banshee/network-collection/network/snmp/ospf-neighbors

OSPF neighbors of a router, by SNMP

Returns, for each OSPF neighbor of a router, the state of the adjacency and its number of state changes, and the number of neighbors. Four watches are offered: no neighbor at all, an adjacency not formed, a neighbor missing, and an adjacency that flaps.

How it works

The collector reads ospfNbrTable (OSPF-MIB, RFC 4750). A neighbor is named by its address (192.0.2.2); a neighbor on an unnumbered interface carries, after #, the interface index the table gives it (ospfNbrAddressLessIndex).

The state is ospfNbrState in words: down, attempt, init, two-way, exchange-start, exchange, loading, full.
"Adjacency not formed" is critical when a neighbor stays neither full nor two-way for 3 runs. two-way is the normal state between two routers that are not the designated router of their segment; exchange and loading pass within a few seconds.
A neighbor that falls leaves the table after its dead interval: it does not read down, it is no longer there. It is seen by "Missing neighbor", once its address is named on the probe, or by "No neighbor" when it was the last one.
The state changes are ospfNbrEvents, a counter: "Adjacency flapping" raises when it grows by more than 20 in an hour.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

The SNMP agent of the router enabled, reachable from the poller (UDP 161), its access restricted to the poller.
The view granted to the poller includes ospf (.1.3.6.1.2.1.14).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).
Versions: any router whose agent serves OSPF-MIB (RFC 4750, or its predecessor RFC 1850, whose neighbor table is the same), whatever its brand.

Outputs

Name	Label	Unit	Per instance
`state`	Adjacency state	—	yes, per neighbor
`events`	State changes	—	yes, per neighbor
`neighbors`	Neighbors	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`no-neighbor`	No neighbor	below a threshold, on `neighbors`	critical below 1	yes
`not-adjacent`	Adjacency not formed	expected value, on `state`	critical when the state is neither `full` nor `two-way`, for 3 runs	yes
`missing`	Missing neighbor	expected instances, on `state`	no neighbor named: it raises nothing until addresses are set on the probe	no
`flapping`	Adjacency flapping	increase, on `events`	warning beyond 20 in 1 h	no

Limits

OSPF-MIB is OSPFv2, IPv4: OSPFv3 neighbors (IPv6) are in OSPFV3-MIB, not read here.
A router without OSPF, or that does not serve OSPF-MIB, reads no neighbor: "No neighbor" is then critical.
A router with several OSPF processes or VRFs usually lists only its default one in OSPF-MIB.