IPLMS Portal not returning any search results

Overview

A customer reports that the IPLMS portal is not returning search results for a particular search query based on some criteria(Correlation Search). Such requests usually come from the Nodal/Analytics team of the Operator to perform Legal Queries. This article provides steps to verify if there is actually any data for the given criteria.

Pre-Requisites

As per the standard process when such requests come from the Managed Services team the following information needs to be provided at the time of ticket creation:

• All logs that belong to the Service Instance
• Tomcat logs
• Pending files Scripts output
• Recent Activities performed before the issue was raised

Solution

Steps 1 and 2 Initial checks in the GUI

Some customers may have more than 1 IPLMS Configured names Primary and Secondary IPLMS. In such cases do the following:

1. Do a Usage search from primary and secondary GUI.
2. Check if the NAT Log File path is added in both the IPLMS Portals.

Steps 3&4: Check the IPLMS Path in the Backend server

• In Search Portal, there is a text box where the Log File path information is available. Example:
• 
  
  • This will help us identify if the search instance of IPLMS is pointing to the path where the processed data is stored.
• Use the output from the textbox field and then run the following command to list the permission and folders for the specific path.:

  • ls –lrth <Folder name> 
    cd <YYYY>/<M>/<DD>/<HH>

  • Here YYYY is the Year in which data is searched, <M> is the month, <DD> is the date, and <HH> is the hour in which the search is to be run.
• Manually check the partition using the Linux 'find' command mentioned below:

  • find . -type f -iname “*.gz” |xargs zcat |grep ",<Public IP>,"|more

  • Example:
  • 
  • Note:
    • Use the Public IP for which legal queries raised by the Nodal/Analytics team 
• If the find results show a partition/path and that path is not visible in the "Log File Path" in the IO then the solution will be add the path to the IPLMS UI Configuration.

Step 5: Check the service input/error directories for unprocessed files

• If the above steps do not yield results it could be that the Service directories for services such as Collector or Parsing service could have a backlog or had moved the files to the error directory due to internal or connectivity issues.
• If there are files for a specific timestamp in the error directory then these files need to be moved back to the input directory and manually processed.
  • Example of command to search - find . -type f -iname "*2023050314*" |wc -l
  • Replace with a timestamp that the customer reported on the ticket in YYYYMMDDHH* format
• See Example Ticket: https://central-supportdesk.zendesk.com/agent/tickets/3802235
• The path of input and error directories can be found in 
• After manual processing of files request the customer to search in IPLMS UI for results.
• To manually process the file they need to be moved in batches from the error directory to the input directory of the service. If the number of files in the error path is high moving them in one shot will lead to an issue. So the customer needs to write a script to move these using a cronjob to move it based on timestamp(usually process files belonging to an hour at a time).

Exceptions - Disk full in the Log file directory

In case the directory gets full follow the attached MOP to change the point of the IP Logger service so new logs are output to this directory.

Scenario - No results

• In the 'find' command output if the given IP Address is not present on processed please report it back to the requester. 
  • This usually means the Records related to the date/IP Address were not received from the upstream device
  • As a result, the data was not processed and not present in storage. This will lead to 'null' output.

KT Notes: Example ticket review with BU - 3823583

Recording: Start from 22:00 for solution