Thanks for the info, I was leaning towards that the timeout was lasting longer than the time between checks which is why it probably freaked out on us on Saturday. Also I found out the boss was copying over 60 gigs of data over the network on Saturday. Across the same switch that all the servers are on, so of course everything was timing out, he was flooding the network. .. Sigh..
Thank you, Anthony Laatz Network Administrator – Answer Center America From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Chris Mang Sent: Tuesday, December 08, 2009 14:01 To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives Anthony, I’ve had similar situations. Setting the timeout value to a higher number never fixed the issue. What would happen is that I would get a 1460, but the Roundtrip time displayed in the GUI was less than my timeout value. This led me to believe that the process (or machine) I was checking was giving SA that response (SA checks the process, and process or server responds with “No way, dude. I’m too busy right now”) because the result happened BEFORE the timeout value set in SA. In every case, restarting the server being checked resolved the issue, at least temporarily. If the problem persisted, we would talk to whoever was responsible for the process and let them know there was a problem. Of course, I could be wrong, but it’s worked for us for years. We strongly resist the urge to change the settings on the check to reduce alerts. I say that because it is an easy trap to fall into. SA sends out alerts based on the results of each check. If the results don’t meet the criteria of the check, SA squawks because that is what it is supposed to do. You shouldn’t adjust SA to reduce DOWN alerts just for the sake of reducing alerts. You should only adjust the checks after evaluating WHAT is being reported. Is it really a problem? If not, adjust the check. If it is a problem, fix the problem. That’s my two cents (maybe a little more than two). Chris>> From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 11:36 AM To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives Right I understand that, I guess I am looking for an acceptable timeout time.. 30seconds seems like it would be. It becomes an issue with management when all day Saturday they are constantly receiving down and up alerts. When the application is constantly up. I made sure there wasn’t anything unusual running on the servers or network. But when it seems to get into a fritz it almost doesn’t stop until there is some manual intervention. It seems like when one application comes back it drags down the checks of the other applications, causing them to timeout. Maybe there is something to separate the processes, so when one times out it doesn’t cause the rest to time out? Thank you, Anthony Laatz Network Administrator – Answer Center America From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Dirk Bulinckx Sent: Tuesday, December 08, 2009 11:12 To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives That's a timeout error. It means that the (remote) server didn't respond within the given timeout. We can't say for sure that the process is running (we're talking about a process check), so we can't set an UP on that entry, that's why you get a DOWN. A DOWN should be interpreted as being "NOT sure it's UP". dirk From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 4:56 PM To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives ERR: 1460 Enterprise Version 6.2.2279 Thank you, Anthony Laatz Network Administrator – Answer Center America From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Dirk Bulinckx Sent: Tuesday, December 08, 2009 09:31 To: Servers Alive Discussion List Subject: RE: [SA-list] Application - False Positives And what does SA show as reason for the down? And what exact version/build of SA are you using? dirk From: Servers Alive Discussion List [mailto:sal...@woodstone.nu] On Behalf Of Laatz, Anthony Sent: Tuesday, December 08, 2009 3:56 PM To: Servers Alive Discussion List Subject: [SA-list] Application - False Positives I’ve noticed more recently that we are starting to get a lot of false positives when SA is checking to see if an application is running. We have SA checking every 2 minutes during the day and every 3 overnight and weekend. It was checking every minute on off hours but we had 12 hours of false positives flood us this past weekend. I have increased the timeout for the application check to 30 seconds, but it doesn’t seem to be enough. I also configured SA to not report an application down until two checks in a row fail. Does anyone have any ideas on how to reduce or eliminate the number of false positives? Thank you, Anthony Laatz | Network Administrator Answer Center America, Inc. | Phone: (800) 270-7030 | Private Fax: (866) 827-8802 Visit Our Website (http://www.goacanow.com/) | Visit Our Blog (http://blog.goacanow.com/) | Email Me (mailto:ala...@acanow.com) | Follow Us On Twitter (http://www.twitter.com/goacanow) | Fan Us On Facebook (http://www.facebook.com/pages/Answer-Center-America/106031356597) ________________________________ This e-mail may contain Answer Center America Company proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list. To unsubscribe send a message with UNSUBSCRIBE in the subject line to salive@woodstone.nu If you use auto-responders (like out-of-the-office messages), make sure that they are not sent to the list nor to individual members. Doing so will cause you to be automatically removed from the list.
