Archived community.zenoss.org | full text search
Skip navigation
Up to Discussions in zenoss-users
101571 Views 12 Replies Latest reply: Dec 2, 2009 6:34 PM by nelliott RSS
nelliott Rank: Green Belt
nelliott
83 posts since
Sep 10, 2009
Currently Being Moderated

Nov 25, 2009 12:05 PM

Cannot view trap details in Event Console?

When I double click on events from a few device manufactuers, the event console detail window opens but is blank and I get a connection error message.


The event.log shows this:

 

2009-11-24 15:13:32,951 ERROR Zope.SiteErrorLog: http://headend.gci.com:8080/zport/dmd/Events/evconsole_router
Traceback (innermost last):
  Module ZPublisher.Publish, line 119, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 42, in call_object
  Module Products.ZenUtils.Ext, line 107, in __call__
  Module Products.ZenUtils.json, line 49, in json
  Module simplejson, line 230, in dumps
  Module simplejson.encoder, line 200, in encode
  Module simplejson.encoder, line 260, in iterencode
UnicodeDecodeError: 'utf8' codec can't decode bytes in position 1-2: invalid data


If I locate that event in the database and look at the details, they look something like this:

 

mysql> select * from detail where evid='441acf7d-afb8-4ed4-a5c4-73e806dcfbc1';
+--------------------------------------+----------+------------------------------------------+---------------------------------------------------------------------+
| evid                                 | sequence | name                                     | value                                                               |
+--------------------------------------+----------+------------------------------------------+---------------------------------------------------------------------+
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | community                                | public                                                              |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises                              | 150                                                                 |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.1.4.14.1.1.1.1.2.3 | 1                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.1.4.14.1.2.1.1.2.3 | 1                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.1.4.14.1.3.1.1.2.3 | 2                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.1.4.14.1.4.1.1.2.3 | 3                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.1.0          | Ù
                                                                                                -                                                             |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.2.0          | 1                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.3.0          | Ù
                                                                                                -                                                              |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.4.0          | 65                                                                  |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.5.0          | 4                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.6.0          | 4                                                                   |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.7.0          | Optical transport unit severely errored seconds threshold exceeded. |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.8.0          | 33                                                                  |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.1.1.9.0          | 150                                                                 |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | enterprises.18070.2.2.2.4.1.0            | 4549                                                                |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | oid                                      | 1.3.6.1.4.1.18070.2.2.2.1.1.9.0                                     |
| 441acf7d-afb8-4ed4-a5c4-73e806dcfbc1 |     NULL | sysUpTimeInstance                        | 68343831                                                            |
+--------------------------------------+----------+------------------------------------------+---------------------------------------------------------------------+

The offending lines here are the ones with the odd "Ù" character.  If I manually delete those 2 lines from that event in the database, then it allows me to open the event details for THAT SPECIFIC event in the event console.


According to the manufacturer MIB the OIDs are for event Date and Time.


I wonder if I am missing a unicode decoder package or something..??  Any ideas?

  • guyverix ZenossMaster
    guyverix
    846 posts since
    Jul 10, 2007
    Currently Being Moderated
    1. Nov 26, 2009 3:26 AM (in response to nelliott)
    Re: Cannot view trap details in Event Console?

    You are going to have to run a transform on them before the details can be displayed.  I do NOT believe that what I am pasting here will make this give the correct data time format, but I think it might transform the characters enough that you might not get the error anymore.

     

     

    evt.enterprises.18070.2.2.2.1.1.1.0 = ":".join(map(lambda c: "%02x" % ord(c), evt.enterprises.18070.2.2.2.1.1.1.0))

     

    Do that for both of the OID's that are giving you trouble.

     

    As an FYI, this was posted somewhere in the forums for people who were getting unprintable characters in MAC addresses.  Thats why I dont believe it will work in desplaying the correct date time values, but should give you printable characters.

     


  • Andrea Consadori ZenossMaster
    Andrea Consadori
    863 posts since
    Feb 11, 2008
    Currently Being Moderated
    2. Nov 26, 2009 5:08 AM (in response to nelliott)
    Re: Cannot view trap details in Event Console?

    hi, i've the same issue

     

     

    2009-11-26T11:01:55 ERROR Zope.SiteErrorLog http://ipmonitoring.lais.it:8080/zport/dmd/Groups/Lais/evconsole_router
    Traceback (innermost last):
      Module ZPublisher.Publish, line 119, in publish
      Module ZPublisher.mapply, line 88, in mapply
      Module ZPublisher.Publish, line 42, in call_object
      Module Products.ZenUtils.Ext, line 107, in __call__
      Module Products.ZenUtils.json, line 49, in json
      Module simplejson, line 230, in dumps
      Module simplejson.encoder, line 200, in encode
      Module simplejson.encoder, line 260, in iterencode
    UnicodeDecodeError: 'utf8' codec can't decode byte 0xc3 in position 127: unexpected end of data

     

     

    but with tons of event (always snmp trap from different vendor).

     

    how can i locate event in database to make the workaround?

     

    i see this ticket http://dev.zenoss.com/trac/ticket/5795

     

    but i only know the name of the device that give me the issue, not the exact event

  • guyverix ZenossMaster
    guyverix
    846 posts since
    Jul 10, 2007
    Currently Being Moderated
    3. Nov 26, 2009 5:28 AM (in response to Andrea Consadori)
    Re: Cannot view trap details in Event Console?

    Maybe this will work:

    select * from detail where value REGEXP ! '^[A-Z a-z 0-9]';

  • Andrea Consadori ZenossMaster
    Andrea Consadori
    863 posts since
    Feb 11, 2008
    Currently Being Moderated
    4. Nov 26, 2009 5:46 AM (in response to guyverix)
    Re: Cannot view trap details in Event Console?
    i don't see nothing strange
    Attachments:
  • guyverix ZenossMaster
    guyverix
    846 posts since
    Jul 10, 2007
    Currently Being Moderated
    5. Nov 26, 2009 6:03 AM (in response to Andrea Consadori)
    Re: Cannot view trap details in Event Console?
    Nor do I, however I have never used a regex like that before in MySQL, perhaps someone else can confirm that the syntax is correct  for the query..  There just has to be a decent way to tell MySQL to match all non-alphanumeric characters.

    andrea.consadori wrote:

     

    i don't see nothing strange
  • nelliott Rank: Green Belt
    nelliott
    83 posts since
    Sep 10, 2009
    Currently Being Moderated
    6. Nov 26, 2009 1:16 PM (in response to guyverix)
    Re: Cannot view trap details in Event Console?

    I think I understand what the goal is here... but the transform window turns red when I try to save this...I don't know enough python to understand what is wrong with the syntax.  Any ideas?

     

    I will continue to see if I can figure this out.  I also tried just using a simple transform to set the value to zero...but it will not even accept:  evt.enterprises.18070.2.2.2.1.1.1.0=0

     

    Do you have any idea on the root cause of this problem?  I am wondering how I can determine if the devices are sending bogus data, or if Zenoss is stumbling over something valid...

  • nelliott Rank: Green Belt
    nelliott
    83 posts since
    Sep 10, 2009
    Currently Being Moderated
    7. Nov 26, 2009 1:46 PM (in response to nelliott)
    Re: Cannot view trap details in Event Console?

    The following syntax works to set the offending OID attribute data to zero:

     

    setattr(evt,'enterprises.18070.2.2.2.1.1.1.0',0)
    setattr(evt,'enterprises.18070.2.2.2.1.1.3.0',0)

     

    Thanks for the input, it's nice to at least have a hack/workaround for now. 

  • nelliott Rank: Green Belt
    nelliott
    83 posts since
    Sep 10, 2009
    Currently Being Moderated
    8. Nov 26, 2009 1:55 PM (in response to Andrea Consadori)
    Re: Cannot view trap details in Event Console?

    Are you able to open the event console to view the event summaries and times, or is your event console completely broken?  It sounds like some people are experiencing a different variation of this problem where the event console won't connect at all....

     

    If you can open the event console and view the summaries, but cannot double-click for details then here is how I isolated the problem OID:

     

    Close (the circle with the X that moves them to history) all events EXCEPT the one that is "broken", then logging into mysql and doing:

     

    "select evid from status;" (This will give you the evid for the "broken" event.  If you get more than one result, you have more than one current event)

     

    Then:  "select * from detail where evid='xxxx-xxxx-xxxx-xxxx-xxxx';"  (Your evid goes in place of the xxxx's)

     

    This should give you all the event details and you can spot the lines with funky data and record the OIDs to transform.

  • Andrea Consadori ZenossMaster
    Andrea Consadori
    863 posts since
    Feb 11, 2008
    Currently Being Moderated
    9. Nov 29, 2009 7:07 AM (in response to nelliott)
    Re: Cannot view trap details in Event Console?
    with some device where i've trap event i can see the event summary, with other device event console is totally broken and as soon i click on event console view i've server connecction error
  • nelliott Rank: Green Belt
    nelliott
    83 posts since
    Sep 10, 2009
    Currently Being Moderated
    10. Nov 29, 2009 11:04 AM (in response to Andrea Consadori)
    Re: Cannot view trap details in Event Console?

    Andrea - It sounds like you have been able to identify a specific device that causes your problem.  You may be able to learn more by logging into mysql and running:

     

    select evid from status where device='<PROBLEM_DEVICE>' limit 5;

     

    This should give you a sample of 5 Event IDs for that device.  You could then run:

     

    select * from detail where evid='<ONE-OF-THE-EVIDS-FROM-PREVIOUS-QUERY>';

     

    This should give you a full display of all of the trap data, and hopefully provide a clue about which part of the trap is causing a decode problem.

  • Andrea Consadori ZenossMaster
    Andrea Consadori
    863 posts since
    Feb 11, 2008
    Currently Being Moderated
    11. Nov 30, 2009 2:41 AM (in response to nelliott)
    Re: Cannot view trap details in Event Console?

    hi, thank for you usefoul tips.

     

    now i can see my event detail but the only strange issue a notice that i've empty event... it's normal?

     

    mysql> select evid from status where device='ServerExchange' limit 10
        -> ;
    +--------------------------------------+
    | evid                                 |
    +--------------------------------------+
    | 178d5eb8-7106-4c89-9e04-d17e1e096af0 |
    | 4fcacaca-3075-4b1a-876a-427a55408b1a |
    | ac06687e-e17c-4d0b-ad9f-4fc4c1be6eb1 |
    | e2e696bb-4be3-4a50-9f22-cc41bb362f91 |
    | 8c969a03-a3b8-4b68-91e1-d7c5f77570da |
    | 34a51d4e-4ca8-4006-81f7-51c53351b548 |
    | 266bc411-9b72-488e-836e-8d27d4e1ee82 |
    | 5c396832-f014-463d-a3a7-e5f7f160a20b |
    | 31055d4d-ba25-4e4c-8e99-f6cf1c69fa5d |
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |
    +--------------------------------------+
    10 rows in set (0.00 sec)


    mysql>  select * from detail where evid='34a51d4e-4ca8-4006-81f7-51c53351b548';
    Empty set (0.00 sec)

     

    all other events have detail like that

     

    mysql>  select * from detail where evid='b9b8495a-42c9-4059-937f-e23fc530b0d8';
    +--------------------------------------+----------+-----------------+---------------------------+
    | evid                                 | sequence | name            | value                     |
    +--------------------------------------+----------+-----------------+---------------------------+
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |     NULL | categorystring  | None                      |
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |     NULL | computername    | ServerExchange.LAIS.local |
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |     NULL | eventidentifier | 1058                      |
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |     NULL | originaltime    | 2009/11/24 14:50:28       |
    | b9b8495a-42c9-4059-937f-e23fc530b0d8 |     NULL | user            | NT AUTHORITY\SYSTEM       |
    +--------------------------------------+----------+-----------------+---------------------------+
    5 rows in set (0.00 sec)

  • nelliott Rank: Green Belt
    nelliott
    83 posts since
    Sep 10, 2009
    Currently Being Moderated
    12. Dec 2, 2009 6:34 PM (in response to Andrea Consadori)
    Re: Cannot view trap details in Event Console?
    I don't see any latin characters in your event detail (that is what is causing my problem) so unless they just didn't cut-and-paste well, maybe you have found a different bug with the event console.    I have no experience monitoring windows servers, so can't comment on if that event detail looks normal, sorry.

    *edit* - If anyone else has problems with latin characters in the event details and is interested, I opened a ticket: http://dev.zenoss.com/trac/ticket/5883

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points