Topic
10 replies Latest Post - ‏2013-02-12T18:24:45Z by OPanciera
deltabravo
deltabravo
20 Posts
ACCEPTED ANSWER

Pinned topic UTC fields in Object Server

‏2013-01-18T18:55:29Z |
I've created an AckTime field in object server. Datatype = UTC.

On my acknowledge right click tool, I've got the following sql
update alerts.status set Acknowledged=1, AckTime = getdate() where Serial in ( $selected_rows.Serial );

On events that haven't been acknowledged (Acknowledge = 0) the AckTime field is still getting updated. I have no rules or triggers that modify this field. Any ideas why it would update?

Thanks in advance
Updated on 2013-02-12T18:24:45Z at 2013-02-12T18:24:45Z by OPanciera
  • gulfsoft
    gulfsoft
    25 Posts
    ACCEPTED ANSWER

    Re: UTC fields in Object Server

    ‏2013-01-19T04:56:24Z  in response to deltabravo
    I think you need to check again. The ONLY ways that any fields can be updated are:

    • Probe rules that set the value
    • Triggers that set or modify the value
    • Tools that set or modify the value
    • Impact policies that set or modify the value
    • A gateway
    • Direct nco_sql calls

    So, what value is the AckTime field being set to? Is it the same as some other events? Is it set before you run the tool or only after?

    Specifically, your system is configured to update that field somewhere, and you need to find out where.

    Frank

    We can make Tivoli software work for you!
    www.gulfsoft.com
    • deltabravo
      deltabravo
      20 Posts
      ACCEPTED ANSWER

      Re: UTC fields in Object Server

      ‏2013-01-30T23:00:10Z  in response to gulfsoft
      So even a bigger headscratcher.

      Only on one probe server and only on the syslog probe on that server is the AckTime being updated....(history I actually removed the AckTime field and added an AcknowledgeTime field).

      I turned on syslog capture and can see that the AcknowledgeTime field gets updated...It has the same timestamp as the other time fields, firstoccurrence, statechange, etc....

      I've searched through all the syslog rules and no reference to AcknowledgeTime exists...

      This is a "riddle me this Batman" issue..

      Any ideas?
      • Mahyuddin
        Mahyuddin
        40 Posts
        ACCEPTED ANSWER

        Re: UTC fields in Object Server

        ‏2013-01-31T06:20:40Z  in response to deltabravo
        Hi,

        When you says "syslog capture", did you means raw capture log? If yes, did the "AcknowledgeTime" filed logged as "Status_AcknowledgeTime" or just "AcknowledgeTime"?

        If it just "AcknowledgeTime", means it set by rules file. If you can't find any of your rules file contains this field, it could be the rules file been updated by the probe didn't get restarted to pickup the new rules file. You can use kill -HUP <probe pid>.

        If after restart, the probe still setting the "AcknowledgeTime" (identify through raw capture log), means there rules file you might miss in your search.
        • deltabravo
          deltabravo
          20 Posts
          ACCEPTED ANSWER

          Re: UTC fields in Object Server

          ‏2013-01-31T15:18:12Z  in response to Mahyuddin
          The probe capture file does show Status_AcknowledgeTime. In fact, all the UTC time fields are getting set to the current time.

          Another data point here. Yesterday it was just the one probe. I put another probe in raw capture mode and after restarting, it started updating the field. So it is only on probes that have apparently read the object server fields on restart.

          Here is a snippet of the cap. Notice the fields all same time stamp. Don't think I've got a RAD_TimeWindowStart or End specified in any rule file either.

          Status_FirstOccurrence = 1359643461
          Status_RAD_TimeWindowStart = 1359643461
          Status_RAD_TimeWindowEnd = 1359643461
          Status_AcknowledgeTime = 1359643461
          Status_StateChange = 1359643461
          • SystemAdmin
            SystemAdmin
            1283 Posts
            ACCEPTED ANSWER

            Re: UTC fields in Object Server

            ‏2013-01-31T16:16:46Z  in response to deltabravo
            If a probe doesn't know about a field (because the field was added after the probe had been started or last rules file reread) then the field won't be present in the insert statement to the ObjectServer. As long as the field is inserted after the existing columns then the "short insert" will succeed and the new fields will default to "" (for string fields) or 0 for integer/time.

            The behaviour if the probe knows about the time field is dependent on fixpack level as it is related to APAR IZ54825:-

            https://www-01.ibm.com/support/docview.wss?uid=swg1IZ54825

            So fixes are in 7.2.0 FP 10, 7.2.1 FP 7, 7.3.0 FP 9, 7.3.1 FP 4. (It seems there was something odd with the fix being merged forward to 7.3.0 and 7.3.1 hence the relatively late fixpacks).

            Check which version you are currently running.

            If you use a version prior to any of these then any time field (that the probe knows about) is unset (i.e. it is 0) after rules file processing then it is set to the current time.

            After those fixpack versions we only update LastOccurrence and FirstOccurrence to the current time if they are 0 after the rules file has been processed. All other time fields are left as 0.
            • deltabravo
              deltabravo
              20 Posts
              ACCEPTED ANSWER

              Re: UTC fields in Object Server

              ‏2013-01-31T16:52:35Z  in response to SystemAdmin
              Thanks Alex. This is EXACTLY my scenario. The probe capture showed that the field was set to getdate() on insert before any other process took place.

              I'm chasing the rabbit down the fixpack hole.
          • gulfsoft
            gulfsoft
            25 Posts
            ACCEPTED ANSWER

            Re: UTC fields in Object Server

            ‏2013-01-31T16:32:05Z  in response to deltabravo
            You're using TBSM, so you may also be using Impact. This means there are really quite a few more places to look. You mat want to move this to the TBSM forum (RAD was the former name or TBSM, and if you've got those fields being updated, you're using TBSM).

            We can make Tivoli software work for you!www.gulfsoft.com
  • SystemAdmin
    SystemAdmin
    1283 Posts
    ACCEPTED ANSWER

    Re: UTC fields in Object Server

    ‏2013-01-19T07:03:37Z  in response to deltabravo
    If your other tool, say 'change severity' is working, try comparing it with this one. Copy and modify it.
  • deltabravo
    deltabravo
    20 Posts
    ACCEPTED ANSWER

    Re: UTC fields in Object Server

    ‏2013-01-30T22:18:01Z  in response to deltabravo
    This one is a head scratcher. I've found one syslog probe that is updating the field AckTime. There is not a single syslog rule that has the AckTime field specified. I've not found a trigger that has it either....

    Any ideas on how to figure out what is updating it?
  • OPanciera
    OPanciera
    22 Posts
    ACCEPTED ANSWER

    Re: UTC fields in Object Server

    ‏2013-02-12T18:24:45Z  in response to deltabravo
    You could modify default trigger new_row via nco_config utility setting AckTime to 0.