NNMi false Positive Events/Incidents - How to Avoid

[bilal aman2]

Hello Experts, 

We are running on NNMi version 2018.11 , We have few devices which keeps triggering Node UP/Down False positive Alerts as per the Network team , the devices are up but NNMi keeps triggering these Node Down Alerts .  

Is there way we can make this alert/Incident in NNMi to be created for 2 consecutive Polling intervals . Only if it has Failed twice then the alert/incident should be triggered in the console . Like in Sitescope there is way to create an alert for 2 consecutive failures . Can we have do something like this to reduce the False Positives ?

Any other Suggestions to overcome this problem ?

Regards

Bilal Aman

[Heinz Nisi]

Hi Bilal, 

you want to have a look at the Rate feature of NNM. 

Details under https://docs.microfocus.com/itom/Network_Node_Manager_i:2020.08/RateSNMPTgIncident

Heinz

[Eugene Kopyshev]

Hi Heinz,

Right, that should work. I personally like more the approach in finding out why the false Down generated, coz you cannot/should not lift that heavy job of monitoring many regions in network and adding them to the group which is assign to that Node settings with Rate correlation. On other hand, if you assign the Rate on everything, it may affect badly good nodes...

[NickRad]

It may not necessarily indicate a false positive but more a symptom of an underlying issue. If it's the same nodes all the time it might be a network fault to those devices causing packet loss and showing as a node down in NNMi. Try correlating what NNMi see's against the problematic nodes with something more light weight and lower polling time (IP SLA, smokeping, etc)

[Michael_J]

Looking at the rate thing may work -- but it will use some memory to hold on to events -- if your boxes have the juice, that's probably okay.  We found that at least some of the devices on our networks that were giving us false positives had lots of old configurations on them -- old ACL's etc. -- are you using something like NA to manage configurations?  You're not wrong to consider the device configurations.