IMC 7.3 not alarming when device unreachable

[preddy1980]

If a switch goes down i get alarms on the 2 interfaces on my core that where connected to the switch to say the ports are down so i know the swich has rebooted but i then only get a critical alarm on the cold restart.

IMC says the status of the device is normal unless it has a an alarm about the uplinks etc.

[jguse]

Hello,

How long was the device down? If it was just a quick crash and reboot for example, IMC might not pick up on it if the ICMP Polling Interval and SNMP Polling interval does not occur within the timespan when the device is down.

If IMC just polled the device 5 seconds ago, and the ICMP Polling Interval is at default 60 seconds, then it's possible it has started responding again by the time the next interval rolls around.

The reason you immediately got notified about the links going down is because those links events triggered an SNMP Trap (or Syslog if you use that) on the neighbor devices, so IMC was notified about that pretty much immediately.

The minimum Polling Interval is 30 seconds, and you could try reconfiguring it this way to get a notification about a device being unreachable sooner. You can set that on the Device Details > Configure > Modify Poll Interval page.

[preddy1980]

I dont think that is is the issue as i have powered devices off for longer periods and dont get alarms as below,

some devices i am doing ICMP to only such as servers and access points no ssh or snmp but it still should read unreachable, now i have powered off and AP and it still reports as normal in IMC 

[jguse]

Hello,

Could it be that your devices are located at a remote site behind some site to site VPN link? The reason I ask is because there was a fix in IMC E0605P06 for a known issue where devices located behind such a link would not be properly detected as 'unreachable', even though ICMP Unreachable response was returned.

If that's not the issue, you could try doing a packet capture on the IMC Server to figure out what is going on. Does IMC send any ICMP requests after the device goes down? If not, do you see any ARP lookups for the device IP that went down?

[preddy1980]

Hi Justin,

No it os pretty much all my devices switches cores so here is a simple test.

I have 8.8.8.8 added as a device so in theroy if my internet connection was dropped i would lose connection to this.

So i can see on my firewall every now 30 seconds it doing ICMP to this so if i disable the FW rule allowing this traffic then i should see it being unreachable which i do but dont and dont get an alarm.

[jguse · Accepted solution]

Hello,

I'm not familiar with any such issues at the moment, except the one I mentioned, and my lab installations are triggering device unreachable alarms as well. These also get recovered automatically once the device is responding again.

* Do you have any devices that actually trigger an alarm for "Device x does not respond to Ping packets."? I'm wondering if there might be a filter configured under Trap Management > Filtering Trap that is filtering out the alarms on some/all devices.

* What happens if you manually "Synchronize" on the device in IMC and refresh the page?

* Which exact IMC version are you running at the moment?

[preddy1980]

I do see a filter now on the device does not respond to poll packets set to all devices!

So let me remove that and try agaiun.

Cheers