
A while ago I had changed my alert rule for Interfaces to trigger from "Operational Status is equal to Down" to "Operational Status is not equal to Up" to catch all other bad conditions. The result is I get the false alert "Operational Status is Unknown" quite frequently on different devices. Upon quickly checking the devices' interface by snmp browsing, the interface status never changed to "unknown". The interface index did not change either. What am I doing wrong?
Unknown is a state determined by Orion so you won't find it in SNMP, or at least not the same unknown as we use. We mark them as unknown when we cannot determine the status of the parent object.
Thanks Andy. I noticed that on some servers, when it goes down, then back up, the monitored interfaces remain in unknown state even though I can list resources on the node, force a poll, or force a rediscovery. But the interfaces remain in unknown state. Only way I know to fix this problem is to delete the server from Orion, the add it back in. Is there an easier way?