"Error" not seen and reported as "Error"

rasc · Post by **rasc** » Fri Apr 01, 2011 3:29 am

Dear KS-Soft,

today I had to learn about a problem with (at least) Active-RA. The system event log on a server was damaged and the ActiveRA showed this message:
RMA: 301 - System Error. Code: 1500

But nevertheless the system state was set to "unknown" and so we were not informed (no "treat unknown results as bad" configured because that leads to lots of false positives).

Could you please report an "Error" as Error?

BTW: A feature request: "Report unknown as bad after x minutes". That way we used the "unknown as bad" much more often because it reduced false posives dramatically.

Thank you, rasc

KS-Soft · Post by **KS-Soft** » Fri Apr 01, 2011 10:35 am

Could you please report an "Error" as Error?

Sounds like want to exclude Unknown status from HostMonitor at all

I think there is always some error when HostMonitor sets Unknown status, this status is used when HostMonitor/RMA cannot get information that you want to verify by test method. E.g. you are checking for some specific event but RMA cannot connect to event log. Reason of this "error" can be different - permission issue, stopped RPC service, firewall, network problems and so on and so forth.

BTW: A feature request: "Report unknown as bad after x minutes". That way we used the "unknown as bad" much more often because it reduced false posives dramatically

I think you may easily use "advanced mode" actions to start action on some specific replies or after several consecutive "unknown" results
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

What exactly means "false posives" in your case? In some cases you just need to increase timeout specified for agent.

Regards
Alex

rasc · Post by **rasc** » Fri Apr 01, 2011 1:07 pm

KS-Soft wrote:
Could you please report an "Error" as Error?
Sounds like want to exclude Unknown status from HostMonitor at all
I think there is always some error when HostMonitor sets Unknown status, this status is used when HostMonitor/RMA cannot get information that you want to verify by test method. E.g. you are checking for some specific event but RMA cannot connect to event log. Reason of this "error" can be different - permission issue, stopped RPC service, firewall, network problems and so on and so forth.

BTW: A feature request: "Report unknown as bad after x minutes". That way we used the "unknown as bad" much more often because it reduced false posives dramatically
I think you may easily use "advanced mode" actions to start action on some specific replies or after several consecutive "unknown" results
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

What exactly means "false posives" in your case? In some cases you just need to increase timeout specified for agent.

Regards
Alex

rasc · Post by **rasc** » Fri Apr 01, 2011 1:12 pm

I don't know how to quote a quote.

Anyway:
I don't want to "want to exclude Unknown status from HostMonitor at all"
I liked unknown to be unknown and error to be error.

And you DID report an error, didn't you? So WHAT differs your error response from an error?

Regards, rasc

KS-Soft · Post by **KS-Soft** » Fri Apr 01, 2011 2:01 pm

There is no "Error" status in HostMonitor.
There are "Bad", "No answer", "Unknown", "Ok", "Host is alive" statuses.
"Bad" status means that HostMonitor checked for specified condition (in this case event with some specific ID, source or description) and detected specified event.
"Unknown" status means HostMonitor cannot perform test, cannot check for specified condition. You may consider this is as "Error" status but it was named "Unknown" 10 years ago and I don't think we need to change name of this status...
If you want to start alerts in such case, you may keep "Treat Unknown status as Bad" option enabled or you may use "advanced mode" actions.

Regards
Alex

rasc · Post by **rasc** » Sun Apr 03, 2011 6:44 am

Dear Alex,

sorry for the late response but the good weather required me to go out a lot with my dog. She deserves it

"false posoitives" are especially unknown states of active RAs after restarting HM. I disabled all "treat unknown as bad" because we got dozens of mails each an any time we restarted HM (which we do a lot). That's only one issue where the BTW of my original post helped. Same when we lost connection or in the case discussed here.

"Advanced mode" actions might be too advanced to me. One reason we use HM over Nagios or other free solutions is ease of use.

Have a great sunday!

KS-Soft · Post by **KS-Soft** » Mon Apr 04, 2011 11:44 am

sorry for the late response but the good weather required me to go out a lot with my dog. She deserves it

"false posoitives" are especially unknown states of active RAs after restarting HM. I disabled all "treat unknown as bad" because we got dozens of mails each an any time we restarted HM (which we do a lot). That's only one issue where the BTW of my original post helped. Same when we lost connection or in the case discussed here.

Sorry, I cannot find your post regarding connection problem after HostMonitor restarting. This problem related to Active RMA as well?
What version of HostMonitor do you use? Windows? Service Pack?
What exactly error message is displayed in Reply field of the tests performed by these agents?

"Advanced mode" actions might be too advanced to me. One reason we use HM over Nagios or other free solutions is ease of use.

HostMonitor has several layers: simple and advanced. You may mix both options...
Expressions for advanced mode actions are pretty simple, basically its just logical expressions so you can tell HostMonitor when action should be started based on many various parameters, status, reply, recurrences, acknowledgement status using any available macro variable.

Regards
Alex[/quote]