Trap Adapter platform flag RESOLVE_IP on trap_mgr.conf

Products

• VMware Smart Assurance

Issue/Introduction

This Article explains about the rap Adapter platform flag RESOLVE_IP on trap_mgr.conf

Environment

SMARTS- 10.1.x

Resolution

• On Smarts trap adapter platform we can enable RESOLVE_IP flag, while trap parsing which will determines whether unrecognized IP Addresses will be resolved before being assigned to the $SYS$ variable. 

• • <SMARTS Based>smarts/conf/icoi/trap_mgr.conf
    
    RESOLVE_IP = FALSE
    
    uncomment the line RESOLVE_IP and change to TRUE.

  • restart Smarts Trap adapter platform after the change.

     

Additional Information

Below the explanation in trap_mgr.conf file, also the flag can work with CACHE_HOSTS to use file for name resolution.
# --------------------------------------------------------------------------
# This flag determines whether unrecognized IP Addresses will be resolved
# before being assigned to the $SYS$ variable.  For objects already known
# to the system, this option will have no effect.
# NOTE:  Name resolution can be very slow.  A system receiving thousands of
# traps and calling a name server for every request can seriously impact
# the number of traps that can be processed.  Threading can help somewhat,
# but name resolution is NOT RECOMMENDED in large installations unless the
# server is configured to use only host file resolution and the
# 'CACHE_HOSTS' feature is used.  Alternatively, a caching DNS server can
# be run on the trap host to help somewhat, but performance will still
# be impacted.
# --------------------------------------------------------------------------
# RESOLVE_IP = FALSE

# --------------------------------------------------------------------------
# This flag only has meaning if "RESOLVE_IP" is TRUE.  The flag determines
# whether the system 'hosts' will be cached and used to resolve IP addresses
# instead of calling the system functions which may be slow in some cases.
# NOTE:  This is ONLY useful if DNS name resolution is disabled in the
# Smarts environment.  This is sometimes done to improve performance, but
# it requires an extensive hosts table.  By altering the 'HOSTS_PATH'
# below, it is possible to use a special file to load the hosts cache
# instead of using the same hosts file used by the system that the trap
# processor is running on.
# --------------------------------------------------------------------------
# CACHE_HOSTS = FALSE

# --------------------------------------------------------------------------
# This value only has meaning if "CACHE_HOSTS" is TRUE.  It defines the full
# path to the system 'hosts' file.  (It is possible to use a unique file for
# the cache by specifying its path here.)
# --------------------------------------------------------------------------
# HOSTS_PATH = /etc/hosts

 

• Please note if the IP objects is already known to the system, this option will have no effect. You may remove the IP objects in trap adapter platform to take effect for the new trap.
• Also there are impact of the resource on name resolution related to the number of trap processing with RESOLVE_IP enable.
• Below is related code in trap_mgr_parse.asl file
  
  

  conf/icoi/trap_mgr.conf
  
  rules/icoi-trapd/trap_mgr_conf.asl
  
  rules/icoi-trapd/trap_mgr_parse.asl
  
  if (resolve_ip == "TRUE") {
  
                      if ((glob("<0-255>.<0-255>.<0-255>.<0-255>", elementinstancename)) ||
  
                          (glob("[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*", elementinstancename))) {
  
                          tempresolve = "";
  
                          if (cache_hosts == "FALSE") {
  
                             tempresolve = system->addrToName(elementinstancename) ? LOG, IGNORE ;
  
                          }