An existing connection forcibly closed by the remote host

Sainyam · Post by **Sainyam** » Fri Dec 16, 2011 10:45 pm

Hello Alex,

I am monitoring my Barracuda Firewall by HM.
I have set alert after one bad event.
But sometimes its give me unknown status with reply "An existing connection was forcibly closed by the remote host"

I want to ask two things

1. Why this gives me this reply and unknown status?
2. Secondly if I want to ignore only this unknown error to 5 times in row then how can I do it? along with my settings of alert me after one bad (In case of other).

KS-Soft · Post by **KS-Soft** » Sat Dec 17, 2011 11:34 am

Why this gives me this reply and unknown status?

Because an existing connection was forcibly closed by the remote host.
If you are asking what exactly software drops connection, I have to say - sorry, we do not have any idea. May be its your antivirus, may be its your firewall, may be some other software.

BTW: What exactly means "monitoring my Barracuda Firewall"? What test method do you use? Test is performed directly by HostMonitor? or you are using RMA installed on target system?
HostMonitor version?
RMA?
Windows?
Service Pack?
Antivirus?

Secondly if I want to ignore only this unknown error to 5 times in row then how can I do it? along with my settings of alert me after one bad (In case of other).

For example you may unmark "Treat Unknown status as Bad" option (Test Properties dialog) and add "advanced mode" action into profile assigned to the test using expression like
('%Status%'=='Unknown') and (%Recurrences%==5)
Also you may want to mark "Action depends on bad one" option for "good" action assigned for this test.

Regards
Alex

Sainyam · Post by **Sainyam** » Mon Dec 19, 2011 10:33 pm

What test method do you use?

I am using SNMP get method to monitor my Barracuda Spam and Firewall Device.

Test is performed directly by HostMonitor? or you are using RMA installed on target system?HostMonitor version? Windows? Service Pack? Antivirus?

Yes Test are performed directly from Host Monitor. I am using HM v8.86. Its Windows Server 2008 R2. None antivirus installed on it.

If I use this expression on profile, will it work

('%Status%'=='Unknown') and (%Recurrences%==5) or ('%Status%'=='Bad') and (%Recurrences%==1)

you may unmark "Treat Unknown status as Bad" option (Test Properties dialog)

This Option is not avaialble on the properties of test.

Regards
Alex[/quote]

KS-Soft · Post by **KS-Soft** » Tue Dec 20, 2011 6:08 am

If I use this expression on profile, will it work
('%Status%'=='Unknown') and (%Recurrences%==5) or ('%Status%'=='Bad') and (%Recurrences%==1)

If you want to use the same action in both cases, add more brakets
(('%Status%'=='Unknown') and (%Recurrences%==5)) or (('%Status%'=='Bad') and (%Recurrences%==1))

This Option is not avaialble on the properties of test

Click small [+] button beside "Reverse alert" option

Regards
Alex