Event related problems in TSPS. How can they be resolved?

Version 11
    Share:|

    This document contains official content from the BMC Software Knowledge Base. It is automatically updated when the knowledge article is modified.


    PRODUCT:

    TrueSight Operations Management


    COMPONENT:

    TrueSight Operations Management


    APPLIES TO:

    This is applicable to all TSPS versions.



    QUESTION:

    How can the following TSPS event related symptoms be resolved:

    Events missing in TSPS compared to TSIM.
    Events cannot be closed in TSPS.
    Deleted events still visible in TSPS.
    Event status incorrect. For example, event shows closed in TSIM but open in TSPS.
    Event group with custom slot not working
    Unable to see any events in monitor details view.


    ANSWER:

    For TSPS 10.0 and 10.1:

    Stop the TSPS server.

    Delete the elasticsearch data folder from TSPS. The location of the folder is <installdir>\truesightpserver\modules\elasticsearch\data

    Start the TSPS server and once connected to TSIM it will sync all the events.

    For TSPS 10.5, 10.7, 11.0 (except FP3 or later), 11.3.01:

    1. From a command window, go to the <installdir>\truesightpserver\bin directory and stop the Core server process with command:

    tssh process stop csr

    Verify that the database service is running with command:

    tssh server status


    Execute:

    tssh properties list | findstr EVENT_TIME_TRACKED ( Windows ) or  tssh properties list | grep EVENT_TIME_TRACKED  (Linux)

    It will output a list similar to the example below. For each TSIM it will list one row.
    For example; If there are 2 TSIMs, then there will be two rows of output.

    EVENT_TIME_TRACKED_1                                      1471849890
    EVENT_TIME_TRACKED_2                                      1471849891


    Where EVENT_TIME_TRACKED_#  is the component id of a TSIM and 1471849890 is the epoch timestamp for the last event updated for that TSIM.

    For each row, execute below commands:

    tssh properties set EVENT_TIME_TRACKED_1 0
    tssh properties set EVENT_TIME_TRACKED_2 0

    Make sure the value for the above property is 0 before restart.

    Stop the TSPS server. Execute 'tssh server status' to verify it is completely stopped. If the Index Server and Database Server processes still show as running then stop them manually by executing 'tssh process stop indexserver' and 'tssh process stop database'.


    Delete the elasticsearch data folder from TSPS. The location of the folder is <installdir>\truesightpserver\modules\elasticsearch\data

    Start the TSPS server and once connected to TSIM it will sync all the events.

    For TSPS in HA 10.5, 10.7, 11.0 (except FP3 or later), 11.3.01:

    1. Stop the secondary TSPS and execute 'tssh server status' to verify it is completely stopped. If the Index Server and Database Server processes still show as running then stop them manually by executing 'tssh process stop indexserver' and 'tssh process stop database'.

    2.  On the primary TSPS, from a command window, go to the <installdir>\truesightpserver\bin directory and stop the Core server process with command:

    tssh process stop csr

    Verify that the database service is running with command:

    tssh server status


    Execute:

    tssh properties list | findstr EVENT_TIME_TRACKED ( Windows ) or  tssh properties list | grep EVENT_TIME_TRACKED  (Linux)

    It will output a list similar to the example below. For each TSIM it will list one row.
    For example; If there are 2 TSIMs, then there will be two rows of output.

    EVENT_TIME_TRACKED_1                                      1471849890
    EVENT_TIME_TRACKED_2                                      1471849891


    Where EVENT_TIME_TRACKED_#  is the component id of a TSIM and 1471849890 is the epoch timestamp for the last event updated for that TSIM.

    3. For each row, execute below commands:

    tssh properties set EVENT_TIME_TRACKED_1 0
    tssh properties set EVENT_TIME_TRACKED_2 0

    Make sure the value for the above property is 0 before restart.

    4. 
    On the Secondary TSPS delete the elasticsearch data folder from TSPS. The location of the folder is <installdir>\truesightpserver\modules\elasticsearch\data

    5. Stop the primary TSPS and execute 'tssh server status' to verify it is completely stopped. If the Index Server and Database Server processes still show as running then stop them manually by executing 'tssh process stop indexserver' and 'tssh process stop database'.


    5. On the Primary TSPS delete the elasticsearch data folder from TSPS. The location of the folder is <installdir>\truesightpserver\modules\elasticsearch\data

    6. Start the Primary TSPS server and once connected to TSIM it will sync all the events.

    7. Start the Secondary TSPS server 

    BMC is tracking the TSPS/TSIM event discrepancy issue with CAR00083125.

    Note : Best practice recommends closing the events to allow propagation to clear the events after the defined pruning period.

    Note: With 11.0 FP3 and 11.3.02, most of the event sync related problems have been resolved. If an event sync problem is still seen, then please execute command 'tssh event reinitialize' as this performs the above steps under the covers.


     

     


    Article Number:

    000102508


    Article Type:

    FAQ/Procedural



      Looking for additional information?    Search BMC Support  or  Browse Knowledge Articles