Difference between CLEAR and SOURCE-CLEAR

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

What is the difference between CLEAR and SOURCE-CLEAR Audit log entries?

Environment

All Supported Smarts versions

Resolution

A SOURCE-CLEAR entry in the Smarts SAM Audit log indicates a notification has multiple sources and Smarts SAM has not received a CLEAR from all sources.

Example, a notification generated by both Smarts APM and Smarts MPLS has two sources. If Smarts SAM receives a CLEAR for this notification from Smarts APM first, because the notification has another source, it would stay ACTIVE and SAM would put SOURCE-CLEAR in the audit log. Then when SAM receives a CLEAR from Smarts MPLS as well, it will clear this notification, set it to INACTIVE, and put CLEAR in the audit log.

Therefore, SOURCE-CLEAR in the audit log means that Smarts SAM has received a CLEAR from one source of a notification that has multiple sources, but not from all sources.

CLEAR in the audit log means SAM has received CLEAR from ALL sources related to this notification.