Smarts SAM: Audit log shows the TAKE_OWNERSHIP occurring before NOTIFY in Presentation SAM; What is the notification processing flow at Presentation level SAM?

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:

Why do the audit logs not match when two SAMs are associated hierarchially?

In below example, there are two SAMs, an Aggregrate SAM named AGG-SAM and Presentation SAM named PRSN-SAM. The Presentation SAM takes its feed from the Aggregrate SAM. The audit log information associated to each notification does not match in the AGG-SAM and PRSN-SAM audit logs.

We can see that the highlighted entry below has come up before NOTIFY occurred in AGG-SAM audit file, which is not same as PRSN-SAM.

[smart@a026 logs]$ cat AGG-SAM.audit | grep 'NOTIFICATION-Switch__777015__2_Down'
1403520888      June 23, 2014 11:54:48 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    0       DXA     NOTIFY  Server: PLT-SAM-02
1403520888      June 23, 2014 11:54:48 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    1       nGTA    AutoTTEnabled   Event is Auto CreateTT
1403520888      June 23, 2014 11:54:48 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    2       AutoTT  CREATE_TICKET   Setting owner as AutoTT
1403520888      June 23, 2014 11:54:48 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    3       AutoTT  TAKE_OWNERSHIP
1403520888      June 23, 2014 11:54:48 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    4       nGTA    AutoTTEnabled   Event is Auto CreateTT
1403520949      June 23, 2014 11:55:49 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    5       user1 TAKE_OWNERSHIP
1403520949      June 23, 2014 11:55:49 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    6       nGTA    AutoTTEnabled   Event is Auto CreateTT
1403521009      June 23, 2014 11:56:49 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    7       AutoTT  AUTO_TICKET_CREATION     AUTO_CREATE
1403521009      June 23, 2014 11:56:49 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    8       nGTA    AutoTTEnabled   Event is Auto CreateTT
1403521009      June 23, 2014 11:56:49 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    9       Ticket Adapter  CREATE_TICKET    Raised Trouble Ticket
 
[smart@a027 logs]$ cat PRSN-SAM.audit | grep 'NOTIFICATION-Switch__777015__2_Down'
1403520891      June 23, 2014 11:54:51 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    0       AutoTT  TAKE_OWNERSHIP  Server: AGG-SAM
1403520891      June 23, 2014 11:54:51 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    1       DXA     NOTIFY  Server: AGG-SAM
1403520952      June 23, 2014 11:55:52 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    9       user1 TAKE_OWNERSHIP  Server: AGG-SAM
1403521011      June 23, 2014 11:56:51 AM GMT+01:00     NOTIFICATION-Switch__777015__2_Down  Switch       Switch_777015_2 Down    10      AutoTT  TAKE_OWNERSHIP  Server: AGG-SAM
 

Environment

VMware Smart Assurance - SMARTS

Resolution

Between Presentation SAM and corresponding Aggregate SAM the notification flow uses HyperNotif and ics-nl-processing.asl.

You can go through the processNLNotifyV2 function in ics-nl-processing.asl file located at <Basedir>\SAM\smarts\rules\ics for the complete flow.

Below is the process of notification flow to Presentation SAM from underlying SAM
 
1) Notification Received from underlying Aggregrate SAM.
 
2) Make the notification Object in the Presentation SAM, create notification object using makeNotification

3) Copy all incoming notification attributes to Presentation SAM notification Attributes

4) In case the Owner is populated in underlying SAM - copy the field from underlying SAM to Presentation SAM and the Presentation SAM will invoke takeOwnerShip on that notification. All notifications having Owner from underlying Aggregate server, will always have takeOwnerShip first in the audit log after the notification created but before DXA notify is seen.

5) Once all the attributes are copied then the notification object is ready for publishing.
 
6) The notify() function is called on the notification object and this is seen in AuditTrail and Audit log as DXA notify.