IMC
cancel
Showing results for 
Search instead for 
Did you mean: 

IMC poll inteface DOWN meaning

SOLVED
Go to solution
Bede Academy
Occasional Contributor

IMC poll inteface DOWN meaning

A typical message I receive on the Alarms console:
Interface "37" State DOWN found during iMC device poll

What does this mean?
How does it know not to report every switch port that is simply not used?
What if a machine is patched differently and change the switch port it connects to?
What is the sensitivity of the alarm, is it instant, within seconds or between poll intervals?
When I check the switch the port usually has been blocked by STP but eventually through much investigation it was simply a machine turning on.

Can someone explain to me the logic of what this result actually means? What has been tested to arrive at this conclusion?

For those interested I changed the alarm to a warning alarm becase hacing 11,000+ major alarms was useless.

3 REPLIES
RPapaux
Frequent Advisor
Solution

Re: IMC poll inteface DOWN meaning

Some explanation:

IMC is polling the device typically every 4 hours (configurable).

It then compares the difference between the port Administration status and the port Operational status.

If the port is set UP by the administrator, and IMC found it DOWN, it fires an alarm.

To get rid of them, you can filter them out in the "SystemSetting" (see attached picture).

You can also set the Admin status DOWN for every intrface you are NOT using.

Beware: These traps are generating by IMC during the device polling process.

It should not be confused with MIB-II LinkUp/LinkDown traps generated by the device SNMP agent itself, but usually you can filter these at the device level.

BR

Ray

RPapaux
Frequent Advisor

Re: IMC poll inteface DOWN meaning

Et now with the picture :)

Bede Academy
Occasional Contributor

Re: IMC poll inteface DOWN meaning

Thank you for the reply, that helps explain it. Hopefully it will help me solve the port firing the errors.

As for filtering the alerts I have tried to do this in the past (painfully so) but it doesnt allow more than 900 ports to be filtered. I have thousands of ports that need to be in this filter. Simply changing it to a warning and attempting to resolve the underlying issues is better for both awareness of system health and good practise of fixing underlying issues.