Troubleshooting event search
How to resolve problems with your event search configuration.
- You must log in each time you switch between interfaces
- Operations Analytics - Log Analysis session times out after 2 hours
- Launch to Operations Analytics - Log Analysis fails on Firefox in non-English locales
- Right-click tool fail to start Operations Analytics - Log Analysis from event lists
- Error message displayed when dynamic dashboard is run
- Error message displayed on "Show event dashboard by node" tool from event lists
- Chart display in Operations Analytics - Log Analysis changes without warning
- addIndex script error: Unexpected ant version
- addIndex script error: Duplicate fields in template file
You must log in each time you switch between interfaces
The problem occurs if single sign-on (SSO) is not configured. If the WebGUI and Operations Analytics - Log Analysis are on the same host computer, you must log in each time you switch between the interfaces in your browser.
This problem happens because each instance of WebSphere® Application Server uses the same default name for the LTPA token cookie:
LtpaToken2
. When you switch between the interfaces, one WebSphere Application Server instance overwrites the cookie of the other
and your initial session is ended.
The ways of resolving this problem are as follows:
- Customize the domain name in the WebGUI SSO configuration:
- In the administrative console of the WebSphere Application Server that hosts the WebGUI, click . Then, click and click Single sign-on (SSO)..
- Enter an appropriate domain name for your organization, for example, abc.com. By default, the domain name field is empty and the cookie's domain is the hostname. If you also customize the domain name in the Operations Analytics - Log Analysis WebSphere Application Server, to avoid any conflict ensure that the two domain names are different.
- Restart the Dashboard Application Services Hub server.
- Use the fully qualified domain name for accessing one instance of WebSphere Application Server and the IP address for accessing the other.
For example, always access the WebGUI by the fully
qualified domain name and always access Operations Analytics - Log
Analysis by the IP
address. To configure the WebGUI to access
Operations Analytics - Log
Analysis by the
IP address:
- In the $WEBGUI_HOME/etc/server.init file, change the
value of the scala.url property to the IP address of the host, For
example:
https://3.127.46.125:9987/Unity
- Restart the Dashboard Application Services Hub server. See https://www.ibm.com/docs/en/SSSHTQ_8.1.0/webtop/wip/task/web_adm_server_restart.html.
- In the $WEBGUI_HOME/etc/server.init file, change the
value of the scala.url property to the IP address of the host, For
example:
Operations Analytics - Log Analysis session times out after 2 hours
This problem occurs if SSO is not configured. The first time that you start the Operations Analytics - Log Analysis product from an event list in the WebGUI, you are prompted to log in to Operations Analytics - Log Analysis. You are automatically logged out after 2 hours and must reenter your login credentials every 2 hours. This problem occurs because the default expiration time of the LTPA token is 2 hours.
To resolve this problem, change the session timeout in the Operations Analytics - Log Analysis product as follows:
- In the $SCALA_HOME/wlp/usr/servers/Unity/server.xml
file, increase the value of the <ltpa expiration="120m"/> attribute to the required value, in
minutes. For example, to change the session timeout to 540
minutes:
</oauthProvider> <ltpa expiration="540"/> <webAppSecurity ssoDomainNames="hostname" httpOnlyCookies="false"/> </server>
- Restart the Operations Analytics - Log Analysis WebSphere Liberty Profile.
Launch to Operations Analytics - Log Analysis fails on Firefox in non-English locales
This problem is a known issue when you launch from the Active Event List (AEL) into the Firefox browser.
If your browser is set to a language other than US English (en_us) or English (en), you might not be able to launch into Operations Analytics - Log Analysis from the WebGUI AEL.
This problem happens because Operations Analytics - Log Analysis does not support all the languages that are supported by Firefox.
To work around this problem, try setting your browser language to an alternative language version. For example, if the problem arises when the browser language is French[fr], set the language to French[fr-fr]. If the problem arises when the browser language is German[de-de], set the language to German[de].
Right-click tool fail to start Operations Analytics - Log Analysis from event lists
The following error is displayed when you start the tools from the right-click menu of an event list:
CTGA0026E: The APP name in the query is invalid or it does not exist
This error occurs because the custom app that is defined in the $WEBGUI_HOME/etc/server.init file does not match the file names in the Tivoli® Netcool®/OMNIbus Insight® Pack.
To resolve this problem, set the scala.app.keyword and scala.app.static.dashboard properties in the server.init file accordingly.
- If the properties are set as follows, the version of the Insight Pack needs to be 1.1.0.2:
scala.app.keyword=OMNIbus_Keyword_Search scala.app.static.dashboard=OMNIbus_Static_Dashboard
- If the properties are set as follows, the version of the Insight Pack needs to be 1.1.0.1 or
1.1.0.0:
scala.app.keyword= OMNIbus_SetSearchFilter scala.app.static.dashbaord=OMNIbus_Event_Distribution
If you need to change the values of these properties, restart the Dashboard Application Services Hub server afterwards. See https://www.ibm.com/docs/en/SSSHTQ_8.1.0/webtop/wip/task/web_adm_server_restart.html.
Error message displayed when dynamic dashboard is run
The following error is displayed when you run a dynamic dashboard from the Operations Analytics - Log Analysis product:
undefined not found in results data
This error is a known defect in the Operations Analytics - Log Analysis product. To resolve, it close and then reopen the dynamic dashboard.
Error message displayed on Show event dashboard by node
tool from event lists
An error message is displayed when you start the Show event dashboard by node tool from an event list.
This error is caused by incompatibility between the version of the Insight Pack and the and the version of the Operations Analytics - Log Analysis product.
Ensure that the versions are compatible. See ../concept/soc_es_overview.html#soc_es_overview__requiredproducts. For more information about checking which version of the Insight Pack is installed, see Checking the version of the Insight Pack.
Chart display in Operations Analytics - Log Analysis changes without warning
The sequence in which charts are displayed on the Operations Analytics - Log Analysis GUI can changes intermittently. This problem is a known defect in the Operations Analytics - Log Analysis product and has no workaround or solution.
addIndex script error: Unexpected ant version
addIndex
script to create or update a data source type,
the script fails with an error that contains text similar to the following:
installation does not contain expected ant version.
./addIndex.sh -i
Prompt: installation does not contain expected ant version
This error could be caused by
any of the following issues: - Operations Analytics - Log
Analysis is
not installed on the machine on which you are running the
addIndex
script. - Operations Analytics - Log
Analysis is
installed on the machine on which you are running the
addIndex
script, but the script does not support the version of Operations Analytics - Log Analysis.
addIndex
script on a machine where Operations Analytics - Log
Analysis is installed.
Ensure that Operations Analytics - Log
Analysis 1.3.5 is
installed.addIndex script error: Duplicate fields in template file
addIndex
script to create or
update a data source type, the script fails with an error that contains text similar to the
following: filesets.json does not exist.
./addIndex.sh -i
....
generatebasedsv:
[exec] Duplicate field name: field_name
....
BUILD FAILED
filepath/addIndex.xml:68: Replace: source file filepath/data_source_type_nameInsightPack_v1.3.1.0/metadata/filesets.json
does not exist
Where:- field_name is the name of the duplicate field name.
- filepath is the system-dependent path to the script.
- data_source_type_name is the name of your custom data source type.
omnibus1100_template.properties
template file is used to define the fields
in the data source type. This error is caused by definition of duplicate fields in the
omnibus1100_template.properties
file.omnibus1100_template.properties
file and remove any duplicate fields. Then rerun
the addIndex
script.