Currently triggered agentless rules falsely alerting as Normal
|Article:TECH147240|||||Created: 2010-12-30|||||Updated: 2012-07-21|||||Article URL http://www.symantec.com/docs/TECH147240|
Agentless rules which are currently triggered for resources are falsely resolving as Normal. The metric value stated in the alert details shows that the rule should not be resolving as Normal. The rule then triggers again shortly after with the appropriate severity.
An agentless ping rule triggers as Critical for a machine which is unavailable with a metric value of "0". The rule then resolves and a Normal alert occurs even though the metric value is still "0". The rule then triggers again as Critical shortly thereafter.
- Monitor Solution for Servers SP5 7.0.8641 (and previous versions)
This behavior occurs if the rule has a Repeat count: value of 2 or greater. If the Pluggable Protocols Architecture (PPA) web service becomes unavailable for a brief period of time (IIS services are restarted or the Notification Server is rebooted), it causes the Monitor Agent rule evaluation to faulter and the rule is falsely resolved temporarily. When communication to the PPA web service is restored, the rule triggers again.
This is a known issue and has been submitted to development.
This issue will be resolved in the 7.1 release of Monitor Solution for Servers.
Set the associated agentless rule's Repeat count: value to 1.
PPA web service unavailable causes false Normal alerts for agentless ping monitor rule with off-box RMS
Article URL http://www.symantec.com/docs/TECH147240