Drop in the number of BGP received routes-juniper-junos

Drop in the number of BGP received routes-juniper-junos
0

Drop in the number of BGP received routes-juniper-junos

Vendor: juniper

OS: junos

Description:
indeni will track the number of BGP connections to detect when the number of connections drops.

Remediation Steps:

    "Identify any network and server issues which may be causing this.

junos-show-bgp-neighbor

name: junos-show-bgp-neighbor
description: Retrieve BGP neighbor information
type: monitoring
monitoring_interval: 1 minute
requires:
  vendor: juniper
  os.name: junos
comments:
  bgp-received-routes:
    why: |
      Check if a BGP neighbor's received routes changed in a substantial way.
    how: |
      This script logs into the Juniper JUNOS-based device using SSH and retrieves the output of the "show bgp neighbor" command.
      The output includes the status of active/established/inactive BGP neighbors.
    can-with-snmp: false
    can-with-syslog: true
  bgp-state:
    why: |
      Due to the dynamic nature of BGP, it should be closely monitored to verify that it is working correctly.
      Since routing is a vital part of any network, a failure or issues in dynamic routing can cause large disruptions.
    how: |
      This script logs into the Juniper JUNOS-based device using SSH and retrieves the output of the "show bgp neighbor" command.
      The output includes the status of active/established/inactive BGP neighbors.
    can-with-snmp: false
    can-with-syslog: true
steps:
  -   run:
        type: SSH
        command: show bgp summary
      parse:
        type: AWK
        file: show-bgp-neighbor.parser.1.awk

cross_vendor_bgp_drop_detection

package com.indeni.server.rules.library.core
import com.indeni.ruleengine.expressions.OptionalExpression
import com.indeni.ruleengine.expressions.core.{ConstantExpression, StatusTreeExpression}
import com.indeni.ruleengine.expressions.data.{SelectTagsExpression, SelectTimeSeriesExpression, TimeSeriesExpression}
import com.indeni.ruleengine.expressions.tools.ChangeDetectionExpression
import com.indeni.ruleengine.expressions.utility.IsEmptyExpression.IsEmptyExpressionHelper
import com.indeni.server.common.data.conditions.True
import com.indeni.server.params.ParameterDefinition
import com.indeni.server.params.ParameterDefinition.UIType
import com.indeni.server.rules.library.{ConditionalRemediationSteps, PerDeviceRule, RuleHelper}
import com.indeni.server.rules.{DeviceCategory, DeviceKey, RuleCategory, RuleContext, RuleMetadata}
import com.indeni.server.sensor.models.managementprocess.alerts.dto.AlertSeverity


case class BgpDropDetectionRule() extends PerDeviceRule with RuleHelper {


  private[library] val confidenceLevelParameterName = "Confidence_Level_Threshold"
  private val confidenceLevelParameter = new ParameterDefinition(confidenceLevelParameterName,
    "",
    "Confidence Level (%)",
    "If the number of BGP received routes drops drastically, an issue will be triggered..",
    UIType.DOUBLE,
    95)


  override val metadata: RuleMetadata = RuleMetadata.builder(
    "cross_vendor_bgp_drop_detection",
    "Drop in the number of BGP received routes",
    "indeni will track the number of BGP connections to detect when the number of connections drops.",
    AlertSeverity.INFO,
    categories = Set(RuleCategory.HealthChecks),
    deviceCategory = DeviceCategory.AllDevices)
    .configParameters(confidenceLevelParameter).build()

  override def expressionTree(context: RuleContext): StatusTreeExpression = {
    val confidenceLevel: OptionalExpression[Double] = getParameterDouble(confidenceLevelParameter)
    val actualValue = TimeSeriesExpression[Double]("bgp-received-routes")
    val changeDetectionExp = ChangeDetectionExpression(actualValue, confidenceLevel).down().withLazy

    StatusTreeExpression(
      // Which objects to pull (normally, devices)
      SelectTagsExpression(context.metaDao, Set(DeviceKey), True),

      // What constitutes an issue
      StatusTreeExpression(
        // The additional tags we care about (we'll be including this in alert data)
        SelectTagsExpression(context.tsDao, Set("name"), withTagsCondition("bgp-received-routes")),

        StatusTreeExpression(
          // The time-series we check the test condition against:
          SelectTimeSeriesExpression[Double](context.tsDao, Set("bgp-received-routes"), denseOnly = true),

          // The condition which, if true, we have an issue. Checked against the time-series we've collected
          changeDetectionExp.nonEmpty
        ).withSecondaryInfo(
          scopableStringFormatExpression("${scope(\"name\")}"),
          scopableStringFormatExpression("Number of BGP received routes dropped by %.2f%%. From %.2f on average to %.2f on average", changeDetectionExp.changePercentage, changeDetectionExp.before, changeDetectionExp.after),
          title = "Drop in BGP routes"
        ).asCondition()
      ).withoutInfo().asCondition()
    ).withRootInfo(
      getHeadline(),
      ConstantExpression(
        "Number of BGP connections dropped drastically."),
      ConditionalRemediationSteps(
        "Identify any network and server issues which may be causing this.")
    )
  }
}