Adjusting Host Status Idle Interval Alert

We have seen this behavior when the collector is falling behind. If you haven’t I suggest adding in the collector as a resource to be monitored. And check the Collector graphs to see if it is falling behind. By default the collector will set off Warnings for TasksCountInQueue and a few others.

You can’t change is the poll interval, as for “Internal” type DSs, the selected poll rate has no impact. 

Also, you shouldn’t change the threshold to anything other than 300, since that’s the internal value at which LM marks the host down, which suppresses all alerts opened after that point. So, if you make it more than 300, the device will be marked as down and all other alert notifications (including the one that would tell you that the device is down) will be suppressed.

I’m not sure the impact of changing the trigger and clear intervals though. 

Are you sure they’re false positives? Is it possible there’s something actually going on, but it resolves/heals quickly enough that you’re not seeing it? One thing to consider is that all of this is based on the collector’s ability to report data back to the LM platform on a continuous basis. Host status really does mean that the platform hasn’t gotten any data for that device in 5 minutes. What could cause all the datasources on a device to return no data all at the same time for 5 whole minutes? 

Do your ping alerts open before the host status alert? Check the ping DS. Does it have data the whole time? If it does, there’s something broken with LM. If Ping has data, the host status alert shouldn’t be opening. 

FWIW: we have not modified anything on the host status DS.

If you just don’t want to receive alerts (versus having them logged in the UI), one trick we’ve used is a delayed escalation chain with an empty stage 1.  If you want the alerts not to exist at all, you’ll have to change the thresholds.