NetCool Connector is not forward Large Events (NETIQKB72052)

Large events generated in AppManager are not showing up in Netcool. Most other events show up but larger events containing a longer detail message are not showing up.

Diagnosis of the SNMP Traps being sent by the Connector shows that the Netcool Connector is not sending a full trap to the Netcool MTTRAPD probe.

To work around this issue NetIQ has updated the Netcool Connector to attempt to populate the ARP cache prior to sending any events that exceed the system MTU size.  This attempt may not work if the system in question has multiple network interfaces.  Another workaround exists of creating a static ARP cache entry for the destination server.

To create a static ARP cache entry:

1. Open a command prompt
2. Use the following command:  arp -s ip_address mac_address
   1. Note:  ip_address and mac_address should be the appropriate values for the interface on your MTTRAPD probe system

Static ARP entries are only valid until your computer is restarted.  If you utilize this workaround method you should create a batch file the with appropriate command noted above and set that batch file to run at system startup.

Windows 2003 and higher systems have issues with fragmenting UDP datagrams.  If a UDP based application such as the Connector sends multiple datagrams to a single destination without any pauses between them, some of the datagrams may be dropped if there is not ARP cache entry.  This is detailed in Microsoft's Windows Server 2003 TCP/IP Implementation Details document available at:  http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=06c60bfe-4d37-4f50-8587-8b68d32fa6ee

Formerly known as NETIQKB72052