Event Analytics synthetic parent events are being cleared

After configuring event patterns to trigger a synthetic event, you notice that the synthetic parent event is generated with the severity chosen in the View Related Events portlet in the Pattern parent tab. However, after a short time the parent event is cleared (severity =clear), and eventually, this synthetic parent event is deleted when the delete_clear trigger is activated in the ObjectServer.

Problem

The parent synthetic event should not be cleared. The system has determined that there is an event pattern and related event groups based on this pattern should continue to be generated in the Event Viewer.

Cause

This issue is caused if the ObjectServer gateway is incorrectly set up.

Resolution

Perform the following steps to work around this issue.
  1. Edit the AGG_GATE.map file for the bidirectional ObjectServer gateway used for the failover aggregate ObjectServer pair.
  2. Find the StatusMap table in the file.
  3. Within this table check that the ParentIdentifier field has been added. There should be a line in the table that reads as follows:
    'ParentIdentifier' = '@ParentIdentifier'
  4. On the secondary (AGG_B) aggregate ObjectServer in the failover pair, disable the re_remove_dangling_parentEvent ObjectServer trigger. You can do this in one of the following ways:
    • Linux®: using the nco_config tool.
    • Windows: using the Netcool® Administrator tool.