Why do I sometimes see health check errors for WebPulse/DRTR, even though it works correctly?

book

Article ID: 167559

calendar_today

Updated On:

Products

ProxySG Software - SGOS

Issue/Introduction

The Blue Coat WebPulse (formerly known as DRTR, for Dynamic Real-Time Rating) service is designed with multiple possible service points. The ProxySG appliance's health check system generates an alert when it detects that one of these service points is down, but the service continues to function without interruption while accessing the next available site from the numerous service points.  In SGOS 6.5 the service points are determined by the DNS lookup results of sp.cwfservice.net, as of SGOS 6.6 sp.cwfservice.net has been replaced with webpulse.es.bluecoat.com.  This change has been made to accommodate new services and to implement certificate based authentication.  Currently this service only contains a limited number of IP addresses, this will however increase over the next several months.

For example, in the following health check condition, WebPulse functions without issue:
(In SGOS 6.6 the Domain Name below would be webpulse.es.bluecoat.com)

  drtr.rating_service
    Domain name: sp.cwfservice.net      DNS status: success
      Enabled      OK for some IPs      UP
      IP address: 103.246.38.203              Enabled      OK      UP
        Last status: Success.
        Successes (total): 39      (last): Mon, 01 Sep 2014 22:37:25 GMT      (consecutive): 39
        Failures  (total): 0      (last): Never      (consecutive): 0      (external): 0
        Last response time: 221 ms      Average response time: 322 ms
        Minimum response time: 219 ms      Maximum response time: 3196 ms

--Truncated--

      IP address: 199.19.249.201              Enabled      OK      UP
        Last status: Success.
        Successes (total): 39      (last): Mon, 01 Sep 2014 22:37:57 GMT      (consecutive): 39
        Failures  (total): 0      (last): Never      (consecutive): 0      (external): 0
        Last response time: 1082 ms      Average response time: 1139 ms
        Minimum response time: 986 ms      Maximum response time: 4059 ms
      IP address: 103.246.39.213              Enabled      OK      UP
        Last status: Success.
        Successes (total): 39      (last): Mon, 01 Sep 2014 22:37:16 GMT      (consecutive): 39
        Failures  (total): 0      (last): Never      (consecutive): 0      (external): 0
        Last response time: 21 ms      Average response time: 99 ms
        Minimum response time: 18 ms      Maximum response time: 2996 ms
>>>   IP address: 103.246.36.213              Enabled      Check failed      DOWN  <<<<<<<<
        Last status: A communication error has occurred.
        Successes (total): 32      (last): Mon, 01 Sep 2014 01:37:13 GMT      (consecutive): 0
        Failures  (total): 3489      (last): Tue, 02 Sep 2014 00:00:07 GMT      (consecutive): 3489      (external): 0
        Last response time: 9989 ms      Average response time: 9984 ms
        Minimum response time: 9978 ms      Maximum response time: 9991 ms

Resolution

Workaround

While this is expected behavior, you can try to reduce these notifications by performing one of the following:
  1. Override the notifications you receive from the DRTR rating service by going to Configuration > Health Checks > DRTR rating service > Override default notification settingsBy selecting which notifications to send, you can effectively reduce the notifications you receive.  This is highly useful when working with email notifications
  2. If you would rather not receive any healthcheck notifications from DRTR, even if there is a problem, simply disable the same healthcheck using the 'Disabled:Healthy' option.