Troubleshooting
Problem
IBM APM 8.1 OS agent is sending events to Event Integration Facility receiver, with hostname field populated with an IP address, instead of actual agent's hostname.
Symptom
1)
Here is an example of an EIF event taken from the pdcollect data collected from the OS agent; it shows that an IP address is being provided as the value of the hostname slot, instead of the hostname that is used in the agent's managed system name:
EIFE: <EIFEVENT><TMZDIFF>-28800</TMZDIFF><TENANTID>5ABE-3FCF-4F36-230D-1C4E-0731-F9DD-7E33</TENANTID><HOSTNAME>[hostname here]</HOSTNAME><IPADDRESS></IPADDRESS><NODENAME>[hostname here]:LZ</NODENAME><PRODUCT>LZ</PRODUCT><VERSION>06.35.14</VERSION><EIFDATA><![CDATA[ITM_Linux_System_Statistics;source='ITM Agent: Private Situation';sub_source='[hostname here]:LZ';situation_name='avq_reboot_rlzc_redhat_std';situation_type='S';situation_origin='[hostname here]:LZ';situation_origin_uuid='xxxxxx';situation_time='02/10/2020 15:00:01.000';situation_status='Y';situation_thrunode='[hostname here]:LZ';integration_type='U';appl_label='A:P:S';hostname='[IP address here]';origin='xxxxx';adapter_host='xxxxx';severity='F
EIFE: <EIFEVENT><TMZDIFF>-28800</TMZDIFF><TENANTID>5ABE-3FCF-4F36-230D-1C4E-0731-F9DD-7E33</TENANTID><HOSTNAME>[hostname here]</HOSTNAME><IPADDRESS></IPADDRESS><NODENAME>[hostname here]:LZ</NODENAME><PRODUCT>LZ</PRODUCT><VERSION>06.35.14</VERSION><EIFDATA><![CDATA[ITM_Linux_System_Statistics;source='ITM Agent: Private Situation';sub_source='[hostname here]:LZ';situation_name='avq_reboot_rlzc_redhat_std';situation_type='S';situation_origin='[hostname here]:LZ';situation_origin_uuid='xxxxxx';situation_time='02/10/2020 15:00:01.000';situation_status='Y';situation_thrunode='[hostname here]:LZ';integration_type='U';appl_label='A:P:S';hostname='[IP address here]';origin='xxxxx';adapter_host='xxxxx';severity='F
2)
<hostname>_lz_klzagent_<timestamp>.log file shows:
kraarpc.cpp,724,"IRA_DeriveHostname") Derived <[IP address here]> as the hostname.
...
krabvald.cpp,110,"KRA_ValidateNodeNameSubstr") Validation of node name substring "IRA_SetHostname" with value "[IP address here]" is successful.
krabvald.cpp,124,"KRA_ValidateNodeNameSubstr") Exit: 0x0
kraafmgr.cpp,1455,"IRA_SetHostname") Setting hostname to [IP address here].
kraarpc.cpp,724,"IRA_DeriveHostname") Derived <[IP address here]> as the hostname.
...
krabvald.cpp,110,"KRA_ValidateNodeNameSubstr") Validation of node name substring "IRA_SetHostname" with value "[IP address here]" is successful.
krabvald.cpp,124,"KRA_ValidateNodeNameSubstr") Exit: 0x0
kraafmgr.cpp,1455,"IRA_SetHostname") Setting hostname to [IP address here].
Cause
Possible cause is that, on the OS agent machine, the IP address reported in events cannot be resolved via the "Domain Name Server" (DNS), so in that case, it's the IP address that is used and populated in the 'hostname' slot.
Environment
APM 8.1.4
OS agent
Event Integration Facility (EIF) receiver
Netcool Omnibus
Diagnosing The Problem
On the OS agent machine, launch command like:
$> nslookup <IP_address>
Example
$> nslookup 193.2.2.1
Where 193.2.2.1 is the IP address seen in events after 'hostname=xxxx' field.
Resolving The Problem
If the nslookup command failed to return the valid hostname, fix this issue in the DNS settings. Then check again EIF events content.
Document Location
Worldwide
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSVJUL","label":"IBM Application Performance Management"},"Component":"OS agent","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"8.1.4","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Historical Number
TS003335676
Product Synonym
APM
Was this topic helpful?
Document Information
Modified date:
18 February 2020
UID
ibm11956759