Incident Report X040802 Guessing Atom Rules

orcmid> sostegno> X040802> 0.00 2004-08-26 -16:07 -0700

Category: Incoherence - Protocol Abuse	Incident ID: X040802
Priority: 4 - Amusing	Status: Capturing Information
Subject: Atom Site Feeds, NewsGator 2.0.3.3	Repaired in: tbd
Assigned To: Dennis Hamilton	Reported By:  Dennis Hamilton (2004-08-26)
Date Opened: 2004-08-26	Date Closed: none
1. Summary 2. Remedies 3. Actions 4. Analysis 5. Lessons Learned	see also: X040801: Bad Atom Provokes Gator B040801: Blog Slamdown Procedure

1. Summary (2004-08-26):

Incident	Spanner Wingnut Site Feed Error (X040801)
2004-08-24	2004-08-23	At 2004-08-23-22:36 pdt, there was an invalid site feed for Spanner Wingnut.  The incident was corrected in 10 minutes.  Any access to the feed in that interval may have resulted in feed errors or even removal of the feed from syndication.

[Say more about what the significance of this is.]

2. Remedies (2004-08-26):  

1. Substitutions for site feeds must match the descriptive information for the original feed so that a feed reader/aggregator will not have any basis for concluding that the feed is damaged and/or should be unsubscribed.

2. Identify the permitted dependencies that feed readers may have on Atom feed elements.

3. Confirm the actual dependencies that exist and determine how those are reconciled or accomodated.

3. Actions (2004-08-26):

• 2004-08-26-16:05 Create brief initial narrative of what happened.

• Capture all materials: The feed, the screen shots, the actual rules.

• Write Expanded Description with Lessons Learned.  Show what's needed to make acceptable feed-file announcements.
• Capture the specific requirements and check deviations.  See what ways there are to know about deviations.  Provide a feedback mechanism on the blogs themselves so we can find out about such things.

4. Analysis (2004-08-26):

1. On August 23, I created a custom Atom XML file as a form of "Please Stand By" announcement for site feeds. I wanted to make a simple file that could be used in place of any feed to protect subscribers from accessing a possibly-corrupted feed.  This file would be used as part of a site incident response.

2. My file was too simple.  I removed a number of descriptive elements at the beginning of the feed, and others had been changed.  In particular, the feed <title>-element was altered.

3. I posted the altered feed as wing-atom.xml, the feed for Spanner Wingnut's Muddleware Lab.  I then ran NewsGator to see how the special-announcement feed would be retrieved by my aggregator.  I saw it report that there was one new entry.

4. When I went to the Outlook 2000 News Folder for Spanner Wingnut's Muddleware Lab, there was no new unread entry, however.  Then, when I looked in the subscription list to check the entry for Spanner Wingnut, there wasn't one.  I concluded that NewsGator removed the feed because of some difficulty with the modified stream headers.  So, after I had restored the feed file to its previous good condition, I re-subscribed.  Apart from some duplicated retrievals, the subscription was fully restored.

5. Later, I discovered more.  The subscription had not been removed, it had been replaced.  NewsGator saw the new title and spontaneously created a new News folder for "nfoCentrale Feed Standby," the new title, and used the feed source URL as the source for that feed.

6. Finally, I noticed the new feed, with its unread notice sitting there.  

7. When I ran a successful test of a feed announcement, it all worked with the restored Spanner Wingnut folder in my NewsGator News folder.  These were done by retrieving the specific feed and everything came through fine: Danger, the Please Stand By, and the All Clear.

8. The next day, I did a mass retrieve for new NewsGator News feeds and I saw a duplicate of the Danger and All Clear in my NewsGator News for the Spanner Wingnut feed.  It took me a while to figure out where those came from.  When NewsGator began to check for new entries in the "nfoCentrale Feed Standby" feed, it saw the two newer feeds, and it saw that they were for Spanner Wingnut (again).  So the items were retrieved as Spanner Wingnut items and the "nfoCentrale Feed Standby" feed was deleted from the NewsGator subscriptions!

[This will be decorated with a couple of screen shots and also made more clear with, say, a table.  There's nothing wrong here.  I didn't expect the behavior, but I didn't have any right to expect anything in particular.  I now need to find out what the specified behavior is!]]

5. Lessons Learned (tbd):

0.00 2004-08-26-14:32 Create Initial Incident Identification, Analysis, and Proposed Actions

Capture enough material so that other troubleshooting can proceed and this report can be polished later.  Manage with a  job jar.