Smarts SAM: What commands are needed to test the database for SMARTS OSPF events
Article ID: 331825
Updated On:
Products
VMware Smart Assurance
Environment
VMware Smart Assurance - SMARTS
Resolution
Here is is a notifiy event, and it's coresponding log entry telling us the event was sent to the external database. These are events take from SAM SDI adapter log:
Here is an example Down Notify event that I ill use to show you how to query the same events in your SQL database:
NA-SAM-AGG-8:Message Type : NL_NOTIFY...
NA-SAM-AGG-8:Key : NOTIFICATION-OSPFNeighborRelationship_OSPF-NBR-10.99.222.11/73-10.1.1.61->10.1.1.62_Down
NA-SAM-AGG-8:ClassName : OSPFNeighborRelationship
NA-SAM-AGG-8:InstanceName : OSPF-NBR-10.99.222.11/73 [TenGigE0/1/0/1] [10.1.1.61] [CH3WANRTR00 T9/8 NXGN CKT:100177036CHI02010GENY403L]-10.1.1.61->10.1.1.62
NA-SAM-AGG-8:EventName : Down
NA-SAM-AGG-8:Active : TRUE
NA-SAM-AGG-8:
NA-SAM-AGG-8:LastChangedAt : September 2, 2016 6:41:45 AM GMT+00:00
NA-SAM-AGG-8:LastNotifiedAt : September 2, 2016 6:40:41 AM GMT+00:00
NA-SAM-AGG-8:LastClearedAt : The Epoch
NA-SAM-AGG-8:Severity : 2
NA-SAM-AGG-8:Category : Operational
NA-SAM-AGG-8:Certainty : 100
NA-SAM-AGG-8:TroubleTicketID :
NA-SAM-AGG-8:Cached : FALSE
NA-SAM-AGG-8:Cached State : TRUE
NA-SAM-AGG-8: (Domain: NA-NPM-OSPF-8)
Looking at the below log entry we can see that this notification gets processed, and gets sent up to the SQL compatible database. Looking at this entry you can see that it has an event ID of - 1005669713- and was sent. Using this number we can search the SQL database for this same event:
INSERT INTO IC_Notification_Occurrences (OccurrenceIdentifier, Name, Class, Instance, Event, NotificationList, NotifiedAt, ClearedAt, LastChangedAt, Category, ElementClass, ElementInstance, EventState, IsRoot, ClearedOnInit, EventText, EventType, CreatedAt, ArchivedAt, Severity, Certainty, TroubleTicketID, InsertDTS, UpdateDTS) VALUES (1005669713, 'NOTIFICATION-OSPFNeighborRelationship_OSPF-NBR-10.99.222.11/73-10.1.1.61->10.1.1.62_Down', 'OSPFNeighborRelationship', 'OSPF-NBR-10.99.222.11/73 [TenGigE0/1/0/1] [10.1.1.61] [CH3WANRTR00 T9/8 NXGN CKT:100177036CHI02010GENY403L]-10.1.1.61->10.1.1.62', 'Down', 'SDI_NOTIFICATIONS', '2016-09-02 06:40:41', '1970-01-01 00:00:00', '2016-09-02 06:41:45', 'Operational', 'OSPFNeighborRelationship', 'OSPF-NBR-10.99.222.11/73-10.1
Here is an example Down Notify event that I ill use to show you how to query the same events in your SQL database:
NA-SAM-AGG-8:Message Type : NL_NOTIFY...
NA-SAM-AGG-8:Key : NOTIFICATION-OSPFNeighborRelationship_OSPF-NBR-10.99.222.11/73-10.1.1.61->10.1.1.62_Down
NA-SAM-AGG-8:ClassName : OSPFNeighborRelationship
NA-SAM-AGG-8:InstanceName : OSPF-NBR-10.99.222.11/73 [TenGigE0/1/0/1] [10.1.1.61] [CH3WANRTR00 T9/8 NXGN CKT:100177036CHI02010GENY403L]-10.1.1.61->10.1.1.62
NA-SAM-AGG-8:EventName : Down
NA-SAM-AGG-8:Active : TRUE
NA-SAM-AGG-8:
NA-SAM-AGG-8:LastChangedAt : September 2, 2016 6:41:45 AM GMT+00:00
NA-SAM-AGG-8:LastNotifiedAt : September 2, 2016 6:40:41 AM GMT+00:00
NA-SAM-AGG-8:LastClearedAt : The Epoch
NA-SAM-AGG-8:Severity : 2
NA-SAM-AGG-8:Category : Operational
NA-SAM-AGG-8:Certainty : 100
NA-SAM-AGG-8:TroubleTicketID :
NA-SAM-AGG-8:Cached : FALSE
NA-SAM-AGG-8:Cached State : TRUE
NA-SAM-AGG-8: (Domain: NA-NPM-OSPF-8)
Looking at the below log entry we can see that this notification gets processed, and gets sent up to the SQL compatible database. Looking at this entry you can see that it has an event ID of - 1005669713- and was sent. Using this number we can search the SQL database for this same event:
INSERT INTO IC_Notification_Occurrences (OccurrenceIdentifier, Name, Class, Instance, Event, NotificationList, NotifiedAt, ClearedAt, LastChangedAt, Category, ElementClass, ElementInstance, EventState, IsRoot, ClearedOnInit, EventText, EventType, CreatedAt, ArchivedAt, Severity, Certainty, TroubleTicketID, InsertDTS, UpdateDTS) VALUES (1005669713, 'NOTIFICATION-OSPFNeighborRelationship_OSPF-NBR-10.99.222.11/73-10.1.1.61->10.1.1.62_Down', 'OSPFNeighborRelationship', 'OSPF-NBR-10.99.222.11/73 [TenGigE0/1/0/1] [10.1.1.61] [CH3WANRTR00 T9/8 NXGN CKT:100177036CHI02010GENY403L]-10.1.1.61->10.1.1.62', 'Down', 'SDI_NOTIFICATIONS', '2016-09-02 06:40:41', '1970-01-01 00:00:00', '2016-09-02 06:41:45', 'Operational', 'OSPFNeighborRelationship', 'OSPF-NBR-10.99.222.11/73-10.1
Additional Information
The above two entries indicate and injection into the database, but to to verify this actualy happened here are a few database queries we can execute:
This command will show that exact Query with ID - 1005669713
***** select * from IC_Notification_Occurrences where OccurrenceIdentifier = 1005669713;
for example a query like the one below should also produce the result that it is present in DB,
**** select * from IC_Notification_Occurrences where Class like 'OSPFNeighborRelationship'
If we look at the table, IC_Occurrence_Servers would find the notification coming in from specific domains. To this we could we could use a query like:
****** select * from IC_Occurrence_Servers where Server like 'NA-NPM-OSPF-8'
this query would provide Occurrence Identitiers of the notificaitons which have come in from OSPF domain, and the timestamps would indicate the Update time and Insert Time,
these occurrence idenitifiers can be used to query IC_Notification_Occurrences to look for further details of the notificaiton.
Too look at OSPF neighbour relationship events, we should run a query
select * from IC_Notification_Occurrences where Class like 'OSPFNeighborRelationship'
This articles has been promoted as HVC on EMC Community Network (ECN): https://community.emc.com/docs/DOC-55340
.
This command will show that exact Query with ID - 1005669713
***** select * from IC_Notification_Occurrences where OccurrenceIdentifier = 1005669713;
for example a query like the one below should also produce the result that it is present in DB,
**** select * from IC_Notification_Occurrences where Class like 'OSPFNeighborRelationship'
If we look at the table, IC_Occurrence_Servers would find the notification coming in from specific domains. To this we could we could use a query like:
****** select * from IC_Occurrence_Servers where Server like 'NA-NPM-OSPF-8'
this query would provide Occurrence Identitiers of the notificaitons which have come in from OSPF domain, and the timestamps would indicate the Update time and Insert Time,
these occurrence idenitifiers can be used to query IC_Notification_Occurrences to look for further details of the notificaiton.
Too look at OSPF neighbour relationship events, we should run a query
select * from IC_Notification_Occurrences where Class like 'OSPFNeighborRelationship'
This articles has been promoted as HVC on EMC Community Network (ECN): https://community.emc.com/docs/DOC-55340
.
Feedback
Yes
No
Powered by
