BII4 Patrolv 3

BMC Impact Integration for PATROL
User Guide
Supporting
BMC Impact Integration for PATROL 3.1.01
December, 2004
Contacting BMC Software

You can access the BMC Software Web site at http://www.bmc.com. From this Web site, you can obtain information about the company, its products, corporate offices, special events, and career opportunities.
United States and Canada

Address BMC Software, Inc. 2101 CityWest Blvd. Houston TX 77042-2827 713 918 8800 or 800 841 2031 713 918 8000
Outside United States and Canada

Telephone Fax (01) 713 918 8800 (01) 713 918 8000
Telephone Fax
Copyright 2004 BMC Software, Inc., as an unpublished work. All rights reserved. BMC Software, the BMC Software logos, and all other BMC Software product or service names are registered trademarks or trademarks of BMC Software, Inc. All other trademarks belong to their respective companies. PATROL technology holds U.S. Patent Number 5655081. BMC Software considers information included in this documentation to be proprietary and confidential. Your use of this information is subject to the terms and conditions of the applicable End User License Agreement for the product and the proprietary and restricted rights notices included in this documentation.
Restricted Rights Legend

U.S. Government Restricted Rights to Computer Software. UNPUBLISHED -- RIGHTS RESERVED UNDER THE COPYRIGHT LAWS OF THE UNITED STATES. Use, duplication, or disclosure of any data and computer software by the U.S. Government is subject to restrictions, as applicable, set forth in FAR Section 52.227-14, DFARS 252.227-7013, DFARS 252.227-7014, DFARS 252.227-7015, and DFARS 252.227-7025, as amended from time to time. Contractor/Manufacturer is BMC Software, Inc., 2101 CityWest Blvd., Houston, TX 77042-2827, USA. Any contract notices should be sent to this address.
Customer Support
You can obtain technical support by using the Support page on the BMC Software Web site or by contacting Customer Support by telephone or e-mail. To expedite your inquiry, please see Before Contacting BMC Software.
Support Web Site

You can obtain technical support from BMC Software 24 hours a day, 7 days a week at http://www.bmc.com/support_home. From this Web site, you can
s s s s s s s
read overviews about support services and programs that BMC Software offers find the most current information about BMC Software products search a database for problems similar to yours and possible solutions order or download product documentation report a problem or ask a question subscribe to receive e-mail notices when new product versions are released find worldwide BMC Software support center locations and contact information, including e-mail addresses, fax numbers, and telephone numbers
Support by Telephone or E-mail

In the United States and Canada, if you need technical support and do not have access to the Web, call 800 537 1813. Outside the United States and Canada, please contact your local support center for assistance. To find telephone and e-mail contact information for the BMC Software support center that services your location, refer to the Contact Customer Support section of the Support page on the BMC Software Web site at http://www.bmc.com/support_home.
Before Contacting BMC Software

Before you contact BMC Software, have the following information available so that Customer Support can begin working on your problem immediately:
s
product information product name product version (release number) license number and password (trial or permanent)
operating system and environment information machine type operating system type, version, and service pack or other maintenance level such as PUT or PTF system hardware configuration serial numbers related software (database, application, and communication) including type, version, and service pack or maintenance level
s s s
sequence of events leading to the problem commands and options that you used messages received (and the time and date that you received them) product error messages messages from the operating system, such as file system full messages from related software
BMC Impact Integration for PATROL User Guide
Contents
About This Book How This Book Is Organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Related Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Online and Printed Books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 1 Introduction 11 11 12 13 14 14 17 18 18 19 20 21 22 25 26 27 28 29 30 30 30 30 31 33 34 34 35 37 38 38 39 41 42 43
Product Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How BMC II for PATROL Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Configuration File for PATROL Agents . . . . . . . . . . . . . . . . BMC II for PATROL Event Class File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PATROL KM for Event Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Events for startup, shutdown and errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC Impact Manager Knowledge Base Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Filtering and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 2 Installation
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Product Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing the BMC II for PATROL Component . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing BMC II for PATROL on Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing BMC II for PATROL on Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling the BMC II for PATROL Component . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling BMC II for PATROL from Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling BMC II for PATROL from Windows . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 3 Configuration
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The mcxp.conf Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . General Attributes Supported by mcxp.conf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Filtering Attributes Supported by mcxp.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The mcxpagent.conf Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Autodiscovery Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents
Creating a PATROL Agent Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Updating the PATROL Agent Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Handling Security with BMC II for PATROL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Overview of PATROL Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 PATROL Security on Unix Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Specifying an Authentication Certificate Owner on Unix . . . . . . . . . . . . . . . . . . . . 50 PATROL Security on Windows Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Modifying the Keyfile Registry Setting on Windows. . . . . . . . . . . . . . . . . . . . . . . . 51 PATROL KM for Event Management Security Requirements . . . . . . . . . . . . . . . . 51 Chapter 4 Using BMC Impact Integration for PATROL 53
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Starting and Stopping BMC II for PATROL on Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Starting and Stopping BMC II for PATROL on Windows . . . . . . . . . . . . . . . . . . . . . . . 56 Validating the Correct Functioning of BMC II for PATROL . . . . . . . . . . . . . . . . . . . . . 57 BMC II for PATROL Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Alarm and State Change Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Processing Events from PATROL KM for Event Management . . . . . . . . . . . . . . . 60 Fully-Qualified Versus Short Host Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Alarms and Recovery Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Agent Up and Down . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Duplicate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Chapter 5 Maintenance and Troubleshooting 63
Maintaining BMC Impact Integration for PATROL . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Changing Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Monitoring the Event Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Glossary Index 67 83
Figures
Event Flow from PATROL Agent to BMC Impact Manager . . . . . . . . . . . . . . . . . . . . 20 BMC II for PATROL Functional Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 PATROL Agent Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Figures
Tables
Slots in BMC II for PATROL Event Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Event Status Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Event Severity Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Slots in Event Class PATROL_EV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PATROL KM for Event Management Slots in Class PATROL_EV . . . . . . . . . . . . . . . BMC II for PATROL Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL mcxp.conf Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Attributes in the mcxp.conf File . . . . . . . . . . . . . . . . . . . . . . . . . . Filtering Attributes Supported by BMC II for PATROL . . . . . . . . . . . . . . . . . . . . . . . . Highlights of Different Security Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 23 24 24 25 30 38 39 41 47
Tables
10
About This Book

This book contains detailed information about the BMC Impact Integration for PATROL product component, an interface between BMC Impact Manager and one or more PATROL Agents. It is intended for users who will set up the transfer of events from the PATROL Agent and PATROL Knowledge Module for Event Management (PATROL KM for Event Management, formerly EventSpring) to the BMC Service Impact Manager and BMC Event Manager products.
NOTE
This book assumes that you are familiar with your host operating system. You should know how to perform basic actions in a window environment, such as choosing menu commands and dragging and dropping icons.
How This Book Is Organized

This book is organized as follows. In addition, this book contains a glossary of terms and an index.
Chapter/Appendix Chapter 1, Introduction Chapter 2, Installation Description provides an overview of BMC Impact Integration for PATROL describes the tasks to install the BMC Impact Integration for PATROL product in a computing environment in which both BMC Impact Manager and PATROL are installed provides information about how to configure BMC Impact Integration for PATROL for your environment
Chapter 3, Configuration
Chapter 4, Using BMC Impact Integration provides information about how to use BMC for PATROL Impact Integration for PATROL in your computing environment Chapter 5, Maintenance and Troubleshooting provides information for use in product maintaining and troubleshooting BMC Impact Integration for PATROL
About This Book
11
Related Documentation
Related Documentation
BMC Software products offer several types of documentation, including online and printed books and release notes. In addition to this book, you can find useful information in the publications listed in the following table. As Online and Printed Books on page 13 explains, these publications are available on request from BMC Software.
Category installation documents BMC Impact Manager core documents Document BMC Impact Solutions Installation Guide Description provides instructions for installing BMC Impact Manager and related software components
BMC Impact Explorer User Guide contains instructions for accessing, analyzing, and responding to event and service model component data BMC Impact Solutions System Configuration, Administration, and Maintenance Guide Building a Service Model provides information and procedures for configuring BMC Impact Manager, BMC Impact Explorer Server, and BMC Impact Explorer provides information on designing, developing, and maintaining BMC Impact Manager service models
BMC Impact Manager Knowledge contains detailed information necessary for creating Base Reference Guide knowledge bases BMC Impact Event Adapters User contains descriptions of adapter files and instructions Guide for configuring and running the event adapters BMC Impact Integration documents BMC Impact Database Gateway User Guide BMC Impact Integration for Remedy AR System Installation and Configuration Guide contains information about exporting data from BMC Impact Manager into databases provides instructions for installing and configuring the BMC Impact Integration for Remedy AR System, which automatically creates trouble tickets for events and updates the event or trouble ticket when either is modified
BMC Impact Integration for Tivoli contains steps for streamlining TEC performance by User Guide using the BMC Impact Manager product BMC Impact Integration for PATROL Enterprise Manager Installation and Configuration Guide provides instructions for installing and configuring the BMC Impact Integration for PATROL Enterprise Manager, which enables the synchronized, bidirectional interchange of PATROL Enterprise Manager alerts to BMC Impact Manager events
12
Online and Printed Books
Category PATROL documentation
Document PATROL KM for Event Management User Guide
Description describes the KM for Event Management, formerly EventSpring, and provides information and instructions for its configuration
PATROL Configuration Manager provides instructions for installing and configuring the User Guide PATROL Configuration Manager that manages PATROL Agents on multiple hosts and allows system administrators to focus on rules and rule features in the enterprise PATROL Agent Reference Manual contains information about using PATROL Agents as monitors of a computing enterprise that can intelligently report events to a PATROL Event Manager describes PATROL security levels and security utilities available, contains instructions for loading and configuring PATROL security features, and contains troubleshooting information contain last-minute information about the product and changes to the installation procedures
PATROL Security User Guide
supplemental documents
BMC Impact Solutions Release Notes BMC Impact Integration for Tivoli Release Notes BMC Impact Database Gateway Release Notes
s
Online and Printed Books

The books that accompany BMC Software products are available in online and printed formats. Online books are formatted as Portable Document Format (PDF) files. Some online books are also formatted as HTML files.
To Access Online Books

To view any online book that BMC Software offers, visit the Customer Support page of the BMC Software Web site at http://www.bmc.com/support_home. You can also access PDF books from the documentation compact disc (CD) that accompanies your product. Use the free Acrobat Reader from Adobe Systems to view, print, or copy PDF files. In some cases, installing the Acrobat Reader and downloading the online books is an optional part of the product-installation process. For information about downloading the free reader from the Web, go to the Adobe Systems site at http://www.adobe.com.
About This Book
13
Release Notes
To Request Additional Printed Books

BMC Software provides some printed books with your product order. To request additional books, go to http://www.bmc.com/support_home.
Release Notes
Release notes accompany each BMC Software product. Release notes provide up-todate information such as
s s
updates to the installation instructions last-minute product information
The latest versions of the release notes are also available on the Web at http://www.bmc.com/support_home.
Conventions
The following conventions are used in this book:
s
This book includes special elements called notes, warnings, and examples:
NOTE
Notes provide additional information about the current subject.
WARNING
Warnings alert you to situations that can cause problems, such as loss of data, if you do not follow instructions carefully.
EXAMPLE
An example clarifies a concept discussed in text.
All syntax, operating system terms, and literal examples are presented in this typeface. In instructions, boldface type highlights information that you enter. File names, directories, and names of GUI elements also appear in boldface type.
14
Conventions
The symbol => connects items in a menu sequence. For example, Actions => Create Test instructs you to choose the Create Test command from the Actions menu. In syntax, path names, or system messages, italic text represents a variable, as shown in the following examples: The table tableName is not available.
system/instance/fileName
In syntax, the following additional conventions apply: A vertical bar ( | ) separating items indicates that you must choose one item. In the following example, you would choose a, b, or c: a | b | c An ellipsis ( . . . ) indicates that you can repeat the preceding item or items as many times as necessary. Square brackets ( [ ] ) around an item indicate that the item is optional.
About This Book
15
Conventions
16
Chapter
1
18 18 19 20 21 22 25 26 27 28
Introduction
This chapter provides an introduction to the BMC Impact Integration for PATROL product component, also referred to in this book as BMC II for PATROL. The following topics are included: Product Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How BMC II for PATROL Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Configuration File for PATROL Agents . . . . . . . . . . . . . . . . BMC II for PATROL Event Class File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PATROL KM for Event Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Events for startup, shutdown and errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC Impact Manager Knowledge Base Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Filtering and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 1
Introduction
17
Product Description
Product Description
The BMC Impact Integration for PATROL (BMC II for PATROL) component is an interface between an instance of the BMC Impact Manager (BMC IM) and one or more PATROL Agents. From a high level perspective, BMC II for PATROL transfers event information stored in PATROL Agents to a BMC IM, where the event information is processed by the event processing engine, called a cell, that resides within the BMC IM instance. BMC II for PATROL features persistent buffering. With this feature you can display event information from the PATROL product in the BMC IM console without losing any information in the transfer process. BMC II for PATROL integrates the event monitoring and reporting features of PATROL with the flexible event processing and service modeling technology of BMC IM. PATROL Agents and their associated Knowledge Modules (KMs), including the PATROL KM for Event Management, store event information. The BMC II for PATROL component queries the PATROL Agents for this stored event information. BMC II for PATROL then filters the event information to determine what should be propagated to a BMC IM. The BMC II for PATROL assigns the event information to one event class, PATROL_EV, that contains slots to which the incoming PATROL information is assigned. BMC II for PATROL adapts the filtered event information into the BAROC (Basic Recorder of Objects in C) language, the only language understood by the cell, before propagating it to the BMC IM to which it is connected.
BMC II for PATROL Components

BMC II for PATROL accepts event information from one or more PATROL Agents, using persistent buffering so that no information is lost, either in obtaining event information from PATROL Agents or in sending the filtered and adapted event information to a cell. A cell is the event processing engine of each instance of a BMC IM. The destination for event information from BMC II for PATROL can be a list of cells. BMC II for PATROL will attempt to send the events to one cell among those on the list, and it always attempts to connect to the first cell on the list when such a connection is broken or at startup. BMC II for PATROL contains the BMC II for PATROL executable, mcxp.exe, and the discovery tool, mcxpconfig. The single executable, mcxp.exe, launches BMC II for PATROL which runs as a daemon on Unix platforms and as a Service on Windows platforms. It is installed in the BMC Impact directory structure. On Windows it is installed in %MCELL_HOME%\server\bin and uses %MCELL_HOME%\server\etc as the configuration directory. On Unix it is installed in $MCELL_HOME/bin and uses $MCELL_HOME/etc as the configuration directory. MCELL_HOME is the home directory for BMC II for PATROL.
18
How BMC II for PATROL Works
The discovery tool, mcxpconfig, enables BMC II for PATROL to discover and configure PATROL Agents in its environment. BMC II for PATROL uses three files in the BMC IM cells default knowledge base: mcxp.baroc, mcxp.mrl, and mcxpcoll.mrl. The mcxp.mrl file is a BMC IM rule file. It contains a set of rules that are used to manage the flow of PATROL events. The primary purposes of these rules are to:
s s
close alarm events when the alarm has been cancelled in PATROL update or create alarms with enhanced information from PATROL KM for Event Management sources automatically drop duplicate events
The mcxpcoll.mrl is a rule file for creating static or dynamic collectors. Collectors are required for displaying the event information obtained from PATROL Agents, adapted and sent to a BMC IM, in a BMC IM Console. All files with a .baroc extension are files that contain event class definitions and the slot definitions for each class; these files may also contain instances (events) of the class definitions. Such files reside in the cells Knowledge Base. The mcxp.baroc file contains the PATROL_EV event class and the slot definitions that are used in adapting event information obtained from a PATROL Agent source into the format that a cell can understand and process.
How BMC II for PATROL Works

PATROL events flow from the PATROL Agent to the host on which BMC II for PATROL resides. BMC II for PATROL translates events from PATROL Agents into BAROC events. Those BAROC events are sent to a BMC IM, which processes the event information according to the rules in its Knowledge Base. In addition, BMC II for PATROL can filter events, in order to decrease the network traffic from BMC II for PATROL to BMC IM, and to decrease the processing load of BMC IM. The relationship between the PATROL Agents and the BMC IM through BMC II for PATROL is many-to-one as illustrated by Figure 1.
Chapter 1
Introduction
19
BMC II for PATROL Architecture
Figure 1
Event Flow from PATROL Agent to BMC Impact Manager
One instance of BMC II for PATROL software can accommodate events from several PATROL Agents and their associated Knowledge Modules while forwarding the events to an appropriate BMC IM cell. After events are forwarded to the BMC IM, the cell processes the event information in the same way it processes event information that is sent directly from other BMC IM sources.
BMC II for PATROL Architecture

This section presents a detailed view of the architectural model, including the files and utility that actually adapt events. Configuration files are an important part of the BMC II for PATROL architecture. However, for information concerning the configuration of the BMC II for PATROL software and details of the contents of configuration files themselves, see Chapter 3, Configuration. Figure 2 on page 21 summarizes the functional architecture for BMC II for PATROL.
20
BMC II for PATROL Configuration File for PATROL Agents
Figure 2
BMC II for PATROL Functional Architecture
BMC II for PATROL and PATROL Agents typically reside on different hosts. BMC IM and BMC II for PATROL can reside on the same computer.
BMC II for PATROL Configuration File for PATROL Agents

The mcxpagent.conf file contains information about PATROL Agents from which the BMC II for PATROL component obtains PATROL events. For each PATROL Agent, the hostname, port, logon ID and encrypted password are stored. This file can be updated, if passwords are missing, or created by using the autodiscovery tool, mcxpconfig. See Chapter 3, Configuration, for more information about the mcxpconfig utility. Figure 3 on page 22 depicts the relationship between the mcxpconfig tool and the mcxpagent.conf file.
Chapter 1
Introduction
21
BMC II for PATROL Event Class File
Figure 3
PATROL Agent Configuration Files

An event is a structured message in a BMC IM environment. It is an instance of an event class definition. An event can have many slots, each one of which is a field in the event class definition. The slot contains information about that event. The slot content may determine how the event is processed by the BMC IM cell, according to the rules contained in its Knowledge Base. The mcxp.baroc file is the class definition file for the BMC II for PATROL component. It resides in the BMC IM cells Knowledge Base. PATROL events are mapped to the one single class, PATROL_EV, defined in the mcxp.baroc file. This file contains all of the slot definitions that are set by BMC II for PATROL. The BMC II for PATROL event class slots inherited from the base class EVENT are listed in Table 1. Table 1
Slot Name adapter_host status severity mc_host
Slots in BMC II for PATROL Event Class (Part 1 of 2)

Description the fully qualified host name of the computer on which BMC II for PATROL is running the event status, which corresponds to the PATROL status according to Table 2 on page 23 the BMC IM severity, which corresponds to the PATROL Type according to Table 3 on page 24 The FQDN (Fully Qualified Domain Name) of the host on which the event occurred Generally, it can be different from the PATROL Agent host name, as in the case of an event reported on a remote Agent by the KM for Event Management. PATROL does not provide the FQDN. BMC II for PATROL attempts to retrieve this fully qualified name for the event but if your DNS is not configured correctly, the attempt to retrieve the FQDN may not be successful. In this case, the cell sets the event's mc_location slot to UNKNOWN.
22
Table 1
Slot Name
Slots in BMC II for PATROL Event Class (Part 2 of 2)

Description the OS version of mc_host the IP address of mc_host the name of the PATROL instance the name of the PATROL application (KM) the name of the PATROL parameter This slot is populated for every event related to a parameter.
mc_host_class mc_host_address mc_object mc_object_class mc_parameter
mc_tool
the host name of the PATROL Agent that created the original event Its syntax is the host name of the PATROL Agent that created the original event, followed by the character ':', followed by the port number of the PATROL Agent.
mc_tool_class mc_tool_key mc_tool_sev
the string PATROL Agent the PATROL event identifier the PATROL Severity, as displayed in the PATROL Event Manager Severity is expressed as an integer, with a value ranging from 1 to 5; 5 being the highest severity.
mc_origin_class mc_origin
the string PATROL Agent the hostname of the PATROL Agent that created the original event Its syntax is the hostname of the PATROL Agent that created the original event, followed by the character ':', followed by the port number of the PATROL Agent.
mc_origin_key mc_origin_sev
the PATROL event identifier the PATROL Severity, as displayed in the PATROL Event Manager Severity is expressed as an integer, with a value ranging from 1 to 5; 5 being the highest severity.
mc_smc_id
A string formed as follows: mc_host:mc_object_class:mc_object
Table 2
Value 1 2 3 4 5
Event Status Basis

PATROL Status EV_TYPE_OPEN EV_TYPE_ACKNOWLEDGED EV_TYPE_CLOSED EV_TYPE_ESCALATED EV_TYPE_DELETED BMC Impact Manager status OPEN ACK CLOSED OPEN CLOSED
Chapter 1
Introduction
23
Table 3
Value 1 2 3 4 5 6 7
Event Severity Basis

PATROL Type EV_TYPE_INFORMATION EV_TYPE_CHANGE_STATUS EV_TYPE_ERROR EV_TYPE_WARNING EV_TYPE_ALARM EV_TYPE_RESPONSE EV_TYPE_ACK BMC Impact Manager severity INFO OK MINOR WARNING CRITICAL OK OK
The BMC II for PATROL PATROL_EV class contains the specific slots listed in Table 4. These slots all begin with the p_ prefix. These slots are present in the PATROL_EV class definition to accommodate event information from a PATROL KM for Event Management source. Table 4
Slot Name p_agent p_agent_address p_agent_port p_agent_version p_application
Slots in Event Class PATROL_EV (Part 1 of 2)

Description the hostname of the PATROL Agent that has reported the event the IP address of p_agent the port number the PATROL Agent is using for communication the version of the PATROL Agent the name of the PATROL KM This slot can be empty when no KM is associated with the event.
p_catalog p_class
the name of the PATROL Catalog as displayed in the PATROL Event Manager the name of the PATROL class as displayed in the PATROL Event Manager The value for this slot is usually a string, although the string often consists of an integer.
p_diary p_expectancy
the content of the PATROL Diary as displayed in the PATROL Event Manager the PATROL Life Expectancy as displayed in the PATROL Event Manager Valid PATROL Life Expectancies are:
s s s s
STORED DEL_IF_CLOSED DEL_IF_INFO DO_NOT_STORE
p_handler
the name of the PATROL Handler as displayed in the PATROL Event Manager
24
PATROL KM for Event Management Events
Table 4
Slot Name p_instance
Slots in Event Class PATROL_EV (Part 2 of 2)

Description the name of the PATROL instance This slot can be empty when no instance is associated with the event.
p_node
the name of the PATROL Node as displayed in the PATROL Event Manager The value of this slot should be identical to the host name of the PATROL Agent.
p_origin p_owner p_source_id p_status
the PATROL Origin as displayed in the PATROL Event Manager the name of the PATROL Owner as displayed in the PATROL Event Manager the value of the PATROL Source Identifier as displayed in the PATROL Event Manager the PATROL Event Manager event status, displayed as an integer See the definition of status slots for the list of p_status values in Table 2 on page 23.
p_type
The PATROL Type Identifier, displayed as an integer See the definition of severity slot for the list of p_type values in Table 3 on page 24.
p_args
a list of strings containing the event attributes
PATROL KM for Event Management Events

BMC II for PATROL supports the PATROL KM for Event Management. As is the case with any PATROL event, PATROL KM for Event Management events are mapped to the BMC II for PATROL class PATROL_EV. New slots are created within PATROL_EV to contain additional information provided only by events from a PATROL KM for Event Management source. These slots are listed in the table Table 5. Table 5
Slot Name mc_parameter_value
PATROL KM for Event Management Slots in Class PATROL_EV (Part 1 of 2)

Description the value of the PATROL KM for Event Management parameter at the time of alert This slot should only be populated when the event originated from the PATROL KM for Event Management; otherwise, it will be empty.
pes pes_tcp_port pes_udp_port pes_icon_name
a Boolean flag to indicate the PATROL KM for Event Management source the TCP port on which the affected PATROL Agent is listening the UDP port on which the affected PATROL Agent is listening the name of the instance as displayed on the PATROL console, such as oracle_db1
Chapter 1
Introduction
25
Events for startup, shutdown and errors
Table 5
Slot Name
PATROL KM for Event Management Slots in Class PATROL_EV (Part 2 of 2)

Description the instance name that is the parent container of instance, such as CPU/CPU the value of the PATROL KM for Event Management parameter status at the time of the alert the date the alert occurred This is the date on the local mc_host.
pes_parent_instance pes_param_status pes_alert_date
pes_alert_time
the time the alert occurred This is the time on the local mc_host.
pes_tz pes_last10
the time zone to which the affected PATROL KM for Event Management system is set the last ten (10) PATROL KM for Event Management parameter values preceding and including the current value. Values are space delimited, as in 98.11 97.14 95.87.
pes_ave10 pes_last10_ts
the average of the last ten (10) PATROL KM for Event Management parameter values the times at which the last ten (10) PATROL KM for Event Management parameter values were collected These map directly with the pes_last10 values. The time value is expressed in seconds since epoch.
pes_last10_tp pes_user_defined
the length of time, in minutes, between the first PATROL KM for Event Management parameter value and the last the user defined variable This variable contains the information stored in the variable /_my_APPCLASS_APPINSTANCE_PARAMETER at the time of the alert condition.
pes_alarm_min pes_alarm_max pes_patrol_home
the lowest threshold value of the current alarm range the highest threshold value of the current alarm range the PATROL_HOME directory of the PATROL Agent
Events for startup, shutdown and errors

The BMC II for PATROL product generates MC_CLIENT_START/STOP events. For these events, the mc_tool_class slot contains Mccli, which indicates that the event source is a cell client. The mc_tool slot contains MCPP Libs, indicating that the message has been generated by the C++ libraries used by the mcxp process. The mc_tool_key slot contains the persistent buffer directory.
26
BMC Impact Manager Knowledge Base Files
In addition, higher levels of BMC II for PATROL routines generate events MC_ADAPTER_START, MC_ADAPTER_STOP and MC_ADAPTER_CONTROL. When a connection to a PATROL Agent is up or down from its last state, an MC_ADAPTER_CONTROL event is generated. For these events, the mc_tool_class slot contains MCxP and the mc_tool_key slot is left empty. The mc_tool slot contains information about the state of the connection to a PATROL Agent. The BMC II for PATROL process reports any error as an MC_ADAPTER_ERROR event when such errors do not prevent the BMC II for PATROL from continuing to run. Allowing the BMC II for PATROL to continue to run when a non-fatal error occurs ensures that the communication channels remain accessible to both PATROL Agents and the BMC IM.
BMC Impact Manager Knowledge Base Files

mcxp.mrl and mcxpcoll.mrl are files residing in the BMC IM cells default Knowledge Base that apply to the event information received from the BMC II for PATROL component.
WARNING
mcxp.mrl and mcxpcoll.mrl should not be modified, and only advanced users should modify the .mrl files for BMC II for PATROL.
mcxpcoll.mrl
The mcxpcoll.mrl file defines BMC IM collectors. The BMC IM collectors are groups of events and event types that are linked together conceptually to provide a meaningful context in which to visualize events. The translated events combine according to the BMC IM definitions as they flow from the BMC II for PATROL process to the BMC IM. Types of collectors include the base collector for all PATROL events, as well as collectors for objects such as PATROL parameters, applications and computer classes.
mcxp.mrl
The mcxp.mrl file contains the rules that control event processing by the BMC IM cell that receives the PATROL events after they have been processed by BMC II for PATROL. These rules identify and filter out duplicate event reports. The rules library links corrective action events with triggering events that require specific action. It also provides a mechanism to update or close previously received events so that the state of the parameters producing events in PATROL software are accurately represented.
Chapter 1
Introduction
27
Filtering and Mapping
Filtering and Mapping

BMC II for PATROL filters the incoming event information at the beginning of its process by using the configuration attributes of mcxp.conf. Only the information that meets the criteria specified is retained for further processing and ultimately propagated to a BMC IM cell. The event information that is rejected by the filtering procedure is not processed further by BMC II for PATROL but is dropped from processing and eliminated with the next cleanup operation. Mapping associates specific event attributes defined in PATROL with the corresponding attributes defined in BMC IM.
28
Chapter
2
30 30 30 30 31 33 34 34 35
Installation
This chapter describes how to install and configure the BMC Impact Integration for PATROL product in a computing environment in which both BMC Impact Manager and PATROL are installed. The following topics are included. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Product Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing the BMC II for PATROL Component . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing BMC II for PATROL on Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing BMC II for PATROL on Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling the BMC II for PATROL Component . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling BMC II for PATROL from Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling BMC II for PATROL from Windows . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 2
Installation
29
Overview
Overview
BMC Impact Integration for PATROL is installed by InstallShield on Windows platforms and by shell scripts on Unix platforms. The PATROL Agents and BMC IM should be installed in the computing environment before you install the BMC II for PATROL product component. You must have root privileges on Unix platforms or Administrator privileges on Windows platforms to install BMC II for PATROL.
Supported Platforms
BMC II for PATROL supports the platforms listed in Table 6. Table 6
Solaris Windows 2000 Windows 2003
BMC II for PATROL Supported Platforms

Version 2.8, 2.9 service pack 4 Server
Operating System
Supported Product Versions

BMC II for PATROL supports BMC Impact Manager version 5.0 and PATROL Agent versions 3.4.x and 3.5.x.
Installing the BMC II for PATROL Component

Complete the following tasks to install the BMC II for PATROL product. You have the opportunity during the installation to provide specific information that customizes your installation of the product. The installation process provides a commonly used value as the default. You can accept the default value or you can enter a value unique to your environment for this installation.
30
Installing BMC II for PATROL on Unix

Use this task to install the BMC II for PATROL product component on a Unix operating system.
NOTE
BMC II for PATROL does not support installing the new version of the product over an existing version (over-the-top installation). You must uninstall the product before installing a new version.
Before You Begin

s
You must be logged on as root. You must have at least 8,163 KB of free space to install the product. The PATROL Agents and BMC IM should be installed in your computing environment before you install the BMC II for PATROL component.
To Install BMC II for PATROL on Unix

If the Unix platform on which you are working automatically mounts the CD, begin with step 2 of these instructions. If you need to go back to a previous screen at any time, use the < key.
1 Untar the product to extract its files to the bmc_products directory. 2 Change to the directory where you have expanded the files by typing the following
command:
cd driveDesignator
3 Run the installation script by typing . /IIPINST.

The welcome message is displayed.
4 Press Enter.
The End User License Agreement is displayed with the following instruction:
Enter accept to accept the Agreement, q to quit, p for the previous page, t to go to the top, or just Enter for the next page. Response (or < for back):
Chapter 2
Installation
31
5 Enter accept.
The installation program asks for the installation directory path.
6 Enter the directory path where you want to install BMC II for PATROL, or accept
the default directory, and press Enter. A message is displayed, followed by instructions.
7 Accept the default value for the destination cell, cellName, and press Enter.
The installation program asks for the encryption string of the destination cell.
8 Accept the default value for the encryption string, mc, and press Enter.
The installation program asks for the name of the host where the destination cell resides.
9 Accept the default value for the host name, cellName, and press Enter.
The installation program asks for the port number of the destination cell.
10 Accept the default value for the port number, 1828, and press Enter.
The installation program displays a summary of your installation selections and prompts you for a response.
11 Enter y to begin installing BMC II for PATROL. NOTE

Enter n to cancel the installation.
Installation proceeds and at completion, the program notifies you of the results of the installation.
Where to Go from Here

BMC II for PATROL must be correctly configured before it can function properly in your environment. Go to Chapter 3, Configuration, for configuration information about BMC II for PATROL.
32
Installing BMC II for PATROL on Windows
Installing BMC II for PATROL on Windows

Use this task to install the BMC II for PATROL product component on a Windows operating system.
NOTE
BMC II for PATROL does not support installing the new version of the product over an existing version (over-the-top installation). You must uninstall the product before installing a new version.
Before You Begin

s
You must be logged on as Administrator. A full installation of BMC II for PATROL requires a minimum of 64 MB of free disk space.
To Install BMC II for PATROL on Windows 1 Unzip the product to extract its files to the bmc_products directory. 2 Double-click IIP.EXE.
The BMC Software splash screen is displayed briefly, followed by the Welcome screen.
3 Click Next.
The End User License Agreement is displayed.
4 Click Yes to accept the terms of the License Agreement. 5 On the BMC Impact base directory installation screen, click Next to install the BMC
II for PATROL software into the default targeted directory that is displayed. The BMC II for PATROL software is installed in the directory in which the BMC IM product is installed. You are not permitted to change the target directory for installation.
Chapter 2
Installation
33
Uninstalling the BMC II for PATROL Component
6 Specify the name, host, port number, and encryption key for the primary cell and
the backup cell to which the BMC II for PATROL product sends error reports. You can:
s s s
type the information and press Enter select your choice from the list of available cells use the Browse button to locate the information
7 Click Next.
The installation program displays a summary of your selections.
8 If the settings displayed are correct, click Next to begin the installation. 9 Click Finish to complete the installation. Where to Go from Here
BMC II for PATROL must be correctly configured before it can function properly in your environment. Go to Chapter 3, Configuration, for configuration information about BMC II for PATROL.
Uninstalling the BMC II for PATROL Component

Complete the following tasks to uninstall the BMC II for PATROL product.
Uninstalling BMC II for PATROL from Unix

Use this task to uninstall the BMC II for PATROL product from a Unix operating system.
Before You Begin

You must be logged on as root.
34
Uninstalling BMC II for PATROL from Windows
To Uninstall BMC II for PATROL on Unix 1 Run the uninstallation script by typing ./IIPUNINST. 2 Enter y to continue with the uninstall. 3 Uninstallation of the BMC II for PATROL software proceeds and the program
notifies you of the successful uninstallation of the software.

Use this task to uninstall BMC II for PATROL product from a Windows operating system.
Before You Begin

You must be logged on as Administrator.
To Uninstall BMC II for PATROL on Windows 1 In the Windows taskbar, choose Start => Settings => Control Panel => Add/Remove
Programs.
2 From the list of currently installed programs, select BMC Impact Integration for
Patrol.
3 Click Change/Remove. 4 Click Yes to confirm the uninstallation of BMC II for PATROL. 5 Click Finish to complete the uninstallation of BMC II for PATROL.
Chapter 2
Installation
35
36
Chapter
3
38 38 39 41 42 43 44 46 47 47 49 50 50 51 51
Configuration
This chapter provides configuration information about BMC II for PATROL in your environment. The following topics are included. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The mcxp.conf Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . General Attributes Supported by mcxp.conf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Filtering Attributes Supported by mcxp.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The mcxpagent.conf Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Autodiscovery Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a PATROL Agent Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Updating the PATROL Agent Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . Handling Security with BMC II for PATROL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview of PATROL Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PATROL Security on Unix Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Specifying an Authentication Certificate Owner on Unix. . . . . . . . . . . . . . . . . . . . PATROL Security on Windows Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modifying the Keyfile Registry Setting on Windows . . . . . . . . . . . . . . . . . . . . . . . PATROL KM for Event Management Security Requirements . . . . . . . . . . . . . . . .
Chapter 3 Configuration
37
Overview
Overview
To configure BMC II for PATROL so it can connect to PATROL Agents and their associated KMs, use the mcxp.conf and mcxpagent.conf files. The mcxp.conf file contains attributes that control the global behavior of BMC II for PATROL and the BMC II for PATROL connection with a BMC IM. The mcxpagent.conf file contains information about PATROL Agents, such as host name, port, logon ID, and password. It stores passwords in the encrypted form. You can use the BMC II for PATROL discovery tool, mcxpconfig, to populate configuration information in the mcxpagent.conf file.
The mcxp.conf Configuration File

The mcxp.conf configuration file contains attributes of specific types that have default values as displayed in Table 7. Table 7
Attribute MCXPAgentFile MCXPAgentHeartbeat MCXPAgentLocalPort MCXPAgentReconnectInterval MCXPAgentRetries MCXPAgentTimeout MCXPAgentTransport
BMC II for PATROL mcxp.conf Configuration File (Part 1 of 2)

Type string integer integer integer integer integer string Unit sec sec sec sec Default Value mcxpagent.conf 600 0 60 5 2 udp Range NA 518000 065535 any 310 1180 udp | tcp Note: On Unix, you must use the lowercase udp or tcp entry.
MCXPBufferDirectory MCXPDropClass
string string
MCELL_HOME/log/adapter NA s/mcxp any string that can UpdInstState,UpdAppState,UpdMachineState,Wor contain the PATROL stApp event class empty list any string that can contain a list of KM names any string that can contain a PATROL event class.
MCXPDropKM
string
MCXPIncludeClass
string
all classes are kept (except classes included in MCXPDropClass)
38
General Attributes Supported by mcxp.conf
Table 7
Attribute
BMC II for PATROL mcxp.conf Configuration File (Part 2 of 2)

Type string string string integer integer integer Unit sec byte sec Default Value all KMs are kept O,E I,S,E,W,A,R 0 0 0 No Range any string that can contain a KM name O,A,E,C,D I,S,E,W,A,R any integer >= 0 any Yes, On, No, Off
MCXPIncludeKM MCXPIncludeStatus MCXPIncludeType MCXPRecoveryInterval MpBufferSizeMax MpServerHeartbeat MCXPIgnoreSaveTime
boolean -

The mcxp.conf file supports every common attribute that is supported by mclient.conf, such as ServerLocation, ServerDirectoryName and ServerPort. (See the BMC Impact Solutions System Configuration, Administration, and Maintenance Guide for detailed information about event slots and attributes in the BMC IM mclient.conf file.) A functional description of each BMC II for PATROL attribute listed in Table 7 is provided in Table 8 on page 39 or in Table 9 on page 41. Table 8
BMC II for PATROL Attributes in the mcxp.conf File (Part 1 of 2) Description the value of this attribute can be used to specify an alternate PATROL Agent file By default, this file is mcxpagent.conf in the current directory. It can contain the absolute path to the PATROL Agent configuration file. If the absolute path is not given, the PATROL Agent configuration file is considered to be in the current directory. MCXPAgentHeartbeat an attribute specific to the PATROL API communication libraries It is the value of the communication connection heartbeat. MCXPAgentLocalPort the local port number of the BMC II for PATROL instance By default, BMC II for PATROL uses /etc/services to connect to a port number on the host; this attribute overrides the port number specified in the /etc/services directory. MCXPAgentReconnectInterval the time to wait for a new connection attempt after either an unsuccessful connection attempt or a disconnection from a PATROL Agent
Attribute Name MCXPAgentFile
39
Table 8
BMC II for PATROL Attributes in the mcxp.conf File (Part 2 of 2) Description an attribute specific to the PATROL API communication libraries It is the value of the communication retries. The PATROL API uses it during a connection attempt. If the connection is not yet established after that number of retries, BMC II for PATROL will continue to attempt to reconnect to the PATROL Agent after the number of seconds specified in MCXPAgentReconnectInterval.
Attribute Name MCXPAgentRetries
MCXPAgentTimeout
an attribute specific to the PATROL API communication libraries It is the value of the communication connection timeout.
MCXPAgentTransport
an attribute specific to the PATROL API communication libraries It is a string specifying the type of network transport protocol used for the PATROL Agent communication session.
MCXPBufferDirectory
used to specify an alternate persistent buffer directory It must contain an absolute path or a path relative to the current working directory.
MCXPIgnoreSaveTime MCXPRecoveryInterval
used to specify whether or not to send events that occured during the last MCXPRecoveryInterval. the recovery time period for PATROL events between two BMC II for PATROL sessions When BMC II for PATROL starts, it sends all the events that have occurred between the last time BMC II for PATROL stopped plus the amount of time that is specified by this attribute. Even if the value of the attribute is 0 (zero), all events that have occurred during that fraction of a second since the last event was successfully sent will be resent. MCXPRecoveryInterval can be set to a special value, -1, that specifies an infinite recovery interval; in this case, all events stored in the PATROL Agents will be sent.
MpBufferSizeMax MpServerHeartbeat
the maximum size of the buffer for the msend command the interval, in seconds, at which BMC II for PATROL emits a heartbeat These heartbeats are identical to the heartbeats (MC_CLIENT_HEARTBEAT) sent by the mposter or msend command when running in persistent buffering mode.
40
Filtering Attributes Supported by mcxp.conf
Filtering Attributes Supported by mcxp.conf

The filtering attributes listed in Table 9 are supported by the BMC II for PATROL component. Table 9 Filtering Attributes Supported by BMC II for PATROL
Description a string of one or more PATROL classes, separated by commas Each event whose PATROL class belongs to the string list is dropped by BMC II for PATROL. MCXPDropKM a string of one or more KM names, separated by commas Each event whose KM name belongs to the string list is dropped by BMC II for PATROL. MCXPIncludeClass a string of one or more PATROL classes, separated by commas Each event whose PATROL class does not belong to the string list is dropped by BMC II for PATROL. MCXPIncludeKM a string of one or more KM names, separated by commas Each event whose KM does not belong to the string list is dropped by BMC II for PATROL. MCXPIncludeStatus a string of one or more status tags, separated by commas Each event whose status does not belong to the string list is dropped by BMC II for PATROL. MCXPIncludeType a string of one or more event type tags, separated by commas Each event whose type does not belong to the string list is dropped by the filter rules in the BMC II for PATROL Knowledge Base during the processing.
Attribute Name MCXPDropClass
Use the following guidelines when you define the attributes of filters:
s
You cannot logically combine these attributes in evaluating event information. They are considered to be AND combinations. Each event must pass all the filtering conditions represented by the attributes before it can be propagated to the BMC IM cell. As a logical consequence, if an item appears in both MCXPDropXXX and MCXPIncludeXXX attributes, every event corresponding to that item will be dropped. You can use the keyword * within MCXPIncludeXXX attributes as a special value having the meaning every possible value. It has the same effect as not setting the attribute to any value. Do not enclose attribute values in quotes (single or double). Quotes will be interpreted as part of the value.
Chapter 3 Configuration 41
The mcxpagent.conf Configuration File
Do not use spaces around commas in a string of values.
You can easily set these attribute values to meet common user requirements.
EXAMPLE
Set MCXPDropClass = UpdInstState to drop all events of PATROL class UpdInstState.
The mcxpagent.conf Configuration File

The configuration file mcxpagent.conf contains the configuration information for a list of PATROL Agents. It is divided into sections; a section represents one or more PATROL Agents whose password is common. Each section begins with a configuration name within square brackets on one line. Following that is a list of PATROL Agents in the form
Agent = hostnameOrIPAddress:port:logonID
EXAMPLE
Agent = myhost.mydomain.com:3181:PATROL
Each section contains a corresponding line in the form

Password = encryptedPassword
A complete section should resemble the following
EXAMPLE
[Section 1] Agent = myhost.mydomain.com:3181:PATROL Password = ENCRYPTEDPASSWORD0987645321
You must use the autodiscovery tool (mcxpconfig) to create the mcxpagent.conf configuration file or to add encrypted passwords. However, the file can be edited manually to add sections without password lines.
42
The Autodiscovery Tool
The Autodiscovery Tool

You can use the autodiscovery tool, mcxpconfig, in two different modes, one mode for updating the PATROL Agent configuration file, mcxpagent.conf, and the other mode to create it. The options and syntax available for use with it are as follows: Usage:
mcxpconfig [-h] [-z] [-b ConfigFile] [-e | -a Host [[-o] [-s] [-p port] [t timeout]]]
Option -h -z -b
Description or Function displays and gives a short description of the available options for use with this command displays the version number of the currently installed BMC II for PATROL product specifies the full path to the PATROL Agent configuration file
s
If the -b option is not specified, you must run mcxpconfig from the directory where the mcxpagent.conf file is to be created. If only the name of the configuration file is provided, the file is in the current directory. The default name for the PATROL Agent configuration file is mcxpagent.conf.
-e
specifies the encrypt password mode Passwords for PATROL Agents are encrypted and set in the PATROL Agent configuration file.
-a -o -s
specifies host name or IP address of computers on which the autodiscovery tool should search for PATROL Agent PATROL Agents with the same password are grouped into one section in the configuration file specifies that the entire subnet, in which the autodiscovery tool will search for a PATROL Agent, is searched for PATROL Agents The -s option is not valid unless the -a option is also specified.
-p
specifies a port number or port range, N1N2, in which the autodiscovery tool will search for PATROL Agents
s s
The -p option is not valid unless the -a option is also specified. The default is 3181.
-t
specifies the timeout, or time value, for the autodiscovery tool to search for PATROL Agents The default is 5 seconds.
43
Creating a PATROL Agent Configuration File

The autodiscovery mode of mcxpconfig is available by using the -a option. In this mode the tool scans a range of ports and IP addresses to discover PATROL Agents. When the scan is completed, it generates a PATROL Agent configuration file that BMC II for PATROL can use. The mcxpconfig tool executes the following operations: 1. It autodiscovers the PATROL Agents if you use any combination of the options -a, -p and -s.
s
The -a option is required to identify the host name or IP address that the tool must scan in search of PATROL Agents. The -p option identifies the port or the port range to scan on the computer identified in the -a option. If you do not use the -p option, the tool scans port 3181 The -s option enables a search of all hosts on the subnet on which the specified computer resides. The -t option sets a timeout, a limit on the amount of time during which the scanning takes place.
2. When mcxpconfig discovers PATROL Agents, it requests a logon ID and password for each agent. For the first PATROL Agent, the logon ID and password must be given. For the remainder, you can use the same ones by pressing Return when logon ID and password are requested. If the -o option is used, all of the PATROL Agents are assumed to have the same password. 3. When all logon ID and password information has been collected, the autodiscovery tool generates the mcxpagent.conf file.
s
If you use the -o option, all of the PATROL Agents are grouped in one section. If two or more successive PATROL Agents have the same password, they are grouped in the same section. PATROL Agents that have unique logon IDs and passwords are stored in different sections. The default configuration file is mcxpagent.conf in the current directory. You can use the -b option to move this file to another location or to change its name. The -b option requires you to supply the full path to the configuration file.
44
For instance, if you want to scan hosts on the subnet on which host1.domain1.com resides, for port range 30003200 you would enter the following command:
mcxpconfig -a host1.domain1.com -s -p 3000-3200
Then mcxpconfig discovers two agents and asks for logon ID and password for each one:
Configuration of the agent in the host host1.domain1.com port: 3181 Login (Default: ): login1 Password: typed password is not visible Please Confirm! Password: typed password is not visible Configuration of the agent in the host host2.domain1.com port: 3181 Login (Default: login1): login2 Password: typed password is not visible Please Confirm! Password: typed password is not visible
Then mcxpagent.conf file is created and resembles the following
EXAMPLE
[Section 1] Agent = host1.domain1.com:3181:login1 Password = ENCRYPTEDPASSWORD2345678901 [Section 2] Agent = host2.domain1.com:3181:login2 Password = ENCRYPTEDPASSWORD2987645320
If you use the -o option or if you do not enter the second password at the prompt, only one section is created, similar to the following
EXAMPLE
[Section 1] Agent = host1.domain1.com:3181:login1 Agent = host2.domain1.com:3181:login2 Password = ENCRYPTEDPASSWORD2356478901
45
Updating the PATROL Agent Configuration File
Updating the PATROL Agent Configuration File

When the PATROL Agent configuration file already exists, use mcxpconfig with the -e option to check and update it. In this case, the tool reads the PATROL configuration file and looks for sections in which there is no encrypted password. For each such section, it requests the user to enter a password twice to confirm and prevent typographical errors. Then it updates this section by adding the encrypted password entered by the user.
WARNING
Do not use mcxpconfig with the -a option to update an existing PATROL Agent configuration file. Using the -a option overwrites the existing file. If you need to add additional PATROL Agents to the PATROL Agent configuration file, edit the file manually and add them. Then run mcxpconfig with the -e option to add the encrypted passwords.
Following is an example mcxpagent.conf file that contains no encrypted passwords and has not been updated. It is assumed in this example that all PATROL Agents belonging to the same section have the same password.
EXAMPLE
[Section 1] Agent = host1.domain1.com:3181:PATROL Agent = host2.domain1.com:3181:PATROL Agent = host3.domain1.com:6666:johnPATROL [Section 2] Agent = host1.domain2.com:3181:PATROL
If this file is updated by executing mcxpconfig with the -e option, the updated file should resemble the following
EXAMPLE
[Section 1] Agent = host1.domain1.com:3181:PATROL Agent = host2.domain1.com:3181:PATROL Agent = host3.domain1.com:6666:johnPATROL Password = ENCRYPTEDPASSWORD1234567890 [Section ] Agent = host1.domain2.com:3181:PATROL Password = ENCRYPTEDPASSWORD0987645321
46
Handling Security with BMC II for PATROL
Handling Security with BMC II for PATROL

PATROL security is discussed here only as it applies to the connection between PATROL Agents and BMC II for PATROL. See the PATROL Security User Guide for complete information about security available in the PATROL product.
Overview of PATROL Security

Basic security, the default, is the lowest level of PATROL security and is designated as level 0. Levels 1 through 4 provide increasingly higher levels of security, along with increasingly greater configuration demands. The security levels and basic characteristics are listed in Table 10. Table 10 Highlights of Different Security Levels (Part 1 of 2)
Description
s
Security Level Basic security (Level 0)
default level of security employed when you install PATROL no cryptographic protection of network traffic no verification of product or data integrity authentication provided and protected password stored in unattended operations in the PATROL application minimized security and access control lists (ACLs) in favor of usability and performance Diffie-Hellman used for privacy no SSL authentication of either party to the other private communications provided by SSL no SSL authentication performed (PATROL console runs in keyless mode) defaults to unattended agent restart
s s s
Level 1
s s
Level 2
s s
47
Overview of PATROL Security
Table 10
Level 3
Highlights of Different Security Levels (Part 2 of 2)

Description
s
Security Level
private communications and server authentication provided by SSL certificate provided by agent so that the console can authenticate the agent PATROL console not authenticated back to the agent defaults to unattended agent restart; can configure for attended agent restart private communications and mutual authentication of the PATROL console and the agent provided by SSL defaults to unattended agent restart; can configure for attended agent restart certificates provided by both the agent and PATROL console for mutual authentication
s s
Level 4
BMC II for PATROL can accept connection to remote PATROL Agents running at any security level (0-4). The level of security at which the connection runs is determined by the PATROL Agent. The BMC II for PATROL product cannot connect to multiple PATROL Agents running with different security levels on the same computer. If you want to connect to multiple PATROL Agents that run at different security levels, BMC II for PATROL must be installed on one computer at each of the different security levels. In practical terms, connections between BMC II for PATROL and PATROL Agents with their associated KMs are restricted in their conformation by PATROL security levels that exercise the following restrictions:
s
All PATROL Agents connected to the same instance of BMC II for PATROL must be running with the same security level. If the conformation of the computing environment includes PATROL Agents running at different levels of security, at least one BMC II for PATROL component must be installed on one of the computers at each of the different security levels.
48
PATROL Security on Unix Platforms
EXAMPLE
One group of three PATROL Agents is running at security level 2 on three different computers, and one group of two PATROL Agents is running at security level 4 on two different computers, requiring one BMC II for PATROL component to be installed on one of the computers on which the PATROL Agent is running at severity level 2, and another BMC II for PATROLcomponent to be installed on one of the computers on which the PATROL Agent is running at security level 4.
PATROL Agents must be running at the same security level to communicate with one another. That is, if one is running at security Level 2 and another is running at security level 4, they cannot communicate. This is important when a remote PATROL Agent with an associated PATROL KM for Event Management is configured to forward event information to a PATROL Agent that, in turn, forwards that event information to an instance of BMC II for PATROL. The PATROL Agent with which the PATROL KM for Event Management is associated and the PATROL Agent to which it is sending the event information must be running at the same security level.
PATROL security affects how successful you are in achieving optimum value from the BMC II for PATROL product. You must perform some tasks after the installation of the PATROL product to ensure that it will perform correctly with the BMC II for PATROL product in your environment.
PATROL Security on Unix Platforms

The BMC II for PATROL process can be executed on a Unix platform only if you are logged on as root. If the BMC II for PATROL process is communicating with PATROL Agents running at an advanced security level and the keyfile is pointing to a user other than root, an error message is generated and reports an error. The /etc/patrol.d/security_policy/esi.plc file must be modified to point to the correct user. To specify the PATROL user who has ownership of the authentication certificate, you must enter an identity line in the esi.plc file. The procedure is provided in Specifying an Authentication Certificate Owner on Unix on page 50. When you start the BMC II for PATROL process on a Unix platform you are prompted, by default, for the keyfile and password. You are not required to set these. However, if the user identity, the keyfile, and the password are not set, you will be prompted for the keyfile and password each time you attempt to start the BMC II for PATROL process.
49
Specifying an Authentication Certificate Owner on Unix
Specifying an Authentication Certificate Owner on Unix

Use this task to specify the owner of the PATROL authentication certificate on a Unix operating system by modifying the esi.plc file.
Before You Begin

You can be logged on as a patrol user to perform this task.
To Specify the PATROL User on a Unix computer

In a text editor, add the following information to the /etc/patrol.d/security_policy/esi.plc file by creating a new (identity) line:
[client] identity = intqa logfile = esi_client.log
PATROL Security on Windows Platforms

See the PATROL Security User Guide for information about PATROL security for the version of PATROL you are using. On Windows platforms the user identity setting in the PATROL\SecurityPolicy\esi\client file points to the default user identity, bmcuser. Since this default user is set automatically, you need not modify it in the security policy file in order to run the BMC II for PATROL software. You may wish to change this default but you are not required to do so. Modification of the keyfile on Windows is required only when the PATROL Agents that connect to BMC II for PATROL run at the higher security levelslevel 3 or 4. If any of the PATROL Agents in your environment are running at a security level 3 or 4, you must modify the keyfile registry setting before you run the BMC II for PATROL software. Instructions for modifying this file are given in the next task.
50
Modifying the Keyfile Registry Setting on Windows
Modifying the Keyfile Registry Setting on Windows

Use this task to modify the keyfile registry setting in the esi\client file on a Windows platform.
Before You Begin

s
You can be logged on as the patrol user to perform this task. You must create a user.kdb file for yourself as user and substitute the filename in the keyfile definition. Consult the PATROL Security User Guide for instructions about how to create this file.
To Modify the Keyfile Setting for PATROL on a Windows computer 1 Navigate to the \WINNT\system32 directory and double-click the regedt32.exe file
to open the Registry Editor window.
2 In the Registry Editor window navigate to the \esi\client file located in the
HKEY_LOCAL_MACHINE\SOFTWARE\BMC Software\PATROL\SecurityPolicy
directory. A default keyfile has information similar to the following:

keyfile : REG_SZ : C:\Program Files\BMC Software\common\security\key s\bmcuser.kdb
3 Change the default keyfile settings to identify yourself as the user. 4 Save and close the Registry Editor window.
PATROL KM for Event Management Security Requirements

Event information from the PATROL KM for Event Management can be accepted by BMC II for PATROL only if a Notification Server and remote PATROL Agents are present and functioning in the computing environment. The PATROL KM for Event Management must be configured for Notification, which can be done only in developer mode on the PATROL Console for Windows or Unix. Operator mode appears to offer the appropriate configuration menu commands but when you choose these commands, an error message informs you that the action is not allowed at the operator level. See the PATROL KM for Event Management User Guide for detailed information about configuring this KM for use with PATROL Agents sending event information to BMC II for PATROL.
51
PATROL KM for Event Management Security Requirements
52
Chapter
4
54 54 56 57 58 58 60 61 61 61 62
Using BMC Impact Integration for PATROL

4
This chapter contains information on how to use BMC II for PATROL in your computing environment. The following topics are included: Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting and Stopping BMC II for PATROL on Unix . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting and Stopping BMC II for PATROL on Windows . . . . . . . . . . . . . . . . . . . . . . . Validating the Correct Functioning of BMC II for PATROL . . . . . . . . . . . . . . . . . . . . . BMC II for PATROL Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Alarm and State Change Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Processing Events from PATROL KM for Event Management . . . . . . . . . . . . . . . Fully-Qualified Versus Short Host Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Alarms and Recovery Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Agent Up and Down . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Duplicate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 4
53
Overview
Overview
Using BMC II for PATROL requires
s
a fully functioning connection with PATROL Agents and their associated KMs by which they send event information to the BMC II for PATROL component a fully functioning connection with a BMC IM cell that is designated to receive propagated event information from the BMC II for PATROL component.
After the BMC II for PATROL product is configured it is ready to receive event information from PATROL Agents, process the information, and propagate it to a BMC IM cell. You can control how BMC II for PATROL performs various tasks and operations by changing configuration settings, adding or removing PATROL Agents or their associated KMs, or reestablishing a connection that breaks. This chapter provides information about tasks that you can perform in running BMC II for PATROL as well as information about how BMC II for PATROL performs its tasks.
Starting and Stopping BMC II for PATROL on Unix

This section provides instructions for starting and stopping the BMC II for PATROL component on Unix platforms. On Unix platforms BMC II for PATROL runs as a daemon. By default, this daemon is started automatically when the computer boots.
To Start BMC II for PATROL on Unix

From a shell execute the following command:
mcxp [-n cellname]
The -n option is not mandatory; it can be set in the ServerName attribute of the mcxp.conf file.
54
Starting and Stopping BMC II for PATROL on Unix
Usage:
mcxp [-h|-?] [-z] [-q] [-c ConfigFile] {-p "Var=Value"} [-n CellName | -n @Host [:Port[#Key]] ] [-l HomeLocation] [-a] [-b AgentFile] [-d] [-f BufDir] [-I] [-i StatusFilter] [-j TypeFilter] [-r PathToExecutable] [-s] [-t RecoverySeconds] [-y]
Option -h -z -q -c
Corresponding Attributes in mcxp.conf none none none none
Description or Function displays the help topics available for this command displays the version number of the currently installed BMC II for PATROL product execution proceeds with no banner configures from the specified configuration file, ConfigFile The default is ConfigDir/mclient.conf if mcxp.conf does not exist.
-p -n -l -a -b -f -I -i -j -s -t
none none none none MCXPAgentFile MCXPBufferDirectory none MCXPIncludeStatus MCXPIncludeType none MCXPRecoveryInterval
assigns attribute Var a value; you can make multiple assignments by using this option multiple times connects to the BMC IM CellName, as defined in the mcell.dir file or on the indicated host and port, with specified key specifies the home directory in which BMC II for PATROL is installed runs BMC II for PATROL in the foreground rather than as a daemon specifies the configuration file for connecting to PATROL Agents specifies the persistent buffer directory reinitialize persistent buffers specifies the filter for PATROL Status specifies the filter for PATROL Type outputs events to standard output specifies the recovery interval, in seconds Set it to -1 for an infinite time period.
-y
none
terminates the process immediately on a connection failure to the BMC IM
Chapter 4
55
Starting and Stopping BMC II for PATROL on Windows
To Stop BMC II for PATROL on Unix 1 From a shell execute the following command:
ps -ef | grep mcxp
The command returns a line similar to the following, identifying the process ID (PID) of the mcxp daemon:
root 31341 3412 0 09:08 pts/1 00:00:00 ./mcxp -n tsm
2 To stop the daemon, enter the following command:

kill 31341
Starting and Stopping BMC II for PATROL on Windows

This section provides instructions for starting and stopping the BMC II for PATROL product on Windows platforms. The BMC II for PATROL product is installed as a service on Windows platforms. By default, this service starts automatically when the computer boots. If, for some reason, you have stopped the BMC II for PATROL service, use the following task to start the service on Windows.
To Start BMC II for PATROL on Windows 1 From the Windows task bar, choose Start => Settings => Control Panel =>
Administrative Tools => Services => BMC Impact Integration for PATROL.
2 In the Services dialog box toolbar, select the BII service and click Start. To Stop BMC II for PATROL on Windows 1 From the Windows task bar, choose Start => Settings => Control Panel =>
Administrative Tools => Services => BMC Impact Integration for PATROL.
2 In the Services dialog box toolbar, select the BII service and click Stop.
56
Validating the Correct Functioning of BMC II for PATROL
Validating the Correct Functioning of BMC II for PATROL

You can validate whether BMC II for PATROL is running correctly on either Unix or Windows platforms by performing the next task.
To Validate BMC II for PATROL Operations 1 Verify that the BMC II for PATROL process is running:
s
On Unix, enter the following command: ps -ef | grep mcxp
On Windows, use one of the following methods: From the Windows task bar, choose Start => Settings => Control Panel => Administrative Tools => Services. Verify that the status of the BMC Impact Integration for Patrol service is Started. In the Windows task bar, right-click and choose Task Manager; click the Processes tab. The BMC II for PATROL process is running if it is listed on this tab of the Task Manager. The process name is mcxp.exe.
2 Verify that the following events are being received and displayed by the BMC
Impact Explorer (BMC IX) to which the BMC II for PATROL is sending event information:
s
an MC_CLIENT_START event whose mc_tool_class slot value contains the mcxp string an MC_ADAPTER_START event is generated an MC_ADAPTER_CONTROL event whose mc_tool slot value contains the AGENT_UP string PATROL_EV events are generated
Chapter 4
57
BMC II for PATROL Operations
3 Compare PATROL_EV events in the BMC Impact Explorer (BMC IX) with the
PATROL events from the PATROL console to determine whether they contain the same event information. BMC IX usually contains fewer events than the PATROL Event Manager because the BMC II for PATROL component filters out events and the BMC IM contains rules to update, not create, new events. For information about event filtering in BMC II for PATROL, see Chapter 3, Configuration.
BMC II for PATROL Operations

This section describes how BMC II for PATROL filters, maps, and adapts event information from PATROL Agents into the BAROC language. BMC II for PATROL accepts all PATROL events sent to it and handles each incoming PATROL event in exactly the same way. BMC II for PATROL generates one instance of the event class PATROL_EV from each PATROL event received.
Alarm and State Change Events

A PATROL parameter can accommodate three alarm ranges: Alarm/Alarm# 1, Warn/Alarm# 2, and Border/Out-of-range. The adapt_alarm_severity rule handles alarm events, in the following manner. When any one of those three alarms occurs, a PATROL event is generated as Event A. The PATROL event can be seen in the BMC IX as a new OPEN event. The severity of this event depends on the type of alarm, such as WARNING or CRITICAL. When the alarm range of the PATROL event parameter changes, a new PATROL event is created, Event B, which reports the change of alarm range. When such a situation occurs, the rule adapt_alarm_severity closes Event A when Event B arrives; that is, when the status slot of Event A is set to CLOSED. The purpose of this rule is to have only one open event at any one time that is related to a PATROL parameter. This rule also applies to different events from the PATROL KM for Event Management that report the same information. If an Alarm/Alarm # 1 event is reported by both a NOTIFY_EVENT, and a REMOTE_NOTIFY_EVENT by the KM for Event Management, the second event that arrives at the BMC IM will close the first one. When the first alarm is triggered, an event is generated. When the second alarm is triggered, the state of the parameter is changed so the first PATROL_EV can be closed and only the second PATROL_EV that corresponds to the second alarm is retained. The PATROL events for alarms belong to classes 11 and 39.
58
Alarm and State Change Events
Often state change events correspond to other older events. These state change events can be used to close the older ones. The event information is evaluated by rules adapt_param_status, adapt_instance_status, adapt_application_status, and adapt_host_status. These rules evaluate according to the following criteria: Event B is a state change event containing information that changes the state described by Event A. Accordingly, Event A can be closed, and Event B replaces Event A. You can see how BMC II for PATROL implements these rules if you perform the following actions. Use a PATROL console on which there are no alarms. 1. Set a logical alarm on a disk that can reflect the alarm quickly. When the alarm is triggered, you can see the following ALARM events in the PATROL console:
s
Event A of the UpdMachineState class reports that the state of your computer is changed. Event B reports PATROL class 11 alarm on the parameter. Event C of the UpdInstState class reports that the state of the corresponding instance is changed. Event D of the WorstApp class reports that the state of the corresponding application is changed.
2. Stop the alarm and observe:

s
Event A2 of the UpdMachineState class reports the state of your computer has changed. It can update Event A. Event B2 of PATROL class 9 reports that the alarm on the parameter is cancelled. This event updates Event B. Event C2 of the UpdInstState class reports that the state of the corresponding instance is changed. It can update Event C. Event D2 of the UpdAppState class reports that the state of the corresponding application class has changed. It can update Event D.
The UpdInstState, UpdAppState, WorstApp, and UpdMachineState events are filtered by default. In this case, only Event B is observed when the alarm is triggered, and Event B2 cancels Event B. The rules adapt_instance_status, adapt_application_status, and adapt_host_status are not used. If you want to see all the events discussed, you must set MCXPDropClass to the empty string.
Chapter 4
59
Processing Events from PATROL KM for Event Management
Event B can be an instance of PATROL classes 9, 11, 39 or UpdParState in some cases. Event D also can be an instance of PATROL classes WorstApp or UpdAppState. Event B2 can be an instance of PATROL classes 9, 16, or UpdParState.
Processing Events from PATROL KM for Event Management

If the PATROL KM for Event Management is loaded and configured, NOTIFY_EVENT and REMOTE_NOTIFY_EVENT events are sent to BMC II for PATROL. In addition to the instance of the PATROL_EV class that BMC II for PATROL generates for all PATROL events, the PATROL KM for Event Management events also take the value of the second item of the string value of the p_args slot. This slot takes a list of 32 values and populates the slots with the prefix pes in their names. The mc_parameter_value slot is also populated for the PATROL KM for Event Management events with its value set at the time of the alert. The es_priority rule handles the KM for Event Management NOTIFY_EVENT and REMOTE_NOTIFY_EVENT events. An illustration of how BMC II for PATROL handles a PATROL KM for Event Management event follows. An alarm is generated for a disk when its available space is below a defined value, as in LDldFreeSpacePercent < 5. The PATROL KM for Event Management component is loaded in PATROL. This alarm generates two events, Event A and Event B.
s
Event A is a PATROL event that you can see in the PATROL Event Manager (PEM) with a message of the form
'Alarm #1 of global parameter LDldFreeSpacePercent' triggered on . . . '

s
Event B is a NOTIFY_EVENT or REMOTE_NOTIFY_EVENT event. The second argument of the p_args argument list is a long string that contains 32 comma-separated values. Only by using this single long string is it possible to reconstruct Event A completely. This string provides additional information that will populate the pes_xxx slots.
When BMC II for PATROL receives Event A, it generates an instance of the PATROL_EV class with the information available about the alarm. The pes_xxx slots remain empty because that information is not available. The PATROL_EV event is sent to the BMC IM as Event PA. When BMC II for PATROL receives Event B, all the information about the NOTIFY_EVENT or REMOTE_NOTIFY_EVENT event, except the second argument of the argument list, is dropped. BMC II for PATROL extracts the information from the argument list and creates a new instance of PATROL_EV. This PATROL_EV is actually the same PATROL_EV as created from Event A, except that the pes_xxx slots are populated. The PATROL_EV is sent to the BMC IM as Event PB.
60 BMC Impact Integration for PATROL User Guide
Fully-Qualified Versus Short Host Names
Since Events PA and PB are the same except for the pes_xxx slots and the msg slot, PA is updated with the value of these slots from PB and PB is dropped according to the es_priority rule.
Fully-Qualified Versus Short Host Names

When a new PATROL event is received by the BMC Impact Manager, the cell looks in the local hosts file for the host name contained in the event. If the host name in the event is contained in the hosts file, the cell replaces the host name in the event with the host name found in the hosts file. When the hosts file contains the fully-qualified name of the host, the fully-qualified name will be displayed with the event, even if the host name in the PATROL event is the short host name. If you want to display the short host name in the events received from PATROL, perform one of the following actions:
s
Replace the fully-qualified host name in the hosts file with the short host name. Create or refine a rule on PATROL events that shortens the fully-qualified host name.
Alarms and Recovery Actions

When an alarm is triggered, you can execute a recovery action in PATROL. When you execute a recovery action, a PATROL event is generated that belongs to PATROL class 10, 12 or 40. In this case, BMC II for PATROL generates two PATROL_EV events, one for the alarm, Event A, and one for the recovery action, Event B. If Event A is closed, then Event B, for the recovery action, can be closed also according to the alarm_and_ra rule. This rule requires intense processing by the Impact Manager. If you do not want to execute the recovery action, you can comment out this rule in the mcxp.mrl file to improve Impact Manager performance.
Agent Up and Down

When a PATROL Agent is down, an MC_ADAPTER_CONTROL event is generated with the mc_tools slot set to AGENT_DOWN. When this PATROL Agent is up an MC_ADAPTER_CONTROL event is generated with the mc_tools slot set to AGENT_UP. This event can close the previous one according to the agent_up_closes_down rule.
Chapter 4
61
Duplicate Events
Duplicate Events
Duplicate events that occur at the moment BMC II for PATROL is started are dropped according to the patrol_duplicates rule, and the repeat_count slot of the existing event is incremented by 1.
62
Chapter
Maintenance and Troubleshooting

This chapter provides information for use in maintaining and troubleshooting BMC II for PATROL. The following topics are included. Maintaining BMC Impact Integration for PATROL . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Changing Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Monitoring the Event Load. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Chapter 5 Maintenance and Troubleshooting
63
Maintaining BMC Impact Integration for PATROL
Maintaining BMC Impact Integration for PATROL

The BMC II for PATROL component requires little maintenance. However, you can use the following procedure to review the state of your BMC II for PATROL configuration and determine whether to make adjustments. 1. Verify the syntax and the contents of the mcxp.conf and mcxpagent.conf configuration files: Open the configuration files and review the contents to verify that the desired event information is
s
accepted by BMC II for PATROL from the PATROL Agents and associated KMs that provide the event information the correct event information is propagated by BMC II for PATROL to the correct BMC IM
2. Verify that the information necessary to configure the connection to each desired PATROL Agent is in the mcxpagent.conf file: Open the mcxpagent.conf file and verify that each PATROL Agent is configured by a line whose syntax is Agent = <hostname_or_ip_address>:<port><logon> From each of these lines, verify:
s
the host name or IP address of the computer on which the PATROL Agent resides the logon IDs used to connect to configured PATROL Agents are correct the passwords used to connect to configured PATROL Agents are correct each section contains a line similar to: Password = <encrypted_password>
Passwords are stored in encrypted format. If you are not sure that the passwords are correct, you can reinitialize them by removing them from the mcxpagent.conf file and using mcxpconfig with the -e option to reenter them. 3. Verify that the connections between the PATROL Agents and BMC II for PATROL and between BMC II for PATROL and the BMC IM cell are fully functional: Check the console display for events to be certain that event information is being sent by the PATROL Agents through the BMC II for PATROL component to the cell.
64
Changing Filters
4. Verify that the MC_ADAPATER_CONTROL event indicates the agent connection is open. For the connection between BMC II for PATROL and the BMC IM cell, the MC_ADAPTER_START and MC_CLIENT_START events should reflect that each has started. 5. Verify whether MC_ADAPTER_ERROR events have been generated by looking at the msg slot for any error message. 6. Contact customer support if you encounter a problem you cannot resolve.
Changing Filters
You may want to change the specifications for filtering PATROL Agent event information for any number of reasons, such as a change in your computing environment or new business objectives that require the processing of different PATROL Agent event information. Change filters by using the filtering options described in Filtering Attributes Supported by mcxp.conf on page 41. These filtering options reside in the mcxp.conf file.
EXAMPLE
By default all OPEN and ESCALATED PATROL events are sent. You can decide to send OPEN, CLOSED, and ACKNOWLEDGED PATROL events by setting MCXPIncludeStatus=O,A,C.
Monitoring the Event Load

When BMC II for PATROL has been started, you can estimate the event load by looking at the activity in a BMC Impact Explorer (BMC IX) to which BMC II for PATROL is sending event information. Monitor the event load by using the mgetinfo command. This command is available in the BMC IM and its correct use is detailed in the BMC Impact Manager Administrator Guide.
Chapter 5 Maintenance and Troubleshooting
65
Monitoring the Event Load
66
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Glossary
$MCELL_HOME The Unix platform environment variable that defines the home directory in which product files reside. Use this environment variable to find all product executables and configuration files. %MCELL_ HOME% The Windows platform environment variable that defines the home directory in which product files reside. Use this environment variable to find all product executables and configuration files. /etc/mcell On Unix platforms, the directory that contains the setup_env.sh and setup_env.csh scripts used to set the environment variables used by the product software. Abstract phase The event processing phase in which Abstract rules are evaluated and, if conditions are met, abstraction events are generated. Abstract rule An event processing rule that creates an abstraction event from one or more low-level events. abstracted event An event that contributes to the creation of an abstraction event. The abstracted event is the basis for inferring that some condition exists. For example, if a critical subprocess of an application is down, the application is down. abstraction event A conceptual or summary event based on other events that are occurring. You cannot understand the context of an abstraction event by its details. To understand the context, you must view the relationships between the abstraction event and the events that triggered its creation. See abstracted event. action An executable that can be run by a cell. Actions are called in an Execute rule. Users can request the execution of actions in the BMC Impact Explorer. See also: local action, remote action. adapter A background process that audits data from various sources, evaluates it for specific conditions, and creates the corresponding events. Adapters also transform event data into the format understood by BMC Impact Manager.
Glossary
67
Administration View The BMC Impact Explorer user interface for cell administration. Administrative users can start, pause, stop, and reconfigure a cell using this interface. They can also make changes to a cells dynamic data tables. administrator The person responsible for product administrative tasks. API Application Program Interface. A set of exposed functions that allows interaction with an application. attribute See slot. BAROC language Basic Recorder of Objects in C. A structured language used to create and modify class definitions. A class definition is similar to a structure in the C programming language. The elements in a structure are called slots. base class A root superclass, a class from which all other classes of its type are derived. BMC Event Adapters (BMC IEA) The adapters that collect log file information, convert it to BMC Impact events and send the events to a designated BMC Impact Manager instance(s). They are implemented in the Perl language. BMC Event Log Adapter for Windows (BMC IELA) The native Windows platform executable that audits Windows event logs. It runs as a Windows service and checks for new event log records. BMC IDG See BMC Impact Database Gateway. BMC IEA See BMC Event Adapters. BMC IELA See BMC Event Log Adapter for Windows. BMC II See BMC Impact Integration product. BMC IM See BMC Impact Manager.
68
BMC Impact Database Gateway (BMC IDG) The interface that enables BMC impact events to be exported to a relational database. BMC Impact Explorer (BMC IX) A console that enables users to connect to any number of BMC Impact Managers and examine the events stored in them and perform event and service management activities. BMC Impact Explorer Server (BMC IXS) The configuration server that administrators use to manage user access to the products resources. The BMC Impact Explorer Server runs as a daemon on Unix platforms and as a service on the supported Windows platforms. Synonym: MCCS. BMC Impact Integration (BMC II) product An interface that enables the synchronized, bi-directional flow of events and data between a BMC Impact Manager instance and another BMC product or a specific third-party product. BMC Impact Manager (BMC IM) The BMC Impact product that provides automated event and service impact management. It runs as a service on supported Windows platforms and as a daemon on Unix platforms and can be distributed throughout a networked enterprise and connected in various topologies to support IT goals. BMC IX See BMC Impact Explorer. BMC IXS See BMC Impact Exploration Server. cell The event processing engine that collects, processes, and stores events within a BMC Impact Manager instance. Each cell uses the information in the associated Knowledge Base to identify the type of events to receive and how to process and distribute them. child collector A collector contained within another collector. class A BAROC-language data structure that defines a type of object used in this product. A class is made up of data fields called slots that define its properties. CLI command A product command that is issued on the OS command line for automation or immediate execution. For a complete list of Command Line Interface (CLI) commands, see the BMC Impact Administrator Guide.
Glossary
69
collector An event grouping whose content is defined by its collector rule. Collectors are displayed in the BMC Impact Explorer and are defined in the BMC Impact Managers Knowledge Base. collector rule A type of rule defined in the Knowledge Base that defines how events from a cell are organized and presented in the BMC Impact Explorer. Collector definitions are written in Master Rule Language (MRL). collector set A group of collectors organized in a parent-child hierarchy that performs progressing filtering of those incoming events that match the top-level (parent collector) criteria. A collector set selects a set of events and organizes them for display in the BMC Impact Explorer. component See service model component (SMC). connectivity component A type of service model component (SMC) that represents the types of connections between IT components. console See BMC Impact Explorer. consolidation A BMC Impact Manager instance that can receive events originating from other systems on the network. Correlate phase An event processing phase in which the Correlate rules are evaluated to determine whether any events have a cause-and-effect relationship. Correlate rule An event processing rule used to establish a cause-and-effect relationship between two events. Correlate rules represent a one-to-one relationship. correlation A cause-and-effect relationship established between two events. data class A BAROC class that is a child of the base event class, DATA, and that defines a type of data. Delete phase The event processing phase in which Delete rules are evaluated and actions are taken to ensure data integrity is maintained when an event is deleted from the repository during the cleanup process.
70
Delete rule An event processing rule that used to clean up obsolete information when an event is deleted from the repository. Delete rules are evaluated when an event is deleted and take actions to ensure data integrity is maintained. dynamic collector A special type of collector that, in response to events, can add or remove event collectors from the cell during runtime. dynamic data Contextual reference data that is stored in a table in the repository (mc.db) and that can be updated during runtime. Administrators can use and manipulate dynamic data in the BMC Impact Manager Administration View. ECF Event Condition Formula. The section of an MRL rule definition that specifies the conditions that an incoming event must meet to trigger evaluation of the rule during processing. For example: APP_MISSING_PROCESSES where [hostname: == red1, sub_origin: contains System]. event A structured message passed to and from cells in a BMC Impact environment. It is an instance of an event class. Event Adapters See BMC Event Adapters. event class A BAROC class that is a child of the base event class, EVENT, and that defines a type of event. Event Log Adapter for Windows See BMC Log Adapter for Windows. Event Processor Obsolete term. See BMC Impact Manager. event propagation The act of forwarding events and maintaining their synchronization among multiple BMC Impact Managers. event repository See repository. Events View The BMC Impact Explorer user interface for viewing and manipulating event data.
Glossary
71
Execute phase The event processing phase in which Execute rules are evaluated and, if conditions are met, specified actions are performed. Execute rule An event processing rule that performs actions when a slot value changes in the event repository. Execute rules are evaluated during the Execute phase of event processing. Often, the resulting actions are internal actions, but it is possible to use the execute primitive in a rule to call an external executable. Exploring Event Relationships The process used to view additional details about an event and its relationships. facet A specific attribute of a class slot that either controls the values that the slot can have or controls aspects of a class instances processing. field Obsolete term. See attribute. Filter phase The phase of event processing in which Filter rules are evaluated to determine which events need additional processing, need no additional processing, or are unneeded and are to be discarded. Filter rule A rule evaluated by the rules engine during the event processing Filter phase to determine whether a specific type of event should be passed as-is, subjected to further processing, or discarded as unwanted. gateway See BMC Impact Manager Integration product. gateway.export A special file that controls the propagation and synchronization of events to a BMC Impact Manager Integration product. The file is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. global record A special BAROC class instance that defines a persistent global variable. When a cell starts, it creates one instance of each global record defined in the Knowledge Base and restores any existing values. Global record definitions are stored in the record subdirectory of the Knowledge Base. You can get and set global record values in rules or using the CLI mgetrec and msetrec commands. global slot order A slot order that is shared among users.
72
heartbeat A process by which a cell can monitor other cells to verify that they remain active and accessible. impact relationship A relationship between two components in a service infrastructure in which a consumer component depends on a provider component to deliver some resource to it. Changes in status of the provider affects (has an impact on) the status of the consumer component. See also null relationship. instance An object with specific attribute values created using a class definition. integration product See BMC Impact Integration product. interface class A BAROC class that defines the programming interface used by an MRL rule primitive, such as get_external, to return data from an external program. At cell startup, an interface class is loaded into memory. The cell invokes the executable defined in an argument of the primitive. The executables value is returned by the interface. internal base class A BAROC internal class that defines the required structure for the base class from which a group of product classes is derived. internal event An event that is created by the cell during event processing. An internal event is processed in the same way as an incoming event. All internal events are processed before any new incoming external events are processed. IT component A type of service model component (SMC) that represents physical IT resources, such as hardware or application software. kb directory The default directory in which the BMC Impact Manager Knowledge Base is located. The directory and basic product definitions are created during installation. key The seed encryption key. If the destination BMC Impact Manager or BMC Impact Integration product has a key value, all clients must encrypt their communications using the same key value. Knowledge Base (KB) A collection of information that forms the intelligence of a BMC Impact Manager instance and enables it to process events and perform service impact management activities. This information
Glossary
73
includes event class definitions, service model component definitions, record definitions, interface definitions, collector definitions, data associations, and processing rules. .load file A file that specifies the order in which a directorys files are to be loaded and read by a BMC Impact Manager instance. local action An executable that users can run directly from the BMC Impact Explorer. Local actions are written in XML and are stored in the OS-specific subdirectory of the bin directory of the Knowledge Base. logical component A type of service model component (SMC) that represents logical resources involved in the delivery of business services, such as user groups. macro An executable used in MAP files to execute code that manipulates the fields used for event translation. manifest.kb A central locator file that specifies the locations of the directories that comprise a Knowledge Base. The manifest.kb file is used by the compiler to load the Knowledge Base source files for compilation. MAP file A text file that defines the translation of a message between one event format and another. Master Rule Language (MRL) A compact, declarative language used to define rules and collectors to process and organize events. Uncompiled rule and collector source files have a .mrl file extension. MCCS Obsolete term. See BMC Impact Explorer Server. mccomp The rules compiler. Rules are written in the Master Rule Language (MRL). The platform-independent compiler converts them to byte code that the cell can read and process. mcell.conf The configuration file that contains configuration options for a BMC Impact Manager instance. It is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. mcell.dir The file that lists the cells to which a product component can connect and communicate. The information for each cell includes: its name, its encryption key, and its host name and port
74
number. This file is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc directory on supported Windows platforms. mcell.modify The file that lists the slots that affect the mc_modification_date slot. When a specified slot is modified, the time stamp of the modification is reset in the mc_modification_date slot. mcell.propagate The configuration file that specifies the slot values that are synchronized during event propagation between cells. It is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. mcell.trace The configuration file that specifies the BMC Impact Manager trace information that should be recorded and the location to which it is written. It is in $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%/etc/ directory on supported Windows platforms. mclient.conf The configuration file that specifies the configurations for the BMC Impact Managers Command Line Interface (CLI) commands. It is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. mclient.trace The configuration file that specifies the trace information that should be collected for the CLI commands and the location to which it should be written. This file is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. mcontrol The CLI command that sends control commands to a BMC Impact Manager instance. metaclass See internal base class. MetaCollector A virtual collector that contains a group of collectors from multiple BMC Impact Manager instances. It only exists in the BMC Impact Explorer and can be user-customized. .mrl file A file that contains rule and collector definitions written in the Master Rule Language (MRL). Event and service management processing rules and collectors are stored in .mrl files, and in compiled .wic files. New phase The event processing phase in which the New rules are evaluated to determine which events in the event repository should be updated with new information from new incoming events. This is the last opportunity to prevent an event from entering the event repository.
Glossary
75
New rule An event processing rule that is evaluated during the New event processing phase, and can update events stored in the repository (mc.db) with fresh information from new incoming events. node A BMC Impact Manager instance that only can receive events originating on the local host system. null relationship A relationship between two components in a service infrastructure in which there is no impact to the consumer component. A null relationship only indicates that the two components are connected logically and are represented visually as linked. See also impact relationship. open event An event that may require action. An OPEN status indicates that an event has not yet been examined, or that neither an operator nor an automated process has been assigned responsibility for the event. parent collector A collector containing its child collectors to form a collector set. phase (rule) A specific stage of event processing. There are eight sequential phases to event processing and two non-sequential phases; each with a corresponding rule type. port A number that designates a specific communication channel in TCP/IP networking. BMC Impact Manager communicates using the ports specified during installation. pre-authenticated user Definition to be determined. primitive A function that is available in the MRL language. See the BMC Impact Manager Knowledge Base Reference Guide for information on the MRL primitives and how to use them. Propagate phase The event processing rule phase in which propagate rules are evaluated to determine the events to be forwarded to another cell or an Integration product. Propagate rule An event processing rule that is used to forward events to other BMC Impact Managers in the managed domain. Propagate rules are evaluated during the Propagate phase of event processing.
76
propagated event An event that is forwarded from one cell to another cell or to an Integration product during the Propagate phase of event processing. record See global record. Refine phase The first phase of event processing in which Refine rules are evaluated to validate incoming events and, if necessary, collect additional data needed before further event processing can occur. Refine rule A rule evaluated during the first phase of event processing to validate an incoming event and, if necessary, to collect any additional data needed before further processing can occur. Regulate phase The event processing phase, in which Regulate rules are evaluated and, if true, collect duplicate events for a time period and, if a specified threshold of duplicates is reached, passes an event to the next processing phase. Regulate rule A rule used by the during event processing to process repetitive (duplicate) events or events that occur with a specified frequency. With a Regulate rule, you can create a new event based on the detection of repetitive or frequent events. remote action An executable that can be run by a cell. Remote actions are written in the Master Rule Language (MRL) and are stored in the OS-specific subdirectory of the bin directory of the Knowledge Base. remote user To be determined. repetitive event An event that has matching values for all the slots defined with the dup_detect=yes facet in the event class definition. You can use Regulate rules to detect and count repetitive events. rule A conditional statement that, if determined to be true, executes actions. The cell evaluates events by comparing each event to a series of rules during event processing. Rules are grouped in phases that are processed one-by-one. The order in which rules are evaluated during a particular phase is based on their load order. When all the rules in one phase are evaluated, the cell moves to the next phase. rule engine See cell.
Glossary
77
saved state The state of a BMC Impact Manager instance as determined by the StateBuilder utility, statbld.exe. The StateBuilder utility periodically consolidates the data in the transactions file (xact) to produce the saved state of the product instance. This information is stored in the .mcdb file and the state is reloaded when BMC Impact Manager restarts. rule type A designation of a rule that applies to a specific phase of event processing. The cell processes rules within the context of the associated event processing phase and in the order in which the rules are loaded from the rule file. SDK Software Development Kit. A set of procedures and tools with which to develop a type of application. Service Level Agreement (SLA) An agreement that defines the required availability of a business service to its consumers. service level agreement component A type of Service Model component (SMC) that represents service level agreements and metrics. service level metric (SLM) A measurement of some aspect of service delivery. Service Model (SM) An extensible system for defining the various resources that combine to deliver business services, for modeling their behaviors and functional relationships, and for managing the delivery of the resulting services. Service Model component (SMC) A logical or physical resource that participates in the delivery of services. There are four types of service model components: connectivity components, IT components, logical components, and service level agreement components. An SMC can provide services to and/or consume services from another component. In technical terms, a service model component is any data class that is a subclass of the MC_SM_COMPONENT base class. Services View The BMC Impact Explorer user interface for viewing service model components and their relationships and for viewing and managing the events that affect service availability. shadow component A component that is a copy of a component existing on another cell. Shadow components are used when setting up distributed Service Models. slot A attribute in a BAROC class definition. A class definition consists of one or more slots. Each slot has a data type and can have specific attributes called facets that can control the values that
78
the slot can have or control aspects of a class instances processing. A class that is a subclass to another class inherits all the slots of the parent class. slot change The process of updating the slot value of a class instance. slot facet An attribute specified for a specific slot that defines either how it is processed or its range of valid values. slot propagation A situation in which a slot change takes place and the mcell.propagate file specifies that changes to that slot or class should be propagated. slot value The value associated with a particular slot (attribute) of a class instance. slot value pair A slot name and its associated slot value. SM See Service Model. SMC See Service Model component. SNMP adapter An adapter that listens at a port for SNMP traps. It evaluates the traps and formats them based on the configured event mapping. If the event mapping conditions are satisfied, it sends the event to the cell. statbld.conf The configuration file for the StateBuilder utility. It is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. statbld.trace The configuration file that specifies the trace information to be collected for the StateBuilder utility and where it should be written. It is in the $MCELL_HOME/etc/ directory on Unix platforms and in the %MCELL_HOME%\etc\ directory on supported Windows platforms. StateBuilder utility The utility, statbld, that periodically consolidates the data in a cells transactions file (xact) and writes the Saved State of the cell to a file (.mcdb).
Glossary
79
status (1) For events, an indication of the events management. Possible values are: Open, Acknowledged, Closed. (2) For service management components, an indication of the relative availability of an IT resource. Possible values are: Unavailable, Impacted, At Risk, Maintenance, Available, Unknown, None. STATUS_ PROPAGATION table A dynamic data table that defines the different pairs of service component types whose instances can have a relationship and the status propagation model to be used for each relationship. store and forward A mechanism that ensures that if an event cannot reach its destination, it is saved in a file and sent when a viable connection to the destination becomes available. stored event An event that has been processed by the cell and stored in the event repository. Only stored events are returned by queries and are: displayed in the BMC Impact Explorer console, returned by the mquery CLI command, or referenced by the Using and Update clauses of an MRL rule. substatus (component) The status of a consumer component that is calculated from the status of the components on which it depends. If a component does not depend on any other components, it does not have a substatus. In the GUI, a components substatus is indicated graphically by an offset square in its background. superclass A hierarchically superior event or data class. A class that is derived from another class inherits part of its attributes (slots) from its superclasses. Syslog adapter An adapter that collects information from the log file generated by the Unix daemon syslogd. The Syslog adapter reads syslogd events and formats and sends them to the cell. table The set of dynamic data instances for a particular data class. target The entity designated to receive events from an adapter, an event generator, or a BMC Impact Manager instance. Also, a cell whose content currently displays in a BMC Impact Explorer dialog.
80
Timer phase A phase in event processing in which Timer rules for the delayed execution of another rule type are evaluated. This phase extends during the New, Abstract, Correlate, and Execute phases of event processing. Timer rule An event processing rule that triggers the delayed execution of another type of rule. Timer trigger See Timer rule. Update phase Obsolete term. See New phase. Using clause An MRL rule clause used to access dynamic data and to query events. When clause A part of MRL rule syntax for Abstract, Correlate, Execute, Propagate, and Timer MRL rules. Events must first meet the selection criteria in the rule before the When clause is evaluated. Changes to slot values cause When clauses to be re-evaluated. For details, see the BMC Impact Manager Knowledge Base Reference Guide. wildcard A type of pattern matching that uses the asterisk character (*) to represent any number of different characters, and the question mark character (?) to represent a single unknown character.
Glossary
81
82
Index
A
ACK 23 action, PATROL recovery 61 adapter_host slot 22 agents, in PATROL 18 alarm events, PATROL KM for Event Management 60 alarm, PATROL event 58 attributes filtering 41 mcxp.conf file 38 authentication certificate owner 50 autodiscovery tool mcxpconfig 43 autodiscovery tool, mcxpconfig 21 down events 61 duplicate events 62
E
EV_TYPE_ACK 24 EV_TYPE_ACKNOWLEDGED 23 EV_TYPE_ALARM 24 EV_TYPE_CHANGE_STATUS 24 EV_TYPE_CLOSED 23 EV_TYPE_DELETED 23 EV_TYPE_ERROR 24 EV_TYPE_ESCALATED 23 EV_TYPE_INFORMATION 24 EV_TYPE_OPEN 23 EV_TYPE_RESPONSE 24 EV_TYPE_WARNING 24 event alarm, PATROL 58 state change, PATROL 59 Event class slots 22 event class, BMC II for PATROL slot 22 event load, monitoring 65 event status 23 events alarm 60 duplicate 62
B
BAROC 18 BMC IM cell 18 Knowledge Base, in cell 19 mcxp.baroc 19 mcxp.mrl 19 mcxpcoll.mrl 19 BMC IM event status 23 BMC IM instance 18 BMC IM severity status 24 BMC Impact Manager (BMC IM) 18 BMC Software, contacting 2 buffering, persistent 18
C
cell 18 CLOSED 23 collectors, mcxpcoll.mrl rule file 27 conventions, document 14 CRITICAL 24 customer support 3
F
files mcxp.baroc 19 mcxp.conf 38 mcxp.exe 18 mcxp.mrl 19 mcxpagent.conf 42 mcxpcoll.mrl 19 filtering 28 filters, changing 65 fully-qualified name 61
D
document conventions 14 documentation, related 12
Index
83
H
host name 61 hosts file 61
I
INFO 24 installation, platforms supported 30
K
keyfile modifying 51 Windows PATROL security 50 KM, for Event Management 18 Knowledge Base 19
M
maintenance 64 MC_ADAPTER_CONTROL 27 MC_ADAPTER_ERROR 27 MC_ADAPTER_START 27 MC_CLIENT_START 26 MC_CLIENT_STOP 26 mc_origin_sev slot 23 mc_parameter_value 25 mc_smc_id slot 23 mcxp.baroc BMC IM 19 mcxp.conf attributes 38 files 38 mcxp.exe 18 mcxp.mrl 19 mcxpagent.conf autodiscovery mode, mcxpconfig 44 BMC II for PATROL 21 file, BMC II for PATROL Agent configuration 42 PATROL Agent, configuration 43 sections represent PATROL Agents 42 update mode, mcxpconfig 46 MCXPAgentFile 38 MCXPAgentHeartbeat 38 MCXPAgentLocalPort 38 MCXPAgentReconnectInterval 38 MCXPAgentRetries 38 MCXPAgentTimeout 38 MCXPAgentTransport 38 MCXPBufferDirectory 38 mcxpcoll.mrl 19 mcxpcoll.mrl rule file 27 mcxpconfig
autodiscovery tool 21, 43 mcxpagent.conf autodiscovery mode 44 mcxpagent.conf update mode 46 options 43 mcxpconfig. See autodiscovery tool MCXPDropClass attribute, filtering, mcxp.conf 41 attribute, mcxp.conf 38 MCXPDropKM attribute, filtering, mcxp.conf 41 attribute, mcxp.conf 38 MCXPIgnoreSaveTime 39 MCXPIncludeClass attribute, filtering, mcxp.conf 41 attribute, mcxp.conf 38 MCXPIncludeKM attribute, filtering, mcxp.conf 41 attribute, mcxp.conf 39 MCXPIncludeStatus attribute, filtering, mcxp.conf 41 attribute, mcxp.conf 39 MCXPIncludeType 39 MCXPRecoveryInterval 39 MINOR 24 MpBufferSizeMax 39 MpServerHeartbeat 39
O
OK 24 OPEN 23 operations 58 validate on Unix 57 validate on Windows 57 options, mcxpconfig 43
P
p_agent slot 24 p_agent_address slot 24 p_agent_port slot 24 p_agent_version slot 24 p_application slot 24 p_args slot 25 p_catalog slot 24 p_class slot 24 p_diary slot 24 p_expectancy slot 24 p_handler slot 24 p_instance slot 25 p_node slot 25 p_origin slot 25 p_owner slot 25 p_source_id slot 25 p_status slot 25
84
p_type slot 25 PATROL Agents 18 alarm event 58 event class PATROL_EV 18 recovery action 61 security levels 47 state change event 59 PATROL Agent mcxpagent.conf, configuration 43 mcxpagent.conf, sections 42 up, down events 61 PATROL event status 23 PATROL KM for Event Management alarm events 60 security requirements 51 PATROL security authentication certificate owner 50 BMC II for PATROL 48 Windows keyfile 50 PATROL_EV 18 PATROL_EV event class slots 24 persistent buffering 18 pes 25 pes_alarm_max 26 pes_alarm_min 26 pes_alert_date 26 pes_alert_time 26 pes_ave10 26 pes_icon_name 25 pes_last10 26 pes_last10_tp 26 pes_last10_ts 26 pes_param_status 26 pes_parent_instance 26 pes_patrol_home 26 pes_tcp_port 25 pes_tz 26 pes_udp_port 25 pes_user_defined 26 platforms, supported 30 product support 3 severity slot 22 short 61 short host name 61 slots PATROL KM for Event Management 25 PATROL_EV event class 24 state change 59 status slot 22 support, customer 3
T
technical support 3 tool, autodiscovery 43
U
Unix authentication certificate owner 50 up events 61 user.kdb file 51
V
validate operations on Unix 57 on Windows 57
W
WARNING 24 Windows keyfile 50
R
recovery actions, PATROL 61 related documentation 12 release notes 14
S
security PATROL and BMC II for PATROL 48 PATROL KM for Event Management requirements 51 PATROL levels 47
Index
85
86
Notes
*51457* *51457* *51457* *51457*

*51457*

BII4 Patrolv 3

Transféré par

Informations du document

Description originale:

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

BII4 Patrolv 3

Transféré par

Droits d'auteur :

Formats disponibles

BMC Impact Integration for PATROL

Contacting BMC Software

United States and Canada

Outside United States and Canada

Restricted Rights Legend

Support Web Site

Support by Telephone or E-mail

Before Contacting BMC Software

BMC Impact Integration for PATROL User Guide

BMC Impact Integration for PATROL User Guide

BMC Impact Integration for PATROL User Guide

BMC Impact Integration for PATROL User Guide

About This Book

How This Book Is Organized

About This Book

BMC Impact Integration for PATROL User Guide

Online and Printed Books

Category PATROL documentation

Document PATROL KM for Event Management User Guide

PATROL Security User Guide

Online and Printed Books

To Access Online Books

About This Book

To Request Additional Printed Books

updates to the installation instructions last-minute product information

BMC Impact Integration for PATROL User Guide

About This Book

BMC Impact Integration for PATROL User Guide

BMC II for PATROL Components

BMC Impact Integration for PATROL User Guide

How BMC II for PATROL Works

How BMC II for PATROL Works

BMC II for PATROL Architecture

Event Flow from PATROL Agent to BMC Impact Manager

BMC II for PATROL Architecture

BMC Impact Integration for PATROL User Guide

BMC II for PATROL Configuration File for PATROL Agents

BMC II for PATROL Functional Architecture

BMC II for PATROL Configuration File for PATROL Agents

BMC II for PATROL Event Class File

PATROL Agent Configuration Files

BMC II for PATROL Event Class File

Slots in BMC II for PATROL Event Class (Part 1 of 2)

BMC Impact Integration for PATROL User Guide

BMC II for PATROL Event Class File

Slots in BMC II for PATROL Event Class (Part 2 of 2)

mc_host_class mc_host_address mc_object mc_object_class mc_parameter

mc_tool_class mc_tool_key mc_tool_sev

A string formed as follows: mc_host:mc_object_class:mc_object

Event Status Basis

BMC II for PATROL Event Class File

Event Severity Basis

Slots in Event Class PATROL_EV (Part 1 of 2)

STORED DEL_IF_CLOSED DEL_IF_INFO DO_NOT_STORE

BMC Impact Integration for PATROL User Guide

PATROL KM for Event Management Events

Slots in Event Class PATROL_EV (Part 2 of 2)

p_origin p_owner p_source_id p_status

a list of strings containing the event attributes

PATROL KM for Event Management Events

PATROL KM for Event Management Slots in Class PATROL_EV (Part 1 of 2)

pes pes_tcp_port pes_udp_port pes_icon_name