Version

Argent Advanced Technology 5.1A-2107-B and earlier

Date

Thursday, 26 Aug 2021

Summary

Outstanding events can suddenly stop being resolved automatically.

Relator trace log shows normal sequence:

Rule ‘xxxx’ is no longer broken. Reset escalation

However, the correspondent events stay outstanding.

Further inspect the Argent Console service log, it shows message ‘Could not query table ARGSOFT_AAC_ESCALATION’ every few minutes:

Click For Full Size

The issue has been addressed in Argent AT 5.1A-2107-C or later

Technical Background

It is caused by memory buffer overflow in ODBC library.

In this particular case, the column ‘EXTRA_INFO’ was allocated 32KB by default.

When a LINUX/UNIX Rule is broken with very long description, the record read operation fails.

Argent Console engine constantly reads SQL table ‘ARSOFT_AAC_ESCALATION’ in order to check if a condition has been corrected.

When engine loops through the records, if it hits the record with very long data in column ‘EXTRA_INFO’, engine stops reading further.

No events correspondent to the records after this particular bad row will be checked. As results, these events cannot be resolved automatically.

Argent AT 5.1A-2107-C is enhanced to handle this column in the same way as column ‘LONG_DESCRIPTION’, which is pre-allocated 1MB by default.

Extreme long text would be truncated to fit into the memory buffer.

Resolution

Upgrade to Argent AT 5.1A-2107-C or later.

User who could not upgrade immediately can temporarily address the issue by increase the default ODBC memory buffer size by editing registry value SOFTWARE\Argent\COMMON\ODBC_TXTBUF_IN_KB to 1024.

Note: This registry editing will increase the memory usage of Argent Console engine process. Upgrading to latest Argent AT version is the better option.