Duplicate Alert Definitions

[hshek]

I'm seeing duplicate RHQ Alert Definitions created for a subset of discovered resources.

What checks does rhq goes through to create new Alert Definitions from Alert Definition Templates?

How is it possible that sometimes I'm getting duplicate Alert Definitions created for the same resource.  In one case I got three Alert Definitions created for the same resource.

These duplicate alert definitions resulted in duplicate alerts being generated.

Any help would be greatly appreciated.

[mazz]

J.S. - I don't think we've ever had this reported. We'll need more information. Can you provide replication steps? This sounds like a pretty bad problem, especially if you have large numbers of resources that are getting duplicates. If you can replicate this, I would write up a bugzilla with the details so we can follow up: https://bugzilla.redhat.com/enter_bug.cgi?product=RHQ%20Project

[hshek]

I am running an older version of RHQ:

RHQ
version: 3.0.0
build number: 59e9341

This problem is intermitten.  The steps to reproduce is the following:

1.  Install rhq server.

2.  Import alert definitions (tempates).

3.  Install rhq agent on client servers.

4.  Wait for client resources to be discovered.

5.  For a small percentage of the client servers, their resources resulted in multiple alert definitions being created.

For example, the following is a sample of what I saw in the database tables.  Notice the rhq_alert_definition table has two records (1002, 1003) that has the same name, same parent_id, and same resource_id.

rhq_alert_definition

id,           name,                               parent_id, resource_id

1001,          my alert def1,          0,                              null

1002,           my alert def1,           1001,                     2000

1003,           my alert def1,           1001,                     2000

rhq_resource_type

id,           name,                                         category

1000,           Linux,                                         PLATFORM

2000,           My Event Plugin,           SERVER

rhq_resource

id,           resource_type_id,           name,                                                                                 agent_id,           parent_resource_id

3000,           1000,                                         MYLINUXSERVER1,                                                   1111,                     null

4000,           2000,                                         My Event Plugin (MYLINUXSERVER1),           1111,                     3000

At this stage, I'm trying to understand how the rhq server alert definition creation code works and how it's possible for duplicate alert definitions to be created.

[mazz]

> I am running an older version of RHQ:

> RHQ

> version: 3.0.0

Hmm.. ok, that is two and a half years old so I would suspect that this has been fixed in a later version (but I only say this by virtue that I can't remember anyone reporting something like this recently). Best bet might be to try, on a test machine, to install a later version and see if the problem for you goes away.

I quickly checked Bugzilla and don't see anything having been reported (whether fixed or not) on a problem like this.

The one other thing I think you can provide is more details on this step:

2.  Import alert definitions (tempates).

What were the exact steps/commands you did to do this? Perhaps something went wrong with the import (or there is a bug in the import stuff).

[hshek]

Thank you for your response.  I will take your suggestions.  I will investigate how we import our alert definition templates and see if we're doing something wrong.  In fact we didn't have any issues with duplicate alert definitions until the import code was modified.

[hshek]

Looks like the import of the alert definition templates is not the issue.  Testing is still in progress, but we've seen several cases where multiple instances of the rhq-server was running.  Not sure if this could cause multiple alert definitions to be created during resource discovery.