Event Analytics synthetic parent events are being cleared
After configuring event patterns to trigger a synthetic event, you notice that the
synthetic parent event is generated with the severity chosen in the View Related Events portlet in the
Pattern parent tab. However, after a short time the parent event is cleared
(severity =clear), and eventually, this synthetic parent event is deleted when the
delete_clear
trigger is activated in the ObjectServer.
Problem
The parent synthetic event should not be cleared. The system has determined that there is an event pattern and related event groups based on this pattern should continue to be generated in the Event Viewer.
Cause
This issue is caused if the ObjectServer gateway is incorrectly set up.
Resolution
Perform the following steps to work around this issue.
- Edit the
AGG_GATE.map
file for the bidirectional ObjectServer gateway used for the failover aggregate ObjectServer pair. - Find the StatusMap table in the file.
- Within this table check that the ParentIdentifier field has been added. There should be a line
in the table that reads as
follows:
'ParentIdentifier' = '@ParentIdentifier'
- On the secondary (AGG_B) aggregate ObjectServer in the failover pair, disable the
re_remove_dangling_parentEvent
ObjectServer trigger. You can do this in one of the following ways:- Linux®: using the
nco_config
tool. - Windows: using the Netcool® Administrator tool.
- Linux®: using the
https://rtp-rtc10.tivlab.raleigh.ibm.com:9443/jazz/web/projects/BSM#action=com.ibm.team.workitem.viewWorkItem%26id=68866