Smarts SAM: Notification cleared at Top Level SAM with Deleted by Server in log
Article ID: 332006
Updated On:
Products
VMware Smart Assurance
Issue/Introduction
Symptoms:
Customer reported that they are getting notifications cleared seconds after being notified at Top Level SAM without getting any clear notification from underlying Lower Level SAM domain.
The BOTTOM audit log, does not show any logs that the notification is cleared. However, the TOP level SAM audit logs shows the Notification is "CLEAR Deleted by Server: <Lower Level SAM domain>"
Customer reported that they are getting notifications cleared seconds after being notified at Top Level SAM without getting any clear notification from underlying Lower Level SAM domain.
The BOTTOM audit log, does not show any logs that the notification is cleared. However, the TOP level SAM audit logs shows the Notification is "CLEAR Deleted by Server: <Lower Level SAM domain>"
Environment
VMware Smart Assurance - SMARTS
Cause
The issue here leading to this particular behavior is the filter (or script) from notification list that SAM is subscribed to.
That specific notifications did not match a filter and hence it is Cleared at the top level SAM but the Underlying domain does not show any Clear because it is not deleted or actually cleared but just not matching that Notification list. Since Top level is pulling information from the aggregate it will show in the logs as cleared, since it's no longer in the Aggregate SAM Notification list.
In the logs you'll see:-
NOTIFICATION-Router_etc.X.X.X.net_Unresponsive Router etc.X.X.X.net Unresponsive 2 DXA SOURCE-CLEAR Deleted by Server: X-SAM-X-X
Deleted by Server: X-SAM-X-X is caused by a NL_DELETE message from the underlying domain,
That specific notifications did not match a filter and hence it is Cleared at the top level SAM but the Underlying domain does not show any Clear because it is not deleted or actually cleared but just not matching that Notification list. Since Top level is pulling information from the aggregate it will show in the logs as cleared, since it's no longer in the Aggregate SAM Notification list.
In the logs you'll see:-
NOTIFICATION-Router_etc.X.X.X.net_Unresponsive Router etc.X.X.X.net Unresponsive 2 DXA SOURCE-CLEAR Deleted by Server: X-SAM-X-X
Deleted by Server: X-SAM-X-X is caused by a NL_DELETE message from the underlying domain,
Resolution
Smarts is behaving as designed.
You need to address your Notification list filter (script) that the Aggregate SAM is subscribed to, in order to match the notifications.
You need to address your Notification list filter (script) that the Aggregate SAM is subscribed to, in order to match the notifications.
Feedback
Yes
No
Powered by
