Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

False Alert

I am getting false alert. Let me explain the Scene.

I have one switch configured in the switch. Some of the interface are not usable and are in condition of Down. I an not configure them as Shutdown or Unplugable. Suppose these are 15 interfaces on my 2960 series switch out of 24 interfaces.

Sometimes i got alert for those interfaces while they are already Down. Like once in a week.

Find more posts tagged with

Accepted answers

All comments

GoldTipu

What Orion version you have with SP ? I better to to open Support ticket with SolarWinds in order to got through the diagnostics .

deepaksingh

NPM 10.1.1

GoldTipu

Ok its better to open support ticket in this issue since Tech need to review your server diagnostics . Have you applied SP1 ?

smargh

I have a case open with SW right now, as a bug, whereby active alerts "expire" and are re-triggered afresh after 10 days.

In your case, are these "interface down" alerts active all the time? If so, perhaps they are just being triggered after Orion prunes old alerts.

deepaksingh

Hey Smargh,

Can you share the technical steps obtained from the solarwind in your case till now regarding the issue that you are facing.

deepaksingh

Hey GoldTipu,

What do you mean by SP ?

outernet

Smargh, did you ever get a response from SW regarding this 'bug'? We have an alert that is doing the exact same thing and curious if you've already obtained a fix.

Thanks!

smargh

They said it would be fixed in "the release after next", and I think the just-released 10.1.2 was the next. So, hopefully it should be fixed in the next minor release. They provided a workaround, but it doesn't seem to work properly - alerts are still re-triggered regularly, definitely earlier than the 20 days suggested. The full SW response is below.

The issue is very likely caused by mechanism in Alerting Engine that should clear old acknowledged alerts.

Alerting Engine removes records about triggered and acknowledged Alerts that are older than particular value - "AutoClearAlertIntervalInMinutes" parameter (default value is exactly 10 days).

I suppose customer has alert with trigger condition like this: trigger when interface status = 'down'. Alert was triggered 10 days ago and customer acknowledged it. Meanwhile machine was unplugged from network but node and interface is still in Orion. 10 days after alert triggering Alerting Engine removed the triggered alert record but because trigger condition is still valid (Interface is down) alert is triggered again.

Hope this explanation make sense. The important information is that there exists workaround:

1. Adjust trigger condition: "Interface is down and parent Node is not down" - alert will not be triggered again because the parent node is down

2. Set AutoClearAlertIntervalInMinutes parameter to bigger value, unfortunately the maximum value is 28800 minutes and it's only 20 days. After that the same situation will happen again.
AutoClearAlertIntervalInMinutes parameter could be add to Alerting Engine following the instructions:
a) Stop AlertingEngine service
b) Locate AlertingEngine.exe.config file in Orion install dir
c) Add row: <add key="AutoClearAlertIntervalInMinutes" value="28799" /> in <appSettings> element
d) Start AlertingEngine service