This topic lists common issues, probable causes, and suggestions for troubleshooting the BMC TrueSight IT Data Analytics (IT Data Analytics) product.
|Category||Scenario||Probable causes with solutions (if any)|
|Accessing the product||Unable to access the product from the Start menu|
You might not be able to start the product, if:
|About saved searches||Unable to edit a saved search (or data pattern)|
You cannot edit the following items:
Solution: If you want to edit an object (saved searches or data patterns) that was initially imported by using a content pack, you can clone the object and then modify it per your requirements.
|System is slow||The Collection Station went down, and the IT Data Analytics server was restarted, the system became very slow|
When you restart the IT Data Analytics server, all of the data collectors try to catch up and send the old pending data into the Collection Station for indexing.
Based on the number of data collectors, this process can take some time (a few minutes to a few hours) to complete.
|System is slow||The Indexer remained down for two days over the weekend, and after IT Data Analytics server was restarted, the system became very slow|
This issue can occur if the Collection Station cached a lot of data over the weekend. When you restart the IT Data Analytics server, the Collection Station pushes all cached data together into the Indexer.
|Product component shows red||Some of the Collection Agents are showing up as red on the Administration > Hosts page and do not change to green, even though all of the servers are running.|
This issue might occur if the Collection Station remains down at the time at which the Collection Agents start.
Solution: Restart the Collection Agents after the Collection Station is up and running.
|Product component shows red||The Configuration Database and Indexer are showing as green on the Administration > Components page, but some of the other components are down (on the Linux operating system).|
The components might not have been started in the recommended order.
|About data collection|
The Collection Station on a Windows computer is not starting or working properly after the time it stopped abruptly and you see the following exceptions in the collection.log.
This issue is rare and might occur when the Collection Station stops abruptly, which can happen if the %BMC_ITDA_HOME%\station\collection\data\c*\flume-checkpoint(1)\checkpoint file becomes corrupted.
You can find the exact name of the corrupted checkpoint file in the collection.log file located at %BMC_ITDA_HOME%\station\collection\logs. In this file, you can search for the line containing the
|About searching||Data entry time on the Search tab is ahead of the time at which the notification was generated|
By default, there is a delay of 90 seconds between data collection and reporting of search results to the product. Therefore, during notification creation, when you select one of the search duration options and apply a condition related to the number of results, you can expect a delay of 90 seconds.
Solution: You can change the 90 seconds time lag by modifying the value of the
|About data collection||Data collector has been created, but the results cannot be seen|
After the data collector is created, it might take some time (approximately 1 minute) for the first poll to happen. The first poll is used to make the data collector ready for data collection. The data is fetched only from the second poll.
Expected time delay (to see the first set of data for a search) = (Time for first poll) + (Poll interval set for the data collector)
|About searching||Data is being generated in the files for monitoring, but no data can be seen when performing a search|
This issue might occur if the time zone specified during data-collector creation is set incorrectly.
Solution: Ensure that the time zone is set correctly when you create data collectors.
|Product component shows red||Status of the Collection Station appears red on the Administration > Components tab.|
This issue might occur in two scenarios:
|Product component shows red||Status of the Search component appears red on the Administration > Components tab.||The host name specified while registering the self-signed certificate does not match the host name of the computer where the Search component is installed. You can find the correct host name by navigating to the %BMC_ITDA_HOME%\logs\itda.log and search for the following line:|
You see the following error on the product user interface:
This can happen if the Configuration Database service is down.
Solution: Perform the following steps:
|About data collection||Some data got lost when the Collection Station (or Collection Agent) went down briefly||By default, the number of days for which data must be collected and indexed (Read from Past (#days) function) is set to zero. As a result, in the process of data collection, if the Collection Station (or Collection Agent) goes down, you can experience data loss. When the Collection Station (or Collection Agent) is up again, it starts collecting data from that point onwards and the time for which it remained down is ignored. You can change the Read from Past (#days) default value for the Monitor Windows events and Monitor using external configuration data collectors.|