IBM E027SLL-H Troubleshooting Guide - Page 259

Table 21. Monitoring events in Netcool/OMNIbus do not have expected values (continued) Cause Resolution An acknowledgement expiration status update event from the hub monitoring server has re-opened a sampled event in the Netcool/OMNIbus ObjectServer after the operator cleared or deleted the event in Netcool/OMNIbus and has set the Summary attribute to the situation name. (Other OMNIbus attributes may not be set as expected too.) If a sampled event is cleared or deleted in Netcool/OMNIbus, the behavior of the bidirectional event synchronization architecture is to send a request to the hub Tivoli Enterprise Monitoring Server to acknowledge the situation with a specified timeout. The reason for this behavior is that you cannot close sampled situation events unless the monitoring agent determines the situation condition is no longer true. If the acknowledgment timeout of the situation expires and the situation is still true, then a new situation event is opened in the Netcool/OMNIbus ObjectServer so that the Netcool/OMNIbus operator is notified that the event condition has not been resolved. By default, Netcool/OMNIbus removes cleared events from the alerts.status table after 2 minutes. If the event has already been removed from the alerts.status table when the acknowledgment expiration times out, a new event is opened in the ObjectServer. However, the event data is not fully populated, because the acknowledgment expiration status update event contains a subset of the base IBM Tivoli Monitoring EIF slots and not any of the agent-specific data. In addition, the OMNIbus Summary attribute is set to the situation name and not the descriptive text that is used when the IBM Tivoli Monitoring sends an open event to Netcool/OMNIbus. To ensure that the event data is fully populated when the acknowledgement expires, set the default acknowledgment expire time to be less than the time cleared events remain in the alerts.status table. If the event is still in the alerts.status table when the acknowledgment expiration status update event is received, the event will be deduplicated by the IBM Tivoli Monitoring triggers and the event attribute settings from the original event will be maintained. To increase the time that cleared events remain in the alerts.status table, edit the Netcool/OMNIbus delete_clears automation trigger. Then set the acknowledgement expire time to be less than time used by the delete_clears trigger logic. See the topic "Changing the default acknowledgment timeout used when sampled events are deleted or cleared in Netcool/OMNIbus" in the IBM Tivoli Monitoring Installation and Setup Guide for more information. After an event is cleared in Netcool/OMNIbus, the event's severity is changed back to its original severity If you clear a monitoring event in Netcool/OMNIbus and you are using the bi-directional architecture, the hub monitoring server sends a loopback event to OMNIbus after it processes the event status change from OMNIbus. If the default deduplication trigger is processing monitoring events and the event had been cleared, the deduplication trigger changes the event's severity to the original severity value that is included in the loopback event. Chapter 14. Event synchronization troubleshooting 241