The network interface firmware will register the link status and provide that information to OneFS (standard behavior for all machines).  The individual node should register that change right away - you should be able to see it if you query 'ifconfig' on that node right away. Upon the change in status - the log files should also reflect the change in /var/log/messages. Then the event is handed off to CELOG for alert notification.  The alert is created and then follows configured rules to provide event notification.  The 30 second figure makes me think of a timeout somewhere.  So there may be some delay in looking up DNS records in the CELOG configuration before alerts can be sent out.   So if you are looking for faster turnaround on the event notifications, I would run a test to see the order of operations and further pinpoint where the delay is and the exact delay.  Tail the /var/log/messages file Unplug an ethernet cable (preferably avoiding critical business impact as this will cause movement and possibly interrupt connected clients!) Run ifconfig on that node to verify the immediate registering of the link status change. Note the exact moment of disconnection and verify it's in the tailed messages log. Watch isi status output for alert notification - noting the time delay.
Hi there ,,, Anybody know how Isilon detects link down ( network connection ) event ?  Reason I am asking is this ..... client Accessing Isilon detects link down as soon as it happens ... but isi event list time stamp show the same event in 30 sec later ..  So is there any rule in Isilon that take time to notice  link down event ?    thanks aya 
Link Down msg