Video Screencast Help
Scheduled Maintenance: Symantec Connect is scheduled to be down Saturday, April 19 from 10am to 2pm Pacific Standard Time (GMT: 5pm to 9pm) for server migration and upgrades.
Please accept our apologies in advance for any inconvenience this might cause.

SSIM, Version 4.7.0-b238, Visualizer, Table View issue.

Created: 19 Aug 2010 • Updated: 05 Jan 2011 | 11 comments
This issue has been solved. See solution.

We had trouble earlier today; disabled a Correlation Rule for which Alerts were enabled. When we began receiving email notices of events related to that rule, we thought the Rule had not been properly disabled.
We were eventually able to stop the alerts and disable the rule.

I began cleaning up (closing) numerous alerts, basically housekeeping, many realted to the disabled rule, and also several thousand others.

After cleanup, we noticed that the Status for most Hosts in the Table View of Visualizer showed as Unknown and a few showing Clock out of Sync. Currently, the Host's that were initially Clock out of Syc are showing Agent Down or Sensor Down.

We have verified that these devices are indeed Up and have traffic, observed in the Statistics view.

It has been a few hours since this happened. Is it possible there is a lag somewhere and the SIM is "preoccupied"?

Any ideas why the Table View is not communicating?

Thanks!

Ron

Comments 11 CommentsJump to latest comment

olaf's picture

Looks like as soon as I leave the System tile the problem is occuring.
As soon as I click on a tile on the left like Events or Rules the Statistics viewer is showing me all Agents as down and sensors as unknown.
Looks like a bug to me, but I will doublecheck what our engineering has to say about this.

mohpossum's picture

olaf,

Thanks for your reply.

When I searched other posts, I located this one:

https://www-secure.symantec.com/connect/forums/ssi...

Though it was not specific to our issue, I forwarded it to my manager and he "recycled" the service.
Within a few minutes we began to see some results, but were not sure if this expidited the issue or was just filling ttime while recovery was taking place.

Thanks again, have a great weekend,

Ron

It always rains...at the end of a dry spell.
 

olaf's picture

Filed a bug to see what development has to say about it.

IncrediBill's picture

I am experiencing this on a new deployment of 4.7.2
needs a reboot of the ssim to get back online.

IncrediBill's picture

This is happening several times now.  This calls for a Support case.  Has anyone made any discovery on this syndrome?

mohpossum's picture

I noticed a few days ago several devices were either Unknown or Clock out of sync Status. This most recent updates listed were on Novenber 9th, 2010.

We restarted  this morning, about an hour ago, and the current status for EVERYTHING is Unknown.

Has anyone made any advances on this?

Thanks!

Ron

It always rains...at the end of a dry spell.
 

olaf's picture

Can you first restart the simserver and then the statsvc on the appliance (if this is the correlation appliance)?

service simserver restart

service statsvc restart

Then wait 5 minutes before accessing the Visualizer and the Table View. Does this change anything?

Just to clarify the Clock out of sync status. Tidoesn't necessarily mean that the clock of the agent machine is off. The more likely cause is that the difference between the Logged Date and Event date is way off. This can for example happen if you have a huge backlog when for example the agent was down. This can also potentially mean that you either overloading the agent or the evntservice and events come faster in than they can be processed.

Also check on the agent machine if you are experiencing any frequent restarts of the Event agent service caused  by the Event Agent management service where the table view is showing the status Clock out of sync for an agent.

mohpossum's picture

olaf,

The server was restarted shortly after my most recent posting. There was no improvement, and it may be worse, as now, the displated status for all devices is now "Unknown".

I have been checking occasionally for several days now, and it has been this way each time I have observed the Table View.

Thanks!

Ron

It always rains...at the end of a dry spell.
 

olaf's picture

By restart you mean a reboot, right?

I have seen this with another customer before and restarting the simserver and statsvc service after the reboot fixed the issue for the customer.

After restarting those 2 services wait 5 min and check again.

mohpossum's picture

olaf,

We re-booted and subsequently stopped and restarted the services.

There has been no change in the Table View, all Hosts show a Status of Unknown.

Ron

It always rains...at the end of a dry spell.
 

mohpossum's picture

The error was in our setup of notifications, following most recent upgrades. Information was available, but not being displayed correctly to Table View. This has been resolved and we can again see which agents truly are responding.

Thanks for all Help! Happy New Year!

Ron

It always rains...at the end of a dry spell.
 

SOLUTION