Hey Craig, Thanks again for the response. Here's some replies:
"running is an up event, so it should be looking for a corresponding down and only raise an event if it found one." Right, and that's what it used to do. Now it marks "RUNNING" as a critical alert and puts the interface in red. "When you get the event, do you also get an alarm, which means does the interface appear in the "Alarmed Interfaces" pane? It is those boxes that appear in the green background." Yes to both. I do get an alarm and it shows up in alarmed interfaces as "NOT RUNNING", even though the events screen keeps posting that it IS running. "Do you get flapping, one up then one down, or are they always down/up all the time?" The problem application always appears as down in red and deleting and re-adding it hasn't help. There are three other apps on the server we're monitoring and they are ok. They appear green, are definitely running, and JFFNMS doesn't generate an alert that they are. When we shut them down, JFFNMS does respond properly by alerting with a "NOT RUNNING" event. I hope this is some helpful information. If all else fails I'll just delete the entire host and re-add it. I have lots of time to kill to figure it out and nothing too critical at the moment since we're testing the program out. Thanks again for all the help so far. Eric ------------------------------------------------------------------------ ---------------------------------------------------- Yes, that's the right way to run the poller. > app_status,current_instances(Medi..rev): running;1 Instance(s)|1 -> > multi_buffer(): 2 (time P:29.73 | 1.75) There is one process. > 09:37:02 : H 8 : I 717 : P 20 : app_status(): running;1 > Instance(s) -> alarm(38): Event Added: 2452 (time P:1.59 | 12.59) app_status yanks something out of the buffer "running;1 Instance(s)", into the alarm plugin. The alarm plugin raises event #2452 runnning is an up event, so it should be looking for a corresponding down and only raise an event if it found one. When you get the event, do you also get an alarm, which means does the interface appear in the "Alarmed Interfaces" pane? It is those boxes that appear in the green background. > I'm noticing it now on some other applications on other hosts too. Is > maybe my database corrupted, or my poller taking too long? The only > problem interfaces seem to be applications so far. I also should have > mentioned on my first post that JFFNMS is on a Windows Machine. I'm not > good with linux :( . It could be corruption, perhaps the consolidator is getting confused as this is the thing that marries up the different events and closes off the down ones. Do you get flapping, one up then one down, or are they always down/up all the time? - Craig This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642 _______________________________________________ jffnms-users mailing list jffnms-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jffnms-users
