Neophyte
ProfessorLM doesn't suggest disabling the HostStatus check is how LM notifies you that a device is down. If you disable it, you would need to rely on some other check to notify you of a device being down before the 6-minute (hard coded) suppression kicks in. WMI and SNMP checks may end up being suppressed before alerting on a down device.
https://www.logicmonitor.com/support/logicmodules/datasources/creating-managing-datasources/host-status-host-behavior
NeophyteI will only be disabling alerting, not the module or tune. I thought it would still work for suppression
ProfessorSo HostStatus is just to alert/notify you that the device is down, it doesn't actually do the suppression itself (from my understanding). The 6-min suppression happens if you want it to or not. So if a HostStatus alert is disabled and the device goes down, you may not get notified that the device is down. You may not get any alerts at all without HostStatus in some device-down situations.
Originally I did the whole NoData thing for checking for broken wmi/snmp too but ended up having dedicated checks specific for wmi/snmp as it works better, can help with troubleshooting, and also much less likely to be misinterpreted by staff.
NeophyteWhen you say dedicated checks for broken wmi/snmp, you created your own modules for it? Could you share, I would love to take a look. Are you also using one for NetFlow? Thank you in advance.
ProfessorI can't but they are basically just modified Win_WMI_Access_Denied_ErrorCodes and SNMP_LM_Troubleshooter. I'm not really on the network side of things and I haven't done anything for NetFlow myself.
