Spectrum AlarmNotifier does not print text in the field "Matched Text" from SystemEDGE Host

[Anon Anon]

Hello everyone

 

In CA Spectrum 10.1.2 and CA SystemEDGE agents 5.9 When a trap "watch logfile" is received and the text contains accents is shown in OneClick Console Events tab as the following image:

 

 

This is the text matched in log file:

 

Caused by: java.sql.BatchUpdateException: ORA-00001: restricción única (SIINTEGRA.AK_MUL_BITACORA_INTERFASE) violada

 

In the AlarmNotifier is shown as follows:

 

ProbableCause: MONITORED LOG MATCH TRAP RECEIVED

SYMPTOMS:

A string satisfying a matching rule was recently written to a monitored log file
.

PROBABLE CAUSES:

The agent sent a trap to SPECTRUM reporting the match.

RECOMMENDED ACTIONS:

1) See the event for details of the match.

EventMessage: - Device linuxdst of type Host_systemEDGE reported that a Log
MonitorMatch event has occurred. (event [0x01169af7])

Monitor Index: 1319

Matched Text: 

Monitored File: /var/log/esa/alarms.log ----- This is a test log

Monitor Description: Revisar excepci.n con base de datos  MF2 D1 Batch Procesos Masivos
Only displaying most recent of 9 event messages.

============================================================

 

Other case:

 

 

 

Other events without accents in the text are displayed correctly:

 

I have seen a related topic in the following link

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC592830.html 

 

Note: In my test environment with the same client settings and SetScript file the texts with accents are displayed.

 

I'd appreciate your help.

Attachment(s)

ALARMRC.alarmrc.zip   543 B 1 version

[Silvio Okamoto]

If in your test environment you have the same accented words, but the problem is not reproduced, then something is different in your client side.

Check the following:

- $SPECROOT/Notifier/.alarmrc file (SS machine)

- $SPECROOT/custom/Events/CsEvFormat/Event01169af7 file (OC machine, in case the event  code/message was customized)

- $SPECROOT/SG-Support/CsEvFormat/Event 01169af7 file (OC machine)

[Anon Anon]

Hi Silvio thanks

 

Already validate the events in the SS but not yet in the OC.

 

NOTE: This is a new implementation in Windows Server 2012 R2 and no changes have been made to the events.

 

Aattached the .alarmrc file.

 

Thanks you very much

Attachment(s)

ALARMRC.alarmrc.zip   543 B 1 version

[Silvio Okamoto]

Try putting the varbind variable between single quotes in the Event Message.

Matched Text: '{S 17}'

 

 

And don't forget to copy the $SPECROOT/custom/Events/CsEvFormat/Event01169af7 file from the OC host to the SS machine.

[Anon Anon]

Hi Silvio 

The change was made in the events 0x01169af7 and 0x01169af6

This is the result.

 

 

 

 

Thanks

[Silvio Okamoto]

Did you copy the Event_01169af7_en_US and Event_01169af6_en_US files to the SpectroSERVER machine?

[Anon Anon]

Hi Silvio

 

Yes 

[Silvio Okamoto]

Hi Manuel Garcia,

 

Are you sure the AlarmNotifier is picking up the correct Event01169af7_en_US file?

Edit it and change any text. Example: Matched Accented Text: '{S 17}'

[Anon Anon]

Hi Silvio

 

Yes in the SS and OC.

 

 

Regards

[Silvio Okamoto]

Hi Manuel Garcia,

 

Do you have this entry in the AlarmNotifier log?

Matched Accented Text:

[Anon Anon]

Hi Silvio 

 

Yes 

 

 

Regards

[Silvio Okamoto]

Hi Manuel Garcia,

 

If you modified the $SPECROOT/custom/Events/CsEvFormat/Event01169af7_en_US file (on the SpectroSERVER machine) and changed

from: Matched Text: {S 17}

to: Matched Accented Text: '{S 17}'

 

I would expect the following in the AlarmNotifier log file:

Matched Accented Text: 

[Anon Anon]

Hi Silvio

 

Sorry, I have not been able to do this test.

 

Otherwise, I think the problem is related to the utf8 encoding because the character (�)  is presented when there are accents in the words.

 

Why does a diamond with a questionmark in it appear in my HTML? - Stack Overflow 

 

Regards and thank you very much for your help.

[Silvio Okamoto]

Hi Manuel Garcia,

 

Let me know the result of my last suggestion once you have a chance to test it.

[Legacy User]

Hello Jose,

 

If you are facing issues with this still please log a case with support for further investigation.

 

Regards

 

Declan

[Anon Anon]

Hi Declan thanks

 

Currently I have the following case 00708247 - AlarmNotifier notification Matched Text parameter does not display information. After so many attempts and tests, it has been decided to reinstall the operating system.

 

I hope this solves the problem.

 

Thanks you very much.

 

Regards Manuel

[Anon Anon]

Hi everyone 

 

The solution is in the following link.

 

CA Spectrum 10 OneClick displays special characters (�)  

 

Thanks you very much for your help.

 

Regards Manuel