Information Technology Reference
In-Depth Information
Table25-2 Troubleshooting NetRanger (continued)
Symptom
Possible Problem
Suggested Actions
The Director's
security map
contains a Sensor
icon but fails to
show any events
for that Sensor.
The level of alarms generated
by the Sensor system fall below
the routing threshold set in the
/usr/nr/etc/destinations file.
If the Director Severity Status
thresholds are set properly,
ensure that the routing
threshold in the Sensor's
/usr/nr/etc/destinations file is
set low enough to route
information to the Director.
You see the
following error
message:
“Application
AppId.HostId.Or
gId has reached
maximum
number of
alarms.”
The application mentioned in
the error message has 1000
alarm icons represented on its
HP OpenView child submap.
The Director will not create
more than 1000 icons on a
submap (window) because HP
OpenView can behave
unpredictably when this
happens.
Delete the alarm icons on the
crowded submap. The Director
will resume creating alarm
icons on the submap for any
new events.
To view iconic representations
of the events that nrdirmap
diverted to /usr/nr/var, delete
the icons on the map, and then
shut down and restart the user
interface.
Note
: The Director saves any
additional alarm data for that
application to a file named
nrdirmap.buffer.ovw_map_nam
e in the /usr/nr/var directory,
where ovw_map_name is the
name of the ovw map.
A Sensor's alarms
are properly
displayed on the
Director security
map, but
information on
those alarms does
not appear in the
Show Current
Events window,
and the event log
file in the
Director's
/usr/nr/var
directory does not
contain any
records from that
Sensor.
The Director loggerd service is
not listed as a destination in
either the Sensor or the
Director's configuration files.
Use nrConfigure to create an
entry in the Sensor's
/usr/nr/etc/destinations file for
the Director's loggerd service,
or create a DupDestination
entry in the Director's
/usr/nr/etc/smid.conf file to
redirect event data to loggerd
from smid.
