Currently a node should be only under the following states: Up, Warning, Down, Unmanaged .
From the Admin guide: Status Icons
Only Volumes and Interfaces should go under the Unknown state. It usually means that Orion cannot retrieve information through SNMP thus letting it blind from the real status of the network element.
Because the node status is defined through ICMP, Orion either gets a reply or not which allows to set the status.
A group to which belong a node can be set to unknown when this node has not the property defined.
See the following post for further information: Re: Trying to add a new device to a existing group
I could be wrong so could you confirm the node is really in the Unknown state and no sorted in an Unknown group?
Thanks, What I was looking for though was how the different states are achieved.
What I got aon a short call to support was:
Yellow (Warning) indicates a normal ping was missed and triggers the fast poll cycle 2 pings every 10 seconds for the duration of a normal polling cycle - 120 seconds default
If that fails for the cycle the device is deemed down - Red
if the device responds then it goes back to green and normal polling.
All of this is ICMP
Unknown is an SNMP mechanism.