excessive/duplicate/misleading Warnings logged from ACC-F in general, and specifically PolicyClientsGenerator script include when a Policy has no CIs at the time - Known Error

excessive/duplicate/misleading Warnings logged from ACC-F in general, and specifically PolicyClientsGenerator script include when a Policy has no CIs at the time Description When an ACC policy has a filter that doesn't have any active CIs to run for, there are excessive/duplicate/misleading warnings logs and records written to syslog table.

Excessive: - the same warnings repeat for the same policies many hundreds of times a day - most are not important enough to justify being Warning level. Using Debug level, after enabling a debug property, would be more appropriate. Duplicate: - "did not get monitored CIs for policy xxx" plus " We got no monitored CIs for table xxx and policy xxx" at the same time, for the same policy. Misleading: - "The monitored CI type is invalid for policy ...", when in fact the warning is trigged because the monitored CIs script did not return any CIs. There is nothing wrong with the CI Type (class) of the policy.

This scenario is highly likely to arise on sub-production instances, due to most ACCs being pointed to production most of the time, due to the 1 instance per ACC install restriction. Warning level should be reserved for things that really need warning about. A lot of ACC warnings are in effect debug messages.

Steps to Reproduce

Install ACC 2.10.1, but don't install any Agents Activate the out-of-box policies, and add a policy with the monitored CIs based on a script watch the syslog table for warnings from source sn_agent You will see many warnings in the app node logs and syslog table for:

Warning: PolicyClientsGenerator: The monitored CI type is invalid for policy ... Warning: PolicyClientsGenerator: We got no monitored CIs for table ... and policy ... Warning: PolicyClientsGenerator: did not get monitored CIs for policy ...

Expected behaviour: As it is common on sub-production instances to not have many Agents installed, but have the same policy and check settings cloned from production, and so these warnings should be classed as optional debug messages instead.

Workaround This problem is currently under review and has no workaround. To receive notifications when more information will become available, subscribe to this Known Error article by selecting Subscribe in the options at the top of this article. If you are able to upgrade, review the Fixed In or Intended Fix Version fields to determine whether any versions have a planned or permanent fix.

This problem is closed, and will be addressed as part of a wider change. Monitored CI code is being refactored, and most logging will be moved to an optional debug level as part of that. At the time of writing (Nov 22), this is planned for the Feb 23 ACC Framework release.