Highlighted
Frequent Contributor.. Frequent Contributor..
Frequent Contributor..
384 views

Null Active List

Jump to solution

We have a particular Active List which is used heavily by a number of rules and queries. This active list has somehow been nulled.

  • Attempts to view the list entries results in the interface not loading the list.
  • Attempts to edit it generates the error: Could not create editor: java.lang.NullPointerException
  • The following error shows in our error log: Schema not available for data List.... (com.arcsight.common.introspection.dependentvariable.DependentVariableIntrospector).
  • All rules and queries that use getActiveListValue become broken.

How can we recover this list? Or at lease release it so that we can rebuild it? All the rules and queries are associated with its list ID, so creating a new list would be troublesome. 

 

0 Likes
1 Solution

Accepted Solutions
Highlighted
Outstanding Contributor.
Outstanding Contributor.

Hmm, dont suppose you have a system table backup or package export containing its definition?  My guess is that the ID exists in arc_resource but the arc_ald_<data_table_name> table might not exist. Have seen this in the past but I had packages that allowed me to delete/reimport the definition with the same ID.

Do you do any custom scripting that imports list contents?

Regards,

Ian.

View solution in original post

0 Likes
4 Replies
Highlighted
Outstanding Contributor.
Outstanding Contributor.

Hmm, dont suppose you have a system table backup or package export containing its definition?  My guess is that the ID exists in arc_resource but the arc_ald_<data_table_name> table might not exist. Have seen this in the past but I had packages that allowed me to delete/reimport the definition with the same ID.

Do you do any custom scripting that imports list contents?

Regards,

Ian.

View solution in original post

0 Likes
Highlighted
Frequent Contributor.. Frequent Contributor..
Frequent Contributor..

We do have custom scripts that replace the list regularly with new content. We will have to build some validation into these scripts and make backups more accessible for applying quick fixes when their is an unexpected issue. 

Thanks.

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Hi Kitty42,

 

I got this problem several months ago and it is possible you have met the same issue.

I have no AL backup thus it was very critical for us. You have to be sure that no NULL value is populating a Key field in the AL, this is mandatory. Create a variable to replace by "not defined" or something else if you have no other choice. It worked perfectly for me.

The error means that there is an issue in your variables based on the base events thus you have to review firstly the rule that populate the AL and check in ESM with AL Monitoring (audit events) or with another ActiveChannel which logs are triggering your rule by mistake and then adapt your rule.

We have done this and the problem was solved.

Another point, is the data you put in your AL, it is really bad if there is chars like  "\" in one of your key fields because of the escaping chars that could be missed when your use getActiveListValue, I know it is annoying but you have to try to remove those chars and you won't have any issue in the future.

For troubleshooting AL issue, there is no easy solution, you have to reverse engineer what you have done and put some conditions to prevent bad values to populate your AL.

Sincerely, I don't think you have to rebuild everything from scratch, if you solve the initial issue, it will be OK.

PS: Did you check the ActiveList Monitoring Attribute you can used in dataMonitor (added to a Dashboard), this is extremely useful to monitor ActiveLists, it will tell you the real items count and size limit, percentage used (100% is not good, you need to increase) and also how many queries/changes per sec?

You have to create a dataMonitor (System Monitor Attribute) then in

Monitor Types:          ActiveListMonitor

Attribute Name:         ActiveCacheInformation

Try it, it will be very useful for your AL monitoring and maybe, you will do it for Session List too.

Thanks
Regards

Michael

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.

Highlighted
Frequent Contributor.. Frequent Contributor..
Frequent Contributor..
Thanks, I will use this as a diagnostic tool in the future.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.