IV59807: CHANGE LINUX_HIGH_ZOMBIES SITS TO AVOID COUNT FUNCTION
A fix is available
Closed as program error.
This is internal APAR associated to defect 209773: In large environments customers are used to disable the Linux agent Linux_High_Zombies and Linux_High_Zombie_2 situations. These situations use the COUNT function to count the number of processes in the Zombie state. Linux_High_Zombies IF VALUE Linux_Process.State EQ Zombie AND COUNT Linux_Process.State GT 20 Linux_High_Zombies_2 IF VALUE KLZ_Process.State EQ Zombie AND COUNT KLZ_Process.Parent_Process_ID GT 20 Because they use the COUNT group function, potentially hundreds of process rows are sent to the RTEMS for evaluation, causing high CPU , memory and network overhead in large environments.
Disable Linux_High_Zombies and Linux_High_Zombies_2 situations, or manually rewrite them as below: The Linux System Statistics attribute group has a Processes_Zombie_Count attribute that can be tested without requiring use of the COUNT function so that these situations definitions' can be rewritten as: Linux_High_Zombies IF VALUE Linux_System_Statistics.Processes_Zombie_Count GT 20 Linux_High_Zombies_2 IF VALUE KLZ_System_Statistics.Processes_Zombie_Count GT 20
Linux_High_Zombies and Linux_High_Zombie_2 situations may produce excessive workload on the server. Because of the usage of the COUNT function in the formulas of these two out-of-the-box situations their evaluation takes place on the Tivoli Enterprise Management Server (TEMS), instead that on the agent side, and this can cause overheads in CPU, memory and network especially in case of large environments. Linux_High_Zombies in particular is an autostarted situation and the above risks are present by default.
Predicates of these situations reworked to avoid the COUNT function. The fix for this APAR is contained in the following maintenance packages: | fix pack | 6.3.0-TIV-ITM-FP0003
Edit the situations to exploit the KLZ_System_Statistics.Processes_Zombie_Count attribute in place of the COUNT function.
Reported component name
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name
Fixed component ID
Applicable component levels