Random UP events

Just upgraded to v2.5 and started assigning pollers and we're seeing the following events in the log. Granted there is an issue going on with the polled resources but the point of concern is the UP event. We see the UP event randomly posted on several pollers for other systems as well but never see any DOWN events on the poller. Anyone else seeing this? Can someone advise if this is normal behavior?

3/13/2009 10:18 AM RPCAveragedLatency for Exchange 2007 WMI Counters on GBEXCHCL1 is up
3/13/2009 10:13 AM RPCAveragedLatency for Exchange 2007 WMI Counters on GBEXCHCL3 is up
3/13/2009 10:13 AM RPCAveragedLatency for Exchange 2007 WMI Counters on GBEXCHCL1 is in a critical state
3/13/2009 10:08 AM RPCAveragedLatency for Exchange 2007 WMI Counters on GBEXCHCL3 is in a warning state
3/13/2009 09:33 AM SlowFindRowRate for Exchange 2007 WMI Counters on GBEXCHCL1 is up
3/13/2009 09:28 AM SlowFindRowRate for Exchange 2007 WMI Counters on GBEXCHCL1 is in a warning state

3/13/2009 09:18 AM SlowFindRowRate for Exchange 2007 WMI Counters on MDOTEVS3 is up
3/13/2009 09:13 AM SlowFindRowRate for Exchange 2007 WMI Counters on MDOTEVS3 is in a critical state
3/13/2009 09:03 AM SlowFindRowRate for Exchange 2007 WMI Counters on GBEXCHCL3 is up
3/13/2009 08:53 AM SlowFindRowRate for Exchange 2007 WMI Counters on GBEXCHCL3 is in a critical state

Find more posts tagged with

up_state

log

event

Accepted answers

All comments

FormerMember

bump...

ShamChauthani

APM creates an event every time the state for an application changes between any of the following states...

Unknown, Up, Down, Not Licensed, Warning and Critical

So because the applications are going from Warning/Critical to Up state it enters that as an event.

FormerMember

Ok, it now makes sense however UP is misleading. UP is the opposite of DOWN and implies the monitor was down/unavailable when it is not. It is still operational but reporting a degraded state. NORMAL would be better applicable to states Warning/Critical and eliminate confusion. I would like to recommend this change as a feature request.

NetEng33

Sham's answer is absolutely right on - Correct! I have been looking into this same behavior to confirm the same findings.

I would like to raise this topic again as I am dealing with what "rgward" stated as well. It is confusing regarding seeing "Up" statuses in the event logs of ORION where the node was never actually "Down" which is the opposite of "Up". So I started researching what makes ORION think a node changes state from "Up" to say.... "Warning"?

I can't seem to find any threshold settings unless I am actually building an alert or working with Atlas. Where do I look to make changes to how and when a node changes from Up to Warning or Up to Unknown? If I can't make changes, then where is it that I can go to look at the facts on how ORION comes to that conclusion on the state changes?

aLTeReGo

Node status is not changed or influenced by any other factor other than ICMP responsiveness. An application being down for instance does not change the nodes reachability status.