At some instances, the audit logs do not match when two SAMs are associated hierarchically.
In below example, there are two SAMs, an Aggregate SAM named AGG-SAM and Presentation SAM named PRES-SAM.
The Presentation SAM takes its feed from the Aggregate SAM. The audit log information associated to each notification does not match in the AGG-SAM and PRES-SAM audit logs.
We can see that the highlighted entry below has come up before NOTIFY occurred in AGG-SAM audit file, which is not same as PRES-SAM.
$ cat AGG-SAM.audit | grep 'NOTIFICATION-Dummy-Device_Down'
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 0 DXA NOTIFY Server: SAM
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 1 EP AutoTTEnabled Event is Auto CreateTT
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 2 AutoTT CREATE_TICKET Setting owner as AutoTT
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 3 AutoTT TAKE_OWNERSHIP
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 4 EP AutoTTEnabled Event is Auto CreateTT
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 5 user1 TAKE_OWNERSHIP
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 6 EP AutoTTEnabled Event is Auto CreateTT
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 7 AutoTT AUTO_TICKET_CREATION AUTO_CREATE
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 8 EP AutoTTEnabled Event is Auto CreateTT
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 9 Ticket Adapter CREATE_TICKET Raised Trouble Ticket
$ cat PRES-SAM.audit | grep 'NOTIFICATION-Dummy-Device_Down'
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 0 AutoTT TAKE_OWNERSHIP Server: AGG-SAM
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 1 DXA NOTIFY Server: AGG-SAM
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 9 user1 TAKE_OWNERSHIP Server: AGG-SAM
<EPOCH> <Date & Time> NOTIFICATION-Dummy-Device_Down Switch Dummy-Device Down 10 AutoTT TAKE_OWNERSHIP Server: AGG-SAM
All Supported Smarts releases
Between Presentation SAM and corresponding Aggregate SAM the notification flow uses HyperNotif and ics-nl-processing.asl.
You can go through the processNLNotifyV2 function in ics-nl-processing.asl file located at <Basedir>\SAM\smarts\rules\ics for the complete flow.
Below is the process of notification flow to Presentation SAM from underlying SAM:
1) Notification Received from underlying Aggregate SAM.
2) Make the notification Object in the Presentation SAM, create notification object using makeNotification()
3) Copy all incoming notification attributes to Presentation SAM notification Attributes
4) In case the Owner is populated in underlying SAM - copy the field from underlying SAM to Presentation SAM and the Presentation SAM will invoke takeOwnerShip() on that notification.
All notifications having Owner from underlying Aggregate server, will always have takeOwnerShip() first in the audit log after the notification created but before DXA notify is seen.
5) Once all the attributes are copied then the notification object is ready for publishing.
6) The notify() function is called on the notification object and this is seen in Audit-Trail and Audit log as DXA notify