Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

False positive reboot notications

dward1976

Hi,

We've had an issue with SAM firing off false reboot notification for one of our servers, a 2003 box being monitored by WMI. The server definitely hadn't dropped off the network during this time, as proved by "net statistics server", and there's no mention of any restarts of the SNMP service in the Event Logs. The emails have been fired off at random times and don't really coincide with anything else happening on the server at that time.

Has anyone else had this issue?

Cheers

Dave

Find more posts tagged with

Accepted answers

All comments

rharland2012

I've seen it on a few different boxes over time. I was never able to figure out why it's happening - I thought it was some limit built into the uptime counter, but that theory doesn't really hold water.

Anyone else?

dward1976

Yeah that was definitely the case with old NT4 boxes, but it shouldn't be an issue these days, even with an old OS like Server 2003

aLTeReGo

What is the polling method for this Node? You can see this in the "Polling Details" resource on the Node Details view, labeled "Polling Method".

Also, what is the trigger condition defined for the alert you're receiving? A screenshot would be helpful.

dward1976

As mentioned above I'm monitoring via WMI.

The trigger condition is "Last Boot_has changed", from the default "Alert me when a node reboots" alert. The last boot time definitely hasn't changed since the 18th (when the server had a scheduled reboot), but we've had reboot notifications since then.

aLTeReGo

I would have to check the code but I believe the query used to validate the server rebooted is the check the uptime measurement using the WMI query below which returns the number of seconds the server has been "up". If the previously polled value is greater than the currently polled value, then we consider the node to have been rebooted. Again, this is somewhat speculation and would need to be verified.

I recommend keeping an eye on this value before and after a false positive alert has been triggered. You can check this easily yourself by running the command "wmic path Win32_PerfFormattedData_PerfOS_System get SystemUptime" from the command line of the monitored server. You can also run the following query using WMIExplorer remotely, or locally on the monitored host.

select SystemUptime from Win32_PerfFormattedData_PerfOS_System

dward1976

Yeah that shows it last rebooted on the 18th which was scheduled, so it's a bit of a mystery where SAM is getting the value to trigger the alert. It's not a major issue as it's happening infrequently, and it's not occurring with any other server, so we can live it for the time being. Cheers for your help.

dward1976

The problem has just occurred again. It would seem that it's WMI screwing up that is causing the problem, when trying to get the system uptime I get a ERROR Code = 0x80041004 Provider failure. Running wmiadap /f solves the problem and shows the correct uptime. The thing is, the rest of the monitors are reporting results fine and show no interruption.