False SYS_NODE_DOWN alarms

Started by marcelm, March 28, 2018, 07:56:45 PM

Previous topic - Next topic

marcelm

Hello
I have false node down event. As you can see I dont have EPP rule 0 , it is something wrong in database?

EPP in epp.png
NODE POLLING in polling.png
DCC is in export.csv

thanks for help M.


netxmsd log file
/var/log/netxmsd.3:2018.03.28 14:33:39.974 *D* CorrelateEvent: event SYS_NODE_DOWN id 478521 source MAKOPC [1125]
/var/log/netxmsd.3:2018.03.28 14:33:39.980 *D* EVENT SYS_NODE_DOWN [28] (ID:478521 F:0x0001 S:4 TAG:"") FROM MAKOPC: Node down
/var/log/netxmsd.3:2018.03.28 14:33:39.980 *D* EPP: processing event 478521
/var/log/netxmsd.3:2018.03.28 14:33:39.980 *D* Event 478521 match EPP rule 0
/var/log/netxmsd.3:2018.03.28 14:33:39.994 *D* Event 478521 with code 28 passed event processing policy
/var/log/netxmsd.3:2018.03.28 14:33:40.012 *D* EventLogger: DBExecute: id=478521,code=28

node configuration poll
28.03.2018 18:51:16] **** Poll request sent to server ****
[28.03.2018 18:51:16] Poll request accepted
[28.03.2018 18:51:16] Starting configuration poll for node MAKOPC
[28.03.2018 18:51:16] Checking node's capabilities...
[28.03.2018 18:51:16]    Checking NetXMS agent...
[28.03.2018 18:51:16]    NetXMS native agent is active
[28.03.2018 18:51:16]    Reading list of available Windows Performance Counters...
[28.03.2018 18:51:18]    225 counters read
[28.03.2018 18:51:18] Capability check finished
[28.03.2018 18:51:18] Checking interface configuration...
[28.03.2018 18:51:18] Interface configuration check finished
[28.03.2018 18:51:18] Checking node name
[28.03.2018 18:51:18] Node name is OK
[28.03.2018 18:51:18] Reading list of installed software packages
[28.03.2018 18:51:19] Got information about 319 installed software packages
[28.03.2018 18:51:19] Finished configuration poll for node MAKOPC
[28.03.2018 18:51:19] Node configuration was not changed after poll
[28.03.2018 18:51:19] **** Poll completed successfully ****

Victor Kirhenshtein

Hi,

in this debug output you see internal rule index, which is 0-based, so it's rule number 1. Node down was likely generated because agent was unresponsive and there are no other communication means for that node, so server consider it as down. There should be debug log records related to status poll of that node upper in the log.

Best regards,
Victor