Duplicate auto tickets on BSM 9.26

We would like to request for an assistance with regards to the issue we are encountering with the auto tickets being generated from BSM. Below is the complete details of the issue:

Ever since we upgraded from BSM 9.24 to BSM 9.26  alerts are being generated from both our Primary DP server and our Secondary DP server on a pretty even distribution. While at first this may seem a good thing to even out the workload, in our case it is not a good thing.  Our alerting functionality coming out of BSM was developed on the idea that alerts would be generated from the Primary DP server almost all of the time (unless we failover of course.)  Based on this assumption, some custom filter technology was developed to suppress duplicate tickets from being developed in our Service Manager instance if an identical alert was generated from the same server for the same event that already had a ticket opened for that event in Service Manager.  Now that alerts are being generated from both the Primary and Secondary DP servers, we are generating duplicate tickets in Service Manager for many events detected by BSM.   We need to know how to configure BSM to generate alerts only from the Primary DP Server.  When we were running BSM 9.24 and all versions prior to this (including BAC versions), alerts were only generated from the Primary DP server.  Something changed in BSM 9.26 so that alerts are now generated from both the Primary and Secondary DP servers (about 50% are generated from the Primary and 50% from the Secondary now) and we need to know how to fix this.

 

 

Tags:

  • I have 2 comments:

    1) in BSM9.26 (and i am pretty sure also in previous version) all outbound (and of course inbound) communication is done from the GW, not the DPS. if you are forwarding events in the right way (i.e using Forwarding Rule to Connected Server) then it will run from the GW from the opr-scripting-host process. This means having 2 DPSs shouldnt have any impact.

    2) in BSM9.2x the secondary DPS should be in stand-by mode (a.k.acold stand-by). this means it shouldnt have any HAC services running on it, which means it shouldnt perform any action.

    because of what mentioned above, I suggest you open Support Case for further investigation on your system.

    Asaf