Also in regards to false alerts. In our company I receive every alert. Other admins (including execs) receive filtered alerts. TO use your example I have two alerts one which sends to me after 2 downs. The second sends to management after 2 downs when the alert "should not contain" 1460. This reduces the false positives that get management all excited but lets me know that something is awry.
Jason Passow Mississippi Welders Supply http://www.mwsco.com jas...@mwsco.com ph: (507) 494-5178 fax: (507) 454-8104 -------------------------------------------------------------------------------- From: Chris Mang [mailto:chris.m...@jda.com] To: Servers Alive Discussion List [mailto:sal...@woodstone.nu] Sent: Tue, 08 Dec 2009 14:00:20 -0600 Subject: RE: [SA-list] Application - False Positives Anthony, Iâve had similar situations. Setting the timeout value to a higher number never fixed the issue. What would happen is that I would get a 1460, but the Roundtrip time displayed in the GUI was less than my timeout value. This led me to believe that the process (or machine) I was checking was giving SA that response (SA checks the process, and process or server responds with âNo way, dude. Iâm too busy right nowâ) because the result happened BEFORE the timeout value set in SA. In every case, restarting the server being checked resolved the issue, at least temporarily. If the problem persisted, we would talk to whoever was responsible for the process and let them know there was a problem. Of course, I could be wrong, but itâs worked for us for years. We strongly resist the urge to change the settings on the check to reduce alerts. I say that because it is an easy trap to fall into. SA sends out alerts based on the results of each check. If the results donât meet the criteria of the check, SA squawks because that is what it is supposed to do. You shouldnât adjust SA to reduce DOWN alerts just for the sake of reducing alerts. You should only adjust the checks after evaluating WHAT is being reported. Is it really a problem? If not, adjust the check. If it is a problem, fix the problem. Thatâs my two cents (maybe a little more than two). Chris>> From: Servers Alive Discussion List [mailto:salive@woodstone.nu (mailto:salive@woodstone.nu)] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 11:36 AM To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives Right I understand that, I guess I am looking for an acceptable timeout time.. 30seconds seems like it would be. It becomes an issue with management when all day Saturday they are constantly receiving down and up alerts. When the application is constantly up. I made sure there wasnât anything unusual running on the servers or network. But when it seems to get into a fritz it almost doesnât stop until there is some manual intervention. It seems like when one application comes back it drags down the checks of the other applications, causing them to timeout. Maybe there is something to separate the processes, so when one times out it doesnât cause the rest to time out? Thank you, Anthony Laatz Network Administrator â Answer Center America From: Servers Alive Discussion List [mailto:salive@woodstone.nu (mailto:salive@woodstone.nu)] On Behalf Of Dirk Bulinckx Sent: Tuesday, December 08, 2009 11:12 To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives That's a timeout error. It means that the (remote) server didn't respond within the given timeout. We can't say for sure that the process is running (we're talking about a process check), so we can't set an UP on that entry, that's why you get a DOWN. A DOWN should be interpreted as being "NOT sure it's UP". dirk From: Servers Alive Discussion List [mailto:salive@woodstone.nu (mailto:salive@woodstone.nu)] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 4:56 PM To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives ERR: 1460 Enterprise Version 6.2.2279 Thank you, Anthony Laatz Network Administrator â Answer Center America From: Servers Alive Discussion List [mailto:salive@woodstone.nu (mailto:salive@woodstone.nu)] On Behalf Of Dirk Bulinckx Sent: Tuesday, December 08, 2009 09:31 To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives And what does SA show as reason for the down? And what exact version/build of SA are you using? dirk From: Servers Alive Discussion List [mailto:salive@woodstone.nu (mailto:salive@woodstone.nu)] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 3:56 PM To: Servers Alive Discussion List Subject: [SA-list] Application - False Positives Iâve noticed more recently that we are starting to get a lot of false positives when SA is checking to see if an application is running. We have SA checking every 2 minutes during the day and every 3 overnight and weekend. It was checking every minute on off hours but we had 12 hours of false positives flood us this past weekend. I have increased the timeout for the application check to 30 seconds, but it doesnât seem to be enough. I also configured SA to not report an application down until two checks in a row fail. Does anyone have any ideas on how to reduce or eliminate the number of false positives? Thank you, Anthony Laatz | Network Administrator Answer Center America, Inc. | Phone: (800) 270-7030 | Private Fax: (866) 827-8802 Visit Our Website (http://www.goacanow.com/) | Visit Our Blog (http://blog.goacanow.com/) | Email Me (mailto:ala...@acanow.com) | Follow Us On Twitter (http://www.twitter.com/goacanow) | Fan Us On Facebook (http://www.facebook.com/pages/Answer-Center-America/106031356597) ________________________________ This e-mail may contain Answer Center America Company proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu (mailto:salive@woodstone.nu) If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list.
