The community has a new login process
The community single sign-on system has been changed. Learn more about it HERE
Highlighted
Acclaimed Contributor.. FrankMortensen Acclaimed Contributor..
Acclaimed Contributor..
140 views

Agent does not "wait until local command completes" before sending the event

Jump to solution

Hi

My colleague created logfile entry policy in OMi 10.63 on Windows the other day, to be used on a RHEL-node. The policy basically matches all rows in the log (the log is in fact created regularly by a another (scheduled task) policy). The first policy has an automatic action that basically looks up a string caught in the logfile row in question in another file. If this string is found, the exit code is i.e. zero. If it is not found, the exit code is non-zero. She has then checked the field "wait till the local command completes and the show the event only if the command fails".

The problem is, however, that the event is shown no matter whether the command fails or not. We can see from the result of the automatic command in the event that it fails for some of the log entries but succeedes for others. But irrespective of this, the even is shown in the event browser.

Any idea why this happens?

BR,
Frank Mortensen
Managon AB

0 Likes
1 Solution

Accepted Solutions
Acclaimed Contributor.. FrankMortensen Acclaimed Contributor..
Acclaimed Contributor..

Re: Agent does not "wait until local command completes" before sending the event

Jump to solution

Hi again,

We found the answer ourselves. It turns out that an apparent policy-related bug fooled us on this one!

When troubleshooting this initially (before posting my question here), I found that the policy in question actually had the "Enable Agent MSI" setting on the Advanced tab checked and set to "Divert events". I was happy to find this, because I thought that this was what caused our problems. I therefore unchecked this field and tried again, but it did not help.

We found out *now*, however, that when saving the policy it silently activates that setting again (!!!) When looking at the Advanced Tab the field is yet again checked, even after saving the policy. Obviously I did not even bother to go back and have a look after saving the changes the first time, as I normally trust that the changes I make stick in the policies.

Today we therefore edited the policy in Raw mode instead, and removed the setting there. Then it sticks. And, furthermore, now the policy behaves as expected when it comes to showing the events based on whether the automatic command succeeds or not!

Thought I'd post this here, in case other people experience the same problem.

Cheers,
Frank

 

1 Reply
Acclaimed Contributor.. FrankMortensen Acclaimed Contributor..
Acclaimed Contributor..

Re: Agent does not "wait until local command completes" before sending the event

Jump to solution

Hi again,

We found the answer ourselves. It turns out that an apparent policy-related bug fooled us on this one!

When troubleshooting this initially (before posting my question here), I found that the policy in question actually had the "Enable Agent MSI" setting on the Advanced tab checked and set to "Divert events". I was happy to find this, because I thought that this was what caused our problems. I therefore unchecked this field and tried again, but it did not help.

We found out *now*, however, that when saving the policy it silently activates that setting again (!!!) When looking at the Advanced Tab the field is yet again checked, even after saving the policy. Obviously I did not even bother to go back and have a look after saving the changes the first time, as I normally trust that the changes I make stick in the policies.

Today we therefore edited the policy in Raw mode instead, and removed the setting there. Then it sticks. And, furthermore, now the policy behaves as expected when it comes to showing the events based on whether the automatic command succeeds or not!

Thought I'd post this here, in case other people experience the same problem.

Cheers,
Frank

 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.