Troubleshooting event search

How to resolve problems with your event search configuration.

You must log in each time you switch between interfaces

The problem occurs if single sign-on (SSO) is not configured. If the WebGUI and Operations Analytics - Log Analysis are on the same host computer, you must log in each time you switch between the interfaces in your browser.

This problem happens because each instance of WebSphere® Application Server uses the same default name for the LTPA token cookie: LtpaToken2. When you switch between the interfaces, one WebSphere Application Server instance overwrites the cookie of the other and your initial session is ended.

The ways of resolving this problem are as follows:

  • Customize the domain name in the WebGUI SSO configuration:
    1. In the administrative console of the WebSphere Application Server that hosts the WebGUI, click Security > Global security. Then, click Authentication > Web security and click Single sign-on (SSO)..
    2. Enter an appropriate domain name for your organization, for example, abc.com. By default, the domain name field is empty and the cookie's domain is the hostname. If you also customize the domain name in the Operations Analytics - Log Analysis WebSphere Application Server, to avoid any conflict ensure that the two domain names are different.
    3. Restart the Dashboard Application Services Hub server.
  • Use the fully qualified domain name for accessing one instance of WebSphere Application Server and the IP address for accessing the other. For example, always access the WebGUI by the fully qualified domain name and always access Operations Analytics - Log Analysis by the IP address. To configure the WebGUI to access Operations Analytics - Log Analysis by the IP address:
    1. In the $WEBGUI_HOME/etc/server.init file, change the value of the scala.url property to the IP address of the host, For example:
      https://3.127.46.125:9987/Unity
    2. Restart the Dashboard Application Services Hub server. See https://www.ibm.com/docs/en/SSSHTQ_8.1.0/webtop/wip/task/web_adm_server_restart.html.

Operations Analytics - Log Analysis session times out after 2 hours

This problem occurs if SSO is not configured. The first time that you start the Operations Analytics - Log Analysis product from an event list in the WebGUI, you are prompted to log in to Operations Analytics - Log Analysis. You are automatically logged out after 2 hours and must reenter your login credentials every 2 hours. This problem occurs because the default expiration time of the LTPA token is 2 hours.

To resolve this problem, change the session timeout in the Operations Analytics - Log Analysis product as follows:

  1. In the $SCALA_HOME/wlp/usr/servers/Unity/server.xml file, increase the value of the <ltpa expiration="120m"/> attribute to the required value, in minutes. For example, to change the session timeout to 540 minutes:
    </oauthProvider>
      <ltpa expiration="540"/>
      <webAppSecurity ssoDomainNames="hostname" httpOnlyCookies="false"/>
    </server>
  2. Restart the Operations Analytics - Log Analysis WebSphere Liberty Profile.

Launch to Operations Analytics - Log Analysis fails on Firefox in non-English locales

This problem is a known issue when you launch from the Active Event List (AEL) into the Firefox browser.

If your browser is set to a language other than US English (en_us) or English (en), you might not be able to launch into Operations Analytics - Log Analysis from the WebGUI AEL.

This problem happens because Operations Analytics - Log Analysis does not support all the languages that are supported by Firefox.

To work around this problem, try setting your browser language to an alternative language version. For example, if the problem arises when the browser language is French[fr], set the language to French[fr-fr]. If the problem arises when the browser language is German[de-de], set the language to German[de].

Right-click tool fail to start Operations Analytics - Log Analysis from event lists

The following error is displayed when you start the tools from the right-click menu of an event list:

CTGA0026E: The APP name in the query is invalid or it does not exist

This error occurs because the custom app that is defined in the $WEBGUI_HOME/etc/server.init file does not match the file names in the Tivoli® Netcool®/OMNIbus Insight® Pack.

To resolve this problem, set the scala.app.keyword and scala.app.static.dashboard properties in the server.init file accordingly.

  • If the properties are set as follows, the version of the Insight Pack needs to be 1.1.0.2:
    scala.app.keyword=OMNIbus_Keyword_Search
    scala.app.static.dashboard=OMNIbus_Static_Dashboard
  • If the properties are set as follows, the version of the Insight Pack needs to be 1.1.0.1 or 1.1.0.0:
    scala.app.keyword= OMNIbus_SetSearchFilter
    scala.app.static.dashbaord=OMNIbus_Event_Distribution

If you need to change the values of these properties, restart the Dashboard Application Services Hub server afterwards. See https://www.ibm.com/docs/en/SSSHTQ_8.1.0/webtop/wip/task/web_adm_server_restart.html.

Error message displayed when dynamic dashboard is run

The following error is displayed when you run a dynamic dashboard from the Operations Analytics - Log Analysis product:

undefined not found in results data

This error is a known defect in the Operations Analytics - Log Analysis product. To resolve, it close and then reopen the dynamic dashboard.

Error message displayed on Show event dashboard by node tool from event lists

An error message is displayed when you start the Show event dashboard by node tool from an event list.

This error is caused by incompatibility between the version of the Insight Pack and the and the version of the Operations Analytics - Log Analysis product.

Ensure that the versions are compatible. See ../concept/soc_es_overview.html#soc_es_overview__requiredproducts. For more information about checking which version of the Insight Pack is installed, see Checking the version of the Insight Pack.

Chart display in Operations Analytics - Log Analysis changes without warning

The sequence in which charts are displayed on the Operations Analytics - Log Analysis GUI can changes intermittently. This problem is a known defect in the Operations Analytics - Log Analysis product and has no workaround or solution.

addIndex script error: Unexpected ant version

When you are running the addIndex script to create or update a data source type, the script fails with an error that contains text similar to the following: installation does not contain expected ant version.
./addIndex.sh -i
Prompt: installation does not contain expected ant version
This error could be caused by any of the following issues:
  • Operations Analytics - Log Analysis is not installed on the machine on which you are running the addIndex script.
  • Operations Analytics - Log Analysis is installed on the machine on which you are running the addIndex script, but the script does not support the version of Operations Analytics - Log Analysis.
To resolve this run the addIndex script on a machine where Operations Analytics - Log Analysis is installed. Ensure that Operations Analytics - Log Analysis 1.3.5 is installed.

addIndex script error: Duplicate fields in template file

When you are running the addIndex script to create or update a data source type, the script fails with an error that contains text similar to the following: filesets.json does not exist.
./addIndex.sh -i
.... 
generatebasedsv:
      [exec] Duplicate field name: field_name 
....
BUILD FAILED
filepath/addIndex.xml:68:  Replace: source file filepath/data_source_type_nameInsightPack_v1.3.1.0/metadata/filesets.json
does not exist
Where:
  • field_name is the name of the duplicate field name.
  • filepath is the system-dependent path to the script.
  • data_source_type_name is the name of your custom data source type.
The omnibus1100_template.properties template file is used to define the fields in the data source type. This error is caused by definition of duplicate fields in the omnibus1100_template.properties file.
To resolve this, edit the omnibus1100_template.properties file and remove any duplicate fields. Then rerun the addIndex script.