Network Management

Since completing our Aruba deployment, I've had a handful of APs act oddly due to layer 1 issues. I've found, for the most part, that these APs show the following sort of events in AirWave:

Recent AMP Device Events (view system event log)
Time User Event
Fri Aug 21 14:56:47 2015 System Status changed to 'AP is no longer associated with controller'
Fri Aug 21 14:56:47 2015 System Down
Fri Aug 21 14:16:33 2015 System Status changed to 'Poll missed 1 SNMP pings'
Fri Aug 21 13:56:25 2015 System Status changed to 'OK'
Fri Aug 21 13:49:41 2015 System Status changed to 'Poll missed 1 SNMP pings'
Fri Aug 21 04:16:32 2015 System Configuration verification succeeded; configuration is good
Fri Aug 21 03:21:28 2015 System Configuration verification succeeded; configuration is good
Fri Aug 21 03:21:12 2015 System Status changed to 'OK'
Fri Aug 21 03:21:12 2015 System Up
Fri Aug 21 03:12:33 2015 System Status changed to 'AP is no longer associated with controller'
Fri Aug 21 03:12:33 2015 System Down
Fri Aug 21 03:07:31 2015 System Status changed to 'Poll missed 1 SNMP pings'
Fri Aug 21 02:37:20 2015 System Status changed to 'OK'
Fri Aug 21 02:30:55 2015 System Status changed to 'Poll missed 1 SNMP pings'

There will be multiple "Poll missed 1 SNMP pings" over the course of a day and I will find that the AP in question will have spent most of its time rolling from LMS to BKLMS over and over. I have an AIrWave trigger setup that says EVENT CONTENTS MATCHES <variations of 'Poll missed 1 SNMP pings' message>, but I've never seen the alert trigger despite finding APs with those exact device events.

Does anyone have something similar setup and working? Receiving these alerts and being able to proactively resolve cabling issues would be awesome. Along those same lines, if you all have other AirWave triggers that you've found to be useful I'd love to see them. The only other alerts that I receive are when an AP is down for >= 5 minutes.

The "Events" trigger is only from syslog or snmp messages received from the controller, not the events in Airwave.  If you have SNMP traps being sent to Airwave from the controller, it is better to see the "Down" event from the controller, than the AP missing a ping.  

With that being said, if your AP is indeed missing pings, that could signify a reboot, and not a failover.  In a true failover, the AP should not be missing any pings...

On the commandline of your controller type "show ap debug counters ap-name <name of ap>" to see how often it rebooted/ bootstrapped....

Understood on the sources for event triggers. I should probably dig a little deeper into syslog/SNMP to find a better event to trigger alerts off of.

The real issue that I'm seeing here is that I'll have 20-30 AP-220 devices on a single switch, and there will be 1 in that group that can't maintain consistent heartbeats with its primary controller despite traversing the same physical path back that the rest of the APs on the switch do. AirWave showing "Poll missed SNMP ping(s)" is just a common message that I've seen between all of these trouble APs, so I figured I'd start with alerting on that. For a given campus, the primary LMS controller(s) reside in a completely different network than the controllers in backup LMS. This results in 1 AP sitting in the middle of a building dishing out a completely different set of IP addresses to clients than all of its neighbor APs. Ultimately this is what I'm really trying to get an alert for.

I have seen this with 4-5 different APs now, and they have all come down to poorly terminated patch cables or patch cables that aren't fully seated in a port (someone broke a tab or crimped it so tight that you don't get that "click" and a locked in place cable). It's an easy issue to fix, it's just difficult for me to reliably find the issue to begin with.

How many access points do you have on that controller, and what is the uplink to it?  typically we recommend 1 gigabit ethernet interface connected to a controller for every 100 access points (back of napkin).  If you already have that, you can run a script to check to see if the access points are negotiating at half duplex or 100, by using the script in the thread here:  http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/Mining-AirWave-for-Half-Duplex-and-100-Mbps-Connections/m-p/243112/highlight/true#M51717

Again, the "show ap debug counters" command will show you if any access points are bootstrapping excessively.  Temporarily you can remove the backup-lms ip address in the AP system profile to give the access points stability until you can figure out what is going on.

EDIT:  I see that you said you have 20 to 30 access points on a switch.  Is there any way that you can check the power consumption to see if you are getting close to the capacity on those switches?