IBM Support

IV22560: ANALYZE EVENT MAPPING TOOL FAILS AND HAMMERS CPU

Direct links to fixes

6.1.0-TIV-BSM-FP0004-zlinux
6.1.0-TIV-BSM-FP0004-windows
6.1.0-TIV-BSM-FP0004-solaris
6.1.0-TIV-BSM-FP0004-linux
6.1.0-TIV-BSM-FP0004-aix
6.1.1-TIV-BSM-FP0004-windows
6.1.1-TIV-BSM-FP0004-zlinux
6.1.1-TIV-BSM-FP0004-solaris
6.1.1-TIV-BSM-FP0004-linux
6.1.1-TIV-BSM-FP0004-aix
6.1.1-TIV-NCI-FP0004-windows
6.1.1-TIV-NCI-FP0004-zlinux
6.1.1-TIV-NCI-FP0004-solaris
6.1.1-TIV-NCI-FP0004-aix
6.1.1-TIV-NCI-FP0004-linux
6.1.0-TIV-BSM-FP0003-solaris
6.1.0-TIV-BSM-FP0003-aix
6.1.0-TIV-BSM-FP0003-zlinux
6.1.0-TIV-BSM-FP0003-windows
6.1.0-TIV-BSM-FP0003-linux
5.1.1-TIV-NCI-FP0003-Linux
5.1.1-TIV-NCI-FP0003-HPUX
5.1.1-TIV-NCI-FP0003-win
5.1.1-TIV-NCI-FP0003-Solaris
5.1.1-TIV-NCI-FP0003-Linuxs390
5.1.1-TIV-NCI-FP0003-aix
6.1.1-TIV-BSM-FP0003-aix
6.1.1-TIV-NCI-FP0003-zlinux
6.1.1-TIV-NCI-FP0003-windows
6.1.1-TIV-NCI-FP0003-solaris
6.1.1-TIV-NCI-FP0003-linux
6.1.1-TIV-NCI-FP0003-aix
6.1.1-TIV-BSM-FP0003-zlinux
6.1.1-TIV-BSM-FP0003-windows
6.1.1-TIV-BSM-FP0003-solaris
6.1.1-TIV-BSM-FP0003-linux
6.1.1-TIV-BSM-FP0002-windows
6.1.1-TIV-BSM-FP0002-zlinux
6.1.1-TIV-BSM-FP0002-solaris
6.1.1-TIV-BSM-FP0002-aix
6.1.1-TIV-BSM-FP0002-linux
6.1.1-TIV-NCI-FP0002_zlinux
6.1.1-TIV-NCI-FP0002_windows
6.1.1-TIV-NCI-FP0002_solaris
6.1.1-TIV-NCI-FP0002_linux
6.1.1-TIV-NCI-FP0002_aix
IBM Tivoli Netcool/Impact V5.1.1 Fix Pack 2 (5.1.1-TIV-NCI-FP0002)
IBM Tivoli Business Service Manager V6.1.1 Fix Pack 1(6.1.1-TIV-BSM-FP0001)
IBM Tivoli Business Service Manager V6.1.0 Fix Pack 2(6.1.0-TIV-BSM-FP0002)
IBM Tivoli Netcool/Impact V6.1.0 Fix Pack 2(6.1.0-TIV-NCI-FP0002)
IBM Tivoli Netcool/Impact V6.1.1 Fix Pack 2 (6.1.1-TIV-NCI-FP0002)
IBM Tivoli Business Service Manager V6.1.1 Fix Pack 3(6.1.1-TIV-BSM-FP0003)
IBM Tivoli Netcool/Impact V6.1.1 Fix Pack 3 (6.1.1-TIV-NCI-FP0003)
IBM Tivoli Netcool/Impact V5.1.1 Fix Pack 3 (5.1.1-TIV-NCI-FP0003)
IBM Tivoli Netcool/Impact V6.1.1 Fix Pack 4 (6.1.1-TIV-NCI-FP0004)
IBM Tivoli Business Service Manager V6.1.1 Fix Pack 4(6.1.1-TIV-BSM-FP0004)
IBM Tivoli Netcool/Impact V6.1.0 Fix Pack 4(6.1.0-TIV-NCI-FP0004)
IBM Tivoli Business Service Manager V6.1.0 Fix Pack 4(6.1.0-TIV-BSM-FP0004)
IBM Tivoli Netcool/Impact V6.1.0 Fix Pack 4(6.1.0-TIV-NCI-FP0004)
IBM Tivoli Netcool/Impact V6.1.1 Fix Pack 5 (6.1.1-TIV-NCI-FP0005)
IBM Tivoli Business Service Manager V6.1.1 Fix Pack 5(6.1.1-TIV-BSM-FP0005)

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • A large and fairly complex set of Filters in an EventReader
    causes the Analyze Event Mapping tool to fail and hits CPU so
    much that the only way out is to kill -9 [PID] the Impact
    instance and restart.
    
    A test against default ObjectServer fields:
    
    impact.pmr_25128_eventreader.restriction.1=(Agent \= 'Alpha')
    and Grade\=1 and ServiceID\!\=''
    impact.pmr_25128_eventreader.restriction.2=Grade\=0 and
    Agent\!\='Beta' and Agent\!\='Gamma'
    impact.pmr_25128_eventreader.restriction.3=((Node LIKE 'Mike')
    or (Node LIKE 'George') ) and Poll\=0
    impact.pmr_25128_eventreader.restriction.4=Acknowledged\=0 and
    Agent \='Delta' and (Summary LIKE 'Hello world' or Summary LIKE
    'Tahdah')
    impact.pmr_25128_eventreader.restriction.5=Agent\='Epsilon'
    and Acknowledged\=0 and AlertKey LIKE 'A.*B.*C'
    impact.pmr_25128_eventreader.restriction.6=Acknowledged\=0 and
    Type\=1 and ((Agent\='Gamma' and (Summary LIKE
    'device failed' or Summary LIKE 'agent failed')) or
    (Agent\='Delta' and Summary LIKE 'Link Down' ))
    impact.pmr_25128_eventreader.restriction.7=Acknowledged\=0 and
    Agent\='Beta' and Type\=1 and Summary LIKE 'fault'
    impact.pmr_25128_eventreader.restriction.8=Acknowledged\=0 and
    Agent \='Alpha' and Type\=1 and (Summary LIKE 'reset'
    or Summary LIKE 'failure')
    impact.pmr_25128_eventreader.restriction.9=OwnerUID\=0 and (Node
    LIKE 'Peter')
    impact.pmr_25128_eventreader.restriction.10=Severity>3 and
    Flash\=0 and (Agent\='Epsilon' OR Node LIKE 'Ted' OR
    NodeAlias LIKE 'Fred' OR Agent\='Gamma' OR
    Agent\='Pi')
    impact.pmr_25128_eventreader.restriction.11=OwnerGID \= 1
    impact.pmr_25128_eventreader.restriction.12=Class \= 3300 and
    Type \= 1 and Grade \= 0 and Agent \= 'Pi'
    and NodeAlias \= '127.0.0.1' and AlertGroup \=
    'MyBestFriend' and AlertKey LIKE 'Apple' and Summary LIKE
    'Help'
    impact.pmr_25128_eventreader.restriction.13=Agent \= 'Zeta'
    AND Summary LIKE 'Link Down' AND Acknowledged\=5
    
    Produced this result.
    

Local fix

  • Avoid using the Analyze Event Mapping tool.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * All Impact Users                                             *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * A large and fairly complex set of Filters in an EventReader  *
    *                                                              *
    * causes the Analyze Event Mapping tool to fail and hits CPU   *
    * so                                                           *
    * much that the only way out is to kill -9 [PID] the Impact    *
    *                                                              *
    * instance and restart.                                        *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * NONE                                                         *
    ****************************************************************
    

Problem conclusion

  • Add a param "analyzer.bypass" to bypass PMAC invoking if there
    is a complex filter.
    When analyzer.bypass is true and filters number is big then 10,
    Filter analyzer will list filters directly
    
    other then call PMAC and list both filters and intersections.
    
    The fix for this APAR is contained in the following
    maintenance packages:
    | Fix Pack | 5.1.1-TIV-NCI-FP0002
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV22560

  • Reported component name

    NC/IMPACT EVENT

  • Reported component ID

    5724O59ER

  • Reported release

    511

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2012-06-08

  • Closed date

    2012-12-17

  • Last modified date

    2012-12-17

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • UNKNOWN
    

Fix information

  • Fixed component name

    NC/IMPACT EVENT

  • Fixed component ID

    5724O59ER

Applicable component levels

  • R511 PSY

       UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSSHYH","label":"Tivoli Netcool\/Impact"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"511","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
17 December 2012