Currently triggered agentless rules falsely alerting as Normal

Article:TECH147240  |  Created: 2010-12-30  |  Updated: 2012-07-21  |  Article URL http://www.symantec.com/docs/TECH147240
Article Type
Technical Solution


Issue



Agentless rules which are currently triggered for resources are falsely resolving as Normal. The metric value stated in the alert details shows that the rule should not be resolving as Normal. The rule then triggers again shortly after with the appropriate severity.

Example:

An agentless ping rule triggers as Critical for a machine which is unavailable with a metric value of "0". The rule then resolves and a Normal alert occurs even though the metric value is still "0". The rule then triggers again as Critical shortly thereafter.

 


Environment



  • Monitor Solution for Servers SP5  7.0.8641  (and previous versions)

 


Cause



This behavior occurs if the rule has a Repeat count: value of 2 or greater. If the Pluggable Protocols Architecture (PPA) web service becomes unavailable for a brief period of time (IIS services are restarted or the Notification Server is rebooted), it causes the Monitor Agent rule evaluation to faulter and the rule is falsely resolved temporarily. When communication to the PPA web service is restored, the rule triggers again.

This is a known issue and has been submitted to development.

 


Solution



This issue will be resolved in the 7.1 release of Monitor Solution for Servers.

Workaround:

Set the associated agentless rule's Repeat count: value to 1.

 


Supplemental Materials

SourceETrack
Value2205346
Description

PPA web service unavailable causes false Normal alerts for agentless ping monitor rule with off-box RMS



Article URL http://www.symantec.com/docs/TECH147240


Terms of use for this information are found in Legal Notices