False positives for HTTP and HTTPS monitoring in SAM

Currently we have several HTTP and HTTPS monitors in SAM going, our NOC seems to get a lot of false positives on a few of them, if I understand correctly I should go to the templates for either HTTP/HTTPS, and modify the Response Time Threshold: "for at least" 2 or 3 polls to decrease the false positives. Is this correct?

As a new admin to my organization who has been tasked with cleaning up, and improving efficiency. I don't want to mess something up either and have an item go unmonitored.

Find more posts tagged with

false positives

thresholds

server and application monitor

Accepted answers

All comments

designerfx

What are you trying to do kausti2 ? The limitation of HTTP/HTTPS monitors is that they are only checking for a REPLY. They aren't checking what's on the page, etc. This is more like "is a page available and can I reach it/can I authenticate with it". WPM checks actual context on the page.

chad.every

kausti2, that is one way to reduce the alert noise but you'd want to consider other detail before you do that. There could legitimately be a larger issue at hand that this alert is eluding too. I've worked a lot with the HTTP monitor and had alerts going to certain developers. Sometimes they would complain of alerts but each time we dug into it it wasn't a false positive.

I would make sure that your email alert includes the Statistic Data and Statistic Message. If it's response time, then you just need to weigh if it's "normal" or not and adjust accordingly. If you're getting something like a 404 or other HTTP error then you'd probably need to investigate the webpage more.

Also, i always included a search string with my HTTP requests, i did see false positives before I did that. Typically a string of 'Login' or something like that is common.

2017-05-16 16_00_49-Edit Application Template - HTTP.png

kausti2

Turns out it is actually some code on the page that is timing out the monitor. We are working to get this resolved.