Highlighted
Super Contributor.. Super Contributor..
Super Contributor..
413 views

Is it possible to see what is touching a ci (and updates LastAccessTime)?

I have 2 unix CI:s that are updated with LAT even if I know that they have been shutdown for 2 months.

If I check Discovery Progress I can see some jobs. Most Failing... For instance Host Connection by shell - error.

But then we have the F5 BIG-IP job. My thinking is that it is this job that keeps update the LAT on the unix ci and ipaddress ci.  Is there any way to be sure that this is the job that causes the problem?

What can I do about it? I know I can prevent the job F5 BIG-IP job to update the LAT but I guess that will cause other ci like Load Balancing Cluster, ClusterResourceGroup to be aged out and recreated.

Another way could of course be to ask the F5 Administrator to remove the configuration of this particular system (which I guess should be included in the LifeCycle Management)...  

Other suggestions?

 

Wbr / Fredrik

0 Likes
6 Replies
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

Check this out https://community.microfocus.com/t5/CMS-UCMDB-and-UD-User/Trouble-understanding-touch-mechanism/td-p/258140.

Keep in mind that in absolutely most cases enrichment is responsible for keeping LAT updated. Check that most related enrichments having Update Last Access Time checkbox off.

Other than that, I'd recommend searching for the info in the probe DB. THere you will see what job is doing the magic. 

Regards
-Dmitry Gomel, PMP
Click the Like button at the bottom to say 'Thanks'.
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

Thanks Dima!

 

My thinking is that the update of LAT on the unix ci comes from the F5 Discovery and the configuration there. Since the target in the configuration is an IP and port that "before" lived on the specific unix ci the ipserviceendpoint is updated with LAT and I guess since the ipserviceendpoint is updated (even if nothing is listening on the ip and port) the unix CI is updated aswell. I can´t see any other explaination right now.

Not sure if this is something good which causes us to end up with nodes that aren´t up and running just because of a configuration on the F5 system.

You mentioned the probe database. Where can I search for this specific information? I got 4 more unix ci from the linux department that are "alive" in CMDB but shutdown long time ago....  they are not involved in the F5 config so this is another issue. Though, the seems to have some kind of ipserviceendpoint involved aswell...  Will try to dig in to it.

I know about the enrichments. Most of our enrichment are NOT updating the LAT, just a few.

Wbr / Fredrik

0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

@Dima Gomel

Ok, I had another server (we call it SERVER A)  that was shutdown over a year ago but still in uCMDB.

I found out that SERVER A has a composition to an ipserviceendpoint. The ipserviceenpooint seems to be updated with an LAST ACCESS TIME from a host application by shell job on another server, we call it SERVER B.

What happens here is that an application on SERVER B is trying to access the ipserviceendpoint. We can see in  the output from the netstat command:

tcp        0      1 147.186.0.1:41410    147.186.0.2:4903     SYN_SENT    5125/java

And this seems to update the LAT on the ipserviceendpoint ala 147.186.0.2:4903. Which also keep an application on SERVER A to be updated with a LAT... as well as SERVER A.

So this is keeping the SERVER A alive in uCMDB which gives us a false picture. 

Should really SERVER B be able to update LAT on an ipserviceendpoint with an composition from another SERVER (SERVER A)? 

Wbr / Fredrik

0 Likes
Highlighted
Visitor.

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

That is a very interesting find.

In order to update ipserviceendpoint discovery job needs to send a host as a container ipserviceendpoint will be connected to. So, yes. If any related CI updated on the host, the host LAT will be updated as well.

Another question, is why TCP connection job still reporting the connection to server that was shut down long time ago. I would suggest either opening a support case or trying to dubug the script on your own.

As a ugly workaround, you could clear probe DB.

 

0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

@Dima Gomel 

Actually I think the SYN SENT is actually something thats happening right now, meaning an application on SERVER B is really trying to access the ipserviceendpoint on SERVER occasionally.

Of course, we should investigate and make sure SERVER B stop trying to access the ipserviceendpoint.

But I really think it is a problem when someone is trying to access an ipserviceendpoint that are not alive and just by that is updating the LAT on the ipserviceendpoint which updates the LAT on the node CI and keeps the node CI from aging out. 

I haven´t digged into my other example as deep as this, but I think that the configuration from the load balancer is keeping the ipserviceendpoint updated with Last Access Time on a target server. Kind of the same scenario. The target server and the ipserviceendpoint is dead since months but the Load Balancer configuration has the ipserviceendpoint in the configuration and updates the LAT on the ipserviceendpoint of the target server which also updates the LAT on the target server. 

Wbr / Fredrik

Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Re: Is it possible to see what is touching a ci (and updates LastAccessTime)?

Just for information, 

I noticed 3 attributes was added in the 2018.08 release, which could help you understand what´s discovering a ci.

https://docs.microfocus.com/UCMDB/2018.08/ucmdb-docs/docs/eng/doc_lib/Content/Home/Whats_New.htm

LastDiscoveredBy

LastDiscoveredByProbe

LastDiscoveredTime

https://community.microfocus.com/t5/CMS-Idea-Exchange/We-need-to-detect-the-Last-Discovered-Time-of-a-CI/idi-p/1643533/page/3#comments

The attribute LastAccessBy attribute was also mention in this idea post but seems to be in the backlog....

I guess my unix ci that will not get aged since surrounding systems has either an client/server request or a F5 configuration of on ipserviceendpoint (that aren´t alive) is another issue.... 

Wbr / Fredrik

 

 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.