UNSOLVED

Isilon123

updated

10 years ago

I

Isilon123

15 Posts

0

1693

July 14th, 2016 03:00

Not getting expected result for API call - platform/2/event/events?begin=

Hi,

We are building a splunk plugin for Isilon and fetching data through Platform APIs.

On Isilon version 7.x, we are calling events API call for the given epoch time to get the events begin with that time

Eg:

/platform/2/event/events?begin=1468488325

where the epoch time 1468488325=14/07/2016 14:55:25 and the call should give the events begin with this time but in output we are getting some events which are of earlier time.

Following is the call and its output:


https://ipaddress:8080/platform/2/event/events?begin=1468488325

{

"acknowledged_time" : null,

"coalesced_by_id" : null,

"devid" : 1,

"end" : null,

"event_type" : 100010011,

"extreme_severity" : "3",

"extreme_value" : 56.0,

"id" : "1.8",

"is_coalescing" : 0,

"message" : "One or more drives (bay(s) 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60 / type(s) HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD",

"severity" : "critical",

"specifiers" :

{

"bay" : "5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60",

"devid" : 1,

"lnn" : 1,

"media_type" : "HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD, HDD",

"model" : "VMware Virtual disk, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown, Unknown",

"thresh" : 0.0,

"val" : 56

},

"start" : 1467608832,

"update_count" : 3,

"value" : 56.0

},

We are unable to understand how begin parameter works due to unexpected results.

Thanks,

Pankaj

  • 1173

    0

    Posted July 14th, 2016 10:00

    Hi Pankaj,

    What API reference document are you using?  Is it the v7.2.1 doc named docu60111.pdf?

    I'm trying to locate the right doc to look for this specific API call.  Some of the URIs change between different versions of OneFS.

    Thanks.

  • Isilon123

    15 Posts

    1173

    0

    Posted July 14th, 2016 23:00

    Thanks for the Reply RobChang,

    I need to check which document we were referring for Platform APIs.

    But generally, I prefer to first execute command https:// :8080/ ? describe which gives all the required information for that call.

    For Isilon events I executed this call and below is the piece of output for it and It is clearly described how begin parameter should work, but unfortunately when I provide epoch times with begin, though it gives less number of events in output but still results are not correct.

    ==================================================================

    /platform/2/event/events

    Overview:

      This resource applies the standard collection pattern to events.

    Method GET:

      Retrieve event information.

    Query Arguments:

      sort=

      The field that will be used for sorting.

      count=

      If true, return a count of events.

      begin=

      Specifies the earliest time to query events from.

      end=

      Specifies the latest time to query events from.

    Thanks,

    Pankaj

  • kipcranford

    125 Posts

    1173

    1

    Posted July 19th, 2016 11:00

    I've been able to reproduce this behavior on a 7.2.1 cluster:

    https:// :8080/platform/2/event/events?begin=1468488325

    ...

    ...

    "media_type" : "HDD",

    "model" : "HGST HUS724040ALA640",

    "val" : 0.0

    },

    "start" : 1468432054,

    "update_count" : 1,

    "value" : 0.0

    ...

    ...

    x210-1# perl -e 'print scalar localtime 1468488325, "\n"'

    Thu Jul 14 05:25:25 2016

    x210-1# perl -e 'print scalar localtime 1468432054, "\n"'

    Wed Jul 13 13:47:34 2016

    So on the surface this looks like a bug to me, but I'll have to consult with some of our API SMEs.  I did check OneFS 8.0, and I could not reproduce the problem.

  • Peter_Sero

    6 Operator

    •

    1169 Posts

    1173

    1

    Posted July 19th, 2016 23:00

    A long shot, but doesn't an event have a time interval [start, end] ?

    So when the event interval overlaps with the query interval,

    shouldn't the event be included? In the original example, event end

    is null, which means that the event has not yet "ended".  Thus

    it would be included with any query for "recent" events.

    cheers

    -- Peter

  • Isilon123

    15 Posts

    1173

    0

    Posted July 20th, 2016 07:00

    Hi Kip,

    The "begin" parameter is no longer supported on version 8.0 so you would not be able to verify this issue.

    Thanks,

    Pankaj

  • kipcranford

    125 Posts

    1173

    0

    Posted July 20th, 2016 07:00

    > The "begin" parameter is no longer supported on version 8.0 so you would not be able to verify this issue.

    I used this:

    https:// :8080/platform/3/event/eventgroup-occurrences?begin=1468488325

  • kipcranford

    125 Posts

    1173

    0

    Posted July 20th, 2016 07:00

    > A long shot, but doesn't an event have a time interval [start, end] ?

    Yes, events have defined intervals.

    > So when the event interval overlaps with the query interval, shouldn't the event be included?

    Well, I don't know about "should" , but it could based on the design of the feature.  My research didn't clearly indicate that this is the case.  I've asked around internally and if I find out anything I'll post it here.  Frankly I can see the logic behind including events that are or were active during the search interval.  My first thought, though, when reading about "begin" was that only events that *started* after that time would be included in results.

    Whatever the behavior, it's clear that the documentation needs some updating.