Details about the notification processing flow at Presentation level SAM
search cancel

Details about the notification processing flow at Presentation level SAM

book

Article ID: 331889

calendar_today

Updated On:

Products

VMware Smart Assurance Network Observability

Issue/Introduction

Symptoms:

At some instances, the audit logs do not match when two SAMs are associated hierarchically.

In below example, there are two SAMs, an Aggregate SAM named AGG-SAM and Presentation SAM named PRES-SAM.
The Presentation SAM takes its feed from the Aggregate SAM. The audit log information associated to each notification does not match in the AGG-SAM and PRES-SAM audit logs.

We can see that the highlighted entry below has come up before NOTIFY occurred in AGG-SAM audit file, which is not same as PRES-SAM.

$ cat AGG-SAM.audit | grep 'NOTIFICATION-Dummy-Device_Down'
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    0       DXA     NOTIFY  Server: SAM
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    1       EP    AutoTTEnabled   Event is Auto CreateTT
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    2       AutoTT  CREATE_TICKET   Setting owner as AutoTT
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    3       AutoTT  TAKE_OWNERSHIP
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    4       EP    AutoTTEnabled   Event is Auto CreateTT
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    5       user1 TAKE_OWNERSHIP
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    6       EP    AutoTTEnabled   Event is Auto CreateTT
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    7       AutoTT  AUTO_TICKET_CREATION     AUTO_CREATE
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    8       EP    AutoTTEnabled   Event is Auto CreateTT
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    9       Ticket Adapter  CREATE_TICKET    Raised Trouble Ticket
 
$ cat PRES-SAM.audit | grep 'NOTIFICATION-Dummy-Device_Down'
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    0       AutoTT  TAKE_OWNERSHIP  Server: AGG-SAM
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    1       DXA     NOTIFY  Server: AGG-SAM
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    9       user1 TAKE_OWNERSHIP  Server: AGG-SAM
<EPOCH>      <Date & Time>     NOTIFICATION-Dummy-Device_Down  Switch       Dummy-Device Down    10      AutoTT  TAKE_OWNERSHIP  Server: AGG-SAM

Environment

All Supported Smarts releases

Resolution

Between Presentation SAM and corresponding Aggregate SAM the notification flow uses HyperNotif and ics-nl-processing.asl.

You can go through the processNLNotifyV2 function in ics-nl-processing.asl file located at <Basedir>\SAM\smarts\rules\ics for the complete flow.

Below is the process of notification flow to Presentation SAM from underlying SAM: 

1) Notification Received from underlying Aggregate SAM.
 
2) Make the notification Object in the Presentation SAM, create notification object using makeNotification()

3) Copy all incoming notification attributes to Presentation SAM notification Attributes

4) In case the Owner is populated in underlying SAM - copy the field from underlying SAM to Presentation SAM and the Presentation SAM will invoke takeOwnerShip() on that notification.
All notifications having Owner from underlying Aggregate server, will always have takeOwnerShip() first in the audit log after the notification created but before DXA notify is seen.

5) Once all the attributes are copied then the notification object is ready for publishing.
 
6) The notify() function is called on the notification object and this is seen in Audit-Trail and Audit log as DXA notify