Hello!
I have a node that fires off the Node Down alert daily and sometimes multiple times a day. The node does not actually go down and continues to function without issue. Following the KB article here: Node is up but the node down alert is triggered (solarwinds.com), I have the output below. It appears to just show "NULL" at the time it is reported down. Any reason on why this would continue to happen?
How are you polling is this SNMP, WMI, Agent or even an external device?
SNMP, as with all our other networking equipment polling
Are you using the out of the box alert "Email me when a Node goes down" as this fires on 1 event change so if there's a blip it will fire the alert instantly, if so you could duplicate the alert and adjust it to fire if down for two polls on all devices or just this node.
The linked doc on the original post suggests the device you are polling could be busy and de-prioritising your ping request so it drops it as its overloaded with other things. Which then points at the device's load or you could relax the polling frequency for this specific node, knowing it may still happen but less often.
Thanks for your reply!
We are not using the Out of the Box alert but are instead using a custom node down alert. The alert is not firing falsely on our other 265ish nodes. Only this specific one. When looking at the switch, there is no obvious reason as to why it would be overloaded in any way.
I had exactly the same issue recently on a clients site. Several Nodes would fire a Node Down alert after missing just a single ICMP (ping) poll. The client was using the Orion platform 2020.2.6 with the latest available hotfixes.
The Node Warning period and fast polling of the devices did not occur. Below is the response from SolarWinds Support.
When using Enhanced Node Status, the Node warning level period is disregarded, and Nodes will move directly to the Down state after a single failed ping response. Support informed me this was by design. It affects nodes already in a warning state due to a child entity such as Hardware health, CPU, RAM, SAM Application etc. The Node is in warning and transitions directly to Down if a status ICMP poll is unsuccessful.
The Status availability polling process described in this ARTICLE is not applied when using Enhanced Node Status.
If your network is prone to the occasionally dropped ping response, you may get far more Node down alerts than expected and for no apparent reason. The Node is up and responds successfully on the next scheduled poll but still fires a Node down alert.
SolarWinds informed me they are investigating and may change the behaviour in a future release.
Terryk
Loop1 Systems: SolarWinds Training and Professional Services
