HP SIM Events

[rabk12sdus]

I have two HPSIM servers looking at the same HOST. They are responding differently to events. Why is the second HPSIM 2 Server responding slower?

HPSIM 1

Server Name: (SNMP)  Logical Drive Status Change (3034):  HPSIM Alert - Time 1:28 p.m.
Server Name: (SNMP)  Logical Drive Status Change (3034):  HPSIM Alert - Time 1:28 p.m.

HPSIM 2

Server Name: (SNMP) Logical Drive Status Change (3034):  HPSIM 2 Alert - Time 1:46 p.m.
Server Name: (SNMP) Logical Drive Status Change (3034):  HPSIM 2 Alert - Time 1:46 p.m.

Server Name: (SNMP) Physical Drive Status Change (3046): HPSIM 2 Events - Time 1:46 p.m.

Server Name: (SNMP) Logical Drive Status Change (3034): HPSIM 2 Alert - Time 1:46 p.m.

Server Name: (SNMP) Logical Drive Status Change (3034): HPSIM 2 Alert - Time 1:46 p.m.

Attached are the event logs in Excel comparing the two servers.

[cvo]

I'm having a similar issue where the event traps are timestamped 15-20 minutes after the event actually occurred, although I only have one SIM server.

Did you happen to find a  cause for this? 

I wonder if it is related ot the Scheduled Tasks that run for Hardware Status polling - although for these my tasks run every 5 or 10 minutes, which would still not explain the time discrepancy.

Chris.

[Bendom]

To rabk12sdus

I checked only events with date 8.5.2013 (mm.dd.yyyy i think it does not matter if you are using twelve or twenty four hour time format) and data provided in excel file are not consistent at both CMS, which mean that traps were not sent on both or they were denied by one system.

Try to check NTP server (in case you are using it) at CMS and Servers where traps are generated. Also check timeouts set up in HP SIM Options> Protocol settings > Global/System Protocol settings and of course be sure about network timeouts and latency .

To cvo

And timestamp is assigned by? Check time settings/ NTP server settings on both  systems (reporting and receiving) if they are not different.

BR,

Martin

[cvo]

Hi Bendom, thanks for your prompt response.

Time on both servers are the same, syncing of the same NTP server.

The scenario around this particular example of timestamp differentiation goes like this:

I have a server with tape library attached. I switched off the library, which I am calling the 'event'.

On the client server (with tape library attached), Windows Event Logs reports the library going offline at 15:56.

On the SIM server, the registered Tape Library object reports the event with time 16:01

On the SIM server, the registered client server object reports the event with time 16:16.

So the same event has a timestamp difference of 5 & 20 minutes.  I don't know if SIM allocate the timestamp when it collects the SNMP traps whether this is done by the client.

[Bendom]

To cvo:

K i think i got it, so now dumb question if there is an event in HP SIM with time 16:00, do you have (regarding on your NTP server) same time in real? I mean if there is an event with timestamp 4PM and real time is 3:45PM... just to be sure there is not anything like that.

I am sorry, but im am not familir with tape library "reporting mechanism" settings but can you check how often your insight agent are gathering info about that machine? At server you can find those setting in control panel/ HP Management Agents or at HP SMH under settings/snmp webagents/... This setting can be different by each system and should cause this problem from my point of view.

Also check your traps folder (%HP_SIM_Install_Folder%/traps). This folder is used (and i really appreciate confirmation from somebody who is more experienced with HP SIM) to store received traps before they are procssed by HP SIM. Sometimes there are many traps and HP SIM is stuck in some way. Solution is usually delete content of this folder. You can also compare time included in name of trap (IP-yyyy.mm.dd-hh.mm.ss.ms.xml) with time when file was created and with time when event appeard in HP SIM.

I hope this ideas got sense.

BR,

Martin

[cvo]

I checked out the \Traps folder as you suggested, and there was a lazy 1.4 million traps pending.  Further reading around that issue (links below) led me to applying the SIM 7.2 hotfix.

I ran the same event sequence that I originally reported and all traps were logged within a minute.  So at this stage i'm tempted to say PROBLEM SOLVED!!

Thanks for your responses and suggestions.

http://h30499.www3.hp.com/t5/ITRC-HP-Systems-Insight-Manager/SIM-7-3-XML-files-stuck-in-the-traps-folder/td-p/6035275#.UkEIIxC-Qmo

http://h30499.www3.hp.com/t5/ITRC-HP-Systems-Insight-Manager/HP-SIM-7-2-Delayed-events-generation/td-p/6030145#.UkEIJRC-Qmo