Académique Documents
Professionnel Documents
Culture Documents
Users Guide
V ersion 3.9
SC32-1235-00
Users Guide
V ersion 3.9
SC32-1235-00
Note Before using this information and the product it supports, read the information in Notices on page 107.
First Edition (August 2003) This edition applies to version 3 release 9 of IBM Tivoli Enterprise Console (product number 5698-TEC) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2003. All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
Contents
About this guide . . . . . . . . . . . v
Who should read this guide . . . . . . . . . v Publications . . . . . . . . . . . . . . v IBM Tivoli Enterprise Console library . . . . . v Related publications . . . . . . . . . . vi Accessing publications online . . . . . . . vi Ordering publications . . . . . . . . . . vii Contacting software support . . . . . . . . vii Participating in newsgroups . . . . . . . . . vii Conventions used in this guide . . . . . . . viii Typeface conventions . . . . . . . . . . viii Operating system-dependent variables and paths ix IBM Tivoli Enterprise Console icons . . . . . . ix Configuring custom buttons for an event console Exporting and importing event console definitions . . . . . . . . . . . . . . Managing Tivoli region definitions for the Web version of the event console . . . . . . . . . Tuning the performance of the Web version of the event console . . . . . . . . . . . . . . Backing up and tuning the event database . . . . Stopping and starting the event server . . . . . 33 38 38 41 42 42
Chapter 1. Overview . . . . . . . . . 1
Highlights of the 3.9 release . . . . . . . . . 1 Unified system and network management . . . 1 Optimized event management for key e-business applications. . . . . . . . . . . . . . 2 Components of the Tivoli Enterprise Console product 3 Adapter Configuration Facility . . . . . . . 4 Event adapter . . . . . . . . . . . . . 4 Tivoli Event Integration Facility . . . . . . . 6 Tivoli Enterprise Console gateway . . . . . . 6 Tivoli NetView . . . . . . . . . . . . 6 Event server . . . . . . . . . . . . . 6 Event database . . . . . . . . . . . . 8 User interface server . . . . . . . . . . . 8 Event console . . . . . . . . . . . . . 9 Events . . . . . . . . . . . . . . . . 14 Internal events . . . . . . . . . . . . 14 Event flow. . . . . . . . . . . . . . 15
. . . . . 51
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 51 52 52 53 53 54 54 54 54 55 56 56 56 57 57 57 59 59 61 61 61 61 62 62 62 62 63
. . . . . . . . . . . . . . . .
19 19 20 20 21 22 22 22 23 24 26 26 26 27 28 29 29
. 29 . 33
Key concepts for event management . . . . Event status . . . . . . . . . . . Event severity . . . . . . . . . . Primary operator tasks . . . . . . . Using the Java version of the event console. . Starting the event console . . . . . . Exiting the event console . . . . . . . Viewing events . . . . . . . . . . Acknowledging events . . . . . . . Running tasks . . . . . . . . . . Running local commands . . . . . . . Closing events . . . . . . . . . . Starting the Tivoli NetView component . . Opening a trouble ticket . . . . . . . Viewing event information . . . . . . Viewing event properties . . . . . . . Customizing the event viewer . . . . . Using the Web version of the event console. . Overview of the Web version of the event console . . . . . . . . . . . . . Starting the Web version of the event console Exiting the event console . . . . . . . Viewing events . . . . . . . . . . Acknowledging events . . . . . . . Running tasks . . . . . . . . . . Closing events . . . . . . . . . . Viewing a summary of events . . . . . Opening a trouble ticket . . . . . . . Viewing event information . . . . . .
iii
. .
. .
. .
. .
. .
. 63 . 63
Problems starting the Tivoli Enterprise Console product. . . . . . . . . . . . . . . . Problems with rules . . . . . . . . . . . Enabling rule tracing . . . . . . . . . . Tuning rules . . . . . . . . . . . . . Problems with the RIM database . . . . . . . Analyzing Tivoli Management Framework trace logs Problems with the Tivoli Enterprise Console gateway . . . . . . . . . . . . . . . Problems with the tec_gateway program . . . Problems with the tec_gwr program . . . . . Problems with the Web version of the event console Problems with performance . . . . . . . . . Configuring the event database . . . . . . . Additional information sources . . . . . . . .
87 88 88 89 89 90 90 90 91 92 93 93 95
. 79
Appendix A. Troubleshooting . . . . . 81
Getting started with problem determination Problems locating an event . . . . . . Understanding event server processes . Checking the event flow . . . . . . . . . . . . . . . . . . 81 81 82 86
Index . . . . . . . . . . . . . . . 111
iv
Publications
This section lists publications in the IBM Tivoli Enterprise Console library and related documents. It also describes how to access Tivoli publications online and how to order Tivoli publications.
v v
Provides release-specific information that is not available until just before the product is sent to market. IBM Tivoli Enterprise Console Rule Developers Guide, SC321234 Describes how to develop rules and integrate them for event correlation and automated event management. IBM Tivoli Enterprise Console Rule Set Reference, SC321282 Provides reference information about the IBM Tivoli Enterprise Console rule sets. IBM Tivoli Enterprise Console Users Guide, SC321235 Provides an overview of the IBM Tivoli Enterprise Console product and describes how to configure and use the IBM Tivoli Enterprise Console product to manage events. IBM Tivoli Enterprise Console Warehouse Enablement Pack: Implementation Guide, SC32-1236
Describes how to install and configure the warehouse enablement pack for the IBM Tivoli Enterprise Console product and describes the data flow and structures that are used by the warehouse pack. v Tivoli Event Integration Facility Reference, SC321241 Describes how to develop your own event adapters that are tailored to your network environment and the specific needs of your enterprise. This reference also describes how to filter events at the source.
Related publications
The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available, in English only, at the following Tivoli software library Web site: http://www.ibm.com/software/tivoli/library/ Access the glossary by clicking the Glossary link on the left pane of the Tivoli software library window.
vi
Ordering publications
You can order many Tivoli publications online at the following Web site: http://www.elink.ibmlink.ibm.com/public/applications/publications/ cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: v In the United States: 800-879-2755 v In Canada: 800-426-4968 In other countries, see the following Web site for a list of telephone numbers: http://www.ibm.com/software/tivoli/order-lit/
Participating in newsgroups
User groups provide software professionals with a forum for communicating ideas, technical expertise, and experiences related to the product. They are located on the Internet and are available using standard news reader programs. These groups are primarily intended for user-to-user communication and are not a replacement for formal support. To access a newsgroup, use the instructions appropriate for your browser. Use these instructions for a Microsoft Internet Explorer browser. 1. Open an Internet Explorer browser. 2. From the Tools menu, click Internet Options. 3. On the Internet Options window, click the Programs tab. 4. 5. 6. 7. In the Newsgroups list, click the Down Arrow and then click Outlook Express. Click OK. Close your Internet Explorer browser and then open it again. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup.
vii
Use these instructions for a Netscape Navigator browser. 1. Open a Netscape Navigator browser. 2. From the Edit menu, click Preferences. The Preferences window is displayed. 3. In the Category view, click Mail & Newsgroups to display the Mail & Newsgroups settings. 4. Select the Use Netscape mail as the default mail application check box. 5. Click OK. 6. Close your Netscape Navigator browser and then open it again. 7. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup. IBM Tivoli Enterprise Console news://news.software.ibm.com/ibm.software.tivoli.enterprise-console IBM Tivoli NetView for UNIX and IBM Tivoli NetView for Windows news://news.software.ibm.com/ibm.software.tivoli.netview-unix-windows
Typeface conventions
This guide uses the following typeface conventions: Bold v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Column headings in a table v Keywords and parameters in text Italic v v v v Citations (titles of books, diskettes, and CDs) Words defined in text Emphasis of words (words as words) Letters as letters
v New terms in text (except in a definition list) v Variables and values you must provide Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type
viii
ix
Chapter 1. Overview
The IBM Tivoli Enterprise Console product is a rule-based event management application that integrates system, network, database, and application management to help ensure the optimal availability of the IT resources in an enterprise. The Tivoli Enterprise Console product: v Provides a centralized, global view of your computing enterprise. v Collects, processes, and automatically responds to common management events, such as a database server that is not responding, a lost network connection, or a successfully completed batch processing job. v Acts as a central collection point for alarms and events from a variety of sources, including those from other Tivoli software applications, Tivoli partner applications, custom applications, network management platforms, and relational database systems. The Tivoli Enterprise Console product helps you effectively process the high volume of events in an IT environment by: v Prioritizing events by their level of importance. v v v v Filtering redundant or low-priority events. Correlating events with other events from different sources. Determining who should view and process specific events. Initiating automatic corrective actions, when appropriate, such as escalation, notification, and the opening of trouble tickets.
v Identifying hosts and automatically grouping events from the hosts that are in maintenance mode in a predefined event group. This chapter describes the highlights of this release and the components of the Tivoli Enterprise Console product. It also provides information about events and how the Tivoli Enterprise Console product processes events.
To unify system and network management, the Tivoli Enterprise Console product provides: v Automatic filtering and forwarding of network events from the Tivoli NetView component v Rules that correlate system-related and network-related events. These rules are based on predefined associations and help in performing root cause analysis. For example, Subnet Unreachable events include the subnet number and mask information. This enhanced event information enables the rules to determine if a server is on a subnet that is known to be unreachable. If it is, this would impact the applications on that server, and the unreachable subnet might be the root cause of any application-related events that have occurred. These rules significantly reduce the human intervention that is typically required to analyze application-failure or system-failure events and compare them to network-failure events to determine the actual problem. By automatically correlating system-related and network-related events, the Tivoli Enterprise Console product saves operators time and provides a more reliable method of problem identification. v Rules that understand and automatically process network events. Only events that require operator action are displayed in the event console. This reduces clutter, gives operators significantly fewer events to assess, and removes the need for operators to manually sort and close previous network status events. Operators can still find and view related events that have been closed by correlation. v Predefined event consoles and event groups for Tivoli NetView events, which you can use to manage these events immediately. You can use the event groups as they are provided, or you can customize them for your enterprise. For more information, see Planning for event management on page 19. v Ability to start the Tivoli NetView Web console from the Java version of the event console, which an operator can use to navigate from an event in the event console to the associated network topology and diagnostics. Rules automatically synchronize the status between the event console and the Tivoli NetView Web console. Therefore, when an operator responds to a network event in the event console, the status of the network element is immediately updated. This enables system and network management operators to analyze and resolve problems more efficiently and effectively. It also improves the communication among the different operators because both the event console and the network console immediately display the correct status. For more information about the rules that the Tivoli Enterprise Console product provides, refer to the IBM Tivoli Enterprise Console Rule Set Reference. For more information about the Tivoli NetView component, refer to the Tivoli NetView documentation at the following Web site: http://www.ibm.com/software/tivoli/library
v Rules that identify the root cause of a problem. Because the rules are based on predefined associations among the WebSphere MQ, DB2, and WebSphere Application Server applications, the rules can determine how the failure of one application affects another application and, therefore, identify the root cause of the problem. For more information about the rules that the Tivoli Enterprise Console product provides, refer to the IBM Tivoli Enterprise Console Rule Set Reference.
v User interface server on page 8 v Event console on page 9 The relationship among the components of the Tivoli Enterprise Console product is illustrated in the following diagram.
Chapter 1. Overview
Event database server Event server Tivoli NetView component Network management server
Prolog rules
SNMP
Event adapter
An event adapter is a process that typically resides on the same host as a managed source and monitors the source for events. A source is an application (such as a database) or a system resource (such as available disk space). A typical source is a system resource or an application that is running. For example, if you want to monitor the Windows event log, install the Windows event log adapter on every
host on which you want to monitor the log. You must either run an event adapter for each source that you want to monitor or modify the source to send events to the Tivoli Enterprise Console product. When an event adapter receives information from its source, the adapter formats the information and forwards it to the event server for interpretation and response, as illustrated in the following diagram.
event: native format event: Tivoli format
Event Adapter
To event server
You can configure an event adapter to discard selected events instead of forwarding the events to the event server, which reduces network traffic and event server workload. An event adapter sends events to the event server using either a Tivoli interface or a non-Tivoli interface. A Tivoli interface is one that runs in a Tivoli environment and a non-Tivoli interface is one that runs in a non-Tivoli environment. Both Tivoli and non-Tivoli types of interfaces send events using a simple interprocess communication mechanism. The difference between the two interfaces is the method used to establish the connection. Interfaces in a Tivoli environment establish connections using services that the Tivoli Management Framework provides. Interfaces in a non-Tivoli environment establish connections using standard interprocess communication mechanisms. You choose the type of connection for your environment when you install an event adapter. For more information about installing and configuring event adapters, refer to the IBM Tivoli Enterprise Console Adapters Guide. Many other Tivoli products that operate in Tivoli or non-Tivoli environments provide additional event adapters. You can also create a specialized event adapter for your own applications and services using the Tivoli Event Integration Facility. For information about the Tivoli Event Integration Facility, refer to the Tivoli Event Integration Facility Reference.
Chapter 1. Overview
Tivoli NetView
The Tivoli NetView component provides the network management function for the Tivoli Enterprise Console product. The Tivoli NetView component monitors the status of network devices and automatically filters and forwards network-related events to the Tivoli Enterprise Console product. For information about how the Tivoli Enterprise Console product processes network-related events, see Unified system and network management on page 1. For more information about the Tivoli NetView component, refer to the Tivoli NetView documentation at the following Web site: http://www.ibm.com/software/tivoli/library/
Event server
The event server provides a centralized location for the management of events in a distributed environment. Each Tivoli region contains only one event server. The event server processes input from event consoles and updates the event database. Because the event consoles read data from the event database, the status of events on all event consoles is updated. The event server creates an entry in the event database for each incoming event and then evaluates these events against a set of rules to determine if the event server should automatically perform any predefined
tasks or modify the event. If human intervention is required, the event server notifies the appropriate operator. The operator performs the required tasks and then notifies the event server when the condition that caused the event has been resolved.
Applying rules
When the event server receives an event or when the event is modified, the event server determines if any existing rules apply to that event. A rule consists of a set of expressions used to determine if an event meets the rule conditions. A rule also includes a set of actions that are taken when an event meets the specified rule conditions. Rules help reduce the amount of interpretation and the number of responses required by operators. For example, a particular event might be known to trigger one or more instances of another event. In such a case, a rule can be used to automatically downgrade the severity of the event or close events that are known to be caused by the triggering event. The event server can use rules to delay responses to an event. If responses are delayed for an event, event consoles are not updated and the event server does not issue an automatic response until the specified amount of time has elapsed. A delayed response might be preferrable, for example, if you have a self-correcting problem that occasionally occurs on the network. This feature can prevent an operator from needlessly responding to a problem. A rule can specify an action to be taken automatically in response to an incoming event. For example, if an event indicates that a router is down, the first response might be to attempt to restart the router and give an operator a low-severity notice. If the attempts to restart the router within a designated time period fail, a rule can specify that attempts to retry be cancelled and that a higher-severity notice be sent to an operator. An operator can monitor actions that are automatically performed for an event. If an operator does not respond to an event after a specified period of time, the event server can take additional actions beyond displaying the event on an event console. For example, the event server can send an e-mail notice of the unacknowledged event to an operator. If the operator still does not acknowledge the event, the server can then perform actions, such as paging the operator or sending an e-mail notice to an alternate contact. You can use the predefined rules that the Tivoli Enterprise Console product provides, or you can create your own rules. The predefined rules associate resource-related events and network-related events to help you to determine the root cause of a problem. For example, the predefined rules can associate an event that indicates that a DB2 server is down with an event that indicates that a specific host is down. This association enables you to quickly determine that the root cause of the events related to the DB2 application is a network failure and not a DB2 application failure. For information about the predefined rules, refer to the IBM
Chapter 1. Overview
Tivoli Enterprise Console Rule Set Reference. For information about creating your own rules, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. A rule can specify, but is not limited to, the following actions: v Correlating events v Responding automatically to events, such as running an application or a script v Delaying responses to events v v v v v Escalating events Modifing event attributes Modifying attributes of other events Preventing duplicate events from being displayed Dispatching Tivoli or other administrative actions on resources
v Reevaluating a set of events v Discarding an event v Generating a new event v Forwarding an event to another event server
Event database
The Tivoli Enterprise Console product uses an external relational database management system (RDBMS) to store the large amount of event data that is received. In this guide, the RDBMS is referred to as the event database. The RDBMS Interface Module (RIM) component of the Tivoli Management Framework is used to access the event database. For additional information about the event database, see the IBM Tivoli Enterprise Console Installation Guide.
Event console
An event console provides a GUI that operators can use to view and respond to events. The Tivoli Enterprise Console product provides two versions of the event console, a Java version and a Web version. Administrators must use the Java version to perform configuration tasks. Administrators or operators must use the Java version to start Tivoli NetView functions and to run local automated tasks. Administrators and operators can use the Java version or the Web version, or both, to manage events. An event console displays a window for monitoring event groups, which operators can use to monitor and respond to incoming events. An event group is a set of events that meet certain filter criteria. An administrator defines the event groups and assigns them to event consoles for each operator. Operators can have independent or shared views of events. The UI server prevents multiple event consoles from updating the same event and updates event status on all event consoles. Therefore, only one operator responds to and works on solving a problem. For more information about the UI server, see User interface server on page 8. For more information about event consoles, see Chapter 4, Managing events, on page 51.
v Multiple operators can be assigned to a single event console definition. For more information about defining event consoles and operators, see the online help for the event console. v When editing event console definitions, all operators assigned to that event console automatically pick up the changes, thus eliminating the need for scripts to be used to update or create event consoles. v When there are conflicts between event consoles, such as two operators simultaneously attempting to change the status of an event, they are resolved automatically and operators are notified. v Import and export functions enable the event console and event group definitions to be exported to a file for archiving or for easily migrating from the development environment into production. For more information about importing event console definitions, see the Exporting and Importing From Other Consoles entry provided in the online help for the event console. The Java version of the event console provides the following views: Configuration view The Configuration view is used to configure both the Java version and the Web version of the event console. Only administrators have access to this view. Summary Chart view The Summary Chart view is used to show a high-level overview of the health of resources represented by an event group. Each event group is represented by a single bar, similar to a bar graph, on an operators event console. To open an event group, click the bar representing that group. Priority view In the Priority view, event groups are represented by buttons. The buttons representing each event group display the event group name and the color of the button representing each event group corresponds to the color defined for the highest severity event contained in that group. To open an event group, click the button representing that group.
10
Framework. You can configure the timeout intervals for these caches, which helps you to balance your needs for performance and current information. v A single installation of the Web version of the event console can be configured to support the installation of the Tivoli Enterprise Console product in multiple Tivoli regions. v Ability to run predefined tasks. v When there are conflicts between event consoles, such as two operators simultaneously attempting to change the status of an event, they are are resolved automatically and operators are notified. The Web version of the event console organizes the tasks you can perform in a portfolio, which is titled My Work. The portfolio contains the following tasks: Select an Event Group Lists the event groups that have been assigned to the event console. To manage the events in an event group, select the appropriate event group from the list. An event viewer is displayed, which contains the events in the selected event group. View Summary of Events Shows a high-level overview of the health of resources represented by an event group, indicating the number of events for each event severity in each event group and the total number of events for each event severity. You can also display the percentage of events for each event severity. To manage the events in an event group, select the name of the event group. An event viewer is displayed, which contains the events in the selected event group. Run Tasks Runs predefined tasks from task libraries. Change User Preferences Controls the display of events in the event viewer. For example, you can change the automatic refresh rate and the maximum number of events to display in the event viewer.
Event groups
An event group is a configured logical area of responsibility that is used to notify users that an event matching a specified set of criteria has occurred. An administrator configures event groups using the Java version of the event console. For example, if your network contains a group of computers that are used for critical work, you might want to create an event group that receives events for these critical computers. This logical grouping of events is an event group. For more information about event groups and attributes, see Chapter 4, Managing events, on page 51. To define an event group, you must specify the selection criteria for the events in the group. This data constitutes an event group filter. An event group filter can include any event attribute except for extended or customer-defined attributes. The following table lists some of the more commonly used attributes for event group filtering.
Chapter 1. Overview
11
Table 2. Common attributes for event group filtering Attribute Name event class Description Specifies the class of the event, as assigned by the event source that forwards the event. The documentation for the event adapter lists the possible values for event classes for adapters. Other Tivoli applications, such as Distributed Monitoring, Software Distribution, and Tivoli NetView, can also forward events to the Tivoli Enterprise Console product. Identifies the protocol address or host name of a host from which you want to receive events. If you want to monitor an entire subdomain, enter the protocol address or host name of the subdomain. Specifies the severity of the event. The Tivoli Enterprise Console product uses the following classifications, listed in order of increasing severity, to indicate the severity of an incoming event: UNKNOWN HARMLESS WARNING MINOR CRITICAL FATAL A system administrator can also add custom severities. source Specifies the type of application that created the event. Sources are defined in the event adapter or the documentation for your application. Possible values include, but are not limited to, LOGFILE, NT, HPOV, and SNMP. Specifies the status of the event as follows: Acknowledged An operator or rule acknowledged receipt of the event. Closed An operator or rule reported that the problem that resulted from the event is resolved. The sending of a closed event by an event adapter indicates that a previously received event of the specified class should be closed as a duplicate. Open The event server received the event, but an operator or rule has not acknowledged receipt of the event.
origin
severity
status
organization_supplied_status The STATUS enumeration that is shipped with the Tivoli Enterprise Console product includes this placeholder status that a system administrator can customize and define for an organization. Response A rule has automatically responded to the event. This status is assigned by a rule language predicate.
12
You can use SQL wildcard characters for any of the attributes to simplify event group filtering options. Entering specific values for each attribute narrows the types of events reported in an event group. Using wildcard characters expands the types and number of events reported in an event group. Event group filters enable you to include specific, and possibly very different, events in an event group. Event group filters also help reduce the number of event groups that an operator must manage. For example, an administrator can create an event group composed of three filters to monitor the events on hosts 9.27.136.1, 9.27.136.2, and 9.27.136.4, but not 9.27.136.3. Without using event group filters, you would need three event groups to manage events from these hosts.
Chapter 1. Overview
13
Table 3. Required Tivoli authorization roles (continued) Activity Installing the Tivoli Enterprise Console product Notes: 1. Each operator must be defined as a Tivoli administrator with the appropriate authorization roles to manage events before you can assign the operator to an event console. 2. If you add an authorization role to a Tivoli administrator after the operator starts the event console, the authorization role does not take affect until the event console is restarted. 3. Tivoli administrators that existed before the installation of Version 3.9 are automatically given the authorization roles of RIM_view and RIM_update during the installation of the event server. You must manually assign the authorization roles of user, RIM_view, and RIM_update to Tivoli administrators that have been created after the installation of the event server. Context Tivoli region Tivoli Authorization Role super
Events
In the Tivoli Enterprise Console product, an event is an object that has been created based on data that is obtained from a source that is monitored by an event adapter. Each event is identified by a class name, which the event adapter defines. Some examples of class names include Su_Success, Su_Failure, No_Permission, and Printer_Toner_Low. Class names are used to label events, but each event contains additional information that helps define and locate a potential problem. Sample event information is provided as an example to manage requests for additional event information that an operator might need. Each event class has a template, which can be modified to include additional information about an event and the action required to resolve the problem. This facilitates the creation of a comprehensive online system of event information and troubleshooting. For detailed information about event classes and attributes provided by the adapters shipped with the Tivoli Enterprise Console product, refer to the IBM Tivoli Enterprise Console Adapters Guide. Several communication protocols are available for forwarding events from event adapters to the event server. The security of each protocol varies. Events use the credibility event attribute to indicate that the events have been received using Tivoli Management Framework services. A credibility of 1 indicates that the event was sent from a TME event adapter and a credibility of 0 indicates the event was sent from a non-TME adapter. You can use the credibility event attribute to determine how to respond to an event, either as a manual response or in an automatic action defined in a rule. Communication between the event server and all event consoles have the same level of security as other Tivoli communication. Events are sent as plain, unencrypted text.
Internal events
The Tivoli Enterprise Console product generates events internally to provide information about the Tivoli Enterprise Console product itself. Each internal event has one of the following classes:
14
TEC_Notice Events that contain non-error conditions in the Tivoli Enterprise Console product. TEC_Error Events for certain error conditions in the Tivoli Enterprise Console product. TEC_DB Events for event database access failures. TEC_Start Events generated when the event server is started. TEC_Stop Events generated when the event server is stopped.
Event flow
The event server architecture consists of the following five processes. The process names are in parentheses. v Master process (tec_server) v Reception engine process (tec_reception) v Rule engine process (tec_rule) v Dispatch engine process (tec_dispatch) v Task engine process (tec_task) Note: An additional process for UI server, tec_ui_server, plays an integral part in the overall Tivoli Enterprise Console architecture. The UI server is not part of the event server, although it communicates with the event server. For more information, see User interface server on page 8. These processes are also known as services when running in a Windows environment. The service names have a .exe file name extension. If any of the event server processes fail, error information is written to a log file as described in the following table. The names of these log files are defined in the $BINDIR/TME/TEC/.tec_diag_config file and can be changed.
Table 4. Log files for event server processes Process tec_server tec_reception tec_rule tec_dispatch tec_task Log File /tmp/tec_master /tmp/tec_reception /tmp/tec_rule /tmp/tec_dispatch /tmp/tec_task
The following figure illustrates the relationships among the event server processes. The arrows represent the flow of communication.
Chapter 1. Overview
15
Master
(tec_server)
Task engine
(tec_task)
Rule engine
(tec_rule)
Dispatch engine
(tec_dispatch)
(tec_ui_server)
Console
Console
Console
Master process
The master process coordinates all of the other event server processes. If one of the other event server processes stops, the master process attempts to restart the process. If the master process cannot restart the process, the master process stops the rest of the processes. The master process also initially receives incoming events sent from Tivoli communication and forwards the events to the reception engine.
16
Reception log
Reception buffer
The state of an event during the reception process (PARSING_FAILED, PROCESSED, QUEUED, and WAITING) is specific to the reception engine and is not an event attribute. The states are defined as follows: PARSING_FAILED The event is not valid. Either the event class is not known to the event server, or the event class attributes are not formatted correctly. The event is discarded. That is, the reception engine process does not insert the event into the event repository, but you can still view the event in the reception log. PROCESSED The event is valid. The rule engine has successfully processed the event. QUEUED The event is waiting in the reception buffer for rule engine processing. The reception buffer is a first in, first out (FIFO) queue. If you routinely see QUEUED events in the output from the wtdumprl command, the rule engine is too busy. If you see only PROCESSED events in the output from the wtdumprl command, the reception buffer is adequately sized, and rule engine processing is efficient. WAITING The reception buffer is full. When the reception buffer accepts the event, the reception engine process changes the event to the QUEUED state. If you routinely see WAITING events in the output of the wtdumprl command, the reception buffer is not large enough, or the rule engine is too busy, or both. When the event server is restarted, the reception engine is reloaded with events from the reception log that are in the WAITING or the QUEUED state.
Chapter 1. Overview
17
The reception engine does not process internally generated events (for example, those generated by rules). Internally generated events never appear in the reception log or the reception buffer. The reception buffer is located in system memory (RAM). You can configure the size of the reception buffer using the wsetesvrcfg command or from the Event Server Parameters dialog.
18
19
that the Tivoli Enterprise Console product uses for root cause analysis. For more information about the predefined rules, refer to the IBM Tivoli Enterprise Console Rule Set Reference. Maintenance Maintenance events that are not closed. Events in this group are used to inform an operator that a specific system is in maintenance mode. When a system is in maintenance mode, events from that system cannot be processed. Events in this event group can be in open state or acknowledged state. Events in open state indicate a scheduled maintenance time for the system identified in the event. Events in acknowledged state indicate that the system identified in the event is within the scheduled maintenance time. OpenNetView Tivoli Netview events that are open. OtherNetView Tivoli Netview events that are acknowledged or closed. ServiceUnavailable Events from the Tivoli Netview component that indicate that IBM WebSphere Application Server, DB2, or WebSphere MQ applications are not available.
20
attributes), not only the event attributes shown in the example. You can use SQL wildcard characters to specify event filters. For more information about creating an event group, see Creating an event group on page 27. Note: When you create an event group, consider adding a criterion to the filter on the date_reception event attribute that limits the time range of the events that are retrieved. Doing this improves performance.
Table 5. Worksheet for creating an event group Event Group Definition Event Group:_______________________________________ Filter Name Event Classes Severity Status Sources Origins Sub-Origins
21
Table 6. Worksheet for correlating an event group with an event console and event group roles (continued) Event Group Roles Event Group:_______________________________________
22
To create a source for an adapter type, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources to display the TEC Source List dialog box. 2. Type the source name in the Name text box. This name must match the source name used for the events that are produced by the event adapter. For more information about event adapters, refer to the IBM Tivoli Enterprise Console Adapters Guide. The following list describes the source that corresponds to each event adapter: Source AS400_ALERT AS400_MSGQ HPOV LOGFILE NT NV390ALT NV390MSG NV6K Adapter AS/400 alert AS/400 message HP OpenView UNIX logfile Windows NT and Windows event log adapters NetView/390 alert NetView/390 message Tivoli NetView adapter
SNMP Simple Network Management Protocol 3. Type a description of the source in the Label text box. 4. Click Add Source to add the source item to the Sources scrolling list. 5. Click Save & Close. For information about using a command to create a source item, refer to the wcrtsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
23
To change a source item, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources to display the TEC Source List dialog box. 2. Select the source item to edit from the Sources scrolling list and click Edit. 3. Modify the Name and Label text box as appropriate. 4. Click Replace Source to make your changes. 5. Click Save & Close. For information about using a command to edit a source item, refer to the wsetsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
To delete a source item from the source list, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources from the context menu to display the TEC Source List dialog box. 2. Select the source item to be deleted from the Sources scrolling list and click Delete. 3. Click Save & Close. For information about using a command to delete a source item, refer to the wdelsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
24
The following table lists the context and authorization role required to perform this task.
Activity Configure the event server Context Event server Required Role senior
To change the default values for logging, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Parameters. The Event Server Parameters dialog is displayed. 2. The Event Server Parameters dialog contains the following options: Log reception of events Determines whether events are logged and is used in conjunction with the Time to keep event reception log information option. Note: This setting is not automatically enforced and is used by the Clean_Database task in the TEC Tasks library. You can run the Clean_Database task immediately or you can schedule the Clean_Database job to run the task later. Maximum number of event messages buffered in memory Specifies the maximum number of incoming events to store in the memory of the tec_reception process while the server processes an existing event. The default value is 500 events. Event cache size Specifies the maximum number of events to keep in the event cache for rule evaluation. The rule engine uses the events in the event cache for correlation. The default value is 1000 events. Time to keep closed events in cache Specifies the amount of time, in hours, to keep a closed event in the event cache. The default value is 24 hours. Time to keep event reception log information Specifies the amount of time, in hours, to keep logged events. The default value is 24 hours. This option is available when the Log reception of events option is activated. Time to keep non-closed events Specifies the amount of time, in days, to keep an event that is in the OPEN or ACK state in the event cache. The default value is 180 days. Time allowed for server initialization Specifies the amount of time, in seconds, to allow the event server to synchronize its processes. If the server cannot synchronize its processes within the specified time, the server generates an error message and shuts down. The default value is 300 seconds. Trace Rules Determines whether rules are traced and is used in conjunction with the Rule Trace File text box. To trace rules, the rules must be compiled with the tracing option activated. See the IBM Tivoli Enterprise Console Rule Developers Guide for more information about rule tracing. Rule Trace File Specifies the path name for the trace file. The default file name is /tmp/rules.trace.
Chapter 2. Configuring the Tivoli Enterprise Console product
25
3. Click Save & Close. Stop and restart the event server to incorporate the changes. For information about using commands to change the logging defaults, refer to the wsetesvrcfg and the wlsesvrcfg commands in the IBM Tivoli Enterprise Console Command and Task Reference.
v Load a rule base For information about performing rule base operations, refer to the IBM Tivoli Enterprise Console Rule Developers Guide and the wrb command in the IBM Tivoli Enterprise Console Command and Task Reference.
For information about creating an event console from the Java version of the event console, refer to the online help. For information about using a command to create an event console, refer to the wconsole command in the IBM Tivoli Enterprise Console Command and Task Reference. If you are creating event consoles for multiple administrators, you can copy an existing event console. To do this, use the c option of the wconsole command.
26
This section describes the following topics: v Creating and changing an event group v Assigning an event group to an event console on page 28 v Creating an operator on page 29 v Assigning an operator to an event console on page 29 v v v v Integrating your trouble ticket system with the trouble ticket rules on page 29 Customizing an event console on page 33 Configuring custom buttons for an event console on page 33 Exporting and importing event console definitions on page 38
For information about creating event groups, event group filters, and event group filter constraints, refer to the following entries in the online help. v Creating an Event Group v Creating an Event Group Filter v Creating an Event Group Filter Constraint v Creating an Event Group Filter Constraint with SQL
For information about editing event groups properties, see Editing Event Group Properties in the online help.
27
The following table lists the context and authorization role required to perform this task.
Activity Editing an event group filter Context Configuration view in the Java version of the event console Required Role senior
For information about editing an event group filter, refer to the Editing Event Group Filter Properties entry in the online help.
For information about deleting event groups, see the Deleting an Event Group entry in the online help.
For information about deleting event group filters, see the Deleting an Event Group Filter entry in the online help.
28
For more information about using and configuring event consoles, refer to the online help.
Creating an operator
The following table lists the context and authorization role required to perform this task.
Activity Create an operator Context Configuration view in the Java version of the event console Required Role senior
For information about how to create an operator for an event console, refer to the online help.
For information about how to assign an operator to an event console, refer to the online help.
Integrating your trouble ticket system with the trouble ticket rules
To help you manage problems more efficiently, you can integrate your trouble ticket system, such as Peregrine Systems Service Center, with the Tivoli Enterprise Console product. To integrate your trouble ticket system, the Tivoli Enterprise Console product provides the following items: v Trouble ticket rules, which are defined in the troubleticket.rls file The trouble ticket rules automatically open, update, or close a trouble ticket in response to an event that meets the criteria you specify. The trouble ticket rules also provide the function to associate an existing trouble ticket with the event for which the trouble ticket was opened. The troubleticket.rls file is located in the default rule base in the TEC_RULES subdirectory.
Chapter 2. Configuring the Tivoli Enterprise Console product
29
v A sample script, TroubleTicket.sh The TroubleTicket.sh script simulates the interface to a trouble ticket system. The TroubleTicket.sh script is located in the Install_dir/bin/interp/TME/TEC directory on the event server. As provided, when an event is received that matches the event criteria, the TroubleTicket.sh script writes the event information in a text file in the /tmp directory named tteventID.log where eventID is the ID of the event. The TroubleTicket.sh script updates the tteventID.log file with status and severity changes for the event and with information about associated events. The TroubleTicket.sh script also provides the function to perform these actions: Associate an existing trouble ticket ID to an event Reflect changes made in a trouble ticket in the associated event To integrate your trouble ticket system with the Tivoli Enterprise Console product, complete the following procedures: 1. Customize the trouble ticket rules to automatically respond to events as described in Customizing the trouble ticket rules. 2. Optionally, customize the TroubleTicket.sh script to add the script that invokes your trouble ticket system so that it automatically opens, updates, and closes a trouble ticket in response to an event that meets your criteria. 3. Optionally, enable your trouble ticket system to update events when an action has been performed on a trouble ticket. Note: Your trouble ticket system must be installed and operational. For information about installing your trouble ticket system, refer to the appropriate documentation for your trouble ticket system.
30
_kbase_file Specifies the name of the file used to store trouble ticket facts in the knowledge base. The default file name is $DBDIR/troubleticket.pro. _tt_elapsed Specifies the amount of time (in seconds) to search backward or forward in the event cache for an associated event. The default value is 604 800 (one week). b. Specify the event criteria for which to open a trouble ticket automatically in the configure_knowledge_base action of the tt_configure rule. The event criteria includes the event class, severity, and the fully qualified host name in the event. To match all possible values for the event class, the severity, or the host name, use an underscore character ( _ ). Here are some examples.
This event criteria assert_tt(_, _, _) assert_tt(_, CRITICAL, _) assert_tt(_, CRITICAL, myhost.raleigh.ibm.com) Opens a trouble ticket for All events All critical events All critical events from myhost.raleigh.ibm.com
This event criteria causes the trouble ticket rules to open a trouble ticket for all fatal TEC_Error events from any host. For more information about the trouble ticket rules and rule language predicates, refer to the IBM Tivoli Enterprise Console Rule Set Reference. 3. Activate, compile, and load the troubleticket.rls file.
31
Condition
Action
A new event is received that matches A rule checks the value of the _assoc_flag parameter in the TroubleTicket.sh the specified criteria. script and performs one of these actions: v If the value of the _assoc_flag is ON (the default value), the rule searches the event cache for a similar event (one with the same event class, severity, and host name) that has a trouble ticket ID in the ttid event slot. If such an event is found in the event cache, the TroubleTicket.sh script associates the new event with the existing trouble ticket for the cached event. The TroubleTicket.sh script sends the trouble ticket ID for the cached event to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script updates the /tmp/tteventID.log file with information about the associated event. If a similar event is not found in the event cache, the TroubleTicket.sh sends a new trouble ticket ID to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script writes all the event slots of the event in the /tmp/tteventID.log file and includes a message indicating that a trouble ticket should be opened for this event. v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script sends a new trouble ticket ID to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script writes all the event slots of the event in the /tmp/tteventID.log file and includes a message indicating that a trouble ticket should be opened for the event. The status of an event associated with a trouble ticket has been changed to any value other than CLOSED. An event associated with a trouble ticket has been closed. The TroubleTicket.sh script updates the /tmp/tteventID.log file with information describing the change made to the event.
A rule checks the value of the _assoc_flag parameter in the TroubleTicket.sh script and performs one of these actions: v If the value of the _assoc_flag is ON (the default value), the rule searches for an event in the event cache that has the same trouble ticket ID in the ttid event slot and is not closed. If an associated event is found, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the event has been closed, but the trouble ticket is still open. If an associated event is not found, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the original event for the trouble ticket has been resolved and closed. v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the original event for the trouble ticket has been resolved and closed.
event_handle Value in the event_handle event slot of the event you want to update. date_reception Value in the date_reception event slot of the event you want to update.
32
server_handle Value in the server_handle event slot of the event you want to update. slotvector Comma separated list of the name=value pairs for the event slots that you want to change. Each name=value pair must be enclosed in single quotation marks as follows:
severity=HARMLESS,source=source1
v To update the ttid event slot of an event when a new trouble ticket has been opened, run the following command from a script or the command line:
TroubleTicket.sh ASSOCIATE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle
v To update one or more event slots of an event (such as, the severity or status of the event) when an action is performed on a trouble ticket, run the following command from a script or the command line:
TroubleTicket.sh UPDATE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle slotvector
v To close an event when a trouble ticket has been closed, run the following command from a script or the command line:
TroubleTicket.sh CLOSE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle
Some event console preferences pertain to only the Java version of the event console. For example, you can configure event console appearance properties to display raw values or percentages in the tool tips in either the Summary Chart view or the Priority view of the Java version of the Web console. You can also customize the Java version of the event console to initialize with the event viewer for a specific event group using the tec_console command. For more information about the tec_console command, refer to the IBM Tivoli Enterprise Console Command and Task Reference. For more information about customizing an event console, refer to the online help.
33
configure a button in the Java version of the event console to run a script or local command on the selected event. You can configure a button in the Web version of the event console to open a URL in the context of the selected event and run a Web application. To configure a custom button, you create the button and you associate an action with the button. Use the Console Properties dialog from the Java version of the event console to create, modify, or delete custom buttons for an event console. To display new custom buttons in an event viewer that is already open, you must close and restart the event console. The following table lists the context and authorization role required to perform this task.
Activity Create, modify, or remove custom buttons for event consoles Context Editing event console properties in the Java version of the event console Required Role senior
For more information about configuring custom buttons, refer to the online help.
Associating an action with a custom button in the Java version of the event console
The following sections include examples of command scripts that start a Java application from a custom button in the event viewer. When an operator selects an event and then selects a custom button in the Java version of the event console, the attributes of the selected event are passed to the script as environment variables. The SLOTS environment variable contains a string array with all event attributes exported by the event console, as shown in the following example.
SLOTS=num_actions hostname server_path adapter_host source cause_event severity status
Each of the event attributes in the string array are also environment variables and can be used individually in a custom script. For a complete list of event attributes available to the SLOTS environment variable, refer to the IBM Tivoli Enterprise Console Command and Task Reference. Note: If environment variables were specified to create custom buttons in a prior release, the environment variables are ignored when creating custom buttons as console properties. Custom buttons created as console properties always supersede those created by using environment variables in prior product versions. Example command script for running a Java application in a Windows environment: To run a CMD or a BAT file from a custom button in the event viewer in a Windows environment, you must first specify the @echo off tag as the first line of your command script, as shown in the following example. The following example runs a Java application in a Windows environment using the SLOTS environment variable as the argument:
@ECHO off @REM Sample script to use as a Custom Button @REM This script checks information about the selected Event and logs @REM it into a temp file. SET TMP_FILE=C:\TEMP\CustomButtonSample.txt
34
@REM SLOTS contains all slots defined in the Event @REM if SLOTS is not defined then NO Event has been @REM selected in the Event Viewer IF "%SLOTS%" == "" GOTO NeedEvent @REM Initialize new log SET EVENT_ID=%event_hndl%:%server_hndl%:%date_reception% ECHO Start log for event %EVENT_ID% >> %TMP_FILE% ECHO Slots of the selected event: ECHO %SLOTS% >> %TMP_FILE% >> %TMP_FILE%
@REM Use class, status and severity to determine which action to @REM take against the Event selected IF "%class%" == "TEC_Start" ECHO TEC Server has been started. >> %TMP_FILE% IF "%class%" == "TEC_Stop" ECHO TEC Server has been stopped. >> %TMP_FILE% IF "%severity%" == "FATAL" ECHO Severity is FATAL: immediate action required. / >> %TMP_FILE% IF "%status%" == "OPEN" ECHO Status is OPEN: no operator is responsible / for this event. >> %TMP_FILE% @REM Finalize log ECHO Stop log for event %EVENT_ID% >> %TMP_FILE% GOTO EndScript :NeedEvent ECHO No event has been selected. >> %TMP_FILE% :EndScript @ECHO on
Example script for running a Java application in a UNIX or Linux environment: To run a shell script from a custom button in the event viewer within a UNIX or Linux environment, you must first specify the shell program before the script. If the custom button script starts a graphical application, such as a Java GUI, you must specify the export DISPLAY environment variable in your script, as shown in the following example.
#!/bin/sh export DISPLAY=:0.0 /usr/jdk/bin/java MyCustomButton $(SLOTS)
The following example starts a Java application in a UNIX environment using the SLOTS environment variable as the argument:
#!/bin/sh # # # # Sample script to use as a Custom Button This script checks some information about the selected Event and logs it into a temp file.
TMP_FILE=/tmp/CustomButtonSample.txt # SLOTS contains all slots defined in the Event # if SLOTS is not defined then NO Event has been # selected in the Event Viewer if [ "${SLOTS}" = "" ] then echo "You must select an event to run this script!"
Chapter 2. Configuring the Tivoli Enterprise Console product
35
exit 1 fi # Initialize new log EVENT_ID=${event_hndl}:${server_hndl}:${date_reception} echo "Start log for event ${EVENT_ID}" >> ${TMP_FILE} # Print all slots values # slot=value echo "Slots of the selected event: " >> ${TMP_FILE} for i in ${SLOTS} do value=`env | grep $i | grep -v SLOTS | cut -f2 -d=` echo "$i = $value" >> $TMP_FILE done # Use class, status and severity to determine # which action to take against the Event selected if [ "${class}" = "TEC_Start" ] then echo "TEC Server has been started." >> ${TMP_FILE} fi if [ "${class}" = "TEC_Stop" ] then echo "TEC Server has been stopped." >> ${TMP_FILE} fi if [ "${severity}" = "FATAL" ] then echo "Severity is FATAL: immediate action required." >> ${TMP_FILE} fi if [ "${status}" = "OPEN" ] then echo "Status is OPEN: no operator is responsible for this event." >> ${TMP_FILE} fi # Finalize log echo "Stop log for event ${EVENT_ID}" >> ${TMP_FILE} echo " " >> ${TMP_FILE}
Associating an action with a custom button in the Web version of the event console
When an operator selects an event and then selects a custom button in the Web version of the event console, the attributes of the selected event are passed to the URL that you defined when you created the custom button. The following example is a sample servlet that can be associated with a custom button.
package test.launch; import import import import import import import import import java.io.IOException; java.io.Writer; java.util.Enumeration; java.util.Iterator; java.util.Map; javax.servlet.ServletException; javax.servlet.http.HttpServlet; javax.servlet.http.HttpServletRequest; javax.servlet.http.HttpServletResponse;
/** *<code>SampleLaunchIntoAppServlet</code> services HTTP requests from event console. * It does not have a mapping in the web.xml for the event console web application.
36
* The purpose of this servlet is to demonstrate the initialization of * different parts of an application when the event console custom buttons * are configured. * <P> * */ public class SampleLaunchIntoAppServlet extends HttpServlet { public static final String CLASSNAME = SampleLaunchIntoAppServlet.class.getName(); /**************************************************************************** * Implements HttpServlet.doPost() * <P> * Launch the task specified by the pathInfo of the URI. * * @param request The HTTP request * @param response The HTTP response * ****************************************************************************/ public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // trace entry doGet(request, response); // trace exit } /**************************************************************************** * Implements HttpServlet.doGet() * <P> * Launch the task specified by the pathInfo of the URI. * * @param request The HTTP request * @param response The HTTP response * ****************************************************************************/ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // trace entry // expire all responses immediately so that no pages get cached ConsoleUtilities.setNoCachingHeaders(response); // lets read some request parms! Map parmMap = request.getParameterMap(); StringBuffer content = new StringBuffer("Event Context Information"); content.append("\n<P>Request Parameter Map:\n"); String key = null; String[] val = new String[1]; for (Iterator i=parmMap.keySet().iterator(); i.hasNext(); ) { content.append("<P>"); key = (String)i.next(); content.append(key); content.append(": "); System.arraycopy(parmMap.get(key), 0, val, 0, 1); content.append(val[0]); } response.setContentType("text/html"); //$NON-NLS-1$ Writer respOut = response.getWriter(); // write some basic html here respOut.write("<HTML><HEAD><TITLE>A sample web app launched from a web custom button in context of an event</TITLE></HEAD><BODY>"); respOut.write(content.toString()); respOut.write("</BODY></HTML>");
37
For more information about exporting and importing event console definitions, see the Exporting a Console and Importing a Console entries in the online help.
Managing Tivoli region definitions for the Web version of the event console
When the Tivoli Enterprise Console product is installed, an administrator can configure the Tivoli region definitions for the Web version of the event console within the IBM WebSphere Application Server product. These definitions specify the following items: v Managed nodes to which an operator can connect when logging on to the Web version of the event console v User ID and password used to access the RIM database v Cache timeout values for the event console A Tivoli region is represented in the IBM WebSphere Application Server product by an authentication alias, a data source, and a connection factory as follows: v The authentication alias is used to encode and store the user name and password, which the data source uses to access the RIM database. v The data source represents the connection to the event database. Event data, console definitions, and operator preferences are stored in the event database. v The connection factory performs the following functions:
38
Interfaces with the Tivoli Management Framework to authenticate operators and validate that they are authorized to use the event console Interfaces with the Tivoli Management Framework to obtain task information, start tasks, and obtain task results Interfaces with the UI server to update events and receive notifications for operators Caches event and summary information after the information is retrieved from the event database You might need to add or change the Tivoli region definitions after installation for the following reasons: v If you add a Tivoli region after installation v If the host name of the Tivoli server has changed v If you want to change the user ID and password that is used to access the RIM database v If you want to change the cache timeout values for the event console v If you delete a Tivoli region after installation The procedure in this section describes the information that is relevant to the Tivoli Enterprise Console product. For specific information about the IBM WebSphere Application Server product, refer to the online help in the WebSphere Application Server Administrative console and the IBM WebSphere Application Server product documentation, which you can access from the WebSphere InfoCenter at the following Web site: http://www-3.ibm.com/software/webservers/appserv/library/index.html To add, change, or delete a Tivoli region definition, follow this general procedure: 1. From the WebSphere Application Server Administrative Console, navigate to Security > JAAS Configuration > J2C Authentication Data to create or change the alias using the following information. Name Type the name of the alias in the following format:
TEC_region_host_name_DS_ALIAS
User ID Type the user ID to access the RIM database. Password Type the password for the specified user ID. Note: If you are deleting a Tivoli region definition, select the name of the appropriate alias and click Delete. 2. Navigate to the Resources > JDBC providers. Select Server and then select the JDBC provider for the Tivoli Enterprise Console product, TEC 3.9.0 RIM JDBC Provider. 3. Click Data Sources. Note: If you are deleting a Tivoli region definition, select the name of the appropriate data source, and click Delete. 4. If you want to change the host name or port number of the Tivoli server, go to step 5 on page 40. If you want to create a Tivoli region definition, create a data source using the following information: Name Type the name of the data source in the following format:
Chapter 2. Configuring the Tivoli Enterprise Console product
39
TEC_region_host_name_DS
Where region_host_name is the fully qualified host name of the Tivoli server. JNDI Name Type jdbc/TEC_region_host_name_DS. Datasource Helper Classname Type com.tivoli.tec.rimds.RIMDataStoreHelper. Component-managed Authentication Alias Select the name of the alias you created in Step 1 on page 39 from the drop-down list. Note: Do not create a container-managed authentication alias. 5. Select the name of the data source and click Custom Properties. Add or change two custom properties, one for the server name and one for the port number. v To add a custom property for the server name, use the following information: Name Type serverName. Value Type the host name of the Tivoli server. Type Select java.lang.String from the drop-down list. v Add the property for the port number with the following information: Name Type portNumber. Value Type the port number for the Tivoli server. The default port number is 94. Type Select java.lang.String from the drop-down list. 6. Optionally, change the connection pool properties. To do this, select the name of the data source and click Connection Pool. 7. Navigate to Resources > Resource Adapters. Select Node and then select the resource adapter for the Tivoli Enterprise Console product, TEC 3.9.0 Resource Adapter. 8. Click J2C Connection Factories. Note: If you are deleting a Tivoli region definition, select the name of the appropriate connection factory and click Delete. 9. If you want to change the cache timeout values, go to step 10 on page 41. If you are creating a Tivoli region definition, define one connection factory for the Tivoli region using the following information: Name Type the name of the connection factory in the following format:
TEC_region_host_name_CF
Where region_host_name is the host name of the Tivoli server. JNDI Name Type the following string:
eis/tec3_9/TEC_region_host_name_CF
40
10. Select the name of the connection factory and optionally change the custom properties. You can also optionally change the connection pool properties. You can change any of the following custom properties: eventDataCacheTimeout Specifies the amount of time (in seconds) to cache event data from the event database. Note: Setting the eventDataCacheTimeout value to less than 60 seconds can impact performance. eventSummaryCacheTimeout Specifies the amount of time (in seconds) to cache event summary data. managedNodeList Specifies a list of host names, each host name separated by a space, to which an operator can connect when logging on to the event console. This parameter is required. rimDataSourceName Type the JNDI name of the data source:
jdbc/TEC_region_host_name_DS
This parameter is required. taskCacheTimeout Specifies the amount of time (in minutes) to cache task information from the Tivoli Management Framework. 11. Click Save on the taskbar. 12. Stop and restart the WebSphere Application Server for the changes to take effect.
41
5. Type the appropriate value in the Max connections field and click OK. 6. Save and confirm your changes. 7. Stop and restart the IBM WebSphere Application Server to incorporate the changes.
To stop the event server, right-click the Event Server icon on the Tivoli desktop and select Shut Down. To start the event server, right-click the Event Server icon on the Tivoli desktop and select Start-up. You can also stop and restart the event server manually using the wstopesvr and the wstartesvr commands, respectively. For more information about the wstopesvr and wstartesvr commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference. If an event server goes down, the UI server reconnects automatically when the server comes back up. It is not necessary to shut down the UI server or an event console to establish communication with the event server.
42
Sample IT environment
This sample customer scenario assumes that the Acme Company has its main office in Raleigh, North Carolina, and branch offices in New York, Chicago, and Los Angeles. To support its business, the Acme Company uses the following applications: v Business applications that run on IBM WebSphere Application servers v WebSphere MQ for messaging services among the business applications v DB2 product for data storage The business applications are distributed among the branch offices with the core parts of the applications installed in the main office in Raleigh. The IP addresses for hosts in the main office range from 9.27.1 to 9.27.9. The IP addresses for hosts in the branch offices begin with 9.27.10 (for New York), 9.27.11 (for Chicago), and 9.27.12 (for Los Angeles). The Acme Company has the following departments in its main office in Raleigh, North Carolina. Data entry Consists of seven people who primarily enter data into the business applications. The data is stored in a DB2 database that is running on an AIX system in the main office. Marketing Consists of five people who plan and implement sales strategies. Marketing personnel use the business applications to gather and analyze data. The analytical data is stored in a DB2 warehouse that is running on an AIX system in the main office. Trading Consists of ten people who buy and sell securities. Trading personnel use the business applications, including Web-based applications, to perform their jobs. Information technology Consists of six people who maintain the computer systems and the network. IT personnel use the Tivoli Enterprise Console product and other Tivoli products to manage and ensure the optimal availability of the IT resources.
Copyright IBM Corp. 2003
43
The following people are the system administrators and operators in the Acme Company. v Mary is the Database Manager. Mary is responsible for resolving database-related problems. v Susan and George are Network Managers. Susan and George are responsible for installing, configuring, and maintaining a heterogeneous network. Susan is the root user and has the administrator role. v Jim is the System Manager. Jim is responsible for maintaining and configuring the workstations, printers, and mail systems. v Carla is a System Manager. Carla is responsible for installing, configuring and maintaining the business application infrastructure, consisting of IBM WebSphere Application servers and WebSphere MQ messaging servers. v Mark is the Help Desk Manager. Mark primarily answers questions about applications that the Acme Company uses. Mark receives notification of all events so that he can be informed of the types of problems that users might encounter. All system administrators and operators are located in the main office in Raleigh and are responsible for maintaining the availability of the business applications and the infrastructure that supports the applications without impacting the business objectives of the company. The Acme Company relies on the Tivoli Enterprise Console product to maintain availability of its IT resources because the Tivoli Enterprise Console product unifies system and network management and provides optimized event management for the following key e-business applications: v WebSphere MQ v DB2 v IBM WebSphere Application Server
Event adapters
The main office uses the IBM Tivoli NetView component to manage its network. The local networks in the branch offices are managed with an SNMP-type adapter. A log-file adapter is installed on each individual employees computer (endpoint) on the network. The event adapters are installed on the same nodes as their respective resources. A Tivoli Management Framework gateway is created on a managed node in each location. The Tivoli Management Framework gateway is installed on Shamrock (9.27.1.6) in the Raleigh office, on Wheeler (9.27.10) in the New York City office, on Fairview (9.27.11) in the Chicago office, and on Bandera (9.27.12) in the Los Angeles office. A Tivoli Enterprise Console gateway is set up in each Tivoli Management Framework gateway to perform event correlation and filtering close
44
to the event source. Endpoints are created on each host (managed node) and individual computer (endpoint). Although a host is considered a managed node, an endpoint must be installed to run an event adapter. The Adapter Configuration Facility is used to distribute and start each adapter on endpoints in the network. This facility is installed on the Tivoli server and all managed nodes in the network. This facility must be used to distribute the adapter to each endpoint. For additional information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide.
Event server
The event server is located in the Raleigh office. It is installed on host wichita, which has an IP address of 9.27.1.5. The default event server configuration is used.
Server configuration
The default values are used for the event server as follows: Log events in reception log The default value is 84 600 seconds (24 hours). Maximum number of event messages buffered in memory The default value is 500 events. Event cache size The default value is 1 000 events. Time to keep closed events in cache The default value is 24 hours. Time to keep non-closed events The default value is 180 days. Time allowed for server initialization The default value is 300 seconds.
Event sources
The sources used correspond to the event adapters installed throughout the Acme Company as follows: v NV6K v LOGFILE v SNMP
Rule bases
Susan uses the Default rule base, which includes the following rule sets: ebusiness.rls Analyzes events related to the following key e-business services (IBM WebSphere Application Server, DB2, and WebSphere MQ) to determine whether the events are causally related to one another or to network events. To use the ebusiness.rls rule set, Susan defines the dependency relationships that apply to the e-business services and network resources and loads the relationships into the knowledge base. netview.rls Manages events from the Tivoli NetView component. The netview.rls rules correlate related Tivoli NetView events and manage the synchronization of the event server with the Tivoli NetView component. Susan also loads and activates the following rule sets:
Chapter 3. Sample IT environment with configuration examples
45
maintenance_mode.rls Provides automated event processing for a monitored system that is in maintenance mode. By default, events received from a system in maintenance mode are closed. notify.rls Supports sending notification to support personnel about new or changed events. Susan configures the notify.rls rule set to send e-mail notification to Mary, the Database Manager, whenever a critical DB2 event is received.
Event groups
Susan uses the predefined event groups to monitor the e-business services and network resources. The predefined event groups are: v AllActiveEvents v EbusinessEvents v UnMonitoredEBusiness v ProbableEventAssn v Maintenance v OpenNetView v OtherNetView v ServiceUnavailable The Tivoli Enterprise Console product also provides the following predefined event consoles: AdministrativeConsole Default event console to which all predefined event groups are assigned. When the Tivoli Enterprise Console product is installed, Susan, the root administrator, is automatically assigned to the AdministrativeConsole. Because all predefined event groups are automatically assigned to the AdministrativeConsole, Susan can start managing IT resources immediately, receiving and displaying events in their related event groups for network impacts, impacts to e-business services, and so forth. EBusinessEventsConsole Event console to which the e-business event groups are assigned. Susan assigns Carla, who is responsible for maintaining the availability of the business application infrastructure, to the EBusinessEventsConsole. Susan associates the responsibilities of each operator with the predefined event groups so that the operators can monitor the resources for which they are responsible. To do this, Susan assigns one or more events groups to an event console and then assigns the appropriate operator to that event console. For example, Susan assigns the OpenNetView and the OtherNetView event groups to an event console and then assigns George, who is responsible for maintaining the availability of the network, to that event console. Susan assigns the AllActiveEvents to an event console and assigns Mark, the Help Desk Manager, to that event console.
46
Event adapters
To extend the event management capabilities that the Tivoli Enterprise Console provides, Susan can customize the adapters that the Tivoli Enterprise Console product provides using the Adapter Configuration Facility. For information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide. Susan can also create new adapters that are tailored to the network envrionment using the Tivoli Event Integration Facility. For information about the Tivoli Event Integration Facility, refer to the Tivoli Event Integration Facility Reference.
Event server
The default values for the event server can be changed to ensure optimal performance. The default values determine how the event server stores and processes logs and how long it should wait for event server initialization. To determine the values to use for the event server, Susan starts with an estimate of the number of events that the event server processes on a daily basis. After the event server runs for some time and Susan can determine the actual number of events that the event server processes on a daily basis, Susan adjusts the values to ensure optimal performance. Susan determines the values for the event server based on the following information: v Average number of events that the tec_reception process receives daily and stores in the reception log. To determine this information, Susan runs the following command on the event server:
wtdumper t start_time e end_time | grep END | wc
For more information about the wtdumper command, refer to the IBM Tivoli Enterprise Console Command and Task Reference. v Average number of open events that are stored daily in the event repository. To determine this information, Susan runs the following command on the event server:
wtdumper t start_time e end_time | grep "status=OPEN" | wc
v Maximum number of events that the event server can potentially store in memory. Susan must consider the peak periods in which a large number of events are sent to the event server and are queued until the event server is able to process them. The event server stores queued events in the reception log and also keeps queued events in memory. v Time period in which to keep open events for correlation. v Time period in which to keep closed events for correlation. This example assumes the following information: v The event server receives an average of 50 000 events daily. v The average number of open events that are stored daily in the event repository is 15 000. v The maximum number of queued events is 3 000. v Keep non-closed events for two days for correlation.
Chapter 3. Sample IT environment with configuration examples
47
Server configuration
Based on the information in this example, Susan configures the event server as follows: Log events in reception log The default value, 84 600 seconds (24 hours), is used for this example. Maximum number of event messages buffered in memory The default value, 500, is changed to 3 900. This value is based on the maximum number of queued events (3 000 in this example) plus 30% more (900) for padding. If events get in a WAITING state, the buffer is too small, and the size of the buffer should be increased. Event cache size The default value, 1 000, is changed to 39 000. This value is based on the average number of events stored daily in the event repository (15 000 in this example) multiplied by the number of days in which Susan wants events to remain in open state for correlation (2 in this example) plus 30% more (900) for padding. If the event cache size is too small, events might be deleted from the cache when new events must be stored. In this situation, a Rule Cache full: forced cleaning event is sent to the event server, and the event cache size should be increased. On the other hand, configuring the event cache to too large a value can affect performance when searching the event cache. Time to keep closed events in cache The default value, 24 hours, is changed to 1 hour. This example assumes that closed events do not need to be correlated and, therefore, do not need to be kept in the event cache. Time to keep non-closed events The default value, 180 days, is changed to 2 days. This example assumes that open events are kept for two days for correlation. Time allowed for server initialization The default value, 300 seconds, is used for this example.
Event sources
If Susan adds new adapters, she must create event sources for the new adapters in addition to the following event sources that have already been defined: v NV6K v LOGFILE v SNMP For more information, see Creating a source item on page 23.
Rule bases
Susan can create a rule set that filters events based on the event sources that correspond to the adapters that are installed in the Acme Company. For information about creating a rule set, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. For information about loading and activating a rule set, refer to the IBM Tivoli Enterprise Console Rule Set Reference.
Event groups
The following examples show how Susan, the root administrator, creates new event groups for the Acme Company. Each example contains worksheets for defining
48
possible event groups and operator roles. The examples use a subset of the attributes that you can use to specify filters. You can use any basic attribute of an event to define a filter. v v v v v All operators get all events Geographic differentiation Network topology differentiation Organizational differentiation Event-type differentiation
Susan can assign the new event groups to the predefined event consoles, or she can create new event consoles and assign the event groups to the new event consoles.
Event Console All Events All Events root All Events Read Only
49
Event Group
Roles
Tivoli NetView Faults super senior admin user Tivoli NetView Faults senior admin user
50
Event status
An event begins in the open state, and an operator can change events to other states. The possible states of an event include the following: ACK An operator has acknowledged the event and assumed responsibility for it.
CLOSED The event has been resolved. An event adapter can also send an event with a status of CLOSED to indicate that a previously received event of the specified class should have the status changed to CLOSE. The previously received event to be closed is the most recent duplicate of the same event description. The event is dropped and not stored in the event database. Do not change the status of a CLOSED event. custom_status A status that has been added to the STATUS enumeration for site-specific purposes. An administrator defines the STATUS enumeration in the root.baroc file. OPEN No action has been taken on the event.
Copyright IBM Corp. 2003
51
RESPONSE A rule has automatically responded to the event. The RESPONSE status is assigned by a rule language predicate and is not available from an event console.
Event severity
Events are classified with different severity levels. The severity levels help you to focus on the most severe problems first. The event console uses the following indicators, listed in order of decreasing severity, to indicate the severity of an incoming event: v FATAL v CRITICAL v MINOR v WARNING v HARMLESS v UNKNOWN Custom severities can be created by adding new enumeration values to the root.baroc file.
52
Starting the event console from the command line in a bash shell
To start the event console from the command line in a bash shell, follow these steps: 1. Enter the following command from the bash shell: v From a DOS prompt or the bash shell on Windows:
tec_console.cmd
The Tivoli Management Environment dialog is displayed. 2. From the Tivoli Management Environment dialog, type the following information in the text fields: v The name and port number of your host computer in the following format:
host_computer_name:port_number
v Your Tivoli Management Framework login ID v Your Tivoli Management Framework password 3. Click OK.
v Your Tivoli Management Framework login ID v Your Tivoli Management Framework password 3. Click OK. The tec_console command starts the event console. This command is located in the $BINDIR/bin directory on the managed node where the event console is installed. On a host in a non-Tivoli environment or an endpoint with the non-Tivoli version of the event console installed, the command is located in the directory where the event console was installed. For more information about the tec_console command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Chapter 4. Managing events
53
Viewing events
The Summary Chart view is the initial view, which offers a quick view of the event activity of all event groups for an event console using stacked bar charts. Click any bar representation of an event group to display details about that event group. You can change the initial event console view to the Priority view and click on the button representing a specific event group to view events. For more information about event viewer options, refer to the online help. The event viewer displays all events for a selected event group. The top pane of the event viewer displays the Working Queue and the bottom pane displays the All Events Queue. To hide the Working Queue or the All Events Queue, expand or collapse the appropriate view using the arrow button displayed on the horizontal bar between the two views. The All Events Queue displays all events at all times. You can filter the events displayed in the Working Queue using the filter buttons on the tool bar of the event viewer. You can view an event from the event console or from the command line. To view an event from the event console, select the event and click View. For information about using the command line to list events, refer to the wlsemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and authorization role required to perform this task.
Activity View an event Context Java version of the event console Required Role user, rim_view
Acknowledging events
You must have the event viewer displayed to acknowledge an event. When you select an event group in the event viewer, all events for that event group are displayed. To acknowledge events, select one or more events from the Working Queue and click Acknowledge. For information about using the command line to acknowledge an event, refer to the wsetemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and event group role required to perform this task.
Activity Acknowledge an event Context Java version of the event console Required Role admin
Running tasks
You can configure and run tasks from task libraries using event console dialogs. You can also configure and run most tasks from the command line using the
54
wruntask command. For more information about the wruntask command, refer to the Tivoli Management Framework Reference Manual. Note: In this section, the term configure means to specify the input parameters and target hosts for the task. To configure and run a task immediately, select Task Execution from the Selected menu in the event viewer. Details about each task and how to configure and run tasks from the command line are described in the Tivoli Enterprise Console Reference and the TEC Library Tasks entries in the online help. The event console also provides the ability to run automated tasks from the event console. Automated tasks are configured ahead of time and run when a particular event is received. For example, an administrator can configure an automated task to send an e-mail message to an administrator when an event matching the criteria you defined is received by the event console. To configure automated tasks, select Automated from the Selected menu in the event viewer. From the Automated Tasks dialog, you can define or modify the following properties: v v v v Name Description When an event matches Execute these tasks
When an automated task completes, the task issues information about its success or failure and the output of the task, if any. A task-completion icon is displayed in the first column of the event viewer when an automated task completes. You can click the icon to view details about the automated task results. Automated task results can also be written to a text file, which an administrator configures in the Console Properties dialog for each console. For more information about running an automated task, refer to the Automated Task entries in the online help.
55
Closing events
You must have the event viewer displayed to close an event. When you select an event group in the event viewer, all events for that event group are displayed. To close events, select one or more events from the Working Queue and click Close. For information about using the command line to close an event, refer to the wsetemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and authorization role required to perform this task.
Activity Close an event Context Java version of the event console Required Role admin
56
View event information in the Java version of the event event viewer console
57
console. For example, if the time on the node is 9:00 and the time on the event server is 10:30, all new events appear to be 90 minutes old to the event consoles. Maximum Number of Events Specifies the maximum number of events to display in the event viewer. For more information about changing general preferences, refer to the online help. The following table lists the context and authorization role required to perform this task.
Activity Change general preferences Context Java version of the event console Required Role user
Because the general user preferences, the name of the last managed node you logged in to, and your user ID are stored locally in the $HOME/.tmeconsole directory, your preferences are maintained between sessions. Similarly, the preferences you set are used when you log on to the Java version of the event console on another computer.
To change the severity colors, follow these steps: 1. From the Edit menu in the event viewer, select Preferences. The Preferences window is displayed. 2. From the Preferences window, expand Event Viewer and then click Severity Colors. 3. Change the settings in the Severity Colors window, referring to the online help for additional information. The following table lists the context and authorization role required to perform this task.
Activity Change severity colors Context Java version of the event console Required Role user
58
Sorting events
You can sort all events or only events in the Working Queue based on any event field in the event viewer. Initially events are sorted based on event severity. If multiple events have the same severity, the events are sorted based on the event date. Events with the highest severity are displayed at the bottom, and events with the lowest severity are displayed at the top. To sort events, follow these steps: 1. From the Edit menu in the event viewer, select Preferences. The Preferences window is displayed. 2. From the Preferences window, expand Event Viewer and then click either All Events to sort all events or Working Queue to sort events in the Working Queue. 3. Set the sort criteria you want in the Sort window, referring to the online help for additional information. The following table lists the context and authorization role required to perform this task.
Activity Sort events Context Java version of the event console Required Role user
Filtering events
You can filter the events in the Working Queue based on severity, status, and operator ownership to help you focus on important events. When you filter events for one event group, other event groups are not affected. To filter events, follow these steps: 1. From the Options menu in the event viewer, select Filter Events. 2. Select the checkboxes for the types of events you want to display in the event viewer. Clear the checkboxes for the types of events you do not want to display in the event viewer. The following table lists the context and authorization role required to perform this task.
Activity Filter events by severity and status Context Java version of the event console Required Role user
For information about using a command to list events based on severity and status to standard output, refer to the wlsemsg command in the IBM Tivoli Enterprise Console Command and Task Reference.
59
Portfolio The primary way that your work is organized within the event console. It is titled My Work. Each entry in the portfolio represents a task that you can perform. The following table describes the tasks in the portfolio.
Table 8. Portfolio tasks in the Web version of the event console Task Select an Event Group Function Lists the event groups available to the operator. An operator can select an event group to view the events assigned to the operator. Displays a table that summarizes events by severity. Runs predefined tasks from task libraries when an event is not required to run the task. Note: When an event is required to run the task, you must run the task from the event viewer. Changes how events are shown in the event viewer. Displays the Welcome page.
The portfolio is open when you start the event console. To close and open the portfolio, click the Hide Tasks and Show Tasks icons, respectively, on the left side of the tool bar in the event console. You might want to close the portfolio to increase the size of the work area. Work Area The area in which task windows are displayed. When the portfolio is closed, the entire page is the work area. taskbar The bar that is located above the work area. The taskbar contains a button for each task that you start so that you can switch between tasks. The taskbar also contains the following icons: All Tasks Displays the Task Manager, which contains a list of all tasks you have started. To switch to a task, select the task and click Switch Task. To end a task, select the task and click End Task. The All Tasks icon is located on the far left corner of the taskbar. Sign Off Signs off the event console. The Sign Off icon is located on the far right corner of the taskbar. Recent Event Groups The area of the portfolio that contains the last five event groups that have been viewed in the event viewer. Task button A button on the taskbar that represents each portfolio task that you have started. When you click a task button, the associated task window opens in the work area. Task Assistant Help for the currently displayed portfolio task. The Task Assistant is represented by a question mark in the upper right corner of the event console. When it is open, the Task Assistant is displayed within the event console to the right of the work area. For windows that require user input,
60
you can also display field descriptions. The icon for field descriptions is represented by an i. This icon is located to the left of the Task Assistant icon. Task Close The icon on the far right of the title bar of the work area, which you can use to close the task that is displayed. Note: When using the Web version of the event console, you might find that some pages display better if you reduce the size of the text. Use the controls that your Web browser provides to reduce the size of the text.
Where computer_name is the fully-qualified name of a computer where the Web server is running. 3. Type your Tivoli Management Framework user ID in the User Name field. 4. Type the password for the specified user ID in the Password field. 5. Select the appropriate managed node from the Server Name drop-down list. 6. Click OK.
Viewing events
To view events, follow these steps: 1. Click Select an Event Group from the portfolio in the event console. A list of event groups is displayed. 2. Click the name of the appropriate event group. An event viewer is opened, which contains the events in the selected event group. The event viewer automatically refreshes at specific time intervals. To suspend the automatic refresh, click the Suspend icon on the toolbar. To resume the refresh, click the Resume icon. The status bar at the bottom of the window indicates if automatic refresh is enabled, suspended, or needed (automatic refresh has been suspended and the refresh interval has been exceeded). You can also select an event group from the Summary of Events table. To view the Summary of Events table, click View Summary of Events from the portfolio.
Acknowledging events
To acknowledge events, select one or more events in the event viewer and click Acknowledge on the tool bar. You can also use wsetemsg command to acknowledge an event. For more information about the wsetemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
61
Running tasks
To run a task, choose one of these methods: v If the task requires a source event, select one or more events in the event viewer. Then select Run Task from the Action menu in the event viewer and click Go. v If the task does not require a source event, select Run Tasks from the portfolio. The task wizard guides you through the steps required to run the task. For more information about running a task, refer to the online help in the event console. The task results are shown in a new window of your Web browser. Use the print option of your Web browser controls to print the task results. You can also run most tasks from the command line using the wruntask command. For more information about the wruntask command, refer to the Tivoli Management Framework Reference Manual. For information about tasks in the T/EC Tasks library, refer to the Tivoli Enterprise Console Reference.
Closing events
To close events, select one or more events in the event viewer and click Close on the tool bar. You can also use the wsetemsg command to close an event. For information about the wsetemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
62
Note: The implementation of trouble tickets depends on how your administrator integrated your trouble ticket system with the trouble ticket rules that the Tivoli Enterprise Console provides.
63
Changing preferences
The preferences control how events are shown in the event viewer. The changes you make, except for changes to the maximum number of events to show in the each event viewer, are reflected immediately in all open event viewers. Because changes to the preferences are stored in cookies, ensure that the privacy settings for your Web browser are set to allow cookies if you want the changes to be persistent. If cookies are not allowed, changes to the preferences affect only the current session. The preferences you set do not affect a Web console on a different computer. To change the preferences, click Change User Preferences in the portfolio. You can change one or more of the following user preferences: Refresh rate Specifies the rate at which you want events automatically refreshed in the event viewer and in the summary of events. Maximum number of events to show on each page Specifies the maximum number of events you want to show on each page in the event viewer. Severity counts Specifies whether or not to show the number of events in each severity on the event filter icons in the event viewer. Maximum number of events to show in each event viewer Specifies the maximum number of events you want to show in the event viewer. The value for this preference is determined in combination with the preference setting for the maximum number of events in the Java version of the event console. If the value specified in the Web version of the event console differs from the value specified in the Java version of the event console, the maximum number of events is set to the lower of the two values. Changes to the maximum number of events to show in each event viewer are reflected the next you time open an event viewer. Banner Specifies whether or not to show the banner in the event viewer. Show the event severity as Specifies how to show the event severity in the event viewer. The event console uses color and icons to indicate the severity level for an event. The following table describes the color and icon that corresponds to each event severity.
Table 9. How event severity is indicated in the Web version of the event console Severity Fatal Critical Minor Warning Color Black Red Orange Yellow Icon
64
Table 9. How event severity is indicated in the Web version of the event console (continued) Severity Harmless Unknown Color Green Blue Icon
Sorting events
By default, events are sorted in the event viewer by the date received field. You can sort events based on up to three event fields. To do this, click the Edit Sort icon on the tool bar in the event viewer.
Filtering events
You can filter events in the event viewer by event severity, event status, and event owner. Filtering events in this manner helps you focus on the events of interest. To filter events, use the event filter icons on the tool bar in the event viewer.
65
66
67
configuration profile that contains the tec_gateway or the tec_gateway_sce profile. Use the tec_gateway_sce profile if you want to use state correlation at the Tivoli Enterprise Console gateway. For information about the gateway configuration file, see Gateway configuration file. For more information about using an adapter configuration profile, refer to the IBM Tivoli Enterprise Console Adapters Guide. Note: To distribute a modified Tivoli Enterprise Console gateway adapter configuration profile to a managed node with a gateway installed, the managed node must also have an endpoint installed on it. When you distribute the adapter configuration profile, the subscriber must be the endpoint on that managed node.
The configuration file defines the behavior of the Tivoli Enterprise Console gateway. For information about the common keywords for the configuration file, refer to the IBM Tivoli Enterprise Console Adapters Guide or the Tivoli Event Integration Facility Reference. The configuration file can also use the following custom keywords: APPEND_CLASSPATH=string Specifies the string that is appended to the CLASSPATH environment variable before Java-based state correlation is started. The string is appended using the appropriate delimiter, a semicolon (;) for Windows or a colon (:) for UNIX. The string must contain valid data for your environment as shown in the following example: UNIX:
APPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar
Windows:
APPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar
68
For the tec_gateway program, the specified string is appended to the list of jar files used for state correlation. For a C Adapter, the specified string is appended to the CLASSPATH environment variable. Notes: 1. The CLASSPATH environment variable will not be changed. The CLASSPATH information is only passed to the Java code when state correlation is started. 2. You can specify the APPEND_CLASSPATH keyword only one time in your configuration file. BufEvtPath Specifies the file in which to buffer events when the Tivoli Enterprise Console gateway cannot forward the events to the event server. Because a single Tivoli Enterprise Console gateway can forward events to multiple event servers, it must have an event buffer file for each event server. When the Tivoli Enterprise Console gateway reestablishes the connection to the event server, it sends the buffered events to the event server. The Tivoli Enterprise Console gateway creates a buffer file for each event server by appending the event server location specified by the ServerLocation keyword to the name of the file specified by the BufEvtPath keyword. Assume that the ServerLocation and the BufEvtPath keywords are specified as follows:
ServerLocation=@EventServer#tmr-central BufEvtPath=/etc/Tivoli/tec/gateway_cache
The Tivoli Enterprise Console gateway creates the /etc/Tivoli/ tec/gateway_cache@EventServer#tmr-central buffer file. If the Tivoli Enterprise Console gateway receives an event from an adapter that specified server location as @EventServer#tmr-east, the Tivoli Enterprise Console gateway also creates a buffer file named /etc/Tivoli/tec /gateway_cache@EventServer#tmr-east. The default value is one of the following: UNIX: /etc/Tivoli/tec/cache@EventServer#region Windows: $DBDIR/cache.dat@EventServer#region (on managed nodes) $TIVOLIHOME/tec/$(AC_TYPE).cache@ EventServer#region (on endpoints) Note: To reduce network traffic and improve performance, filter events as close to the source as possible by specifying filter options in adapter configuration files. You can also use the Filter, FilterCache, FilterMode, and UseStateCorrelation keywords in the Tivoli Enterprise Console gateway configuration file. EventSendThreshold Specifies the maximum number of events per second to send to the event server. Use this keyword in conjunction with the
Chapter 5. Tivoli Enterprise Console gateway
69
BufferFlushRate keyword. For more information about how to set the value for this keyword, see Gateway configuration example on page 76. GatewayAckInterval Specifies the timeout interval, in seconds, to wait for acknowledgement from the event server. The default value is 30 seconds. This keyword works in conjunction with the GatewayTMEAckEnabled keyword for event delivery. GatewayQueueSize Specifies the size, in bytes, for the event buffers. If any of the event buffers fill before expiration of the interval specified by the GatewaySendInterval keyword, the Tivoli Enterprise Console gateway immediately sends the the waiting events to the event server. The minimum value for this keyword is 4096 bytes. If the GatewayQueueSize keyword is set to a value lower than 4096, this keyword is set to 40000, which is the default. GatewaySendInterval Specifies the interval, in seconds, at which to forward events to the event servers. The Tivoli Enterprise Console gateway holds events when they are received. When this interval expires, the Tivoli Enterprise Console gateway bundles and forwards the events in a message to the appropriate event servers. The default interval is five seconds. GatewayTMEAckEnabled Specifies whether or not an acknowledgement is expected from the event server. To ensure event delivery, set this keyword to YES (connection-oriented). The default value is NO. gwr_ActiveConnections=nn Specifies the number of active connections that the tec_gwr program manages at one time. The number of possible connections ranges from 2 to 1000. If the value specified for this keyword is greater than 1000, the number of active connections is set to 1000. If the value specified for the keyword is less than 2, the number of active connections is set to 2. If you do not specify a value for this keyword, the number of possible active connections is not limited. gwr_ActiveConnectionsSafety=nn Specifies the percentage of active connections that the connections specified by gwr_ActiveConnections keyword must be reduced to before connections can be processed again. Valid values range from 10 to 90. When the number of active connections specified in the gwr_ActiveConnections keyword is reached, no new connections are accepted until the number of connections drops below this specified threshold. For example, if the gwr_ActiveConnections keyword is set to 20 and the gwr_ActiveConnectionsSafety is set to 80, the tec_gwr program stops accepting connections when 20 connections are reached. The tec_gwr program accepts new connections when the number of active connections is reduced to 16 or less (80% of 20). The default value is 80. This keyword is used only when a value is specified for the gwr_ActiveConnections keyword.
70
gwr_ConnectionsQueued=nn Specifies the number of connections that the server socket queues. The server socket queues connections that are waiting to be accepted by the tec_gwr program. Use this option to limit the number of connections that can be queued. Valid values range from 1 to 1000. The actual number of queued connections can be slightly more or less than the value you specify. The default value is 500. This keyword is optional. gwr_Enable=YES|NO Specifies whether or not the tec_gateway program receives events from non-TME adapters. To enable the tec_gateway program to receive events from non-TME adapters, specify YES. The default value is NO. This keyword is optional. gwr_OptionPortNotAvailable=ERROR|WAIT Specifies how the tec_gwr program processes events when the port specified by the gwr_ReceptionPort keyword is not available. When this keyword is set to ERROR, the tec_gwr program ends if the port specified in the gwr_ReceptionPort keyword is not available. When this keyword is set to WAIT, the tec_gwr program continues processing instead of returning an error when the port is not available. When the port becomes available, a server socket is created. The default value is ERROR. This keyword is optional. gwr_ReceptionPort=port Specifies the port on which to listen and receive events from non-TME adapters. The default value is 5539. This keyword is optional. gwr_ReceptionTestMode=path Specifies the path and the file name from which to read test mode events. This keyword is similar to the TestMode keyword in that events are read from a data file as opposed to being received on a port. This keyword is optional. gwr_RetryCount=nn Specifies the number of times to resend an event when the tec_gateway program fails to receive an event from the tec_gwr program. The default value is 10. This keyword is optional. gwr_RetryInterval=nn Specifies the interval, in seconds, between retry attempts specified by the gwr_RetryCount keyword. The default value is 1. This keyword is optional. gwr_ServerLocation=host_name Specifies the name of the host on which the event server is installed. The default value is the value of the ServerLocation keyword. This keyword is optional. gwr_ServerPort=port_number Specifies the server port to use for the host specified by the gwr_ServerLocation keyword when events are received from non-TME adapers. The specified server port is used when the value for gwr_ServerLocation is any value other than @EventServer. The default value is 0. This keyword is optional. gwr_ServiceServer=host_name:port_number Specifies the host and port number to which to send service-related
Chapter 5. Tivoli Enterprise Console gateway
71
events. The tec_gwr program sends service status events that belong to the TEC_Notice class to the event server specified by this keyword. The tec_gwr program sends a service status event when the tec_gwr program is started or stopped or when the submission handle is reset. Specify the host and port number as follows:
myEventServerHost:5529
To send service status events from the tec_gwr program to the tec_gateway program, set this keyword to SAME as follows:
gwr_ServiceServer=SAME
gwr_SubmissionTestMode=path Specifies the path and file name from which to read test mode events. This keyword is similar to the TestMode keyword in that events are read from a data file instead of being received on a port. This keyword is optional. MaxGWCacheSizeMegs Specifies the maximum size, in megabytes, of the event cache. By default, the maximum size of the event cache is 1 MB. The keyword is not included in the configuration file as provided. PREPEND_CLASSPATH=string Specifies the string that is prepended to the CLASSPATH environment variable before Java-based state correlation is started. The specified string is prepended using the appropriate delimiter, a semicolon (;) for Windows or a colon (:) for UNIX. The string must contain valid data for your environment as shown in the following example: UNIX:
PREPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar
Windows:
PREPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar
For the tec_gateway program, the specified string is prepended to the list of jar files used for state correlation. For a C Adapter, the specified string is prepended to the CLASSPATH environment variable. Notes: 1. The CLASSPATH environment variable will not be changed. The CLASSPATH information is only passed to the Java code when state correlation is started. 2. You can specify the PREPEND_CLASSPATH keyword only one time in your configuration file. RetryInterval Specifies the interval, in seconds, to wait before connecting to a secondary event server when the Tivoli Enterprise Console gateway cannot send events to the event server. While the Tivoli Enterprise Console gateway is waiting for this time interval to expire, the Tivoli Enterprise Console gateway continues to receive and cache new events. To adjust the size of the Tivoli Enterprise Console gateway memory queues, use the GatewayQueueSize keyword.
72
The RetryInterval keyword enables adapters to send all events to the primary event server even if the primary event server is stopped briefly, such as when loading a new rule base. If you use this option to wait for the event server to restart, set the value for a period of time longer than needed for the event server to be stopped and restarted. The RetryInterval keyword is optional. ReceiveAckPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to receive acknowledgements from state correlation. The acknowledgements indicate that state correlation has received and stored the events. This keyword is used in conjunction with the SendEventPort keyword. This keyword is required when the UseStateCorrelation keyword is set to YES. ReceiveEventPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to recieve events from state correlation. This keyword is used in conjunction with the SendAckPort keyword. This keyword is required when the UseStateCorrelation keyword is set to YES. SendAckPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to acknowledge the reception of events sent from state correlation. This keyword is required when the UseStateCorrelation keyword is set to YES. SendEventPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to send events to state correlation. This keyword is required when the UseStateCorrelation keyword is set to YES. ServerLocation Specifies the default event server location if adapters do not specify an event server location in an event instance. If the ServerLocation keyword is specified in the configuration file for an adapter, the Tivoli Enterprise Console gateway sends events to the adapter-specified event server. If ServerLocation is not specified in an adapter configuration file, the Tivoli Enterprise Console gateway sends events to the event server specified by ServerLocation keyword in the Tivoli Enterprise Console gateway configuration file. If the ServerLocation keyword is not specified in the Tivoli Enterprise Console gateway configuration file, the Tivoli Enterprise Console gateway sends the event to the event server in the local Tivoli region. The default value is @EventServer. You can specify multiple event server names as a comma-delimited list. Event server names later in the list can be backup event servers when the Tivoli Enterprise Console gateway cannot contact its primary event server for an event and the interval specified by the RetryInterval keyword has expired without successfully contacting the primary server. You can specify a host name as you would for a non-TME adapter, and the events are then forwarded
73
to that host using non-Tivoli communication. For more information, see the examples in the description of the ServerPort keyword. When the Tivoli Enterprise Console gateway cannot contact the adapter-specified event server, the event server names specified in the list are backup event servers. If ServerLocation is not present in the Tivoli Enterprise Console gateway configuration file, the Tivoli Enterprise Console gateway uses the default @EventServer value as the backup event server. To prevent event delivery to backup event servers, set the ServerLocation keyword to NONE. Note: When the ServerLocation keyword is used in conjunction with the TestMode=YES keyword, the ServerLocation keyword defines the path and the file name for logging events instead of the event server. ServerPort Specifies the port that the event server uses to send events using non-Tivoli communication. The default value is 0, which causes the portmapper daemon on the specified host to determine the port on which the event server is listening for incoming events. If you are forwarding events to a Tivoli Availability Intermediate Manager, you cannot specify 0 as the port because the Tivoli Availability Intermediate Manager does not register itself with the portmapper daemon. If you specify a value for the ServerPort keyword, the value must be either a single port number or a comma-delimited list of port numbers that correspond to the list of event servers specified in the ServerLocation keyword. If you specify a single port number and you have specified multiple event servers in the ServerLocation keyword, all event servers use the port number specified. Assume that you have a Tivoli Availability Intermediate Manager running on hosts aim.xyz.com and aimbkup.xyz.com, and the ServerLocation and the ServerPort keywords are specified as follows:
ServerLocation=aim.xyz.com,aimbkup.xyz.com,@EventServer ServerPort=5530,5531,0
Events are sent to port 5530 on the host aim.xyz.com using non-Tivoli communication. If that fails, events are sent to port 5531 on the host aimbkup.xyz.com. If that also fails, events are sent directly to the event server in the local Tivoli region using Tivoli communication. The port value of 0 specified for @EventServer is ignored because port numbers are not needed when using Tivoli communication.
74
If an event sent from the tec_gwr program to the tec_gateway program fails, the tec_gwr program resends the event when the gwr_RetryCount keyword is set to a value greater than or equal to 1. The tec_gwr program resends the event after waiting for the time period specified by the gwr_RetryInterval keyword. The number of retry attempts is equal to the value specified for the gwr_RetryCount keyword. To configure non-TME adapters to use the IBM Tivoli Enterprise Console gateway, set the ServerLocation/channelServerLocation and the ServerPort/channelPort keywords in the configuration file of the adapter to the host name and port number that the tec_gwr program uses. If the tec_gwr program is not running on the same host as the event server, you can register the tec_gwr program with the portmapper daemon. To do this, set the value of the gwr_ReceptionPort keyword in the Tivoli Enterprise Console gateway configuration file to 0. Note: Messages received on the socket are generated by non-TME adapters and must be in the correct format as defined by the Tivoli Event Integration Facility in the Tivoli Enterprise Console product. Other types of messages are discarded. The Tivoli Enterprise Console product uses the following files to receive events from non-TME adapters: v UNIX and Windows: tec_gwr.cfg Installation script. init.tec_gwr Script used to start and shut down the tec_gwr program. v Windows only tec_gwr.exe Executable file. tec_gwrs.exe Executable file as a service. sctlgwr.exe Service controller and installation utility. v UNIX only tec_gwr Executable file.
75
Follow this procedure to run a state machine: 1. Modify the state correlation keywords in the configuration file. The following code fragment illustrates the use of the appropriate keywords:
UseStateCorrelation=YES # for Windows NT only StateCorrelationConfigURL=file:C:\tmp\test.xml # for all other INTERPs # StateCorrelationConfigURL=file:///tmp/test.xml # SendEventPort=1234 # ReceiveAckPort=4321 # ReceiveEventPort=5678 # SendAckPort=8765
2. To run state correlation on an IBM Tivoli Enterprise Console gateway, change the adapter configuration profile (ACP) record, tec_gateway_sce, as follows: a. In the Current EIF Environment list, ensure that the UseStateCorrelation, SendEventPort, ReceiveAckPort, ReceiveEventPort, and SendAckPort keywords are set. b. Select the XML file to distribute, which you specified in step 1. c. Distribute the tec_gateway_sce ACP. After the state machine is running, you can test whether state correlation is properly filtering events in the following ways: v If you have written rules to generate event summaries, ensure that the event server is receiving the event summaries. v If you have written rules to suppress events, ensure that suppressed events do not arrive at the event server.
Configuring the rate at which events are sent to the event server
At certain times, the number of events coming from endpoint adapters can overwhelm the Tivoli Enterprise Console gateway, the event server, and even the network. You can control the rate at which the Tivoli Enterprise Console gateway sends events to the event server using the EventSendThreshold, the BufferFlushRate, and the MaxGWCacheSizeMegs keywords in the Tivoli Enterprise Console gateway configuration file. The example in this section shows how to determine the values for the BufferFlushRate and EventSendThreshold keywords in the Tivoli Enterprise Console gateway configuration file to improve event server performance.
76
2. Determine the number of Tivoli Enterprise Console gateways and the resulting number of events that they can send to the event server. Divide the average capacity of the event server by the number of Tivoli Enterprise Console gateways as shown in the following example:
120 2 = 60
The resulting value of 60 indicates the average number of events each Tivoli Enterprise Console gateway can send without overwhelming the event server. Continue with step 3 to obtain the adjusted values for the Tivoli Enterprise Console gateway send rate. 3. Calculate the value for the EventSendThreshold keyword. The EventSendThreshold keyword sets the maximum number of events per second that the Tivoli Enterprise Console gateway sends to the event server. Because gateway A forwards events from mission-critical systems, more gateway A events should be sent to the event server than gateway B events. Thus, the EventSendThreshold keyword for gateway A is set to 80 events per second. Gateway B has the EventSendThreshold keyword set to 40 events per second. This way, more gateway A events get to the event server. The sum of the values for gateway A and gateway B must be less than or equal to the 120 events that the event server can process:
80 + 40 120
4. Determine the value for the BufferFlushRate keyword. Any events above the value specified for the EventSendThreshold keyword are stored in the cache on the Tivoli Enterprise Console gateway. To regulate the number of events being sent to the event server, the BufferFlushRate keyword controls the number of events per minute to be sent from the cache, when the gateway recovers a lost connection to the event server. For gateway A, the BufferFlushRate keyword is set to 5400 events per minute (90 events per second), and for gateway B the keyword is set to 3000 events per minute (50 events per second). Thus at peak traffic times, the event server is receiving 140 events per second from both Tivoli Enterprise Console gateways:
90 + 50 = 140
Although 140 events per second is greater than the average capacity of the event server (120 events per second), the event server has the capability to process excess events during brief, intermittent periods of time. Tip: Remember to convert events per second to events per minute before setting the value for the BufferFlushRate keyword. 5. Modify the adapter configuration profile for the Tivoli Enterprise Console gateway with the values calculated in step 3 and step 4. 6. Distribute the Tivoli Enterprise Console gateway adapter configuration profile. Depending on the number of Tivoli Enterprise Console gateways and endpoints in your environment, you need to carefully consider the rates you specify for the keywords. For instance, an improper configuration might have multiple Tivoli Enterprise Console gateways sending events at the same rate, thus flooding the event server at the same time. See Gateway configuration file on page 68 for details about these keywords.
77
Table 11. Example rate at which events are sent to the event server Event Send Adjusted Rate Rate Gateway A 60 80 EventSendThreshold 80 BufferFlushRate 5400 events per minute (90 events per second) Gateway B 60 40 40 3000 events per minute (50 events per second) Total Events Sent to Event Server 120 120 120 140 events per second
v Windows:
net start TECGWR
78
v Windows:
net stop TECGWR
79
80
Appendix A. Troubleshooting
This appendix contains suggestions for isolating problems that you might encounter when using the Tivoli Enterprise Console product. To use the troubleshooting information in this appendix, you must have administration experience with the the Tivoli Enterprise Console product and you must be able to read Tivoli Management Framework log and trace files. The troubleshooting information in this appendix also requires that you have knowledge about the following items: v SQL v Three-tier architecture (database management, process management, and user system interface) v Installed Tivoli applications v Tivoli Management Framework
81
Note the PARSING_FAILED line in the wtdumprl output. For detailed information about how PARSING_FAILED affects performance, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. wtdumper Generates a report of events in the event repository. The event repository is a table of received events in the event database. The following example is a sample output fragment from running the wtdumper command.
$ wtdumper -o DESC|more ES~1~993068442(Jun 20 15:20:42 2001)~6~TEC_Notice~ LOGFILE~~69.1.6.100~~~~OPEN~ ~[ admin]~CRITICAL~ Jun 20 15:20:42 2001~ CRITICAL postemsg test~ ~0~ 0~0~ES~1~993068442(Jun 20 15:20:42 2001)~1~Su_Success~ TEC~LOGFILE~69.1.6.100~N/A~~N/A~OPEN~ ~[ admin]~WARNING~ Jun 20 15:20:42 2001~ WARNING wpostemsg test~ none~0~
wtdbclear Deletes events from the event database. Use the wtdbclear command to delete events from the event database on a regular basis. Doing so helps to maintain good performance of the Tivoli Enterprise Console product. Use caution when running the wtdbclear command from a managed node other than the event server. The time from the local machine from which the command has been run is used to determine which events to clear, not the time from the event server. Note: For optimal performance, run the wtdbclear command during non-peak processing hours. For more information about the wtdumprl, the wtdumper, and the wtdbclear commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
82
Table 12. Event server processes (continued) Process Name tec_rule tec_dispatch tec_task Description The rule engine process The dispatch engine process The task engine process
If any of the event processes fail, messages are written to files defined in the $BINDIR/TME/TEC/.tec_diag_config file. For more information about this file and the log files, see Event server process log files on page 85. The following figure illustrates the relationships among the event server processes. The arrows represent the flow of communications.
Master
(tec_server)
Task engine
(tec_task)
Rule engine
(tec_rule)
Dispatch engine
(tec_dispatch)
(tec_ui_server)
Console
Console
Console
The following sections describe the flow of an event through each of the Tivoli Enterprise Consoles five processes.
Master process
The controlling (master) process, tec_server, initializes the tec_dispatch, the tec_reception, the tec_rule, and the tec_task processes and restarts them if they stop. The tec_server process manages events as follows: 1. The tec_server process receives incoming events from Tivoli communication. 2. The tec_server process forwards received events to the tec_reception process. If errors are encountered during the tec_server process, the error messages are written to the /tmp/tec_master file by default.
83
The following list explains what happens to an event during the tec_reception process: 1. An event is received by the tec_reception process. 2. The event is stored in the reception buffer with a status of QUEUED. 3. If the reception buffer is full, the event is stored in an event database table named tec_t_evt_rec_log with a status of WAITING. 4. When space is available in the reception buffer, the events in the database in WAITING status are read into the reception buffer and marked as QUEUED. If errors are encountered by the tec_reception process, the error messages are written to the /tmp/tec_reception file by default.
UI server process
The UI server process provides communication services between event consoles and the event server, and between event consoles and the event database. It communicates with the dispatch engine when it needs contact with the event server. The UI server provides the event consoles with updated event information and provides the dispatch engine with change requests to events from event consoles. For more information about the UI server process, see the IBM Tivoli Enterprise Console Rule Developers Guide.
84
Note: In a Windows or UNIX environment, the /tmp directory must already exist on your system for the log files to be properly created and saved. UNIX systems usually have a /tmp directory by default, but Windows temporary directories are named /temp. Rename /temp to /tmp, or add a directory named /tmp. For information about .tec_diag_config file parameters, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Appendix A. Troubleshooting
85
For more information about using the wtdumper command, see Problems locating an event on page 81. v Use the rule tracing facility to ensure that events are being processed through the rule engine. If the event is shown in the wtdumprl command output but not in the wtdumper command output, you might have a rule that is causing the event to be dropped.
For additional troubleshooting using the wpostemsg command, use the wtrace command, as described in Analyzing Tivoli Management Framework trace logs on page 90. For defining specific results using the wtrace command, use the odstat command to filter for specific details.
86
Notes: 1. The wpostemsg command is a form of the Event Integration Facility implementation that uses caching ability. 2. If the connect_agent method call returns an e=12 return code, the wpostemsg command caches the event. The e=12 return code indicates that the event server is not available. For more information about using the wpostemsg command, see the IBM Tivoli Enterprise Console Command and Task Reference.
Using the f option with the postemsg command specifies the name of the adapter configuration file. The adapter configuration file must specify the ServerLocation keyword and, if necessary, the ServerPort keyword. You can use any of the keywords in the adapter configuration file specified by the f option with the postemsg command. Using the f option with the postemsg command is preferred over the S option because it offers more flexibility and because you can specify a standard configuration file. Note: Output from the postemsg command is not included in Tivoli Management Framework trace file output. For more information about the postemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
87
The following list describes the common problem types you can encounter with interconnected Tivoli regions: - Inter-region passwords - Secure and remote connections - One-way and two-way connections - Inability to connect to a previously connected Tivoli region - Unable to disconnect a Tivoli region - Updating the name registry Updating resources Remote resources are not visible or accessible Inability to perform actions on remote objects Application failures across Tivoli region boundaries
For information about troubleshooting each of these potential problems with interconnected Tivoli regions, refer to the Tivoli Management Framework Maintenance and Troubleshooting Guide. v For troubleshooting possible database and RIM problems, see Problems with the RIM database on page 89. v If you suspect problems with the rule base, load and run the default rule base or a known working rule base as a test. If this confirms a problem with the rule base, see Problems with rules on page 88 and the IBM Tivoli Enterprise Console Rule Developers Guide for additional troubleshooting information.
88
Note: When a rule base is compiled for the production environment, disable rules tracing because rule tracing impacts event processing performance. Rules generate trace output in a file. You can examine the resulting trace file to analyze and debug problems related to rules. The name and location of the trace file is set when the event server is configured. The following table describes the information found in rule trace files.
Table 14. Output in rule trace files Output Type action condition prolog calls rule predicate Description The action set when the rule trace is entered and exited The condition set when the rule trace is entered and exited The prolog calls trace, limited to a level of one depth The trace rule whose header matches the current event The predicate used when entering, exiting, or failing a predicate action
For more information and specific instructions for determining the level of granularity for your trace results, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Tuning rules
The following list describes suggested techniques for tuning rules. v Write rules to drop unneeded events immediately (as one of the first rules encountered so that events do not have to process through all rules in the rule base). v Use the commit_action, commit_rule, and commit_set rule language predicates frequently. v Monitor the number of rule timers used. v When writing rules, limit the use of the following predicates: all_instances all_duplicates generate_event predicates For detailed information about tuning rules, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Use the wrimtest command to connect to a specified database and run RIM methods.
Appendix A. Troubleshooting
89
wrimtrace Enables or disables tracing for RIM objects. The contents of the Inter-Object Message (IOM) packets are passed between the RIM object and client program. RDBMS errors are then printed to the RIM log file. Note: The RIM tracing function is intended for debugging purposes. If enabled for extended periods of time, tracing can decrease performance and considerably slow the processing of RIM calls. For additional information about RIM Troubleshooting, refer to the Tivoli Management Framework Users Guide and the Tivoli Management Framework Maintenance and Troubleshooting Guide. Additional information about troubleshooting RIM problems and RIM tuning can be found in the Using Databases with Tivoli Applications and RIM redbook.
90
/etc/Tivoli/tec/.tec_gateway_diag_config v Windows: %SystemRoot%\system32\drivers\etc\Tivoli\.tec_gateway_diag_config To configure tracing for the tec_gateway process, follow these steps: 1. Edit the .tec_gateway_diag_config file to specify the level of tracing that you want. The sample .tec_gateway_diag_config file is located on the event server in the $BINDIR/../generic_unix/TME/ACF_REP directory. By default, the .tec_gateway_diag_config file looks similar to the following:
Highest_level error Truncate_on_restart true # tec_gateway ############# tec_gateway Highest_level error tec_gateway GW_Send error /tmp/tec_gateway tec_gateway State_Correlator error /tmp/tec_gateway
Both Highest_level keywords set the highest trace level possible within the following sections in the file. The tracing levels from least verbose to most verbose are: error warning trace0 trace1 trace2 The Truncate_on_restart keyword specifies whether or not trace files are truncated to zero bytes when the tec_gateway process starts up. 2. Distribute a gateway configuration profile with the Adapter Configuration Facility. Note: If you have upgraded from a previous release of the Tivoli Enterprise Console product, the Distribution tab for existing gateway configuration profiles is not updated with the .tec_gateway_diag_config file. If you want to enable tracing, you must delete the existing gateway configuration profile and distribute a new gateway configuration profile. Set tracing on to determine the cause of a problem. Otherwise, disable tracing or set tracing at the error level. If you are distributing a gateway configuration profile and you want to disable tracing, delete the .tec_gateway_diag_config file from the gateway configuration profile. If you have already distributed the .tec_gateway_diag_config file and you want to disable tracing, delete the .tec_gateway_diag_config file manually from the Tivoli Enterprise Console gateway.
Where:
Appendix A. Troubleshooting
91
c configuration_file Specifies the location of the Tivoli Enterprise Console gateway configuration file. If you do not specify this parameter, the tec_gwr program searches one of the following directories to locate the tec_gateway.conf configuration file. v UNIX: /etc/Tivoli/tec/tec v Windows: \WINNT\system32\drivers\etc\Tivoli\tec 3. Ensure that no other processes are listening on the reception port. To determine if the reception port is in use, type the following command:
netstat a | grep port_number
Where port_number is the port that the tec_gwr program uses to receive events. The first process to start on a port uses the port, and subsequent processes cannot receive events from that same port. 4. Use the postzmsg or the postemsg command to send events to the tec_gwr program for testing.
92
v v v v
Note: The com.tivoli.tec.wc.TecTrace file produces a large amount of data. 8. Select a trace file group or an individual trace file name to specify the level of tracing you want. 9. Optionally, change the maximum trace file size and the number of old trace files to maintain in the Trace Output field on the Runtime tab. 10. Click Save on the taskbar.
v v v v v
To check RDBMS error logs, see Problems with the RIM database on page 89. v Use filters and rules to view only required events. For optimal performance, avoid the following practices: v Attempting to monitor everything possible in an environment v Attempting to dump everything possible to a central log file v Inefficient rules v Improper event handling
Appendix A. Troubleshooting
93
The following tables are the largest, most frequently accessed Tivoli Enterprise Console tables: TEC_T_EVT_REP TEC_T_EVT_TEC_LOG TEC_T_SLOTS_EVT These tables frequently read, insert, delete, and update information and therefore require indexes so that rows can be quickly returned to the application. For example, if each of the tables and their indexes are split across six different input/output (I/O) devices, they will not encounter I/O contention from the read/write (R/W) head on the device. Database transaction logs operate more efficiently when placed on their own I/O device. Use higher performance devices for index tables, temporary work areas, and transaction logs to provide optimal results when updating and retrieving data. If you cannot attain these specifications, you can achieve optional performance improvements by combining various tables and indexes across available I/O devices so that tables accessed less frequently are mixed with frequently-accessed table and data table operations are split from index table operations. After the TEC_T_EVT_REP, the TEC_T_EVT_TEC_LOG, and the TEC_T_SLOTS_EVT tables, the TEC_T_TASK_REP table is the next most frequently accessed table in the event server. This table contains an index for performance, as do most Tivoli Enterprise Console tables. A row cannot be inserted into the TEC_T_EVT_REP or the TEC_T_SLOTS_EVT tables unless the row has a parent row in the TEC_T_EVT_REP table. Referential integrity is therefore established on these tables so that a row deleted from the TEC_T_EVT_REP table causes rows in the two tables with the same server handle, event handle, and date reception, to be deleted. Referential integrity enhances data integrity by speeding up the deletion process. The event console tables are small and usually contain a LONG or a text column. These columns store a descriptor in the table pointing to the actual location of the data. The event console tables are only updated during the event console configuration processes, such as creating consoles, assigning operators and event groups, creating filters, or assigning console preferences. In cases where there are large numbers of consoles, operators, event groups, and filters, these tables contain indexes that enhance performance. The TEC_T_CONSOLES, the TEC_T_EVENT_GROUPS, and the TEC_T_OPERATORS tables are the base tables for storing event console information. The TEC_T_ASSIGN_OP, the TEC_T_ASSIGN _EG, and the TEC_T_EG_WHRCLAUS tables provide data needed for correlation to determine which operators and event groups are assigned to which event consoles and which event filters are assigned to which event groups. A row in these tables can only exist if a corresponding row also exists in the parent table. Referential integrity ensures that a row deletion from a parent table deletes the corresponding row in the child table. These tables can be installed on the same I/O device because these tables have less frequent I/O requests. The TEC_T_ISA and the TEC_T_ENUMERATIONS tables are cleared and reloaded when the Tivoli Enterprise Console product starts but are subsequently read on an infrequent basis. The TEC_T_ARCHIVE table is installed in the event database when the TDS Tivoli Enterprise Console Event Management Guide is installed and is only updated when events are closed. Therefore, the table has less frequent I/O requests. These tables are all good candidates to install on the same I/O device as with the other more active tables for a mix of workload types.
94
For more information about automated event database configuration using the event database installation assistant, refer to the IBM Tivoli Enterprise Console Installation Guide.
v Tivoli Field Guides for Business Issues Tivoli Field Guides for Business Issues are white papers written by Tivoli software developers and customers that are designed to address specific business practices and have a high impact on the success or failure of an Enterprise System Management (ESM) project. The business papers include the following topics: Change Management Asset Management Project Management Developing Requirements Building a Case for a Test Environment Going for the Quick Win
Understanding the Phases of Development Tivoli Field Guides for Business Issues are located at the following Web site:
http://www-3.ibm.com/software/sysmgmt/products/support/Field_Guides_Business.html
v Tivoli Customer Support Knowledge Base (Ask Tivoli) Tivoli software customers can access a Web-based support tool called Ask Tivoli to search the support knowledge base for resolution of issues with Tivoli products. You can search multiple databases simultaneously for information from redbooks, white papers, Release Notes, and Tivoli Service Desk (TSD) for Customer Relationship Management (CRM) solutions. The solutions accessed from the Tivoli Customer Support Knowledge Base are developed by the Tivoli product support staff and have been reviewed to assure validity and accuracy.
Appendix A. Troubleshooting
95
Solutions provided through the Ask Tivoli tool are located at the following Web site: http://www-3.ibm.com/software/sysmgmt/products/support/ Ask Tivoli Frequently Asked Questions (FAQ) Tips and instructions for using the Ask Tivoli tool on the Tivoli Customer Support Knowledge Base are located at the following Web site:
http://www-3.ibm.com/software/sysmgmt/products/support/Support_Site_FAQ.html
v TME10 Mailing List The TME10 mailing list is an e-mail list, which is read and posted to by over 1 200 subscribers around the world. Members subscribing to TME10 listserv are those who create, maintain, support, and use Tivoli software. Members share experiences and ask questions. Access to the TME10 mailing list is controlled. You can subscribe to the TME10 mailing list at the following Web site:. http://publib-b.boulder.ibm.com/Redbooks.nsf/Portals/TivoliCustom1 v Rule Writing Developing Tivoli Enterprise Console rules requires considerable skill and knowledge. Proper rule writing and sharing rule writing experience with others can help increase the power and performance of the Tivoli Enterprise Console product. You can find articles on rule writing topics, such as rule writing and tuning, multiple inheritance in BAROC, and how to use assertion lists with rules at the following Web site: http://www.orb-data.com The communication on the referenced Web sites is primarily customer experience and dialog and is not intended to replace IBM Customer Support. For information about contacting IBM Customer Support, see Contacting software support on page vii.
96
Appendix B. Messages
This appendix describes messages related to using the Web version of the event console.
ECOWEP001E An error occurred when retrieving event details from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEP002E The cause events cannot be retrieved from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEP003E The effect events cannot be retrieved from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV001E The events cannot be retrieved from the event server database. Refresh the event viewer. Explanation: The event server retrieves events from a database when an event viewer is displayed for the first time or when the list of events shown in an existing event viewer is refreshed. If the events cannot be retrieved, the event group definition might not be correct or the connectivity to the event server database might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV002E The status of the event cannot be updated. Refresh the event viewer. Explanation: The event server updates the status of an event on a database when an action is submitted from an event viewer. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV003I A trouble ticket has been opened for the selected events. Explanation: No additional information is available for this message. ECOWEV004E A trouble ticket cannot be opened for the selected events. Explanation: Possible causes for this problem include the following: v You might not have the appropriate authorization role to open a trouble ticket. Either admin or user role is required. v A problem exists with the trouble ticket integration software.
97
ECOWEV005E ECOWPV003I
Operator Response: Contact the administrator of the event server. ECOWEV005E The trouble ticket integration program for the selected events did not complete. Explanation: The trouble ticket integration program, which is supplied by the IBM Tivoli Enterprise Console, integrates your problem reporting software with the IBM Tivoli Enterprise Console. Operator Response: Contact the administrator of the event server. ECOWEV006W Do you want to exit this event viewer? Explanation: This message confirms whether or not you want to exit the event viewer. Operator Response: If you want to exit the event viewer, click Exit. If you do not want to exit the event viewer, click Cancel. ECOWEV007E The details for the selected event cannot be retrieved from the event server. The action associated with the customized button cannot run. Explanation: When you click a customized button, the full set of event details for the selected event is retrieved from the event server. If the communication with the event server fails, the action associated with the customized button cannot run. Operator Response: Contact the administrator of the event server. ECOWEV008W You have selected actual_sels events. Running the requested action against this many events results in actual_sels popup windows. Do you want to continue? Explanation: More than one event was selected when you performed an action from the event viewer. Proceeding with this action will result in a popup window for each of the selected events. This message confirms whether or not you want to continue with the action. Operator Response: If you want to continue with the action, click Continue. If you do not want to continue with the action, click Cancel. ECOWEV009W You have selected actual_sels events. Running the requested action against this many events results in a heavy processing load on the event server. Do you want to continue? Explanation: See message. This message confirms whether or not you want to continue with the action. Operator Response: If you want to continue with the action, click Continue. If you do not want to continue with the action, click Cancel. ECOWGE001E An internal error has occurred. Explanation: Your request could not be completed due to an internal error. Operator Response: Contact your administrator. Administrator Response: To determine the cause of the problem, look in the IBM Web Application Server log files. ECOWPV001I The user preferences were saved. Explanation: No additional information is available for this message. ECOWPV002W Do you want to continue making changes or cancel without saving? Explanation: This message confirms whether or not you want to exit the user preferences without saving the changes. Operator Response: If you want to continue making changes to the user preferences, click Continue. If you want to cancel the changes to the user preferences, click Cancel. ECOWPV003I The user preferences cannot be saved because cookies are not enabled for your browser. Explanation: The user preferences are saved on your computer as a cookie, but the cookie option on your browser is disabled. Operator Response: To save the user preferences, change the privacy settings for your browser to accept cookies. If you do not enable the cookie option, the user preferences affect only the current session.
98
ECOWPV004I ECOWRA007W
ECOWPV004I The user preferences cannot be saved because cookies are not enabled for your browser. Do you want to exit the user preferences? Explanation: The user preferences are saved on your computer as a cookie, but the cookie option on your browser is disabled. Operator Response: To save user preferences, change the privacy settings for your browser to accept cookies. If you do not enable the cookie option, the user preferences affect only the current session. If you want to exit the user preferences, click Exit. If you do not want to exit the user preferences, click Cancel. ECOWRA001W The event group event_group_id is not recognized. Explanation: The specified event group ID does not correspond to any known event group. System Action: The command that referenced the specified event group failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA002W The event ID class_name is not recognized. Explanation: The specified event ID does not correspond to any known event ID class. System Action: The command that referenced the specified event ID failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA003W ConnectionSpec class_name is not supported. Explanation: See message. System Action: The command that specified the ConnectionSpec failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA004W InteractionSpec class_name is not supported. Explanation: See message. System Action: The command that specified the InteractionSpec failed. Other processing is unaffected.
Appendix B. Messages
Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA005W The Web console server encountered an error communicating with server server for user ID userid. Explanation: See message. System Action: The command that encountered the problem communicating with the Tivoli Management Framework failed. Other processing is unaffected. Operator Response: Contact the System Administrator. Administrator Response: The CommunicationFailureException that includes this message includes a nested exception that provides additional details about the failure. To correct the problem, use the information in the nested exception together with other Tivoli Management Framework diagnostic tools to determine why the Web console server is unable to communicate with the Tivoli Management Framework. ECOWRA006W User userid on server server is not authorized to view event data. Explanation: See message. System Action: The specified user is denied access to the Web console server. Operator Response: Contact the System Administrator. Administrator Response: Ensure that the user is defined to the Tivoli Management Framework and that the user has read access to the event server database. Then use the event console to assign the operator to an event console. ECOWRA007W The Web console server encountered an unexpected exception when logging on to the IBM Tivoli Management Framework: exception. Explanation: See message. System Action: The user is denied access to the Web console server. Operator Response: Contact the System Administrator. Administrator Response: To determine the cause of the problem, use the included exception text.
99
ECOWRA008W ECOWRA100W
ECOWRA008W The task taskName failed. pending status change for the event. The status for the event reverts to its previous value until the event is updated in the database and the caches for the Web console event data expire. Administrator Response: This message indicates that the UI server either never received the status change or it has not processed all of the status change requests. If this message occurs occasionally during periods of heavy workload on the UI server, you can ignore this message. Otherwise, determine why the UI server is having problems receiving and processing status change requests. ECOWRA053W The event data cache timeout value must be minimum_cache_time seconds or greater. The default value, default_cache_time seconds, is used. Explanation: See message. System Action: See message. Administrator Response: Change the event data cache timeout value as specified in the message. The timeout value must be specified in seconds. ECOWRA054W The event summary cache timeout value must be minimum_cache_time seconds or greater. The default value, default_cache_time seconds, is used. Explanation: See message. System Action: See message. Administrator Response: Change the event summary cache timeout value as specified in the message. The timeout value must be specified in seconds. ECOWRA100W The pending change for event event_id to status status timed out before completing. Explanation: See message. System Action: The Web console server discards the pending status change for the event. The status for the event reverts to its previous value until the event is updated in the database and the Web console event data caches expire. Operator Response: The status change for the event might have been lost before the UI server processed the request. Acknowledge or close the event again to ensure the change is processed. If this error persists, contact the System Administrator. Administrator Response: The Web console server logs message ECOWRA052 in the IBM WebSphere Application Server log file in conjunction with this message. For more information, refer to the help for message ECOWRA052.
Explanation: The Web console server could not run the task due to an internal error. System Action: The current task failed. Depending on the severity of the error, processing on other tasks might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA009W User userid does not have the role required to update events in this event group. Explanation: See message. System Action: The specified user is denied access to the actions. Operator Response: Contact your administrator. Administrator Response: Ensure that the user is defined to the Tivoli Management Framework and that the user has the appropriate roles to make updates. Then use the event console properties to assign the operator roles to an event console. ECOWRA050E An internal error has occurred.
Explanation: The Web console server has detected an internal error. System Action: The current threads processing fails. Depending on the severity of the error, processing on other threads might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA051E The Web console server encountered a problem communicating with the event server database. Explanation: See message. System Action: The system continues to run, but communication with the event server database might not be possible. Administrator Response: An exception should have been logged along with this message. For information about how to correct this problem, refer to the help text for the message contained in the exception. ECOWRA052W The UI server has taken longer than seconds seconds to process a status change for event event_id. Explanation: See message. System Action: The Web console server discards the
100
ECOWRA101W ECOWRJ007W
ECOWRA101W action on event event_id has been skipped due to previously pending action. Explanation: See message. System Action: The Web console server skips the specified action for the event. Processing of other actions continues. Operator Response: Another operator has requested an action on the event. Open or refresh the event viewer to see the updated status of the event with the pending action. ECOWRA102W Your request could not be completed in its entirety. The events you were attempting to modify have been modified since your last refresh or were being modified by another operator. Explanation: See message. Operator Response: Open or refresh the event viewer to see the current status of the events you were attempting to modify. If your changes are still necessary, modify the events again. ECOWRJ001W Connection pool properties cannot be changed when open connections exist. Explanation: An attempt was made to change a property of the connection pool when the connection pool contained open connections. Connection pool properties can only be changed when there are no open connections. System Action: The system continues to use the previous property values. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ002E The extract directory directory_name could not be created. Explanation: The Web console server could not extract the required files to the specified directory. System Action: The Web console server continues to run, but information stored in the database is not accessible until the error is corrected. Administrator Response: This problem prevents the Web console server from accessing event data and operator console definitions that are stored in the event server database. Ensure that the operating system identity that IBM WebSphere Application Server uses has permission to create and write to the specified directory. Also, ensure that the file system has at least 8MB of free space to store the extracted files. Restart IBM WebSphere Applicaton Server to force the Web console server to retry the file extraction. ECOWRJ003E The ClassLoader URL url is not recognized. Explanation: The Web console server encountered an unrecognized URL when examining its own classloader. Administrator Response: Ensure that IBM WebSphere Application Server is using its own JRE and not an unsupported JRE. If this problem persists, contact IBM Customer Support. ECOWRJ004W The SQL AS keyword is not supported. Explanation: IBM Tivoli Enterprise Console RIM JDBC Provider does not support the SQL AS keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ005W The SQL WHERE keyword was expected but token was found instead. Explanation: The IBM Tivoli Enterprise Console RIM JDBC Provider found the specified token in the SQL query instead of the SQL WHERE keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ006W The SQL query must contain a FROM clause. Explanation: The SQL query did not contain the required SQL FROM clause. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ007W A locale was not specified in a LOCALE clause. Explanation: The LOCALE keyword was not followed by a locale specifier. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an
Appendix B. Messages
101
ECOWRJ008W ECOWSO001E
internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ008W A condition was not specified specified for a WHERE clause. Explanation: The SQL WHERE keyword was not followed by any conditions. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ009W An SQL query must start with the SELECT keyword. Explanation: The SQL query does not begin with the required SELECT keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ010W The Column column in table table is not recognized. Explanation: The SQL query specified a column or a table that is not understood by the IBM Tivoli Enterprise Console RIM JDBC Provider. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ011W The data class class for column column is not recognized. Explanation: The internal metadata for the indicated column specifies an unrecognized data class. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ012W The Connection is no longer active. Explanation: An attempt was made to use a connection that has been closed. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ050E An internal error has occurred.
Explanation: The Web console server has detected an internal error. System Action: The current threads processing failed. Depending on the severity of the error, processing on other threads might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ051E The Web console server encountered a problem extracting the JCF and JRIM JAR files. Explanation: The Web console server was unable to extract the required JAR files. Communication with the event server database is not possible without these files. System Action: The system continues to run, but communication with the event server database is not possible. Administrator Response: An exception should have been logged along with this message. Refer to the help text for the message contained in that exception for additional information. ECOWRJ052E The Web console server encountered a problem communicating with the event server database. Explanation: See message. System Action: The system continues to run, but communication with the event server database might not be possible. Administrator Response: An exception should have been logged along with this message. Refer to the help text for the message contained in that exception for additional information. ECOWSO001E An error occurred when communicating with the Tivoli managed node. Explanation: See message. Operator Response: Retry the operation. If the problem persists, contact your administrator. Administrator Response: This error indicates a problem with the connection between the Web console server, which uses the system information provided to the Web console, and the managed node. The information in the configuration preferences is used to
102
ECOWSO002E ECOWTE003E
establish a system-level connection to the managed node. If the problem occurs on a consistent basis at startup for many or all Web consoles that attempt to connect to the Web console server, verify that the following conditions are met: v The server name, the user name, and the password specified in the configuration preferences are correct. v The computer running the Web console is connected to the network, and TCP/IP is functioning correctly. v The Web console server is running. v The Web console server and any firewalls between the computer running the Web console and the Web console server are configured consistently. v The port specified for access to the Web console server is valid. v If the problem is intermittent, it might be due to network traffic or a transient network problem. If the problem seems to be related to a specific operation, contact IBM Customer Support. ECOWSO002E Authentication failed. Explanation: The user name and password specified on the logon screen are not valid. Operator Response: Enter your user name and password again, ensuring that your user name and password are spelled correctly. ECOWSO003E The bootstrap process for the Web console application failed. The Web console might not function correctly. Report this problem to your administrator. Explanation: See message. Operator Response: See message. Administrator Response: To determine the cause of the problem, look in the IBM Web Application Server log files. ECOWSO004I Your logon session has expired. Explanation: A logon session expires after a prolonged period of inactivity. Operator Response: If you want to use the Web console, log on again. ECOWSO005I Signoff is complete. Explanation: No additional information is available for this message. ECOWSV001E An error occurred when retrieving event summary data from the event server database. Retry the operation or close the View Summary of Events window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWTE001E An error occurred when retrieving task library names from the event server. Try running the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files. ECOWTE002E An error occurred when retrieving task names from the event server. Try running the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files. ECOWTE003E An error occurred when retrieving task information from the event server. Run the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files.
Appendix B. Messages
103
ECOWTE004E ECOWTE012E
ECOWTE004E An error occurred when retrieving the names of the managed nodes from the event server. Retry the operation or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE005E An error occurred retrieving the host names from the event server. Retry the operation or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE006E The attempt to check the task prior to running it on the event server failed. Run the task again or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE007E The task failed to start on the event server. Make sure that the task can be run on the selected events, and run the task again. Explanation: The task might have failed for one of the following reasons: v An event was not selected prior to running the task. v The task cannot be run on one of the selected events. v The connection to the event server or the event server itself might be down. Operator Response: Select an event prior to running the task, or make sure that the task can be run on all of the selected events. Then run the task again. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE008W You must select a task library and a task name. Explanation: When running a task, a task library and a task name have not been selected. Operator Response: Select a task library and a task name. ECOWTE009W You must select a task name.
Explanation: When running a task, a task name has not been selected. Operator Response: Select a task name. ECOWTE010W You must select one or more target hosts. Explanation: When running a task, one or more target hosts have not been selected. Operator Response: Select one or more target hosts. ECOWTE011E The task failed because the configuration of the task is unsupported. Explanation: See message. Operator Response: Contact your administrator. Administrator Response: The layout for the task is unsupported. The Web console supports seven standard layouts: v text (0) v choice (1) v text choice (2) v choice button (3) v radio button (4) v crypto text (5) v list selector (6) ECOWTE012E Your logon session is no longer valid.
Explanation: Your session might have timed out, or you might have tried to access the Web console from a bookmark. Operator Response: Log on to the IBM Tivoli Enterprise console again.
104
ECOWTE013E ECOWUM004E
ECOWTE013E The task failed due to a shortage of resources in the Web console server. Explanation: See message. Operator Response: Run the task again. If the failure persists, contact your administrator. Administrator Response: The Web console server could not create a thread to run the task. Configure IBM WebSphere Application Server to make more resources available. ECOWTE014E The task output has not been received. Explanation: The task output was not received within the timeout period. However, the task might have completed on the event server. It is also possible that the task did not complete or was never started if the connection to the event server or the event server itself is down. Operator Response: Run the task again if doing so will not cause problems if the original task completed. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log file for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE015E The task did not complete due to a problem in the Web console server. Explanation: See message. Operator Response: Run the task again. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files. ECOWTE016E The task cannot run on the event source host because the event does not contain the event source host name. Explanation: A task has been configured to run on the event source host in one or more events. However, the hostname slot in one or more of the events does not contain the event source host name. Operator Response: Run the task on the appropriate host instead of on the event source host. ECOWTE017W Do you want to exit the task wizard? Explanation: This message confirms whether or not you want to exit the task wizard. Operator Response: If you want to exit the task wizard, click Exit. If you do not want to exit the task wizard, click Cancel. ECOWTE018W Do you want to continue? Explanation: This message confirms whether or not you want to cancel this operation in the task wizard. Operator Response: If you want to continue this operation, click Continue. If you do not want to cancel this operation, click Cancel. ECOWUM001E You are not authorized the run the action_name action on the selected item number sel_row. Explanation: You must log on with the appropriate authorization to run this action. Operator Response: Contact your adminstrator to get the appropriate authorization. ECOWUM002E You have selected actual_sels items. You must select needed_sels to run the action_name action. Explanation: Each action requires that you select a specific number of items. Operator Response: Select the appropriate number of items and retry the action. ECOWUM003E Because you are not authorized the run the action_name action on some of the selected items, the action has not been run on any of the selected items. Explanation: You must have the appropiate authorization to run the action on all of the items you select. Operator Response: Deselect the items for which you do not have appropriate authorization and try the action again. ECOWUM004E An error occurred when running the action_name action against the selected item number sel_row. Explanation: The Web console encountered an error when communicating with the event server. Operator Response: Try the operation again. If the problem persists, contact your administrator. Administrator Response: This error indicates a problem with the connection between the Web console server, which uses the system information provided in the Web console configuration preferences, and the event server. The information in the configuration preferences is used to establish a system-level connection to the event server. If the problem persists at startup for many or all consoles that attempt to connect to the Web console server, ensure that the following conditions are met:
Appendix B. Messages
105
v The server name, user name, and password specified in the configuration preferences are correct. v The computer running the Web console is connected to the network, and TCP/IP networking is functioning correctly. v The Web console server is running. v The Web console server and any firewalls between the computer running the Web console and Web console server are configured consistently. If the problem is intermittent, it might be due to network traffic or a transient network problem. If the problem seems to be related to a specific operation, contact IBM Customer Support.
106
Notices
This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the users responsibility to evaluate and verify the operation of any non-IBM product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.
107
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBMs application programming interfaces.
Trademarks
IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, AS/400, DB2, NetView, Tivoli Enterprise, Tivoli Enterprise Console, TME, TME 10, Tivoli Management Environment, and WebSphere are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries, or both.
108
Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.
Microsoft and Windows NT are registered trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of the Open Group in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others.
Notices
109
110
C A
ACK event status 51 acknowledging events event console (Java version) 54 event console (Web version) 61 from the command line 54 acl event attribute 21 adapter backup event server 5 buffering events 5 configuring 22 description 4 non-TME 5 secondary event server 5 source changing 23 creating 23 deleting 24 source name 23 Tivoli Event Integration Facility 6 TME 5 Adapter Configuration Facility 4 adapter configuration profile (ACP) 76 adding custom button sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 to event console (Java version) 34 to event console (Web version) 36 AdministrativeConsole 20 AllActiveEvents event group 19 APPEND_CLASSPATH keyword 68 assigning event group 28 operator to an event console 29 attribute acl 21 EventClass 12 origin 12 severity 12 source 12 status 12 sub_origin 12 authorization roles, required 13 automated tasks Java version of the event console 55 changing event console password 39 server name 40 user ID 39 Web version, cache timeout values 41 Web version, Tivoli region definition 38 event group filter 27 properties 27 preferences event console (Java version) 57 event console (Web version) 64 severity colors event console (Java version) 58 source 23 CLOSED event status 51 closing an event event console (Java version) 56 event console (Web version) 62 from the command line 56 commands postemsg command 87 tec_console 53 tec_console.cmd 53 TroubleTicket.sh 29 wconsole 26 wcrtsrc 23 wdbmaint.sh 42 wdelsrc 24 wlookup 89 wlsemsg 54, 59 wpostemsg 86 wrb 26 wrimtest 89 wrimtrace 90 wruntask 55 wsesvrcfg 26 wsetemsg 54, 56 wsetesvrcfg 18, 26 wsetsrc 24 wstartesvr 42 wstopesvr 42 wtdbclear 42, 82 wtdumper 82 wtdumprl 17, 81 wtdumprl command 86 wtecexport 38 wtecimport 38 components adapter configuring 22 description 4 Adapter Configuration Facility 4 event adapter configuring 22 description 4
B
backup event server 5 books see publications vi buffering events 5 Copyright IBM Corp. 2003
111
components (continued) event console creating 26 description 9 differences between Web version and Java version 51 event management 51 event database backing up 42 description 8 tuning 42 event server 7 configuring 22 description 6 log files 85 performance, improving 76 processes 15 starting 42 stopping 42 relationship of 3 Tivoli Enterprise Console gateway configuration example 76 configuration file 68 configuring 22, 67 description 6, 67 event traffic, controlling 76 files 75 receiving events from non-TME adapters 74 retry, configuring 74 starting 78 status, obtaining 79 stopping 78 tec_gateway program 67 tec_gwr program 67 troubleshooting 90 Tivoli Event Integration Facility 6 UI server 8 configuration file keywords gateway ReceiveAckPort 73 Configuration view 10 configuring custom button for event console (Java version) 34 for event console (Web version) 36 sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 event adapter 22 event server logging 24 rule base 26 source list 23 source, changing 23 source, creating 23 source, deleting 24 Tivoli Enterprise Console gateway 22 conventions typeface viii copying event groups to another console from the command line 38 from the desktop 38 correlation, state 75 creating event console 26
creating (continued) event group 27 source 23 CRITICAL severity level 64 custom button configuring for event console (Java version) 34 for Web version 36 sample script for UNIX for event console (Java version) 35 sample script for Windows for event console (Java version) 34 sample servlet for event console (Web version) 36 SLOTS environment variable, use of 34 custom_status event status 51 customer support see software support vii customizing event console Java version 33 password 39 server name 40 user ID 39 Web version 33 Web version, cache timeout values 41
D
deleting event group 28 event group filter 28 source 24 directory names, notation ix dispatch engine process 18
E
EbusinessEvents event group 19 EBusinessEventsConsole 20 environment variables, notation ix event acknowledging event console (Java version) event console (Web version) from the command line 54 attributes acl 21 num_actions 18 buffering 5 closing event console (Java version) event console (Web version) from the command line 56 credibility attribute 14 database backing up 42 description 8 troubleshooting 89 tuning 42 description 14 filtering event console (Java version) event console (Web version) flow, troubleshooting 86 non-Tivoli environment 87
54 61
56 62
59 65
112
event (continued) flow, troubleshooting (continued) Tivoli environment 86 group assigning to an event console 28 copying to another console from the command line 38 copying to another console from the desktop 38 creating 27 deleting 28 description 11 filter, deleting 28 filter, modifying 27 properties, modifying 27 groups, predefined AllActiveEvents 19 EbusinessEvents 19 Maintenance 20 OpenNetView 20 OtherNetView 20 ProbableEventAssn 19 ServiceUnavailable 20 UnMonitoredEBusiness 19 information, viewing event console (Java version) 57 event console (Web version) 63 internal 14 local commands, running event console (Java version) 55 logging 7 management differences between Web version and Java version of an event console 51 key concepts 51 management, overview 52 management, planning for event group roles 21 overview 19 processing, troubleshooting event server processes 82 log files 85 wtdbclear command 82 wtdumper command 82 wtdumprl command 81 properties, viewing event console (Java version) 57 event console (Web version) 63 severity 52 sorting event console (Java version) 59 event console (Web version) 65 source 4 starting the Tivoli NetView component 56 states PARSING_FAILED 17 PROCESSED 17 QUEUED 17 WAITING 17 states, reception process 17 status ACK 51 CLOSED 51 custom_status 51 OPEN 51 RESPONSE 52 summary, viewing event console (Web version) 62
event (continued) task, running event console (Java version) 54 event console (Web version) 62 from the command line 55 traffic, controlling 76 trouble ticket criteria, defining 30 trouble ticket, opening event console (Java version) 56 event console (Web version) 62 updating from a trouble ticket 32 viewing event console (Java version) 54 event console (Web version) 61 from the command line 54 event adapter backup event server 5 buffering events 5 configuring 22 description 4 example 44, 47 non-TME 5 secondary event server 5 source changing 23 creating 23 deleting 24 source name 23 Tivoli Event Integration Facility 6 TME 5 event console assigning operator to 29 creating 26 definitions exporting and importing 38 event group assigning 28 creating 27 deleting 28 filter 27 properties 27 event group filter deleting 28 event management differences between Web version and Java version key concepts 51 Java version acknowledging events 54 automated tasks 55 Configuration view 10 creating 26 custom button, configuring 34 custom button, description 33 custom button, sample script for UNIX 35 custom button, sample script for Windows 34 description 9 event information, viewing 57 event properties, viewing 57 event, closing 56 events, filtering 59 events, sorting 59 exiting 54 features 9 local commands, running 55 preferences, changing 57 preferences, customizing 33 Priority view 10 Index
51
113
event console (continued) Java version (continued) severity colors, changing 58 starting 53 starting the Tivoli NetView component 56 Summary Chart view 10 task, running 54 trouble ticket, opening 56 viewing events 54 operator creating 29 predefined AdministrativeConsole 20 EBusinessEventsConsole 20 trouble ticket system, integrating description 29 trouble ticket rules, customizing 30 trouble ticket system, integrating with rules trouble ticket, generating automatically 31 updating events from a trouble ticket 32 Web version acknowledging events 61 cache timeout values, changing 41 creating 26 custom button, configuring 36 custom button, description 33 description 9 event information, viewing 63 event properties, viewing 63 event summary, viewing 62 event, closing 62 events, filtering 65 events, sorting 65 exiting 61 features 10 messages 97 overview 59 password 39 performance tuning 41 preferences, changing 64 preferences, customizing 33 sample servlet 36 server name 40 signing off 61 signing on 61 starting 61 task, running 62 Tivoli region definition, managing 38 trouble ticket, opening 62 troubleshooting 92 user ID 39 viewing events 61 event database backing up 42 description 8 RIM description 8 troubleshooting 89 tuning 42 event group assigning to an event console 28 copying to another event console from the command line 38 from the desktop 38 creating 27 deleting 28 description 11
event group (continued) example 48 filter 11 modifying 27 filter, deleting 28 management, planning for 20 modifying properties 27 predefined AllActiveEvents 19 EbuisnessEvents 19 Maintenance 20 OpenNetView 20 OtherNetView 20 ProbableEventAssn 19 ServiceUnavailable 20 UnMonitoredEBusiness 19 roles planning for 21 worksheet 21 worksheet 20 event group filter example 48 event group role defined 13 examples 48 event management differences between Web version and Java version of an event console 51 key concepts event severity 52 event status 51 overview 52 event server backup 5 configuring logging 24 source list 23 source, changing 23 source, creating 23 source, deleting 24 description 6 example 47 log files 85 logging incoming events 7 performance, improving 76 processes dispatch engine 18 master 15, 16 reception engine 16 rule engine 18 task engine 18 tec_dispatch 18 tec_reception 16 tec_rule 18 tec_server 15, 16 tec_task 18 rule base 26 rules common problems 88 debugging 88 description 7 tracing 88 tuning 89 secondary 5 starting 42 stopping 42
114
event states described 17 event-type differentiation, example 50 events states 17 EventSendThreshold keyword 69 example event adapter 44, 47 event group 48 event server 47 event-type differentiation 50 geographic differentiation 49 organizational differentiation 50 system management differentiation 50 examples custom button sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 Tivoli Enterprise Console gateway configuration 76 trouble ticket event criteria 31 exiting event console Java version 54 Web version 61 exporting event console definitions exporting and importing from the command line 38 exporting and importing from the desktop 38 from the desktop 38
gateways, IBM Tivoli Enterprise Console (continued) state machines, running 76 GatewaySendInterval keyword 70 GatewayTMEAckEnabled keyword 70 geographic differentiation, example 49 gwr_ActiveConnections keyword 70 gwr_ActiveConnectionsSafety keyword 70 gwr_Enable keyword 71 gwr_OptionPortNotAvailable keyword 71 gwr_ReceptionPort keyword 71 gwr_ReceptionTestMode keyword 71 gwr_RetryCount keyword 71 gwr_RetryInterval keyword 71 gwr_ServerLocation keyword 71 gwr_ServerPort keyword 71 gwr_ServiceServer keyword 71 gwr_SubmissionTestMode keyword 72
H
HARMLESS severity level 65
I
icons event server ix profile ix rule base ix information sources, additional internal events 14
95
F
FATAL severity level 64 files .tec_diag_config 15 $BINDIR/TME/TEC/.ui_server_diag_config 8 for non-TME adapters init.tec_gwr 75 sctgwr.exe 75 tec_gwr.cfg 75 tec_gwr.exe 75 tec_dispatch 15 tec_gateway.conf 68 tec_master 15 tec_rule 15 tec_task 15 Tivoli Enterprise Console gateway configuration trace for event console (Web version) 92 Tivoli Management Framework 90 troubleticket.rls 29 filter, event group 11 filtering events event console (Java version) 59 event console (Web version) 65 testing 76
L
local commands, running event console (Java version) logging changing defaults 24 logging events 7 55
M
Maintenance event group 20 managing events differences between Web version and Java version of an event console 51 event severity 52 event status 51 management, overview 52 Tivoli region definitions for event console (Web version) 38 manuals see publications vi master process 15, 16 MaxGWCacheSizeMegs keyword 72 messages 97 MINOR severity level 64 modifying event group filter 27 properties 27 monitoring source 4, 6
68
G
GatewayAckInterval keyword 70 GatewayQueueSize keyword 70 gateways, IBM Tivoli Enterprise Console running state machines 75
Index
115
N
newsgroups vii non-TME interface 5 notation environment variables ix path names ix typeface ix num_actions attribute 18
Q
QUEUED event state 17
R
ReceiveAckPort keyword 73, 76 ReceiveEventPort keyword 73, 76 reception buffer 18 reception engine process 16 RESPONSE event status 52 RetryInterval keyword 72 RIM description 8 troubleshooting 89 roles differences 13 event group 13 required roles 13 RIM_update 13 RIM_view 13 Tivoli 13 Tivoli authorization 13 user 13 rule base operations 26 rule engine action 18 event under analysis 18 process 18 rules common problems 88 debugging 88 description 7 tracing 88 tuning 89 running tasks event console (Java version) 54 event console (Web version) 62 from the command line 55
O
online publications accessing vi OPEN event status 51 OpenNetView event group 20 operator assigning to an event console 29 creating 29 operators 13 roles 13 ordering publications vii organizational differentiation, example 50 OtherNetView event group 20 overview event management for key e-business applications highlights of this release 1 product description 1 unified system and network management 1
P
PARSING_FAILED event state 17 path names, notation ix performance practices to avoid 93 performance, tuning event console (Web version) 41 IBM WebSphere Application Server configuration planning for event management event group worksheet 20 event group roles worksheet 21 overview 19 postemsg command 87 preferences, changing event console (Java version) 57 event console (Web version) 64 PREPEND_CLASSPATH keyword 72 Priority view 10 ProbableEventAssn event group 19 PROCESSED event state 17 processes master 16 tec_dispatch 18 tec_reception 16 tec_rule 18 tec_server 15, 16 tec_task 18 tec_ui_server 8 profile, tec_gateway_sce 76 publications accessing online vi ordering vii
41
S
secondary event server 5 SendAckPort keyword 73, 76 SendEventPort keyword 73, 76 ServerLocation keyword 73 ServerPort keyword 74 ServiceUnavailable event group 20 severity colors, changing event console (Java version) 58 severity level CRITICAL 64 FATAL 64 HARMLESS 65 MINOR 64 UNKNOWN 65 WARNING 64 severity of events 52 SLOTS environment variable 34 software support contacting vii sorting events event console (Java version) 59 event console (Web version) 65 source changing 23
116
source (continued) creating 23 defined 4 deleting 24 names for 23 source list, updating 23 starting event console (Java version) from the command line 53 from the Windows task bar 53 event console (Web version) 61 Tivoli Enterprise Console gateway manually 78 Tivoli NetView functions 56 state correlation 75 running state machines 75 tec_gateway_tstate profile 76 testing 76 state machines gateways, IBM Tivoli Enterprise Console 76 running 75 status, Tivoli Enterprise Console gateway 79 stopping Tivoli Enterprise Console gateway 78 Summary Chart view 10 summary of events event console (Web console) 62 system management differentiation, example 50
T
task engine process 18 task, running event console (Java version) 54 event console (Web version) 62 from the command line 55 tasks automated using Java version 55 tec_console command 53 tec_console.cmd command 53 tec_dispatch log file 15 tec_dispatch process 18 tec_gateway program description 67 tracing, controlling 90 troubleshooting 90 tec_gateway_sce profile 76 tec_gateway_tstate profile 76 tec_gateway.conf file 68 tec_gwr program description 67 troubleshooting 91 tec_master log file 15 tec_reception process 16 tec_rule log file 15 tec_rule process 18 tec_server process 16 tec_server processes 15 tec_task log file 15 tec_task process 18 tec_ui_server process 8 testing event filtering 76 state correlation 76 Tivoli Enterprise Console gateway benefits 6
Tivoli Enterprise Console gateway (continued) configuration file APPEND_CLASSPATH keyword 68 BufEvtPath keyword 69 description 68 EventSendThresold keyword 69 GatewayAckInterval keyword 70 GatewayQueueSize keyword 70 GatewaySendInterval keyword 70 GatewayTMEAckEnabled keyword 70 gwr_ActiveConnections keyword 70 gwr_ActiveConnectionsSafety keyword 70 gwr_Enable keyword 71 gwr_OptionPortNotAvailable keyword 71 gwr_ReceptionPort keyword 71 gwr_ReceptionTestMode keyword 71 gwr_RetryCount keyword 71 gwr_RetryInterval keyword 71 gwr_ServerLocation keyword 71 gwr_ServerPort keyword 71 gwr_ServiceServer keyword 71 gwr_SubmissionTestMode keyword 72 MaxGWCacheSizeMegs keyword 72 PREPEND_CLASSPATH keyword 72 ReceiveAckPort keyword 73 ReceiveEventPort keyword 73 RetryInterval keyword 72 SendAckPort keyword 73 SendEventPort keyword 73 ServerLocation keyword 73 ServerPort keyword 74 configuring 22 description 67 event traffic, controlling 76 example 76 receiving events from non-TME adapters 74 retry 74 description 6, 67 starting manually 78 status, obtaining 79 stopping 78 troubleshooting 90 Tivoli Event Integration Facility 6 Tivoli NetView, starting 56 Tivoli region definition adding for event console (Web version) 38 changing for event console (Web version) 38 deleting for event console (Web version) 38 Tivoli roles, required 13 Tivoli Software Information Center vi TME interface 5 trouble ticket event criteria, defining 30 opening from event console (Java version) 56 opening from event console (Web version) 62 trouble ticket system integrating with rules customizing the rules 30 description 29 trouble ticket, generating automatically 31 updating events from a trouble ticket 32 troubleshooting event database 89 event flow 86 non-Tivoli environment 87 Tivoli environment 86 Index
117
troubleshooting (continued) event processing event flow 86 event flow in a non-Tivoli environment 87 event flow in a Tivoli environment 86 event server processes 82 log files 85 wtdbclear command 82 wtdumper command 82 wtdumprl command 81 getting started 81 information sources 95 performance 93 performance, practices to avoid 93 problems starting the Tivoli Enterprise Console product 87 RIM 89 rules common problems 88 debugging 88 tracing 88 tuning 89 tec_gateway program 90 tec_gwr program 91 Tivoli Enterprise Console gateway 90 trace logs, creating for event console (Web version) 92 Tivoli Management Framework 90 tuning 93 troubleticket.rls file 29 TroubleTicket.sh command 29 typeface conventions viii
W
WAITING event state 17 WARNING severity level 64 wconsole command 26 wcrtsrc command 23 wdbmaint.sh command 42 wdelsrc command 24 wlookup command 89 wlsemsg command 54, 59 worksheet event group 20 event group roles 21 wpostemsg command 86 wrb command 26 wrimtest command 89 wrimtrace command 90 wruntask command 55 wsessvrcfg command 26 wsetemsg command 54 wsetesvrcfg command 18, 26 wsetsrc command 24 wssetmsg command 56 wstartesvr command 42 wstopesvr command 42 wtdbclear command 42, 82 wtdumper command 82 wtdumprl command 17, 81, 86 wtecexport command 38 wtecimport command 38
U
UI server $BINDIR/TME/TEC/.ui_server_diag_config log file description 8 UNKNOWN severity level 65 UnMonitoredEBusiness event group 19 user interface server see UI server 8 users operators 13 UseStateCorrelation keyword 76 8
V
variables, notation for ix viewing event information event console (Java version) 57 event console (Web version) 63 event properties event console (Java version) 57 event console (Web version) 63 events event console (Java version) 54 event console (Web version) 61 from the command line 54 events, summary of event console (Web version) 62
118
Printed in U.S.A.
SC32-1235-00