Highlighted
sujansures Absent Member.
Absent Member.
1066 views

Active List is not getting populated

Jump to solution

Hi all,

I am populating an event to the active list and I couldn't see any entries in them even after the occurrence of the event. The fields were mapped properly. Even then I don't have an idea why it's not getting populated..

Labels (2)
0 Likes
1 Solution

Accepted Solutions
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Active List is not getting populated

Jump to solution

Ok, so I just created a rule based on some sample events I have in my test VM ESM. It is different from the rule, but we will come back to that part later. The rules and settings are as follows:

Initial rule conditions - note different events involved - but the AND operator is on all of the events:

1Capture.JPG

Aggregation is the same as your example:

2Capture.JPG

Actions are set to increase the priority to 10 (just makes it easier to see!) and the active list set:

3Capture.JPG

For reference, the active list is set as follows - the same as your example:

4Capture.JPG

Rule action for the setting of the data on the active list - worth checking this part - and setting the correct fields

5Capture.JPG

Rule trigger and one of the base events (Rule is called Test Rule for reference)

6Capture.JPG

And the event inspector for the base event, just to show what triggered it

7Capture.JPG

So I believe that I set the rules to be the same as well as the aggregation settings and actions. So that leaves me to conclude one of the following:

1) The events aren't matching the rule

2) There is something wrong with the logic for the conditions

3) You dont have the rule in the real-time rules folder

4) Something is fundamentally broken that is stopping the rules from running at all.

4) is unlikely and to be honest, you will have thousands of audit events showing that there is something massively wrong. So I can going to discount that one. 3) you have said you have, but it is always worth confirming this and how you placed the rule in the folder. Did you copy it, move it or link it? If it is a copy, is it the most recent copy and does the rule actually match what you have shown. For 2) I would check the logic. Create a filter of the same conditions and create an active channel. Have this open with Continuously Evaluate and see if the events that you want actually appear. If not, then the logic is broken. And finally for 4) Make sure you actually have the events that generate this. The Test Rule option for the rule itself is fine, but is known to have bugs in it (though I haven't had issues). So it is often easier to test the conditions to make sure they work in a different way. Or replay events to show it works? Either way, make sure you have events or the rule never triggers.

0 Likes
15 Replies
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Active List is not getting populated

Jump to solution

Lightweight or standard rule?

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Hi ​, It is a standard rule.

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Active List is not getting populated

Jump to solution

Ok, are you aggregating (where identical) the fields you want added to the ActiveList?

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

​, I have created a query for users created.

Dest.Addr and Dest.UserName are the fields which I wanted and mapped in AL to populate.

1.png

0 Likes
Contributor.. elib Contributor..
Contributor..

Re: Active List is not getting populated

Jump to solution

Hi,

When the rule is triggered, do you see the the action (audit event)?

0 Likes
Honored Contributor.. varunraaj Honored Contributor..
Honored Contributor..

Re: Active List is not getting populated

Jump to solution

Hi Sujan,

Please check whether the rule is placed under Real-Time rules folder.

Regards,

Varun P G

0 Likes
deepakroy1841 Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Hi sujan,

Increase the time frame and then test the rule.

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Active List is not getting populated

Jump to solution

Time is usually one that can cause issues as you are testing the rules on events that aren't there!

Also, what is the action trigger for the rule? I presume you have it set for the add to the active list, but is it every event, on first event etc. Check that you have the right trigger selected and test. If you have the chance, try setting the other ones and testing too - always wroth testing and proving to yourself what works and what happens in the different scenarios!

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Hi ​, the rule is triggering actually, Eli.. The same gets populated in a session list and not an active list. dunno why

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Hi ​, yes, the rule is under real time rules only..

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Dear ​ and ​,

If time is the case as you both are pointing at, I have a weird doubt here. I have aggregated this event to behave as an ultra fast one. Just two seconds

In the case, does it needs enough time in order to get it mapped to the active list?

Because, the active list is created properly, the fields are properly mapped to it. The use case is also the right one. Even then it is not populating in real time. The funny case is it is getting populated in the session list

looking forward guys,

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Active List is not getting populated

Jump to solution

Can you post a screenshot of each tab or at least the Actions tab? Also maybe the configuration of the Active List.

0 Likes
sujansures Absent Member.
Absent Member.

Re: Active List is not getting populated

Jump to solution

Hey Guys,

I am sharing the screen shots of what I have done. Try to find any key on the same, the issue is still prevailing here.

Filter for user created

Filter.JPG

Action for the rule - added to an active list

action.JPG

Active List without data

unpopulated list.JPG

kindly let me know if any information is added on the same..

looking forward people | ​, ​,

Thanks

0 Likes
Honored Contributor.. varunraaj Honored Contributor..
Honored Contributor..

Re: Active List is not getting populated

Jump to solution

Hi Sujan,

From Screen shot i could see that you are trying to add two fields which are not in the active list itself.

Regards,

Varun P G

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.