Troubleshooting infrastructure events

This section lists how to troubleshoot issues related to infrastructure events.

Events are not cleaned up in the Presentation Server

Issue

If you use the pw event delete all –cleanup command to clean up events in the Infrastructure Management server, the same events still show up in the Presentation Server.

Resolution

Run the following command from the InstalledDirectory\truesightpserver\bin folder to clean up events in the Presentation Server:

tssh event delete all <Infrastructure Management server name>

Infrastructure Management events are pruned early

The events pruning time set in the TrueSight Presentation Server affects all the Infrastructure Management Servers registered to it.

The default pruning time is 24 hours for both the Presentation Server and Infrastructure Management Servers.

If you change the pruning time in any of the Infrastructure Management Servers, you need to set the Presentation Server pruning time to the highest pruning value across the Infrastructure Management Servers.

From the command-line interface, change the value of the EVENTS_PRUNING_PERIOD configuration entry:

tssh properties set EVENTS_PRUNING_PERIOD <value>
tssh properties reload

The event count between the Presentation Server and the Infrastructure Management Server do not match

Issue

The number of events displayed in the TrueSight console and the Infrastructure Management do not match.

Causes

• In case your environment has a large event flow and the mcell.conf at the Infrastructure Management Server has a lower setting for EventDBSize (default is 360000), older events get pruned automatically irrespective of Severity or Status.
• The Infrastructure Management JServer retains pruned events for more than 20 minutes after events are pruned in the cell.
• The Presentation Server has a self-pruning period (EVENTS_PRUNING_PERIOD) to prune events.

Resolution

Events are pruned at the Presentation Server as follows:

• Closed events are pruned based on the MC_CELL_DB_CLEANUP events arrival. Closed events older than 24 hours are pruned during this time.

  From the command-line interface, execute the following command to change the events pruning interval: 

  tssh properties set EVENTS_PRUNING_PERIOD <value in minutes>

• In the absence of MC_CELL_DB_CLEANUP events, the Presentation Server prunes closed events every 24 hours.

  Use the tssh properties set command to increase or decrease the time interval.

• Open events are pruned if there are no updates to the event for more than 30 days.
  From the command-line interface, execute the following command to change the open events pruning interval:

  tssh properties set openEventsPruningPeriod <value in minutes>

Users cannot perform event operations after cross-launching to BMC TrueSight Infrastructure Management

Users belonging to non out-of-the-box user groups might not be able to perform event operations after cross-launching to BMC TrueSight Infrastructure Management. Event operations for the same event are possible in the TrueSight console.

On the BMC TrueSight Infrastructure Management Server that you are cross-launching to, add the user group to the .mrl file. For more information, see Adding user groups to the .mrl file.

PATROL Agent and the Infrastructure Management server updates the mc_host_class with different values

When an event is generated, PATROL Agent and the Infrastructure Management server updates the mc_host_class differently. PATROL Agent updates mc_host_class with the operating system name and version details. The Infrastructure Management server updates mc_host_class with the device type details.

Resolution

Using a text editor, open the pronet.conf file located in the pw/custom/conf directory and the update the following property as explained in the following section:

• pronet.jserver.cell.showOSInformation: If you set this value to True, the mc_host_class will be updated with the operating system name and version details.

• pronet.jserver.cell.showOSInformation: If you set this value to False, the mc_host_class will be updated with the device type details.

Infrastructure Management server stops populating groups slot when an intelligent event (abnormality/alarm) is created.

When an intelligent event (abnormality/alarm) is created, the Infrastructure Management server stops populating pn_group_id slot. This slot is disabled by default.

Resolution:

Using a text editor, open the pronet.conf file located in the pw/custom/conf directory location and add the following parameters and save the file:

• pronet.tsim.rate.group.data.fetch.optimized=true
• pronet.tsim.rate.event.fill.group.slots=true

The events count and events built-in filters count displayed in the TrueSight console do not match

There may be a mismatch between the events count and the built-in filters count displayed in the TrueSight console.

Workaround

Log in to the host computer running the Presentation Server and run the tssh event reinitialize command. For details about how to run this command, see  Reinitializing events in the Presentation Server .  Depending on the size of the events data, the event reinitialize operation may take some time to complete. You may have to wait for a few minutes to view the latest events data on the TrueSight console.

No event details are displayed when clicking on event details

When clicking on event details, no event details are displayed or the following error message is displayed:

You do not have access to this page or the requested event details is not available to view

The class definitions in the cell Knowledge Base (KB) must be identical across all the Infrastructure Management servers connected with the Presentation Server. 

Also, to see events in the TrueSight console for any remote cells including those cells for Integration Service(s), the remote cells must have all their class definitions present on all Infrastructure Management servers.

Resolution:

1. Compare the cell KB class definitions across all Infrastructure Management servers and remote cells including Integration Service cells.
2. Add the missing classes on the new Infrastructure Management server and ensure all cell KBs contain all of the same class definitions.
3. Use the mccomp command to compile the KB for any cell where the class definitions are added.
4. Restart the Infrastructure Management server or remote cell where the KB is updated and compiled.
5. Log in to the host computer running the Presentation Server and run the tssh event reinitialize command. For details about how to run this command, see  Reinitializing events in the Presentation Server

PwTray related events are displayed in the TrueSight console after upgrading TrueSight Infrastructure Management

Issue

After upgrading Infrastructure Management to version 11.3.04 on Windows, the alarm events related to pwtray.exe not running are displayed on the Events page in the TrueSight console.

Cause

The PwTray system tray icon is removed in Infrastructure Management 11.3.04. However, the monitor instances and existing events for the PwTray process are not removed during the upgrade process. Hence, an availability event for the PwTray process is generated.

Resolution

To clean up the PwTray related events, perform the following steps after upgrading TrueSight Infrastructure Management:

1. On the Events page, click the three dots menu  and select Close Event for the specific PwTray related event to close the event in the TrueSight console. 

2. Clean up the PwTray monitor instances from the TrueSight Infrastructure Management Administrator console. For a TrueSight Infrastructure Management high-availability setup, ensure to clean up the PwTray monitor instances from both the primary and secondary server. For more information about using the administrator console, see Using the administrator console.

Locking of large amounts of TX on third party events

Issue

A large amount of TX LOCK happens on third party events.

Resolution

Increase the update-time interval.

To increase the update-time interval:

1. Navigate to  pw\custom\conf\pronet.conf location.
2. Open the pronet.conf file and add the following parameter at the end of the file (value in minutes):
   pronet.jserver.licensereport.eventsync.sleep.minutes= 1440
3. Save the pronet.conf file and restart the TrueSight Infrastructure Management Server.

Related topics

Troubleshooting

Troubleshooting the deployment of TrueSight Operations Management components

Registering the components with the Presentation Server