We've been getting periodic alerts on some servers that they are 'down' for a while now.
I configured a span session on the servers vds port and and capturing all traffic in and out of the port. When we get one of these alerts what I see is a gap of time (5 - 6 minutes typically) in which there is no icmp request coming from the polling engine. During this time however there are 1000's of packets to and from the polling engine with other protocols.
When the icmp requests resume, I typically see 4 - 6 requests and replies in the same minute.
It seems like the polling engine got behind and is trying to catch up, but I could be completely misinterpreting this.
I did start a support case for this but thought I'd ask about it here too, to see if anyone else has encountered this behavior.
Thanks.
