We have had events on servers (discovered as hosts) where ICMP/SNMP are unavailable. For some servers, we have a 'DOWN' notification with an 'Unresponsive' event as part of the Impact. For other servers we have only 'Unresponsive' Events. And for others, we have 'Unresponsive' events that are IsRoot, then minutes later, a 'Down' event takes away the IsRoot flag for that server's event stream.

I'm trying to understand what type of diagnostics/tests that AM (6.2 sp1) does to escalate an event from Unresponsive to Down, and what is the difference between the 2 event definitions.

I understand that 'Unresponsive' is a symptom of a 'Down' event, but why would some events receive the 'Down' condition, and others not ?

Thanks