Troubleshooting
Problem
All SelfMonitoring Service problem (Service stopped) events are cleared by GenericClear if any single resolution (Service started) event is created
Symptom
A Service is stopped and a SelfMonitoring (problem) event is sent to the ObjectServer.
Another Service is stopped and that too creates a SelfMonitoring (problem) event in the ObjectServer.
The second Service is then restarted and SelfMonitoring sends a resolution (Service started) events to the ObjectServer and this results in BOTH Service stopped events being set to Severity 0.
Cause
SelfMonitoring Service events do not include any details of the Service in question in the fields used by the GenericClear Automation in the ObjectServer to uniquely identify and correlate Problem and Resolution events - so any single SelfMonitoring Service Resolution event will correlate with ALL SelfMonitoring Service Problem events and set the Severity to 0 for the DeleteClears Automation to mop up.
Diagnosing The Problem
SelfMonitoring Service events for known stopped Services are vanishing when they shouldn't.
Resolving The Problem
The easy solution at this time is to upgrade to Fix Pack 1 or higher. One could go to the extremes of creating a PolicyActivator, polling at a higher rate than the GenericClear Automation, to run a Policy to pick-up these events, pull out the Service name from the Summary field and append it to the Agent field of the events so that the GenericClear Automation can uniquely identify and correlate Problem and Resolution events.
This problem is recorded by APAR IV13297 "ALERTKEY VALUE FOR SELFMONITORING (SERVICE) EVENTS DOES NOT INCLUDE SERVICE DETAILS, SO GENERICCLEAR CLEARS ALL SUCH EVENTS." [link below] and is fixed in IBM Tivoli Netcool/Impact V6.1.0 Fix Pack 1 (6.1.0-TIV-NCI-FP0001) [link below] and above.
Related Information
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21579319