Log Monitoring (Enhanced) -> Watcher Rules (Enhanced) removing child profiles
Article ID: 190502
Updated On:
Products
Issue/Introduction
Template version: 4.12.1
Updates to Log Monitoring (Enhanced) -> Watcher Rules (Enhanced) are removing the child Variables (Enhanced) profiles and they ate not getting redeployed.
we have 3-tier profiles configured Log Monitoring (Enhanced) -> Watcher Rules (Enhanced) -> Variables (Enhanced) which all get install fine and work. But if a change is made to the Watcher Rules (Enhanced) the Variables (Enhanced) profiles are removed and not redeployed.
In this example we have:
SAP_MONI_SCRIPT -> CRITICAL -> port
-> sid
-> standby
-> type
-> CLEAR -> port
-> sid
-> standby
-> type
When first installed the config definition is correct with all the sub-profiles deployed:
<SAP_MONI_SCRIPT>
scanfile = /opt/sapscripts/bin/sap_check_ports.py
interval = 5 min
retries = 3
initialfileptr = 2
urluser =
command_timeout_active = no
urlpass =
alarmFOpenFail = yes
clearFOpenFailRestart = no
qos = yes
user =
max_alarms =
message = no
password =
fileencoding =
url_alarm_sev = 2
proxyport =
max_alarm_sev = 4
proxyuser =
SslSettings = 0
monitor_exit_code = no
scanmode = command
timeout = 15
proxypass =
active = yes
command_timeout = 65
subject =
alarm = yes
reccur_directory_level = 10
mcs_profileid = 1658089
resetFile = no
max_alarm_msg =
challengeresponse = no
resumefileptr = 4
command_timeout_alarm = no
reccur_directory = no
command_severity = 2
proxyhost =
<watchers>
<CLEAR>
mcs_profileid = 1667524
message =
variable_threshold_supp =
pattern_threshold =
match = /(\w*)\s*(OK:)(\w*)\s*(.*)\s*check.*port\s*(\d+)/
separator =
subsystemid =
restrict =
source =
commandexecutable =
runcommandonmatch = no
variable_threshold_severity = warning
qos =
level = clear
count = yes
alarm_on_first_match = no
variable_threshold_message =
expect_message =
pattern_threshold_severity = warning
target =
pattern_threshold_message =
timeout = 1
expect_level = warning
expect = no
i18n_token = as#system.logmon.application_error
abort = no
suppid = ${standby} ${sid} ${type} ${port}
active = yes
commandarguments =
variable_threshold =
sendclear = no
<variables>
<port>
operator = eq
qostarget =
definition = $5
qosactive = yes
mcs_profileid = 1667535
qosname =
threshold =
</port>
<standby>
qosname =
threshold =
mcs_profileid = 1667547
qosactive = yes
qostarget =
definition = $1
operator = eq
</standby>
<type>
qostarget =
definition = $4
operator = eq
mcs_profileid = 1667562
threshold =
qosactive = yes
qosname =
</type>
<sid>
qosactive = yes
definition = $3
operator = eq
qostarget =
threshold =
qosname =
mcs_profileid = 1794319
</sid>
</variables>
</CLEAR>
<CRITICAL>
pattern_threshold_message =
variable_threshold =
match = /(\w*)\s*(CRITICAL:)(\w*)\s*(.*)\s*check.*port\s*(\d+)/
message =
suppid = ${standby} ${sid} ${type} ${port}
level = critical
variable_threshold_message =
i18n_token = as#system.logmon.application_error
restrict =
alarm_on_first_match = no
commandarguments =
pattern_threshold_severity = warning
mcs_profileid = 1667582
source =
sendclear = no
subsystemid =
expect_level = warning
expect_message =
variable_threshold_supp =
pattern_threshold =
expect = no
runcommandonmatch = no
timeout = 1
variable_threshold_severity = warning
separator =
target =
qos =
abort = no
count = yes
commandexecutable =
active = yes
<variables>
<type>
mcs_profileid = 1667622
qostarget =
operator = eq
qosname =
definition = $4
qosactive = yes
threshold =
</type>
<port>
qosactive = yes
qostarget =
qosname =
mcs_profileid = 1667596
definition = $5
operator = eq
threshold =
</port>
<standby>
operator = eq
threshold =
qosactive = yes
qosname =
definition = $1
mcs_profileid = 1667607
qostarget =
</standby>
<sid>
definition = $3
qostarget =
qosname =
threshold =
mcs_profileid = 1794356
operator = eq
qosactive = yes
</sid>
</variables>
</CRITICAL>
</watchers>
</SAP_MONI_SCRIPT>
Once a change is made to the Watcher Rules, the Variables are no longer there:
<SAP_MONI_SCRIPT>
scanfile = /opt/sapscripts/bin/sap_check_ports.py
interval = 5 min
retries = 3
initialfileptr = 2
urluser =
command_timeout_active = no
urlpass =
alarmFOpenFail = yes
clearFOpenFailRestart = no
qos = yes
user =
max_alarms =
message = no
password =
fileencoding =
url_alarm_sev = 2
proxyport =
max_alarm_sev = 4
proxyuser =
SslSettings = 0
monitor_exit_code = no
scanmode = command
timeout = 15
proxypass =
active = yes
command_timeout = 60
subject =
alarm = yes
reccur_directory_level = 10
mcs_profileid = 1658089
resetFile = no
max_alarm_msg =
challengeresponse = no
resumefileptr = 4
command_timeout_alarm = no
reccur_directory = no
command_severity = 2
proxyhost =
<watchers>
<CLEAR>
qos =
level = clear
count = yes
mcs_profileid = 1667524
message =
alarm_on_first_match = no
variable_threshold_message =
expect_message =
pattern_threshold_severity = warning
variable_threshold_supp =
target =
pattern_threshold_message =
timeout = 1
expect_level = warning
expect = no
pattern_threshold =
i18n_token = as#system.logmon.application_error
abort = no
match = /(\w*)\s*(OK:)(\w*)\s*(.*)\s*check.*port\s*(\d+)/
separator =
subsystemid =
restrict =
suppid = ${standby} ${sid} ${type} ${port}
active = yes
source =
commandarguments =
commandexecutable =
runcommandonmatch = no
variable_threshold =
sendclear = no
variable_threshold_severity = warning
</CLEAR>
<CRITICAL>
expect_level = warning
pattern_threshold_message =
expect_message =
variable_threshold_supp =
pattern_threshold =
variable_threshold =
expect = no
match = /(\w*)\s*(CRITICAL:)(\w*)\s*(.*)\s*check.*port\s*(\d+)/
message =
runcommandonmatch = no
suppid = ${standby} ${sid} ${type} ${port}
level = critical
variable_threshold_message =
i18n_token = as#system.logmon.application_error
timeout = 1
restrict =
alarm_on_first_match = no
variable_threshold_severity = warning
separator =
commandarguments =
pattern_threshold_severity = warning
target =
qos =
abort = no
count = yes
commandexecutable =
active = yes
mcs_profileid = 1667582
source =
sendclear = no
subsystemid =
</CRITICAL>
</watchers>
</SAP_MONI_SCRIPT>
The alarms are no longer correct
I looked at the SSRV2Removal for the Watcher Rule and it removes the entire section even though there are child profiles:
Because the child profiles do not change they are not being redeployed. Perhaps the Watcher Rule should only remove the keys that it creates:
/profiles/{parentprofilename}/watchers/{watchername}/variable_threshold_message
/profiles/{parentprofilename}/watchers/{watchername}/variable_threshold_supp
/profiles/{parentprofilename}/watchers/{watchername}/match
/profiles/{parentprofilename}/watchers/{watchername}/expect
/profiles/{parentprofilename}/watchers/{watchername}/expect_message
/profiles/{parentprofilename}/watchers/{watchername}/runcommandonmatch
/profiles/{parentprofilename}/watchers/{watchername}/pattern_threshold_severity
/profiles/{parentprofilename}/watchers/{watchername}/suppid
/profiles/{parentprofilename}/watchers/{profilename}/count
/profiles/{parentprofilename}/watchers/{watchername}/expect_level
/profiles/{parentprofilename}/watchers/{watchername}/active
/profiles/{parentprofilename}/watchers/{watchername}/level
/profiles/{parentprofilename}/watchers/{watchername}/restrict
/profiles/{parentprofilename}/watchers/{watchername}/target
/profiles/{parentprofilename}/watchers/{watchername}/qos
/profiles/{parentprofilename}/watchers/{watchername}/alarm_on_first_match
/profiles/{parentprofilename}/watchers/{watchername}/i18n_token
/profiles/{parentprofilename}/watchers/{watchername}/source
/profiles/{parentprofilename}/watchers/{watchername}/message
/profiles/{parentprofilename}/watchers/{watchername}/variable_threshold_severity
/profiles/{parentprofilename}/watchers/{watchername}/abort
/profiles/{parentprofilename}/watchers/{watchername}/subsystemid
/profiles/{parentprofilename}/watchers/{watchername}/variable_threshold
/profiles/{parentprofilename}/watchers/{watchername}/sendclear
/profiles/{parentprofilename}/watchers/{watchername}/separator
/profiles/{parentprofilename}/watchers/{watchername}/pattern_threshold
/profiles/{parentprofilename}/watchers/{watchername}/pattern_threshold_message
/profiles/{parentprofilename}/watchers/{watchername}/commandexecutable
/profiles/{parentprofilename}/watchers/{watchername}/commandarguments
/profiles/{parentprofilename}/watchers/{watchername}/timeout
Environment
Release : 9.2.0
Component : UIM - MON_CONFIG_SERVICE_TEMPLATES
Resolution
Feedback
