Different Connectors in Same Extension File Is Failed

[Elen Souto Caetano]

Hello people,

I have a problem. I developed a new custom SNMP connector(extension), this connector is OK and publish CI correctly, but when I put another connector(extension) together it stopped working.

Are generating the following errors in the IFW log, and CatalystContainer_wrapper.log

Does anyone know what can it be ?

 

- CatalystContainer_wrapper.log
"INFO | jvm 1 | 2018/06/26 16:46:56 | com.ca.eventplus.catalog.plugin.ClassifierSendEvent: Found key=varbind-1.3.6.1.4.1.3279.1.1.8.1.9999999.1parsing has already been done"

 

- Log IFW
"2018-06-26 17:17:39,734 ERROR [Thread-224] utils.EntityChangeSubscriptionManager - Exception occurred while notifying entity change subscriber: There was an error during outbound processing of the onUpdate event.
2018-06-26 17:17:39,765 INFO [com.ca.sam.ifw.eventplus.catalog.plugin.IFWWriter:Write] jms.JMSPublisher - Publishing CI : Update : [CA:00036:camutanga.prodesp-dc02.sp.gov.br:10.200.43.101:CA:00036:10.200.32.211].
2018-06-26 17:17:39,781 ERROR [pool-9-thread-30] utils.RejectedDataLogger - Invalid CI in onUpdate() from Module: CA:00036_camutanga.=> with MDRElementID:[null] with payload<?xml version="1.0" encoding="UTF-8"?>"

[Brahmaiah Addepalli]

Hello,

 

I assume you have created these SNMP Connector extension files in \resources\core\catalogpolicy\extensions folder…correct?

If so, can you please let us know those file names and “EventClass name” defined in these extension files?

 

Regards

Brahma

[Elen Souto Caetano]

Hello Brahma,

This environment is with Connector version: 4.2.00 catalyst version: 3.4.1.125.
Then the extension path is: D: \ Program Files (x86) \ CA \ Catalyst \ CatalystConnector \ container \ data \ Core \ Catalogpolicy \ extensions

The eventClass structure of the .xml summarized CACTI
<EventClass name = 'Alert'>
<EventClass name = 'Alert_CI' extends = 'Alert'>
<EventClass name = 'Alert_CI_Firewall' extends = 'Alert_CI'>
<EventClass name = 'Item'>
<EventClass name = 'Item_CreateCI' extends = 'Item'>
<EventClass name = 'GenericIPDevice' extends = 'Item_CreateCI' />
<EventClass name = 'CI_Firewall' extends = 'GenericIPDevice'>
<EventClass name = 'USM-Entity'>

 

The eventClass structure of the .xml summarized DCRUM

<EventClass name = 'Item'>
<EventClass name = 'Application' extends = 'Item' />
<EventClass name = 'Dcrum_CI' extends = 'Item'>
<EventClass name = 'Availability_CI' extends = 'Dcrum_CI'>
<EventClass name = 'PerformanceC' extends = 'Dcrum_CI'>
<EventClass name = 'Alert'>
<EventClass name = 'Alert_CI' extends = 'Alert'>
<EventClass name = 'Alert_CI_App' extends = 'Alert_CI'>
<EventClass name = 'Alert_CI_Dis' extends = 'Alert_CI'>
<EventClass name = 'USM-Entity'>

 

Elen

[Michael Boehm]

Hi Elen,

the easiest for further analysis would be to attach the two policies.

There is overlap in the generic classes, and there might be conflicting code, because all the policies are finally merged together into one policy on connector startup.

It can also cause issues if there are conflicting statements for the Classify statements.

 

If you dot want to make the policies public, you can also send them directly to me [e-mail].

 

MichaelBoehm

[Elen Souto Caetano]

Ah okay.

The following policies are attached.

 

Tks

 

Elen

[Michael Boehm]

Which connector policy is working fine? Or do both policies work fine, each individually?

Only when both are in parallel, you get issues?

 

MichaelBoehm

[Elen Souto Caetano]

Hello Michael,

 

Individually each connector works fine, it generates the ICs correctly.

When I put the two together, only the cacti works and the Dcrum stops generating alerts.

 

Elen

[Michael Boehm]

Hi Elen,

the problem is due to overlapping classes.

In both policies you use Alert_CI, e.g. when the policies are merged together into one, the system is confused which one to use (it will merge the code together from both classes with unpredictable results).

Change all the classes (not Alert, Item and USM-Entity) in both policies to have CACTI or DCRUM as part of the name - then it should work with both.  E.g. what is called Alert_CI in both, should be Alert_CACTI and Alert_DCRUM in the two policies (plus adoption of all the sub-classes as well).

 

MichaelBoehm

[Michael Boehm]

And to explain why DCRUM stops sending Alerts:

The policies are read in alphabetical order.  Thus, CACTI is read first, then DCRUM.

In Alert_CI you have

CACTI

<Field input='snmp_varbindvals' pattern='.*ping.*' output='eventtype' outval='Alert_CI_Firewall' />
<Field input='snmp_varbindvals' pattern='.*' output='eventtype' outval='Alert_Discarded' />

 

DCRUM

<Field input='snmp_varbindvals' pattern='.*desempenho.*' output='eventtype' outval='Alert_CI_App' />
<Field input='snmp_varbindvals' pattern='.*disponibilidade.*' output='eventtype' outval='Alert_CI_Dis' />

 

The second statement in CACTI for '.*' will "discard" everything at this point which does not contain "ping".

You could do a test by renaming the DCRUM policy to something else preceding CACTI (aDCRUM).  Then the sequence of the statements would be in different order, and both policies possibly work fine (e.g. you get Alerts).

But the better way is to make sure you know what happens by making the classes unique for each policy (thatis best practice).

 

MichaelBoehm

[Elen Souto Caetano]

Hello Michael,

 

I changed the EventClass (Alert) according to your information and put the letter "a" in the name of the dcrum file.

It worked correctly! Thank you for the tips  :-)

 

Thank you for the help.

 

Elen