Tivoli Enterprise Console - Guia Do Usuário

IBM Tivoli Enterprise Console
Users Guide
V ersion 3.9
SC32-1235-00
IBM Tivoli Enterprise Console
Users Guide
V ersion 3.9
SC32-1235-00
Note Before using this information and the product it supports, read the information in Notices on page 107.
First Edition (August 2003) This edition applies to version 3 release 9 of IBM Tivoli Enterprise Console (product number 5698-TEC) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2003. All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
Contents
About this guide . . . . . . . . . . . v
Who should read this guide . . . . . . . . . v Publications . . . . . . . . . . . . . . v IBM Tivoli Enterprise Console library . . . . . v Related publications . . . . . . . . . . vi Accessing publications online . . . . . . . vi Ordering publications . . . . . . . . . . vii Contacting software support . . . . . . . . vii Participating in newsgroups . . . . . . . . . vii Conventions used in this guide . . . . . . . viii Typeface conventions . . . . . . . . . . viii Operating system-dependent variables and paths ix IBM Tivoli Enterprise Console icons . . . . . . ix Configuring custom buttons for an event console Exporting and importing event console definitions . . . . . . . . . . . . . . Managing Tivoli region definitions for the Web version of the event console . . . . . . . . . Tuning the performance of the Web version of the event console . . . . . . . . . . . . . . Backing up and tuning the event database . . . . Stopping and starting the event server . . . . . 33 38 38 41 42 42
Chapter 3. Sample IT environment with configuration examples . . . . . . . 43

Sample IT environment . . . . . . . . . Fast path to managing events . . . . . . . Event adapters . . . . . . . . . . . Event server . . . . . . . . . . . . Extending event management capabilities . . . Event adapters . . . . . . . . . . . Event server . . . . . . . . . . . . Example 1: All operators get all events . . . Example 2: Geographic differentiation . . . Example 3: System management differentiation Example 4: Organizational differentiation . . Example 5: Event-type differentiation . . . . . . . . . . . . . 43 44 44 45 47 47 47 49 49 50 . 50 . 50
Chapter 1. Overview . . . . . . . . . 1
Highlights of the 3.9 release . . . . . . . . . 1 Unified system and network management . . . 1 Optimized event management for key e-business applications. . . . . . . . . . . . . . 2 Components of the Tivoli Enterprise Console product 3 Adapter Configuration Facility . . . . . . . 4 Event adapter . . . . . . . . . . . . . 4 Tivoli Event Integration Facility . . . . . . . 6 Tivoli Enterprise Console gateway . . . . . . 6 Tivoli NetView . . . . . . . . . . . . 6 Event server . . . . . . . . . . . . . 6 Event database . . . . . . . . . . . . 8 User interface server . . . . . . . . . . . 8 Event console . . . . . . . . . . . . . 9 Events . . . . . . . . . . . . . . . . 14 Internal events . . . . . . . . . . . . 14 Event flow. . . . . . . . . . . . . . 15
Chapter 4. Managing events
. . . . . 51
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 51 52 52 53 53 54 54 54 54 55 56 56 56 57 57 57 59 59 61 61 61 61 62 62 62 62 63
Chapter 2. Configuring the Tivoli Enterprise Console product. . . . . . 19

Planning for event management . . . . . . Predefined event groups . . . . . . . . Predefined event consoles . . . . . . . Planning for new event groups . . . . . . Planning for event group roles . . . . . . Configuring event adapters . . . . . . . . Configuring the Tivoli Enterprise Console gateway Configuring the event server . . . . . . . Updating the source list . . . . . . . . Changing the logging defaults . . . . . . Managing rule bases . . . . . . . . . Creating an event console . . . . . . . . Configuring an event console . . . . . . . Creating and changing an event group . . . Assigning an event group to an event console . Creating an operator . . . . . . . . . Assigning an operator to an event console . . Integrating your trouble ticket system with the trouble ticket rules . . . . . . . . . . Customizing an event console . . . . . .
Copyright IBM Corp. 2003
. . . . . . . . . . . . . . . .
19 19 20 20 21 22 22 22 23 24 26 26 26 27 28 29 29
. 29 . 33
Key concepts for event management . . . . Event status . . . . . . . . . . . Event severity . . . . . . . . . . Primary operator tasks . . . . . . . Using the Java version of the event console. . Starting the event console . . . . . . Exiting the event console . . . . . . . Viewing events . . . . . . . . . . Acknowledging events . . . . . . . Running tasks . . . . . . . . . . Running local commands . . . . . . . Closing events . . . . . . . . . . Starting the Tivoli NetView component . . Opening a trouble ticket . . . . . . . Viewing event information . . . . . . Viewing event properties . . . . . . . Customizing the event viewer . . . . . Using the Web version of the event console. . Overview of the Web version of the event console . . . . . . . . . . . . . Starting the Web version of the event console Exiting the event console . . . . . . . Viewing events . . . . . . . . . . Acknowledging events . . . . . . . Running tasks . . . . . . . . . . Closing events . . . . . . . . . . Viewing a summary of events . . . . . Opening a trouble ticket . . . . . . . Viewing event information . . . . . .
iii
Viewing event properties . . . Customizing the event viewer .
. .
. .
. .
. .
. .
. 63 . 63
Chapter 5. Tivoli Enterprise Console gateway . . . . . . . . . . . . . . 67

Configuring the gateway . . . . . . . . . Gateway configuration file . . . . . . . Configuring the gateway to receive events from non-TME adapters . . . . . . . . . . Configuring the gateway for state correlation . Configuring the rate at which events are sent to the event server . . . . . . . . . . . Starting and stopping the tec_gwr program. . . Starting the tec_gwr program manually . . . Stopping the tec_gwr program manually . . Obtaining the status of the tec_gwr program on UNIX . . . . . . . . . . . . . . . . 67 . 68 . 74 . 75 . . . . 76 78 78 78
Problems starting the Tivoli Enterprise Console product. . . . . . . . . . . . . . . . Problems with rules . . . . . . . . . . . Enabling rule tracing . . . . . . . . . . Tuning rules . . . . . . . . . . . . . Problems with the RIM database . . . . . . . Analyzing Tivoli Management Framework trace logs Problems with the Tivoli Enterprise Console gateway . . . . . . . . . . . . . . . Problems with the tec_gateway program . . . Problems with the tec_gwr program . . . . . Problems with the Web version of the event console Problems with performance . . . . . . . . . Configuring the event database . . . . . . . Additional information sources . . . . . . . .
87 88 88 89 89 90 90 90 91 92 93 93 95
. 79
Appendix B. Messages . . . . . . . . 97 Notices . . . . . . . . . . . . . . 107

Trademarks . . . . . . . . . . . . . . 108
Appendix A. Troubleshooting . . . . . 81
Getting started with problem determination Problems locating an event . . . . . . Understanding event server processes . Checking the event flow . . . . . . . . . . . . . . . . . . 81 81 82 86
Index . . . . . . . . . . . . . . . 111
iv
IBM Tivoli Enterprise Console: Users Guide
About this guide

The IBM Tivoli Enterprise Console product is a rule-based, event management application that integrates system, network, database, and application management to help ensure the optimal availability of an organizations IT services. The Tivoli Enterprise Console product is preconfigured so that you can manage events immediately after installation. The IBM Tivoli Enterprise Console Users Guide provides an overview of the Tivoli Enterprise Console product. It provides information about the preconfigured event consoles, event groups, and rules, and information about how to use event consoles to manage events. This guide also includes step-by-step instructions about configuring the Tivoli Enterprise Console product to extend the management capabilities that the Tivoli Enterprise Console product automatically provides.
Who should read this guide

This guide is for system administrators, system programmers, and operators who use Tivoli products to monitor and manage events from a broad range of resources to ensure the availability of these resources. This guide is also useful for network planners and system managers. Readers should be familiar with the following topics: v IT environment you are managing v Operating systems that your enterprise uses v Tivoli Management Framework
Publications
This section lists publications in the IBM Tivoli Enterprise Console library and related documents. It also describes how to access Tivoli publications online and how to order Tivoli publications.
IBM Tivoli Enterprise Console library

The following documents are available in the IBM Tivoli Enterprise Console library: v The IBM Tivoli Enterprise Console Adapters Guide, SC321242 Provides information about supported adapters, including how to install and configure these adapters. v IBM Tivoli Enterprise Console Command and Task Reference, SC321232 Provides details about IBM Tivoli Enterprise Console commands, predefined tasks that are shipped in the task library, and the environment variables that are available to tasks that run against an event. v IBM Tivoli Enterprise Console Installation Guide, SC321233 Describes how to install, upgrade, and uninstall the IBM Tivoli Enterprise Console product. v IBM Tivoli Enterprise Console Release Notes, SC32-1238
v v
Provides release-specific information that is not available until just before the product is sent to market. IBM Tivoli Enterprise Console Rule Developers Guide, SC321234 Describes how to develop rules and integrate them for event correlation and automated event management. IBM Tivoli Enterprise Console Rule Set Reference, SC321282 Provides reference information about the IBM Tivoli Enterprise Console rule sets. IBM Tivoli Enterprise Console Users Guide, SC321235 Provides an overview of the IBM Tivoli Enterprise Console product and describes how to configure and use the IBM Tivoli Enterprise Console product to manage events. IBM Tivoli Enterprise Console Warehouse Enablement Pack: Implementation Guide, SC32-1236
Describes how to install and configure the warehouse enablement pack for the IBM Tivoli Enterprise Console product and describes the data flow and structures that are used by the warehouse pack. v Tivoli Event Integration Facility Reference, SC321241 Describes how to develop your own event adapters that are tailored to your network environment and the specific needs of your enterprise. This reference also describes how to filter events at the source.
Related publications
The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available, in English only, at the following Tivoli software library Web site: http://www.ibm.com/software/tivoli/library/ Access the glossary by clicking the Glossary link on the left pane of the Tivoli software library window.
Accessing publications online

The product CD contains the publications that are in the product library. The format of the publications is PDF, HTML, or both. To access the publications using a Web browser, open the infocenter.html file. The file is in the appropriate publications directory on the product CD. IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli Software Information Center Web site. Access the Tivoli Software Information Center by first going to the Tivoli software library at the following Web address: http://www.ibm.com/software/tivoli/library/ Scroll down and click the Product manuals link. In the Tivoli Technical Product Documents Alphabetical Listing window, click the Tivoli Enterprise Console link to access the product library at the Tivoli Information Center. Note: If you print PDF documents on other than letter-sized paper, select the Fit to page check box in the Adobe Acrobat Print window. This option is available when you click File Print. Fit to page ensures that the full dimensions of a letter-sized page print on the paper that you are using.
vi
Ordering publications
You can order many Tivoli publications online at the following Web site: http://www.elink.ibmlink.ibm.com/public/applications/publications/ cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: v In the United States: 800-879-2755 v In Canada: 800-426-4968 In other countries, see the following Web site for a list of telephone numbers: http://www.ibm.com/software/tivoli/order-lit/
Contacting software support

If you have a problem with any Tivoli product, refer to the following IBM Software Support Web site: http://www.ibm.com/software/sysmgmt/products/support/ If you want to contact software support, see the IBM Software Support Guide at the following Web site: http://techsupport.services.ibm.com/guides/handbook.html The guide provides information about how to contact IBM Software Support, depending on the severity of your problem, and the following information: v Registration and eligibility v Telephone numbers and e-mail addresses, depending on the country in which you are located v Information you must have before contacting IBM Software Support
Participating in newsgroups
User groups provide software professionals with a forum for communicating ideas, technical expertise, and experiences related to the product. They are located on the Internet and are available using standard news reader programs. These groups are primarily intended for user-to-user communication and are not a replacement for formal support. To access a newsgroup, use the instructions appropriate for your browser. Use these instructions for a Microsoft Internet Explorer browser. 1. Open an Internet Explorer browser. 2. From the Tools menu, click Internet Options. 3. On the Internet Options window, click the Programs tab. 4. 5. 6. 7. In the Newsgroups list, click the Down Arrow and then click Outlook Express. Click OK. Close your Internet Explorer browser and then open it again. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup.
About this guide
vii
Use these instructions for a Netscape Navigator browser. 1. Open a Netscape Navigator browser. 2. From the Edit menu, click Preferences. The Preferences window is displayed. 3. In the Category view, click Mail & Newsgroups to display the Mail & Newsgroups settings. 4. Select the Use Netscape mail as the default mail application check box. 5. Click OK. 6. Close your Netscape Navigator browser and then open it again. 7. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup. IBM Tivoli Enterprise Console news://news.software.ibm.com/ibm.software.tivoli.enterprise-console IBM Tivoli NetView for UNIX and IBM Tivoli NetView for Windows news://news.software.ibm.com/ibm.software.tivoli.netview-unix-windows
Conventions used in this guide

This guide uses several conventions for special terms and actions and operating system-dependent commands and paths.
Typeface conventions
This guide uses the following typeface conventions: Bold v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Column headings in a table v Keywords and parameters in text Italic v v v v Citations (titles of books, diskettes, and CDs) Words defined in text Emphasis of words (words as words) Letters as letters
v New terms in text (except in a definition list) v Variables and values you must provide Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type
viii
v Values for arguments or command options
Operating system-dependent variables and paths

This guide uses the UNIX convention for specifying environment variables and for directory notation. When using the Windows command line, replace $variable with % variable% for environment variables and replace each forward slash (/) with a backslash ( \) in directory paths. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions.
IBM Tivoli Enterprise Console icons

The following icons are used in the IBM Tivoli Enterprise Console product.
Table 1. Tivoli Enterprise Console Icons Icon Represents Event Server The red arrow indicates the event server is running. A hollow arrow indicates the event server is initializing. Rule Base The red arrow indicates the rule base is active.
Profile A profile is a collection of application-specific data.
About this guide
ix
Chapter 1. Overview
The IBM Tivoli Enterprise Console product is a rule-based event management application that integrates system, network, database, and application management to help ensure the optimal availability of the IT resources in an enterprise. The Tivoli Enterprise Console product: v Provides a centralized, global view of your computing enterprise. v Collects, processes, and automatically responds to common management events, such as a database server that is not responding, a lost network connection, or a successfully completed batch processing job. v Acts as a central collection point for alarms and events from a variety of sources, including those from other Tivoli software applications, Tivoli partner applications, custom applications, network management platforms, and relational database systems. The Tivoli Enterprise Console product helps you effectively process the high volume of events in an IT environment by: v Prioritizing events by their level of importance. v v v v Filtering redundant or low-priority events. Correlating events with other events from different sources. Determining who should view and process specific events. Initiating automatic corrective actions, when appropriate, such as escalation, notification, and the opening of trouble tickets.
v Identifying hosts and automatically grouping events from the hosts that are in maintenance mode in a predefined event group. This chapter describes the highlights of this release and the components of the Tivoli Enterprise Console product. It also provides information about events and how the Tivoli Enterprise Console product processes events.
Highlights of the 3.9 release

Two major highlights of this release include unified system and network management and optimized event management for the following key e-business applications: v IBM WebSphere MQ v IBM DB2 v IBM WebSphere Application Server
Unified system and network management

The Tivoli Enterprise Console event management application integrates the IBM Tivoli NetView component, thereby unifying system and network management in a single tool. This integration enables the Tivoli Enterprise Console product to automatically: v Correlate the status of a system or application to the status of the network that it uses. v Determine if the root cause of a system or application problem is an underlying network failure.
To unify system and network management, the Tivoli Enterprise Console product provides: v Automatic filtering and forwarding of network events from the Tivoli NetView component v Rules that correlate system-related and network-related events. These rules are based on predefined associations and help in performing root cause analysis. For example, Subnet Unreachable events include the subnet number and mask information. This enhanced event information enables the rules to determine if a server is on a subnet that is known to be unreachable. If it is, this would impact the applications on that server, and the unreachable subnet might be the root cause of any application-related events that have occurred. These rules significantly reduce the human intervention that is typically required to analyze application-failure or system-failure events and compare them to network-failure events to determine the actual problem. By automatically correlating system-related and network-related events, the Tivoli Enterprise Console product saves operators time and provides a more reliable method of problem identification. v Rules that understand and automatically process network events. Only events that require operator action are displayed in the event console. This reduces clutter, gives operators significantly fewer events to assess, and removes the need for operators to manually sort and close previous network status events. Operators can still find and view related events that have been closed by correlation. v Predefined event consoles and event groups for Tivoli NetView events, which you can use to manage these events immediately. You can use the event groups as they are provided, or you can customize them for your enterprise. For more information, see Planning for event management on page 19. v Ability to start the Tivoli NetView Web console from the Java version of the event console, which an operator can use to navigate from an event in the event console to the associated network topology and diagnostics. Rules automatically synchronize the status between the event console and the Tivoli NetView Web console. Therefore, when an operator responds to a network event in the event console, the status of the network element is immediately updated. This enables system and network management operators to analyze and resolve problems more efficiently and effectively. It also improves the communication among the different operators because both the event console and the network console immediately display the correct status. For more information about the rules that the Tivoli Enterprise Console product provides, refer to the IBM Tivoli Enterprise Console Rule Set Reference. For more information about the Tivoli NetView component, refer to the Tivoli NetView documentation at the following Web site: http://www.ibm.com/software/tivoli/library
Optimized event management for key e-business applications

To optimize the event management for key e-business applications, the Tivoli Enterprise Console product provides: v Predefined event consoles and event groups for WebSphere MQ, DB2, and WebSphere Application Server events, which you can use to manage these events immediately. You can use the event groups as they are provided, or you can customize them for your enterprise. For more information, see Planning for event management on page 19.
v Rules that identify the root cause of a problem. Because the rules are based on predefined associations among the WebSphere MQ, DB2, and WebSphere Application Server applications, the rules can determine how the failure of one application affects another application and, therefore, identify the root cause of the problem. For more information about the rules that the Tivoli Enterprise Console product provides, refer to the IBM Tivoli Enterprise Console Rule Set Reference.
Components of the Tivoli Enterprise Console product

This section provides an overview of the following Tivoli Enterprise Console components, which are listed in the order in which an event flows from its source to the operator: v v v v v v v Adapter Configuration Facility on page 4 Event adapter on page 4 Tivoli Event Integration Facility on page 6 Tivoli Enterprise Console gateway on page 6 Tivoli NetView on page 6 Event server on page 6 Event database on page 8
v User interface server on page 8 v Event console on page 9 The relationship among the components of the Tivoli Enterprise Console product is illustrated in the following diagram.
Chapter 1. Overview
User interface server Web browser
Event console (Web version)
Event console (Java version)
Tivoli NetView component
WebSphere Application Server
Event database server Event server Tivoli NetView component Network management server
Prolog rules
State correlation rules
Tivoli Enterprise Console gateway

Event Integration Facility Event Integration Facility
Event Integration Facility Event Integration Facility
SNMP
Event Integration Facility
Event sources (TME and non-TME)
Event Integration Facility
Figure 1. Tivoli Enterprise Console components
Adapter Configuration Facility

The Adapter Configuration Facility provides a graphical user interface (GUI) to configure and distribute TME adapters. You can use the Adapter Configuration Facility to create profiles for adapters and set adapter configuration and distribution options. You can distribute TME adapters to the subscribers of the profile, thus making configuration changes in a central location and then distributing the changes to the remote endpoints or managed nodes. For more information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide.
Event adapter
An event adapter is a process that typically resides on the same host as a managed source and monitors the source for events. A source is an application (such as a database) or a system resource (such as available disk space). A typical source is a system resource or an application that is running. For example, if you want to monitor the Windows event log, install the Windows event log adapter on every
host on which you want to monitor the log. You must either run an event adapter for each source that you want to monitor or modify the source to send events to the Tivoli Enterprise Console product. When an event adapter receives information from its source, the adapter formats the information and forwards it to the event server for interpretation and response, as illustrated in the following diagram.
event: native format event: Tivoli format
System Resource or Application
Event Adapter
To event server
Figure 2. Event flow from an event adapter
You can configure an event adapter to discard selected events instead of forwarding the events to the event server, which reduces network traffic and event server workload. An event adapter sends events to the event server using either a Tivoli interface or a non-Tivoli interface. A Tivoli interface is one that runs in a Tivoli environment and a non-Tivoli interface is one that runs in a non-Tivoli environment. Both Tivoli and non-Tivoli types of interfaces send events using a simple interprocess communication mechanism. The difference between the two interfaces is the method used to establish the connection. Interfaces in a Tivoli environment establish connections using services that the Tivoli Management Framework provides. Interfaces in a non-Tivoli environment establish connections using standard interprocess communication mechanisms. You choose the type of connection for your environment when you install an event adapter. For more information about installing and configuring event adapters, refer to the IBM Tivoli Enterprise Console Adapters Guide. Many other Tivoli products that operate in Tivoli or non-Tivoli environments provide additional event adapters. You can also create a specialized event adapter for your own applications and services using the Tivoli Event Integration Facility. For information about the Tivoli Event Integration Facility, refer to the Tivoli Event Integration Facility Reference.
Event source buffering

An event adapter can buffer events. When event buffering is enabled for an event adapter and the event source cannot connect to the event server, events are buffered until a connection can be established to the event server. When a connection is established, the event adapter sends the buffered events to the event server.
Secondary event servers

You can specify one or more secondary event servers for an event adapter. A secondary event server is a backup event server that receives events when the Tivoli Enterprise Console gateway cannot contact the adapter-specified event server. You can specify one or more secondary event servers in the Tivoli Enterprise Console gateway configuration file. For information information, see Gateway configuration file on page 68.
Chapter 1. Overview
Tivoli Event Integration Facility

The Tivoli Event Integration Facility is a toolkit that expands the types of events and system information that you can monitor. Event adapters monitor managed resources and send events to the Tivoli Enterprise Console product or other applications. You can use the Tivoli Event Integration Facility to develop your own adapters that are tailored to your network environment and your specific needs. For more information about the Tivoli Event Integration Facility, refer to the Tivoli Event Integration Facility Reference.
Tivoli Enterprise Console gateway

The Tivoli Enterprise Console gateway receives events from TME and non-TME adapters and forwards them to an event server. By default, the Tivoli Enterprise Console gateway uses a connection-oriented service to the event server. A connection-oriented service is one that establishes a connection when the Tivoli Enterprise Console gateway is started, and the connection is maintained for all events. The Tivoli Enterprise Console gateway provides the following benefits: v Greater scalability, which allows you to manage sources with less software running on the endpoints. v Improved performance of the event server. The Tivoli Enterprise Console gateway bundles events before sending the events to the event server, which reduces the amount of communication tasks that the event server or the Tivoli server must perform. v Simple deployment of adapters and updates to adapters using profiles in the Adapter Configuration Facility. v Event correlation and filtering closer to the sources, which reduces the number of events sent to the event server and improves network performance by decreasing the amount of network traffic. For more information about the Tivoli Enterprise Console gateway, see Chapter 5, Tivoli Enterprise Console gateway, on page 67.
Tivoli NetView
The Tivoli NetView component provides the network management function for the Tivoli Enterprise Console product. The Tivoli NetView component monitors the status of network devices and automatically filters and forwards network-related events to the Tivoli Enterprise Console product. For information about how the Tivoli Enterprise Console product processes network-related events, see Unified system and network management on page 1. For more information about the Tivoli NetView component, refer to the Tivoli NetView documentation at the following Web site: http://www.ibm.com/software/tivoli/library/
Event server
The event server provides a centralized location for the management of events in a distributed environment. Each Tivoli region contains only one event server. The event server processes input from event consoles and updates the event database. Because the event consoles read data from the event database, the status of events on all event consoles is updated. The event server creates an entry in the event database for each incoming event and then evaluates these events against a set of rules to determine if the event server should automatically perform any predefined
tasks or modify the event. If human intervention is required, the event server notifies the appropriate operator. The operator performs the required tasks and then notifies the event server when the condition that caused the event has been resolved.
Logging incoming events

When reception logging is enabled, the event server validates and logs incoming events to the event database. The event server assigns a unique identifier and time stamp to each event and, if the event is valid, stores the event in the event database. When the event server receives a valid event, the event server sends the event to the rule engine for further processing. If the rule engine is busy, incoming events are stored in a buffer until the rule engine can process the events. When the rule engine completes processing any buffered events, the event server stores the event in the event database.
Applying rules
When the event server receives an event or when the event is modified, the event server determines if any existing rules apply to that event. A rule consists of a set of expressions used to determine if an event meets the rule conditions. A rule also includes a set of actions that are taken when an event meets the specified rule conditions. Rules help reduce the amount of interpretation and the number of responses required by operators. For example, a particular event might be known to trigger one or more instances of another event. In such a case, a rule can be used to automatically downgrade the severity of the event or close events that are known to be caused by the triggering event. The event server can use rules to delay responses to an event. If responses are delayed for an event, event consoles are not updated and the event server does not issue an automatic response until the specified amount of time has elapsed. A delayed response might be preferrable, for example, if you have a self-correcting problem that occasionally occurs on the network. This feature can prevent an operator from needlessly responding to a problem. A rule can specify an action to be taken automatically in response to an incoming event. For example, if an event indicates that a router is down, the first response might be to attempt to restart the router and give an operator a low-severity notice. If the attempts to restart the router within a designated time period fail, a rule can specify that attempts to retry be cancelled and that a higher-severity notice be sent to an operator. An operator can monitor actions that are automatically performed for an event. If an operator does not respond to an event after a specified period of time, the event server can take additional actions beyond displaying the event on an event console. For example, the event server can send an e-mail notice of the unacknowledged event to an operator. If the operator still does not acknowledge the event, the server can then perform actions, such as paging the operator or sending an e-mail notice to an alternate contact. You can use the predefined rules that the Tivoli Enterprise Console product provides, or you can create your own rules. The predefined rules associate resource-related events and network-related events to help you to determine the root cause of a problem. For example, the predefined rules can associate an event that indicates that a DB2 server is down with an event that indicates that a specific host is down. This association enables you to quickly determine that the root cause of the events related to the DB2 application is a network failure and not a DB2 application failure. For information about the predefined rules, refer to the IBM
Chapter 1. Overview
Tivoli Enterprise Console Rule Set Reference. For information about creating your own rules, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. A rule can specify, but is not limited to, the following actions: v Correlating events v Responding automatically to events, such as running an application or a script v Delaying responses to events v v v v v Escalating events Modifing event attributes Modifying attributes of other events Preventing duplicate events from being displayed Dispatching Tivoli or other administrative actions on resources
v Reevaluating a set of events v Discarding an event v Generating a new event v Forwarding an event to another event server
Event database
The Tivoli Enterprise Console product uses an external relational database management system (RDBMS) to store the large amount of event data that is received. In this guide, the RDBMS is referred to as the event database. The RDBMS Interface Module (RIM) component of the Tivoli Management Framework is used to access the event database. For additional information about the event database, see the IBM Tivoli Enterprise Console Installation Guide.
User interface server

The user interface (UI) server is a process that provides communication services between the event consoles and the event server. The UI server communicates with the dispatch engine when it needs to contact the event server. The UI server provides transaction locking for event console status updates and prevents multiple event consoles from responding to the same event. The UI server also automatically updates the status of events on all event consoles by forwarding the event changes from the event consoles to the dispatch engine, which sends the changes to the event database. For example, when an operator acknowledges an event, the UI server automatically updates the status of the event on each event console that contains the event. The UI server also provides a set of commands that enable an operator to change any event attribute, list the events in a specific event group, and display one message on the operators desktop. The UI server can be installed on any managed node in the Tivoli region, but only on one managed node. The UI server does not have to be located on the same host as the event server. The name of the UI server process is tec_ui_server. If the UI server fails, error messages are written in the /tmp/ui_server log file. The name of this log file is defined in the $BINDIR/TME/TEC/.ui_server_diag_config file and can be changed.
Event console
An event console provides a GUI that operators can use to view and respond to events. The Tivoli Enterprise Console product provides two versions of the event console, a Java version and a Web version. Administrators must use the Java version to perform configuration tasks. Administrators or operators must use the Java version to start Tivoli NetView functions and to run local automated tasks. Administrators and operators can use the Java version or the Web version, or both, to manage events. An event console displays a window for monitoring event groups, which operators can use to monitor and respond to incoming events. An event group is a set of events that meet certain filter criteria. An administrator defines the event groups and assigns them to event consoles for each operator. Operators can have independent or shared views of events. The UI server prevents multiple event consoles from updating the same event and updates event status on all event consoles. Therefore, only one operator responds to and works on solving a problem. For more information about the UI server, see User interface server on page 8. For more information about event consoles, see Chapter 4, Managing events, on page 51.
Java version of the event console

The Java version of the event console can be installed on a managed node, endpoint, or a host in a non-Tivoli environment. The Java version of the event console includes the following features: v Tivoli secure logon for added security. v Each event console retrieves event information directly from the database for high performance and scalability. v The event console refresh rate is configured to allow different event consoles to be given different priorities for event updates. For more information about refresh rates, see the Event Viewer Preferences entry provided in the online help for the event console. v Ability to run local actions and commands enables third-party or custom scripts and applications to be run easily from the event console. For more information about running local commands, see the Executing Local Commands entry provided in the online help for the event console. v Ability to run predefined tasks. For more information about running tasks from a task library, see the online help for running tasks in the event console. v Automated tasks can be configured in advance and run when a particular event is received by the event console. For more information about automated tasks, see the automated task entries provided in the online help for the event console. v Ability to view more information about an event in a Web page, which helps an operator to determine the actions to perform and whom to contact. When the sample event information is installed, samples and hooks are provided to help you enable this feature. Customers must provide the additional information to customize their environment. For more information, see the Web Server and Event Information entries provided in the online help for the event console. v Multiple event details, viewed in a single window with additional contextual information, improving operator understanding. v All attributes, including custom attributes, can be displayed and filtered for event groups with SQL operators. For more information about attributes, see the Event Group entries provided in the online help for the event console.
Chapter 1. Overview
v Multiple operators can be assigned to a single event console definition. For more information about defining event consoles and operators, see the online help for the event console. v When editing event console definitions, all operators assigned to that event console automatically pick up the changes, thus eliminating the need for scripts to be used to update or create event consoles. v When there are conflicts between event consoles, such as two operators simultaneously attempting to change the status of an event, they are resolved automatically and operators are notified. v Import and export functions enable the event console and event group definitions to be exported to a file for archiving or for easily migrating from the development environment into production. For more information about importing event console definitions, see the Exporting and Importing From Other Consoles entry provided in the online help for the event console. The Java version of the event console provides the following views: Configuration view The Configuration view is used to configure both the Java version and the Web version of the event console. Only administrators have access to this view. Summary Chart view The Summary Chart view is used to show a high-level overview of the health of resources represented by an event group. Each event group is represented by a single bar, similar to a bar graph, on an operators event console. To open an event group, click the bar representing that group. Priority view In the Priority view, event groups are represented by buttons. The buttons representing each event group display the event group name and the color of the button representing each event group corresponds to the color defined for the highest severity event contained in that group. To open an event group, click the button representing that group.
Web version of the event console

You can use the Web version of the event console to manage events from your Web browser. The Web version of the event console includes the following features: v Tivoli secure logon for added security. v Event console definitions, event group definitions, and preferences that an administrator defines using the Java version of the event console take effect for the Web version, so that both the Web version and the Java version of the event console can be administered from a single place. v Ability to view additional information about an event in a Web page, which helps an operator determine the actions to perform and whom to contact. v Multiple event details with additional contextual information, viewed in a single Web page, improving operator understanding. v Multiple operators can be assigned to a single event console definition. v Changes to event console definitions are automatically reflected in the event console in the next logon session. v The event console refresh rate can be changed to update events at an interval that meets your needs. For information about changing the refresh rate, see the online help for changing user preferences in the event console. v Event viewer data, event summary data, and task information are cached, reducing the load on the event server database and the Tivoli Management
10
Framework. You can configure the timeout intervals for these caches, which helps you to balance your needs for performance and current information. v A single installation of the Web version of the event console can be configured to support the installation of the Tivoli Enterprise Console product in multiple Tivoli regions. v Ability to run predefined tasks. v When there are conflicts between event consoles, such as two operators simultaneously attempting to change the status of an event, they are are resolved automatically and operators are notified. The Web version of the event console organizes the tasks you can perform in a portfolio, which is titled My Work. The portfolio contains the following tasks: Select an Event Group Lists the event groups that have been assigned to the event console. To manage the events in an event group, select the appropriate event group from the list. An event viewer is displayed, which contains the events in the selected event group. View Summary of Events Shows a high-level overview of the health of resources represented by an event group, indicating the number of events for each event severity in each event group and the total number of events for each event severity. You can also display the percentage of events for each event severity. To manage the events in an event group, select the name of the event group. An event viewer is displayed, which contains the events in the selected event group. Run Tasks Runs predefined tasks from task libraries. Change User Preferences Controls the display of events in the event viewer. For example, you can change the automatic refresh rate and the maximum number of events to display in the event viewer.
Event groups
An event group is a configured logical area of responsibility that is used to notify users that an event matching a specified set of criteria has occurred. An administrator configures event groups using the Java version of the event console. For example, if your network contains a group of computers that are used for critical work, you might want to create an event group that receives events for these critical computers. This logical grouping of events is an event group. For more information about event groups and attributes, see Chapter 4, Managing events, on page 51. To define an event group, you must specify the selection criteria for the events in the group. This data constitutes an event group filter. An event group filter can include any event attribute except for extended or customer-defined attributes. The following table lists some of the more commonly used attributes for event group filtering.
Chapter 1. Overview
11
Table 2. Common attributes for event group filtering Attribute Name event class Description Specifies the class of the event, as assigned by the event source that forwards the event. The documentation for the event adapter lists the possible values for event classes for adapters. Other Tivoli applications, such as Distributed Monitoring, Software Distribution, and Tivoli NetView, can also forward events to the Tivoli Enterprise Console product. Identifies the protocol address or host name of a host from which you want to receive events. If you want to monitor an entire subdomain, enter the protocol address or host name of the subdomain. Specifies the severity of the event. The Tivoli Enterprise Console product uses the following classifications, listed in order of increasing severity, to indicate the severity of an incoming event: UNKNOWN HARMLESS WARNING MINOR CRITICAL FATAL A system administrator can also add custom severities. source Specifies the type of application that created the event. Sources are defined in the event adapter or the documentation for your application. Possible values include, but are not limited to, LOGFILE, NT, HPOV, and SNMP. Specifies the status of the event as follows: Acknowledged An operator or rule acknowledged receipt of the event. Closed An operator or rule reported that the problem that resulted from the event is resolved. The sending of a closed event by an event adapter indicates that a previously received event of the specified class should be closed as a duplicate. Open The event server received the event, but an operator or rule has not acknowledged receipt of the event.
origin
severity
status
organization_supplied_status The STATUS enumeration that is shipped with the Tivoli Enterprise Console product includes this placeholder status that a system administrator can customize and define for an organization. Response A rule has automatically responded to the event. This status is assigned by a rule language predicate.
12
You can use SQL wildcard characters for any of the attributes to simplify event group filtering options. Entering specific values for each attribute narrows the types of events reported in an event group. Using wildcard characters expands the types and number of events reported in an event group. Event group filters enable you to include specific, and possibly very different, events in an event group. Event group filters also help reduce the number of event groups that an operator must manage. For example, an administrator can create an event group composed of three filters to monitor the events on hosts 9.27.136.1, 9.27.136.2, and 9.27.136.4, but not 9.27.136.3. Without using event group filters, you would need three event groups to manage events from these hosts.
Required Tivoli authorization roles

The Tivoli Enterprise Console product requires both Tivoli authorization roles and Tivoli Enterprise Console event group roles. Tivoli authorization roles are roles defined for the tasks that Tivoli Enterprise Console administrators and operators perform in a Tivoli management environment and are set in the Tivoli Management Framework product. For information about assigning Tivoli authorization roles, refer to the Tivoli Management Framework Users Guide. Tivoli Enterprise Console event group roles are the roles defined for managing events in an event console. For information about event group roles, see Planning for event group roles on page 21. The following table lists the Tivoli authorization roles required for the Tivoli Enterprise Console product.
Table 3. Required Tivoli authorization roles Activity Assigning administrative roles for the event server Configuring Starting and stopping Assigning an operator to an event console Configuring your own event viewer preferences Assigning event group roles Creating, modifying, or deleting event groups Assigning event groups Deleting events Acknowledging and closing events Viewing events Sending events Events Event groups Event console Context Event server Tivoli Authorization Role senior super senior senior user senior senior senior senior admin, RIM_view, and RIM_update user and RIM_view user, if using the wpostemsg command, otherwise none senior
Creating, modifying, or loading Rule base rule bases
Chapter 1. Overview
13
Table 3. Required Tivoli authorization roles (continued) Activity Installing the Tivoli Enterprise Console product Notes: 1. Each operator must be defined as a Tivoli administrator with the appropriate authorization roles to manage events before you can assign the operator to an event console. 2. If you add an authorization role to a Tivoli administrator after the operator starts the event console, the authorization role does not take affect until the event console is restarted. 3. Tivoli administrators that existed before the installation of Version 3.9 are automatically given the authorization roles of RIM_view and RIM_update during the installation of the event server. You must manually assign the authorization roles of user, RIM_view, and RIM_update to Tivoli administrators that have been created after the installation of the event server. Context Tivoli region Tivoli Authorization Role super
Events
In the Tivoli Enterprise Console product, an event is an object that has been created based on data that is obtained from a source that is monitored by an event adapter. Each event is identified by a class name, which the event adapter defines. Some examples of class names include Su_Success, Su_Failure, No_Permission, and Printer_Toner_Low. Class names are used to label events, but each event contains additional information that helps define and locate a potential problem. Sample event information is provided as an example to manage requests for additional event information that an operator might need. Each event class has a template, which can be modified to include additional information about an event and the action required to resolve the problem. This facilitates the creation of a comprehensive online system of event information and troubleshooting. For detailed information about event classes and attributes provided by the adapters shipped with the Tivoli Enterprise Console product, refer to the IBM Tivoli Enterprise Console Adapters Guide. Several communication protocols are available for forwarding events from event adapters to the event server. The security of each protocol varies. Events use the credibility event attribute to indicate that the events have been received using Tivoli Management Framework services. A credibility of 1 indicates that the event was sent from a TME event adapter and a credibility of 0 indicates the event was sent from a non-TME adapter. You can use the credibility event attribute to determine how to respond to an event, either as a manual response or in an automatic action defined in a rule. Communication between the event server and all event consoles have the same level of security as other Tivoli communication. Events are sent as plain, unencrypted text.
Internal events
The Tivoli Enterprise Console product generates events internally to provide information about the Tivoli Enterprise Console product itself. Each internal event has one of the following classes:
14
TEC_Notice Events that contain non-error conditions in the Tivoli Enterprise Console product. TEC_Error Events for certain error conditions in the Tivoli Enterprise Console product. TEC_DB Events for event database access failures. TEC_Start Events generated when the event server is started. TEC_Stop Events generated when the event server is stopped.
Event flow
The event server architecture consists of the following five processes. The process names are in parentheses. v Master process (tec_server) v Reception engine process (tec_reception) v Rule engine process (tec_rule) v Dispatch engine process (tec_dispatch) v Task engine process (tec_task) Note: An additional process for UI server, tec_ui_server, plays an integral part in the overall Tivoli Enterprise Console architecture. The UI server is not part of the event server, although it communicates with the event server. For more information, see User interface server on page 8. These processes are also known as services when running in a Windows environment. The service names have a .exe file name extension. If any of the event server processes fail, error information is written to a log file as described in the following table. The names of these log files are defined in the $BINDIR/TME/TEC/.tec_diag_config file and can be changed.
Table 4. Log files for event server processes Process tec_server tec_reception tec_rule tec_dispatch tec_task Log File /tmp/tec_master /tmp/tec_reception /tmp/tec_rule /tmp/tec_dispatch /tmp/tec_task
The following figure illustrates the relationships among the event server processes. The arrows represent the flow of communication.
Chapter 1. Overview
15
Incoming Tivoli events

from non-Tivoli communication

from Tivoli communication
Master
(tec_server)
Task engine
(tec_task)
External tasks or programs
UI server Reception engine

(tec_reception)
Rule engine
(tec_rule)
Dispatch engine
(tec_dispatch)
(tec_ui_server)
Console
Reception buffer (RAM)
Event cache (RAM) RDBMS
Console
Console
Figure 3. Relationship among event server processes
Master process
The master process coordinates all of the other event server processes. If one of the other event server processes stops, the master process attempts to restart the process. If the master process cannot restart the process, the master process stops the rest of the processes. The master process also initially receives incoming events sent from Tivoli communication and forwards the events to the reception engine.
Reception engine process

The reception engine process receives incoming events and logs them to the reception log. The reception engine process also sends received events to the rule engine for processing. The following figure illustrates the event reception steps in detail. The state of an event during the reception process is explained after the figure. The callouts in the figure are described as follows: 1. The reception engine receives events directly from non-Tivoli communication or from the master process if the event was sent from Tivoli communication. 2. All incoming events are written to the reception log, and marked as QUEUED or WAITING. The reception log is actually a table in the event database. 3. Events marked QUEUED are sent to the reception buffer. 4. QUEUED events are sent from the reception buffer to the rule engine for processing. 5. The dispatch engine signals the reception engine when rule engine processing for an event is completed. The reception engine marks the event as PROCESSED in the reception log and removes it from the reception buffer. If the rule engine cannot successfully parse the event for processing, the event is marked as PARSING_FAILED in the reception log.
16
Figure 4. Reception process
Incoming Tivoli events Incoming Tivoli events

from non-Tivoli communication from Tivoli communication
1 Master 1 4 Rule engine 5
Reception engine Dispatch engine
Reception log
Reception buffer
The state of an event during the reception process (PARSING_FAILED, PROCESSED, QUEUED, and WAITING) is specific to the reception engine and is not an event attribute. The states are defined as follows: PARSING_FAILED The event is not valid. Either the event class is not known to the event server, or the event class attributes are not formatted correctly. The event is discarded. That is, the reception engine process does not insert the event into the event repository, but you can still view the event in the reception log. PROCESSED The event is valid. The rule engine has successfully processed the event. QUEUED The event is waiting in the reception buffer for rule engine processing. The reception buffer is a first in, first out (FIFO) queue. If you routinely see QUEUED events in the output from the wtdumprl command, the rule engine is too busy. If you see only PROCESSED events in the output from the wtdumprl command, the reception buffer is adequately sized, and rule engine processing is efficient. WAITING The reception buffer is full. When the reception buffer accepts the event, the reception engine process changes the event to the QUEUED state. If you routinely see WAITING events in the output of the wtdumprl command, the reception buffer is not large enough, or the rule engine is too busy, or both. When the event server is restarted, the reception engine is reloaded with events from the reception log that are in the WAITING or the QUEUED state.
Chapter 1. Overview
17
The reception engine does not process internally generated events (for example, those generated by rules). Internally generated events never appear in the reception log or the reception buffer. The reception buffer is located in system memory (RAM). You can configure the size of the reception buffer using the wsetesvrcfg command or from the Event Server Parameters dialog.
Rule engine process

The rule engine is a rule-based event processor. The reception engine sends an event to the rule engine. Then the event is evaluated against the rules. After rule processing, the event is placed into the event cache of the rule engine. The event in the rule engine currently being evaluated is referred to as the event under analysis. An event that satisfies the specification criteria of a rule causes the rule to run, which means the actions defined by the rule are performed. This is the first input stream into the rule engine. A second input stream comes from the dispatch process. This input stream contains changes made to events that have already been received by the event server, typically coming from a change made by activity at an event console. A third input stream comes from requests for changes to events from running actions by the task process. This input stream comes to the rule engine from a task process thread through the dispatch process. The output stream from the rule engine goes to the dispatch process. After an event is evaluated against the rules, it is forwarded to the dispatch process for storage in the event repository. The rule engine evaluates and correlates events with other events in the event cache. The rule engine uses the event cache for its processing, and the event cache is kept in memory. The rule engine interacts with the dispatch engine to synchronize the updates of its event cache with the event database.
Dispatch engine process

The main functions of the dispatch engine are to keep the event database current and send updated event information to the event consoles. The dispatch engine communicates with the rule engine and the task engine to know when to update event information. If tasks or programs need to be run for an event, the dispatch engine contacts the task engine for running them. The dispatch engine also manages requests for event changes coming from an event console (through the UI server) and sends them to the rule engine. When the event server is started, the dispatch engine retrieves events from the event database to reload the event cache for the rule engine.
Task engine process

The task engine runs programs, tasks, scripts, and commands initiated by rules. The task engine process monitors these running items and can return their exit statuses to the dispatch engine, which writes the statuses to the event database. The task engine runs these items as it receives requests to do so. It does not wait for a running item to complete before starting another one. The num_actions attribute for an event contains the number of actions (tasks or programs) currently being tracked by the event server for the event.
18
Chapter 2. Configuring the Tivoli Enterprise Console product

This chapter is intended for administrators. It describes the planning decisions you need to make and the configuration tasks you can perform so that operators can manage events. This chapter also provides information about backing up and tuning the event database, managing Tivoli region definitions for the Web version of the event console, and stopping and starting the event server.
Planning for event management

To manage events, you and your operators must have the appropriate Tivoli authorization roles. For information about the required Tivoli authorization roles, see Required Tivoli authorization roles on page 13. You must also decide about the event groups that will meet your needs. Event groups specify the events that are displayed on the event console based on the filter criteria you specify. When you assign an operator to an event console, you are defining the area of responsibility for that operator. The Tivoli Enterprise Console product provides predefined event groups and event consoles so that operators can manage events immediately with little or no configuration required. If the predefined event groups and event consoles do not entirely meet your needs, you can modify the predefined event groups, and you can create additional event groups and event consoles.
Predefined event groups

The Tivoli Enterprise Console product provides the following predefined event groups: AllActiveEvents Events that are in open and acknowledged state. EbusinessEvents Events for IBM WebSphere Application Server, DB2, and WebSphere MQ resources that are monitored by the IBM Tivoli Monitoring product. UnMonitoredEBusiness Events for IBM WebSphere Application Server, DB2, and WebSphere MQ resources that are not being monitored by the IBM Tivoli Monitoring product. If the Tivoli NetView component is enabled to do port scans, the Tivoli NetView component can discover the hosts that are running IBM WebSphere Application Server, DB2, or WebSphere MQ resources. The Tivoli NetView component then forwards events related to these resources to the event server. ProbableEventAssn Events that define the probable root cause of events for IBM WebSphere Application Server, DB2, or WebSphere MQ resources. For example, if the Tivoli Enterprise Console product repeatedly receives a sequence of WebSphere Application Server events related to its access to a DB2 resource and at the same time receives events indicating a DB2 failure, the Tivoli Enterprise Console product determines that the root cause of the problem is that the host on which DB2 resides is down. The Tivoli Enterprise Console product then sends a TEC_Probable_Event_Association event. If you are receiving numerous TEC_Probable_Event_Association events, you might need to define this association for the predefined rules
19
that the Tivoli Enterprise Console product uses for root cause analysis. For more information about the predefined rules, refer to the IBM Tivoli Enterprise Console Rule Set Reference. Maintenance Maintenance events that are not closed. Events in this group are used to inform an operator that a specific system is in maintenance mode. When a system is in maintenance mode, events from that system cannot be processed. Events in this event group can be in open state or acknowledged state. Events in open state indicate a scheduled maintenance time for the system identified in the event. Events in acknowledged state indicate that the system identified in the event is within the scheduled maintenance time. OpenNetView Tivoli Netview events that are open. OtherNetView Tivoli Netview events that are acknowledged or closed. ServiceUnavailable Events from the Tivoli Netview component that indicate that IBM WebSphere Application Server, DB2, or WebSphere MQ applications are not available.
Predefined event consoles

The Tivoli Enterprise Console product provides the following predefined event consoles: AdministrativeConsole Default event console to which all predefined event groups are assigned. This event console is assigned to the root administrator. The root administrator can immediately manage events in the predefined event groups without having to perform any additional configuration. EBusinessEventsConsole Event console to which the e-business event groups (EbusinessEvents, UnMonitoredEBusiness, and ProbableEventAssn) are assigned. Assign an operator to this event console for management of all e-business events. For information about creating an operator and assigning an operator to an event console, see Creating an operator on page 29 and Assigning an operator to an event console on page 29, respectively.
Planning for new event groups

To create your own event groups (in addition to the predefined event groups that the Tivoli Enterprise Console product provides), you must decide which events to monitor and which attributes of those events to use in filters for the event group. These attributes collectively constitute the event group filter. Operators can monitor multiple event groups. When you define event groups, you can decide, for example, that an operator is responsible for all NFS-related problems across the network or for only specific hosts. Because event groups specify the type of events (such as, all events from the engineering department) that are displayed on an event console, the event group can include events from several different event sources. (Event sources refer to the event adapters that send events to the event server.) Use a worksheet similar to the following to plan your event groups. Remember that you can filter on all base event attributes (not extended or customer-defined
20
attributes), not only the event attributes shown in the example. You can use SQL wildcard characters to specify event filters. For more information about creating an event group, see Creating an event group on page 27. Note: When you create an event group, consider adding a criterion to the filter on the date_reception event attribute that limits the time range of the events that are retrieved. Doing this improves performance.
Table 5. Worksheet for creating an event group Event Group Definition Event Group:_______________________________________ Filter Name Event Classes Severity Status Sources Origins Sub-Origins
Planning for event group roles

When you assign an event group to an event console, you also assign Tivoli Enterprise Console event group roles to the event console. Assigning an operator to the event console gives that operator the Tivoli Enterprise Console event group roles associated with that event console. The access control list (acl) attribute of each event defines the Tivoli Enterprise Console event group roles that are required to acknowledge and close an event. The acl attribute can have a value of super, senior, admin, or user, or any combination of these. The default value for the acl attribute is admin. If an event is configured to be part of two different event groups and you assign both event groups to the same event console with different event group roles, it is possible that an operator can acknowledge and close the event in one event group and only view the same event in another event group. Assume that you have defined the event Su_Failure, which has an acl value of admin, to be part of both the Network and the System event groups. You have assigned the Network event group to an event console with an event group role of admin, and you have assigned the System event group to the same event console with an event group role of user. The operator can acknowledge and close the Su_Failure event in the Network event group, but the operator can only view the Su_Failure event in System event group. Use a worksheet similar to the following to correlate each event group with the event console and event group roles to which the event group is assigned.
Table 6. Worksheet for correlating an event group with an event console and event group roles Event Group Roles Event Group:_______________________________________ Event console Event group roles
21
Table 6. Worksheet for correlating an event group with an event console and event group roles (continued) Event Group Roles Event Group:_______________________________________
Configuring event adapters

Event adapters send events to the event server through the Tivoli Management Framework or through standard TCP/IP communication. If you anticipate that an event adapter will produce events at a relatively high rate, or if it is critical that events be delivered to the event server as quickly as possible, you should use a connection-oriented event delivery method. If you anticipate that an event adapter will produce events at a relatively low rate, and it is not critical that events be delivered to the event server as quickly as possible, you can avoid the system overhead of maintaining a connection between the event adapter and the event server at all times by using a connectionless event delivery method. If you use this method, a connection is established when an event occurs, the event is sent to the event server, and the connection is ended. Third-party vendors can also provide event adapters. For information about installing and configuring event adapters, refer to the IBM Tivoli Enterprise Console Adapters Guide.
Configuring the Tivoli Enterprise Console gateway

If you are using endpoint adapters, you must install and configure the Tivoli Enterprise Console gateway. You can also use the Tivoli Enterprise Console gateway if you want to consolidate events at a single point and control the number of events sent across your network or if you have geographically dispersed sites and want to consolidate events locally before events are sent to a central server. For more information, see Chapter 5, Tivoli Enterprise Console gateway, on page 67.
Configuring the event server

After you configure the event adapters, you need to configure the components of the event server. If you add a new event adapter to your system, you might need to configure the event server. For example, you might need to update an event source list or add a BAROC file to the rule base. You can configure the following components of the event server: v Event source (source list) v Event server and logging options v Rule bases
22
Updating the source list

The name you use for an event adapter in the source list must be the same as the source name defined in the event adapter. The source name of an event adapter is identified in the documentation for the event adapter. The source name for an event adapter is unique to that adapter.
Creating a source item

When the event server is installed, sources are defined for all adapters that the Tivoli Enterprise Console product provides. If you add an event adapter, you must create a source for the adapter. The following table lists the context and authorization role required to perform this task.
Activity Create a source Context Event server Required Role senior
To create a source for an adapter type, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources to display the TEC Source List dialog box. 2. Type the source name in the Name text box. This name must match the source name used for the events that are produced by the event adapter. For more information about event adapters, refer to the IBM Tivoli Enterprise Console Adapters Guide. The following list describes the source that corresponds to each event adapter: Source AS400_ALERT AS400_MSGQ HPOV LOGFILE NT NV390ALT NV390MSG NV6K Adapter AS/400 alert AS/400 message HP OpenView UNIX logfile Windows NT and Windows event log adapters NetView/390 alert NetView/390 message Tivoli NetView adapter
SNMP Simple Network Management Protocol 3. Type a description of the source in the Label text box. 4. Click Add Source to add the source item to the Sources scrolling list. 5. Click Save & Close. For information about using a command to create a source item, refer to the wcrtsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
Changing a source item

You can change a source item to change the icon or label for the source. Do not change the source name unless you entered a source name that is not valid when you created the source. The following table lists the context and authorization role required to perform this task.
23
Activity Edit a source
Context Configuration view in the Java version of the event console
Required Role senior
To change a source item, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources to display the TEC Source List dialog box. 2. Select the source item to edit from the Sources scrolling list and click Edit. 3. Modify the Name and Label text box as appropriate. 4. Click Replace Source to make your changes. 5. Click Save & Close. For information about using a command to edit a source item, refer to the wsetsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
Deleting a source item

Delete a source item when the source item becomes obsolete, for example, when you are no longer using the event adapter or when a resource is removed from the network. Delete all events with an obsolete source from the event repository and event cache before deleting the source. The following table lists the context and authorization role required to perform this task.
Activity Delete a source Context Configuration view in the Java version of the event console Required Role senior
To delete a source item from the source list, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Sources from the context menu to display the TEC Source List dialog box. 2. Select the source item to be deleted from the Sources scrolling list and click Delete. 3. Click Save & Close. For information about using a command to delete a source item, refer to the wdelsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.
Changing the logging defaults

You can specify how the event server processes Tivoli Enterprise Console logs (the type of information to be logged and how long to retain this information). You can also change the default values of the following items: v Size of the event cache v Amount of time to keep events in the event cache v Amount of time to allow for the event server to start v Whether or not to activate rule tracing
24
The following table lists the context and authorization role required to perform this task.
Activity Configure the event server Context Event server Required Role senior
To change the default values for logging, follow these steps from the Tivoli desktop: 1. Right-click the EventServer icon and select Parameters. The Event Server Parameters dialog is displayed. 2. The Event Server Parameters dialog contains the following options: Log reception of events Determines whether events are logged and is used in conjunction with the Time to keep event reception log information option. Note: This setting is not automatically enforced and is used by the Clean_Database task in the TEC Tasks library. You can run the Clean_Database task immediately or you can schedule the Clean_Database job to run the task later. Maximum number of event messages buffered in memory Specifies the maximum number of incoming events to store in the memory of the tec_reception process while the server processes an existing event. The default value is 500 events. Event cache size Specifies the maximum number of events to keep in the event cache for rule evaluation. The rule engine uses the events in the event cache for correlation. The default value is 1000 events. Time to keep closed events in cache Specifies the amount of time, in hours, to keep a closed event in the event cache. The default value is 24 hours. Time to keep event reception log information Specifies the amount of time, in hours, to keep logged events. The default value is 24 hours. This option is available when the Log reception of events option is activated. Time to keep non-closed events Specifies the amount of time, in days, to keep an event that is in the OPEN or ACK state in the event cache. The default value is 180 days. Time allowed for server initialization Specifies the amount of time, in seconds, to allow the event server to synchronize its processes. If the server cannot synchronize its processes within the specified time, the server generates an error message and shuts down. The default value is 300 seconds. Trace Rules Determines whether rules are traced and is used in conjunction with the Rule Trace File text box. To trace rules, the rules must be compiled with the tracing option activated. See the IBM Tivoli Enterprise Console Rule Developers Guide for more information about rule tracing. Rule Trace File Specifies the path name for the trace file. The default file name is /tmp/rules.trace.
25
3. Click Save & Close. Stop and restart the event server to incorporate the changes. For information about using commands to change the logging defaults, refer to the wsetesvrcfg and the wlsesvrcfg commands in the IBM Tivoli Enterprise Console Command and Task Reference.
Managing rule bases

You can perform the following rule base operations: v List all known rule bases v List the rule base currently being used by the event server v List all the rule sets that are contained in a specified rule base v v v v v v v Change the properties of a rule base Create a new rule base Copy a rule base Delete a rule base Add a rule set to a rule base Add class definitions to a rule base Compile a rule base
v Load a rule base For information about performing rule base operations, refer to the IBM Tivoli Enterprise Console Rule Developers Guide and the wrb command in the IBM Tivoli Enterprise Console Command and Task Reference.
Creating an event console

The following table lists the context and Tivoli authorization role required to perform this task:
Activity Create an event console Context Configuration view in the Java version of the event console Required Role senior
For information about creating an event console from the Java version of the event console, refer to the online help. For information about using a command to create an event console, refer to the wconsole command in the IBM Tivoli Enterprise Console Command and Task Reference. If you are creating event consoles for multiple administrators, you can copy an existing event console. To do this, use the c option of the wconsole command.
Configuring an event console

This section describes the configuration tasks to perform if you are not using the predefined event groups and the predefined event consoles. It also describes some optional configuration tasks, such as configuring custom buttons for an event console. You can configure an event console only from the Java version of the event console. The Java version and the Web version of the event console use the same configuration settings.
26
This section describes the following topics: v Creating and changing an event group v Assigning an event group to an event console on page 28 v Creating an operator on page 29 v Assigning an operator to an event console on page 29 v v v v Integrating your trouble ticket system with the trouble ticket rules on page 29 Customizing an event console on page 33 Configuring custom buttons for an event console on page 33 Exporting and importing event console definitions on page 38
Creating and changing an event group

This section describes how to create, modify, and delete an event group.
Creating an event group

To create an event group, you specify the event filters that define the events that are to be included in the event group. After you create an event group, assign the event group to one or more event consoles and then assign an operator to each event console. The following table lists the context and authorization role required to perform this task.
Activity Create an event group Context Configuration view in the Java version of the event console Required Role senior
For information about creating event groups, event group filters, and event group filter constraints, refer to the following entries in the online help. v Creating an Event Group v Creating an Event Group Filter v Creating an Event Group Filter Constraint v Creating an Event Group Filter Constraint with SQL
Editing event group properties

When you edit event group properties, you can change the name or description of the event group. The following table lists the context and authorization role required to perform this task.
Activity Edit event group properties Context Configuration view in the Java version of the event console Required Role senior
For information about editing event groups properties, see Editing Event Group Properties in the online help.
Editing an event group filter

You might need to edit an event group filter when users, hosts, and applications are added to or removed from the network.
27
Activity Editing an event group filter Context Configuration view in the Java version of the event console Required Role senior
For information about editing an event group filter, refer to the Editing Event Group Filter Properties entry in the online help.
Deleting an event group

Delete obsolete event groups to help conserve system resources. When you delete an event group, filters associated with that event group are also deleted. The following table lists the context and authorization role required to perform this task.
Activity Delete an event group Context Configuration view in the Java version of the event console Required Role senior
For information about deleting event groups, see the Deleting an Event Group entry in the online help.
Deleting event group filters

Filters can be deleted as system resources change. Deleting a filter can change the events displayed on event consoles. The following table lists the context and authorization role required to perform this task.
Activity Delete a filter Context Configuration view in the Java version of the event console Required Role senior
For information about deleting event group filters, see the Deleting an Event Group Filter entry in the online help.
Assigning an event group to an event console

After you have created an event console, assign one or more event groups to the event console. When you assign an event group to an event console, you also assign the appropriate event group roles to the event console. Assigning an operator to an event console gives that operator the event group roles associated with that event console. For more information about event group roles, see Planning for event group roles on page 21. The following table lists the context and authorization role required to perform this task.
28
Activity Assign an event group
Context Configuration view in the Java version of the event console
Required Role senior
For more information about using and configuring event consoles, refer to the online help.
Creating an operator
Activity Create an operator Context Configuration view in the Java version of the event console Required Role senior
For information about how to create an operator for an event console, refer to the online help.
Assigning an operator to an event console

Before you can assign an operator to an event console, the operator must be defined as a Tivoli administrator and have the appropriate Tivoli authorization roles. For information about defining an administrator, refer to the Tivoli Management Framework Users Guide. For information about the authorization roles that the Tivoli Enterprise Console product requires, see Required Tivoli authorization roles on page 13. The following table lists the context and authorization role required to perform this task.
Activity Assign an operator to an event console Context Configuration view in the Java version of the event console Required Role senior
For information about how to assign an operator to an event console, refer to the online help.
Integrating your trouble ticket system with the trouble ticket rules
To help you manage problems more efficiently, you can integrate your trouble ticket system, such as Peregrine Systems Service Center, with the Tivoli Enterprise Console product. To integrate your trouble ticket system, the Tivoli Enterprise Console product provides the following items: v Trouble ticket rules, which are defined in the troubleticket.rls file The trouble ticket rules automatically open, update, or close a trouble ticket in response to an event that meets the criteria you specify. The trouble ticket rules also provide the function to associate an existing trouble ticket with the event for which the trouble ticket was opened. The troubleticket.rls file is located in the default rule base in the TEC_RULES subdirectory.
29
v A sample script, TroubleTicket.sh The TroubleTicket.sh script simulates the interface to a trouble ticket system. The TroubleTicket.sh script is located in the Install_dir/bin/interp/TME/TEC directory on the event server. As provided, when an event is received that matches the event criteria, the TroubleTicket.sh script writes the event information in a text file in the /tmp directory named tteventID.log where eventID is the ID of the event. The TroubleTicket.sh script updates the tteventID.log file with status and severity changes for the event and with information about associated events. The TroubleTicket.sh script also provides the function to perform these actions: Associate an existing trouble ticket ID to an event Reflect changes made in a trouble ticket in the associated event To integrate your trouble ticket system with the Tivoli Enterprise Console product, complete the following procedures: 1. Customize the trouble ticket rules to automatically respond to events as described in Customizing the trouble ticket rules. 2. Optionally, customize the TroubleTicket.sh script to add the script that invokes your trouble ticket system so that it automatically opens, updates, and closes a trouble ticket in response to an event that meets your criteria. 3. Optionally, enable your trouble ticket system to update events when an action has been performed on a trouble ticket. Note: Your trouble ticket system must be installed and operational. For information about installing your trouble ticket system, refer to the appropriate documentation for your trouble ticket system.
Customizing the trouble ticket rules

To customize the trouble ticket rules to act on events that meet the criteria you specify, follow these steps: 1. Load the troubleticket.baroc file, which is located in the default rule base in the TEC_CLASSES subdirectory. The troubleticket.baroc file defines the TT_OPEN_EVENT, the TT_UPDATE_EVENT and the TT_CLOSE_EVENT classes, which the Tivoli Enterprise Console product uses to respectively associate, update, and close events for existing trouble tickets. 2. Modify the troubleticket.rls file to meet your needs. In particular, you might want to edit the event criteria that cause the rules to automatically open a trouble ticket in response to an event. Edit the troubleticket.rls file as follows: a. Change any of the following parameters as appropriate: _tt_admin Specifies the administrator name to use when automatically acknowledging or closing events. The default value is troubleticket.rls. _tt_err_log Specifies the name of the log file. The default log file is /tmp/troubleticket.err. _assoc_flag Specifies whether or not multiple events can be associated with the same trouble ticket. The default value is ON, which associates multiple events with the same trouble ticket. To create a trouble ticket for each event that matches the specified criteria, set this value to OFF.
30
_kbase_file Specifies the name of the file used to store trouble ticket facts in the knowledge base. The default file name is $DBDIR/troubleticket.pro. _tt_elapsed Specifies the amount of time (in seconds) to search backward or forward in the event cache for an associated event. The default value is 604 800 (one week). b. Specify the event criteria for which to open a trouble ticket automatically in the configure_knowledge_base action of the tt_configure rule. The event criteria includes the event class, severity, and the fully qualified host name in the event. To match all possible values for the event class, the severity, or the host name, use an underscore character ( _ ). Here are some examples.
This event criteria assert_tt(_, _, _) assert_tt(_, CRITICAL, _) assert_tt(_, CRITICAL, myhost.raleigh.ibm.com) Opens a trouble ticket for All events All critical events All critical events from myhost.raleigh.ibm.com
As provided, the troubleticket.rls file defines the following event criteria:

assert_tt(TEC_Error, FATAL, _)
This event criteria causes the trouble ticket rules to open a trouble ticket for all fatal TEC_Error events from any host. For more information about the trouble ticket rules and rule language predicates, refer to the IBM Tivoli Enterprise Console Rule Set Reference. 3. Activate, compile, and load the troubleticket.rls file.
Automatically opening, updating, and closing a trouble ticket

The following table describes how the trouble ticket rules and the TroubleTicket.sh script automatically open, update, and close a trouble ticket in response to an event. This example assumes that you have customized the trouble ticket rules as described in Customizing the trouble ticket rules on page 30.
31
Condition
Action
A new event is received that matches A rule checks the value of the _assoc_flag parameter in the TroubleTicket.sh the specified criteria. script and performs one of these actions: v If the value of the _assoc_flag is ON (the default value), the rule searches the event cache for a similar event (one with the same event class, severity, and host name) that has a trouble ticket ID in the ttid event slot. If such an event is found in the event cache, the TroubleTicket.sh script associates the new event with the existing trouble ticket for the cached event. The TroubleTicket.sh script sends the trouble ticket ID for the cached event to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script updates the /tmp/tteventID.log file with information about the associated event. If a similar event is not found in the event cache, the TroubleTicket.sh sends a new trouble ticket ID to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script writes all the event slots of the event in the /tmp/tteventID.log file and includes a message indicating that a trouble ticket should be opened for this event. v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script sends a new trouble ticket ID to the event server, and the event server updates the ttid event slot in the new event with the trouble ticket ID. The TroubleTicket.sh script writes all the event slots of the event in the /tmp/tteventID.log file and includes a message indicating that a trouble ticket should be opened for the event. The status of an event associated with a trouble ticket has been changed to any value other than CLOSED. An event associated with a trouble ticket has been closed. The TroubleTicket.sh script updates the /tmp/tteventID.log file with information describing the change made to the event.
A rule checks the value of the _assoc_flag parameter in the TroubleTicket.sh script and performs one of these actions: v If the value of the _assoc_flag is ON (the default value), the rule searches for an event in the event cache that has the same trouble ticket ID in the ttid event slot and is not closed. If an associated event is found, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the event has been closed, but the trouble ticket is still open. If an associated event is not found, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the original event for the trouble ticket has been resolved and closed. v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script updates the /tmp/tteventID.log file with a message indicating that the original event for the trouble ticket has been resolved and closed.
Enabling your trouble ticket system to update events

You can enable your trouble ticket system to update events based on an action that is performed on a trouble ticket. To do this, run the TroubleTicket.sh script, which is located in Install_dir/bin/interp/TME/TEC directory on the event server. The TroubleTicket.sh script uses the following parameters: fully_qualified_hostname Name of the host on which the trouble ticket system is running. ttid Trouble ticket ID.
event_handle Value in the event_handle event slot of the event you want to update. date_reception Value in the date_reception event slot of the event you want to update.
32
server_handle Value in the server_handle event slot of the event you want to update. slotvector Comma separated list of the name=value pairs for the event slots that you want to change. Each name=value pair must be enclosed in single quotation marks as follows:
severity=HARMLESS,source=source1
v To update the ttid event slot of an event when a new trouble ticket has been opened, run the following command from a script or the command line:
TroubleTicket.sh ASSOCIATE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle
v To update one or more event slots of an event (such as, the severity or status of the event) when an action is performed on a trouble ticket, run the following command from a script or the command line:
TroubleTicket.sh UPDATE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle slotvector
v To close an event when a trouble ticket has been closed, run the following command from a script or the command line:
TroubleTicket.sh CLOSE_TEC_EVENT fully_qualified_hostname ttid \ event_handle date_reception server_handle
Customizing an event console

You can customize many preference settings for event consoles. Both the Java version and the Web version of the event console use these preference settings. For example, you can change the severity color for events, and you can customize the fields you want to display in the event viewer. The event viewer shows the Event Type, Status, Class, Severity, Hostname, Message, and Time Received fields. You can customize the event viewer by adding or deleting one or more fields. The event console preferences are stored centrally in the event database. The following table lists the context and authorization role required to perform this task.
Activity Customize an event console Context Editing event console properties in the Java version of the event console Required Role senior
Some event console preferences pertain to only the Java version of the event console. For example, you can configure event console appearance properties to display raw values or percentages in the tool tips in either the Summary Chart view or the Priority view of the Java version of the Web console. You can also customize the Java version of the event console to initialize with the event viewer for a specific event group using the tec_console command. For more information about the tec_console command, refer to the IBM Tivoli Enterprise Console Command and Task Reference. For more information about customizing an event console, refer to the online help.
Configuring custom buttons for an event console

You can configure up to three custom buttons for the Java version and the Web version of the event console. An operator can then select an event in the event viewer and click the custom button to perform a user-defined action. You can
33
configure a button in the Java version of the event console to run a script or local command on the selected event. You can configure a button in the Web version of the event console to open a URL in the context of the selected event and run a Web application. To configure a custom button, you create the button and you associate an action with the button. Use the Console Properties dialog from the Java version of the event console to create, modify, or delete custom buttons for an event console. To display new custom buttons in an event viewer that is already open, you must close and restart the event console. The following table lists the context and authorization role required to perform this task.
Activity Create, modify, or remove custom buttons for event consoles Context Editing event console properties in the Java version of the event console Required Role senior
For more information about configuring custom buttons, refer to the online help.
Associating an action with a custom button in the Java version of the event console
The following sections include examples of command scripts that start a Java application from a custom button in the event viewer. When an operator selects an event and then selects a custom button in the Java version of the event console, the attributes of the selected event are passed to the script as environment variables. The SLOTS environment variable contains a string array with all event attributes exported by the event console, as shown in the following example.
SLOTS=num_actions hostname server_path adapter_host source cause_event severity status
Each of the event attributes in the string array are also environment variables and can be used individually in a custom script. For a complete list of event attributes available to the SLOTS environment variable, refer to the IBM Tivoli Enterprise Console Command and Task Reference. Note: If environment variables were specified to create custom buttons in a prior release, the environment variables are ignored when creating custom buttons as console properties. Custom buttons created as console properties always supersede those created by using environment variables in prior product versions. Example command script for running a Java application in a Windows environment: To run a CMD or a BAT file from a custom button in the event viewer in a Windows environment, you must first specify the @echo off tag as the first line of your command script, as shown in the following example. The following example runs a Java application in a Windows environment using the SLOTS environment variable as the argument:
@ECHO off @REM Sample script to use as a Custom Button @REM This script checks information about the selected Event and logs @REM it into a temp file. SET TMP_FILE=C:\TEMP\CustomButtonSample.txt
34
@REM SLOTS contains all slots defined in the Event @REM if SLOTS is not defined then NO Event has been @REM selected in the Event Viewer IF "%SLOTS%" == "" GOTO NeedEvent @REM Initialize new log SET EVENT_ID=%event_hndl%:%server_hndl%:%date_reception% ECHO Start log for event %EVENT_ID% >> %TMP_FILE% ECHO Slots of the selected event: ECHO %SLOTS% >> %TMP_FILE% >> %TMP_FILE%
@REM Use class, status and severity to determine which action to @REM take against the Event selected IF "%class%" == "TEC_Start" ECHO TEC Server has been started. >> %TMP_FILE% IF "%class%" == "TEC_Stop" ECHO TEC Server has been stopped. >> %TMP_FILE% IF "%severity%" == "FATAL" ECHO Severity is FATAL: immediate action required. / >> %TMP_FILE% IF "%status%" == "OPEN" ECHO Status is OPEN: no operator is responsible / for this event. >> %TMP_FILE% @REM Finalize log ECHO Stop log for event %EVENT_ID% >> %TMP_FILE% GOTO EndScript :NeedEvent ECHO No event has been selected. >> %TMP_FILE% :EndScript @ECHO on
Example script for running a Java application in a UNIX or Linux environment: To run a shell script from a custom button in the event viewer within a UNIX or Linux environment, you must first specify the shell program before the script. If the custom button script starts a graphical application, such as a Java GUI, you must specify the export DISPLAY environment variable in your script, as shown in the following example.
#!/bin/sh export DISPLAY=:0.0 /usr/jdk/bin/java MyCustomButton $(SLOTS)
The following example starts a Java application in a UNIX environment using the SLOTS environment variable as the argument:
#!/bin/sh # # # # Sample script to use as a Custom Button This script checks some information about the selected Event and logs it into a temp file.
TMP_FILE=/tmp/CustomButtonSample.txt # SLOTS contains all slots defined in the Event # if SLOTS is not defined then NO Event has been # selected in the Event Viewer if [ "${SLOTS}" = "" ] then echo "You must select an event to run this script!"
35
exit 1 fi # Initialize new log EVENT_ID=${event_hndl}:${server_hndl}:${date_reception} echo "Start log for event ${EVENT_ID}" >> ${TMP_FILE} # Print all slots values # slot=value echo "Slots of the selected event: " >> ${TMP_FILE} for i in ${SLOTS} do value=`env | grep $i | grep -v SLOTS | cut -f2 -d=` echo "$i = $value" >> $TMP_FILE done # Use class, status and severity to determine # which action to take against the Event selected if [ "${class}" = "TEC_Start" ] then echo "TEC Server has been started." >> ${TMP_FILE} fi if [ "${class}" = "TEC_Stop" ] then echo "TEC Server has been stopped." >> ${TMP_FILE} fi if [ "${severity}" = "FATAL" ] then echo "Severity is FATAL: immediate action required." >> ${TMP_FILE} fi if [ "${status}" = "OPEN" ] then echo "Status is OPEN: no operator is responsible for this event." >> ${TMP_FILE} fi # Finalize log echo "Stop log for event ${EVENT_ID}" >> ${TMP_FILE} echo " " >> ${TMP_FILE}
Associating an action with a custom button in the Web version of the event console
When an operator selects an event and then selects a custom button in the Web version of the event console, the attributes of the selected event are passed to the URL that you defined when you created the custom button. The following example is a sample servlet that can be associated with a custom button.
package test.launch; import import import import import import import import import java.io.IOException; java.io.Writer; java.util.Enumeration; java.util.Iterator; java.util.Map; javax.servlet.ServletException; javax.servlet.http.HttpServlet; javax.servlet.http.HttpServletRequest; javax.servlet.http.HttpServletResponse;
/** *<code>SampleLaunchIntoAppServlet</code> services HTTP requests from event console. * It does not have a mapping in the web.xml for the event console web application.
36
* The purpose of this servlet is to demonstrate the initialization of * different parts of an application when the event console custom buttons * are configured. * * */ public class SampleLaunchIntoAppServlet extends HttpServlet { public static final String CLASSNAME = SampleLaunchIntoAppServlet.class.getName(); /**************************************************************************** * Implements HttpServlet.doPost() * * Launch the task specified by the pathInfo of the URI. * * @param request The HTTP request * @param response The HTTP response * ****************************************************************************/ public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // trace entry doGet(request, response); // trace exit } /**************************************************************************** * Implements HttpServlet.doGet() * * Launch the task specified by the pathInfo of the URI. * * @param request The HTTP request * @param response The HTTP response * ****************************************************************************/ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // trace entry // expire all responses immediately so that no pages get cached ConsoleUtilities.setNoCachingHeaders(response); // lets read some request parms! Map parmMap = request.getParameterMap(); StringBuffer content = new StringBuffer("Event Context Information"); content.append("\nRequest Parameter Map:\n"); String key = null; String[] val = new String[1]; for (Iterator i=parmMap.keySet().iterator(); i.hasNext(); ) { content.append(""); key = (String)i.next(); content.append(key); content.append(": "); System.arraycopy(parmMap.get(key), 0, val, 0, 1); content.append(val[0]); } response.setContentType("text/html"); //$NON-NLS-1$ Writer respOut = response.getWriter(); // write some basic html here respOut.write("<HTML><HEAD><TITLE>A sample web app launched from a web custom button in context of an event</TITLE></HEAD><BODY>"); respOut.write(content.toString()); respOut.write("</BODY></HTML>");
37
respOut.close(); // trace exit } }
Exporting and importing event console definitions

Exporting and importing console definitions is an efficient way to create backups and a base set of event consoles in one Tivoli region and import them into other Tivoli regions for implementation or additional configuration. Therefore, you can use the event console definitions in one Tivoli region as a single point of control for console configuration in an environment with multiple Tivoli regions. To do this, you export the definitions of event groups, event consoles, and operators to a file and then import the definitions to a different installation of the Tivoli Enterprise Console product in another Tivoli region. After you import the definitions, all Tivoli administrators have the same configuration view of object definitions for event consoles in a Tivoli region.
Exporting and importing definitions from the Tivoli desktop

The following table lists the context and authorization role required to export and import definitions from the Tivoli desktop.
Activity Exporting and Importing Context Java version of the event console Required Role senior
For more information about exporting and importing event console definitions, see the Exporting a Console and Importing a Console entries in the online help.
Exporting and importing definitions from the command line

For information about using the command line to export and import event console definitions, refer to the wtecexport and the wtecimport commands in the IBM Tivoli Enterprise Console Command and Task Reference.
Managing Tivoli region definitions for the Web version of the event console
When the Tivoli Enterprise Console product is installed, an administrator can configure the Tivoli region definitions for the Web version of the event console within the IBM WebSphere Application Server product. These definitions specify the following items: v Managed nodes to which an operator can connect when logging on to the Web version of the event console v User ID and password used to access the RIM database v Cache timeout values for the event console A Tivoli region is represented in the IBM WebSphere Application Server product by an authentication alias, a data source, and a connection factory as follows: v The authentication alias is used to encode and store the user name and password, which the data source uses to access the RIM database. v The data source represents the connection to the event database. Event data, console definitions, and operator preferences are stored in the event database. v The connection factory performs the following functions:
38
Interfaces with the Tivoli Management Framework to authenticate operators and validate that they are authorized to use the event console Interfaces with the Tivoli Management Framework to obtain task information, start tasks, and obtain task results Interfaces with the UI server to update events and receive notifications for operators Caches event and summary information after the information is retrieved from the event database You might need to add or change the Tivoli region definitions after installation for the following reasons: v If you add a Tivoli region after installation v If the host name of the Tivoli server has changed v If you want to change the user ID and password that is used to access the RIM database v If you want to change the cache timeout values for the event console v If you delete a Tivoli region after installation The procedure in this section describes the information that is relevant to the Tivoli Enterprise Console product. For specific information about the IBM WebSphere Application Server product, refer to the online help in the WebSphere Application Server Administrative console and the IBM WebSphere Application Server product documentation, which you can access from the WebSphere InfoCenter at the following Web site: http://www-3.ibm.com/software/webservers/appserv/library/index.html To add, change, or delete a Tivoli region definition, follow this general procedure: 1. From the WebSphere Application Server Administrative Console, navigate to Security > JAAS Configuration > J2C Authentication Data to create or change the alias using the following information. Name Type the name of the alias in the following format:
TEC_region_host_name_DS_ALIAS
User ID Type the user ID to access the RIM database. Password Type the password for the specified user ID. Note: If you are deleting a Tivoli region definition, select the name of the appropriate alias and click Delete. 2. Navigate to the Resources > JDBC providers. Select Server and then select the JDBC provider for the Tivoli Enterprise Console product, TEC 3.9.0 RIM JDBC Provider. 3. Click Data Sources. Note: If you are deleting a Tivoli region definition, select the name of the appropriate data source, and click Delete. 4. If you want to change the host name or port number of the Tivoli server, go to step 5 on page 40. If you want to create a Tivoli region definition, create a data source using the following information: Name Type the name of the data source in the following format:
39
TEC_region_host_name_DS
Where region_host_name is the fully qualified host name of the Tivoli server. JNDI Name Type jdbc/TEC_region_host_name_DS. Datasource Helper Classname Type com.tivoli.tec.rimds.RIMDataStoreHelper. Component-managed Authentication Alias Select the name of the alias you created in Step 1 on page 39 from the drop-down list. Note: Do not create a container-managed authentication alias. 5. Select the name of the data source and click Custom Properties. Add or change two custom properties, one for the server name and one for the port number. v To add a custom property for the server name, use the following information: Name Type serverName. Value Type the host name of the Tivoli server. Type Select java.lang.String from the drop-down list. v Add the property for the port number with the following information: Name Type portNumber. Value Type the port number for the Tivoli server. The default port number is 94. Type Select java.lang.String from the drop-down list. 6. Optionally, change the connection pool properties. To do this, select the name of the data source and click Connection Pool. 7. Navigate to Resources > Resource Adapters. Select Node and then select the resource adapter for the Tivoli Enterprise Console product, TEC 3.9.0 Resource Adapter. 8. Click J2C Connection Factories. Note: If you are deleting a Tivoli region definition, select the name of the appropriate connection factory and click Delete. 9. If you want to change the cache timeout values, go to step 10 on page 41. If you are creating a Tivoli region definition, define one connection factory for the Tivoli region using the following information: Name Type the name of the connection factory in the following format:
TEC_region_host_name_CF
Where region_host_name is the host name of the Tivoli server. JNDI Name Type the following string:
eis/tec3_9/TEC_region_host_name_CF
Note: Do not define any authentication aliases.
40
10. Select the name of the connection factory and optionally change the custom properties. You can also optionally change the connection pool properties. You can change any of the following custom properties: eventDataCacheTimeout Specifies the amount of time (in seconds) to cache event data from the event database. Note: Setting the eventDataCacheTimeout value to less than 60 seconds can impact performance. eventSummaryCacheTimeout Specifies the amount of time (in seconds) to cache event summary data. managedNodeList Specifies a list of host names, each host name separated by a space, to which an operator can connect when logging on to the event console. This parameter is required. rimDataSourceName Type the JNDI name of the data source:
jdbc/TEC_region_host_name_DS
This parameter is required. taskCacheTimeout Specifies the amount of time (in minutes) to cache task information from the Tivoli Management Framework. 11. Click Save on the taskbar. 12. Stop and restart the WebSphere Application Server for the changes to take effect.
Tuning the performance of the Web version of the event console

For optimal performance of the Web version of the event console, consider the following recommendations: v Consider the number of open and active event groups that are available to operators using the Web version of the event console. As the number of active and open event groups increases and the event database grows, you might need to adjust the frequency at which event views are refreshed or the rate at which outdated events are deleted from the event database. v Ensure that the maximum number of connections for the J2C connection pool is greater than the number of users logged in to the Web version of the event console at a given time. By default, the maximum number of connections for the J2C connections pool is 50. To change the maximum number of connections for the J2C connection pool, follow these steps from the WebSphere Application Server Administrative Console: 1. Navigate to Resources > Resource Adapters. 2. Select Node and then select the resource adapter for the Tivoli Enterprise Console product, TEC 3.9.0 Resource Adapter. 3. Click J2C Connection Factories in the Additional Properties section. 4. Select the appropriate connection factory and click Connection Pool in the Additional Properties section.
41
5. Type the appropriate value in the Max connections field and click OK. 6. Save and confirm your changes. 7. Stop and restart the IBM WebSphere Application Server to incorporate the changes.
Backing up and tuning the event database

To ensure optimal performance of the Tivoli Enterprise Console product, back up and tune your event database on a regular basis. For detailed information about backing up and tuning your database, refer to the appropriate RDBMS database documentation. Also, perform the following tasks on a regular basis: v Clear unneeded data from the event database. To do this, use the wtdbclear command. For information about the wtdbclear command, refer to the IBM Tivoli Enterprise Console Command and Task Reference. v Update database statistics and reorganize tables and indexes to eliminate fragmentation. To do this, use the wdbmaint.sh command. For information about the wdbmaint.sh command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Stopping and starting the event server

Some configuration tasks require that you stop and restart the event server. The following table lists the context and authorization role required to perform this task.
Activity Stop or start the event server Context Tivoli desktop Required Role senior
To stop the event server, right-click the Event Server icon on the Tivoli desktop and select Shut Down. To start the event server, right-click the Event Server icon on the Tivoli desktop and select Start-up. You can also stop and restart the event server manually using the wstopesvr and the wstartesvr commands, respectively. For more information about the wstopesvr and wstartesvr commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference. If an event server goes down, the UI server reconnects automatically when the server comes back up. It is not necessary to shut down the UI server or an event console to establish communication with the event server.
42
Chapter 3. Sample IT environment with configuration examples

This chapter provides examples that are based on the IT environment in the Acme Company, a fictitious company, and the key personnel in the Acme Company who are responsible for ensuring the optimal availability of the IT resources in the Acme Company. The examples illustrate how you can use the preconfigured features of the Tivoli Enterprise Console product to begin managing your environment quickly, efficiently, and effectively. The examples also illustrate how you can extend the management capabilities that the Tivoli Enterprise Console product provides.
Sample IT environment
This sample customer scenario assumes that the Acme Company has its main office in Raleigh, North Carolina, and branch offices in New York, Chicago, and Los Angeles. To support its business, the Acme Company uses the following applications: v Business applications that run on IBM WebSphere Application servers v WebSphere MQ for messaging services among the business applications v DB2 product for data storage The business applications are distributed among the branch offices with the core parts of the applications installed in the main office in Raleigh. The IP addresses for hosts in the main office range from 9.27.1 to 9.27.9. The IP addresses for hosts in the branch offices begin with 9.27.10 (for New York), 9.27.11 (for Chicago), and 9.27.12 (for Los Angeles). The Acme Company has the following departments in its main office in Raleigh, North Carolina. Data entry Consists of seven people who primarily enter data into the business applications. The data is stored in a DB2 database that is running on an AIX system in the main office. Marketing Consists of five people who plan and implement sales strategies. Marketing personnel use the business applications to gather and analyze data. The analytical data is stored in a DB2 warehouse that is running on an AIX system in the main office. Trading Consists of ten people who buy and sell securities. Trading personnel use the business applications, including Web-based applications, to perform their jobs. Information technology Consists of six people who maintain the computer systems and the network. IT personnel use the Tivoli Enterprise Console product and other Tivoli products to manage and ensure the optimal availability of the IT resources.
43
The following people are the system administrators and operators in the Acme Company. v Mary is the Database Manager. Mary is responsible for resolving database-related problems. v Susan and George are Network Managers. Susan and George are responsible for installing, configuring, and maintaining a heterogeneous network. Susan is the root user and has the administrator role. v Jim is the System Manager. Jim is responsible for maintaining and configuring the workstations, printers, and mail systems. v Carla is a System Manager. Carla is responsible for installing, configuring and maintaining the business application infrastructure, consisting of IBM WebSphere Application servers and WebSphere MQ messaging servers. v Mark is the Help Desk Manager. Mark primarily answers questions about applications that the Acme Company uses. Mark receives notification of all events so that he can be informed of the types of problems that users might encounter. All system administrators and operators are located in the main office in Raleigh and are responsible for maintaining the availability of the business applications and the infrastructure that supports the applications without impacting the business objectives of the company. The Acme Company relies on the Tivoli Enterprise Console product to maintain availability of its IT resources because the Tivoli Enterprise Console product unifies system and network management and provides optimized event management for the following key e-business applications: v WebSphere MQ v DB2 v IBM WebSphere Application Server
Fast path to managing events

This example illustrates how Susan, the root administrator, can set up the Tivoli Enterprise Console product to manage events quickly and efficiently. Susan does not need to configure the Tivoli Enterprise Console product because she can use the predefined rule sets, event groups, and event consoles. Susan only needs to install and set up the adapters and install the rule base with the predefined rule sets to begin managing events. Susan can also associate each predefined event group to an event console and associate the appropriate operator to that area of responsibility so that operators can begin managing events immediately.
Event adapters
The main office uses the IBM Tivoli NetView component to manage its network. The local networks in the branch offices are managed with an SNMP-type adapter. A log-file adapter is installed on each individual employees computer (endpoint) on the network. The event adapters are installed on the same nodes as their respective resources. A Tivoli Management Framework gateway is created on a managed node in each location. The Tivoli Management Framework gateway is installed on Shamrock (9.27.1.6) in the Raleigh office, on Wheeler (9.27.10) in the New York City office, on Fairview (9.27.11) in the Chicago office, and on Bandera (9.27.12) in the Los Angeles office. A Tivoli Enterprise Console gateway is set up in each Tivoli Management Framework gateway to perform event correlation and filtering close
44
to the event source. Endpoints are created on each host (managed node) and individual computer (endpoint). Although a host is considered a managed node, an endpoint must be installed to run an event adapter. The Adapter Configuration Facility is used to distribute and start each adapter on endpoints in the network. This facility is installed on the Tivoli server and all managed nodes in the network. This facility must be used to distribute the adapter to each endpoint. For additional information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide.
Event server
The event server is located in the Raleigh office. It is installed on host wichita, which has an IP address of 9.27.1.5. The default event server configuration is used.
Server configuration
The default values are used for the event server as follows: Log events in reception log The default value is 84 600 seconds (24 hours). Maximum number of event messages buffered in memory The default value is 500 events. Event cache size The default value is 1 000 events. Time to keep closed events in cache The default value is 24 hours. Time to keep non-closed events The default value is 180 days. Time allowed for server initialization The default value is 300 seconds.
Event sources
The sources used correspond to the event adapters installed throughout the Acme Company as follows: v NV6K v LOGFILE v SNMP
Rule bases
Susan uses the Default rule base, which includes the following rule sets: ebusiness.rls Analyzes events related to the following key e-business services (IBM WebSphere Application Server, DB2, and WebSphere MQ) to determine whether the events are causally related to one another or to network events. To use the ebusiness.rls rule set, Susan defines the dependency relationships that apply to the e-business services and network resources and loads the relationships into the knowledge base. netview.rls Manages events from the Tivoli NetView component. The netview.rls rules correlate related Tivoli NetView events and manage the synchronization of the event server with the Tivoli NetView component. Susan also loads and activates the following rule sets:
45
maintenance_mode.rls Provides automated event processing for a monitored system that is in maintenance mode. By default, events received from a system in maintenance mode are closed. notify.rls Supports sending notification to support personnel about new or changed events. Susan configures the notify.rls rule set to send e-mail notification to Mary, the Database Manager, whenever a critical DB2 event is received.
Event groups
Susan uses the predefined event groups to monitor the e-business services and network resources. The predefined event groups are: v AllActiveEvents v EbusinessEvents v UnMonitoredEBusiness v ProbableEventAssn v Maintenance v OpenNetView v OtherNetView v ServiceUnavailable The Tivoli Enterprise Console product also provides the following predefined event consoles: AdministrativeConsole Default event console to which all predefined event groups are assigned. When the Tivoli Enterprise Console product is installed, Susan, the root administrator, is automatically assigned to the AdministrativeConsole. Because all predefined event groups are automatically assigned to the AdministrativeConsole, Susan can start managing IT resources immediately, receiving and displaying events in their related event groups for network impacts, impacts to e-business services, and so forth. EBusinessEventsConsole Event console to which the e-business event groups are assigned. Susan assigns Carla, who is responsible for maintaining the availability of the business application infrastructure, to the EBusinessEventsConsole. Susan associates the responsibilities of each operator with the predefined event groups so that the operators can monitor the resources for which they are responsible. To do this, Susan assigns one or more events groups to an event console and then assigns the appropriate operator to that event console. For example, Susan assigns the OpenNetView and the OtherNetView event groups to an event console and then assigns George, who is responsible for maintaining the availability of the network, to that event console. Susan assigns the AllActiveEvents to an event console and assigns Mark, the Help Desk Manager, to that event console.
46
Extending event management capabilities

The examples in this section illustrate how you can extend the event management capabilities that the Tivoli Enterprise Console product provides. For example, Susan can add new adapters and event sources, change event server defaults, and create new event groups.
Event adapters
To extend the event management capabilities that the Tivoli Enterprise Console provides, Susan can customize the adapters that the Tivoli Enterprise Console product provides using the Adapter Configuration Facility. For information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide. Susan can also create new adapters that are tailored to the network envrionment using the Tivoli Event Integration Facility. For information about the Tivoli Event Integration Facility, refer to the Tivoli Event Integration Facility Reference.
Event server
The default values for the event server can be changed to ensure optimal performance. The default values determine how the event server stores and processes logs and how long it should wait for event server initialization. To determine the values to use for the event server, Susan starts with an estimate of the number of events that the event server processes on a daily basis. After the event server runs for some time and Susan can determine the actual number of events that the event server processes on a daily basis, Susan adjusts the values to ensure optimal performance. Susan determines the values for the event server based on the following information: v Average number of events that the tec_reception process receives daily and stores in the reception log. To determine this information, Susan runs the following command on the event server:
wtdumper t start_time e end_time | grep END | wc
For more information about the wtdumper command, refer to the IBM Tivoli Enterprise Console Command and Task Reference. v Average number of open events that are stored daily in the event repository. To determine this information, Susan runs the following command on the event server:
wtdumper t start_time e end_time | grep "status=OPEN" | wc
v Maximum number of events that the event server can potentially store in memory. Susan must consider the peak periods in which a large number of events are sent to the event server and are queued until the event server is able to process them. The event server stores queued events in the reception log and also keeps queued events in memory. v Time period in which to keep open events for correlation. v Time period in which to keep closed events for correlation. This example assumes the following information: v The event server receives an average of 50 000 events daily. v The average number of open events that are stored daily in the event repository is 15 000. v The maximum number of queued events is 3 000. v Keep non-closed events for two days for correlation.
47
v Do not keep closed events for correlation.
Server configuration
Based on the information in this example, Susan configures the event server as follows: Log events in reception log The default value, 84 600 seconds (24 hours), is used for this example. Maximum number of event messages buffered in memory The default value, 500, is changed to 3 900. This value is based on the maximum number of queued events (3 000 in this example) plus 30% more (900) for padding. If events get in a WAITING state, the buffer is too small, and the size of the buffer should be increased. Event cache size The default value, 1 000, is changed to 39 000. This value is based on the average number of events stored daily in the event repository (15 000 in this example) multiplied by the number of days in which Susan wants events to remain in open state for correlation (2 in this example) plus 30% more (900) for padding. If the event cache size is too small, events might be deleted from the cache when new events must be stored. In this situation, a Rule Cache full: forced cleaning event is sent to the event server, and the event cache size should be increased. On the other hand, configuring the event cache to too large a value can affect performance when searching the event cache. Time to keep closed events in cache The default value, 24 hours, is changed to 1 hour. This example assumes that closed events do not need to be correlated and, therefore, do not need to be kept in the event cache. Time to keep non-closed events The default value, 180 days, is changed to 2 days. This example assumes that open events are kept for two days for correlation. Time allowed for server initialization The default value, 300 seconds, is used for this example.
Event sources
If Susan adds new adapters, she must create event sources for the new adapters in addition to the following event sources that have already been defined: v NV6K v LOGFILE v SNMP For more information, see Creating a source item on page 23.
Rule bases
Susan can create a rule set that filters events based on the event sources that correspond to the adapters that are installed in the Acme Company. For information about creating a rule set, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. For information about loading and activating a rule set, refer to the IBM Tivoli Enterprise Console Rule Set Reference.
Event groups
The following examples show how Susan, the root administrator, creates new event groups for the Acme Company. Each example contains worksheets for defining
48
possible event groups and operator roles. The examples use a subset of the attributes that you can use to specify filters. You can use any basic attribute of an event to define a filter. v v v v v All operators get all events Geographic differentiation Network topology differentiation Organizational differentiation Event-type differentiation
Susan can assign the new event groups to the predefined event consoles, or she can create new event consoles and assign the event groups to the new event consoles.
Example 1: All operators get all events

In this example, all operators are notified of all events. Susan, the root administrator, receives event notification for informational purposes.
Event Group All Events Filter None (specifying no filter means all events are received.) Constraints None
Event Console All Events All Events root All Events Read Only
Operators Mary, George, Jim, Carla Susan Mark
Event Group All Events All Events All Events
Roles admin user super senior admin user user
Example 2: Geographic differentiation

In this example, George in Raleigh resolves network problems for the branch offices in New York, Chicago, and Los Angeles. Susan receives notification because she is Georges backup. Because the origins of the remote sites cannot be expressed as a single value (the main office IP addresses are 9.27.1 to 9.27.9), three filters are created.
Event Group Sales Network Filter Subnet 9.27.10 Subnet 9.27.11 Subnet 9.27.12 Constraints Source = SNMP Origin LIKE 9.27.10.% Source = SNMP Origin LIKE 9.27.11.% Source = SNMP Origin LIKE 9.27.12.%
Event Console Sales Network root Sales Network
Operators George Susan
Event Group Sales Network Sales Network
Roles super senior admin user senior admin user
49
Example 3: System management differentiation

In this example, Jim is responsible for resolving all hardware and operating system problems not related to the network. Carla is Jims backup.
Event Group System Management Filter Monitored Sources Constraints Source IN LOGFILE, OS2, NT
Event Console System Management root System Management
Operators Jim Carla
Event Group System Management System Management
Roles super senior admin user admin user
Example 4: Organizational differentiation

In this example, Susan and George are responsible for resolving the network and system problems for the Marketing department. The members of the Marketing department use IP addresses beginning with 9.27.1.
Event Group Marketing Filter Subnet 9.27.1 Constraints Origin LIKE 9.27.1.%
Event Console Marketing
Operators Susan, George
Event Group Marketing
Roles super senior admin user
Example 5: Event-type differentiation

In this example, Susan is responsible for resolving very specific Tivoli NetView problems. George is Susans backup. The classes are defined in the BAROC file for the Tivoli NetView adapter. Three filters are required.
Event Group Tivoli NetView Faults Filter NetView Faults Constraints Class IN TEC_ITS_INTERFACE_STATUS, TEC_ITS_NODE_STATUS, TEC_ITS_SUBNET_CONNECTIVITY Source = NV6K
Event Console NetView Faults root NetView Faults
Operators Susan George
Event Group
Roles
Tivoli NetView Faults super senior admin user Tivoli NetView Faults senior admin user
50

This chapter is intended for operators. It describes how to use the event console to manage events. The Tivoli Enterprise Console product provides two versions of the event console: a Java version and a Web version. You can use the Java version or the Web version, or both, to manage events. Managing events using the Web version of the event console is very similar to managing events using the Java version of the event console. However, you need to understand the differences between the two versions of the event console. v You can run automated tasks that you configure only from the Java version of the event console. v You can start Tivoli NetView functions only from the Java version of the event console. v You can sort events based on any number of columns in the Java version of the event console. You can sort events based on up to three columns in the Web version of the event console. v Custom buttons are implemented differently in the Java version and the Web version of the event console. If your administrator has configured one or more custom buttons for the Java version of the event console, selecting an event and then clicking a custom button runs a script or a local command on the selected event. If your administrator has configured one or more custom buttons for the Web version of the event console, selecting an event and then clicking a custom button passes the attributes of the selected event to a predefined URL and runs a Web application.
Key concepts for event management

This section describes the following concepts, which are basic to managing events: v Event status v Event severity v Primary operator tasks
Event status
An event begins in the open state, and an operator can change events to other states. The possible states of an event include the following: ACK An operator has acknowledged the event and assumed responsibility for it.
CLOSED The event has been resolved. An event adapter can also send an event with a status of CLOSED to indicate that a previously received event of the specified class should have the status changed to CLOSE. The previously received event to be closed is the most recent duplicate of the same event description. The event is dropped and not stored in the event database. Do not change the status of a CLOSED event. custom_status A status that has been added to the STATUS enumeration for site-specific purposes. An administrator defines the STATUS enumeration in the root.baroc file. OPEN No action has been taken on the event.
51
RESPONSE A rule has automatically responded to the event. The RESPONSE status is assigned by a rule language predicate and is not available from an event console.
Event severity
Events are classified with different severity levels. The severity levels help you to focus on the most severe problems first. The event console uses the following indicators, listed in order of decreasing severity, to indicate the severity of an incoming event: v FATAL v CRITICAL v MINOR v WARNING v HARMLESS v UNKNOWN Custom severities can be created by adding new enumeration values to the root.baroc file.
Primary operator tasks

Whether you use the Java version or the Web version of the event console to manage events, your primary tasks are the same. To manage events, use this basic procedure: 1. Start the event console. 2. View the events in an event group. If an event is for informational purposes only, go to step 5. If you are responsible for resolving the problem associated with the event, go to the next step. 3. Acknowledge the event. You must first acknowledge an event before you can resolve the problem associated with the event. When you acknowledge an event, you let other operators know that you have taken responsibility for the event. You must have the appropriate event group role to acknowlege the event. 4. Run system management tasks on the event. A task is a script that runs other Tivoli commands. Variable values are passed to a task when you run the task. The values passed can come from input parameters and options specified or from event attributes available to the task. For tasks that need the attributes of an event available to them, you must associate the event with the task. The event console provides a set of predefined tasks in the task library named T/EC Tasks. The name, T/EC Tasks, shows in task dialogs and is used when specifying the task library from a command line. 5. Close the event. When you have completed all the activities associated with an event, you can close the event. Closing an event requires the same event console event group role as acknowledging the event. 6. Exit the event console.
52
Using the Java version of the event console

This section describes the tasks you can perform using the Java version of the event console.
Starting the event console

You can start the event console from the command line in a bash shell or you can start the event console from the Windows task bar.
Starting the event console from the command line in a bash shell
To start the event console from the command line in a bash shell, follow these steps: 1. Enter the following command from the bash shell: v From a DOS prompt or the bash shell on Windows:
tec_console.cmd
v From a UNIX shell:

tec_console
The Tivoli Management Environment dialog is displayed. 2. From the Tivoli Management Environment dialog, type the following information in the text fields: v The name and port number of your host computer in the following format:
host_computer_name:port_number
v Your Tivoli Management Framework login ID v Your Tivoli Management Framework password 3. Click OK.
Starting the event console from the Windows task bar

To start an event console from the Start menu in a Windows environment, follow these steps: Note: This option is available only when you install an event console in a non-Tivoli environment. 1. From the Windows task bar, click Start > Programs > IBM Tivoli Event Console > IBM Tivoli Enterprise Console. The Tivoli Management Environment dialog is displayed. 2. From the Tivoli Management Environment dialog, type the following information in the text fields: v The name and port number of your host computer in the following format:
host_computer_name:port_number
v Your Tivoli Management Framework login ID v Your Tivoli Management Framework password 3. Click OK. The tec_console command starts the event console. This command is located in the $BINDIR/bin directory on the managed node where the event console is installed. On a host in a non-Tivoli environment or an endpoint with the non-Tivoli version of the event console installed, the command is located in the directory where the event console was installed. For more information about the tec_console command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
53
Exiting the event console

To exit the event console, select Close from the File menu in the initial view in the event console. The initial view can be the Summary View, the Priority View, or the Configuration View.
Viewing events
The Summary Chart view is the initial view, which offers a quick view of the event activity of all event groups for an event console using stacked bar charts. Click any bar representation of an event group to display details about that event group. You can change the initial event console view to the Priority view and click on the button representing a specific event group to view events. For more information about event viewer options, refer to the online help. The event viewer displays all events for a selected event group. The top pane of the event viewer displays the Working Queue and the bottom pane displays the All Events Queue. To hide the Working Queue or the All Events Queue, expand or collapse the appropriate view using the arrow button displayed on the horizontal bar between the two views. The All Events Queue displays all events at all times. You can filter the events displayed in the Working Queue using the filter buttons on the tool bar of the event viewer. You can view an event from the event console or from the command line. To view an event from the event console, select the event and click View. For information about using the command line to list events, refer to the wlsemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and authorization role required to perform this task.
Activity View an event Context Java version of the event console Required Role user, rim_view
Acknowledging events
You must have the event viewer displayed to acknowledge an event. When you select an event group in the event viewer, all events for that event group are displayed. To acknowledge events, select one or more events from the Working Queue and click Acknowledge. For information about using the command line to acknowledge an event, refer to the wsetemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and event group role required to perform this task.
Activity Acknowledge an event Context Java version of the event console Required Role admin
Running tasks
You can configure and run tasks from task libraries using event console dialogs. You can also configure and run most tasks from the command line using the
54
wruntask command. For more information about the wruntask command, refer to the Tivoli Management Framework Reference Manual. Note: In this section, the term configure means to specify the input parameters and target hosts for the task. To configure and run a task immediately, select Task Execution from the Selected menu in the event viewer. Details about each task and how to configure and run tasks from the command line are described in the Tivoli Enterprise Console Reference and the TEC Library Tasks entries in the online help. The event console also provides the ability to run automated tasks from the event console. Automated tasks are configured ahead of time and run when a particular event is received. For example, an administrator can configure an automated task to send an e-mail message to an administrator when an event matching the criteria you defined is received by the event console. To configure automated tasks, select Automated from the Selected menu in the event viewer. From the Automated Tasks dialog, you can define or modify the following properties: v v v v Name Description When an event matches Execute these tasks
When an automated task completes, the task issues information about its success or failure and the output of the task, if any. A task-completion icon is displayed in the first column of the event viewer when an automated task completes. You can click the icon to view details about the automated task results. Automated task results can also be written to a text file, which an administrator configures in the Console Properties dialog for each console. For more information about running an automated task, refer to the Automated Task entries in the online help.
Running local commands

You can run a user-defined local command on selected events by running a user-defined script. The attributes of the event are passed to the script as environment variables. The name of the attribute environment variables can be referenced by using the non-formatted attribute name. The full list of non-formatted attribute names is contained in the SLOTS environment variable, which is passed to the script. To run a local command, follow these steps: 1. From the event viewer, select the appropriate event in the Working Queue. 2. From the Selected menu, click Local Command. 3. From the Run dialog box, browse to the location of the script that you want to run. 4. Click OK.
55
Closing events
You must have the event viewer displayed to close an event. When you select an event group in the event viewer, all events for that event group are displayed. To close events, select one or more events from the Working Queue and click Close. For information about using the command line to close an event, refer to the wsetemsg command in the IBM Tivoli Enterprise Console Command and Task Reference. The following table lists the context and authorization role required to perform this task.
Activity Close an event Context Java version of the event console Required Role admin
Starting the Tivoli NetView component

You can start a Tivoli NetView console from the event viewer in the context of an event and drill down with Tivoli NetView tools to troubleshoot a network problem. You can open the Tivoli NetView Submap Explorer, Object Properties, or Diagnosis windows to view information about a problem node and take action if necessary. To successfully use Tivoli NetView functions from the event viewer, certain prerequisite Tivoli NetView software must be installed and configured. For more information, refer to the IBM Tivoli Enterprise Console Installation Guide. To run Tivoli NetView functions, select NetView from the Selected menu in the event viewer. For information about using the Tivoli NetView functions, refer to the online help in the event console. For information about using the Tivoli NetView network management console, refer to the Tivoli NetView documentation at the following Web site: http://www.ibm.com/software/tivoli/library/
Opening a trouble ticket

You can use trouble tickets to track events or send notification of an event to someone who does not normally use the event console. To open a trouble ticket, follow these steps: 1. From the event viewer, select an event in the Working Queue. 2. From the Selected menu in the event viewer, click Trouble Ticket. Note: The implementation of trouble tickets depends on how your administrator integrated your trouble ticket system with the trouble ticket rules that the Tivoli Enterprise Console provides. The following table lists the context and authorization role required to perform this task.
Activity Open a trouble ticket Context Java version of the event console Required Role user
56
Viewing event information

You can view additional information about an event in a Web page. To do this, an administrator must have configured the event console and a CGI program must exist that provides the event information. To view event information in a Web browser, select the appropriate event in the Working Queue. The following table lists the context and authorization role required to perform this task.
Activity Context Required Role user, rim_view
View event information in the Java version of the event event viewer console
Viewing event properties

To view details about an event in the event viewer, double-click the event or select one or more events in the Working Queue and click Details. If you selected more than one event, you can navigate between the details of each event by clicking Next or Previous in the event details window. To view a category of the details of an event, click one of the tabs in the event details window. The following table lists the context and authorization role required to perform this task.
Activity View event details in the event viewer Context Java version of the event console Required Role user, rim_view
Customizing the event viewer

This section describes the following topics related to customizing the event viewer: v Changing general preferences v Changing severity colors on page 58. v Sorting events on page 59 v Filtering events on page 59
Changing general preferences

The preferences control how events are shown in the event viewer. To change the general preferences, from the Edit menu in the event viewer, click Preferences. You can change one or more of the following general preferences: Refresh Time Specifies the rate (in seconds, minutes, or hours) at which events are automatically refreshed in the event viewer. Maximum Age of Closed Event to Display Specifies the maximum age (in seconds, minutes, hours, days, weeks, months, or years) of closed events to display in the event viewer. Note: When setting event time limits on the event consoles, be aware that event consoles compare local system time with the date of the events to determine which event should be displayed on the event
57
console. For example, if the time on the node is 9:00 and the time on the event server is 10:30, all new events appear to be 90 minutes old to the event consoles. Maximum Number of Events Specifies the maximum number of events to display in the event viewer. For more information about changing general preferences, refer to the online help. The following table lists the context and authorization role required to perform this task.
Activity Change general preferences Context Java version of the event console Required Role user
Because the general user preferences, the name of the last managed node you logged in to, and your user ID are stored locally in the $HOME/.tmeconsole directory, your preferences are maintained between sessions. Similarly, the preferences you set are used when you log on to the Java version of the event console on another computer.
Changing severity colors

You can change the severity colors only if your administrator has made this option available to you. Each event is color-coded to indicate the severity level for that event. The following table lists each default severity level and the corresponding default color.
Table 7. How event severity is indicated in the Java version of the event console Severity FATAL CRITICAL MINOR WARNING HARMLESS UNKNOWN Color Black Red Orange Yellow Green Blue
To change the severity colors, follow these steps: 1. From the Edit menu in the event viewer, select Preferences. The Preferences window is displayed. 2. From the Preferences window, expand Event Viewer and then click Severity Colors. 3. Change the settings in the Severity Colors window, referring to the online help for additional information. The following table lists the context and authorization role required to perform this task.
Activity Change severity colors Context Java version of the event console Required Role user
58
Sorting events
You can sort all events or only events in the Working Queue based on any event field in the event viewer. Initially events are sorted based on event severity. If multiple events have the same severity, the events are sorted based on the event date. Events with the highest severity are displayed at the bottom, and events with the lowest severity are displayed at the top. To sort events, follow these steps: 1. From the Edit menu in the event viewer, select Preferences. The Preferences window is displayed. 2. From the Preferences window, expand Event Viewer and then click either All Events to sort all events or Working Queue to sort events in the Working Queue. 3. Set the sort criteria you want in the Sort window, referring to the online help for additional information. The following table lists the context and authorization role required to perform this task.
Activity Sort events Context Java version of the event console Required Role user
Filtering events
You can filter the events in the Working Queue based on severity, status, and operator ownership to help you focus on important events. When you filter events for one event group, other event groups are not affected. To filter events, follow these steps: 1. From the Options menu in the event viewer, select Filter Events. 2. Select the checkboxes for the types of events you want to display in the event viewer. Clear the checkboxes for the types of events you do not want to display in the event viewer. The following table lists the context and authorization role required to perform this task.
Activity Filter events by severity and status Context Java version of the event console Required Role user
For information about using a command to list events based on severity and status to standard output, refer to the wlsemsg command in the IBM Tivoli Enterprise Console Command and Task Reference.
Using the Web version of the event console

This section describes the tasks you can perform using the Web version of the event console.
Overview of the Web version of the event console

The Web version of the event console is comprised of the following areas:
59
Portfolio The primary way that your work is organized within the event console. It is titled My Work. Each entry in the portfolio represents a task that you can perform. The following table describes the tasks in the portfolio.
Table 8. Portfolio tasks in the Web version of the event console Task Select an Event Group Function Lists the event groups available to the operator. An operator can select an event group to view the events assigned to the operator. Displays a table that summarizes events by severity. Runs predefined tasks from task libraries when an event is not required to run the task. Note: When an event is required to run the task, you must run the task from the event viewer. Changes how events are shown in the event viewer. Displays the Welcome page.
View Summary of Events Run Tasks
Change User Preferences Welcome
The portfolio is open when you start the event console. To close and open the portfolio, click the Hide Tasks and Show Tasks icons, respectively, on the left side of the tool bar in the event console. You might want to close the portfolio to increase the size of the work area. Work Area The area in which task windows are displayed. When the portfolio is closed, the entire page is the work area. taskbar The bar that is located above the work area. The taskbar contains a button for each task that you start so that you can switch between tasks. The taskbar also contains the following icons: All Tasks Displays the Task Manager, which contains a list of all tasks you have started. To switch to a task, select the task and click Switch Task. To end a task, select the task and click End Task. The All Tasks icon is located on the far left corner of the taskbar. Sign Off Signs off the event console. The Sign Off icon is located on the far right corner of the taskbar. Recent Event Groups The area of the portfolio that contains the last five event groups that have been viewed in the event viewer. Task button A button on the taskbar that represents each portfolio task that you have started. When you click a task button, the associated task window opens in the work area. Task Assistant Help for the currently displayed portfolio task. The Task Assistant is represented by a question mark in the upper right corner of the event console. When it is open, the Task Assistant is displayed within the event console to the right of the work area. For windows that require user input,
60
you can also display field descriptions. The icon for field descriptions is represented by an i. This icon is located to the left of the Task Assistant icon. Task Close The icon on the far right of the title bar of the work area, which you can use to close the task that is displayed. Note: When using the Web version of the event console, you might find that some pages display better if you reduce the size of the text. Use the controls that your Web browser provides to reduce the size of the text.
Starting the Web version of the event console

To sign on to the the event console, follow these steps: 1. Open your Web browser. 2. Type the address your administrator provided, which is similar to the following example:
http://computer_name:9080/TecConsoleWeb
Where computer_name is the fully-qualified name of a computer where the Web server is running. 3. Type your Tivoli Management Framework user ID in the User Name field. 4. Type the password for the specified user ID in the Password field. 5. Select the appropriate managed node from the Server Name drop-down list. 6. Click OK.
Exiting the event console

To exit the event console, click the Sign Off icon in the right corner of the taskbar.
Viewing events
To view events, follow these steps: 1. Click Select an Event Group from the portfolio in the event console. A list of event groups is displayed. 2. Click the name of the appropriate event group. An event viewer is opened, which contains the events in the selected event group. The event viewer automatically refreshes at specific time intervals. To suspend the automatic refresh, click the Suspend icon on the toolbar. To resume the refresh, click the Resume icon. The status bar at the bottom of the window indicates if automatic refresh is enabled, suspended, or needed (automatic refresh has been suspended and the refresh interval has been exceeded). You can also select an event group from the Summary of Events table. To view the Summary of Events table, click View Summary of Events from the portfolio.
Acknowledging events
To acknowledge events, select one or more events in the event viewer and click Acknowledge on the tool bar. You can also use wsetemsg command to acknowledge an event. For more information about the wsetemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
61
Running tasks
To run a task, choose one of these methods: v If the task requires a source event, select one or more events in the event viewer. Then select Run Task from the Action menu in the event viewer and click Go. v If the task does not require a source event, select Run Tasks from the portfolio. The task wizard guides you through the steps required to run the task. For more information about running a task, refer to the online help in the event console. The task results are shown in a new window of your Web browser. Use the print option of your Web browser controls to print the task results. You can also run most tasks from the command line using the wruntask command. For more information about the wruntask command, refer to the Tivoli Management Framework Reference Manual. For information about tasks in the T/EC Tasks library, refer to the Tivoli Enterprise Console Reference.
Closing events
To close events, select one or more events in the event viewer and click Close on the tool bar. You can also use the wsetemsg command to close an event. For information about the wsetemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Viewing a summary of events

To view a summary of the events contained in each event group, select View Summary of Events from the portfolio. By default, the table shows the number of events for each severity in each event group, the total number of events in each event group, and the total number of events for each severity. To show the percentage of events in each category, click Percentage on the tool bar. If the percentage of events in each category is shown and you want to show the number of events in each category, click Absolute on the tool bar. The window automatically refreshes at specific time intervals. To suspend the automatic refresh, click the Suspend icon on the toolbar. To resume the refresh, click the Resume icon. The status bar at the bottom of the window indicates if automatic refresh is enabled, suspended, or needed (automatic refresh has been suspended and the refresh interval has been exceeded).
Opening a trouble ticket

To open a trouble ticket, follow these steps: 1. Select one or more events in the event viewer. 2. Select Trouble Ticket from the Action menu on the toolbar and click Go. When multiple events are selected, a separate trouble ticket is opened for each selected event.
62
Note: The implementation of trouble tickets depends on how your administrator integrated your trouble ticket system with the trouble ticket rules that the Tivoli Enterprise Console provides.
Viewing event information

To view information for an event, select an event in the event viewer and click Information on the tool bar. The information is displayed in a new window of your Web browser.
Viewing event properties

Details about events are called properties. To display event properties, choose one of these methods: v Select the appropriate event in the event viewer and click Properties on the tool bar. v Click on the severity in the Severity column of the event viewer for the appropriate event. An event properties notebook is displayed that contains the following pages: General Displays general information about the selected event, such as status and date received. If a rule has automatically responded to the event (the event status is RESPONSE), you can view the rule engine output. To do this, click View Rule Engine Output on this page. The results are shown in a new window of your Web browser. Cause Events Displays the cause events of the selected event when you click Show Cause Events. The cause events are listed in a table. To manage one or more cause events, select the events and then select Manage Events from the table menu. An event viewer is opened for the selected events. Effect Events Displays the effect events of the selected event when you click Show Effect Events. To manage one or more effect events, select the events and then select Manage Events from the table menu. An event viewer is opened for the selected events. Attributes Displays the attributes of the selected event. If you want to print the event properties, click Format a Print Version on any page of the event properties notebook. The formatted version of the event properties is shown in a new window of your Web browser. Use the print option of your Web browser to print the event properties.
Customizing the event viewer

This section describes the following topics related to customizing the event viewer: v Changing preferences on page 64 v Sorting events on page 65 v Filtering events on page 65
63
Changing preferences
The preferences control how events are shown in the event viewer. The changes you make, except for changes to the maximum number of events to show in the each event viewer, are reflected immediately in all open event viewers. Because changes to the preferences are stored in cookies, ensure that the privacy settings for your Web browser are set to allow cookies if you want the changes to be persistent. If cookies are not allowed, changes to the preferences affect only the current session. The preferences you set do not affect a Web console on a different computer. To change the preferences, click Change User Preferences in the portfolio. You can change one or more of the following user preferences: Refresh rate Specifies the rate at which you want events automatically refreshed in the event viewer and in the summary of events. Maximum number of events to show on each page Specifies the maximum number of events you want to show on each page in the event viewer. Severity counts Specifies whether or not to show the number of events in each severity on the event filter icons in the event viewer. Maximum number of events to show in each event viewer Specifies the maximum number of events you want to show in the event viewer. The value for this preference is determined in combination with the preference setting for the maximum number of events in the Java version of the event console. If the value specified in the Web version of the event console differs from the value specified in the Java version of the event console, the maximum number of events is set to the lower of the two values. Changes to the maximum number of events to show in each event viewer are reflected the next you time open an event viewer. Banner Specifies whether or not to show the banner in the event viewer. Show the event severity as Specifies how to show the event severity in the event viewer. The event console uses color and icons to indicate the severity level for an event. The following table describes the color and icon that corresponds to each event severity.
Table 9. How event severity is indicated in the Web version of the event console Severity Fatal Critical Minor Warning Color Black Red Orange Yellow Icon
64
Table 9. How event severity is indicated in the Web version of the event console (continued) Severity Harmless Unknown Color Green Blue Icon
Sorting events
By default, events are sorted in the event viewer by the date received field. You can sort events based on up to three event fields. To do this, click the Edit Sort icon on the tool bar in the event viewer.
Filtering events
You can filter events in the event viewer by event severity, event status, and event owner. Filtering events in this manner helps you focus on the events of interest. To filter events, use the event filter icons on the tool bar in the event viewer.
65
66
Chapter 5. Tivoli Enterprise Console gateway

The Tivoli Enterprise Console gateway can receive events from TME adapters and non-TME adapters. The Tivoli Enterprise Console gateway forwards events to the event server and communicates with the event server using the Tivoli Event Integration Facility. The Tivoli Enterprise Console gateway is comprised of the tec_gateway and the tec_gwr programs. The tec_gateway program processes events from TME adapters. The tec_gateway program and all of the necessary adapter files for each endpoint operating system are installed when the Adapter Configuration Facility is installed on a managed node. The Adapter Configuration Facility must be installed on any managed node that is configured as a Tivoli Enterprise Console gateway. For more information about the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise Console Adapters Guide. The tec_gwr program receives events from non-TME adapters and sends them to the tec_gateway program. The tec_gwr program is installed when a Tivoli Enterprise Console gateway adapter configuration profile is distributed to an endpoint using the Adapter Configuration Facility. The tec_gwr program is essentially an endpoint adapter that receives events from non-TME adapters. The tec_gwr program uses the LCF (endpoint) transport type to send events to the tec_gateway program in a manner similar to that of the SNMP and logfile endpoint adapters. By default, the Tivoli Enterprise Console gateway does not receive events from non-TME adapters. You can configure the Tivoli Enterprise Console gateway to receive events from non-TME adapters using a keyword in the Tivoli Enterprise Console gateway configuration file. For information about adapters that send events to the Tivoli Enterprise Console gateway, refer to the IBM Tivoli Enterprise Console Adapters Guide.
Configuring the gateway

You can use the Tivoli Enterprise Console gateway as installed, or you can create a gateway configuration file. You might want to configure the Tivoli Enterprise Console gateway for the following reasons: v To enable the Tivoli Enterprise Console gateway to receive events from non-TME adapters. See Configuring the gateway to receive events from non-TME adapters on page 74. v To control network traffic and improve event server and network performance as follows: Use state correlation at the Tivoli Enterprise Console gateway. See Configuring the gateway for state correlation on page 75. Control the rate at which the Tivoli Enterprise Console gateway sends events to the event server. See Configuring the rate at which events are sent to the event server on page 76. Note: To control the number of events sent from an adapter, refer to the event filtering information in the IBM Tivoli Enterprise Console Adapters Guide. To configure the Tivoli Enterprise Console gateway, modify the keywords in the gateway configuration file as appropriate. Then create and distribute an adapter
67
configuration profile that contains the tec_gateway or the tec_gateway_sce profile. Use the tec_gateway_sce profile if you want to use state correlation at the Tivoli Enterprise Console gateway. For information about the gateway configuration file, see Gateway configuration file. For more information about using an adapter configuration profile, refer to the IBM Tivoli Enterprise Console Adapters Guide. Note: To distribute a modified Tivoli Enterprise Console gateway adapter configuration profile to a managed node with a gateway installed, the managed node must also have an endpoint installed on it. When you distribute the adapter configuration profile, the subscriber must be the endpoint on that managed node.
Gateway configuration file

The Tivoli Enterprise Console gateway configuration file is optional and does not exist on the managed node until an adapter configuration profile containing the gateway configuration information is distributed to the endpoint on that managed node. The Tivoli Enterprise Console gateway uses default values unless you modify the keywords in the Tivoli Enterprise Console gateway configuration file and distribute an adapter configuration profile containing the changed gateway configuration information. Also, if you do not specify a value for a keyword, the default value is used. The Tivoli Enterprise Console gateway uses one of the following configuration files: UNIX: /etc/Tivoli/tec/tec_gateway.conf Windows: %SystemRoot%\drivers\etc\Tivoli\tec\tec_gateway.conf The following example shows how the Windows path notation can be expanded:
c:\winnt\system32\drivers\etc\Tivoli\tec\tec_gateway.conf
The configuration file defines the behavior of the Tivoli Enterprise Console gateway. For information about the common keywords for the configuration file, refer to the IBM Tivoli Enterprise Console Adapters Guide or the Tivoli Event Integration Facility Reference. The configuration file can also use the following custom keywords: APPEND_CLASSPATH=string Specifies the string that is appended to the CLASSPATH environment variable before Java-based state correlation is started. The string is appended using the appropriate delimiter, a semicolon (;) for Windows or a colon (:) for UNIX. The string must contain valid data for your environment as shown in the following example: UNIX:
APPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar
Windows:
APPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar
68
For the tec_gateway program, the specified string is appended to the list of jar files used for state correlation. For a C Adapter, the specified string is appended to the CLASSPATH environment variable. Notes: 1. The CLASSPATH environment variable will not be changed. The CLASSPATH information is only passed to the Java code when state correlation is started. 2. You can specify the APPEND_CLASSPATH keyword only one time in your configuration file. BufEvtPath Specifies the file in which to buffer events when the Tivoli Enterprise Console gateway cannot forward the events to the event server. Because a single Tivoli Enterprise Console gateway can forward events to multiple event servers, it must have an event buffer file for each event server. When the Tivoli Enterprise Console gateway reestablishes the connection to the event server, it sends the buffered events to the event server. The Tivoli Enterprise Console gateway creates a buffer file for each event server by appending the event server location specified by the ServerLocation keyword to the name of the file specified by the BufEvtPath keyword. Assume that the ServerLocation and the BufEvtPath keywords are specified as follows:
ServerLocation=@EventServer#tmr-central BufEvtPath=/etc/Tivoli/tec/gateway_cache
The Tivoli Enterprise Console gateway creates the /etc/Tivoli/ tec/gateway_cache@EventServer#tmr-central buffer file. If the Tivoli Enterprise Console gateway receives an event from an adapter that specified server location as @EventServer#tmr-east, the Tivoli Enterprise Console gateway also creates a buffer file named /etc/Tivoli/tec /gateway_cache@EventServer#tmr-east. The default value is one of the following: UNIX: /etc/Tivoli/tec/cache@EventServer#region Windows: $DBDIR/cache.dat@EventServer#region (on managed nodes) $TIVOLIHOME/tec/$(AC_TYPE).cache@ EventServer#region (on endpoints) Note: To reduce network traffic and improve performance, filter events as close to the source as possible by specifying filter options in adapter configuration files. You can also use the Filter, FilterCache, FilterMode, and UseStateCorrelation keywords in the Tivoli Enterprise Console gateway configuration file. EventSendThreshold Specifies the maximum number of events per second to send to the event server. Use this keyword in conjunction with the
69
BufferFlushRate keyword. For more information about how to set the value for this keyword, see Gateway configuration example on page 76. GatewayAckInterval Specifies the timeout interval, in seconds, to wait for acknowledgement from the event server. The default value is 30 seconds. This keyword works in conjunction with the GatewayTMEAckEnabled keyword for event delivery. GatewayQueueSize Specifies the size, in bytes, for the event buffers. If any of the event buffers fill before expiration of the interval specified by the GatewaySendInterval keyword, the Tivoli Enterprise Console gateway immediately sends the the waiting events to the event server. The minimum value for this keyword is 4096 bytes. If the GatewayQueueSize keyword is set to a value lower than 4096, this keyword is set to 40000, which is the default. GatewaySendInterval Specifies the interval, in seconds, at which to forward events to the event servers. The Tivoli Enterprise Console gateway holds events when they are received. When this interval expires, the Tivoli Enterprise Console gateway bundles and forwards the events in a message to the appropriate event servers. The default interval is five seconds. GatewayTMEAckEnabled Specifies whether or not an acknowledgement is expected from the event server. To ensure event delivery, set this keyword to YES (connection-oriented). The default value is NO. gwr_ActiveConnections=nn Specifies the number of active connections that the tec_gwr program manages at one time. The number of possible connections ranges from 2 to 1000. If the value specified for this keyword is greater than 1000, the number of active connections is set to 1000. If the value specified for the keyword is less than 2, the number of active connections is set to 2. If you do not specify a value for this keyword, the number of possible active connections is not limited. gwr_ActiveConnectionsSafety=nn Specifies the percentage of active connections that the connections specified by gwr_ActiveConnections keyword must be reduced to before connections can be processed again. Valid values range from 10 to 90. When the number of active connections specified in the gwr_ActiveConnections keyword is reached, no new connections are accepted until the number of connections drops below this specified threshold. For example, if the gwr_ActiveConnections keyword is set to 20 and the gwr_ActiveConnectionsSafety is set to 80, the tec_gwr program stops accepting connections when 20 connections are reached. The tec_gwr program accepts new connections when the number of active connections is reduced to 16 or less (80% of 20). The default value is 80. This keyword is used only when a value is specified for the gwr_ActiveConnections keyword.
70
gwr_ConnectionsQueued=nn Specifies the number of connections that the server socket queues. The server socket queues connections that are waiting to be accepted by the tec_gwr program. Use this option to limit the number of connections that can be queued. Valid values range from 1 to 1000. The actual number of queued connections can be slightly more or less than the value you specify. The default value is 500. This keyword is optional. gwr_Enable=YES|NO Specifies whether or not the tec_gateway program receives events from non-TME adapters. To enable the tec_gateway program to receive events from non-TME adapters, specify YES. The default value is NO. This keyword is optional. gwr_OptionPortNotAvailable=ERROR|WAIT Specifies how the tec_gwr program processes events when the port specified by the gwr_ReceptionPort keyword is not available. When this keyword is set to ERROR, the tec_gwr program ends if the port specified in the gwr_ReceptionPort keyword is not available. When this keyword is set to WAIT, the tec_gwr program continues processing instead of returning an error when the port is not available. When the port becomes available, a server socket is created. The default value is ERROR. This keyword is optional. gwr_ReceptionPort=port Specifies the port on which to listen and receive events from non-TME adapters. The default value is 5539. This keyword is optional. gwr_ReceptionTestMode=path Specifies the path and the file name from which to read test mode events. This keyword is similar to the TestMode keyword in that events are read from a data file as opposed to being received on a port. This keyword is optional. gwr_RetryCount=nn Specifies the number of times to resend an event when the tec_gateway program fails to receive an event from the tec_gwr program. The default value is 10. This keyword is optional. gwr_RetryInterval=nn Specifies the interval, in seconds, between retry attempts specified by the gwr_RetryCount keyword. The default value is 1. This keyword is optional. gwr_ServerLocation=host_name Specifies the name of the host on which the event server is installed. The default value is the value of the ServerLocation keyword. This keyword is optional. gwr_ServerPort=port_number Specifies the server port to use for the host specified by the gwr_ServerLocation keyword when events are received from non-TME adapers. The specified server port is used when the value for gwr_ServerLocation is any value other than @EventServer. The default value is 0. This keyword is optional. gwr_ServiceServer=host_name:port_number Specifies the host and port number to which to send service-related
71
events. The tec_gwr program sends service status events that belong to the TEC_Notice class to the event server specified by this keyword. The tec_gwr program sends a service status event when the tec_gwr program is started or stopped or when the submission handle is reset. Specify the host and port number as follows:
myEventServerHost:5529
To send service status events from the tec_gwr program to the tec_gateway program, set this keyword to SAME as follows:
gwr_ServiceServer=SAME
gwr_SubmissionTestMode=path Specifies the path and file name from which to read test mode events. This keyword is similar to the TestMode keyword in that events are read from a data file instead of being received on a port. This keyword is optional. MaxGWCacheSizeMegs Specifies the maximum size, in megabytes, of the event cache. By default, the maximum size of the event cache is 1 MB. The keyword is not included in the configuration file as provided. PREPEND_CLASSPATH=string Specifies the string that is prepended to the CLASSPATH environment variable before Java-based state correlation is started. The specified string is prepended using the appropriate delimiter, a semicolon (;) for Windows or a colon (:) for UNIX. The string must contain valid data for your environment as shown in the following example: UNIX:
PREPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar
Windows:
PREPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar
For the tec_gateway program, the specified string is prepended to the list of jar files used for state correlation. For a C Adapter, the specified string is prepended to the CLASSPATH environment variable. Notes: 1. The CLASSPATH environment variable will not be changed. The CLASSPATH information is only passed to the Java code when state correlation is started. 2. You can specify the PREPEND_CLASSPATH keyword only one time in your configuration file. RetryInterval Specifies the interval, in seconds, to wait before connecting to a secondary event server when the Tivoli Enterprise Console gateway cannot send events to the event server. While the Tivoli Enterprise Console gateway is waiting for this time interval to expire, the Tivoli Enterprise Console gateway continues to receive and cache new events. To adjust the size of the Tivoli Enterprise Console gateway memory queues, use the GatewayQueueSize keyword.
72
The RetryInterval keyword enables adapters to send all events to the primary event server even if the primary event server is stopped briefly, such as when loading a new rule base. If you use this option to wait for the event server to restart, set the value for a period of time longer than needed for the event server to be stopped and restarted. The RetryInterval keyword is optional. ReceiveAckPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to receive acknowledgements from state correlation. The acknowledgements indicate that state correlation has received and stored the events. This keyword is used in conjunction with the SendEventPort keyword. This keyword is required when the UseStateCorrelation keyword is set to YES. ReceiveEventPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to recieve events from state correlation. This keyword is used in conjunction with the SendAckPort keyword. This keyword is required when the UseStateCorrelation keyword is set to YES. SendAckPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to acknowledge the reception of events sent from state correlation. This keyword is required when the UseStateCorrelation keyword is set to YES. SendEventPort=number Specifies the port number that the Tivoli Enterprise Console gateway uses to send events to state correlation. This keyword is required when the UseStateCorrelation keyword is set to YES. ServerLocation Specifies the default event server location if adapters do not specify an event server location in an event instance. If the ServerLocation keyword is specified in the configuration file for an adapter, the Tivoli Enterprise Console gateway sends events to the adapter-specified event server. If ServerLocation is not specified in an adapter configuration file, the Tivoli Enterprise Console gateway sends events to the event server specified by ServerLocation keyword in the Tivoli Enterprise Console gateway configuration file. If the ServerLocation keyword is not specified in the Tivoli Enterprise Console gateway configuration file, the Tivoli Enterprise Console gateway sends the event to the event server in the local Tivoli region. The default value is @EventServer. You can specify multiple event server names as a comma-delimited list. Event server names later in the list can be backup event servers when the Tivoli Enterprise Console gateway cannot contact its primary event server for an event and the interval specified by the RetryInterval keyword has expired without successfully contacting the primary server. You can specify a host name as you would for a non-TME adapter, and the events are then forwarded
73
to that host using non-Tivoli communication. For more information, see the examples in the description of the ServerPort keyword. When the Tivoli Enterprise Console gateway cannot contact the adapter-specified event server, the event server names specified in the list are backup event servers. If ServerLocation is not present in the Tivoli Enterprise Console gateway configuration file, the Tivoli Enterprise Console gateway uses the default @EventServer value as the backup event server. To prevent event delivery to backup event servers, set the ServerLocation keyword to NONE. Note: When the ServerLocation keyword is used in conjunction with the TestMode=YES keyword, the ServerLocation keyword defines the path and the file name for logging events instead of the event server. ServerPort Specifies the port that the event server uses to send events using non-Tivoli communication. The default value is 0, which causes the portmapper daemon on the specified host to determine the port on which the event server is listening for incoming events. If you are forwarding events to a Tivoli Availability Intermediate Manager, you cannot specify 0 as the port because the Tivoli Availability Intermediate Manager does not register itself with the portmapper daemon. If you specify a value for the ServerPort keyword, the value must be either a single port number or a comma-delimited list of port numbers that correspond to the list of event servers specified in the ServerLocation keyword. If you specify a single port number and you have specified multiple event servers in the ServerLocation keyword, all event servers use the port number specified. Assume that you have a Tivoli Availability Intermediate Manager running on hosts aim.xyz.com and aimbkup.xyz.com, and the ServerLocation and the ServerPort keywords are specified as follows:
ServerLocation=aim.xyz.com,aimbkup.xyz.com,@EventServer ServerPort=5530,5531,0
Events are sent to port 5530 on the host aim.xyz.com using non-Tivoli communication. If that fails, events are sent to port 5531 on the host aimbkup.xyz.com. If that also fails, events are sent directly to the event server in the local Tivoli region using Tivoli communication. The port value of 0 specified for @EventServer is ignored because port numbers are not needed when using Tivoli communication.
Configuring the gateway to receive events from non-TME adapters

To configure the tec_gwr program to receive events receive events from non-TME adapters, set the value of the gwr_Enable keyword in the gateway configuration file to YES. The tec_gwr program listens on a socket port for incoming events from non-TME adapters. The port used must not be in use by another application, such as the event server.
74
If an event sent from the tec_gwr program to the tec_gateway program fails, the tec_gwr program resends the event when the gwr_RetryCount keyword is set to a value greater than or equal to 1. The tec_gwr program resends the event after waiting for the time period specified by the gwr_RetryInterval keyword. The number of retry attempts is equal to the value specified for the gwr_RetryCount keyword. To configure non-TME adapters to use the IBM Tivoli Enterprise Console gateway, set the ServerLocation/channelServerLocation and the ServerPort/channelPort keywords in the configuration file of the adapter to the host name and port number that the tec_gwr program uses. If the tec_gwr program is not running on the same host as the event server, you can register the tec_gwr program with the portmapper daemon. To do this, set the value of the gwr_ReceptionPort keyword in the Tivoli Enterprise Console gateway configuration file to 0. Note: Messages received on the socket are generated by non-TME adapters and must be in the correct format as defined by the Tivoli Event Integration Facility in the Tivoli Enterprise Console product. Other types of messages are discarded. The Tivoli Enterprise Console product uses the following files to receive events from non-TME adapters: v UNIX and Windows: tec_gwr.cfg Installation script. init.tec_gwr Script used to start and shut down the tec_gwr program. v Windows only tec_gwr.exe Executable file. tec_gwrs.exe Executable file as a service. sctlgwr.exe Service controller and installation utility. v UNIX only tec_gwr Executable file.
Configuring the gateway for state correlation

To decrease the number of events that are sent to the event server, you can configure the Tivoli Enterprise Console gateway for state correlation. Using state correlation at the Tivoli Enterprise Console gateway to perform advanced filtering, duplication detection, and event correlation closer to the source off-loads filtering and event correlation from the event server. For information about writing rules for state correlation, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Activating state machines

Before you activate the state machine, ensure that you have written your rules based on the information described in the IBM Tivoli Enterprise Console Rule Developers Guide.
75
Follow this procedure to run a state machine: 1. Modify the state correlation keywords in the configuration file. The following code fragment illustrates the use of the appropriate keywords:
UseStateCorrelation=YES # for Windows NT only StateCorrelationConfigURL=file:C:\tmp\test.xml # for all other INTERPs # StateCorrelationConfigURL=file:///tmp/test.xml # SendEventPort=1234 # ReceiveAckPort=4321 # ReceiveEventPort=5678 # SendAckPort=8765
2. To run state correlation on an IBM Tivoli Enterprise Console gateway, change the adapter configuration profile (ACP) record, tec_gateway_sce, as follows: a. In the Current EIF Environment list, ensure that the UseStateCorrelation, SendEventPort, ReceiveAckPort, ReceiveEventPort, and SendAckPort keywords are set. b. Select the XML file to distribute, which you specified in step 1. c. Distribute the tec_gateway_sce ACP. After the state machine is running, you can test whether state correlation is properly filtering events in the following ways: v If you have written rules to generate event summaries, ensure that the event server is receiving the event summaries. v If you have written rules to suppress events, ensure that suppressed events do not arrive at the event server.
Configuring the rate at which events are sent to the event server
At certain times, the number of events coming from endpoint adapters can overwhelm the Tivoli Enterprise Console gateway, the event server, and even the network. You can control the rate at which the Tivoli Enterprise Console gateway sends events to the event server using the EventSendThreshold, the BufferFlushRate, and the MaxGWCacheSizeMegs keywords in the Tivoli Enterprise Console gateway configuration file. The example in this section shows how to determine the values for the BufferFlushRate and EventSendThreshold keywords in the Tivoli Enterprise Console gateway configuration file to improve event server performance.
Gateway configuration example

This example assumes that the event server processes an average of 120 events per second without degrading its performance. The example environment contains two Tivoli Enterprise Console gateways, where gateway A is responsible for Web commerce servers and gateway B is responsible for the secretaries systems. The values provided in this example can vary greatly from installation to installation, depending on how many events, adapters, and Tivoli Enterprise Console gateways are in a particular environment. Use the worksheets provided in Worksheets and calculations on page 77 to collect and calculate the data for your environment. All numerical values are expressed in events per second, except where noted. 1. Determine the average number of events that the event server can process (120 in this example).
76
2. Determine the number of Tivoli Enterprise Console gateways and the resulting number of events that they can send to the event server. Divide the average capacity of the event server by the number of Tivoli Enterprise Console gateways as shown in the following example:
120 2 = 60
The resulting value of 60 indicates the average number of events each Tivoli Enterprise Console gateway can send without overwhelming the event server. Continue with step 3 to obtain the adjusted values for the Tivoli Enterprise Console gateway send rate. 3. Calculate the value for the EventSendThreshold keyword. The EventSendThreshold keyword sets the maximum number of events per second that the Tivoli Enterprise Console gateway sends to the event server. Because gateway A forwards events from mission-critical systems, more gateway A events should be sent to the event server than gateway B events. Thus, the EventSendThreshold keyword for gateway A is set to 80 events per second. Gateway B has the EventSendThreshold keyword set to 40 events per second. This way, more gateway A events get to the event server. The sum of the values for gateway A and gateway B must be less than or equal to the 120 events that the event server can process:
80 + 40 120
4. Determine the value for the BufferFlushRate keyword. Any events above the value specified for the EventSendThreshold keyword are stored in the cache on the Tivoli Enterprise Console gateway. To regulate the number of events being sent to the event server, the BufferFlushRate keyword controls the number of events per minute to be sent from the cache, when the gateway recovers a lost connection to the event server. For gateway A, the BufferFlushRate keyword is set to 5400 events per minute (90 events per second), and for gateway B the keyword is set to 3000 events per minute (50 events per second). Thus at peak traffic times, the event server is receiving 140 events per second from both Tivoli Enterprise Console gateways:
90 + 50 = 140
Although 140 events per second is greater than the average capacity of the event server (120 events per second), the event server has the capability to process excess events during brief, intermittent periods of time. Tip: Remember to convert events per second to events per minute before setting the value for the BufferFlushRate keyword. 5. Modify the adapter configuration profile for the Tivoli Enterprise Console gateway with the values calculated in step 3 and step 4. 6. Distribute the Tivoli Enterprise Console gateway adapter configuration profile. Depending on the number of Tivoli Enterprise Console gateways and endpoints in your environment, you need to carefully consider the rates you specify for the keywords. For instance, an improper configuration might have multiple Tivoli Enterprise Console gateways sending events at the same rate, thus flooding the event server at the same time. See Gateway configuration file on page 68 for details about these keywords.
Worksheets and calculations

Table 10 on page 78 and Table 11 on page 78 summarize the values for this example. You can use these tables as worksheets to assemble the values you measure and calculate for your environment. All numerical values are expressed in events per
77
second, except where noted.

Table 10. Example rate at which the event server processes events Average Receive Rate 120 Expected Peak Rate for High Traffic 140
Table 11. Example rate at which events are sent to the event server Event Send Adjusted Rate Rate Gateway A 60 80 EventSendThreshold 80 BufferFlushRate 5400 events per minute (90 events per second) Gateway B 60 40 40 3000 events per minute (50 events per second) Total Events Sent to Event Server 120 120 120 140 events per second
The following are the calculations to control event traffic:

event server average rate gateway A events + gateway B events EventSendThreshold = adjusted send rate for gateway gateway A gateway B BufferFlushRate + BufferFlushRate event server peak rate
Starting and stopping the tec_gwr program

By default, the tec_gwr program is automatically started when the host starts. The tec_gwr program is automatically started when an adapter configuration profile containing the tec_gateway or tec_gateway_sce entry is distributed using the Adapter Configuration Facility. You can also manually start the tec_gwr program. Starting the tec_gwr program causes the tec_gwr program to reread the tec_gateway.conf configuration file and restart the daemons. The tec_gwr program is automatically stopped when you distribute an adapter configuration profile that has the init.tec_gwr start command removed from the after-file-distribution actions. You can also manually stop the tec_gwr program.
Starting the tec_gwr program manually

To start the tec_gwr program manually, use one of the following commands: v UNIX:
init.tec_gwr start &
v Windows:
net start TECGWR
Stopping the tec_gwr program manually

To manually stop the tec_gwr program, use one of the following commands: v UNIX:
init.tec_gwr stop
78
v Windows:
net stop TECGWR
Obtaining the status of the tec_gwr program on UNIX

To obtain the status of the tec_gwr program on a UNIX system, use the init.tec_gwr command as follows: v To obtain status, type the following command:
init.tec_gwr status &
v To obtain the process ID, type the following command:

init.tec_gwr pid &
v To obtain environment settings, type the following command:

init.tec_gwr env &
79
80
Appendix A. Troubleshooting
This appendix contains suggestions for isolating problems that you might encounter when using the Tivoli Enterprise Console product. To use the troubleshooting information in this appendix, you must have administration experience with the the Tivoli Enterprise Console product and you must be able to read Tivoli Management Framework log and trace files. The troubleshooting information in this appendix also requires that you have knowledge about the following items: v SQL v Three-tier architecture (database management, process management, and user system interface) v Installed Tivoli applications v Tivoli Management Framework
Getting started with problem determination

To begin isolating where you might have a problem with the Tivoli Enterprise Console product, ask yourself the following questions: v Where is the event? v What is the most likely candidate for the problem in my specific environment? Event server Rules Performance
Problems locating an event

This section describes the various commands and tools that you can use to determine where processing stopped for an event and where an event is currently located. The following commands can be useful: wtdumprl Generates a report of events that the event server receives by producing the contents of the reception log. The following example is a sample of an output fragment from running the wtdumprl command.
$ wtdumprl -o DESC|more 1~10782~65537~993068402(Jun 20 15:20:02 2001) ### EVENT ### BadClass;source=EVENT;msg=Test Parsing;origin=69.1.6.100;END ### END EVENT ### PARSING_FAILED~Line 1: Class BadClass undefined 1~10781~65537~993068400(Jun 20 15:20:00 2001) ### EVENT ### BadClass;source=EVENT;msg=Test Parsing;origin=69.1.6.100;END ### END EVENT ### PARSING_FAILED~Line 1: Class BadClass undefined 1~10780~2~993068145(Jun 20 15:15:45 2001) ### EVENT ### TEC_Notice;source=LOGFILE;severity=HARMLESS;msg=HARMLESS postemsg test;origin=69.1.6.100;END
81
### END EVENT ### PROCESSED
Note the PARSING_FAILED line in the wtdumprl output. For detailed information about how PARSING_FAILED affects performance, refer to the IBM Tivoli Enterprise Console Rule Developers Guide. wtdumper Generates a report of events in the event repository. The event repository is a table of received events in the event database. The following example is a sample output fragment from running the wtdumper command.
$ wtdumper -o DESC|more ES~1~993068442(Jun 20 15:20:42 2001)~6~TEC_Notice~ LOGFILE~~69.1.6.100~~~~OPEN~ ~[ admin]~CRITICAL~ Jun 20 15:20:42 2001~ CRITICAL postemsg test~ ~0~ 0~0~ES~1~993068442(Jun 20 15:20:42 2001)~1~Su_Success~ TEC~LOGFILE~69.1.6.100~N/A~~N/A~OPEN~ ~[ admin]~WARNING~ Jun 20 15:20:42 2001~ WARNING wpostemsg test~ none~0~
wtdbclear Deletes events from the event database. Use the wtdbclear command to delete events from the event database on a regular basis. Doing so helps to maintain good performance of the Tivoli Enterprise Console product. Use caution when running the wtdbclear command from a managed node other than the event server. The time from the local machine from which the command has been run is used to determine which events to clear, not the time from the event server. Note: For optimal performance, run the wtdbclear command during non-peak processing hours. For more information about the wtdumprl, the wtdumper, and the wtdbclear commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Understanding event server processes

To effectively use reports generated by the wtdumprl and the wtdumper commands, you need to understand how an event is processed before the event is displayed on an event console. The event server architecture consists of five processes, each of which impacts developing and running rules. An additional process, the UI server process, plays an integral part in the overall Tivoli Enterprise Console architecture. The UI server is not a part of the event server, although it communicates with the event server. The event server runs as five main processes, as shown in the following table:
Table 12. Event server processes Process Name tec_server tec_reception Description The master process The reception engine process
82
Table 12. Event server processes (continued) Process Name tec_rule tec_dispatch tec_task Description The rule engine process The dispatch engine process The task engine process
If any of the event processes fail, messages are written to files defined in the $BINDIR/TME/TEC/.tec_diag_config file. For more information about this file and the log files, see Event server process log files on page 85. The following figure illustrates the relationships among the event server processes. The arrows represent the flow of communications.

from non-Tivoli communication

from Tivoli communication
Master
(tec_server)
Task engine
(tec_task)
External tasks or programs
UI server Reception engine

(tec_reception)
Rule engine
(tec_rule)
Dispatch engine
(tec_dispatch)
(tec_ui_server)
Console
Reception buffer (RAM)
Event cache (RAM) RDBMS
Console
Console
Figure 5. Relationship among event server processes
The following sections describe the flow of an event through each of the Tivoli Enterprise Consoles five processes.
Master process
The controlling (master) process, tec_server, initializes the tec_dispatch, the tec_reception, the tec_rule, and the tec_task processes and restarts them if they stop. The tec_server process manages events as follows: 1. The tec_server process receives incoming events from Tivoli communication. 2. The tec_server process forwards received events to the tec_reception process. If errors are encountered during the tec_server process, the error messages are written to the /tmp/tec_master file by default.
Reception engine process

When an event is received, the event is immediately placed in the reception buffer by the reception engine process, tec_reception.
83
The following list explains what happens to an event during the tec_reception process: 1. An event is received by the tec_reception process. 2. The event is stored in the reception buffer with a status of QUEUED. 3. If the reception buffer is full, the event is stored in an event database table named tec_t_evt_rec_log with a status of WAITING. 4. When space is available in the reception buffer, the events in the database in WAITING status are read into the reception buffer and marked as QUEUED. If errors are encountered by the tec_reception process, the error messages are written to the /tmp/tec_reception file by default.
Rule engine process

Events with a status of QUEUED are now available for rule processing. The rule engine process, tec_rule, manages events as follows: 1. Events are passed from the tec_reception process to the tec_dispatch process and then to the tec_rule process. 2. A copy of the event is stored in the event cache where event correlation (rule processing) can occur. If errors are encountered during rule processing, the error messages are written to the /tmp/tec_rule file by default.
Dispatch engine process

The dispatch engine process, tec_dispatch, uses the tec_server process to notify the tec_reception process that an event has completed processing. The tec_dispatch process manages events as follows: 1. The tec_dispatch process places a copy of the event (including changes made during rule processing) in the event repository using RDBMS Interface Module (RIM). The event repository table name is tec_t_evt_rep. 2. The tec_dispatch process sends a message to the tec_task process to run assigned tasks or programs associated with the event. 3. The event is now available to the appropriate event consoles for viewing. 4. After the event is stored in the event repository, an acknowledgement is sent to the tec_reception process, which updates the status to PROCESSED. If the event is labeled as PROCESSED in the reception log, the rules have processed the event. If errors are encountered during the tec_dispatch process, the error messages are written to the /tmp/tec_dispatch file by default.
UI server process
The UI server process provides communication services between event consoles and the event server, and between event consoles and the event database. It communicates with the dispatch engine when it needs contact with the event server. The UI server provides the event consoles with updated event information and provides the dispatch engine with change requests to events from event consoles. For more information about the UI server process, see the IBM Tivoli Enterprise Console Rule Developers Guide.
84
Task engine process

The task engine process, tec_task, is responsible for managing actions as directed by the tec_rule process and manages running the rule language predicates. The process runs programs, tasks, scripts, and commands initiated by the rules. The exit status of the monitored items is returned to the dispatch engine, which writes the status to the event database if watch status is set to YES in the exec_prog or exec_task predicates. The num_actions attribute for an event contains the number of actions (tasks or programs) currently being tracked by the event server for the event. The tec_task process passes the event through the following assigned activity sources (rule language predicates): exec_task Assigned tasks are run on the event. exec_program Assigned scripts or programs are run on the event. forward_event The event is forwarded to another event server with changes applied from running the assigned task and program. If errors are encountered during the tec_task process, the error messages are written to the /tmp/tec_task file by default. For additional information about event server architecture and details about the event server processes, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Event server process log files

Error information is written to specific log files when event server processes fail. The log files are defined in the $BINDIR/TME/TEC/.tec_diag_config file. The following table lists each event server process and its corresponding default log file name and location:
Table 13. Log files for event server processes Process Name tec_server tec_reception tec_rule tec_dispatch tec_task Log File /tmp/tec_master /tmp/tec_reception /tmp/tec_rule /tmp/tec_dispatch /tmp/tec_task
Note: In a Windows or UNIX environment, the /tmp directory must already exist on your system for the log files to be properly created and saved. UNIX systems usually have a /tmp directory by default, but Windows temporary directories are named /temp. Rename /temp to /tmp, or add a directory named /tmp. For information about .tec_diag_config file parameters, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
85
Checking the event flow

To check the event flow and determine why an event is not displayed on the event console: v Examine the adapter and the Tivoli Enterprise Console gateway cache files. If the event server is down, the Tivoli Enterprise Console gateway buffers events at the gateway. Locate and inspect the cache files to find events that stop at the Tivoli Enterprise Console gateway. The file location is specified in the adapter configuration file. If events are found in the cache files, these events have not been forwarded to the event server. Ensure that the endpoint, the Tivoli Enterprise Console gateway, the Tivoli Management Framework gateway, and the event server are running. v Ensure that you do not filter out this event class at the adapter with the PreFilter and Filter adapter configuration options. v Use the wtdumprl command to check the reception log and determine if the event server received the event. For more information about using the wtdumprl command, see Problems locating an event on page 81. v Use the wtdumper command to check the event repository. If the event is in the event repository, it should be displayed on the event console. If the event is not displayed on the event console and the event is in the wtdumper command output, first check the time limits that were set during configuration for displaying events. Ensure that the time limits fit the criteria for the event in question. Time limits for displaying events can be modified in the following areas: Event server parameters Event group filters Event viewer filtering Rule processing
For more information about using the wtdumper command, see Problems locating an event on page 81. v Use the rule tracing facility to ensure that events are being processed through the rule engine. If the event is shown in the wtdumprl command output but not in the wtdumper command output, you might have a rule that is causing the event to be dropped.
Checking the event flow in a Tivoli environment

To check the event flow in a Tivoli environment, use the wpostemsg command. The wpostemsg command sends an event to the event server. Sending events is a good way to test the event server after you have created new event groups, created event group assignments, edited rules, or otherwise changed the behavior of event processing at the event server level. The following example sends a test message with the source of LOGFILE to the event server:
wpostemsg -m test message from EP TEC_Notice LOGFILE
For additional troubleshooting using the wpostemsg command, use the wtrace command, as described in Analyzing Tivoli Management Framework trace logs on page 90. For defining specific results using the wtrace command, use the odstat command to filter for specific details.
86
Notes: 1. The wpostemsg command is a form of the Event Integration Facility implementation that uses caching ability. 2. If the connect_agent method call returns an e=12 return code, the wpostemsg command caches the event. The e=12 return code indicates that the event server is not available. For more information about using the wpostemsg command, see the IBM Tivoli Enterprise Console Command and Task Reference.
Checking the event flow in a non-Tivoli environment

To check the event flow in a non-Tivoli environment, use the postemsg command. The postemsg command sends an event to the event server. Sending events is a good way to test the server after you have created new event groups, created event group assignments, edited rules, or otherwise changed the behavior of event processing at the server level. The following example sends a test message that displays an Su_Failure event on the event console.
postemsg -S tecbox -r WARNING -m su login failure. Su_Failure LOGFILE
Using the f option with the postemsg command specifies the name of the adapter configuration file. The adapter configuration file must specify the ServerLocation keyword and, if necessary, the ServerPort keyword. You can use any of the keywords in the adapter configuration file specified by the f option with the postemsg command. Using the f option with the postemsg command is preferred over the S option because it offers more flexibility and because you can specify a standard configuration file. Note: Output from the postemsg command is not included in Tivoli Management Framework trace file output. For more information about the postemsg command, refer to the IBM Tivoli Enterprise Console Command and Task Reference.
Problems starting the Tivoli Enterprise Console product

When you cannot start the Tivoli Enterprise Console product from the Tivoli desktop or the command line, look first at the following items: v Tivoli Management Framework or Tivoli Enterprise Console environment problems: If the tec_server event server process is no longer responding, restart it using the wstartesvr command. To check the status of the event server, use the wstatesvr command. When the event server is restarted, event consoles that were connected to it are automatically reconnected. For details about using the wstartesvr or wstatesvr commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference. Ensure that all interconnected Tivoli regions are running. If your environment contains several Tivoli regions that are connected, administration can be complex if you do not have a good diagram of the connections between the Tivoli regions. Before you begin troubleshooting, create a diagram of the connections between the Tivoli regions to assist you in determining the location of your Tivoli regions and the connection types.
87
The following list describes the common problem types you can encounter with interconnected Tivoli regions: - Inter-region passwords - Secure and remote connections - One-way and two-way connections - Inability to connect to a previously connected Tivoli region - Unable to disconnect a Tivoli region - Updating the name registry Updating resources Remote resources are not visible or accessible Inability to perform actions on remote objects Application failures across Tivoli region boundaries
For information about troubleshooting each of these potential problems with interconnected Tivoli regions, refer to the Tivoli Management Framework Maintenance and Troubleshooting Guide. v For troubleshooting possible database and RIM problems, see Problems with the RIM database on page 89. v If you suspect problems with the rule base, load and run the default rule base or a known working rule base as a test. If this confirms a problem with the rule base, see Problems with rules on page 88 and the IBM Tivoli Enterprise Console Rule Developers Guide for additional troubleshooting information.
Problems with rules

The most common problems related to rules are: v Failure to recompile, reload, and activate the rule base. v Failure to restart all Tivoli Enterprise Console processes after making changes to the rule base. For information about the Tivoli Enterprise Console processes, see Understanding event server processes on page 82. v Introduction of hidden characters or the Windows end-of-line (^M) character in a rule set causing unpredictable results, such as the product failing to start or the event console not being updated. For more information about writing rules, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Enabling rule tracing

The Tivoli Enterprise Console product provides a rule tracing facility for debugging problems related to rules. You can use the rule tracing facility to trace rules at different levels of granularity. For example, you can trace all rules, a particular rule set, part of a rule set, or a particular rule. To enable rule tracing, follow these steps: 1. Compile the rule base with tracing enabled. To do this, use the wrb comprules trace command with a trace directive specified in a rule or rule set. You can also trace rules from the rule builder. To do this, select Trace Rules in the Compile Rule Base dialog box. 2. Turn on tracing using the wsetesvrcfg command with the t option. 3. Load and activate the compiled rule base.
88
Note: When a rule base is compiled for the production environment, disable rules tracing because rule tracing impacts event processing performance. Rules generate trace output in a file. You can examine the resulting trace file to analyze and debug problems related to rules. The name and location of the trace file is set when the event server is configured. The following table describes the information found in rule trace files.
Table 14. Output in rule trace files Output Type action condition prolog calls rule predicate Description The action set when the rule trace is entered and exited The condition set when the rule trace is entered and exited The prolog calls trace, limited to a level of one depth The trace rule whose header matches the current event The predicate used when entering, exiting, or failing a predicate action
For more information and specific instructions for determining the level of granularity for your trace results, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Tuning rules
The following list describes suggested techniques for tuning rules. v Write rules to drop unneeded events immediately (as one of the first rules encountered so that events do not have to process through all rules in the rule base). v Use the commit_action, commit_rule, and commit_set rule language predicates frequently. v Monitor the number of rule timers used. v When writing rules, limit the use of the following predicates: all_instances all_duplicates generate_event predicates For detailed information about tuning rules, refer to the IBM Tivoli Enterprise Console Rule Developers Guide.
Problems with the RIM database

The following commands are useful tools for troubleshooting problems with the RIM database. For additional information about the RIM commands, refer to the Tivoli Management Framework Reference Manual. wrimtest Verifies the connectivity and functionality of a RIM object as follows:
wrimtest l tec
Use the wrimtest command to connect to a specified database and run RIM methods.
89
wlookup RIM Displays a list of available RIM objects as follows:

wlookup ar RIM
wrimtrace Enables or disables tracing for RIM objects. The contents of the Inter-Object Message (IOM) packets are passed between the RIM object and client program. RDBMS errors are then printed to the RIM log file. Note: The RIM tracing function is intended for debugging purposes. If enabled for extended periods of time, tracing can decrease performance and considerably slow the processing of RIM calls. For additional information about RIM Troubleshooting, refer to the Tivoli Management Framework Users Guide and the Tivoli Management Framework Maintenance and Troubleshooting Guide. Additional information about troubleshooting RIM problems and RIM tuning can be found in the Using Databases with Tivoli Applications and RIM redbook.
Analyzing Tivoli Management Framework trace logs

The Tivoli Management Framework product supports an object tracing mode that records in a log file either all operations or only those operations that fail. Use the wtrace log file to diagnose problems. The wtrace command extracts information used to debug methods and diagnose problems in custom methods and executable files. The wtrace command examines the method input, transactions, and method output. The wtrace log file provides detailed information and should be used in conjunction with an odstat command listing option. The odstat command lists the status of current and recent object calls. The odstat service status command displays the currently running operations and the previous 200 operations for a specific managed node. You can find an error in the odstat command listing and use the thread ID associated with it to find additional information in a wtrace log file. Using the odstat command results in more explicit way to view the output data from the wtrace command. For more information about Tivoli Management Framework trace logs, refer to the Tivoli Management Framework Maintenance and Troubleshooting Guide. For information about using the wtrace and the odstat commands, refer to the Tivoli Management Framework Reference Manual.
Problems with the Tivoli Enterprise Console gateway

This section describes how to troubleshoot problems with the tec_gateway and the tec_gwr programs of the Tivoli Enterprise Console gateway.
Problems with the tec_gateway program

To troubleshoot problems with the tec_gateway program, you can configure tracing for the tec_gateway process. Tracing for the tec_gateway process is controlled by one of the following files: v UNIX:
90
/etc/Tivoli/tec/.tec_gateway_diag_config v Windows: %SystemRoot%\system32\drivers\etc\Tivoli\.tec_gateway_diag_config To configure tracing for the tec_gateway process, follow these steps: 1. Edit the .tec_gateway_diag_config file to specify the level of tracing that you want. The sample .tec_gateway_diag_config file is located on the event server in the $BINDIR/../generic_unix/TME/ACF_REP directory. By default, the .tec_gateway_diag_config file looks similar to the following:
Highest_level error Truncate_on_restart true # tec_gateway ############# tec_gateway Highest_level error tec_gateway GW_Send error /tmp/tec_gateway tec_gateway State_Correlator error /tmp/tec_gateway
Both Highest_level keywords set the highest trace level possible within the following sections in the file. The tracing levels from least verbose to most verbose are: error warning trace0 trace1 trace2 The Truncate_on_restart keyword specifies whether or not trace files are truncated to zero bytes when the tec_gateway process starts up. 2. Distribute a gateway configuration profile with the Adapter Configuration Facility. Note: If you have upgraded from a previous release of the Tivoli Enterprise Console product, the Distribution tab for existing gateway configuration profiles is not updated with the .tec_gateway_diag_config file. If you want to enable tracing, you must delete the existing gateway configuration profile and distribute a new gateway configuration profile. Set tracing on to determine the cause of a problem. Otherwise, disable tracing or set tracing at the error level. If you are distributing a gateway configuration profile and you want to disable tracing, delete the .tec_gateway_diag_config file from the gateway configuration profile. If you have already distributed the .tec_gateway_diag_config file and you want to disable tracing, delete the .tec_gateway_diag_config file manually from the Tivoli Enterprise Console gateway.
Problems with the tec_gwr program

To troubleshoot problems with the tec_gwr program, follow these steps: 1. Stop all tec_gwr processes currently running on the machine. 2. Type the following command to cold start the tec_gwr program:
tec_gwr [-d] [-c configuration_file]
Where:
91
Starts the tec_gwr program in debug mode.
c configuration_file Specifies the location of the Tivoli Enterprise Console gateway configuration file. If you do not specify this parameter, the tec_gwr program searches one of the following directories to locate the tec_gateway.conf configuration file. v UNIX: /etc/Tivoli/tec/tec v Windows: \WINNT\system32\drivers\etc\Tivoli\tec 3. Ensure that no other processes are listening on the reception port. To determine if the reception port is in use, type the following command:
netstat a | grep port_number
Where port_number is the port that the tec_gwr program uses to receive events. The first process to start on a port uses the port, and subsequent processes cannot receive events from that same port. 4. Use the postzmsg or the postemsg command to send events to the tec_gwr program for testing.
Problems with the Web version of the event console

If you experience problems with the Web version of the event console, you can create trace files that IBM Customer Support can use to determine the cause of the problem. To create the trace files, use the following general procedure from the WebSphere Application Server Administrative Console. The following procedure describes the information that is relevant to the Tivoli Enterprise Console product. For specific information about the IBM WebSphere Application Server product, refer to the online help in the WebSphere Application Server Administrative console and the IBM WebSphere Application Server product documentation, which you can access from the WebSphere InfoCenter at the following Web site: http://www-3.ibm.com/software/webservers/appserv/library/index.html 1. From the WebSphere Application Server Administrative console, navigate to Troubleshooting > Logs and Trace. 2. Select your server. The default name is server1. 3. Select Diagnostic Trace. 4. Do one of the following: v Select the Configuration tab to change the trace settings that are stored in the WebSphere Application Server configuration files. v Select the Runtime tab to change the trace settings of the currently running WebSphere Application Server. The Runtime tab contains the Save Trace option, which saves your settings in the WebSphere Application Server configuration files so that the changes remain in effect the next time the WebSphere Application Server is started. 5. In the Trace Specification field, click Modify. The Trace Service page is opened in a new window. 6. Select the Components tab on the Trace Service page. 7. On the Trace Service page, expand the com.tivoli.tec and the com.tivoli.tec.wc components. The following trace files are useful to IBM Customer Support:
92
v v v v
com.tivoli.paa.jdbc.util.AbstractJDBC com.tivoli.tec.rimds.RIMJDBCProv com.tivoli.tec.wc.TecTrace com.tivoli.tec.wc.jca.TECResAdap
Note: The com.tivoli.tec.wc.TecTrace file produces a large amount of data. 8. Select a trace file group or an individual trace file name to specify the level of tracing you want. 9. Optionally, change the maximum trace file size and the number of old trace files to maintain in the Trace Output field on the Runtime tab. 10. Click Save on the taskbar.
Problems with performance

No two work environments are the same and there are typically many things an administrator can do to tune the environment for optimal performance. As a starting point, the following items should be considered when tuning your environment: v Attempt to tune first at the source. Tuning the sources that send events, such as filtering at the adapter level, can reduce unnecessary network traffic. For information about filtering at the adapter level, refer to the IBM Tivoli Enterprise Console Adapters Guide. Ensure that the Tivoli region and the Tivoli Enterprise Console product reside on separate machines, free of other major processes. Ensure that the Tivoli Enterprise Console database resides on a separate machine. Do not run event consoles on the Tivoli server or the UI server. Avoid shutting down the database while the Tivoli Enterprise Console product is running. Tuning RDBMS The RDBMS server can be tuned for locking and recovery considerations that can impact the performance of the Tivoli Enterprise Console product. For more information about database configuration and tuning the RDBMS server, see the IBM Tivoli Enterprise Console Installation Guide.
v v v v v
To check RDBMS error logs, see Problems with the RIM database on page 89. v Use filters and rules to view only required events. For optimal performance, avoid the following practices: v Attempting to monitor everything possible in an environment v Attempting to dump everything possible to a central log file v Inefficient rules v Improper event handling
Configuring the event database

The Tivoli Enterprise Console product offers automated database vendor configuration options to customize your event database application for optimal performance.
93
The following tables are the largest, most frequently accessed Tivoli Enterprise Console tables: TEC_T_EVT_REP TEC_T_EVT_TEC_LOG TEC_T_SLOTS_EVT These tables frequently read, insert, delete, and update information and therefore require indexes so that rows can be quickly returned to the application. For example, if each of the tables and their indexes are split across six different input/output (I/O) devices, they will not encounter I/O contention from the read/write (R/W) head on the device. Database transaction logs operate more efficiently when placed on their own I/O device. Use higher performance devices for index tables, temporary work areas, and transaction logs to provide optimal results when updating and retrieving data. If you cannot attain these specifications, you can achieve optional performance improvements by combining various tables and indexes across available I/O devices so that tables accessed less frequently are mixed with frequently-accessed table and data table operations are split from index table operations. After the TEC_T_EVT_REP, the TEC_T_EVT_TEC_LOG, and the TEC_T_SLOTS_EVT tables, the TEC_T_TASK_REP table is the next most frequently accessed table in the event server. This table contains an index for performance, as do most Tivoli Enterprise Console tables. A row cannot be inserted into the TEC_T_EVT_REP or the TEC_T_SLOTS_EVT tables unless the row has a parent row in the TEC_T_EVT_REP table. Referential integrity is therefore established on these tables so that a row deleted from the TEC_T_EVT_REP table causes rows in the two tables with the same server handle, event handle, and date reception, to be deleted. Referential integrity enhances data integrity by speeding up the deletion process. The event console tables are small and usually contain a LONG or a text column. These columns store a descriptor in the table pointing to the actual location of the data. The event console tables are only updated during the event console configuration processes, such as creating consoles, assigning operators and event groups, creating filters, or assigning console preferences. In cases where there are large numbers of consoles, operators, event groups, and filters, these tables contain indexes that enhance performance. The TEC_T_CONSOLES, the TEC_T_EVENT_GROUPS, and the TEC_T_OPERATORS tables are the base tables for storing event console information. The TEC_T_ASSIGN_OP, the TEC_T_ASSIGN _EG, and the TEC_T_EG_WHRCLAUS tables provide data needed for correlation to determine which operators and event groups are assigned to which event consoles and which event filters are assigned to which event groups. A row in these tables can only exist if a corresponding row also exists in the parent table. Referential integrity ensures that a row deletion from a parent table deletes the corresponding row in the child table. These tables can be installed on the same I/O device because these tables have less frequent I/O requests. The TEC_T_ISA and the TEC_T_ENUMERATIONS tables are cleared and reloaded when the Tivoli Enterprise Console product starts but are subsequently read on an infrequent basis. The TEC_T_ARCHIVE table is installed in the event database when the TDS Tivoli Enterprise Console Event Management Guide is installed and is only updated when events are closed. Therefore, the table has less frequent I/O requests. These tables are all good candidates to install on the same I/O device as with the other more active tables for a mix of workload types.
94
For more information about automated event database configuration using the event database installation assistant, refer to the IBM Tivoli Enterprise Console Installation Guide.
Additional information sources

This section lists information sources that discuss troubleshooting and experience with the administration of the Tivoli Enterprise Console product. The Web sites listed in this section were current at the time of this publication. v Tivoli Field Guides for Technical Issues Tivoli Field Guides for technical issues are white papers and scripts written by Tivoli software developers and customers. The papers address complex technical scenarios or concepts, such as the following: Endpoint Mobility Migration Heartbeat Monitoring in Large Environments Using Precompiled Fact Files Within the Rule Base Getting the Most out of Traces Endpoint Policy Issues Tivoli Field Guides for Technical Issues are located at the following Web site:
http://www-3.ibm.com/software/sysmgmt/products/support/Field_Guides_Technical.html
v Tivoli Field Guides for Business Issues Tivoli Field Guides for Business Issues are white papers written by Tivoli software developers and customers that are designed to address specific business practices and have a high impact on the success or failure of an Enterprise System Management (ESM) project. The business papers include the following topics: Change Management Asset Management Project Management Developing Requirements Building a Case for a Test Environment Going for the Quick Win
Understanding the Phases of Development Tivoli Field Guides for Business Issues are located at the following Web site:
http://www-3.ibm.com/software/sysmgmt/products/support/Field_Guides_Business.html
v Tivoli Customer Support Knowledge Base (Ask Tivoli) Tivoli software customers can access a Web-based support tool called Ask Tivoli to search the support knowledge base for resolution of issues with Tivoli products. You can search multiple databases simultaneously for information from redbooks, white papers, Release Notes, and Tivoli Service Desk (TSD) for Customer Relationship Management (CRM) solutions. The solutions accessed from the Tivoli Customer Support Knowledge Base are developed by the Tivoli product support staff and have been reviewed to assure validity and accuracy.
95
Solutions provided through the Ask Tivoli tool are located at the following Web site: http://www-3.ibm.com/software/sysmgmt/products/support/ Ask Tivoli Frequently Asked Questions (FAQ) Tips and instructions for using the Ask Tivoli tool on the Tivoli Customer Support Knowledge Base are located at the following Web site:
http://www-3.ibm.com/software/sysmgmt/products/support/Support_Site_FAQ.html
v TME10 Mailing List The TME10 mailing list is an e-mail list, which is read and posted to by over 1 200 subscribers around the world. Members subscribing to TME10 listserv are those who create, maintain, support, and use Tivoli software. Members share experiences and ask questions. Access to the TME10 mailing list is controlled. You can subscribe to the TME10 mailing list at the following Web site:. http://publib-b.boulder.ibm.com/Redbooks.nsf/Portals/TivoliCustom1 v Rule Writing Developing Tivoli Enterprise Console rules requires considerable skill and knowledge. Proper rule writing and sharing rule writing experience with others can help increase the power and performance of the Tivoli Enterprise Console product. You can find articles on rule writing topics, such as rule writing and tuning, multiple inheritance in BAROC, and how to use assertion lists with rules at the following Web site: http://www.orb-data.com The communication on the referenced Web sites is primarily customer experience and dialog and is not intended to replace IBM Customer Support. For information about contacting IBM Customer Support, see Contacting software support on page vii.
96
Appendix B. Messages
This appendix describes messages related to using the Web version of the event console.
ECOWEP001E An error occurred when retrieving event details from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEP002E The cause events cannot be retrieved from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEP003E The effect events cannot be retrieved from the event server database. Retry the operation or close the Event Properties window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV001E The events cannot be retrieved from the event server database. Refresh the event viewer. Explanation: The event server retrieves events from a database when an event viewer is displayed for the first time or when the list of events shown in an existing event viewer is refreshed. If the events cannot be retrieved, the event group definition might not be correct or the connectivity to the event server database might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV002E The status of the event cannot be updated. Refresh the event viewer. Explanation: The event server updates the status of an event on a database when an action is submitted from an event viewer. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWEV003I A trouble ticket has been opened for the selected events. Explanation: No additional information is available for this message. ECOWEV004E A trouble ticket cannot be opened for the selected events. Explanation: Possible causes for this problem include the following: v You might not have the appropriate authorization role to open a trouble ticket. Either admin or user role is required. v A problem exists with the trouble ticket integration software.
97
ECOWEV005E ECOWPV003I
Operator Response: Contact the administrator of the event server. ECOWEV005E The trouble ticket integration program for the selected events did not complete. Explanation: The trouble ticket integration program, which is supplied by the IBM Tivoli Enterprise Console, integrates your problem reporting software with the IBM Tivoli Enterprise Console. Operator Response: Contact the administrator of the event server. ECOWEV006W Do you want to exit this event viewer? Explanation: This message confirms whether or not you want to exit the event viewer. Operator Response: If you want to exit the event viewer, click Exit. If you do not want to exit the event viewer, click Cancel. ECOWEV007E The details for the selected event cannot be retrieved from the event server. The action associated with the customized button cannot run. Explanation: When you click a customized button, the full set of event details for the selected event is retrieved from the event server. If the communication with the event server fails, the action associated with the customized button cannot run. Operator Response: Contact the administrator of the event server. ECOWEV008W You have selected actual_sels events. Running the requested action against this many events results in actual_sels popup windows. Do you want to continue? Explanation: More than one event was selected when you performed an action from the event viewer. Proceeding with this action will result in a popup window for each of the selected events. This message confirms whether or not you want to continue with the action. Operator Response: If you want to continue with the action, click Continue. If you do not want to continue with the action, click Cancel. ECOWEV009W You have selected actual_sels events. Running the requested action against this many events results in a heavy processing load on the event server. Do you want to continue? Explanation: See message. This message confirms whether or not you want to continue with the action. Operator Response: If you want to continue with the action, click Continue. If you do not want to continue with the action, click Cancel. ECOWGE001E An internal error has occurred. Explanation: Your request could not be completed due to an internal error. Operator Response: Contact your administrator. Administrator Response: To determine the cause of the problem, look in the IBM Web Application Server log files. ECOWPV001I The user preferences were saved. Explanation: No additional information is available for this message. ECOWPV002W Do you want to continue making changes or cancel without saving? Explanation: This message confirms whether or not you want to exit the user preferences without saving the changes. Operator Response: If you want to continue making changes to the user preferences, click Continue. If you want to cancel the changes to the user preferences, click Cancel. ECOWPV003I The user preferences cannot be saved because cookies are not enabled for your browser. Explanation: The user preferences are saved on your computer as a cookie, but the cookie option on your browser is disabled. Operator Response: To save the user preferences, change the privacy settings for your browser to accept cookies. If you do not enable the cookie option, the user preferences affect only the current session.
98
ECOWPV004I ECOWRA007W
ECOWPV004I The user preferences cannot be saved because cookies are not enabled for your browser. Do you want to exit the user preferences? Explanation: The user preferences are saved on your computer as a cookie, but the cookie option on your browser is disabled. Operator Response: To save user preferences, change the privacy settings for your browser to accept cookies. If you do not enable the cookie option, the user preferences affect only the current session. If you want to exit the user preferences, click Exit. If you do not want to exit the user preferences, click Cancel. ECOWRA001W The event group event_group_id is not recognized. Explanation: The specified event group ID does not correspond to any known event group. System Action: The command that referenced the specified event group failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA002W The event ID class_name is not recognized. Explanation: The specified event ID does not correspond to any known event ID class. System Action: The command that referenced the specified event ID failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA003W ConnectionSpec class_name is not supported. Explanation: See message. System Action: The command that specified the ConnectionSpec failed. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA004W InteractionSpec class_name is not supported. Explanation: See message. System Action: The command that specified the InteractionSpec failed. Other processing is unaffected.
Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA005W The Web console server encountered an error communicating with server server for user ID userid. Explanation: See message. System Action: The command that encountered the problem communicating with the Tivoli Management Framework failed. Other processing is unaffected. Operator Response: Contact the System Administrator. Administrator Response: The CommunicationFailureException that includes this message includes a nested exception that provides additional details about the failure. To correct the problem, use the information in the nested exception together with other Tivoli Management Framework diagnostic tools to determine why the Web console server is unable to communicate with the Tivoli Management Framework. ECOWRA006W User userid on server server is not authorized to view event data. Explanation: See message. System Action: The specified user is denied access to the Web console server. Operator Response: Contact the System Administrator. Administrator Response: Ensure that the user is defined to the Tivoli Management Framework and that the user has read access to the event server database. Then use the event console to assign the operator to an event console. ECOWRA007W The Web console server encountered an unexpected exception when logging on to the IBM Tivoli Management Framework: exception. Explanation: See message. System Action: The user is denied access to the Web console server. Operator Response: Contact the System Administrator. Administrator Response: To determine the cause of the problem, use the included exception text.
99
ECOWRA008W ECOWRA100W
ECOWRA008W The task taskName failed. pending status change for the event. The status for the event reverts to its previous value until the event is updated in the database and the caches for the Web console event data expire. Administrator Response: This message indicates that the UI server either never received the status change or it has not processed all of the status change requests. If this message occurs occasionally during periods of heavy workload on the UI server, you can ignore this message. Otherwise, determine why the UI server is having problems receiving and processing status change requests. ECOWRA053W The event data cache timeout value must be minimum_cache_time seconds or greater. The default value, default_cache_time seconds, is used. Explanation: See message. System Action: See message. Administrator Response: Change the event data cache timeout value as specified in the message. The timeout value must be specified in seconds. ECOWRA054W The event summary cache timeout value must be minimum_cache_time seconds or greater. The default value, default_cache_time seconds, is used. Explanation: See message. System Action: See message. Administrator Response: Change the event summary cache timeout value as specified in the message. The timeout value must be specified in seconds. ECOWRA100W The pending change for event event_id to status status timed out before completing. Explanation: See message. System Action: The Web console server discards the pending status change for the event. The status for the event reverts to its previous value until the event is updated in the database and the Web console event data caches expire. Operator Response: The status change for the event might have been lost before the UI server processed the request. Acknowledge or close the event again to ensure the change is processed. If this error persists, contact the System Administrator. Administrator Response: The Web console server logs message ECOWRA052 in the IBM WebSphere Application Server log file in conjunction with this message. For more information, refer to the help for message ECOWRA052.
Explanation: The Web console server could not run the task due to an internal error. System Action: The current task failed. Depending on the severity of the error, processing on other tasks might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA009W User userid does not have the role required to update events in this event group. Explanation: See message. System Action: The specified user is denied access to the actions. Operator Response: Contact your administrator. Administrator Response: Ensure that the user is defined to the Tivoli Management Framework and that the user has the appropriate roles to make updates. Then use the event console properties to assign the operator roles to an event console. ECOWRA050E An internal error has occurred.
Explanation: The Web console server has detected an internal error. System Action: The current threads processing fails. Depending on the severity of the error, processing on other threads might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRA051E The Web console server encountered a problem communicating with the event server database. Explanation: See message. System Action: The system continues to run, but communication with the event server database might not be possible. Administrator Response: An exception should have been logged along with this message. For information about how to correct this problem, refer to the help text for the message contained in the exception. ECOWRA052W The UI server has taken longer than seconds seconds to process a status change for event event_id. Explanation: See message. System Action: The Web console server discards the
100
ECOWRA101W ECOWRJ007W
ECOWRA101W action on event event_id has been skipped due to previously pending action. Explanation: See message. System Action: The Web console server skips the specified action for the event. Processing of other actions continues. Operator Response: Another operator has requested an action on the event. Open or refresh the event viewer to see the updated status of the event with the pending action. ECOWRA102W Your request could not be completed in its entirety. The events you were attempting to modify have been modified since your last refresh or were being modified by another operator. Explanation: See message. Operator Response: Open or refresh the event viewer to see the current status of the events you were attempting to modify. If your changes are still necessary, modify the events again. ECOWRJ001W Connection pool properties cannot be changed when open connections exist. Explanation: An attempt was made to change a property of the connection pool when the connection pool contained open connections. Connection pool properties can only be changed when there are no open connections. System Action: The system continues to use the previous property values. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ002E The extract directory directory_name could not be created. Explanation: The Web console server could not extract the required files to the specified directory. System Action: The Web console server continues to run, but information stored in the database is not accessible until the error is corrected. Administrator Response: This problem prevents the Web console server from accessing event data and operator console definitions that are stored in the event server database. Ensure that the operating system identity that IBM WebSphere Application Server uses has permission to create and write to the specified directory. Also, ensure that the file system has at least 8MB of free space to store the extracted files. Restart IBM WebSphere Applicaton Server to force the Web console server to retry the file extraction. ECOWRJ003E The ClassLoader URL url is not recognized. Explanation: The Web console server encountered an unrecognized URL when examining its own classloader. Administrator Response: Ensure that IBM WebSphere Application Server is using its own JRE and not an unsupported JRE. If this problem persists, contact IBM Customer Support. ECOWRJ004W The SQL AS keyword is not supported. Explanation: IBM Tivoli Enterprise Console RIM JDBC Provider does not support the SQL AS keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ005W The SQL WHERE keyword was expected but token was found instead. Explanation: The IBM Tivoli Enterprise Console RIM JDBC Provider found the specified token in the SQL query instead of the SQL WHERE keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ006W The SQL query must contain a FROM clause. Explanation: The SQL query did not contain the required SQL FROM clause. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ007W A locale was not specified in a LOCALE clause. Explanation: The LOCALE keyword was not followed by a locale specifier. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an
101
ECOWRJ008W ECOWSO001E
internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ008W A condition was not specified specified for a WHERE clause. Explanation: The SQL WHERE keyword was not followed by any conditions. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ009W An SQL query must start with the SELECT keyword. Explanation: The SQL query does not begin with the required SELECT keyword. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ010W The Column column in table table is not recognized. Explanation: The SQL query specified a column or a table that is not understood by the IBM Tivoli Enterprise Console RIM JDBC Provider. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ011W The data class class for column column is not recognized. Explanation: The internal metadata for the indicated column specifies an unrecognized data class. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ012W The Connection is no longer active. Explanation: An attempt was made to use a connection that has been closed. System Action: The erroneous SQL command failed with an exception. Other processing is unaffected. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ050E An internal error has occurred.
Explanation: The Web console server has detected an internal error. System Action: The current threads processing failed. Depending on the severity of the error, processing on other threads might also be impacted. Administrator Response: This error indicates an internal problem in the Web console server. Contact IBM Customer Support. ECOWRJ051E The Web console server encountered a problem extracting the JCF and JRIM JAR files. Explanation: The Web console server was unable to extract the required JAR files. Communication with the event server database is not possible without these files. System Action: The system continues to run, but communication with the event server database is not possible. Administrator Response: An exception should have been logged along with this message. Refer to the help text for the message contained in that exception for additional information. ECOWRJ052E The Web console server encountered a problem communicating with the event server database. Explanation: See message. System Action: The system continues to run, but communication with the event server database might not be possible. Administrator Response: An exception should have been logged along with this message. Refer to the help text for the message contained in that exception for additional information. ECOWSO001E An error occurred when communicating with the Tivoli managed node. Explanation: See message. Operator Response: Retry the operation. If the problem persists, contact your administrator. Administrator Response: This error indicates a problem with the connection between the Web console server, which uses the system information provided to the Web console, and the managed node. The information in the configuration preferences is used to
102
ECOWSO002E ECOWTE003E
establish a system-level connection to the managed node. If the problem occurs on a consistent basis at startup for many or all Web consoles that attempt to connect to the Web console server, verify that the following conditions are met: v The server name, the user name, and the password specified in the configuration preferences are correct. v The computer running the Web console is connected to the network, and TCP/IP is functioning correctly. v The Web console server is running. v The Web console server and any firewalls between the computer running the Web console and the Web console server are configured consistently. v The port specified for access to the Web console server is valid. v If the problem is intermittent, it might be due to network traffic or a transient network problem. If the problem seems to be related to a specific operation, contact IBM Customer Support. ECOWSO002E Authentication failed. Explanation: The user name and password specified on the logon screen are not valid. Operator Response: Enter your user name and password again, ensuring that your user name and password are spelled correctly. ECOWSO003E The bootstrap process for the Web console application failed. The Web console might not function correctly. Report this problem to your administrator. Explanation: See message. Operator Response: See message. Administrator Response: To determine the cause of the problem, look in the IBM Web Application Server log files. ECOWSO004I Your logon session has expired. Explanation: A logon session expires after a prolonged period of inactivity. Operator Response: If you want to use the Web console, log on again. ECOWSO005I Signoff is complete. Explanation: No additional information is available for this message. ECOWSV001E An error occurred when retrieving event summary data from the event server database. Retry the operation or close the View Summary of Events window. Explanation: The connection to the event server database or the event server database itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. ECOWTE001E An error occurred when retrieving task library names from the event server. Try running the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files. ECOWTE002E An error occurred when retrieving task names from the event server. Try running the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files. ECOWTE003E An error occurred when retrieving task information from the event server. Run the task again. Explanation: The connection to the event server or the event server itself might be down. Operator Response: If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server and the event server log files.
103
ECOWTE004E ECOWTE012E
ECOWTE004E An error occurred when retrieving the names of the managed nodes from the event server. Retry the operation or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE005E An error occurred retrieving the host names from the event server. Retry the operation or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE006E The attempt to check the task prior to running it on the event server failed. Run the task again or cancel the task. Explanation: The connection to the event server or the event server itself might be down. Operator Response: See message. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE007E The task failed to start on the event server. Make sure that the task can be run on the selected events, and run the task again. Explanation: The task might have failed for one of the following reasons: v An event was not selected prior to running the task. v The task cannot be run on one of the selected events. v The connection to the event server or the event server itself might be down. Operator Response: Select an event prior to running the task, or make sure that the task can be run on all of the selected events. Then run the task again. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE008W You must select a task library and a task name. Explanation: When running a task, a task library and a task name have not been selected. Operator Response: Select a task library and a task name. ECOWTE009W You must select a task name.
Explanation: When running a task, a task name has not been selected. Operator Response: Select a task name. ECOWTE010W You must select one or more target hosts. Explanation: When running a task, one or more target hosts have not been selected. Operator Response: Select one or more target hosts. ECOWTE011E The task failed because the configuration of the task is unsupported. Explanation: See message. Operator Response: Contact your administrator. Administrator Response: The layout for the task is unsupported. The Web console supports seven standard layouts: v text (0) v choice (1) v text choice (2) v choice button (3) v radio button (4) v crypto text (5) v list selector (6) ECOWTE012E Your logon session is no longer valid.
Explanation: Your session might have timed out, or you might have tried to access the Web console from a bookmark. Operator Response: Log on to the IBM Tivoli Enterprise console again.
104
ECOWTE013E ECOWUM004E
ECOWTE013E The task failed due to a shortage of resources in the Web console server. Explanation: See message. Operator Response: Run the task again. If the failure persists, contact your administrator. Administrator Response: The Web console server could not create a thread to run the task. Configure IBM WebSphere Application Server to make more resources available. ECOWTE014E The task output has not been received. Explanation: The task output was not received within the timeout period. However, the task might have completed on the event server. It is also possible that the task did not complete or was never started if the connection to the event server or the event server itself is down. Operator Response: Run the task again if doing so will not cause problems if the original task completed. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log file for problems logged by the resource adapter or the JDBC provider. Also, look in the event server log files. ECOWTE015E The task did not complete due to a problem in the Web console server. Explanation: See message. Operator Response: Run the task again. If the problem persists, contact your administrator. Administrator Response: To determine the cause of the problem, look in the Web console server log files. ECOWTE016E The task cannot run on the event source host because the event does not contain the event source host name. Explanation: A task has been configured to run on the event source host in one or more events. However, the hostname slot in one or more of the events does not contain the event source host name. Operator Response: Run the task on the appropriate host instead of on the event source host. ECOWTE017W Do you want to exit the task wizard? Explanation: This message confirms whether or not you want to exit the task wizard. Operator Response: If you want to exit the task wizard, click Exit. If you do not want to exit the task wizard, click Cancel. ECOWTE018W Do you want to continue? Explanation: This message confirms whether or not you want to cancel this operation in the task wizard. Operator Response: If you want to continue this operation, click Continue. If you do not want to cancel this operation, click Cancel. ECOWUM001E You are not authorized the run the action_name action on the selected item number sel_row. Explanation: You must log on with the appropriate authorization to run this action. Operator Response: Contact your adminstrator to get the appropriate authorization. ECOWUM002E You have selected actual_sels items. You must select needed_sels to run the action_name action. Explanation: Each action requires that you select a specific number of items. Operator Response: Select the appropriate number of items and retry the action. ECOWUM003E Because you are not authorized the run the action_name action on some of the selected items, the action has not been run on any of the selected items. Explanation: You must have the appropiate authorization to run the action on all of the items you select. Operator Response: Deselect the items for which you do not have appropriate authorization and try the action again. ECOWUM004E An error occurred when running the action_name action against the selected item number sel_row. Explanation: The Web console encountered an error when communicating with the event server. Operator Response: Try the operation again. If the problem persists, contact your administrator. Administrator Response: This error indicates a problem with the connection between the Web console server, which uses the system information provided in the Web console configuration preferences, and the event server. The information in the configuration preferences is used to establish a system-level connection to the event server. If the problem persists at startup for many or all consoles that attempt to connect to the Web console server, ensure that the following conditions are met:
105
v The server name, user name, and password specified in the configuration preferences are correct. v The computer running the Web console is connected to the network, and TCP/IP networking is functioning correctly. v The Web console server is running. v The Web console server and any firewalls between the computer running the Web console and Web console server are configured consistently. If the problem is intermittent, it might be due to network traffic or a transient network problem. If the problem seems to be related to a specific operation, contact IBM Customer Support.
106
Notices
This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the users responsibility to evaluate and verify the operation of any non-IBM product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.
107
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBMs application programming interfaces.
Trademarks
IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, AS/400, DB2, NetView, Tivoli Enterprise, Tivoli Enterprise Console, TME, TME 10, Tivoli Management Environment, and WebSphere are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries, or both.
108
Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.
Microsoft and Windows NT are registered trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of the Open Group in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others.
Notices
109
110
Index Special characters

.tec_diag_config file 15 ButEvtPath keyword 69
C A
ACK event status 51 acknowledging events event console (Java version) 54 event console (Web version) 61 from the command line 54 acl event attribute 21 adapter backup event server 5 buffering events 5 configuring 22 description 4 non-TME 5 secondary event server 5 source changing 23 creating 23 deleting 24 source name 23 Tivoli Event Integration Facility 6 TME 5 Adapter Configuration Facility 4 adapter configuration profile (ACP) 76 adding custom button sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 to event console (Java version) 34 to event console (Web version) 36 AdministrativeConsole 20 AllActiveEvents event group 19 APPEND_CLASSPATH keyword 68 assigning event group 28 operator to an event console 29 attribute acl 21 EventClass 12 origin 12 severity 12 source 12 status 12 sub_origin 12 authorization roles, required 13 automated tasks Java version of the event console 55 changing event console password 39 server name 40 user ID 39 Web version, cache timeout values 41 Web version, Tivoli region definition 38 event group filter 27 properties 27 preferences event console (Java version) 57 event console (Web version) 64 severity colors event console (Java version) 58 source 23 CLOSED event status 51 closing an event event console (Java version) 56 event console (Web version) 62 from the command line 56 commands postemsg command 87 tec_console 53 tec_console.cmd 53 TroubleTicket.sh 29 wconsole 26 wcrtsrc 23 wdbmaint.sh 42 wdelsrc 24 wlookup 89 wlsemsg 54, 59 wpostemsg 86 wrb 26 wrimtest 89 wrimtrace 90 wruntask 55 wsesvrcfg 26 wsetemsg 54, 56 wsetesvrcfg 18, 26 wsetsrc 24 wstartesvr 42 wstopesvr 42 wtdbclear 42, 82 wtdumper 82 wtdumprl 17, 81 wtdumprl command 86 wtecexport 38 wtecimport 38 components adapter configuring 22 description 4 Adapter Configuration Facility 4 event adapter configuring 22 description 4
B
backup event server 5 books see publications vi buffering events 5 Copyright IBM Corp. 2003
111
components (continued) event console creating 26 description 9 differences between Web version and Java version 51 event management 51 event database backing up 42 description 8 tuning 42 event server 7 configuring 22 description 6 log files 85 performance, improving 76 processes 15 starting 42 stopping 42 relationship of 3 Tivoli Enterprise Console gateway configuration example 76 configuration file 68 configuring 22, 67 description 6, 67 event traffic, controlling 76 files 75 receiving events from non-TME adapters 74 retry, configuring 74 starting 78 status, obtaining 79 stopping 78 tec_gateway program 67 tec_gwr program 67 troubleshooting 90 Tivoli Event Integration Facility 6 UI server 8 configuration file keywords gateway ReceiveAckPort 73 Configuration view 10 configuring custom button for event console (Java version) 34 for event console (Web version) 36 sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 event adapter 22 event server logging 24 rule base 26 source list 23 source, changing 23 source, creating 23 source, deleting 24 Tivoli Enterprise Console gateway 22 conventions typeface viii copying event groups to another console from the command line 38 from the desktop 38 correlation, state 75 creating event console 26
creating (continued) event group 27 source 23 CRITICAL severity level 64 custom button configuring for event console (Java version) 34 for Web version 36 sample script for UNIX for event console (Java version) 35 sample script for Windows for event console (Java version) 34 sample servlet for event console (Web version) 36 SLOTS environment variable, use of 34 custom_status event status 51 customer support see software support vii customizing event console Java version 33 password 39 server name 40 user ID 39 Web version 33 Web version, cache timeout values 41
D
deleting event group 28 event group filter 28 source 24 directory names, notation ix dispatch engine process 18
E
EbusinessEvents event group 19 EBusinessEventsConsole 20 environment variables, notation ix event acknowledging event console (Java version) event console (Web version) from the command line 54 attributes acl 21 num_actions 18 buffering 5 closing event console (Java version) event console (Web version) from the command line 56 credibility attribute 14 database backing up 42 description 8 troubleshooting 89 tuning 42 description 14 filtering event console (Java version) event console (Web version) flow, troubleshooting 86 non-Tivoli environment 87
54 61
56 62
59 65
112
event (continued) flow, troubleshooting (continued) Tivoli environment 86 group assigning to an event console 28 copying to another console from the command line 38 copying to another console from the desktop 38 creating 27 deleting 28 description 11 filter, deleting 28 filter, modifying 27 properties, modifying 27 groups, predefined AllActiveEvents 19 EbusinessEvents 19 Maintenance 20 OpenNetView 20 OtherNetView 20 ProbableEventAssn 19 ServiceUnavailable 20 UnMonitoredEBusiness 19 information, viewing event console (Java version) 57 event console (Web version) 63 internal 14 local commands, running event console (Java version) 55 logging 7 management differences between Web version and Java version of an event console 51 key concepts 51 management, overview 52 management, planning for event group roles 21 overview 19 processing, troubleshooting event server processes 82 log files 85 wtdbclear command 82 wtdumper command 82 wtdumprl command 81 properties, viewing event console (Java version) 57 event console (Web version) 63 severity 52 sorting event console (Java version) 59 event console (Web version) 65 source 4 starting the Tivoli NetView component 56 states PARSING_FAILED 17 PROCESSED 17 QUEUED 17 WAITING 17 states, reception process 17 status ACK 51 CLOSED 51 custom_status 51 OPEN 51 RESPONSE 52 summary, viewing event console (Web version) 62
event (continued) task, running event console (Java version) 54 event console (Web version) 62 from the command line 55 traffic, controlling 76 trouble ticket criteria, defining 30 trouble ticket, opening event console (Java version) 56 event console (Web version) 62 updating from a trouble ticket 32 viewing event console (Java version) 54 event console (Web version) 61 from the command line 54 event adapter backup event server 5 buffering events 5 configuring 22 description 4 example 44, 47 non-TME 5 secondary event server 5 source changing 23 creating 23 deleting 24 source name 23 Tivoli Event Integration Facility 6 TME 5 event console assigning operator to 29 creating 26 definitions exporting and importing 38 event group assigning 28 creating 27 deleting 28 filter 27 properties 27 event group filter deleting 28 event management differences between Web version and Java version key concepts 51 Java version acknowledging events 54 automated tasks 55 Configuration view 10 creating 26 custom button, configuring 34 custom button, description 33 custom button, sample script for UNIX 35 custom button, sample script for Windows 34 description 9 event information, viewing 57 event properties, viewing 57 event, closing 56 events, filtering 59 events, sorting 59 exiting 54 features 9 local commands, running 55 preferences, changing 57 preferences, customizing 33 Priority view 10 Index
51
113
event console (continued) Java version (continued) severity colors, changing 58 starting 53 starting the Tivoli NetView component 56 Summary Chart view 10 task, running 54 trouble ticket, opening 56 viewing events 54 operator creating 29 predefined AdministrativeConsole 20 EBusinessEventsConsole 20 trouble ticket system, integrating description 29 trouble ticket rules, customizing 30 trouble ticket system, integrating with rules trouble ticket, generating automatically 31 updating events from a trouble ticket 32 Web version acknowledging events 61 cache timeout values, changing 41 creating 26 custom button, configuring 36 custom button, description 33 description 9 event information, viewing 63 event properties, viewing 63 event summary, viewing 62 event, closing 62 events, filtering 65 events, sorting 65 exiting 61 features 10 messages 97 overview 59 password 39 performance tuning 41 preferences, changing 64 preferences, customizing 33 sample servlet 36 server name 40 signing off 61 signing on 61 starting 61 task, running 62 Tivoli region definition, managing 38 trouble ticket, opening 62 troubleshooting 92 user ID 39 viewing events 61 event database backing up 42 description 8 RIM description 8 troubleshooting 89 tuning 42 event group assigning to an event console 28 copying to another event console from the command line 38 from the desktop 38 creating 27 deleting 28 description 11
event group (continued) example 48 filter 11 modifying 27 filter, deleting 28 management, planning for 20 modifying properties 27 predefined AllActiveEvents 19 EbuisnessEvents 19 Maintenance 20 OpenNetView 20 OtherNetView 20 ProbableEventAssn 19 ServiceUnavailable 20 UnMonitoredEBusiness 19 roles planning for 21 worksheet 21 worksheet 20 event group filter example 48 event group role defined 13 examples 48 event management differences between Web version and Java version of an event console 51 key concepts event severity 52 event status 51 overview 52 event server backup 5 configuring logging 24 source list 23 source, changing 23 source, creating 23 source, deleting 24 description 6 example 47 log files 85 logging incoming events 7 performance, improving 76 processes dispatch engine 18 master 15, 16 reception engine 16 rule engine 18 task engine 18 tec_dispatch 18 tec_reception 16 tec_rule 18 tec_server 15, 16 tec_task 18 rule base 26 rules common problems 88 debugging 88 description 7 tracing 88 tuning 89 secondary 5 starting 42 stopping 42
114
event states described 17 event-type differentiation, example 50 events states 17 EventSendThreshold keyword 69 example event adapter 44, 47 event group 48 event server 47 event-type differentiation 50 geographic differentiation 49 organizational differentiation 50 system management differentiation 50 examples custom button sample script for event console (Java version) in UNIX 35 sample script for event console (Java version) in Windows 34 sample servlet for event console (Web version) 36 Tivoli Enterprise Console gateway configuration 76 trouble ticket event criteria 31 exiting event console Java version 54 Web version 61 exporting event console definitions exporting and importing from the command line 38 exporting and importing from the desktop 38 from the desktop 38
gateways, IBM Tivoli Enterprise Console (continued) state machines, running 76 GatewaySendInterval keyword 70 GatewayTMEAckEnabled keyword 70 geographic differentiation, example 49 gwr_ActiveConnections keyword 70 gwr_ActiveConnectionsSafety keyword 70 gwr_Enable keyword 71 gwr_OptionPortNotAvailable keyword 71 gwr_ReceptionPort keyword 71 gwr_ReceptionTestMode keyword 71 gwr_RetryCount keyword 71 gwr_RetryInterval keyword 71 gwr_ServerLocation keyword 71 gwr_ServerPort keyword 71 gwr_ServiceServer keyword 71 gwr_SubmissionTestMode keyword 72
H
HARMLESS severity level 65
I
icons event server ix profile ix rule base ix information sources, additional internal events 14
95
F
FATAL severity level 64 files .tec_diag_config 15 $BINDIR/TME/TEC/.ui_server_diag_config 8 for non-TME adapters init.tec_gwr 75 sctgwr.exe 75 tec_gwr.cfg 75 tec_gwr.exe 75 tec_dispatch 15 tec_gateway.conf 68 tec_master 15 tec_rule 15 tec_task 15 Tivoli Enterprise Console gateway configuration trace for event console (Web version) 92 Tivoli Management Framework 90 troubleticket.rls 29 filter, event group 11 filtering events event console (Java version) 59 event console (Web version) 65 testing 76
L
local commands, running event console (Java version) logging changing defaults 24 logging events 7 55
M
Maintenance event group 20 managing events differences between Web version and Java version of an event console 51 event severity 52 event status 51 management, overview 52 Tivoli region definitions for event console (Web version) 38 manuals see publications vi master process 15, 16 MaxGWCacheSizeMegs keyword 72 messages 97 MINOR severity level 64 modifying event group filter 27 properties 27 monitoring source 4, 6
68
G
GatewayAckInterval keyword 70 GatewayQueueSize keyword 70 gateways, IBM Tivoli Enterprise Console running state machines 75
Index
115
N
newsgroups vii non-TME interface 5 notation environment variables ix path names ix typeface ix num_actions attribute 18
Q
QUEUED event state 17
R
ReceiveAckPort keyword 73, 76 ReceiveEventPort keyword 73, 76 reception buffer 18 reception engine process 16 RESPONSE event status 52 RetryInterval keyword 72 RIM description 8 troubleshooting 89 roles differences 13 event group 13 required roles 13 RIM_update 13 RIM_view 13 Tivoli 13 Tivoli authorization 13 user 13 rule base operations 26 rule engine action 18 event under analysis 18 process 18 rules common problems 88 debugging 88 description 7 tracing 88 tuning 89 running tasks event console (Java version) 54 event console (Web version) 62 from the command line 55
O
online publications accessing vi OPEN event status 51 OpenNetView event group 20 operator assigning to an event console 29 creating 29 operators 13 roles 13 ordering publications vii organizational differentiation, example 50 OtherNetView event group 20 overview event management for key e-business applications highlights of this release 1 product description 1 unified system and network management 1
P
PARSING_FAILED event state 17 path names, notation ix performance practices to avoid 93 performance, tuning event console (Web version) 41 IBM WebSphere Application Server configuration planning for event management event group worksheet 20 event group roles worksheet 21 overview 19 postemsg command 87 preferences, changing event console (Java version) 57 event console (Web version) 64 PREPEND_CLASSPATH keyword 72 Priority view 10 ProbableEventAssn event group 19 PROCESSED event state 17 processes master 16 tec_dispatch 18 tec_reception 16 tec_rule 18 tec_server 15, 16 tec_task 18 tec_ui_server 8 profile, tec_gateway_sce 76 publications accessing online vi ordering vii
41
S
secondary event server 5 SendAckPort keyword 73, 76 SendEventPort keyword 73, 76 ServerLocation keyword 73 ServerPort keyword 74 ServiceUnavailable event group 20 severity colors, changing event console (Java version) 58 severity level CRITICAL 64 FATAL 64 HARMLESS 65 MINOR 64 UNKNOWN 65 WARNING 64 severity of events 52 SLOTS environment variable 34 software support contacting vii sorting events event console (Java version) 59 event console (Web version) 65 source changing 23
116
source (continued) creating 23 defined 4 deleting 24 names for 23 source list, updating 23 starting event console (Java version) from the command line 53 from the Windows task bar 53 event console (Web version) 61 Tivoli Enterprise Console gateway manually 78 Tivoli NetView functions 56 state correlation 75 running state machines 75 tec_gateway_tstate profile 76 testing 76 state machines gateways, IBM Tivoli Enterprise Console 76 running 75 status, Tivoli Enterprise Console gateway 79 stopping Tivoli Enterprise Console gateway 78 Summary Chart view 10 summary of events event console (Web console) 62 system management differentiation, example 50
T
task engine process 18 task, running event console (Java version) 54 event console (Web version) 62 from the command line 55 tasks automated using Java version 55 tec_console command 53 tec_console.cmd command 53 tec_dispatch log file 15 tec_dispatch process 18 tec_gateway program description 67 tracing, controlling 90 troubleshooting 90 tec_gateway_sce profile 76 tec_gateway_tstate profile 76 tec_gateway.conf file 68 tec_gwr program description 67 troubleshooting 91 tec_master log file 15 tec_reception process 16 tec_rule log file 15 tec_rule process 18 tec_server process 16 tec_server processes 15 tec_task log file 15 tec_task process 18 tec_ui_server process 8 testing event filtering 76 state correlation 76 Tivoli Enterprise Console gateway benefits 6
Tivoli Enterprise Console gateway (continued) configuration file APPEND_CLASSPATH keyword 68 BufEvtPath keyword 69 description 68 EventSendThresold keyword 69 GatewayAckInterval keyword 70 GatewayQueueSize keyword 70 GatewaySendInterval keyword 70 GatewayTMEAckEnabled keyword 70 gwr_ActiveConnections keyword 70 gwr_ActiveConnectionsSafety keyword 70 gwr_Enable keyword 71 gwr_OptionPortNotAvailable keyword 71 gwr_ReceptionPort keyword 71 gwr_ReceptionTestMode keyword 71 gwr_RetryCount keyword 71 gwr_RetryInterval keyword 71 gwr_ServerLocation keyword 71 gwr_ServerPort keyword 71 gwr_ServiceServer keyword 71 gwr_SubmissionTestMode keyword 72 MaxGWCacheSizeMegs keyword 72 PREPEND_CLASSPATH keyword 72 ReceiveAckPort keyword 73 ReceiveEventPort keyword 73 RetryInterval keyword 72 SendAckPort keyword 73 SendEventPort keyword 73 ServerLocation keyword 73 ServerPort keyword 74 configuring 22 description 67 event traffic, controlling 76 example 76 receiving events from non-TME adapters 74 retry 74 description 6, 67 starting manually 78 status, obtaining 79 stopping 78 troubleshooting 90 Tivoli Event Integration Facility 6 Tivoli NetView, starting 56 Tivoli region definition adding for event console (Web version) 38 changing for event console (Web version) 38 deleting for event console (Web version) 38 Tivoli roles, required 13 Tivoli Software Information Center vi TME interface 5 trouble ticket event criteria, defining 30 opening from event console (Java version) 56 opening from event console (Web version) 62 trouble ticket system integrating with rules customizing the rules 30 description 29 trouble ticket, generating automatically 31 updating events from a trouble ticket 32 troubleshooting event database 89 event flow 86 non-Tivoli environment 87 Tivoli environment 86 Index
117
troubleshooting (continued) event processing event flow 86 event flow in a non-Tivoli environment 87 event flow in a Tivoli environment 86 event server processes 82 log files 85 wtdbclear command 82 wtdumper command 82 wtdumprl command 81 getting started 81 information sources 95 performance 93 performance, practices to avoid 93 problems starting the Tivoli Enterprise Console product 87 RIM 89 rules common problems 88 debugging 88 tracing 88 tuning 89 tec_gateway program 90 tec_gwr program 91 Tivoli Enterprise Console gateway 90 trace logs, creating for event console (Web version) 92 Tivoli Management Framework 90 tuning 93 troubleticket.rls file 29 TroubleTicket.sh command 29 typeface conventions viii
W
WAITING event state 17 WARNING severity level 64 wconsole command 26 wcrtsrc command 23 wdbmaint.sh command 42 wdelsrc command 24 wlookup command 89 wlsemsg command 54, 59 worksheet event group 20 event group roles 21 wpostemsg command 86 wrb command 26 wrimtest command 89 wrimtrace command 90 wruntask command 55 wsessvrcfg command 26 wsetemsg command 54 wsetesvrcfg command 18, 26 wsetsrc command 24 wssetmsg command 56 wstartesvr command 42 wstopesvr command 42 wtdbclear command 42, 82 wtdumper command 82 wtdumprl command 17, 81, 86 wtecexport command 38 wtecimport command 38
U
UI server $BINDIR/TME/TEC/.ui_server_diag_config log file description 8 UNKNOWN severity level 65 UnMonitoredEBusiness event group 19 user interface server see UI server 8 users operators 13 UseStateCorrelation keyword 76 8
V
variables, notation for ix viewing event information event console (Java version) 57 event console (Web version) 63 event properties event console (Java version) 57 event console (Web version) 63 events event console (Java version) 54 event console (Web version) 61 from the command line 54 events, summary of event console (Web version) 62
118
Printed in U.S.A.
SC32-1235-00

Tivoli Enterprise Console - Guia Do Usuário

Caricato da

Informazioni sul documento

Descrizione originale:

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Tivoli Enterprise Console - Guia Do Usuário

Caricato da

Copyright:

Formati disponibili

IBM Tivoli Enterprise Console

IBM Tivoli Enterprise Console

Chapter 3. Sample IT environment with configuration examples . . . . . . . 43

Chapter 4. Managing events

Chapter 2. Configuring the Tivoli Enterprise Console product. . . . . . 19

Viewing event properties . . . Customizing the event viewer .

Chapter 5. Tivoli Enterprise Console gateway . . . . . . . . . . . . . . 67

Appendix B. Messages . . . . . . . . 97 Notices . . . . . . . . . . . . . . 107

IBM Tivoli Enterprise Console: Users Guide

About this guide

Who should read this guide

IBM Tivoli Enterprise Console library

Copyright IBM Corp. 2003

Accessing publications online

IBM Tivoli Enterprise Console: Users Guide

Contacting software support

About this guide

Conventions used in this guide

IBM Tivoli Enterprise Console: Users Guide

v Values for arguments or command options

Operating system-dependent variables and paths

IBM Tivoli Enterprise Console icons

Profile A profile is a collection of application-specific data.

About this guide

IBM Tivoli Enterprise Console: Users Guide

Highlights of the 3.9 release

Unified system and network management

Optimized event management for key e-business applications

IBM Tivoli Enterprise Console: Users Guide

Components of the Tivoli Enterprise Console product

User interface server Web browser

Event console (Web version)

Event console (Java version)

Tivoli NetView component

WebSphere Application Server

State correlation rules

Tivoli Enterprise Console gateway

Event Integration Facility Event Integration Facility

Event Integration Facility

Event sources (TME and non-TME)

Event Integration Facility

Figure 1. Tivoli Enterprise Console components

Adapter Configuration Facility

IBM Tivoli Enterprise Console: Users Guide

System Resource or Application

Figure 2. Event flow from an event adapter

Event source buffering

Secondary event servers

Tivoli Event Integration Facility

Tivoli Enterprise Console gateway

IBM Tivoli Enterprise Console: Users Guide

Logging incoming events

User interface server

IBM Tivoli Enterprise Console: Users Guide

Java version of the event console

Web version of the event console

IBM Tivoli Enterprise Console: Users Guide

IBM Tivoli Enterprise Console: Users Guide

Required Tivoli authorization roles

Creating, modifying, or loading Rule base rule bases

IBM Tivoli Enterprise Console: Users Guide

Incoming Tivoli events