Troubleshooting infrastructure events
This section lists how to troubleshoot issues related to infrastructure events.
Events are not cleaned up in the Presentation Server
If you use the
pw event delete all –cleanup command to clean up events in the Infrastructure Management server, the same events still show up in the Presentation Server.
Run the following command from the InstalledDirectory\truesightpserver\bin folder to clean up events in the Presentation Server:
tssh event delete all <Infrastructure Management server name>
Infrastructure Management events are pruned early
The events pruning time set in the TrueSight Presentation Server affects all the Infrastructure Management Servers registered to it.
The default pruning time is 24 hours for both the Presentation Server and Infrastructure Management Servers.
If you change the pruning time in any of the Infrastructure Management Servers, you need to set the Presentation Server pruning time to the highest pruning value across the Infrastructure Management Servers.
From the command-line interface, change the value of the EVENTS_PRUNING_PERIOD configuration entry:
tssh properties set EVENTS_PRUNING_PERIOD <value>
tssh properties reload
The event count between the Presentation Server and the Infrastructure Management Server do not match
The number of events displayed in the TrueSight console and the Infrastructure Management operator console do not match.
- In case your environment has a large event flow and the mcell.conf at the Infrastructure Management Server has a lower setting for
EventDBSize(default is 360000), older events get pruned automatically irrespective of Severity or Status. You are able to view events in the TrueSight console that you cannot view in the Infrastructure Management operator console. You cannot perform any actions on these events.
- The Infrastructure Management JServer retains pruned events for more than 20 minutes after events are pruned in the cell.
- The Presentation Server has a self-pruning period (EVENTS_PRUNING_PERIOD) to prune events.
Events are pruned at the Presentation Server as follows:
Closed events are pruned based on the MC_CELL_DB_CLEANUP events arrival. Closed events older than 24 hours are pruned during this time.
From the command-line interface, execute the following command to change the events pruning interval:
tssh properties set EVENTS_PRUNING_PERIOD <value in minutes>
In the absence of MC_CELL_DB_CLEANUP events, the Presentation Server prunes closed events every 24 hours.
tssh properties setcommand to increase or decrease the time interval.
Open events are pruned if there are no updates to the event for more than 30 days.
From the command-line interface, execute the following command to change the open events pruning interval:
tssh properties set openEventsPruningPeriod <value in minutes>
Users cannot perform event operations after cross-launching to BMC TrueSight Infrastructure Management
Users belonging to non out-of-the-box user groups might not be able to perform event operations after cross-launching to BMC TrueSight Infrastructure Management. Event operations for the same event are possible in the TrueSight console.
On the BMC TrueSight Infrastructure Management Server that you are cross-launching to, add the user group to the .mrl file. For more information, see Adding user groups to the .mrl file.
PATROL Agent and the Infrastructure Management server updates the mc_host_class with different values
When an event is generated, PATROL Agent and the Infrastructure Management server updates the mc_host_class differently. PATROL Agent updates mc_host_class with the operating system name and version details. The Infrastructure Management server updates mc_host_class with the device type details.
Using a text editor, open the pronet.conf file located in the pw/custom/conf directory and the update the following property as explained in the following section:
pronet.jserver.cell.showOSInformation: If you set this value to True, the mc_host_class will be updated with the operating system name and version details.
- pronet.jserver.cell.showOSInformation: If you set this value to False, the mc_host_class will be updated with the device type details.
Infrastructure Management server stops populating groups slot when an intelligent event (abnormality/alarm) is created.
When an intelligent event (abnormality/alarm) is created, the Infrastructure Management server stops populating pn_group_id slot. This slot is disabled by default.
Using a text editor, open the pronet.conf file located in the pw/custom/conf directory location and add the following parameters and save the file:
The events count and events built-in filters count displayed in the TrueSight console do not match
There may be a mismatch between the events count and the built-in filters count displayed in the TrueSight console.
Log in to the host computer running the Presentation Server and run the
tssh event reinitialize command. For details about how to run this command, see
. Depending on the size of the events data, the event reinitialize operation may take some time to complete. You may have to wait for a few minutes to view the latest events data on the TrueSight console.
Custom class events not displayed after connecting a new Infrastructure Management server
When you connect a new Infrastructure Management server with default event classes to a Presentation Server with other Infrastructure Management servers containing custom event classes, custom events are not displayed on the TrueSight console.
- Add the missing classes on the new Infrastructure Management server.
- Compile the KB using the mccomp command.
- Restart the Infrastructure Management server.