We monitor around 150 applications and components, many of which are via HTTPS component monitors.
The frequency for polling these is every minute, and alerts are configured after 2 minutes so we know we only get e-mail / SMS alerts if there have been two consecutive polls indicating a component / application is down or critical.
We also have several internal departments who use the Solarwinds interface to see if their websites / services are running via views restricted to limited applications.
These views include the "Application Health Overview" chart, an "All Applications Tree", and "Last 25 Application Events".
The problem we have is that we seem to get fairly frequent false alarms from the HTTPS monitors (two or three a day), where it reports that an application / component is DOWN, when we can see that it is in fact still Up, or they take well over the threshold setting for the critical response.
As these events clear on the next poll, we don't receive any alerts (which is how we want it), but they do show as a bright red entry in the "Last 25 Application Events" chart on the team views - which inevitably leads them to demanding an explanation as to why their application went down, and time wasted trying to prove it didn't.
Is there any way to change the logging of events to only happen on a second occurrence of the status change of an application - or a way to force a poll to retry immediately if a status change before it logs to the event table?
Failing that, are there any other alternatives? We tried a custom SWQL view pulling from Orion.Events, but that no longer colours the rows - ideally we want their displays to only turn red based on alerts that have been fired, rather than just the last poll.
Tim
Solarwinds info : NPM 10.4.2, SAM 5.5.0