ICMP alerts firing too frequently

Recently, I set up one-minute ping checks following https://docs.librenms.org/Extensions/Fast-Ping-Check/ on one of my distributed pollers. You can see my /etc/cron.d/librenms for the poller below:

33   */6  * * *   librenms    /opt/librenms/cronic /opt/librenms/discovery-wrapper.py 1
*/5  *    * * *   librenms    /opt/librenms/discovery.php -h new >> /dev/null 2>&1
*    *    * * *   librenms    /opt/librenms/cronic /opt/librenms/poller-wrapper.py 16
*/5  *    * * *   librenms    /opt/librenms/poll-billing.php >> /dev/null 2>&1
01   *    * * *   librenms    /opt/librenms/billing-calculate.php >> /dev/null 2>&1
*/5  *    * * *   librenms    /opt/librenms/check-services.php >> /dev/null 2>&1
*    *    * * *   librenms    /opt/librenms/ping.php >> /dev/null 2>&1

I’ve followed all the steps related the rrdcached, and I see the ping data recorded in the UI. I’ve also set an alert to go off every 5 minutes:

However, for some reason I seem to be getting an alert every minute at ~30s mark:

Any idea why that might be the case? Let me know if you need anymore information.

Thanks!

Delay is for the notification.

The alert will fire up in the moment it happens, and wait Delay time to send the notification.

1 Like

That makes sense. So if there’s a failed ping, the alert will fire?

I’m still a little confused about why that would happen in this case. How often do the alerts run if not specified in /etc/cron.d/librenms? I have ping running every minute, but the alerts are firing at the half minute. I also tried setting it to have sub-minute ping checks following the same steps by updating ping_rrd_step in config.php and adding

*    *    * * *   librenms    /opt/librenms/ping.php >> /dev/null 2>&1
*    *    * * *   librenms    sleep 30 && /opt/librenms/ping.php >> /dev/null 2>&1

to /etc/cron.d/librenms, but the alerts would still go off at the half minute mark. I’m pinging localhost on the distributed poller, so I know pings should be consistent on the device.

Yes, a failed ping will fire the alert. In case of fast ping it will fire in the moment it fail.

That makes sense. I think I figured out the source of my issue. I set the device on my poller to poller group 0, but I also had a poller running on my main install that was trying to poll the server that’s running my distributed poller. I’ve deactivated polling/ping/discovery on the main install and moved the devices on the distributed poller to its own group, and the problem seems to be resolved.

Thanks again!