IV99200: SITUATION ALERTS PERSIST AFTER AGENT SHUTDOWN

APAR status

• Closed as Permanent restriction.

Error description

• PROBELM DESCRIPTION: Customer sets up situation with a
  sampling interval and persist count. For
  example sampling interval of 5 minutes with persist count of  3.
  However, if the agent goes down before the 3 sampling periods,
  the alert
  is still generated - seemingly 'after the fact' and after the
  agent
  would have reported the 3rd sample.
  
  
  
  RECREATE INSTRUCTIONS:
  Perpare a sampled situation with a sampling interval of 3 with a
  persist
   count of 3.
  
  Stop the Agent 6 minutes after the situation threshold could
  have been met the first time (situation was watching for a
  running
  service, service was started and the agent stopped 6 minutes
  later.
  
  Observe that the situation alert in the Tep Situation Event
  Console
  is generated 1 minute after the agent is stopped and 7 minutes
  after the
  situation threshold was met.
  
  The sampling interval and persist count would have expected 9
  minutes to
  have met the criteria.  Yet the agent was stopped 6 minutes into
  the
  test and the alert was still generated a minute after the agent
  was
  offline.
  

Local fix

Problem summary

• A situation with a sampling interval and persist period can be
  created such that when the Agent is terminated, a residual
  alert is propagated to the user even though the Agent is no
  longer running.
  
  
  So if a sampling interval of 5 minutes with persist count
  of 3 was configured for a Situation, then if the Agent is
  terminated before the 3 sampling periods, an alert is
  still generated - seemingly 'after the fact'  and after the
  agent would have reported the 3rd sample.
  

Problem conclusion

• With the current design, the processing involved in terminating
  an Agent does not have the capacity to remove alerts which have
  already been queued prior to the completion of the Agent
  shutdown.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels