book
Article ID: 103516
calendar_today
Updated On:
Issue/Introduction
When reviewing the VNM.OUT the following information shows:
4/18/18 12:37:54 AM[Current Event: 0x1169b31] [Current Model: 0x399a08] Error: Error evaluating end string expression
4/18/18 12:37:54 AM[Current Event: 0x1169b31] [Current Model: 0x399a08] Error: Error evaluating start string expression
2018/04/18 00:24:14: Warning: Event rule CA.EventCondition for model 0x399a08, model name xxxxxxxxxxxxx for event 0x1169ada Unable to evaluate expression - possibly due to attempted access of a non-existent trap variable
Cause
Review the model handle and the event id that are contained within the message:
Current Event: 0x1169b31] [Current Model: 0x399a08
For this example, model_handle 0x1169b31 matched to a Host_Systemedge. Event 0x1169b31 shows that it was generated from 0x01160028 and it tried to generate 0x1169ada:
0x01160028 R Aprisma.EventCondition, \
"!exists( { v 12 } )", "0x01169b2f -:-", \
"{ v 12 } == { I 4 } || { v 12 } == { I 12 }", "0x01169b30 -:-", \
"{ v 12 } == { I 5 } || { v 12 } == { I 6 } || { v 12 } == { I 7 }", "0x01169b31 -:-", \
"{ v 12 } == { I 2 } || { v 12 } == { I 11 }", "0x01169adb -:-", \
"default", "0x01169af9 -:-"
0x01169b31 P "CreateEventWithVariables(\
{C CURRENT_MODEL},\
{H 0x1169ada},\
SetEventVariable( GetEventVariableList(), {H 0x12b4c},\
Append( Append( {S\"\"}, GetEventVariable({U 1})),\
Append( Append( Append({S\"(\"}, ToString(GetEventVariable({U 3}))),\
Append({S\") is \"},\
GetElement(\
AddHead(\
AddHead(\
AddHead(\
AddHead(\
AddHead(\
AddHead(\
AddHead(\
CreateList(),\
{S\"not equal to\"}),\
{S\"equal to\"}),\
{S\"less than or equal to\"}),\
{S\"greater than or equal to\"}),\
{S\"less than\"}),\
{S\"greater than\"}),\
{S\"'no operator'\"}),\
GetEventVariable({U 6}))\
)\
),\
Append( Append( {S\" configured threshold(\"},\
ToString(GetEventVariable({U 4})) ),\
{S\")\"} )\
)\
)\
)\
)"
When reviewing the AlertMap for 0x1160028, we can see the following trap information:
# monitorTrap
1.3.6.1.4.1.546.1.1.6.1 0x1160028 1.3.6.1.4.1.546.6.1.1.2(1,0) \
1.3.6.1.4.1.546.6.1.1.5(2,0) \
1.3.6.1.4.1.546.6.1.1.6(3,0) \
1.3.6.1.4.1.546.6.1.1.8(4,0) \
1.3.6.1.4.1.546.6.1.1.12(5,0) \
1.3.6.1.4.1.546.6.1.1.7(6,0) \
1.3.6.1.4.1.546.6.1.1.1(7,0) \
1.3.6.1.4.1.546.6.1.1.16(8,0) \
1.3.6.1.4.1.546.6.1.1.18(9,0) \
1.3.6.1.4.1.546.6.1.1.19(10,0) \
1.3.6.1.4.1.546.6.1.1.20(11,0) \
1.3.6.1.4.1.546.6.1.1.22(12,0)
When running a sniffer trace and reviewing the varbinds, the agent was not sending information in all of the varbinds.
Environment
Release:
Component: SPCAEM
Resolution
The agent is sending traps that do not contain the needed varbind values. Update/fix the agent to send all varbinds and values so the event rule processing can work.