Forum Discussion

davidstclair_20's avatar
davidstclair_20
Icon for Nimbostratus rankNimbostratus
Jun 10, 2009

Alert Suppression?

There are two alerts that don't have alert suppresion enabled...

 

 

Rule Override Cache Update Failure

 

Unhandled Exception in Data Source

 

 

it just so happens we are having a lot of errors right now and these two alerts are assulting our console. I have overridden them to turn them off, and attempted to recreate them using suppression, however the Target is not available outside that MP. Not sure that was the way it was designed?

 

 

Any thoughts?

 

  • Dave_Ruddell_79's avatar
    Dave_Ruddell_79
    Historic F5 Account
    For the Rule Override Cache Update Failure alert, can you look in the Event Viewer and under F5 Monitoring Log, find any event with id 800 and paste the details into a response.

     

     

    Similarly, for the Unhandled Exception in Data Source, can you find any events with id 405?

     

     

    In the meantime, I will look into why you can't suppress the alerts.
  • I can't suppress the duplicates because the MP is sealed. That would have to be done when the MP is being created by F5.

     

    As far as the event logs go... the EventID 405 is happening on the active node of the RMS Cluster and the 800 is happening on the passive node of the RMS cluster. I installed it on both nodes, starting with the active node.

     

    Log Name: F5 Monitoring Log

     

    Source: F5 Events

     

    Date: 6/11/2009 10:05:17 AM

     

    Event ID: 405

     

    Task Category: None

     

    Level: Error

     

    Keywords: Classic

     

    User: N/A

     

    Computer: SERVERNAME1.web

     

    Description:

     

    Data Source [PerformanceDataSource] reported an unhandled server exception: terminating=True error=Microsoft.EnterpriseManagement.HealthService.ModuleException: The singleton data source PerformanceDataSource has already been loaded with id=55467396; failing load of 41876200. Check the data source configuration and restart the associated module and/or Health Service

     

    at F5Networks.ManagementPack.DataAccess.OperationsManager.DataSource.Sources.DataSourceBase`3..ctor(ModuleHost`1 moduleHost, XmlReader configuration, Byte[] previousState)

     

    Log Name: F5 Monitoring Log

     

    Source: F5 Events

     

    Date: 6/10/2009 1:49:00 PM

     

    Event ID: 800

     

    Task Category: None

     

    Level: Warning

     

    Keywords: Classic

     

    User: N/A

     

    Computer: servername2.web

     

    Description:

     

    Unable to update collection rules due to data failure

     

    Event Xml:

     

     

     

     

    800

     

    3

     

    0

     

    0x80000000000000

     

     

    86

     

    F5 Monitoring Log

     

    server3.web

     

     

     

     

    Unable to update collection rules due to data failure

     

     

  • Dave_Ruddell_79's avatar
    Dave_Ruddell_79
    Historic F5 Account
    I'm guessing you have overrides set on some of the F5 objects, correct? We're thinking it could be related to the targeting of the overrides, but we won't know unless we can look at the trace log. Can you please zip up and attach an export of your F5 Monitoring Log and the entire logs folder located at C:\Program Files\F5 Networks\Management Pack\logs ?

     

    Thanks,

     

    -Dave
  • Hi Dave,

     

    attached are the verbose logs and evt files saved as txt. So we changed the account to be an Admin on the F5s in the lab, and are now getting an invalid cert error.

     

    Any thoughts? Thanks...

     

    David
  • Hi Dave,

     

    attached are the verbose logs and evt files saved as txt. So we changed the account to be an Admin on the F5s in the lab, and are now getting an invalid cert error.

     

    Any thoughts? Thanks...

     

    David