• State Not Answered
  • Replies 5 replies
  • Subscribers 20 subscribers
  • Views 1262 views
  • Users 0 members are here
Options
Related

Change Auditor Agent Slow ingesting NetApp Filer Events

geoff cranenburgh
10 months ago

We have a NetApp Agent pointing to a filer. The agent is reporting very few events (between 5 and 20 events) even though we can see in the logs that there are at least 960 events queued. The Agent does not appear to Forward the events to the Coordinator, as seen from the Agent Status. However, we see the events from the client almost instantly. The Agent eventually slows down to a point of stopping to register NetApp events, even though the memory does not appear to be an issue; nor does the Agent itself stop.

The template is configured correctly and is running in Cluster mode, the FPolicy appears to be correct and the polling settings appear to be correct as do the credentials.

It looks like there is a buffering / capacity issue between the Agent and the Filer. So, my question is do I need to start looking at setting the NetAppFPolicySendBufferSize? 

Thanks - Geoff

Version of Change Auditor: 7.3

Version of ONTAP: 9.7

  • 0 10 months ago
    geoff cranenburgh said:
    The agent is reporting very few events (between 5 and 20 events) even though we can see in the logs that there are at least 960 events queued. The Agent does not appear to Forward the events to the Coordinator, as seen from the Agent Status. However, we see the events from the client almost instantly.

    You're going to have to explain this better as I am having a hard time understanding where you are seeing these various things.

    On the one hand you said "the agent is reporting very few events" but then you turn around and say "we see events from the client almost instantly" - which client are you referring to here?

    And where are you seeing the events queued?

    "The Agent does not appear to Forward the events to the Coordinator" - the events are sent to the database, not the Coordinator.  What are you seeing in the agent log (not the Coordinator log) around the forwarding of events?  If there's a lag, it's going to be either on the agent side or possibly SQL (the SQL server is busy).


  • 0 10 months ago

    Also a question:  Where do you have the proxy agent for your NetApp installed?  Not on the Coordinator I hope?  (Unless the Coordinator is a very beefy machine)

  • 0 10 months ago in reply to JohnnyQuest

    Hi, The agent logs report: "NetApp Cluster Snk (enqueue counter) total 1791 events, 7.11 events per second (period (300 seconds) 4.55 events per second (avg) 64.66 events per second (max)". This is consistent with what the users are actually doing. But on the Agent's status panel it indicates 18 events. It climbs very slowly and eventually stops. The logs however continue to indicate that the total events are incresing. The Agent service does not hang and there is no issue with memory on the agent. When you log onto the Windows Client (installed on the Coordinator) you can see these 18 events that are shown on the Agent's Status panel. This is nowhere near the events that we know are actually created by the user or shown in the Agent log. Hope that provides you with a clearer picture.

  • 0 10 months ago in reply to JohnnyQuest

    The Proxy Agent is a stand-alone server. The template is configured to use just this proxy in cluster mode. We will eventually end up with two stand-alone agents load balancing each Filer.

  • 0 10 months ago in reply to JohnnyQuest

    Many thanks for your response, yes indeed the Events are going to the SQL Server. However, not all the events are reaching the SQL Server. When you query the for NetApp Events form the client (installed on the coordinator), you can only find the number of NetApp avents that are seen on the Agent's Status Panel which I'm assuming are the events that have actually reached the SQL Server. The Agent Log however, as stated below  indicates that there are far more events that are not showing up on the Agent's Status Panel.