Hi,
I am asking this question with regard to the HP proliant management pack but my question is about the more general "rule" v "monitor" question which generally I understand (I think).
We get alerts for HP network card failures. This is rule based and basically looks for event "2" in the event logs. The same thing happens though if a cable gets pulled or a switch fails for a few seconds for instance.
The question I am getting asked by admins is to override this as its a "false alarm". I have pointed out people shouldnt just pull a network cable (maintenance mode please!) and if switches are failing then use the SCOM alert to let the network team know... Plus if the card genuinly does fail this is the alert. BUT they are asking why isnt this a monitor anyway? If the network card is OK I think event 4 gets logged. So why didnt HP write it as a monitor that would close when it sees the success event?
My main thinking was if they had you wouldnt get to know about intermitant faults that dont last long. For instance the card would be down for 30 seconds but the monitor would close as soon as it was back up and you wouldnt see it.
Any thoughts?
thanks