AnsweredAssumed Answered

False start trigger for event frame

Question asked by Guilherme Ferreira Champion on Jul 17, 2018
Latest reply on Jul 24, 2018 by Guilherme Ferreira

Hi folks!

 

I have created some simple notifications for monitoring my PI Interfaces.

The related event frame triggers look like below.

 

(EDIT: this image was missing)

 

"Notificação" is just a flag for easily turning notifications on\off.

If interface ping is not a badval, check if last heartbeat is older than 10 minutes ago.

This should tell me that the interface node is online but the service has stopped for any reason. Quite simple!

 

For some of my interfaces (notice the above configuration is in template level), I am getting false event frame starts.

In other words, the interface is operating normally, heartbeat is updating and a event frame is generated.

 

The notification message also shows that the event should not have been created:

 

 

Although the heartbeat values stored in the server have current timestamps, I suspected the interface clock could be desynchronized with the server's.

Indeed it is! The interface clock is about 5 minutes behind.

 

It makes me think that at trigger time, analysis service considers the interface node timestamp but when I click "evaluate" button, it considers server timestamp (as it is stored).

 

Does it make sense?

 

It is the only explanation I can think right now.

 

Any ideas?

 

Is there a debug level log for analysis service?

 

Regards

 

Mensagem editada por: Guilherme Ferreira

Outcomes