Smarts ASAM: Alerts for device are being missed; eventMgr.asl: No _hostObj in CacheTable, and looking for the object; missing alerts for device from SCOM
Article ID: 331925
Updated On:
Products
VMware Smart Assurance
Issue/Introduction
Symptoms:
Alerts for the device are being missed.
When server name is using upper case letters in SCOM and Smarts Adapter for OpsMgr, it is not recognised in SAM
From the logs the following errors are seen:
[July 20, 2016 2:41:49 PM GMT+02:00 +361ms] t@3880 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: No _hostObj in CacheTable, and looking for the object
[July 20, 2016 2:41:49 PM GMT+02:00 +361ms] t@3880 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: July 20,,EventMgr,ERR,Event's host: SMARTS1.emc.com is unknown to SMARTS,ignoring event.
So from the log file it looks like the Smarts Adapter for OpsMgr didnt find the server in its host cache table.
However, the device is indeed monitored by Smarts IP. There is also a correspondent object in Smarts SAM:
D:\EMC\SAM9.4\SAM\smarts\bin>dmctl -s SWR-SAM get Host::smarts1.emc.com
Properties of Host::smarts1.emc.com
Certification = CERTIFIED
ComposedOf = { Interface::IF-smarts1.emc.com/12 }
ConfiguredBy = { }
ConnectedVia = { IPNetwork::IPNET-10.127.101.0 }
CreationClassName = Host
....
Alerts for the device are being missed.
When server name is using upper case letters in SCOM and Smarts Adapter for OpsMgr, it is not recognised in SAM
From the logs the following errors are seen:
[July 20, 2016 2:41:49 PM GMT+02:00 +361ms] t@3880 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: No _hostObj in CacheTable, and looking for the object
[July 20, 2016 2:41:49 PM GMT+02:00 +361ms] t@3880 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: July 20,,EventMgr,ERR,Event's host: SMARTS1.emc.com is unknown to SMARTS,ignoring event.
So from the log file it looks like the Smarts Adapter for OpsMgr didnt find the server in its host cache table.
However, the device is indeed monitored by Smarts IP. There is also a correspondent object in Smarts SAM:
D:\EMC\SAM9.4\SAM\smarts\bin>dmctl -s SWR-SAM get Host::smarts1.emc.com
Properties of Host::smarts1.emc.com
Certification = CERTIFIED
ComposedOf = { Interface::IF-smarts1.emc.com/12 }
ConfiguredBy = { }
ConnectedVia = { IPNetwork::IPNET-10.127.101.0 }
CreationClassName = Host
....
Environment
VMware Smart Assurance - SMARTS
Cause
When an SCOM alert comes into SCOM Adapter, the adapter uses ComputerName present in SCOM Alert and determines whether the topology element corresponding to ComputerName is present in SAM server using findComputerSystem method.
Since in this case, we see the ComputerName from SCOM is in upper case and the corresponding topology in SAM is lower case, it is not able to find the topology element.
This occurs because the Microsoft SCOM is not case sensitive, so SMARTS1 is the same as smarts1 as far as SCOM is concerned. SAM is case sensitive so only stores the device name it was initially discovered with.
Since Microsoft sticks to this case-insensitiveness, it doesn t matter if the actual hostname configured on the server is written smarts1 or SMARTS1 . The clients will always be able to access the server, regardless of the case they use. Because of this users do not have a stringent policy how the computer name on the system itself is configured.
Therefore what happens is, device is discovered in IP / SAM as smarts1.emc.com. Then end user access the server with SMARTS1 from SCOM, SAM checks to see if it has a SMARTS1 but it doesn't have a server with upper case name, only smarts1 so ignores the alarm.
Since in this case, we see the ComputerName from SCOM is in upper case and the corresponding topology in SAM is lower case, it is not able to find the topology element.
This occurs because the Microsoft SCOM is not case sensitive, so SMARTS1 is the same as smarts1 as far as SCOM is concerned. SAM is case sensitive so only stores the device name it was initially discovered with.
Since Microsoft sticks to this case-insensitiveness, it doesn t matter if the actual hostname configured on the server is written smarts1 or SMARTS1 . The clients will always be able to access the server, regardless of the case they use. Because of this users do not have a stringent policy how the computer name on the system itself is configured.
Therefore what happens is, device is discovered in IP / SAM as smarts1.emc.com. Then end user access the server with SMARTS1 from SCOM, SAM checks to see if it has a SMARTS1 but it doesn't have a server with upper case name, only smarts1 so ignores the alarm.
Resolution
Since the host name in SCOM is uppercase and domain name is lower-case, the asl file attached will take the hostname and do lowercase search of the name as well as an upper case search when looking up the topology .
This change will enable the host to be matched.
To install the asl file :
1. Backup the original asl file from <adapter-install-dir>/SAM.adapters/smarts/local/rules/opsmgr2007/ to some dir where it wont be deleted.
2. stop the scom adapter service;
3. Rename the attached asl file to eventMgr.asl and copy the asl to <adapter-install-dir>/SAM.adapters/smarts/local/rules/opsmgr2007/
4. start the adapter-service
This change will enable the host to be matched.
To install the asl file :
1. Backup the original asl file from <adapter-install-dir>/SAM.adapters/smarts/local/rules/opsmgr2007/ to some dir where it wont be deleted.
2. stop the scom adapter service;
3. Rename the attached asl file to eventMgr.asl and copy the asl to <adapter-install-dir>/SAM.adapters/smarts/local/rules/opsmgr2007/
4. start the adapter-service
Additional Information
Once installed, the following will be seen when the first events are imported:
An ASL error is thrown because the object SMARTS1.emc.com is not found
[August 22, 2016 8:24:07 AM GMT+02:00 +865ms] t@5808 EventMgr_RTMGR
ASL-W-ERROR_RULE_SOURCE-While executing rule set 'D:\EMC\SAM-Adapters8.1\SAM.Adapters\smarts\local\rules\OpsMgr2007\eventMgr.asl'
ASL-ERROR_ACTION-While executing action at:
ASL-CALL_STACK_RULE- RuleName: findHostFromCache, Line: 239
ASL-CALL_STACK_RULE- RuleName: importEvent, Line: 345
ASL-CALL_STACK_RULE- RuleName: END_EVENT, Line: 191
ASL-CALL_STACK_RULE- RuleName: EVENT, Line: 169
ASL-CALL_STACK_RULE- RuleName: START, Line: 126
ASL-ERROR_UNDEFINED_TABLE_KEY_ACCESS-Attempted to access undefined key 'SMARTS1.emc.com' in table 'hostCacheTable'
ASL-BAD_HASH_TABLE_KEY-The hash table key 'SMARTS1.emc.com' was not found
But then it is found:
[August 22, 2016 8:24:07 AM GMT+02:00 +865ms] t@5808 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: Found the host from Cache table. Returning the same
The error seen is normal, the adapter will periodically synchronise the topology from SAM (only for UnitaryComputerSystem), now in SAM - the Host Name is lower-case.
The SCOM provides it in upper-case (except for domain name), so initially the adapter checks if the hostname exists using the upper-case version. It is not found hence the error is seen. Then, as a result of the fix, the adapter converts upper-case to lower-case and then attempts a look up in the hostTable or uses findComputerSystem, where it is found and continues as normal.
An ASL error is thrown because the object SMARTS1.emc.com is not found
[August 22, 2016 8:24:07 AM GMT+02:00 +865ms] t@5808 EventMgr_RTMGR
ASL-W-ERROR_RULE_SOURCE-While executing rule set 'D:\EMC\SAM-Adapters8.1\SAM.Adapters\smarts\local\rules\OpsMgr2007\eventMgr.asl'
ASL-ERROR_ACTION-While executing action at:
ASL-CALL_STACK_RULE- RuleName: findHostFromCache, Line: 239
ASL-CALL_STACK_RULE- RuleName: importEvent, Line: 345
ASL-CALL_STACK_RULE- RuleName: END_EVENT, Line: 191
ASL-CALL_STACK_RULE- RuleName: EVENT, Line: 169
ASL-CALL_STACK_RULE- RuleName: START, Line: 126
ASL-ERROR_UNDEFINED_TABLE_KEY_ACCESS-Attempted to access undefined key 'SMARTS1.emc.com' in table 'hostCacheTable'
ASL-BAD_HASH_TABLE_KEY-The hash table key 'SMARTS1.emc.com' was not found
But then it is found:
[August 22, 2016 8:24:07 AM GMT+02:00 +865ms] t@5808 EventMgr_RTMGR
ASL_MSG-*-ASLP-OpsMgr2007/eventMgr.asl: Found the host from Cache table. Returning the same
The error seen is normal, the adapter will periodically synchronise the topology from SAM (only for UnitaryComputerSystem), now in SAM - the Host Name is lower-case.
The SCOM provides it in upper-case (except for domain name), so initially the adapter checks if the hostname exists using the upper-case version. It is not found hence the error is seen. Then, as a result of the fix, the adapter converts upper-case to lower-case and then attempts a look up in the hostTable or uses findComputerSystem, where it is found and continues as normal.
Feedback
Yes
No
Powered by
