Fake Alert Issue

Kiran- are you able to search the alerts web page or app and see their alert history? This should help confirm which alert was triggered and therefore the logic and history. Is it possible that they were still up but that Orion lost network communication with them- what does their availablity show at the time of the alerts?

Alert is of that "Node is down" but node is up at that time.

The node being down would be the result of the Orion server no being able to ping the end node.  If teh node was up, perhaps there was a device between the server and end device that was down/preventing pings from reaching the end node.

I've had whole sites of servers go "down" when just the border router was down. Unfortunately Orion doesn't know if they are "down" or just "unreachable" unless you help it - you can add a parent dependency for each site on it's routers back to your poller or you could write it into the alert suppression. Good read:http://www.solarwinds.com/documentation/Orion/docs/Groupsanddependencies.pdf

Kiran,

I have fought this for a quite a while.  I've noted that the alerts are almost always on remote sites.  What I found was that my edge firewall was actually blocking the messages to Solarwinds NPM as DoS attacks.  I ended up putting in a specific bypass rule for the NPM server to/from.  That resolved my 'false' messages.

Hope that helps.

See which path the Orion server takes by doing a traceroute. Then determine if anything along the way can stop the Orion server from seeing the device.

Or maybe someone was testing the alerts in Manage Alerts thus generating false alarms.

HI Kiran,

Try to do some troubleshooting.

1. Try to ping and traceroute the nodes that orion says "is down" from the Polling server (orion server) where that node is assigned. and then vice versa

2. Check for "possible" IP address conflict of nodes

3. If you have admin access, try to choose the nodes then "Poll Now" or "Rediscover"

4. If you don't need historical data of that nodes, you can try to delete and add back the node.