Agents Display a Red "Down" Arrow (298474)


The information in this article applies to:

  • Microsoft Operations Manager 2000
This article was previously published under Q298474

SYMPTOMS

When you click All Agents in the Microsoft Operations Manager (MOM) Microsoft Management Console (MMC), one or more agents may display a red down-arrow.

CAUSE

This behavior occurs because the red down-arrow is an indicator that the Consolidator does not pick up a "heartbeat" signal from an agent sends. The red arrow remains until the agent successfully updates to the Consolidator at the next heartbeat. Lengthy display of the red arrow is normal behavior if the interval between heartbeats is long. The default interval is 10 minutes.

If the agent on the Consolidator misses a heartbeat, all MOM components display a red down-arrow in the Components folder in the MMC. Note that the red arrow does not indicate that the OnePoint service is stopped.

WORKAROUND

To work around this behavior, specify a shorter time between agent heartbeats to shorten the length of time that the red arrow is displayed:
  1. In the Microsoft Operations Manager MMC, go to Global Settings under Configuration.
  2. In the right pane, double-click Agents.
  3. Click the Heartbeat tab, and then set the heartbeat interval to a shorter time period, for example 60 seconds.
  4. Click OK.
  5. Right-click Rules, and then click Force Configuration Changes Now.
  6. To verify the change, click All Agents under Monitor, and then note the Last Contact time.

STATUS

This behavior is by design.

MORE INFORMATION

The current practice for indication of missed heartbeats is as follows:
  • When the heartbeat for one agent is not being updated, MOM generates an alert, HeartBeatFailedSingleAgent, to show which agent missed a heartbeat and whether a ping to that agent was successful.
  • When more than one agent misses a heartbeat, MOM generates the HeartBeatFailedSingleAgent alert for the first agent that raises Event ID 21209. MOM then generates the HeartBeatFailedMultipleAgent alert.
  • Event consolidation is enabled on Event ID 21209 for 10 minutes to prevent occurrence of multiple alerts.
  • Duplicate-alert suppression is configured for all these alerts. However, the HeartBeatSingleAgent alert is not suppressed if the agent that is involved has a different machine name.
  • All of these alerts have a severity level of "warning."
Modification Type:MinorLast Reviewed:6/13/2005
Keywords:kbprb KB298474
©2004 Microsoft Corporation. All rights reserved.