Multiple "link up" messages, SP 8.25A, Windows 2008

[John Benak · Accepted solution]

Got what seems to be the 'final' answer from MS PSS on this. The short answer is that 'yes, this is indeed an issue; no, you can't control it.'

I sent some network captures from our HPSim server during a 2008 server reboot, as well as some other data. The MS tech was also able to replicate the issue in his lab. His only suggestion was to disable the 'LinkUp' alerts altogether (as was mentioned above) and either rely on the 'ColdStart' for reboot notifications, or create a customized alert from a particular EventID using a built-in windows utility called 'EventWin' .

Not sure how feasible the latter solution is in a large enterprise, as I don't know too much about EventWin. TBD... I think now that we have some definitive info on this, we're probably going to go ahead and disable the "LinkUp's". We have SCOM 2007 deployed in our infrastructure as well, so we're probably going to look to and rely on that tool to give us the info that the missing 'LinkUps' provided.

Below is the response from MS PSS on the issue:

John:
"I reviewed the capture, and you can clearly see the 2008 box sending the SNMP Traps. The count corresponds with the e-mail alerts you reviewed. I have tested this in my lab environment and saw consistent behavior.

I also found the SNMPUtil output interesting. As there is no way to control this behavior, it may be best to reconfigure the alerting using a different trigger as we discussed. One possibility could be to use evntwin to generate a trap based on the following, as the event is triggered only once during boot:

Log: System
Source: EventLog
ID: 6005 The Event log has started"


Thanks for all of your helpful feedback troubleshooting this issue, and best of luck! If any of you (or others who run across this post later!) come up with a better solution, please post it here.

Tx,
John in Austin, TX

[suzan maxey]

Thanks very much for all of your detective work, John.