NTService Monitoring - CA Sysedge

[Anon Anon]

Hi All,

 

I am facing an odd issue with SysEDGE NTService watch and hoping for some assistance.

 

Problem:

If a service is not running for 6 consecutive breaches then an event is issued. However, if the associated alarm is cleared without the service being started, no further events are being sent by SysEDGE agent. I have configured the flag to send continuous NotReady Traps.

 

The flag I am using is:

 

watch ntservice 'DHCP Client' 11001 0x00601010 30 'DHCP Client Service' 'C:\Scripts\Callback-svc.cmd Dhcp' 'NTService' 'DHCP Client' 'Running' major

 

Can you advise how to continuously send the NotReady trap every 6 consecutive breaches? am I missing something?

 

Thanks

[Charles Lilienkamp]

Hi Tom,

Have you thought about getting rid of the flags and adding them 1 at a time?

the 0x10 seem unapplicable because not ready is for a object not detected or not found, you dont want NOT Ready traps you want the down traps.

0x800 seems like an odd one too because typically this is a process monitor flag not so much a windows service to match process name and args.

There are different flags for all monitors overriden by watch specific flags.

 

Also have you checked the sysedge logs to see if it is actually sending the traps its just that spectrum only shows the first event and hides the rest as a duplicate event or other?

I think the best option is to review the agent logs if you need a support case can be opened for us to take a look at it.

 

#   x006 010 10

#    000 000 10 - keep sending notReady traps

all self

#    *** 002 00 - send monitorThreshold traps after *** consecutive breaches (including log and action)

Service

#    000 002 00 - don't send processStart traps (including log and action

#    *** 020 00 - send at most *** consecutive processThreshold/Stop traps (including log and action

#    000 008 00 - match process name and arguments

 

Thanks, Charlie.

[Anon Anon]

Hi Charlie,

 

Thanks for your response.

 

In that case, how do I force SysEDGE to continuously report down traps when the service is down for more than 6 consecutive polls?

 

I have reviewed the SysEDGE log and It is definitely only reporting a single trap when the state changes.

 

Thanks

[Charles Lilienkamp]

Tom,

I suspect either the flags or the major value at the end when this type of state monitoring is there it changes it from legacy traps which may also have an impact.

I would tackle how it behaves without the flags or the major first then start adding the needed options after I determined which was causing the singular trap.

But I would take it back to the first step so I could build off of that working scenario

charlie.

[Anon Anon]

Hi Charles,

 

Apologies for taking so long to respond to your suggestions.  I have taken the watch back to basics and I am still facing similar issue even with process down traps. I have used the following configuration:

 

watch ntservice 'Background Intelligent Transfer Service' 11000 0x0 30 'BITS Service' ''

 

and

 

watch ntservice 'Background Intelligent Transfer Service' 11000 0x10 30 'BITS Service' ''

 

However, both send only a single down trap but no further traps. If the alarm is then cleared incorrectly, I have a service down without any visibility. This is a major concern for us as you can imagine.

 

Do you have any ideas? If you think it is best to open a support case (if it is not working as designed) then let me know and I will do so.

 

Many thanks for your help so far.

Thomas

[David Lith]

We use watch ntservice with flag 0x00008010 for our 5.x agents. And we receive continuous process stop traps from the agent.

[Kevin Hamner]

Hello Thomas,

 

If I understand the question correctly, I may have a workable solution for you. There is a issue in SystemEDGE where the 'Keep sending notReady Traps' flag is not working when monitoring a NT service. You could monitor the executable used by the Service. The problem with BITS is that it (and many other services) uses svchost.exe.  As a workaround to the known issue, we can use two entries like this:

 

1 - Monitor NT Service using this entry:

    

          watch ntservice 'Background Intelligent Transfer Service' 11000 0x8002 30 'BITS Service' ''

 

The flags I've applied are:

     Monitor NT-service

     No Traps

 

This is just a dummy entry to extend the MIB. In turn, it gives us a pmonCurrState OID for index 11000. Because it's a dummy entry, we don't need it to do anything other that extend the MIB.

 

Here's a description of that OID:

 

pmonCurrState OBJECT-TYPE

        SYNTAX INTEGER {

            unknown(1),

            ok(2),

            warning(3),

            minor(4),

            major(5),

            critical(6),

            fatal(7),

            up(11),

            down(12)

        }

 

 

 

 

Any value in the MIB for index 11000 other than 11 means the agent is down. We can now build a self/threshold monitor to watch the pmonCurrState OID value.

 

2 - Create self/threshold monitor:

 

          monitor oid pmonCurrState.11000 11001 0x600310 30 absolute != '11' 'BITS Service Down' ''

 

The flags I've applied are:

 

     Send Traps after X Events

     Send clearTraps

     Keep sending notReady Traps

     X=6

 

Now, the self/threshold monitor is going to trap when the pmonCurrState.11000 OID is something other than 11. A trap will only be sent after the 6th event. I have the interval set to 30 seconds so the Service would be down for 3 Minutes before the first trap is sent. You should receive a NotReady trap every 30 seconds after that.

 

I hope this helps,

Kevin

[Anon Anon]

thomasclark89 Hi Thomas, did this answer your question? If yes, please mark as "correct"  otherwise let us know if you still need assistance.  Thanks,

[Anon Anon]

Hi Melissa,

 

Yes it did, I have updated the post as the correct answer.

 

Thanks to all for their help.

 

Thomas