I've created an AckTime field in object server. Datatype = UTC.
On my acknowledge right click tool, I've got the following sql
update alerts.status set Acknowledged=1, AckTime = getdate() where Serial in ( $selected_rows.Serial );
On events that haven't been acknowledged (Acknowledge = 0) the AckTime field is still getting updated. I have no rules or triggers that modify this field. Any ideas why it would update?
Thanks in advance
This topic has been locked.
10 replies Latest Post - 2013-02-12T18:24:45Z by OPanciera
Pinned topic UTC fields in Object Server
Answered question This question has been answered.
Unanswered question This question has not been answered yet.
Updated on 2013-02-12T18:24:45Z at 2013-02-12T18:24:45Z by OPanciera
gulfsoft 1000008G2Y25 PostsACCEPTED ANSWER
Re: UTC fields in Object Server2013-01-19T04:56:24Z in response to deltabravoI think you need to check again. The ONLY ways that any fields can be updated are:
- Probe rules that set the value
- Triggers that set or modify the value
- Tools that set or modify the value
- Impact policies that set or modify the value
- A gateway
- Direct nco_sql calls
So, what value is the AckTime field being set to? Is it the same as some other events? Is it set before you run the tool or only after?
Specifically, your system is configured to update that field somewhere, and you need to find out where.
We can make Tivoli software work for you!
Re: UTC fields in Object Server2013-01-30T23:00:10Z in response to gulfsoftSo even a bigger headscratcher.
Only on one probe server and only on the syslog probe on that server is the AckTime being updated....(history I actually removed the AckTime field and added an AcknowledgeTime field).
I turned on syslog capture and can see that the AcknowledgeTime field gets updated...It has the same timestamp as the other time fields, firstoccurrence, statechange, etc....
I've searched through all the syslog rules and no reference to AcknowledgeTime exists...
This is a "riddle me this Batman" issue..
Mahyuddin 270003XKQT40 PostsACCEPTED ANSWER
Re: UTC fields in Object Server2013-01-31T06:20:40Z in response to deltabravoHi,
When you says "syslog capture", did you means raw capture log? If yes, did the "AcknowledgeTime" filed logged as "Status_AcknowledgeTime" or just "AcknowledgeTime"?
If it just "AcknowledgeTime", means it set by rules file. If you can't find any of your rules file contains this field, it could be the rules file been updated by the probe didn't get restarted to pickup the new rules file. You can use kill -HUP <probe pid>.
If after restart, the probe still setting the "AcknowledgeTime" (identify through raw capture log), means there rules file you might miss in your search.
Re: UTC fields in Object Server2013-01-31T15:18:12Z in response to MahyuddinThe probe capture file does show Status_AcknowledgeTime. In fact, all the UTC time fields are getting set to the current time.
Another data point here. Yesterday it was just the one probe. I put another probe in raw capture mode and after restarting, it started updating the field. So it is only on probes that have apparently read the object server fields on restart.
Here is a snippet of the cap. Notice the fields all same time stamp. Don't think I've got a RAD_TimeWindowStart or End specified in any rule file either.
Status_FirstOccurrence = 1359643461
Status_RAD_TimeWindowStart = 1359643461
Status_RAD_TimeWindowEnd = 1359643461
Status_AcknowledgeTime = 1359643461
Status_StateChange = 1359643461
SystemAdmin 110000D4XK1283 PostsACCEPTED ANSWER
Re: UTC fields in Object Server2013-01-31T16:16:46Z in response to deltabravoIf a probe doesn't know about a field (because the field was added after the probe had been started or last rules file reread) then the field won't be present in the insert statement to the ObjectServer. As long as the field is inserted after the existing columns then the "short insert" will succeed and the new fields will default to "" (for string fields) or 0 for integer/time.
The behaviour if the probe knows about the time field is dependent on fixpack level as it is related to APAR IZ54825:-
So fixes are in 7.2.0 FP 10, 7.2.1 FP 7, 7.3.0 FP 9, 7.3.1 FP 4. (It seems there was something odd with the fix being merged forward to 7.3.0 and 7.3.1 hence the relatively late fixpacks).
Check which version you are currently running.
If you use a version prior to any of these then any time field (that the probe knows about) is unset (i.e. it is 0) after rules file processing then it is set to the current time.
After those fixpack versions we only update LastOccurrence and FirstOccurrence to the current time if they are 0 after the rules file has been processed. All other time fields are left as 0.
Re: UTC fields in Object Server2013-01-31T16:52:35Z in response to SystemAdminThanks Alex. This is EXACTLY my scenario. The probe capture showed that the field was set to getdate() on insert before any other process took place.
I'm chasing the rabbit down the fixpack hole.
gulfsoft 1000008G2Y25 PostsACCEPTED ANSWER
Re: UTC fields in Object Server2013-01-31T16:32:05Z in response to deltabravoYou're using TBSM, so you may also be using Impact. This means there are really quite a few more places to look. You mat want to move this to the TBSM forum (RAD was the former name or TBSM, and if you've got those fields being updated, you're using TBSM).
We can make Tivoli software work for you!www.gulfsoft.com
Re: UTC fields in Object Server2013-01-30T22:18:01Z in response to deltabravoThis one is a head scratcher. I've found one syslog probe that is updating the field AckTime. There is not a single syslog rule that has the AckTime field specified. I've not found a trigger that has it either....
Any ideas on how to figure out what is updating it?