Difference Between Statistics Collection Interval and Rediscovery Interval

Hi Guys,

Trust all of you are doing great.

Please, I just want to understand the difference between Statistics Collection and Rediscovery interval.

By default, Solarwinds made Statistics Collection interval and Rediscovery interval to be 10 and 30 minutes respectively.

Please correct me if I'm wrong. For example, if a Node is down at a time when the polling engine is yet to poll the node, and at the end of 120 seconds, the node is polled and observed to be down.

My own understanding is that Fast Polling Cycle takes effect; only 10 seconds, and not another 120 seconds, is awaited by the polling engine to initiate its next poll to the node.

My question is: How long would a node be down before it is being observed to be down? 120 seconds, 10 minutes, 30 minutes?

My aim is that I want to clear my doubts/confusion about the Statistics Collection interval. I hope that a node would not be down for 10 minutes before it gets noticed.

Kindly assist with detailed explanations.

Many thanks.

Regards,

David Ibrahim.

Find more posts tagged with

network_monitoring

network_management

Accepted answers

All comments

rob.hock

David,

In terms of status- there is actually a separate 5-21-2014 6-17-21 PM.png status polling interval as well. Default is 120 sec:

shuth

Short version: At system defaults, a device can be down for 2-4 minutes before being detected

Long version: See wall of text below.

As Rob above mentioned, there are separate polling intervals for status, statistics and rediscovery.

The status polling interval is how often the server will check the status, availability, response time and packet loss of your monitored elements (default 2 minutes).

The statistics polling interval is how often the server will collect statistics from your devices using SNMP/WMI - information such as CPU/Memory utilisation, volume statistics, interfaces statistics, etc.

The rediscovery interval polls your devices checking for reindexed interfaces, system OID info, node details, as well as checking for technologies like EnergyWise and wireless.

As for how long a node can be down before being detected, this will depend on your status polling interval (default 120 seconds) and node warning level (this setting is further down the page under Calculations & Thresholds - default 120 seconds).

As for how long before the system detects a node is down, my understanding is the following:

If the polling engine polls a node and does not get a response, the node status is set to Warning (and the icon goes from green to yellow) and goes into a "fast poll mode". In this mode, the server will poll the node every 10 seconds (locked value) for the period defined in the node warning level (default 120 seconds). If there is still no response at the end of this time period then the status is set to Down (and icon changes from yellow to red). If the node responds, the status changes to up (green). If you have dependencies configured, the system will check the parent statuses first before marking a device as down - if all of the parents are down or unreachable, the node will be marked as unreachable.

Therefore, if a node goes down immediately after a successful poll, with default polling intervals you will find out after ~4 minutes.

T0 - successful poll, node status up

T1 - device goes offline

T120 - system polls, node status set to warning, enter fast poll mode - poll every 10 seconds

T240 - node warning level ends, node status set to down (device has been offline for 3m:59s)

I typed the above then remembered I had this bookmarked: How Does Orion Mark a Node as Down?

I also had another bookmarked thread with some developer quotes on the fast poll cycle: Fast Polling

Karlo.Zatylny wrote:
Here is perhaps a more detailed explanation than what you are looking for.
On a status poll orion performs an ICMP ping operation. If that ping fails then we set the Node to Warning Status and begin Fast Poll. By default, we will poll in Fast Poll mode for 120 seconds and send a ping every 10 seconds. (120 seconds configurable from your Polling Settings page - Node Warning Level). If after the 120 seconds, all of the pings sent every 10 seconds have failed, then we will mark the node as Down. So on average it will take 13 failed pings to set a node to the Down status.
Fast Poll pings are not logged against availability.
There are more settings to ping more than once on the initial status poll, too.

There is a setting that you can use to increase the number of times we will try to ping a device on a status poll by default. Meaning that even before fast polling kicks in, we will try to ping the device X number of times to make sure we didn't just maybe miss a ping because of network load.
In your Settings table of your Orion database, you may or may not have the entry:
SWNetPerfMon-Settings-Response Time Retry Count
This value, even if not in the database defaults to 1. Meaning we will try to ping the device once before failing and moving into fast poll if necessary. If you were to update this number "CurrentValue" to 3, then if we were polling the device and the first ping failed, we would try again, and if that one failed, again before going into fast poll mode. If any one of the 3 succeed, then we immediately just mark the device as up for that poll interval. There is no time delta between these pings. If one fails, another is tried as fast as the code can run.
You probably don't need to change this number unless you are seeing a lot of your nodes go to warning because your network often drops ICMP packets.
Hopefully, this helps even more.

It will stop as soon as the first ping attempt succeeds.
So if you set it to 3, then we will try once and if that succeeds then attempt no more.
Here is the algorithm:
1. Try to ping the device
2. Did we succeed? Yes go to 4. No, go to 3.
3. Should we try again (we've tried less times than we are configured to)? Yes, go to 1. No, go to 4.
4. Notify the system of the success or failure of the ping.
So it is really a maximum amount of attempts. Thus 1 is truly the minimum attempt count.

Hope this helps.

sgenius

Hi Steven,

Your response is wonderful.

You may not understand how grateful I am but I must say: Thank you very much.

This is really an eye-opener.

However, please allow me to clarify something:

Correct me if I'm wrong but from your explanation aforewritten, I have been able to understand that by default, it is only every 10 minutes that Solarwinds polling engine sends SNMP requests.

During the polling interval of 120 seconds, ICMP requests are used instead. Am I correct?

Regards,

David

shuth

The polling engine will poll for node statistics every 10 minutes (default) using the selected method (WMI/SNMP). Interface and volume statistics are collected separately (default 9 minutes and 15 minutes respectively). This can be configured globally and on a per-node basis.

The status polling uses ICMP by default every 120 seconds (also configurable globally or per-node). As of NPM v10.7, you also have the option of enabling SNMP status polling for particular nodes instead of using ICMP (List Resources of a node and there will be an option to select SNMP). This is useful for devices/networks that don't allow ICMP but will let SNMP through.