This topic lists common issues, probable causes, and suggestions for troubleshooting the BMC TrueSight IT Data Analytics (IT Data Analytics) product.
To locate an issue, use one of the following options:
|Category||Scenario||Probable causes with solutions (if any)|
|Accessing the product||Unable to access the product from the Start menu|
You might not be able to start the product, if:
|Saved searches||Unable to edit a saved search (or data pattern)|
You cannot edit the following items:
Solution: If you want to edit an object (saved searches or data patterns) that was initially imported by using a content pack, you can clone the object and then modify it per your requirements.
|System response time||The Collection Station went down, and the IT Data Analytics server was restarted, the system became very slow|
When you restart the IT Data Analytics server, all of the data collectors try to catch up and send the old pending data into the Collection Station for indexing.
Based on the number of data collectors, this process can take some time (a few minutes to a few hours) to complete.
|System response time||The Indexer remained down for two days over the weekend, and after IT Data Analytics server was restarted, the system became very slow|
This issue can occur if the Collection Station cached a lot of data over the weekend. When you restart the IT Data Analytics server, the Collection Station pushes all cached data together into the Indexer.
|Product component shows red||Some of the Collection Agents are showing up as red on the Administration > Hosts page and do not change to green, even though all of the servers are running.|
This issue might occur if the Collection Station remains down at the time at which the Collection Agents start.
Solution: Restart the Collection Agents after the Collection Station is up and running.
|Product component shows red||The Configuration Database and Indexer are showing as green on the Administration > Components page, but some of the other components are down (on the Linux operating system).|
The components might not have been started in the recommended order.
Unable to search for indexed data.
This can happen in two scenarios:
The Collection Station on a Windows computer is not starting or working properly after the time it stopped abruptly and you see the following exceptions in the collection.log.
This issue is rare and might occur when the Collection Station stops abruptly, which can happen if the %BMC_ITDA_HOME%\station\collection\data\c*\flume-checkpoint(1)\checkpoint file becomes corrupted.
You can find the exact name of the corrupted checkpoint file in the collection.log file located at %BMC_ITDA_HOME%\station\collection\logs. In this file, you can search for the line containing the
|Search||Data entry time on the Search tab is ahead of the time at which the notification was generated|
By default, there is a delay of 90 seconds between data collection and reporting of search results to the product. Therefore, during notification creation, when you select one of the search duration options and apply a condition related to the number of results, you can expect a delay of 90 seconds.
Solution: You can change the 90 seconds time lag by modifying the value of one of the following properties available in the searchserviceCustomConfig.properties file. For more information, see.
|Data collection||Data collector has been created, but the results cannot be seen|
After the data collector is created, it might take some time (approximately 1 minute) for the first poll to happen. The first poll is used to make the data collector ready for data collection. The data is fetched only from the second poll.
Expected time delay (to see the first set of data for a search) = (Time for first poll) + (Poll interval set for the data collector)
|Search||Data is being generated in the files for monitoring, but no data can be seen when performing a search|
This issue might occur if the time zone specified during data-collector creation is set incorrectly.
Solution: Ensure that the time zone is set correctly when you create data collectors.
|Product component shows red||Status of the Collection Station appears red on the Administration > Components tab.|
This issue might occur in two scenarios:
|Product component shows red||Status of the Search component appears red on the Administration > Components tab.||The host name specified while registering the self-signed certificate does not match the host name of the computer where the Search component is installed. You can find the correct host name by navigating to the %BMC_ITDA_HOME%\logs\itda.log and search for the following line:|
You see the following error on the product user interface:
This can happen if the Configuration Database service is down.
Solution: Perform the following steps:
|Data collection||Some data got lost when the Collection Station (or Collection Agent) went down briefly||By default, the number of days for which data must be collected and indexed (Read from Past (#days) function) is set to zero. As a result, in the process of data collection, if the Collection Station (or Collection Agent) goes down, you can experience data loss. When the Collection Station (or Collection Agent) is up again, it starts collecting data from that point onwards and the time for which it remained down is ignored. You can change the Read from Past (#days) default value for the Monitor Windows events and Monitor using external configuration data collectors.|
The polling status for the following data collectors shows red (unsuccessful polling).
You see the
This issue might occur in the following scenarios:
This issue occurs because the number of concurrent SSH connections allowed to the target host is lesser than the the number of data collectors that you want to create. The number of concurrent SSH connections determine the number of data collectors that you can create for collecting data from the same target host.
Solution: Navigate to the /etc/ssh/sshd_config directory and increase the value of the MaxSessions parameter. This solution is only applicable for OpenSSH version 5.1 and later.
At the time of creating a data collector, when you try to filter the relevant data patterns, you might see the following error:
This issue might occur if the system response time of the server on which you are trying to create the data collector is slow.
Solution: Edit the olaengineCustomConfig.properties file located at %BMC_ITDA_HOME%\custom\conf\server\ and then add the
This property determines the duration of time (in seconds) for which the Console Server waits to receive a response from the Collection Station.
|Saved searches||Unable to use a saved search shared by another user to create dashboards or notifications.|
You cannot use saved searches shared by other users for creating dashboards or notifications.
Solution: Clone the saved search and then use the cloned instance to create dashboards or notifications. For more information, see Managing saved searches
Unable to see the updated UI available for the upgraded version of the product.
To find out if you are still accessing the older UI, navigate to Administration > Components and check if you can see the Version column that is available in the new version of the product.
This might occur if the browser where you are accessing the product continues to access the cached content.
Solution: Press Ctrl+F5 to reload the browser page while ignoring the cached content. If reloading the browser page does not work, then append ?version=1_1 to the browser URL, before the hash sign (#) as follows:
You are experiencing some data loss and you see the following error in the collection.log file located at %BMC_ITDA_HOME%\station\collection\logs.
Even when all the Indexers in your environment are up and functioning normally, this error might occur due to various reasons. For example, a poor network connection or the system on which the Indexers (or the Collection Station) reside have become slow.
Workaround: Increase the value of the
Some data collected by the Receive over TCP/UDP data collected is not getting indexed and occasionally you find the following message in the collection.log file.
This might occur when the rate at which the sender sends data via the TCP port is greater than the rate at which the Receive over TCP/UDP data collector indexes data. This indicates that the data collector is dropping records and needs to be tuned.
Solution: To allow for indexing higher volumes of data per day on a single data collector, you must add the following properties with appropriate values in the agent.properties file. For more information, see Modifying the configuration files.
Note that the following property values were used for indexing up to 100 GB of data in the lab environment.
|Accessing the product, Cross-launch|
Unable to access the product after cross-launching from BMC ProactiveNet.
This might occur if the product URL uses the internal host name of the Console Server. This can happen if the Console Server is installed on a computer which uses both an external host name and internal host name, and the internal host name is sent to BMC ProactiveNet for cross-launch.
Solution: Edit the olaengineCustomConfig.properties file, locate and uncomment the
While searching for data, you see the following error:
This might occur if the number of results returned for the search string is too large. This might happen if the search string specified is too complex or the time range specified is too large, or both.
Solution: Reduce the time range for which you are searching data or provide specific search strings that are likely to occur in the data that you are searching.
While running the timechart command, you see the following error:
This can occur when there are too many data points or bars displayed in the chart.
Solution: Either reduce the time range or reduce the
|Integration||You are unable to search for applications while creating notifications.|
This can happen if IT Data Analytics is unable to connect with the Presentation Server. This can occur if the user name and password of the Presentation Server is changed.
Solution: Use the tspsuserdetails CLI command to update the new user name and password of the Presentation Server on IT Data Analytics.
|Integration||Even after deleting the IT Data Analytics component registration on BMC TrueSight Operations Management, the external configuration for BMC TrueSight Operations Management continues to show in IT Data Analytics on the Administration > Configurations page.|
This can happen in the following two scenarios:
This can happen in the following two scenarios:
Solution: Use the tspsdeleteprofile CLI command to delete the external configuration details of BMC TrueSight Operations Management on IT Data Analytics.
The polling status for the Monitor remote Windows events data collector shows red (unsuccessful polling).
While creating the Monitor remote Windows events data collector, if you provide all the necessary inputs, and click Test Connection next to the Domain field, you see the following error:
This can happen in the following two scenarios:
Solution: Provide the correct host name so that the target host is communicable. To do so, you can perform one of the following steps:
The search times out.
The search results are displayed. But, after you export them, the output file does not contain data.
The search times out and if you export the search results, the output file does not contain data.
This issue can occur if the search query is too complex or if you are searching over a large time duration.
Workarounds: Perform one of the following actions:
For the Monitor remote Windows events data collector: You get the following error message in the Collection Status History page:
This issue can occur if the data collector has a large number of events in one poll.
Workaround: Add the following property in the agent.properties file that is located at %BMC_ITDA_HOME%\station\collection\custom\conf.
collection.reader.wbem.executor.query.time.slice: Specifies the time period (in minutes) in which the events must be fetched in a batch within a poll.
|Upgrade, Accessing the product||After completing the upgrade, users are not able to access the product.|
This issue might occur due to the change in handling user authentication in version 2.1.00 of the product. For more information, see Performing the upgrade.
Solution: Proceed in one of the following ways:
To help you identify whether the users were successfully migrated and correctly associated with the roles and user groups during the upgrade, the following files are generated at %BMC_ITDA_HOME%\userdetails.
The preceding files contain details about the same users. The two files are aimed at providing specific details about the mapping conflicts associated with user groups and roles.
For advanced troubleshooting, contact BMC Support.
|Accessing the product||After installing the product, you cannot log on to the product with the default admin credentials.|
This scenario might occur if you are using BMC Atrium Single Sign-On for user authentication and the default admin, or the default Administrators user group, or both are already present on Atrium Single Sign-On.
Solution: In this scenario, a new user itdaadmin is automatically created. As an Administrator, you can use the following default credentials to log on to IT Data Analytics.
|Data collection, Search|
While creating a data collector, the Auto-Detect option used for filtering data patterns and date formats does not display appropriate results.
Even after specifying the correct data pattern or date format while creating the data collector, the timestamp in not correctly extracted in the search results.
This scenario might occur if the data that you are trying to collect uses a character set encoding (file encoding) other than the defaultencoding.
Solution: While creating the data collector, ensure that the character set encoding (file encoding) is set to the correct value.
If you are unable to correctly determine this value, you can use the filtering option to find a list of relevant character set encodings matching your data. To apply the filter, navigate to Advanced Options > File Encoding and click Filter the relevant character set encodings.