Database Management

False positive offline alerts in SQL Sentry

You have received an alert for an offline condition within SQL Sentry. When you go to check the server in question, it is not offline.

First published date

3/29/2024 1:40 PM

Last published date

3/26/2025 11:41 PM

Overview

You have received an alert for an offline condition within SQL Sentry. When you go to check the server in question, it is not offline. This can happen for either SQL Server or Windows Server conditions, depending upon environmental scenarios. We will want to set up a Response Ruleset to help eliminate these false positive alerts so that when the offline condition alerts, the server is actually offline.

Product section

SQL Sentry (SQLS)

Cause

In typical cases, the case of this is a slight network blip that has caused SQL Sentry's polling to not be able to connect several times in a row. This can happen in the span of just a few seconds. Because the polling tries and can't connect on several consecutive attempts, it treats the connection as offline and subsequently throws the offline condition. 

Resolution

To keep these false positives from alerting your team, you will want to set up a Response Ruleset that will take into account these quick blips in the network. 
  1. Open the Conditions Pane and find the corresponding condition/s that are alerting you. (Typically Windows: Offline, Windows Computer: Offline, or SQL Server: Offline)
  2. Click on the Condition and go to the Ruleset tab.
    • sqlsentry-conditions-pane-ruleset-tab-202112.png
  3. Create a new ruleset that is Time Based. Set the "Process Actions After" between 3 -5 minutes and set "Process Subsequent Actions Every" to an appropriate amount.
    • sqlsentry-response-ruleset-editor-time-based-ruleset-example-202118.png
  4. Repeat these steps for conditions you are receiving as falsely offline.
  5. Once completed, delete the corresponding Online conditions that mirror the Offline ones you just added the ruleset to. (we do this because the online condition will continue to alert after a false offline no matter what, even if the false offline is filtered out by our ruleset)

After the above steps, you should end up with one or multiple offline conditions that have rulesets applied to them and their corresponding online alerts no longer being present. 

This information is also covered along with more information relating to Response Rulesets in our documentation here. Please feel free to take a look.