Smarts SAM/OI: Trap events are cleared instantaneously in Smarts OI

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:




Trap events are cleared instantaneously in Smarts OI
Smarts trapd creates a new event in OI when the new event arrives, but OI immediately clears the event, apparently without a clear event being sent from the trapd.

Environment

VMware Smart Assurance - SMARTS

Cause

This can occur when an earlier clear event is somehow cached in Smarts OI prior the notify event. When this happens and the notify event occurrs, the notification in Smarts OI is immediately cleared as the clear event was already present.

Resolution

This behavior is by design to help deal with trap floods. Within the trap_mgr_parse.asl, there is a cleanInterval value of 900 seconds (15 minutes). A "clear" table is maintained and cleared every 900 seconds, and if an event arrives again during the cleanInterval period, it will get cleared.

Workaround
To work around this behavior, you could set the PutInTable value to FALSE, or lower the cleanInterval setting(default=900). However, these changes to the Smarts ASL code should be handled with care, as the changes are not supported and may leave your environment vulnerable to trap floods.