RSA enVision^® Discussions

RSAAdmin · ‎2012-12-28

We have customised application for example abc .

Now we have parsed the log for this particular application .

Now we have configured a correlation rule , set the filter , configured an output action for sending alerts thorugh SMTP i.e mail

Now as we configured mange views and add this corrrelation rule and view is not coming as running . It is coming error in view .

Now i have deleted it and configured it again then also it is coming error in view .

Everythiing is correctly configured , checked many times . Restarted many services , alerter services but still coming error in view .

What is possible reason for this , pls. guide. Attaching screenshot

Also

If I stop and restart the view I am getting below logs . Now a error I can read is no device configured , 0 messages processed whereas I have configured this device also attaching the screenshot for this.

%NIC-6-508100: Packager, Packager, -, -, -, -, Detail: 928: Device 172.18.104.60 (Resourcing): 0 messages processed

%NIC-5-608027: Alerter, Alerter, -, -, -, -, Detail: 4028: 734 view=resourcing stopped.

%NIC-4-608025: Alerter, Alerter, -, -, -, -, Detail: 4028: 9826 view=resourcing error no devices configured.

%NIC-5-608026: Alerter, Alerter, -, -, -, -, Detail: 4028: 1758 view=resourcing started.

%NIC-5-608024: Alerter, Alerter, -, -, -, -, Detail: 4028: 1700 view=resourcing initialized.

%NIC-6-608801: Alerter, Alerter, -, -, -, -, Detail: 4028: View=resourcing Session= INTERVAL_STATISTICS 0,0,0,0,0,0,1356931997,1356931997,1356931997,1356931997,0,0

%NIC-5-608020: Alerter, Alerter, -, -, -, -, Detail: 4028: 1177 Requesting view=resourcing to start

Also adding that that is a customised application .

Also if i have to delete any parsed application then what is the procedure for it .

Thanks

Abhishek

RSAAdmin · ‎2013-01-08

I am not sure how did you configure the view, but after looking at the errors you posted it seems that the system is complaining about the devices in the view.

%NIC-4-608025: Alerter, Alerter, -, -, -, -, Detail: 4028: 9826 view=resourcing error no devices configured.

As per my interpretation of the above error, you 'Respurcing' view does not have any devices configured. There are many possiblities of this error.

1. You have selected a devices group in the alert rule but no devices in that group.

2. The devices have been deleted.

If you find any such error, please correct to make it work.

RSAAdmin · ‎2013-01-09

Yes , device was deleted but rediscovered as unknown device in manage monitored devices , but now if we click on unknow device in manage monitored devices we are getting unknown error , if delete this device again rediscover again getting same error on clicking .

Weblogs for this are givn belwo , can u help in understanding the issue :

Jan 3, 2013 1:22:13 PM org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/].[jsp.setup.devices.monitored_005fdevices_005fdetails_jsp]:SEVERE: Servlet.service() for servlet jsp.setup.devices.monitored_005fdevices_005fdetails_jsp threw exception

java.lang.NullPointerException

at jsp.setup.devices.monitored_005fdevices_005fdetails_jsp._jspService(jsp.setup.devices.monitored_005fdevices_005fdetails_jsp:279)

at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at com.opensystems.privatei.tomcat.request.EnvisionCsrfGuardFilter.doFilter(EnvisionCsrfGuardFilter.java:58)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at com.opensystems.privatei.tomcat.request.HibernateSessionFilter.doFilter(HibernateSessionFilter.java:26)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)

RSAAdmin · ‎2013-01-10

As per my understanding of the above message, when you click on the unknown device the system is not able to find the device in the database. In this case I could have tried the following. (which you have done)

1. Stop the collection of logs from this device for some time.

2. delete the unknown device.

3. wait for a minute or two for replication.

4. restart the services on ES box or on the collector if it is LS.

5. now enable the collection of events.

Affter all this, check if the device is getting discovered as its intended devicetype.

RSAAdmin · ‎2013-01-11

We have done this but not working ,

For the unknown error coming on clicking the device on manage monitored devices we are getting the below particular log file in webserver logs :

Jan 3, 2013 1:22:13 PM org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/].[jsp.setup.devices.monitored_005fdevices_005fdetails_jsp]:SEVERE: Servlet.service() for servlet jsp.setup.devices.monitored_005fdevices_005fdetails_jsp threw exception

java.lang.NullPointerException