IBM Support

Oracle Extended agent is alerting on old message in the alert log.

Troubleshooting


Problem

ITCAM for Extended Oracle Agent sends events for old alert log messages.

Symptom

Duplicate alerts are received for old alert log messages, for which alerts were previously received.

For example, you may have a situation with following formula:


KRZRDBLOGD.SEVERITY == Error

The situation may cause alerts for older messages in Oracle instance alert log, for those messages, you have already received situation alerts in the past.


 

Cause

ITCAM Extended agent for Oracle, client process (krzclient) was restarted, either when agent was restarted, or because it was restarted after having crashed for some reason. The restart of agent is causing the alert log to be re-processed, and generate alerts for older messages.

Diagnosing The Problem

Check krzclient log and krzagent logs for start time.
<host>_rz_<inst>_krzstart_<hex>-01.log
Start Date: 2014/06/16
Start Time: 12:55:13

<host>_rz_<inst>_krzclient_<hex>-01.log
Start Date: 2014/06/16
Start Time: 12:55:13

If the alert on an older message (in alert log) was received on the date and time when the monitoring agent, or the krzclient process was started, then the resolution of this technote will apply.

Resolving The Problem

ITCAM Extended agent for Oracle provides an environment variable KRZ_LOG_NOREPEAT, which controls processing of alert log entries during agent startup.

By default KRZ_LOG_NOREPEAT is set to 'FALSE', the agent sends alerts for message entries found in the alert log, irrespective of whether those were already found in the last running of the agent. To prevent duplicate events from being sent during restart of agent process, set this variable to 'TRUE'.

Edit the install_dir/config/rz_<instance>.config file to make following change:

Change:
KRZ_LOG_NOREPEAT='FALSE'
to:
KRZ_LOG_NOREPEAT='TRUE'

When this setting is 'TRUE', the agent does not resend alert log message entries, already processed in the last running of the monitoring agent, thus preventing duplicate alert for the older message in the alert log.

Make the same change in install_dir/config/rz.ini, so that new instance configuration will inherit this setting.

[{"Product":{"code":"SS3JRN","label":"Tivoli Composite Application Manager for Applications"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"ITCAM Extended Agent for Oracle Database 5724V09OR v6.3","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"7.2.0;7.2;7.1.0;7.1;6.3.1;6.3","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
17 June 2018

UID

swg21678229

Page Feedback