Enable debugging for events received by the Events-Processing-Manager (Event Spy)

Products

• VMware Smart Assurance

Issue/Introduction

Steps to enable event spy on Events-Processing-Manager (EPM)

Steps to enable event spy to get raw traffic flow data received from device.

Environment

Watch4Net/M&R 7.x

Resolution

Steps to enable debugging for events received by the Watch4net Events-Processing-Manager (Event Spy).

1. Open the processing.xml of respective EPM instance for editing. This file is found here:                          
   

   /opt/APG/Event-Processing/Event-Processing-Manager/<instance>/conf/processing.xml

2. Uncomment or add the following line:

    <!-- Debugging -->
        <!-- Event spy for debugging purposes: outputs events to log files. Install the event-processing-utils modules to use this. -->
        <processing-element name="EVENT-SPY" type="EventSpy" config="Event-Processing-Utils/Default/conf" />

3. Add "EVENT-SPY" to the "data" parameter of the listener you wish to debug. For example, the following shows the Event Spy added to a Smarts Listener:

<!-- Smarts Listener -->
        <processing-element name="Smarts" config="Smarts-Listener/Default/conf/smarts-listener.xml" data="AC Generic-Event-Writer[data] EVENT-SPY" />

4. Save and close the processing.xml file.
5. Restart the EPM service for changes to get updated. 
6. Once restart is done, please check processing.log for Event Spy data present under below directory.

    /opt/APG/Event-Processing/Event-Processing-Manager/<instance>/logs

Additional Information

• The "event-processing-utils" module must be installed to use Event Spy debugging. 
• To check this, use the following command - "/opt/APG/bin/manage-modules.sh list installed"
• To install, use the following command - "/opt/APG/bin/manage-modules.sh install event-processing-utils"