Error Trying to process an EMS Event

[Arturo Acevedo_2]

I've got the following errot in an HP-UX client with ISEE A.03.00.030:

An EMS monitor attempted to send an event that was too big for the EMS
framework to deliver to the ISEE EMS listener. The event may be
available in the EMS log file /var/opt/resmon/log/rst.log on the
client system.

This problem NEEDS to be investigated with the customer, since it is
possible that an urgent EMS event may have been missed.

I noticed that this error comes up in A.02.50 and A.01.00 and its fixed in A.03.00.030. Please let me know if you know something to fix this issue.

[Stefan Stechemesser]

Hi,

you're right. Normally the problem that too large EMS messages may produce this error should be fixed by either patch PHSS_29238 or with the A.03.00.030 version of ISEE and yes, you should check the /var/opt/resmon/log/rst.log file for new EMS errors.
If there is no error logged in this file, then another possibble error cause is that someone (any application in the customer's local network) talks to port 1402. The process /opt/hpservices/contrib/emsListener/bin/rstlistener is bound to this port and listening for incoming tcp messages from EMS. If something else than EMS is talking to this port then the above error message will be the result. You can try:

telnet localhost 1402
(type anything or nothing, then CTRL-D)

=> error to process an EMS event.

The same happens if a port scanner scanns all ports in a network (started by either a hacker or from an IT security application)

I would recomend to change the port 1402 to another port for testing issues, maybe this helps:

Therefor edit the file
/etc/opt/hpservices/contrib/emsListener/rstlistener.prop
and set the variable:
"rstPort"
to another port than 1402
restart the Listener:
/sbin/init.d/rstemsListener stop/start

To configure EMS to send the messages to that port do:
vi /var/stm/config/tools/monitor/isee.sapcfg (or predictive.sapcfg for 10.20)
change the TCP Port to the value set in the rstlistener.prop
Restart EMS, therefor start
/etc/opt/resmon/lbin/monconfig
and choose (E)nable
Check if everything works fine with send_test_event disk_em and have a look at the WEB UI if the message is reported.

best regards

Stefan