Anonymous_User Absent Member.
Absent Member.
235 views

Where is the "Last Data Received" stored in database?


Hi,
I developed a custom report that lists the configuration data for the
connected event sources.
Customer asked me to include the "Last Data Received" information which
can already be seen from the ESM interface at the "Event Source Status"
window ( "Status" selection of the menu that appears by right-clicking
on to the event source icon) .
Is this info stored in the postgresql database? If yes in which
table/column?
Thanks.


--
hkalyoncu
------------------------------------------------------------------------
hkalyoncu's Profile: http://forums.novell.com/member.php?userid=63527
View this thread: http://forums.novell.com/showthread.php?t=451823

0 Likes
6 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I do not think it is stored in the database, even when PostgreSQL is
used as the data store (which is only the case in Sentinel RD). As a
result I would guess you would just search for the last event that the
system received from the collector/connector/event-source based on that
UUID.

Why they want one arbitrary, not determined to be useful in any way
event in a report with configuration data is beyond me. Is this really
what they want?

Good luck.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPLZrbAAoJEF+XTK08PnB5yNAP/04Cp8C9fhqJN972mzIHBog4
JHJAa08Gtyv6Xx1Ez8oWITkNgv4Q7w96UwuNCsqVnDI3xz766RtMjA7kphB4nccO
VZNTQB+ZNfr1JXERU899PYCUWzkteRATMfqGaN4gIRMbl9Sw0MQak2M+006Zb6sL
4xftCVFdHSYfeTewShdZSLGzj1G4iA00dFE9V2sISZjNiAK8DZL7uCFHYV5VHiId
LpkAzxg6FbovOjwDcCPusnmtHcRoRjnG3w1oTgPGcl23TOMOzW7yz8bCftT+6iQZ
YYut1G2CMDz4CPEW6BrU6QCQKjnPCRmlpOZc3IvX0J2vQzBgn/OyxnPlmmn7VvmP
59cDkSsqapEqOuxTADW3kK9XiVTKzOO3f7S1YrnfGodxw2C58j/nXVS2twNly9wy
F0K2UmWjrCqYEkqOSEjrx6nFgXwBnag7sq4mOrm3plykJqaJNdkreeTDqzM/h1xy
+dutOWt7NRxsJYvZUhwQCFOUPtxXMjm/P7uauX66efxu6hwzQpB7RcFKvW/+aThW
RCUWHDP8Ze7Y+1XZ8F4G5QOtZSpHofgKZpv3UCsV9hpgRubvRFyno6wnQMPgezXC
I8pEzP31Ja2/E/rmhwQpPFpvF3nd74dlIo6+1DCI5EF6YZBjHQ3seGxNHj8W4I27
mhhbr/m6cSbpuPOtvj0N
=zb9V
-----END PGP SIGNATURE-----
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?


In fact for most of the connectors (such as dbase and file) I can get
the time from the offset table.

This is a report listing the event sources and they want to see the
event sources with no data received for a long time.

Since this is an SLM report and lists configuration data from
postgresql, I cannot search from event data for the last event
received!

As I wrote before, this information is shown in the Event Source Status
window of the ESM interface, therefore it is strange that it is not
stored anywhere.


--
hkalyoncu
------------------------------------------------------------------------
hkalyoncu's Profile: http://forums.novell.com/member.php?userid=63527
View this thread: http://forums.novell.com/showthread.php?t=451823

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> In fact for most of the connectors (such as dbase and file) I can
> get the time from the offset table.


Sure, because an offset makes sense to keep across restarts of a node
and will only be updated when a file is read or when a database is
database event source is shut down.

> This is a report listing the event sources and they want to see the
> event sources with no data received for a long time.


Ah, so you really don't care about the last event, you want to know
about event sources not receiving events. Have you tried enabling
alerts on the event sources or collectors or something? If you do not
receive events regularly then the system generates an alert (internal
event) on which you can then report. Also, as a benefit, is you can
report on many of these (not just the current omission of data, but all
of them for the last customized period of time). You could also have
other things watch for these and then act based on an omission of data.

> Since this is an SLM report and lists configuration data from
> postgresql, I cannot search from event data for the last event
> received!


Sure you can search for an event, but not from the database. Report
from data in the Lucene-based data store as all of the other reports do.

> As I wrote before, this information is shown in the Event Source
> Status window of the ESM interface, therefore it is strange that it
> is not stored anywhere.


Right, but since the "last event which came in" could be changing
hundreds of times per second writing to the database would be a huge
mistake. This is probably stored in memory and then only written to the
database (in the case of an offset) on shutdown of the event source
since that is the only time it will ever leave memory. At best
something like this may be written to the database at a predetermined
interval to keep from killing the system with worthless writes to the
database hundreds of times per second.

Either way, I think what you really want is doable a better way by
setting up alerts and reporting on those directly from the datastore, or
even skipping the report and instead having the system notify you ahead
of time about the missed event so you're not waiting for the report that
comes tomorrow and is twenty-four hours out of date.

Good luck.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPLai9AAoJEF+XTK08PnB5ANcP/0nmPj5GeyaHe6bScSeLlQML
fHMiDWWBPQn357kMS4KtQJSgd9t1SPIjTrUJVmiq9F5a1UBU5b2x3v0tV6UKaTwu
oTyRltGUtZq171MVeBgh9VJeBbXNOujaIhyu12q5dLhxI/rARPUTerVPB+KnrlG9
OEEJw2FmsZNfDkKJRE1EdMlpmjXJho1d9S36z/FP1Ker2bOmpeKyjZyXEGJ10mTN
05YPdC3paaTyxksSsH/L8fNxYcSkNo1WmcILz6Qdc5xzCZPg1LcuMS1ga8Va2dvu
luFCyg0jTbkjycBq5WrY7cJY/pH1dW+mPQFwzSKseZXtzHFxW+rCE4O9Vmt8yxgG
Ktfy1EHRVURZxsF3Dt13jtdiGGa5UFVnGZZB2ZF6YltxkebEOtrZti7monxuJrMC
ffLCvKU5Q2G+naHa5xtmpGruzxA0Fkzmsa/yNexkZgHM5FtuA/3b+b9z7QanFPjF
d5oUbsUQr10+yy5n35BVZrY5+bF3IgzIubm23cZEuLVjcmUW10W36ndVf4mcP0AR
sm8Qm5FuJg7BCAsW+46mMHXZZ89DxeV8REaYTzGIPTqoqzvGJDDLhk6cIXrRAib3
YT/W7Pu/DpDZbmBvqzBpljQMbyNWg4ajRyXC58aysMi8rERKo9KapbtmjcRoa9wW
wKl12JYYvJa3PTijKROd
=MofR
-----END PGP SIGNATURE-----
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?


ab;2173367 Wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > In fact for most of the connectors (such as dbase and file) I can
> > get the time from the offset table.

>
> Sure, because an offset makes sense to keep across restarts of a node
> and will only be updated when a file is read or when a database is
> database event source is shut down.
>
>
> > This is a report listing the event sources and they want to see the
> > event sources with no data received for a long time.

>
> Ah, so you really don't care about the last event, you want to know
> about event sources not receiving events. Have you tried enabling
> alerts on the event sources or collectors or something? If you do not
> receive events regularly then the system generates an alert (internal
> event) on which you can then report. Also, as a benefit, is you can
> report on many of these (not just the current omission of data, but
> all
> of them for the last customized period of time). You could also have
> other things watch for these and then act based on an omission of
> data.
>


I am aware of all of your suggestions but it is not me but the customer
who wants to get this info as a column of the events sources
configuration report that I already have developed.

Moreover, he has an impression that this alert mechanism is not stable
and unfortunately I don't have any means to prove that it is stable!
Do you?

ab;2173367 Wrote:
>
> > Since this is an SLM report and lists configuration data from
> > postgresql, I cannot search from event data for the last event
> > received!

>
> Sure you can search for an event, but not from the database. Report
> from data in the Lucene-based data store as all of the other reports
> do.
>


Again, I know that I can search for an event from the Lucene data store
but as I wrote before the customer wants to see that info as a column of
the event source configuration report which gets all its data from the
postgresql database. Afaik we cannot query both databases within a
single report, right?

ab;2173367 Wrote:
>
> > As I wrote before, this information is shown in the Event Source
> > Status window of the ESM interface, therefore it is strange that it
> > is not stored anywhere.

>
> Right, but since the "last event which came in" could be changing
> hundreds of times per second writing to the database would be a huge
> mistake. This is probably stored in memory and then only written to
> the
> database (in the case of an offset) on shutdown of the event source
> since that is the only time it will ever leave memory. At best
> something like this may be written to the database at a predetermined
> interval to keep from killing the system with worthless writes to the
> database hundreds of times per second.
>


I understand your concern, but I would like to see that it is for sure
not stored in the database so that I can use this argument.

ab;2173367 Wrote:
> Either way, I think what you really want is doable a better way by
> setting up alerts and reporting on those directly from the datastore,
> or
> even skipping the report and instead having the system notify you
> ahead
> of time about the missed event so you're not waiting for the report
> that
> comes tomorrow and is twenty-four hours out of date.
>


Again it is not me who wants this but the customer. And I really don't
care whether they missed event while waiting for the report or not. I am
just trying to finalize the project and get the acceptance.

Thanks...

ab;2173367 Wrote:
> Good luck.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.18 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - 'Enigmail: A simple interface for
> OpenPGP email security' (http://enigmail.mozdev.org/)
>
> iQIcBAEBAgAGBQJPLai9AAoJEF+XTK08PnB5ANcP/0nmPj5GeyaHe6bScSeLlQML
> fHMiDWWBPQn357kMS4KtQJSgd9t1SPIjTrUJVmiq9F5a1UBU5b2x3v0tV6UKaTwu
> oTyRltGUtZq171MVeBgh9VJeBbXNOujaIhyu12q5dLhxI/rARPUTerVPB+KnrlG9
> OEEJw2FmsZNfDkKJRE1EdMlpmjXJho1d9S36z/FP1Ker2bOmpeKyjZyXEGJ10mTN
> 05YPdC3paaTyxksSsH/L8fNxYcSkNo1WmcILz6Qdc5xzCZPg1LcuMS1ga8Va2dvu
> luFCyg0jTbkjycBq5WrY7cJY/pH1dW+mPQFwzSKseZXtzHFxW+rCE4O9Vmt8yxgG
> Ktfy1EHRVURZxsF3Dt13jtdiGGa5UFVnGZZB2ZF6YltxkebEOtrZti7monxuJrMC
> ffLCvKU5Q2G+naHa5xtmpGruzxA0Fkzmsa/yNexkZgHM5FtuA/3b+b9z7QanFPjF
> d5oUbsUQr10+yy5n35BVZrY5+bF3IgzIubm23cZEuLVjcmUW10W36ndVf4mcP0AR
> sm8Qm5FuJg7BCAsW+46mMHXZZ89DxeV8REaYTzGIPTqoqzvGJDDLhk6cIXrRAib3
> YT/W7Pu/DpDZbmBvqzBpljQMbyNWg4ajRyXC58aysMi8rERKo9KapbtmjcRoa9wW
> wKl12JYYvJa3PTijKROd
> =MofR
> -----END PGP SIGNATURE-----



--
hkalyoncu
------------------------------------------------------------------------
hkalyoncu's Profile: http://forums.novell.com/member.php?userid=63527
View this thread: http://forums.novell.com/showthread.php?t=451823

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?


Hakan,

Which platform are you using? Is this SLM or Sentinel 7, or what?


--
DCorlette
------------------------------------------------------------------------
DCorlette's Profile: http://forums.novell.com/member.php?userid=4437
View this thread: http://forums.novell.com/showthread.php?t=451823

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Where is the "Last Data Received" stored in database?


DCorlette;2177148 Wrote:
> Hakan,
>
> Which platform are you using? Is this SLM or Sentinel 7, or what?


I am trying to get this info from SLM. All other fields of the report
come from configuration (postgresql).


--
hkalyoncu
------------------------------------------------------------------------
hkalyoncu's Profile: http://forums.novell.com/member.php?userid=63527
View this thread: http://forums.novell.com/showthread.php?t=451823

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.