LastChangedAt update

Products

VMware Smart Assurance Network Observability

Issue/Introduction

What causes the LastChangedAt value to get updated in Smarts SAM for Durable notifications?; Is there any command or log file which logs the timestamps?

Environment

All Supported Smarts version

Resolution

Any Smarts code calling the ICS_Notification::changed() function will cause the value for the LastChangedAt field of a notification to get updated. This could be a Smarts SAM notification processing routine when it receives a Notify/clear/changed event from an underlying server, or an application/adapter call to the ICS_Notification::changed() function.

There is no command or log file which logs timestamps when the LastChangedAt field of a notification gets updated. This is because the ICS_Notification::changed() function call does not log anything to the audit log.

Discarded duplicate clears will update the LastChangedAt field after an alert has been cleared so we can see a different time for both the LastChangedAt field and the LastClearedAt field. Please review the lab simulation details as follows:

========================================================

Step:1 Test Notification Created as follows:

# ./dmctl -s SAM get ICS_Notification::NOTIFICATION-Host_Test_Down | grep -iE 'AuditTrail|FirstNotifiedAt|LastChangedAt|LastClearedAt|LastNotifiedAt'
                           AuditTrail = {  { 0, 1782731821, admin, NOTIFY,  } }
                  AuditTrailSizeLimit = 100
                      FirstNotifiedAt = 1782731821
                        LastChangedAt = 1782731822
                        LastClearedAt = 0
                       LastNotifiedAt = 1782731821

Step:2> Clear the Test Notification:

# ./sm_ems -s SAM clear Host Test Down AMPM

Notification Properties updated for this CLEAR as follows:

# ./dmctl -s SAM get ICS_Notification::NOTIFICATION-Host_Test_Down | grep -iE 'AuditTrail|FirstNotifiedAt|LastChangedAt|LastClearedAt|LastNotifiedAt'
                           AuditTrail = { { 2, 1782731939, admin, CLEAR,  }, { 0, 1782731821, admin, NOTIFY,  } }
                  AuditTrailSizeLimit = 100
                      FirstNotifiedAt = 1782731821
                        LastChangedAt = 1782731939
                        LastClearedAt = 1782731939
                       LastNotifiedAt = 1782731821

Step:3> Clear the Test Notification again :

# ./sm_ems -s SAM clear Host Test Down AMPM

The Logs do appear to Discard the notification and update the LastChangedAt timeline:

[June 29, 2026 at 11:21:29 AM UTC +318ms] t@360625728 SM_ProtocolEngine-1708 1892119 sm_ems
EMS-*-DISCARDED_EVENT_DISP-DISCARDED EVENT: NOTIFICATION-Host_Test_Down - Reason: Already Cleared - Source: AMPM
======================================================================================================================================================
# ./dmctl -s SAM get ICS_Notification::NOTIFICATION-Host_Test_Down | grep -iE 'AuditTrail|FirstNotifiedAt|LastChangedAt|LastClearedAt|LastNotifiedAt'
                           AuditTrail = { { 2, 1782731939, admin, CLEAR,  }, { 0, 1782731821, admin, NOTIFY,  } }
                  AuditTrailSizeLimit = 100
                      FirstNotifiedAt = 1782731821
                        LastChangedAt = 1782732089 # Mon Jun 29 11:21:29 AM UTC 2026
                        LastClearedAt = 1782731939
                       LastNotifiedAt = 1782731821

Note: the numbers in the audit trail and timestamp parameters are in UNIX time.

Additional Information

Regarding event logging:

The audit log stores all updates (NOTIFY, CLEAR and actual CHANGE on the Notifications) and in the SAM domain log, we log only DISCARDS.

We do not log all notifications into the SAM domain logs unless debug are enabled. As we get about 40 to 50 thousand events from underlying systems (AMPM, OI, NPM etc), not all events are NOTIFIED, except changes, co-relation or RCA based information about impacted systems.