Emergency maintenance.
• Device removed from the network.

In order to resolve this alert:

• Check on the status of the device to determine why it is no longer online.

This alert will notify if a snapshot for a virtual machine has not been taken.

In order to resolve this alert:

• Take a new snapshot if determined a new snapshot should be taken for the virtual machine.

This alert will notify when the software on a network element has changed (upgrade or downgrade).

In order to resolve this alert:

• Check that the change completed correctly.

This alert will notify when the number of available snapshots for a virtual machine has exceeded the allowed number.

In order to resolve this alert:

• From VMware: reduce the number of snapshots by deleting old snapshots that are no longer needed.

This alert will notify when the size of a hypervisor’s snapshot repository has exceeded the allowed size (in GB).

In order to resolve this alert:

• From VMware: reduce the size of the hypervisor’s snapshot repository by deleting old snapshots that are no longer needed.

This alert will notify when when a network device has been online past a specific time period.

Some devices that are up for too long begin to run poorly and may display other issues. This alert can also be used to determine if a device has gone too long without a firmware update.

In order to resolve this alert:

• Restart the device.

This alert will notify when a UPS battery needs to be replaced.

In order to resolve this alert:

• Replace the old battery with a new battery.

This alert will notify when the output tray for a printer has been removed and not put back.

In order to resolve this alert:

• Check the printer and put the output tray back.

This alert will notify when the input tray for a printer has been removed and not put back.

In order to resolve this alert:

• Check the printer and put the input tray back.

This alert will notify when paper has become jammed in a printer.

In order to resolve this alert:

• Check the printer and remove any paper that’s jamming the works.

This alert will notify when when a printer has gone offline.

In order to resolve this alert:

• Check the status of the device to determine why it’s no longer online. If needed, power it back on.

This alert will notify when a BGP neighbor connection status is not established.

Possible causes for this include:

• The local device or remote BGP peer is offline.
• The BGP neighbor has been administratively disabled.
• Network connectivity between the peers has been interrupted.
• TCP port 179 is blocked by a firewall or access control list.
• The peer IP address, local or remote autonomous system number (ASN), authentication settings, or source interface is incorrectly configured.
• A routing policy, prefix limit, or incompatible BGP capability caused the session to close.

In order to resolve this alert:

• Check the BGP neighbor state and device logs for messages explaining why the session did not establish.
• Verify that both devices are online and that the peer IP address is reachable from the expected source interface.
• Confirm that TCP port 179 is permitted between the peers.
• Compare the BGP configuration on both devices, including the peer IP addresses, ASNs, authentication settings, address families, and source interfaces.
• Review routing policies, prefix limits, and recent configuration changes that may have caused the session to close.

This alert will notify when an OSPF neighbor connection status is not up.

Possible causes for this include:

• The neighboring device or connected interface is down or unreachable.
• OSPF is disabled or incorrectly configured on one of the devices.
• The devices have mismatched OSPF settings, such as area ID, authentication, hello/dead timers, network type, or MTU.
• An access control list or firewall rule is blocking OSPF traffic.
• Duplicate OSPF router IDs are configured.
• High device resource utilization or a software issue is preventing OSPF from operating correctly.

In order to resolve this alert:

• Verify that both neighboring devices and their connecting interfaces are online.
• Confirm IP connectivity between the OSPF neighbors.
• Review the OSPF neighbor state and device logs to identify where adjacency formation is failing.
• Compare the OSPF configuration on both devices, including the area ID, authentication, timers, network type, subnet, and MTU.
• Confirm that no access control list or firewall policy is blocking OSPF traffic.
• Verify that each OSPF router has a unique router ID.

This alert will notify when the number of SSL VPN sessions in use is greater than or equal to the maximum entered for the firewall.

In order to resolve this alert:

• Check that there are enough licenses and hardware capacity.

This alert will notify when the number of available SSL VPN sessions remaining, based on the maximum entered, is less than the defined threshold for the firewall.

In order to resolve this alert:

• Check that there are enough licenses and hardware capacity.

This alert will notify when the number of SSL VPN sessions in use is greater than the defined threshold for the firewall.

In order to resolve this alert:

• Check that there are enough licenses and hardware capacity.

This alert will notify when the percentage of SSL VPN sessions in use, relative to the maximum entered, is greater than the defined threshold for the firewall.

In order to resolve this alert:

• Check that there are enough licenses and hardware capacity.