To handle CLEAR of DURABLE trap when OI is DOWN

Products

VMware Smart Assurance Network Observability

Issue/Introduction

After OI domain manager restarts, all persisted ICS_Notification events transition to WAS_ACTIVE. For certain ephemeral or synthetic event sources, this is undesirable — operators do not want stale notifications from these sources to survive a restart. Instead, those notifications should be explicitly cleared (EventState = INACTIVE) on restart so they auto-archive and are removed from the active event console.

Environment

Smarts: All Supported OI Suite

Version: 25.x and later

Cause

On restart, the RESTORE_NOTIFICATIONS rule in icoi-init.asl unconditionally calls serverDetached() on every notification, which sets the state to WAS_ACTIVE. There is no mechanism to instead clear a notification on restart for specific sources.

Resolution

NOTE: Following workaround would work on new traps generated after implementing custom asl but would not work on existing trap notification.

A pre-modified icoi-init.asl is provided as an attachment to this KB article. It introduces a configurable variable ClearSourcesOnRestart that, when set to a comma-separated list of event source DomainName values, calls ICS_Notification::clear() for those sources on restart instead of serverDetached(). This drives the EventState to INACTIVE (CLEAR), after which the notification follows the standard auto-archive lifecycle.

Default value: "" (empty) — preserves all existing behavior. Safe to deploy without setting the variable.
No code changes are required, Only the variable value needs to be configured.

Prerequisites

Access to $SM_SITEMOD/conf/icoi/(INCHARGE-OI) on the server.
Know the DomainName of the trap-based source. To find it:

dmctl -s <OI> get ICS_Domain::ICS-Trap-Normalization::DomainName
Example:
dmctl -s INCHARGE-OI get ICS_Domain::ICS-Trap-Normalization::DomainName

For a standard Trap Adapter deployment, the value is typically "Trap Processor".

Implementation Steps

Create the target directory (if it does not exist)
On the OI server, create the following directory: [By default this directory is available]
```
mkdir -p $SM_HOME/local/rules/icoi
```
The typical full path is <SAM_BASE>/smarts/local/rules/icoi/. Files placed here take precedence over the default installation, so the original product file is not modified.
Download and place the modified ASL file
Download the attached icoi-init.asl from this KB article and copy it to the directory created in $SM_HOME/local/rules/icoi/icoi-init.asl
Configure the variable
Open the copied file and locate the following line near the top:
```
default ClearSourcesOnRestart = "";
```
Set it to the DomainName of the trap-based source identified in the Prerequisites step.
Example:
```
default ClearSourcesOnRestart = "Trap Processor";
```
Note: For multiple sources, use a comma-separated list with no spaces:
Example:
```
default ClearSourcesOnRestart = "Trap Processor,MyOtherTrapSource";
```
This is the only line in the file that needs to be edited. No other modifications are required.

Restart the domain manager

sm_service stop <OI_SERVICE>
sm_service start <OI_SERVICE>

Post restart, All the notifications from the specified source under variable "ClearSourcesOnRestart" will have the EventState as "INACTIVE", verify it as:

dmctl -s <OI> get ICS_Notification::<NotificationName>::EventState
Example:
dmctl -s INCHARGE-OI get ICS_Notification::<NotificationName>::EventState

Notes

The ClearSourcesOnRestart value is case-sensitive and must exactly match the DomainName attribute of the source domain.
Multiple sources are comma-separated with no surrounding spaces: "Source1,Source2".
The default empty string preserves all standard WAS_ACTIVE behavior — this change is fully opt-in and backward compatible.
This file is placed in local/rules/icoi/ which takes priority over the standard installation path via SM_SITEMOD resolution. The original product file under $SM_HOME/rules/icoi/ is never modified.

Additional Information

Rollback

Remove the placed file from $SM_HOME/local/rules/icoi/ and restart the domain manager. The server will revert to the original product file with no changes:

rm $SM_HOME/local/rules/icoi/icoi-init.asl
sm_service stop <OI_SERVICE>
sm_service start <OI_SERVICE>

Attachments

icoi-init.asl get_app