1 2 Previous Next 22 Replies Latest reply on Apr 23, 2019 4:26 AM by Ana Lorite

    Error updating TKU with an obsolete module pattern

    Ana Lorite
      Share:|

      Hi everyone,

       

      As I mentioned in the subject, I am getting the next error:

       

       

      Once I deactivate the obsolete pattern module (obsoletes IBM.TivoliSecurityComplianceManager;) and I update again the TKU, the process works fine.

       

      Is it the procedure I have to follow every time I update de TKU?

       

      1) Deactivate

      2) Update

      3) Activate

       

      Thanks in advance.

       

      Ana.

        • 1. Re: Error updating TKU with an obsolete module pattern
          Andrew Waters

          You have a custom BKGS pattern module which is obsoleting a standard TKU pattern module hence when you try to activate the pattern module it fails.

          2 of 2 people found this helpful
          • 2. Re: Error updating TKU with an obsolete module pattern
            Ana Lorite

            Thanks, Andrew.

             

            So this behaviour it's normal and the procedure I follow is correct.

             

            Is there any other way to "inactive" a pattern?

            • 3. Re: Error updating TKU with an obsolete module pattern
              Andrew Waters

              If you upload it as part of TKU you could deactivate it. Though that, of course, relies on you remember to do so.

               

              Why do you want to stop it activating?

              1 of 1 people found this helpful
              • 4. Re: Error updating TKU with an obsolete module pattern
                Bob Anderson

                How about modifying the custom pattern it so that is 'overrides' rather than 'obsoletes'.

                 

                There should be no custom patterns that 'obsoletes' anything in the TKU.  If you need additional or alternative pattern work beyond the TKU patterns, then write your pattern such that it 'augments' (does addtional work) or 'overrides' (takes over) TKU patterns.

                Pattern Overview - BMC Discovery 11.3 - BMC Documentation

                 

                Perhaps the online docs pertaining to 'obsoletes' needs to be updated to reflect potential TKU update isses with 'obsoleted' patterns.

                1 of 1 people found this helpful
                • 5. Re: Error updating TKU with an obsolete module pattern
                  Ana Lorite

                  Hi Andrew,

                   

                  Thanks again for your time.

                   

                  Discovering IBM.TivoliSecurity takes a long time (i think the log files are very very big and the pattern read them, i try to remember). That application doesn't rely on my customer so they asked to deactivate that discovering.

                   

                  I jogged my memory and i think i read this post and i applied the obsolete solution.

                  • 6. Re: Error updating TKU with an obsolete module pattern
                    Ana Lorite

                    Hi Bob,

                     

                    Thanks for your help.

                     

                    Yes, perhaps the override solution is the most appropiate.

                     

                    Thanks!!

                    • 7. Re: Error updating TKU with an obsolete module pattern
                      Andrew Waters

                      I suggest raising a case with an example so the pattern can be improved.

                      2 of 2 people found this helpful
                      • 8. Re: Error updating TKU with an obsolete module pattern
                        Andrew Waters

                        The issue with overrides is that you must have an import and so the version must be appropriate.

                        1 of 1 people found this helpful
                        • 9. Re: Error updating TKU with an obsolete module pattern
                          Mark Edwards

                          Should the logic in the TKU not be that only affected pattern module is left inactive?

                           

                          I have encountered the same problem and what seems to happen is that as soon as the TKU encounters an error it leaves all the remaining modules inactive as in the example above.

                          • 10. Re: Error updating TKU with an obsolete module pattern
                            Andrew Waters

                            No - it should definitely not be that as you end up with partial applying of what you have done.

                             

                            This would lead to needing for the user to be able to distinguish which pattern modules were not activated because of an issue, and then the dependencies. It all becomes really complicated trying to understand what the system has done if it only does some of the work.

                            2 of 2 people found this helpful
                            • 11. Re: Error updating TKU with an obsolete module pattern
                              Ana Lorite

                              Hi Andrew,

                               

                              Yes, you are right. I will consider to do that. Thanks for your suggestion.

                               

                              Just for checking and to be sure that it's ok. Is this overriding pattern correct?

                               

                              // (c) Copyright 2011-2018 BMC Software, Inc.

                              //

                              tpl 1.12 module BKGS.Override;

                               

                              metadata

                                  origin := "BKGS";

                                  tree_path := "Custom BKGS", "Overrides";

                              end metadata;

                               

                              from IBM.TivoliSecurityComplianceManager import TivoliSCMClient 1.0;

                              from IBM.TivoliSecurityComplianceManager import TivoliSCMServer 1.0;

                               

                              pattern TivoliSecurityComplianceManagerOverrided 1.1

                              """

                              """

                              overview

                              tags overrided, Tivoli;

                              overrides TivoliSCMClient,TivoliSCMServer;

                              end overview;

                               

                              triggers

                              on process := DiscoveredProcess created, confirmed, modified;

                              end triggers;

                               

                              body

                              log.info("overriding TivoliSCMClient and TivoliSCMServer. Do nothing");

                              end body;

                              end pattern;

                              • 12. Re: Error updating TKU with an obsolete module pattern
                                Andrew Waters

                                You do not really want to do that. If will trigger a LOT and write lots of unhelpful log messages.

                                2 of 2 people found this helpful
                                • 13. Re: Error updating TKU with an obsolete module pattern
                                  Bob Anderson

                                  Ana,

                                   

                                  You should use the same trigger(s) as in the TKU.

                                   

                                  Since each of the patterns has nearly identical trigger conditions, perhaps a combined trigger would suffice.

                                   

                                  Something like this:

                                   

                                  triggers

                                     on process := DiscoveredProcess where cmd matches regex "(?i)\bjava(?:\.exe)?$"

                                                                                                                                           and

                                                                                                                                      (

                                                                                                                                      args matches regex "(?i)com\.ibm\.jac\.server\.BootStrap"

                                                                                                                                           or

                                   

                                                                                                                                      args matches regex "(?i)com/ibm/jac/server/BootStrap"

                                                                                                                                           or

                                                                                                                                      args matches regex "(?i)com\.ibm\.scm\.client\.SCMClient"

                                                                                                                                           or

                                                                                                                                      args matches regex "(?i)com/ibm/scm/client/SCMClient"

                                                                                                                                 );

                                   

                                   

                                  This will reduce the number of times it is triggered, and the number of logging statements.

                                   

                                  It may be better to have 2 override patterns, one for each of the patterns being overridden. I'll leave this for Andrew's advice.

                                  2 of 2 people found this helpful
                                  • 14. Re: Error updating TKU with an obsolete module pattern
                                    Bernard Stern

                                    Hi Ana

                                     

                                    we have to modify the trigger of a OOTB pattern to make it work because the expected command is a tiny bit different

                                     

                                    OOTB trigger          cmd matches unix_cmd 'dataserver'

                                    CUSTOM trigger     cmd matches unix_cmd '.+dataserver'

                                     

                                    the process is the following:

                                     

                                    1. upload the latest OOTB TKU, the CUSTOM pattern gets deactivated.

                                    2. create a copy of the OOTB pattern, modify the trigger to generate the CUSTOM pattern (this has been automated)

                                    3. upload the CUSTOM TKU, the OOTB pattern gets deactivated.

                                     

                                    Here it is important that you don't ever change pattern version. Whenever you upload a pattern with the same version, the latest uploaded pattern is activated and deactivates the previously uploaded pattern. Of course, provided the pattern is correct, that it does not tigger an error upon upload. We have 4 such CUSTOM patterns, so there are 4 inactive BMC patterns.

                                     

                                    1 of 1 people found this helpful
                                    1 2 Previous Next