Current Situation Values view is empty even if situation is true

Body

In one of our environment I had to setup a situation that was expected to fire when the size of  specified file did not change between two situation intervals.

The formula looked like this:

------------------
*IF *VALUE File_Information.File_U *EQ 'systemout.log' *AND *VALUE
File_Information.Path_U *EQ '/tmp' *AND *CHANGE File_Information.Size *EQ 0
------------------

It leverages on the "Change In Value" function used on Unix OS agent attribute "Size", belonging to the File_Information attribute group.

The situation fired and the alert was displayed and propagated in TEP physical tree.

Anyway, clicking on the event the "Current Situation Values" view showed no info also after several minutes and even if situation continued to stay true.

I had to investigate to understand the reason behind this unexpected behavior and finally found that

this is not really an error, it occurs because of the "Change In Value" function used into the situation formula.

Initially I suspected of the attribute "Size", but then I noticed it was occurring with any numeric attribute in case "Change In Value" function is used.
This function checks how a value has changed comparing it to the previous situation sample.
So situations with "Change In Value" function require 2 data samples.
When you perform a refresh in the "Current Situation Values" view, the code creates a stand-alone situation request that collects only one sample and evaluates situation based on one sample.
This request runs separately from the original situation.

For this reason, "Current Situation Values" view can not be used for situations using "Change In Value" or "Percent Change In Value" functions: it will be always empty.
If the situation involves attribute "Size" from Unix OS agent File_Information attribute group, and if the "Change In Value" function is needed only to check whether the the Size is changed from previous sample, like in the formula:

------------------
*IF *VALUE File_Information.File_U *EQ 'systemout.log' *AND *VALUE
File_Information.Path_U *EQ '/tmp' *AND *CHANGE File_Information.Size *EQ 0

-------------------

then we can use another attribute to obtain the same result.
The attribute name is "File Content Changed".
The situation formula should look like:

-------------------
*IF *VALUE File_Information.File_U *EQ 'systemout.log' *AND *VALUE
File_Information.Path_U *EQ '/tmp' *AND *VALUE File_Information.FCChanged *EQ 'NO'
-------------------

This situation has the same purpose of the original one, but it will also shows the "Current Situation Value" information when situation is true.

Thanks for reading

Subscribe and follow us for all the latest information directly on your social feeds: