Syslog messages Clear from Smarts OI Server before reaching SAM Console

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:




Syslog adapter is running but no syslog events appear in SAM Consoles
Syslog Messages do appear in the OI Server but clear automatically

Environment

VMware Smart Assurance - SMARTS

Cause

The syslog adapter configuration has been set to an Expiration time which is less then the SmoothingInterval between the OI server and SAM server in the ics.conf file.  Thus, the Syslog messages clear prior to the SAM server ever receiving a Notify event for the syslog Notification.

Resolution

Increase the EXPIRATION value in the my_hook_syslog.asl file or decrease the SmoothingInterval in the SAM ics.conf file for the OI Domain Manager.

The my_hook_syslog.asl file has an EXPIRATION parameter at the top of the file.  Do not change the parameter here as it will have no effect.  You much make the change to the file at approximately line 219 where is begins with:

MODIFY_ATTRIBUTES {
} do {
    DISCARD = "FALSE";
    CLEAR_SYSLOG = "FALSE";
    BATCH_NOTIFY_INTERVAL = 10;
    CLASSNAME = "Syslog" ? LOG;
    INSTANCENAME = HOST."_".APPLICATION_NAME."_".PROCESS_ID ? LOG;
    EVENTNAME = slice ? LOG;
    SEVERITY = "2" ? LOG;
    EVENTTEXT = MESSAGE ? LOG;
    CATEGORY = "" ? LOG;
    EXPIRATION = "120" ? LOG;
    STATE = "NOTIFY" ? LOG;
    INMAINTENANCE = "FALSE" ? LOG;