-
Titre
EMC or NetApp NAS have duplicate events in Coordinator when multiple agents included in the audit template -
Description
When using two Remote Agents and two Coordinators for HA purpose, on EMC and NetApp, duplicate events are found in the logs. -
Cause
On EMC (NetApp has the same issue), when auditing File opens, up to four events (scan requests) from the filer is collected.
So, with 1 Agent, only 1 file open events should be collected as Change Auditor run consolidation rule against all incoming events (10 seconds is the default). So when only 1 Agent is used in the Template, the issue should be masked - The 3 duplicates are suppressed.
However, with 2 Agents, the EMC filer will round-robin the events so the Agents will get 2 events each. Since consolidation occurs at the Agent level, 2 events should be added in the database for the same change.
The only way to get rid of this limitation is if EMC/NetApp modify their audit subsystem and only produce 1 event (scan request) for the change itself and not send as many duplicates.
-
Résolution
Customers should log an enhancement request with EMC or NetApp so they update their code to reduce the number of 'File Open' scan request generated.
That would be the proper way to solve the issue since CA Agent is simply processing the events (scan requests) sent from the filer.