I had 2 devices (primary and back up) have the same interface go down on the same night this week during planned maintenance, I could see the syslog related to both interfaces going down in message centre and syslogviewer so I was happy with that but when I checked through message centre I could only see an event generated for one of the boxes on which the interface went down. I know my advanced alert is configured to generate an event when an interface goes down...
but my question is related to how this alert actually works, I want to know, will an event only be generated if the interface is down when the device is actually polled? I am polling these interfaces every 180 seconds. The interface for which I got the alert was down for about 30 minutes whereas the interface for which I did not get an alert was down for about 10 seconds so this has led me to believe advanced alert manager didn't alert on this interface going down because it had gone down and then back up in between polling cycles. My next question if advanced alert manager alerts if the interfaces status down when it polls every 180 seconds how come I didn't get about 10 events generated during that period or is advanced alert manager "advanced" enough to know that the interfaces status hasn't changed from down since it originally generated an event when it went down in the first place?
