I've got an odd situation with events. SAM says a Windows node has "stopped responding (request timed out)". My alert waits for an expected amount of time and, because the status hasn't reset, a call is generated in our service desk system.
But then - three or four minutes later - SAM not only logs a "the system rebooted" event, but the event says that the system rebooted BEFORE it says the box stopped responding.
This isn't a one-off. I've got 2 instances of this happening on Windows nodes this morning. I'm guessing SAM uses different mechanisms for measuring network responsiveness (fast) and system events like a reboot (not as fast) on Windows?
If that's the case, how do I get the events to evaluate in the correct order and not generate a false-positive?