Smarts: Trap Adapter platform flag RESOLVE_IP on trap_mgr.conf

Products

• VMware Smart Assurance

Environment

VMware Smart Assurance - SMARTS

Resolution

On Smarts trap adapter platform we can enable RESOLVE_IP flag, while trap parsing which will determines whether unrecognized IP Addresses will be resolved before being assigned to the $SYS$ variable. 

<SMARTS Based>smarts/conf/icoi/trap_mgr.conf

RESOLVE_IP = FALSE

uncomment the line RESOLVE_IP and change to TRUE.

restart Smarts Trap adapter platform after the change.

Additional Information

Below the explanation in trap_mgr.conf file, also the flag can work with CACHE_HOSTS to use file for name resolution.

# --------------------------------------------------------------------------
# This flag determines whether unrecognized IP Addresses will be resolved
# before being assigned to the $SYS$ variable.  For objects already known
# to the system, this option will have no effect.
# NOTE:  Name resolution can be very slow.  A system receiving thousands of
# traps and calling a name server for every request can seriously impact
# the number of traps that can be processed.  Threading can help somewhat,
# but name resolution is NOT RECOMMENDED in large installations unless the
# server is configured to use only host file resolution and the
# 'CACHE_HOSTS' feature is used.  Alternatively, a caching DNS server can
# be run on the trap host to help somewhat, but performance will still
# be impacted.
# --------------------------------------------------------------------------
# RESOLVE_IP = FALSE

# --------------------------------------------------------------------------
# This flag only has meaning if "RESOLVE_IP" is TRUE.  The flag determines
# whether the system 'hosts' will be cached and used to resolve IP addresses
# instead of calling the system functions which may be slow in some cases.
# NOTE:  This is ONLY useful if DNS name resolution is disabled in the
# Smarts environment.  This is sometimes done to improve performance, but
# it requires an extensive hosts table.  By altering the 'HOSTS_PATH'
# below, it is possible to use a special file to load the hosts cache
# instead of using the same hosts file used by the system that the trap
# processor is running on.
# --------------------------------------------------------------------------
# CACHE_HOSTS = FALSE

# --------------------------------------------------------------------------
# This value only has meaning if "CACHE_HOSTS" is TRUE.  It defines the full
# path to the system 'hosts' file.  (It is possible to use a unique file for
# the cache by specifying its path here.)
# --------------------------------------------------------------------------
# HOSTS_PATH = /etc/hosts

Please note if the IP objects is already known to the system, this option will have no effect. You may remove the IP objects in trap adapter platform to take effect for the new trap.

Also there are impact of the resource on name resolution related to the number of trap processing with RESOLVE_IP enable.

below is related code in trap_mgr_parse.asl file

conf/icoi/trap_mgr.conf
rules/icoi-trapd/trap_mgr_conf.asl
rules/icoi-trapd/trap_mgr_parse.asl
if (resolve_ip == "TRUE") {
                    if ((glob("<0-255>.<0-255>.<0-255>.<0-255>", elementinstancename)) ||
                        (glob("[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F]*", elementinstancename))) {
                        tempresolve = "";
                        if (cache_hosts == "FALSE") {
                           tempresolve = system->addrToName(elementinstancename) ? LOG, IGNORE ;
                        }