ibm tivoli enterprise console: user.s...

IBM Tivoli Enterprise Console

User’s GuideVersion 3.9

SC32-1235-00

��

NoteBefore using this information and the product it supports, read the information in “Notices” on page 107.

First Edition (August 2003)

This edition applies to version 3 release 9 of IBM Tivoli Enterprise Console (product number 5698-TEC) and to allsubsequent releases and modifications until otherwise indicated in new editions.

© Copyright International Business Machines Corporation 2003. All rights reserved.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

About this guide . . . . . . . . . . . vWho should read this guide . . . . . . . . . vPublications . . . . . . . . . . . . . . v

IBM Tivoli Enterprise Console library . . . . . vRelated publications . . . . . . . . . . viAccessing publications online . . . . . . . viOrdering publications . . . . . . . . . . vii

Contacting software support . . . . . . . . viiParticipating in newsgroups. . . . . . . . . viiConventions used in this guide . . . . . . . viii

Typeface conventions . . . . . . . . . . viiiOperating system-dependent variables and paths ix

IBM Tivoli Enterprise Console icons . . . . . . ix

Chapter 1. Overview . . . . . . . . . 1Highlights of the 3.9 release . . . . . . . . . 1

Unified system and network management . . . 1Optimized event management for key e-businessapplications. . . . . . . . . . . . . . 2

Components of the Tivoli Enterprise Console product 3Adapter Configuration Facility . . . . . . . 4Event adapter . . . . . . . . . . . . . 4Tivoli Event Integration Facility . . . . . . . 6Tivoli Enterprise Console gateway . . . . . . 6Tivoli NetView . . . . . . . . . . . . 6Event server . . . . . . . . . . . . . 6Event database . . . . . . . . . . . . 8User interface server . . . . . . . . . . . 8Event console . . . . . . . . . . . . . 9

Events . . . . . . . . . . . . . . . . 14Internal events . . . . . . . . . . . . 14Event flow. . . . . . . . . . . . . . 15

Chapter 2. Configuring the TivoliEnterprise Console product. . . . . . 19Planning for event management . . . . . . . 19

Predefined event groups . . . . . . . . . 19Predefined event consoles . . . . . . . . 20Planning for new event groups . . . . . . . 20Planning for event group roles . . . . . . . 21

Configuring event adapters . . . . . . . . . 22Configuring the Tivoli Enterprise Console gateway 22Configuring the event server . . . . . . . . 22

Updating the source list . . . . . . . . . 23Changing the logging defaults . . . . . . . 24Managing rule bases . . . . . . . . . . 26

Creating an event console . . . . . . . . . 26Configuring an event console . . . . . . . . 26

Creating and changing an event group . . . . 27Assigning an event group to an event console . . 28Creating an operator . . . . . . . . . . 29Assigning an operator to an event console . . . 29Integrating your trouble ticket system with thetrouble ticket rules . . . . . . . . . . . 29Customizing an event console . . . . . . . 33

Configuring custom buttons for an event console 33Exporting and importing event consoledefinitions . . . . . . . . . . . . . . 38

Managing Tivoli region definitions for the Webversion of the event console . . . . . . . . . 38Tuning the performance of the Web version of theevent console . . . . . . . . . . . . . . 41Backing up and tuning the event database . . . . 42Stopping and starting the event server . . . . . 42

Chapter 3. Sample IT environment withconfiguration examples . . . . . . . 43Sample IT environment . . . . . . . . . . 43Fast path to managing events . . . . . . . . 44

Event adapters . . . . . . . . . . . . 44Event server . . . . . . . . . . . . . 45

Extending event management capabilities . . . . 47Event adapters . . . . . . . . . . . . 47Event server . . . . . . . . . . . . . 47Example 1: All operators get all events . . . . 49Example 2: Geographic differentiation . . . . 49Example 3: System management differentiation 50Example 4: Organizational differentiation . . . 50Example 5: Event-type differentiation. . . . . 50

Chapter 4. Managing events . . . . . 51Key concepts for event management . . . . . . 51

Event status . . . . . . . . . . . . . 51Event severity . . . . . . . . . . . . 52Primary operator tasks . . . . . . . . . 52

Using the Java version of the event console. . . . 53Starting the event console . . . . . . . . 53Exiting the event console . . . . . . . . . 54Viewing events . . . . . . . . . . . . 54Acknowledging events . . . . . . . . . 54Running tasks . . . . . . . . . . . . 54Running local commands. . . . . . . . . 55Closing events . . . . . . . . . . . . 56Starting the Tivoli NetView component . . . . 56Opening a trouble ticket . . . . . . . . . 56Viewing event information . . . . . . . . 57Viewing event properties . . . . . . . . . 57Customizing the event viewer . . . . . . . 57

Using the Web version of the event console. . . . 59Overview of the Web version of the eventconsole . . . . . . . . . . . . . . . 59Starting the Web version of the event console . . 61Exiting the event console . . . . . . . . . 61Viewing events . . . . . . . . . . . . 61Acknowledging events . . . . . . . . . 61Running tasks . . . . . . . . . . . . 62Closing events . . . . . . . . . . . . 62Viewing a summary of events . . . . . . . 62Opening a trouble ticket . . . . . . . . . 62Viewing event information . . . . . . . . 63

© Copyright IBM Corp. 2003 iii

Viewing event properties . . . . . . . . . 63Customizing the event viewer . . . . . . . 63

Chapter 5. Tivoli Enterprise Consolegateway . . . . . . . . . . . . . . 67Configuring the gateway . . . . . . . . . . 67

Gateway configuration file . . . . . . . . 68Configuring the gateway to receive events fromnon-TME adapters . . . . . . . . . . . 74Configuring the gateway for state correlation . . 75Configuring the rate at which events are sent tothe event server . . . . . . . . . . . . 76

Starting and stopping the tec_gwr program. . . . 78Starting the tec_gwr program manually . . . . 78Stopping the tec_gwr program manually . . . 78

Obtaining the status of the tec_gwr program onUNIX . . . . . . . . . . . . . . . . 79

Appendix A. Troubleshooting . . . . . 81Getting started with problem determination . . . 81Problems locating an event . . . . . . . . . 81

Understanding event server processes . . . . 82Checking the event flow . . . . . . . . . 86

Problems starting the Tivoli Enterprise Consoleproduct. . . . . . . . . . . . . . . . 87Problems with rules . . . . . . . . . . . 88

Enabling rule tracing . . . . . . . . . . 88Tuning rules . . . . . . . . . . . . . 89

Problems with the RIM database . . . . . . . 89Analyzing Tivoli Management Framework trace logs 90Problems with the Tivoli Enterprise Consolegateway . . . . . . . . . . . . . . . 90

Problems with the tec_gateway program . . . 90Problems with the tec_gwr program . . . . . 91

Problems with the Web version of the event console 92Problems with performance . . . . . . . . . 93

Configuring the event database. . . . . . . 93Additional information sources . . . . . . . . 95

Appendix B. Messages . . . . . . . . 97

Notices . . . . . . . . . . . . . . 107Trademarks . . . . . . . . . . . . . . 108

Index . . . . . . . . . . . . . . . 111

iv IBM Tivoli Enterprise Console: User’s Guide

About this guide

The IBM® Tivoli Enterprise Console® product is a rule-based, event managementapplication that integrates system, network, database, and application managementto help ensure the optimal availability of an organization’s IT services. The TivoliEnterprise Console product is preconfigured so that you can manage eventsimmediately after installation.

The IBM Tivoli Enterprise Console User’s Guide provides an overview of the TivoliEnterprise Console product. It provides information about the preconfigured eventconsoles, event groups, and rules, and information about how to use eventconsoles to manage events. This guide also includes step-by-step instructions aboutconfiguring the Tivoli Enterprise Console product to extend the managementcapabilities that the Tivoli Enterprise Console product automatically provides.

Who should read this guideThis guide is for system administrators, system programmers, and operators whouse Tivoli® products to monitor and manage events from a broad range ofresources to ensure the availability of these resources.

This guide is also useful for network planners and system managers.

Readers should be familiar with the following topics:v IT environment you are managingv Operating systems that your enterprise usesv Tivoli Management Framework

PublicationsThis section lists publications in the IBM Tivoli Enterprise Console library andrelated documents. It also describes how to access Tivoli publications online andhow to order Tivoli publications.

IBM Tivoli Enterprise Console libraryThe following documents are available in the IBM Tivoli Enterprise Consolelibrary:v The IBM Tivoli Enterprise Console Adapters Guide, SC32–1242

Provides information about supported adapters, including how to install andconfigure these adapters.

v IBM Tivoli Enterprise Console Command and Task Reference, SC32–1232Provides details about IBM Tivoli Enterprise Console commands, predefinedtasks that are shipped in the task library, and the environment variables that areavailable to tasks that run against an event.

v IBM Tivoli Enterprise Console Installation Guide, SC32–1233Describes how to install, upgrade, and uninstall the IBM Tivoli EnterpriseConsole product.

v IBM Tivoli Enterprise Console Release Notes, SC32-1238

© Copyright IBM Corp. 2003 v

Provides release-specific information that is not available until just before theproduct is sent to market.

v IBM Tivoli Enterprise Console Rule Developer’s Guide, SC32–1234Describes how to develop rules and integrate them for event correlation andautomated event management.

v IBM Tivoli Enterprise Console Rule Set Reference, SC32–1282Provides reference information about the IBM Tivoli Enterprise Console rule sets.

v IBM Tivoli Enterprise Console User’s Guide, SC32–1235Provides an overview of the IBM Tivoli Enterprise Console product anddescribes how to configure and use the IBM Tivoli Enterprise Console product tomanage events.

v IBM Tivoli Enterprise Console Warehouse Enablement Pack: Implementation Guide,SC32-1236Describes how to install and configure the warehouse enablement pack for theIBM Tivoli Enterprise Console product and describes the data flow andstructures that are used by the warehouse pack.

v Tivoli Event Integration Facility Reference, SC32–1241Describes how to develop your own event adapters that are tailored to yournetwork environment and the specific needs of your enterprise. This referencealso describes how to filter events at the source.

Related publicationsThe Tivoli Software Glossary includes definitions for many of the technical termsrelated to Tivoli software. The Tivoli Software Glossary is available, in English only,at the following Tivoli software library Web site:

http://www.ibm.com/software/tivoli/library/

Access the glossary by clicking the Glossary link on the left pane of the Tivolisoftware library window.

Accessing publications onlineThe product CD contains the publications that are in the product library. Theformat of the publications is PDF, HTML, or both. To access the publications usinga Web browser, open the infocenter.html file. The file is in the appropriatepublications directory on the product CD.

IBM posts publications for this and all other Tivoli products, as they becomeavailable and whenever they are updated, to the Tivoli Software InformationCenter Web site. Access the Tivoli Software Information Center by first going to theTivoli software library at the following Web address:


Scroll down and click the Product manuals link. In the Tivoli Technical ProductDocuments Alphabetical Listing window, click the Tivoli Enterprise Console linkto access the product library at the Tivoli Information Center.

Note: If you print PDF documents on other than letter-sized paper, select the Fit topage check box in the Adobe Acrobat Print window. This option is availablewhen you click File → Print. Fit to page ensures that the full dimensions of aletter-sized page print on the paper that you are using.

vi IBM Tivoli Enterprise Console: User’s Guide



Ordering publicationsYou can order many Tivoli publications online at the following Web site:http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi

You can also order by telephone by calling one of these numbers:v In the United States: 800-879-2755v In Canada: 800-426-4968

In other countries, see the following Web site for a list of telephone numbers:

http://www.ibm.com/software/tivoli/order-lit/

Contacting software supportIf you have a problem with any Tivoli product, refer to the following IBM SoftwareSupport Web site:

http://www.ibm.com/software/sysmgmt/products/support/

If you want to contact software support, see the IBM Software Support Guide at thefollowing Web site:

http://techsupport.services.ibm.com/guides/handbook.html

The guide provides information about how to contact IBM Software Support,depending on the severity of your problem, and the following information:v Registration and eligibilityv Telephone numbers and e-mail addresses, depending on the country in which

you are locatedv Information you must have before contacting IBM Software Support

Participating in newsgroupsUser groups provide software professionals with a forum for communicating ideas,technical expertise, and experiences related to the product. They are located on theInternet and are available using standard news reader programs. These groups areprimarily intended for user-to-user communication and are not a replacement forformal support.

To access a newsgroup, use the instructions appropriate for your browser.

Use these instructions for a Microsoft Internet Explorer browser.1. Open an Internet Explorer browser.2. From the Tools menu, click Internet Options.3. On the Internet Options window, click the Programs tab.4. In the Newsgroups list, click the Down Arrow and then click Outlook Express.5. Click OK.6. Close your Internet Explorer browser and then open it again.7. Cut and paste the newsgroup address of a product into the browser Address

field, and press Enter to open the newsgroup.

About this guide vii

http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi

http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi

http://www.ibm.com/software/tivoli/order-lit/

http://www.ibm.com/software/sysmgmt/products/support/

http://techsupport.services.ibm.com/guides/handbook.html

Use these instructions for a Netscape Navigator browser.1. Open a Netscape Navigator browser.2. From the Edit menu, click Preferences. The Preferences window is displayed.3. In the Category view, click Mail & Newsgroups to display the Mail &

Newsgroups settings.4. Select the Use Netscape mail as the default mail application check box.5. Click OK.6. Close your Netscape Navigator browser and then open it again.7. Cut and paste the newsgroup address of a product into the browser Address

field, and press Enter to open the newsgroup.

IBM Tivoli Enterprise Console

news://news.software.ibm.com/ibm.software.tivoli.enterprise-console

IBM Tivoli NetView® for UNIX® and IBM Tivoli NetView for Windows®

news://news.software.ibm.com/ibm.software.tivoli.netview-unix-windows

Conventions used in this guideThis guide uses several conventions for special terms and actions and operatingsystem-dependent commands and paths.

Typeface conventionsThis guide uses the following typeface conventions:

Bold

v Lowercase commands and mixed case commands that are otherwisedifficult to distinguish from surrounding text

v Interface controls (check boxes, push buttons, radio buttons, spinbuttons, fields, folders, icons, list boxes, items inside list boxes,multicolumn lists, containers, menu choices, menu names, tabs, propertysheets), labels (such as Tip:, and Operating system considerations:)

v Column headings in a tablev Keywords and parameters in text

Italic

v Citations (titles of books, diskettes, and CDs)v Words defined in textv Emphasis of words (words as words)v Letters as lettersv New terms in text (except in a definition list)v Variables and values you must provide

Monospace

v Examples and code examplesv File names, programming keywords, and other elements that are difficult

to distinguish from surrounding textv Message text and prompts addressed to the userv Text that the user must type

viii IBM Tivoli Enterprise Console: User’s Guide

news://news.software.ibm.com/ibm.software.tivoli.enterprise-console

news://news.software.ibm.com/ibm.software.tivoli.netview-unix-windows

v Values for arguments or command options

Operating system-dependent variables and pathsThis guide uses the UNIX convention for specifying environment variables and fordirectory notation.

When using the Windows command line, replace $variable with % variable% forenvironment variables and replace each forward slash (/) with a backslash ( \) indirectory paths.

Note: If you are using the bash shell on a Windows system, you can use the UNIXconventions.

IBM Tivoli Enterprise Console iconsThe following icons are used in the IBM Tivoli Enterprise Console product.

Table 1. Tivoli Enterprise Console Icons

Icon Represents

Event Server

The red arrow indicates the event server isrunning.

A hollow arrow indicates the event server isinitializing.

Rule Base

The red arrow indicates the rule base is active.

Profile

A profile is a collection of application-specificdata.

About this guide ix

x IBM Tivoli Enterprise Console: User’s Guide

Chapter 1. Overview

The IBM Tivoli Enterprise Console product is a rule-based event managementapplication that integrates system, network, database, and application managementto help ensure the optimal availability of the IT resources in an enterprise.

The Tivoli Enterprise Console product:v Provides a centralized, global view of your computing enterprise.v Collects, processes, and automatically responds to common management events,

such as a database server that is not responding, a lost network connection, or asuccessfully completed batch processing job.

v Acts as a central collection point for alarms and events from a variety of sources,including those from other Tivoli software applications, Tivoli partnerapplications, custom applications, network management platforms, andrelational database systems.

The Tivoli Enterprise Console product helps you effectively process the highvolume of events in an IT environment by:v Prioritizing events by their level of importance.v Filtering redundant or low-priority events.v Correlating events with other events from different sources.v Determining who should view and process specific events.v Initiating automatic corrective actions, when appropriate, such as escalation,

notification, and the opening of trouble tickets.v Identifying hosts and automatically grouping events from the hosts that are in

maintenance mode in a predefined event group.

This chapter describes the highlights of this release and the components of theTivoli Enterprise Console product. It also provides information about events andhow the Tivoli Enterprise Console product processes events.

Highlights of the 3.9 releaseTwo major highlights of this release include unified system and networkmanagement and optimized event management for the following key e-businessapplications:v IBM WebSphere® MQv IBM DB2®

v IBM WebSphere Application Server

Unified system and network managementThe Tivoli Enterprise Console event management application integrates the IBMTivoli NetView component, thereby unifying system and network management ina single tool. This integration enables the Tivoli Enterprise Console product toautomatically:v Correlate the status of a system or application to the status of the network that it

uses.v Determine if the root cause of a system or application problem is an underlying

network failure.

© Copyright IBM Corp. 2003 1

To unify system and network management, the Tivoli Enterprise Console productprovides:v Automatic filtering and forwarding of network events from the Tivoli NetView

componentv Rules that correlate system-related and network-related events. These rules are

based on predefined associations and help in performing root cause analysis. Forexample, Subnet Unreachable events include the subnet number and maskinformation. This enhanced event information enables the rules to determine if aserver is on a subnet that is known to be unreachable. If it is, this would impactthe applications on that server, and the unreachable subnet might be the rootcause of any application-related events that have occurred.These rules significantly reduce the human intervention that is typically requiredto analyze application-failure or system-failure events and compare them tonetwork-failure events to determine the actual problem. By automaticallycorrelating system-related and network-related events, the Tivoli EnterpriseConsole product saves operators’ time and provides a more reliable method ofproblem identification.

v Rules that understand and automatically process network events. Only eventsthat require operator action are displayed in the event console. This reducesclutter, gives operators significantly fewer events to assess, and removes theneed for operators to manually sort and close previous network status events.Operators can still find and view related events that have been closed bycorrelation.

v Predefined event consoles and event groups for Tivoli NetView events, whichyou can use to manage these events immediately. You can use the event groupsas they are provided, or you can customize them for your enterprise. For moreinformation, see “Planning for event management” on page 19.

v Ability to start the Tivoli NetView Web console from the Java™ version of theevent console, which an operator can use to navigate from an event in the eventconsole to the associated network topology and diagnostics. Rules automaticallysynchronize the status between the event console and the Tivoli NetView Webconsole. Therefore, when an operator responds to a network event in the eventconsole, the status of the network element is immediately updated. This enablessystem and network management operators to analyze and resolve problemsmore efficiently and effectively. It also improves the communication among thedifferent operators because both the event console and the network consoleimmediately display the correct status.

For more information about the rules that the Tivoli Enterprise Console productprovides, refer to the IBM Tivoli Enterprise Console Rule Set Reference. For moreinformation about the Tivoli NetView component, refer to the Tivoli NetViewdocumentation at the following Web site:

http://www.ibm.com/software/tivoli/library

Optimized event management for key e-business applicationsTo optimize the event management for key e-business applications, the TivoliEnterprise Console product provides:v Predefined event consoles and event groups for WebSphere MQ, DB2, and

WebSphere Application Server events, which you can use to manage theseevents immediately. You can use the event groups as they are provided, or youcan customize them for your enterprise. For more information, see “Planning forevent management” on page 19.

2 IBM Tivoli Enterprise Console: User’s Guide


v Rules that identify the root cause of a problem. Because the rules are based onpredefined associations among the WebSphere MQ, DB2, and WebSphereApplication Server applications, the rules can determine how the failure of oneapplication affects another application and, therefore, identify the root cause ofthe problem.For more information about the rules that the Tivoli Enterprise Console productprovides, refer to the IBM Tivoli Enterprise Console Rule Set Reference.

Components of the Tivoli Enterprise Console productThis section provides an overview of the following Tivoli Enterprise Consolecomponents, which are listed in the order in which an event flows from its sourceto the operator:v “Adapter Configuration Facility” on page 4v “Event adapter” on page 4v “Tivoli Event Integration Facility” on page 6v “Tivoli Enterprise Console gateway” on page 6v “Tivoli NetView” on page 6v “Event server” on page 6v “Event database” on page 8v “User interface server” on page 8v “Event console” on page 9

The relationship among the components of the Tivoli Enterprise Console product isillustrated in the following diagram.

Chapter 1. Overview 3

Adapter Configuration FacilityThe Adapter Configuration Facility provides a graphical user interface (GUI) toconfigure and distribute TME® adapters. You can use the Adapter ConfigurationFacility to create profiles for adapters and set adapter configuration anddistribution options. You can distribute TME adapters to the subscribers of theprofile, thus making configuration changes in a central location and thendistributing the changes to the remote endpoints or managed nodes. For moreinformation about the Adapter Configuration Facility, refer to the IBM TivoliEnterprise Console Adapters Guide.

Event adapterAn event adapter is a process that typically resides on the same host as a managedsource and monitors the source for events. A source is an application (such as adatabase) or a system resource (such as available disk space). A typical source is asystem resource or an application that is running. For example, if you want tomonitor the Windows® event log, install the Windows event log adapter on every

Tivoli EnterpriseConsole gateway

Prologrules

Event console(Web version)

Webbrowser

WebSphereApplication

Server

Eventserver

User interfaceserver

Eventdatabase server

Event sources(TME and non-TME)

Statecorrelation

rules

SNMP

Event console(Java version)

TivoliNetView

component

TivoliNetView

component

Event IntegrationFacility






Networkmanagement

server

Figure 1. Tivoli Enterprise Console components


host on which you want to monitor the log. You must either run an event adapterfor each source that you want to monitor or modify the source to send events tothe Tivoli Enterprise Console product.

When an event adapter receives information from its source, the adapter formatsthe information and forwards it to the event server for interpretation and response,as illustrated in the following diagram.

You can configure an event adapter to discard selected events instead offorwarding the events to the event server, which reduces network traffic and eventserver workload.

An event adapter sends events to the event server using either a Tivoli interface ora non-Tivoli interface. A Tivoli interface is one that runs in a Tivoli environmentand a non-Tivoli interface is one that runs in a non-Tivoli environment. Both Tivoliand non-Tivoli types of interfaces send events using a simple interprocesscommunication mechanism. The difference between the two interfaces is themethod used to establish the connection. Interfaces in a Tivoli environmentestablish connections using services that the Tivoli Management Frameworkprovides. Interfaces in a non-Tivoli environment establish connections usingstandard interprocess communication mechanisms. You choose the type ofconnection for your environment when you install an event adapter. For moreinformation about installing and configuring event adapters, refer to the IBM TivoliEnterprise Console Adapters Guide.

Many other Tivoli products that operate in Tivoli or non-Tivoli environmentsprovide additional event adapters. You can also create a specialized event adapterfor your own applications and services using the Tivoli Event Integration Facility.For information about the Tivoli Event Integration Facility, refer to the Tivoli EventIntegration Facility Reference.

Event source bufferingAn event adapter can buffer events. When event buffering is enabled for an eventadapter and the event source cannot connect to the event server, events arebuffered until a connection can be established to the event server. When aconnection is established, the event adapter sends the buffered events to the eventserver.

Secondary event serversYou can specify one or more secondary event servers for an event adapter. Asecondary event server is a backup event server that receives events when theTivoli Enterprise Console gateway cannot contact the adapter-specified eventserver. You can specify one or more secondary event servers in the TivoliEnterprise Console gateway configuration file. For information information, see“Gateway configuration file” on page 68.

event:native format

event:Tivoli format

To event serverSystem

Resource orApplication

EventAdapter

Figure 2. Event flow from an event adapter


Tivoli Event Integration FacilityThe Tivoli Event Integration Facility is a toolkit that expands the types of eventsand system information that you can monitor. Event adapters monitor managedresources and send events to the Tivoli Enterprise Console product or otherapplications. You can use the Tivoli Event Integration Facility to develop your ownadapters that are tailored to your network environment and your specific needs.For more information about the Tivoli Event Integration Facility, refer to the TivoliEvent Integration Facility Reference.

Tivoli Enterprise Console gatewayThe Tivoli Enterprise Console gateway receives events from TME and non-TMEadapters and forwards them to an event server. By default, the Tivoli EnterpriseConsole gateway uses a connection-oriented service to the event server. Aconnection-oriented service is one that establishes a connection when the TivoliEnterprise Console gateway is started, and the connection is maintained for allevents.

The Tivoli Enterprise Console gateway provides the following benefits:v Greater scalability, which allows you to manage sources with less software

running on the endpoints.v Improved performance of the event server. The Tivoli Enterprise Console

gateway bundles events before sending the events to the event server, whichreduces the amount of communication tasks that the event server or the Tivoliserver must perform.

v Simple deployment of adapters and updates to adapters using profiles in theAdapter Configuration Facility.

v Event correlation and filtering closer to the sources, which reduces the numberof events sent to the event server and improves network performance bydecreasing the amount of network traffic.

For more information about the Tivoli Enterprise Console gateway, see Chapter 5,“Tivoli Enterprise Console gateway”, on page 67.

Tivoli NetViewThe Tivoli NetView component provides the network management function for theTivoli Enterprise Console product. The Tivoli NetView component monitors thestatus of network devices and automatically filters and forwards network-relatedevents to the Tivoli Enterprise Console product. For information about how theTivoli Enterprise Console product processes network-related events, see “Unifiedsystem and network management” on page 1. For more information about theTivoli NetView component, refer to the Tivoli NetView documentation at thefollowing Web site:


Event serverThe event server provides a centralized location for the management of events in adistributed environment. Each Tivoli region contains only one event server. Theevent server processes input from event consoles and updates the event database.Because the event consoles read data from the event database, the status of eventson all event consoles is updated. The event server creates an entry in the eventdatabase for each incoming event and then evaluates these events against a set ofrules to determine if the event server should automatically perform any predefined



tasks or modify the event. If human intervention is required, the event servernotifies the appropriate operator. The operator performs the required tasks andthen notifies the event server when the condition that caused the event has beenresolved.

Logging incoming eventsWhen reception logging is enabled, the event server validates and logs incomingevents to the event database. The event server assigns a unique identifier and timestamp to each event and, if the event is valid, stores the event in the eventdatabase. When the event server receives a valid event, the event server sends theevent to the rule engine for further processing. If the rule engine is busy, incomingevents are stored in a buffer until the rule engine can process the events. When therule engine completes processing any buffered events, the event server stores theevent in the event database.

Applying rulesWhen the event server receives an event or when the event is modified, the eventserver determines if any existing rules apply to that event. A rule consists of a setof expressions used to determine if an event meets the rule conditions. A rule alsoincludes a set of actions that are taken when an event meets the specified ruleconditions. Rules help reduce the amount of interpretation and the number ofresponses required by operators. For example, a particular event might be knownto trigger one or more instances of another event. In such a case, a rule can beused to automatically downgrade the severity of the event or close events that areknown to be caused by the triggering event.

The event server can use rules to delay responses to an event. If responses aredelayed for an event, event consoles are not updated and the event server does notissue an automatic response until the specified amount of time has elapsed. Adelayed response might be preferrable, for example, if you have a self-correctingproblem that occasionally occurs on the network. This feature can prevent anoperator from needlessly responding to a problem.

A rule can specify an action to be taken automatically in response to an incomingevent. For example, if an event indicates that a router is down, the first responsemight be to attempt to restart the router and give an operator a low-severitynotice. If the attempts to restart the router within a designated time period fail, arule can specify that attempts to retry be cancelled and that a higher-severitynotice be sent to an operator. An operator can monitor actions that areautomatically performed for an event.

If an operator does not respond to an event after a specified period of time, theevent server can take additional actions beyond displaying the event on an eventconsole. For example, the event server can send an e-mail notice of theunacknowledged event to an operator. If the operator still does not acknowledgethe event, the server can then perform actions, such as paging the operator orsending an e-mail notice to an alternate contact.

You can use the predefined rules that the Tivoli Enterprise Console productprovides, or you can create your own rules. The predefined rules associateresource-related events and network-related events to help you to determine theroot cause of a problem. For example, the predefined rules can associate an eventthat indicates that a DB2 server is down with an event that indicates that a specifichost is down. This association enables you to quickly determine that the root causeof the events related to the DB2 application is a network failure and not a DB2application failure. For information about the predefined rules, refer to the IBM


Tivoli Enterprise Console Rule Set Reference. For information about creating your ownrules, refer to the IBM Tivoli Enterprise Console Rule Developer’s Guide.

A rule can specify, but is not limited to, the following actions:v Correlating eventsv Responding automatically to events, such as running an application or a scriptv Delaying responses to eventsv Escalating eventsv Modifing event attributesv Modifying attributes of other eventsv Preventing duplicate events from being displayedv Dispatching Tivoli or other administrative actions on resourcesv Reevaluating a set of eventsv Discarding an eventv Generating a new eventv Forwarding an event to another event server

Event databaseThe Tivoli Enterprise Console product uses an external relational databasemanagement system (RDBMS) to store the large amount of event data that isreceived. In this guide, the RDBMS is referred to as the event database. TheRDBMS Interface Module (RIM) component of the Tivoli Management Frameworkis used to access the event database.

For additional information about the event database, see the IBM Tivoli EnterpriseConsole Installation Guide.

User interface serverThe user interface (UI) server is a process that provides communication servicesbetween the event consoles and the event server. The UI server communicates withthe dispatch engine when it needs to contact the event server. The UI serverprovides transaction locking for event console status updates and preventsmultiple event consoles from responding to the same event. The UI server alsoautomatically updates the status of events on all event consoles by forwarding theevent changes from the event consoles to the dispatch engine, which sends thechanges to the event database. For example, when an operator acknowledges anevent, the UI server automatically updates the status of the event on each eventconsole that contains the event.

The UI server also provides a set of commands that enable an operator to changeany event attribute, list the events in a specific event group, and display onemessage on the operator’s desktop.

The UI server can be installed on any managed node in the Tivoli region, but onlyon one managed node. The UI server does not have to be located on the same hostas the event server. The name of the UI server process is tec_ui_server. If the UIserver fails, error messages are written in the /tmp/ui_server log file. The name ofthis log file is defined in the $BINDIR/TME/TEC/.ui_server_diag_config file andcan be changed.


Event consoleAn event console provides a GUI that operators can use to view and respond toevents. The Tivoli Enterprise Console product provides two versions of the eventconsole, a Java version and a Web version. Administrators must use the Javaversion to perform configuration tasks. Administrators or operators must use theJava version to start Tivoli NetView functions and to run local automated tasks.Administrators and operators can use the Java version or the Web version, or both,to manage events.

An event console displays a window for monitoring event groups, which operatorscan use to monitor and respond to incoming events. An event group is a set ofevents that meet certain filter criteria. An administrator defines the event groupsand assigns them to event consoles for each operator. Operators can haveindependent or shared views of events. The UI server prevents multiple eventconsoles from updating the same event and updates event status on all eventconsoles. Therefore, only one operator responds to and works on solving aproblem. For more information about the UI server, see “User interface server” onpage 8.

For more information about event consoles, see Chapter 4, “Managing events”, onpage 51.

Java version of the event consoleThe Java version of the event console can be installed on a managed node,endpoint, or a host in a non-Tivoli environment. The Java version of the eventconsole includes the following features:v Tivoli secure logon for added security.v Each event console retrieves event information directly from the database for

high performance and scalability.v The event console refresh rate is configured to allow different event consoles to

be given different priorities for event updates. For more information aboutrefresh rates, see the Event Viewer Preferences entry provided in the online helpfor the event console.

v Ability to run local actions and commands enables third-party or custom scriptsand applications to be run easily from the event console. For more informationabout running local commands, see the Executing Local Commands entryprovided in the online help for the event console.

v Ability to run predefined tasks. For more information about running tasks froma task library, see the online help for running tasks in the event console.

v Automated tasks can be configured in advance and run when a particular eventis received by the event console. For more information about automated tasks,see the automated task entries provided in the online help for the event console.

v Ability to view more information about an event in a Web page, which helps anoperator to determine the actions to perform and whom to contact. When thesample event information is installed, samples and hooks are provided to helpyou enable this feature. Customers must provide the additional information tocustomize their environment. For more information, see the Web Server andEvent Information entries provided in the online help for the event console.

v Multiple event details, viewed in a single window with additional contextualinformation, improving operator understanding.

v All attributes, including custom attributes, can be displayed and filtered forevent groups with SQL operators. For more information about attributes, see theEvent Group entries provided in the online help for the event console.


v Multiple operators can be assigned to a single event console definition. For moreinformation about defining event consoles and operators, see the online help forthe event console.

v When editing event console definitions, all operators assigned to that eventconsole automatically pick up the changes, thus eliminating the need for scriptsto be used to update or create event consoles.

v When there are conflicts between event consoles, such as two operatorssimultaneously attempting to change the status of an event, they are resolvedautomatically and operators are notified.

v Import and export functions enable the event console and event groupdefinitions to be exported to a file for archiving or for easily migrating from thedevelopment environment into production. For more information aboutimporting event console definitions, see the Exporting and Importing FromOther Consoles entry provided in the online help for the event console.

The Java version of the event console provides the following views:

Configuration viewThe Configuration view is used to configure both the Java version and theWeb version of the event console. Only administrators have access to thisview.

Summary Chart viewThe Summary Chart view is used to show a high-level overview of thehealth of resources represented by an event group. Each event group isrepresented by a single bar, similar to a bar graph, on an operator’s eventconsole. To open an event group, click the bar representing that group.

Priority viewIn the Priority view, event groups are represented by buttons. The buttonsrepresenting each event group display the event group name and the colorof the button representing each event group corresponds to the colordefined for the highest severity event contained in that group. To open anevent group, click the button representing that group.

Web version of the event consoleYou can use the Web version of the event console to manage events from your Webbrowser. The Web version of the event console includes the following features:v Tivoli secure logon for added security.v Event console definitions, event group definitions, and preferences that an

administrator defines using the Java version of the event console take effect forthe Web version, so that both the Web version and the Java version of the eventconsole can be administered from a single place.

v Ability to view additional information about an event in a Web page, whichhelps an operator determine the actions to perform and whom to contact.

v Multiple event details with additional contextual information, viewed in a singleWeb page, improving operator understanding.

v Multiple operators can be assigned to a single event console definition.v Changes to event console definitions are automatically reflected in the event

console in the next logon session.v The event console refresh rate can be changed to update events at an interval

that meets your needs. For information about changing the refresh rate, see theonline help for changing user preferences in the event console.

v Event viewer data, event summary data, and task information are cached,reducing the load on the event server database and the Tivoli Management


Framework. You can configure the timeout intervals for these caches, whichhelps you to balance your needs for performance and current information.

v A single installation of the Web version of the event console can be configured tosupport the installation of the Tivoli Enterprise Console product in multipleTivoli regions.

v Ability to run predefined tasks.v When there are conflicts between event consoles, such as two operators

simultaneously attempting to change the status of an event, they are areresolved automatically and operators are notified.

The Web version of the event console organizes the tasks you can perform in aportfolio, which is titled My Work. The portfolio contains the following tasks:

Select an Event GroupLists the event groups that have been assigned to the event console. Tomanage the events in an event group, select the appropriate event groupfrom the list. An event viewer is displayed, which contains the events inthe selected event group.

View Summary of EventsShows a high-level overview of the health of resources represented by anevent group, indicating the number of events for each event severity ineach event group and the total number of events for each event severity.You can also display the percentage of events for each event severity. Tomanage the events in an event group, select the name of the event group.An event viewer is displayed, which contains the events in the selectedevent group.

Run TasksRuns predefined tasks from task libraries.

Change User PreferencesControls the display of events in the event viewer. For example, you canchange the automatic refresh rate and the maximum number of events todisplay in the event viewer.

Event groupsAn event group is a configured logical area of responsibility that is used to notifyusers that an event matching a specified set of criteria has occurred. Anadministrator configures event groups using the Java version of the event console.

For example, if your network contains a group of computers that are used forcritical work, you might want to create an event group that receives events forthese critical computers. This logical grouping of events is an event group.

For more information about event groups and attributes, see Chapter 4, “Managingevents”, on page 51.

To define an event group, you must specify the selection criteria for the events inthe group. This data constitutes an event group filter. An event group filter caninclude any event attribute except for extended or customer-defined attributes. Thefollowing table lists some of the more commonly used attributes for event groupfiltering.


Table 2. Common attributes for event group filtering

Attribute Name Description

event class Specifies the class of the event, as assigned by theevent source that forwards the event. Thedocumentation for the event adapter lists thepossible values for event classes for adapters.Other Tivoli applications, such as DistributedMonitoring, Software Distribution, and TivoliNetView, can also forward events to the TivoliEnterprise Console product.

origin Identifies the protocol address or host name of ahost from which you want to receive events. If youwant to monitor an entire subdomain, enter theprotocol address or host name of the subdomain.

severity Specifies the severity of the event. The TivoliEnterprise Console product uses the followingclassifications, listed in order of increasing severity,to indicate the severity of an incoming event:

UNKNOWNHARMLESSWARNINGMINORCRITICALFATAL

A system administrator can also add customseverities.

source Specifies the type of application that created theevent. Sources are defined in the event adapter orthe documentation for your application. Possiblevalues include, but are not limited to, LOGFILE,NT, HPOV, and SNMP.

status Specifies the status of the event as follows:

AcknowledgedAn operator or rule acknowledged receiptof the event.

Closed An operator or rule reported that theproblem that resulted from the event isresolved. The sending of a closed eventby an event adapter indicates that apreviously received event of the specifiedclass should be closed as a duplicate.

Open The event server received the event, butan operator or rule has not acknowledgedreceipt of the event.

organization_supplied_status

The STATUS enumeration that is shippedwith the Tivoli Enterprise Consoleproduct includes this placeholder statusthat a system administrator can customizeand define for an organization.

ResponseA rule has automatically responded to theevent. This status is assigned by a rulelanguage predicate.


You can use SQL wildcard characters for any of the attributes to simplify eventgroup filtering options. Entering specific values for each attribute narrows thetypes of events reported in an event group. Using wildcard characters expands thetypes and number of events reported in an event group.

Event group filters enable you to include specific, and possibly very different,events in an event group. Event group filters also help reduce the number of eventgroups that an operator must manage. For example, an administrator can create anevent group composed of three filters to monitor the events on hosts 9.27.136.1,9.27.136.2, and 9.27.136.4, but not 9.27.136.3. Without using event group filters, youwould need three event groups to manage events from these hosts.

Required Tivoli authorization rolesThe Tivoli Enterprise Console product requires both Tivoli authorization roles andTivoli Enterprise Console event group roles. Tivoli authorization roles are rolesdefined for the tasks that Tivoli Enterprise Console administrators and operatorsperform in a Tivoli management environment and are set in the TivoliManagement Framework product. For information about assigning Tivoliauthorization roles, refer to the Tivoli Management Framework User’s Guide.

Tivoli Enterprise Console event group roles are the roles defined for managing eventsin an event console. For information about event group roles, see “Planning forevent group roles” on page 21.

The following table lists the Tivoli authorization roles required for the TivoliEnterprise Console product.

Table 3. Required Tivoli authorization roles

Activity Context Tivoli Authorization Role

Assigning administrative rolesfor the event server

Event server senior

Configuring super

Starting and stopping senior

Assigning an operator to anevent console

Event console senior

Configuring your own eventviewer preferences

user

Assigning event group roles Event groups senior

Creating, modifying, ordeleting event groups

senior

Assigning event groups senior

Deleting events Events senior

Acknowledging and closingevents

admin, RIM_view, andRIM_update

Viewing events user and RIM_view

Sending events user, if using thewpostemsg command,otherwise none

Creating, modifying, or loadingrule bases

Rule base senior


Table 3. Required Tivoli authorization roles (continued)

Activity Context Tivoli Authorization Role

Installing the Tivoli EnterpriseConsole product

Tivoli region super

Notes:

1. Each operator must be defined as a Tivoli administrator with the appropriateauthorization roles to manage events before you can assign the operator to an eventconsole.

2. If you add an authorization role to a Tivoli administrator after the operator starts theevent console, the authorization role does not take affect until the event console isrestarted.

3. Tivoli administrators that existed before the installation of Version 3.9 are automaticallygiven the authorization roles of RIM_view and RIM_update during the installation ofthe event server. You must manually assign the authorization roles of user, RIM_view,and RIM_update to Tivoli administrators that have been created after the installation ofthe event server.

EventsIn the Tivoli Enterprise Console product, an event is an object that has beencreated based on data that is obtained from a source that is monitored by an eventadapter. Each event is identified by a class name, which the event adapter defines.Some examples of class names include Su_Success, Su_Failure, No_Permission, andPrinter_Toner_Low. Class names are used to label events, but each event containsadditional information that helps define and locate a potential problem. Sampleevent information is provided as an example to manage requests for additionalevent information that an operator might need. Each event class has a template,which can be modified to include additional information about an event and theaction required to resolve the problem. This facilitates the creation of acomprehensive online system of event information and troubleshooting. Fordetailed information about event classes and attributes provided by the adaptersshipped with the Tivoli Enterprise Console product, refer to the IBM TivoliEnterprise Console Adapters Guide.

Several communication protocols are available for forwarding events from eventadapters to the event server. The security of each protocol varies. Events use thecredibility event attribute to indicate that the events have been received usingTivoli Management Framework services. A credibility of 1 indicates that the eventwas sent from a TME event adapter and a credibility of 0 indicates the event wassent from a non-TME adapter. You can use the credibility event attribute todetermine how to respond to an event, either as a manual response or in anautomatic action defined in a rule.

Communication between the event server and all event consoles have the samelevel of security as other Tivoli communication. Events are sent as plain,unencrypted text.

Internal eventsThe Tivoli Enterprise Console product generates events internally to provideinformation about the Tivoli Enterprise Console product itself. Each internal eventhas one of the following classes:


TEC_NoticeEvents that contain non-error conditions in the Tivoli Enterprise Consoleproduct.

TEC_ErrorEvents for certain error conditions in the Tivoli Enterprise Console product.

TEC_DBEvents for event database access failures.

TEC_StartEvents generated when the event server is started.

TEC_StopEvents generated when the event server is stopped.

Event flowThe event server architecture consists of the following five processes. The processnames are in parentheses.v Master process (tec_server)v Reception engine process (tec_reception)v Rule engine process (tec_rule)v Dispatch engine process (tec_dispatch)v Task engine process (tec_task)

Note: An additional process for UI server, tec_ui_server, plays an integral part inthe overall Tivoli Enterprise Console architecture. The UI server is not partof the event server, although it communicates with the event server. Formore information, see “User interface server” on page 8.

These processes are also known as services when running in a Windowsenvironment. The service names have a .exe file name extension.

If any of the event server processes fail, error information is written to a log file asdescribed in the following table. The names of these log files are defined in the$BINDIR/TME/TEC/.tec_diag_config file and can be changed.

Table 4. Log files for event server processes

Process Log File

tec_server /tmp/tec_master

tec_reception /tmp/tec_reception

tec_rule /tmp/tec_rule

tec_dispatch /tmp/tec_dispatch

tec_task /tmp/tec_task

The following figure illustrates the relationships among the event server processes.The arrows represent the flow of communication.


Master processThe master process coordinates all of the other event server processes. If one of theother event server processes stops, the master process attempts to restart theprocess. If the master process cannot restart the process, the master process stopsthe rest of the processes. The master process also initially receives incoming eventssent from Tivoli communication and forwards the events to the reception engine.

Reception engine processThe reception engine process receives incoming events and logs them to thereception log. The reception engine process also sends received events to the ruleengine for processing.

The following figure illustrates the event reception steps in detail. The state of anevent during the reception process is explained after the figure. The callouts in thefigure are described as follows:1. The reception engine receives events directly from non-Tivoli communication or

from the master process if the event was sent from Tivoli communication.2. All incoming events are written to the reception log, and marked as QUEUED

or WAITING. The reception log is actually a table in the event database.3. Events marked QUEUED are sent to the reception buffer.4. QUEUED events are sent from the reception buffer to the rule engine for

processing.5. The dispatch engine signals the reception engine when rule engine processing

for an event is completed. The reception engine marks the event asPROCESSED in the reception log and removes it from the reception buffer. Ifthe rule engine cannot successfully parse the event for processing, the event ismarked as PARSING_FAILED in the reception log.

Task engine(tec_task)

Master(tec_server)

External tasksor programs

UI server(tec_ui_server)

Eventcache(RAM)

IncomingTivoli events

Receptionengine

(tec_reception)

Receptionbuffer(RAM)

RDBMS

Rule engine(tec_rule)

Dispatchengine

(tec_dispatch) Console

Console

Console

from non-Tivolicommunication


from Tivolicommunication

Figure 3. Relationship among event server processes


Master

1

1

Reception engine

Receptionbuffer

Receptionlog

Rule engine

Dispatchengine

1

2 3

4

5

IncomingTivoli eventsfrom non-Tivolicommunication



The state of an event during the reception process (PARSING_FAILED,PROCESSED, QUEUED, and WAITING) is specific to the reception engine and isnot an event attribute. The states are defined as follows:

PARSING_FAILEDThe event is not valid. Either the event class is not known to the eventserver, or the event class attributes are not formatted correctly. The event isdiscarded. That is, the reception engine process does not insert the eventinto the event repository, but you can still view the event in the receptionlog.

PROCESSEDThe event is valid. The rule engine has successfully processed the event.

QUEUEDThe event is waiting in the reception buffer for rule engine processing. Thereception buffer is a first in, first out (FIFO) queue. If you routinely seeQUEUED events in the output from the wtdumprl command, the ruleengine is too busy. If you see only PROCESSED events in the output fromthe wtdumprl command, the reception buffer is adequately sized, and ruleengine processing is efficient.

WAITINGThe reception buffer is full. When the reception buffer accepts the event,the reception engine process changes the event to the QUEUED state. Ifyou routinely see WAITING events in the output of the wtdumprlcommand, the reception buffer is not large enough, or the rule engine istoo busy, or both.

When the event server is restarted, the reception engine is reloaded with eventsfrom the reception log that are in the WAITING or the QUEUED state.

Figure 4. Reception process


The reception engine does not process internally generated events (for example,those generated by rules). Internally generated events never appear in thereception log or the reception buffer.

The reception buffer is located in system memory (RAM). You can configure thesize of the reception buffer using the wsetesvrcfg command or from the EventServer Parameters dialog.

Rule engine processThe rule engine is a rule-based event processor. The reception engine sends anevent to the rule engine. Then the event is evaluated against the rules. After ruleprocessing, the event is placed into the event cache of the rule engine. The event inthe rule engine currently being evaluated is referred to as the event under analysis.An event that satisfies the specification criteria of a rule causes the rule to run,which means the actions defined by the rule are performed. This is the first inputstream into the rule engine.

A second input stream comes from the dispatch process. This input streamcontains changes made to events that have already been received by the eventserver, typically coming from a change made by activity at an event console.

A third input stream comes from requests for changes to events from runningactions by the task process. This input stream comes to the rule engine from a taskprocess thread through the dispatch process.

The output stream from the rule engine goes to the dispatch process. After anevent is evaluated against the rules, it is forwarded to the dispatch process forstorage in the event repository.

The rule engine evaluates and correlates events with other events in the eventcache. The rule engine uses the event cache for its processing, and the event cacheis kept in memory. The rule engine interacts with the dispatch engine tosynchronize the updates of its event cache with the event database.

Dispatch engine processThe main functions of the dispatch engine are to keep the event database currentand send updated event information to the event consoles. The dispatch enginecommunicates with the rule engine and the task engine to know when to updateevent information. If tasks or programs need to be run for an event, the dispatchengine contacts the task engine for running them. The dispatch engine alsomanages requests for event changes coming from an event console (through the UIserver) and sends them to the rule engine. When the event server is started, thedispatch engine retrieves events from the event database to reload the event cachefor the rule engine.

Task engine processThe task engine runs programs, tasks, scripts, and commands initiated by rules.The task engine process monitors these running items and can return their exitstatuses to the dispatch engine, which writes the statuses to the event database.The task engine runs these items as it receives requests to do so. It does not waitfor a running item to complete before starting another one.

The num_actions attribute for an event contains the number of actions (tasks orprograms) currently being tracked by the event server for the event.


Chapter 2. Configuring the Tivoli Enterprise Console product

This chapter is intended for administrators. It describes the planning decisions youneed to make and the configuration tasks you can perform so that operators canmanage events. This chapter also provides information about backing up andtuning the event database, managing Tivoli region definitions for the Web versionof the event console, and stopping and starting the event server.

Planning for event managementTo manage events, you and your operators must have the appropriate Tivoliauthorization roles. For information about the required Tivoli authorization roles,see “Required Tivoli authorization roles” on page 13. You must also decide aboutthe event groups that will meet your needs. Event groups specify the events thatare displayed on the event console based on the filter criteria you specify. Whenyou assign an operator to an event console, you are defining the area ofresponsibility for that operator. The Tivoli Enterprise Console product providespredefined event groups and event consoles so that operators can manage eventsimmediately with little or no configuration required. If the predefined eventgroups and event consoles do not entirely meet your needs, you can modify thepredefined event groups, and you can create additional event groups and eventconsoles.

Predefined event groupsThe Tivoli Enterprise Console product provides the following predefined eventgroups:

AllActiveEventsEvents that are in open and acknowledged state.

EbusinessEventsEvents for IBM WebSphere Application Server, DB2, and WebSphere MQresources that are monitored by the IBM Tivoli Monitoring product.

UnMonitoredEBusinessEvents for IBM WebSphere Application Server, DB2, and WebSphere MQresources that are not being monitored by the IBM Tivoli Monitoringproduct. If the Tivoli NetView component is enabled to do port scans, theTivoli NetView component can discover the hosts that are running IBMWebSphere Application Server, DB2, or WebSphere MQ resources. TheTivoli NetView component then forwards events related to these resourcesto the event server.

ProbableEventAssnEvents that define the probable root cause of events for IBM WebSphereApplication Server, DB2, or WebSphere MQ resources. For example, if theTivoli Enterprise Console product repeatedly receives a sequence ofWebSphere Application Server events related to its access to a DB2resource and at the same time receives events indicating a DB2 failure, theTivoli Enterprise Console product determines that the root cause of theproblem is that the host on which DB2 resides is down. The TivoliEnterprise Console product then sends a TEC_Probable_Event_Associationevent. If you are receiving numerous TEC_Probable_Event_Associationevents, you might need to define this association for the predefined rules


that the Tivoli Enterprise Console product uses for root cause analysis. Formore information about the predefined rules, refer to the IBM TivoliEnterprise Console Rule Set Reference.

MaintenanceMaintenance events that are not closed. Events in this group are used toinform an operator that a specific system is in maintenance mode. When asystem is in maintenance mode, events from that system cannot beprocessed. Events in this event group can be in open state oracknowledged state. Events in open state indicate a scheduled maintenancetime for the system identified in the event. Events in acknowledged stateindicate that the system identified in the event is within the scheduledmaintenance time.

OpenNetViewTivoli Netview events that are open.

OtherNetViewTivoli Netview events that are acknowledged or closed.

ServiceUnavailableEvents from the Tivoli Netview component that indicate that IBMWebSphere Application Server, DB2, or WebSphere MQ applications are notavailable.

Predefined event consolesThe Tivoli Enterprise Console product provides the following predefined eventconsoles:

AdministrativeConsoleDefault event console to which all predefined event groups are assigned.This event console is assigned to the root administrator. The rootadministrator can immediately manage events in the predefined eventgroups without having to perform any additional configuration.

EBusinessEventsConsoleEvent console to which the e-business event groups (EbusinessEvents,UnMonitoredEBusiness, and ProbableEventAssn) are assigned. Assign anoperator to this event console for management of all e-business events. Forinformation about creating an operator and assigning an operator to anevent console, see “Creating an operator” on page 29 and “Assigning anoperator to an event console” on page 29, respectively.

Planning for new event groupsTo create your own event groups (in addition to the predefined event groups thatthe Tivoli Enterprise Console product provides), you must decide which events tomonitor and which attributes of those events to use in filters for the event group.These attributes collectively constitute the event group filter. Operators canmonitor multiple event groups. When you define event groups, you can decide, forexample, that an operator is responsible for all NFS-related problems across thenetwork or for only specific hosts. Because event groups specify the type of events(such as, all events from the engineering department) that are displayed on anevent console, the event group can include events from several different eventsources. (Event sources refer to the event adapters that send events to the eventserver.)

Use a worksheet similar to the following to plan your event groups. Rememberthat you can filter on all base event attributes (not extended or customer-defined


attributes), not only the event attributes shown in the example. You can use SQLwildcard characters to specify event filters. For more information about creating anevent group, see “Creating an event group” on page 27.

Note: When you create an event group, consider adding a criterion to the filter onthe date_reception event attribute that limits the time range of the eventsthat are retrieved. Doing this improves performance.

Table 5. Worksheet for creating an event group

Event Group DefinitionEvent Group:_______________________________________

Filter Name

Event Classes

Severity

Status

Sources

Origins

Sub-Origins

Planning for event group roles

When you assign an event group to an event console, you also assign TivoliEnterprise Console event group roles to the event console. Assigning an operatorto the event console gives that operator the Tivoli Enterprise Console event grouproles associated with that event console.

The access control list (acl) attribute of each event defines the Tivoli EnterpriseConsole event group roles that are required to acknowledge and close an event.The acl attribute can have a value of super, senior, admin, or user, or anycombination of these. The default value for the acl attribute is admin.

If an event is configured to be part of two different event groups and you assignboth event groups to the same event console with different event group roles, it ispossible that an operator can acknowledge and close the event in one event groupand only view the same event in another event group. Assume that you havedefined the event Su_Failure, which has an acl value of admin, to be part of boththe Network and the System event groups. You have assigned the Network eventgroup to an event console with an event group role of admin, and you haveassigned the System event group to the same event console with an event grouprole of user. The operator can acknowledge and close the Su_Failure event in theNetwork event group, but the operator can only view the Su_Failure event inSystem event group.

Use a worksheet similar to the following to correlate each event group with theevent console and event group roles to which the event group is assigned.

Table 6. Worksheet for correlating an event group with an event console and event grouproles

Event Group RolesEvent Group:_______________________________________

Event console Event group roles

Chapter 2. Configuring the Tivoli Enterprise Console product 21

Table 6. Worksheet for correlating an event group with an event console and event grouproles (continued)

Event Group RolesEvent Group:_______________________________________

Configuring event adaptersEvent adapters send events to the event server through the Tivoli ManagementFramework or through standard TCP/IP communication. If you anticipate that anevent adapter will produce events at a relatively high rate, or if it is critical thatevents be delivered to the event server as quickly as possible, you should use aconnection-oriented event delivery method. If you anticipate that an event adapterwill produce events at a relatively low rate, and it is not critical that events bedelivered to the event server as quickly as possible, you can avoid the systemoverhead of maintaining a connection between the event adapter and the eventserver at all times by using a connectionless event delivery method. If you use thismethod, a connection is established when an event occurs, the event is sent to theevent server, and the connection is ended.

Third-party vendors can also provide event adapters.

For information about installing and configuring event adapters, refer to the IBMTivoli Enterprise Console Adapters Guide.

Configuring the Tivoli Enterprise Console gatewayIf you are using endpoint adapters, you must install and configure the TivoliEnterprise Console gateway. You can also use the Tivoli Enterprise Consolegateway if you want to consolidate events at a single point and control the numberof events sent across your network or if you have geographically dispersed sitesand want to consolidate events locally before events are sent to a central server.For more information, see Chapter 5, “Tivoli Enterprise Console gateway”, onpage 67.

Configuring the event serverAfter you configure the event adapters, you need to configure the components ofthe event server. If you add a new event adapter to your system, you might needto configure the event server. For example, you might need to update an eventsource list or add a BAROC file to the rule base. You can configure the followingcomponents of the event server:v Event source (source list)v Event server and logging optionsv Rule bases


Updating the source listThe name you use for an event adapter in the source list must be the same as thesource name defined in the event adapter. The source name of an event adapter isidentified in the documentation for the event adapter. The source name for anevent adapter is unique to that adapter.

Creating a source itemWhen the event server is installed, sources are defined for all adapters that theTivoli Enterprise Console product provides. If you add an event adapter, you mustcreate a source for the adapter.

The following table lists the context and authorization role required to perform thistask.

Activity Context Required Role

Create a source Event server senior

To create a source for an adapter type, follow these steps from the Tivoli desktop:1. Right-click the EventServer icon and select Sources to display the TEC Source

List dialog box.2. Type the source name in the Name text box. This name must match the source

name used for the events that are produced by the event adapter. For moreinformation about event adapters, refer to the IBM Tivoli Enterprise ConsoleAdapters Guide. The following list describes the source that corresponds to eachevent adapter:

Source Adapter

AS400_ALERT AS/400® alert

AS400_MSGQ AS/400 message

HPOV HP OpenView

LOGFILE UNIX logfile

NT Windows NT and Windows event log adapters

NV390ALT NetView/390 alert

NV390MSG NetView/390 message

NV6K Tivoli NetView adapter

SNMP Simple Network Management Protocol3. Type a description of the source in the Label text box.4. Click Add Source to add the source item to the Sources scrolling list.5. Click Save & Close.

For information about using a command to create a source item, refer to thewcrtsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.

Changing a source itemYou can change a source item to change the icon or label for the source. Do notchange the source name unless you entered a source name that is not valid whenyou created the source.




Edit a source Configuration view in theJava version of the eventconsole

senior

To change a source item, follow these steps from the Tivoli desktop:1. Right-click the EventServer icon and select Sources to display the TEC Source

List dialog box.2. Select the source item to edit from the Sources scrolling list and click Edit.3. Modify the Name and Label text box as appropriate.4. Click Replace Source to make your changes.5. Click Save & Close.

For information about using a command to edit a source item, refer to the wsetsrccommand in the IBM Tivoli Enterprise Console Command and Task Reference.

Deleting a source itemDelete a source item when the source item becomes obsolete, for example, whenyou are no longer using the event adapter or when a resource is removed from thenetwork. Delete all events with an obsolete source from the event repository andevent cache before deleting the source.



Delete a source Configuration view in theJava version of the eventconsole

senior

To delete a source item from the source list, follow these steps from the Tivolidesktop:1. Right-click the EventServer icon and select Sources from the context menu to

display the TEC Source List dialog box.2. Select the source item to be deleted from the Sources scrolling list and click

Delete.3. Click Save & Close.

For information about using a command to delete a source item, refer to thewdelsrc command in the IBM Tivoli Enterprise Console Command and Task Reference.

Changing the logging defaultsYou can specify how the event server processes Tivoli Enterprise Console logs (thetype of information to be logged and how long to retain this information). You canalso change the default values of the following items:v Size of the event cachev Amount of time to keep events in the event cachev Amount of time to allow for the event server to startv Whether or not to activate rule tracing




Configure the event server Event server senior

To change the default values for logging, follow these steps from the Tivolidesktop:1. Right-click the EventServer icon and select Parameters. The Event Server

Parameters dialog is displayed.2. The Event Server Parameters dialog contains the following options:

Log reception of eventsDetermines whether events are logged and is used in conjunction withthe Time to keep event reception log information option.

Note: This setting is not automatically enforced and is used by theClean_Database task in the TEC Tasks library. You can run theClean_Database task immediately or you can schedule theClean_Database job to run the task later.

Maximum number of event messages buffered in memorySpecifies the maximum number of incoming events to store in thememory of the tec_reception process while the server processes anexisting event. The default value is 500 events.

Event cache sizeSpecifies the maximum number of events to keep in the event cache forrule evaluation. The rule engine uses the events in the event cache forcorrelation. The default value is 1000 events.

Time to keep closed events in cacheSpecifies the amount of time, in hours, to keep a closed event in theevent cache. The default value is 24 hours.

Time to keep event reception log informationSpecifies the amount of time, in hours, to keep logged events. Thedefault value is 24 hours. This option is available when the Logreception of events option is activated.

Time to keep non-closed eventsSpecifies the amount of time, in days, to keep an event that is in theOPEN or ACK state in the event cache. The default value is 180 days.

Time allowed for server initializationSpecifies the amount of time, in seconds, to allow the event server tosynchronize its processes. If the server cannot synchronize its processeswithin the specified time, the server generates an error message andshuts down. The default value is 300 seconds.

Trace RulesDetermines whether rules are traced and is used in conjunction withthe Rule Trace File text box. To trace rules, the rules must be compiledwith the tracing option activated. See the IBM Tivoli Enterprise ConsoleRule Developer’s Guide for more information about rule tracing.

Rule Trace FileSpecifies the path name for the trace file. The default file name is/tmp/rules.trace.


3. Click Save & Close. Stop and restart the event server to incorporate thechanges.

For information about using commands to change the logging defaults, refer to thewsetesvrcfg and the wlsesvrcfg commands in the IBM Tivoli Enterprise ConsoleCommand and Task Reference.

Managing rule basesYou can perform the following rule base operations:v List all known rule basesv List the rule base currently being used by the event serverv List all the rule sets that are contained in a specified rule basev Change the properties of a rule basev Create a new rule basev Copy a rule basev Delete a rule basev Add a rule set to a rule basev Add class definitions to a rule basev Compile a rule basev Load a rule base

For information about performing rule base operations, refer to the IBM TivoliEnterprise Console Rule Developer’s Guide and the wrb command in the IBM TivoliEnterprise Console Command and Task Reference.

Creating an event consoleThe following table lists the context and Tivoli authorization role required toperform this task:


Create an event console Configuration view in theJava version of the eventconsole

senior

For information about creating an event console from the Java version of the eventconsole, refer to the online help.

For information about using a command to create an event console, refer to thewconsole command in the IBM Tivoli Enterprise Console Command and Task Reference.If you are creating event consoles for multiple administrators, you can copy anexisting event console. To do this, use the –c option of the wconsole command.

Configuring an event consoleThis section describes the configuration tasks to perform if you are not using thepredefined event groups and the predefined event consoles. It also describes someoptional configuration tasks, such as configuring custom buttons for an eventconsole. You can configure an event console only from the Java version of theevent console. The Java version and the Web version of the event console use thesame configuration settings.


This section describes the following topics:v “Creating and changing an event group”v “Assigning an event group to an event console” on page 28v “Creating an operator” on page 29v “Assigning an operator to an event console” on page 29v “Integrating your trouble ticket system with the trouble ticket rules” on page 29v “Customizing an event console” on page 33v “Configuring custom buttons for an event console” on page 33v “Exporting and importing event console definitions” on page 38

Creating and changing an event groupThis section describes how to create, modify, and delete an event group.

Creating an event groupTo create an event group, you specify the event filters that define the events thatare to be included in the event group. After you create an event group, assign theevent group to one or more event consoles and then assign an operator to eachevent console.



Create an event group Configuration view in theJava version of the eventconsole

senior

For information about creating event groups, event group filters, and event groupfilter constraints, refer to the following entries in the online help.v Creating an Event Groupv Creating an Event Group Filterv Creating an Event Group Filter Constraintv Creating an Event Group Filter Constraint with SQL

Editing event group propertiesWhen you edit event group properties, you can change the name or description ofthe event group.



Edit event group properties Configuration view in theJava version of the eventconsole

senior

For information about editing event groups properties, see Editing Event GroupProperties in the online help.

Editing an event group filterYou might need to edit an event group filter when users, hosts, and applicationsare added to or removed from the network.




Editing an event group filter Configuration view in theJava version of the eventconsole

senior

For information about editing an event group filter, refer to the Editing EventGroup Filter Properties entry in the online help.

Deleting an event groupDelete obsolete event groups to help conserve system resources. When you deletean event group, filters associated with that event group are also deleted.



Delete an event group Configuration view in theJava version of the eventconsole

senior

For information about deleting event groups, see the Deleting an Event Groupentry in the online help.

Deleting event group filtersFilters can be deleted as system resources change. Deleting a filter can change theevents displayed on event consoles.



Delete a filter Configuration view in theJava version of the eventconsole

senior

For information about deleting event group filters, see the Deleting an EventGroup Filter entry in the online help.

Assigning an event group to an event consoleAfter you have created an event console, assign one or more event groups to theevent console. When you assign an event group to an event console, you alsoassign the appropriate event group roles to the event console. Assigning anoperator to an event console gives that operator the event group roles associatedwith that event console. For more information about event group roles, see“Planning for event group roles” on page 21.




Assign an event group Configuration view in theJava version of the eventconsole

senior

For more information about using and configuring event consoles, refer to theonline help.

Creating an operatorThe following table lists the context and authorization role required to perform thistask.


Create an operator Configuration view in theJava version of the eventconsole

senior

For information about how to create an operator for an event console, refer to theonline help.

Assigning an operator to an event consoleBefore you can assign an operator to an event console, the operator must bedefined as a Tivoli administrator and have the appropriate Tivoli authorizationroles. For information about defining an administrator, refer to the TivoliManagement Framework User’s Guide. For information about the authorization rolesthat the Tivoli Enterprise Console product requires, see “Required Tivoliauthorization roles” on page 13.



Assign an operator to anevent console

Configuration view in theJava version of the eventconsole

senior

For information about how to assign an operator to an event console, refer to theonline help.

Integrating your trouble ticket system with the trouble ticketrules

To help you manage problems more efficiently, you can integrate your troubleticket system, such as Peregrine System’s Service Center, with the Tivoli EnterpriseConsole product. To integrate your trouble ticket system, the Tivoli EnterpriseConsole product provides the following items:v Trouble ticket rules, which are defined in the troubleticket.rls file

The trouble ticket rules automatically open, update, or close a trouble ticket inresponse to an event that meets the criteria you specify. The trouble ticket rulesalso provide the function to associate an existing trouble ticket with the eventfor which the trouble ticket was opened. The troubleticket.rls file is located inthe default rule base in the TEC_RULES subdirectory.


v A sample script, TroubleTicket.sh

The TroubleTicket.sh script simulates the interface to a trouble ticket system.The TroubleTicket.sh script is located in the Install_dir/bin/interp/TME/TECdirectory on the event server. As provided, when an event is received thatmatches the event criteria, the TroubleTicket.sh script writes the eventinformation in a text file in the /tmp directory named tteventID.log whereeventID is the ID of the event. The TroubleTicket.sh script updates thetteventID.log file with status and severity changes for the event and withinformation about associated events. The TroubleTicket.sh script also providesthe function to perform these actions:– Associate an existing trouble ticket ID to an event– Reflect changes made in a trouble ticket in the associated event

To integrate your trouble ticket system with the Tivoli Enterprise Console product,complete the following procedures:1. Customize the trouble ticket rules to automatically respond to events as

described in “Customizing the trouble ticket rules”.2. Optionally, customize the TroubleTicket.sh script to add the script that invokes

your trouble ticket system so that it automatically opens, updates, and closes atrouble ticket in response to an event that meets your criteria.

3. Optionally, enable your trouble ticket system to update events when an actionhas been performed on a trouble ticket.

Note: Your trouble ticket system must be installed and operational. Forinformation about installing your trouble ticket system, refer to theappropriate documentation for your trouble ticket system.

Customizing the trouble ticket rulesTo customize the trouble ticket rules to act on events that meet the criteria youspecify, follow these steps:1. Load the troubleticket.baroc file, which is located in the default rule base in the

TEC_CLASSES subdirectory. The troubleticket.baroc file defines theTT_OPEN_EVENT, the TT_UPDATE_EVENT and the TT_CLOSE_EVENTclasses, which the Tivoli Enterprise Console product uses to respectivelyassociate, update, and close events for existing trouble tickets.

2. Modify the troubleticket.rls file to meet your needs. In particular, you mightwant to edit the event criteria that cause the rules to automatically open atrouble ticket in response to an event. Edit the troubleticket.rls file as follows:a. Change any of the following parameters as appropriate:

_tt_adminSpecifies the administrator name to use when automaticallyacknowledging or closing events. The default value istroubleticket.rls.

_tt_err_logSpecifies the name of the log file. The default log file is/tmp/troubleticket.err.

_assoc_flagSpecifies whether or not multiple events can be associated with thesame trouble ticket. The default value is ON, which associatesmultiple events with the same trouble ticket. To create a troubleticket for each event that matches the specified criteria, set thisvalue to OFF.


_kbase_fileSpecifies the name of the file used to store trouble ticket facts in theknowledge base. The default file name is $DBDIR/troubleticket.pro.

_tt_elapsedSpecifies the amount of time (in seconds) to search backward orforward in the event cache for an associated event. The defaultvalue is 604 800 (one week).

b. Specify the event criteria for which to open a trouble ticket automatically inthe configure_knowledge_base action of the tt_configure rule. The eventcriteria includes the event class, severity, and the fully qualified host namein the event. To match all possible values for the event class, the severity, orthe host name, use an underscore character ( _ ). Here are some examples.

This event criteria Opens a trouble ticket for

assert_tt(_, _, _) All events

assert_tt(_, ’CRITICAL’, _) All critical events

assert_tt(_, ’CRITICAL’,’myhost.raleigh.ibm.com’)

All critical events frommyhost.raleigh.ibm.com

As provided, the troubleticket.rls file defines the following event criteria:assert_tt(’TEC_Error’, ’FATAL’, _)

This event criteria causes the trouble ticket rules to open a trouble ticket forall fatal TEC_Error events from any host.

For more information about the trouble ticket rules and rule languagepredicates, refer to the IBM Tivoli Enterprise Console Rule Set Reference.

3. Activate, compile, and load the troubleticket.rls file.

Automatically opening, updating, and closing a trouble ticketThe following table describes how the trouble ticket rules and the TroubleTicket.shscript automatically open, update, and close a trouble ticket in response to anevent. This example assumes that you have customized the trouble ticket rules asdescribed in “Customizing the trouble ticket rules” on page 30.


Condition Action

A new event is received that matchesthe specified criteria.

A rule checks the value of the _assoc_flag parameter in the TroubleTicket.shscript and performs one of these actions:

v If the value of the _assoc_flag is ON (the default value), the rule searchesthe event cache for a similar event (one with the same event class,severity, and host name) that has a trouble ticket ID in the ttid event slot.If such an event is found in the event cache, the TroubleTicket.sh scriptassociates the new event with the existing trouble ticket for the cachedevent. The TroubleTicket.sh script sends the trouble ticket ID for thecached event to the event server, and the event server updates the ttidevent slot in the new event with the trouble ticket ID. TheTroubleTicket.sh script updates the /tmp/tteventID.log file withinformation about the associated event. If a similar event is not found inthe event cache, the TroubleTicket.sh sends a new trouble ticket ID to theevent server, and the event server updates the ttid event slot in the newevent with the trouble ticket ID. The TroubleTicket.sh script writes all theevent slots of the event in the /tmp/tteventID.log file and includes amessage indicating that a trouble ticket should be opened for this event.

v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script sends anew trouble ticket ID to the event server, and the event server updates thettid event slot in the new event with the trouble ticket ID. TheTroubleTicket.sh script writes all the event slots of the event in the/tmp/tteventID.log file and includes a message indicating that a troubleticket should be opened for the event.

The status of an event associatedwith a trouble ticket has beenchanged to any value other thanCLOSED.

The TroubleTicket.sh script updates the /tmp/tteventID.log file withinformation describing the change made to the event.

An event associated with a troubleticket has been closed.

A rule checks the value of the _assoc_flag parameter in the TroubleTicket.shscript and performs one of these actions:

v If the value of the _assoc_flag is ON (the default value), the rule searchesfor an event in the event cache that has the same trouble ticket ID in thettid event slot and is not closed. If an associated event is found, theTroubleTicket.sh script updates the /tmp/tteventID.log file with amessage indicating that the event has been closed, but the trouble ticket isstill open. If an associated event is not found, the TroubleTicket.sh scriptupdates the /tmp/tteventID.log file with a message indicating that theoriginal event for the trouble ticket has been resolved and closed.

v If the value of the _assoc_flag is OFF, the TroubleTicket.sh script updatesthe /tmp/tteventID.log file with a message indicating that the originalevent for the trouble ticket has been resolved and closed.

Enabling your trouble ticket system to update eventsYou can enable your trouble ticket system to update events based on an action thatis performed on a trouble ticket. To do this, run the TroubleTicket.sh script, whichis located in Install_dir/bin/interp/TME/TEC directory on the event server. TheTroubleTicket.sh script uses the following parameters:

fully_qualified_hostnameName of the host on which the trouble ticket system is running.

ttid Trouble ticket ID.

event_handleValue in the event_handle event slot of the event you want to update.

date_receptionValue in the date_reception event slot of the event you want to update.


server_handleValue in the server_handle event slot of the event you want to update.

slotvectorComma separated list of the name=value pairs for the event slots that youwant to change. Each name=value pair must be enclosed in singlequotation marks as follows:’severity=HARMLESS’,’source=source1’

v To update the ttid event slot of an event when a new trouble ticket has beenopened, run the following command from a script or the command line:TroubleTicket.sh ASSOCIATE_TEC_EVENT fully_qualified_hostname ttid \event_handle date_reception server_handle

v To update one or more event slots of an event (such as, the severity or status ofthe event) when an action is performed on a trouble ticket, run the followingcommand from a script or the command line:TroubleTicket.sh UPDATE_TEC_EVENT fully_qualified_hostname ttid \event_handle date_reception server_handle slotvector

v To close an event when a trouble ticket has been closed, run the followingcommand from a script or the command line:TroubleTicket.sh CLOSE_TEC_EVENT fully_qualified_hostname ttid \event_handle date_reception server_handle

Customizing an event consoleYou can customize many preference settings for event consoles. Both the Javaversion and the Web version of the event console use these preference settings. Forexample, you can change the severity color for events, and you can customize thefields you want to display in the event viewer. The event viewer shows the EventType, Status, Class, Severity, Hostname, Message, and Time Received fields. Youcan customize the event viewer by adding or deleting one or more fields. Theevent console preferences are stored centrally in the event database.



Customize an event console Editing event consoleproperties in the Java versionof the event console

senior

Some event console preferences pertain to only the Java version of the eventconsole. For example, you can configure event console appearance properties todisplay raw values or percentages in the tool tips in either the Summary Chartview or the Priority view of the Java version of the Web console. You can alsocustomize the Java version of the event console to initialize with the event viewerfor a specific event group using the tec_console command. For more informationabout the tec_console command, refer to the IBM Tivoli Enterprise Console Commandand Task Reference.

For more information about customizing an event console, refer to the online help.

Configuring custom buttons for an event consoleYou can configure up to three custom buttons for the Java version and the Webversion of the event console. An operator can then select an event in the eventviewer and click the custom button to perform a user-defined action. You can


configure a button in the Java version of the event console to run a script or localcommand on the selected event. You can configure a button in the Web version ofthe event console to open a URL in the context of the selected event and run a Webapplication. To configure a custom button, you create the button and you associatean action with the button. Use the Console Properties dialog from the Java versionof the event console to create, modify, or delete custom buttons for an eventconsole. To display new custom buttons in an event viewer that is already open,you must close and restart the event console.



Create, modify, or removecustom buttons for eventconsoles

Editing event consoleproperties in the Java versionof the event console

senior

For more information about configuring custom buttons, refer to the online help.

Associating an action with a custom button in the Java versionof the event consoleThe following sections include examples of command scripts that start a Javaapplication from a custom button in the event viewer.

When an operator selects an event and then selects a custom button in the Javaversion of the event console, the attributes of the selected event are passed to thescript as environment variables. The SLOTS environment variable contains a stringarray with all event attributes exported by the event console, as shown in thefollowing example.SLOTS=num_actions hostname server_path adapter_host source cause_eventseverity status

Each of the event attributes in the string array are also environment variables andcan be used individually in a custom script. For a complete list of event attributesavailable to the SLOTS environment variable, refer to the IBM Tivoli EnterpriseConsole Command and Task Reference.

Note: If environment variables were specified to create custom buttons in a priorrelease, the environment variables are ignored when creating custom buttonsas console properties. Custom buttons created as console properties alwayssupersede those created by using environment variables in prior productversions.

Example command script for running a Java application in a Windowsenvironment: To run a CMD or a BAT file from a custom button in the eventviewer in a Windows environment, you must first specify the @echo off tag as thefirst line of your command script, as shown in the following example.

The following example runs a Java application in a Windows environment usingthe SLOTS environment variable as the argument:@ECHO off@REM Sample script to use as a Custom Button@REM This script checks information about the selected Event and logs@REM it into a temp file.

SET TMP_FILE=C:\TEMP\CustomButtonSample.txt


@REM SLOTS contains all slots defined in the Event@REM if SLOTS is not defined then NO Event has been@REM selected in the Event Viewer

IF "%SLOTS%" == "" GOTO NeedEvent

@REM Initialize new logSET EVENT_ID=%event_hndl%:%server_hndl%:%date_reception%

ECHO Start log for event %EVENT_ID% >> %TMP_FILE%

ECHO Slots of the selected event: >> %TMP_FILE%ECHO %SLOTS% >> %TMP_FILE%

@REM Use class, status and severity to determine which action to@REM take against the Event selected

IF "%class%" == "TEC_Start" ECHO TEC Server has been started. >> %TMP_FILE%IF "%class%" == "TEC_Stop" ECHO TEC Server has been stopped. >> %TMP_FILE%IF "%severity%" == "FATAL" ECHO Severity is FATAL: immediate action required. />> %TMP_FILE%IF "%status%" == "OPEN" ECHO Status is OPEN: no operator is responsible /for this event. >> %TMP_FILE%

@REM Finalize logECHO Stop log for event %EVENT_ID% >> %TMP_FILE%GOTO EndScript

:NeedEventECHO No event has been selected. >> %TMP_FILE%

:EndScript@ECHO on

Example script for running a Java application in a UNIX or Linux environment:To run a shell script from a custom button in the event viewer within a UNIX orLinux environment, you must first specify the shell program before the script.

If the custom button script starts a graphical application, such as a Java GUI, youmust specify the export DISPLAY environment variable in your script, as shown inthe following example.#!/bin/sh

export DISPLAY=:0.0/usr/jdk/bin/java MyCustomButton $(SLOTS)

The following example starts a Java application in a UNIX environment using theSLOTS environment variable as the argument:#!/bin/sh

# Sample script to use as a Custom Button# This script checks some information about# the selected Event and logs it into a temp# file.

TMP_FILE=/tmp/CustomButtonSample.txt

# SLOTS contains all slots defined in the Event# if SLOTS is not defined then NO Event has been# selected in the Event Viewer

if [ "${SLOTS}" = "" ]then

echo "You must select an event to run this script!"


exit 1fi

# Initialize new logEVENT_ID=${event_hndl}:${server_hndl}:${date_reception}

echo "Start log for event ${EVENT_ID}" >> ${TMP_FILE}

# Print all slots values# slot=valueecho "Slots of the selected event: " >> ${TMP_FILE}for i in ${SLOTS}do

value=`env | grep $i | grep -v SLOTS | cut -f2 -d’=’`echo "$i = $value" >> $TMP_FILE

done

# Use class, status and severity to determine# which action to take against the Event selected

if [ "${class}" = "TEC_Start" ]then

echo "TEC Server has been started." >> ${TMP_FILE}fi

if [ "${class}" = "TEC_Stop" ]then

echo "TEC Server has been stopped." >> ${TMP_FILE}fi

if [ "${severity}" = "FATAL" ]then

echo "Severity is FATAL: immediate action required." >> ${TMP_FILE}fi

if [ "${status}" = "OPEN" ]then

echo "Status is OPEN: no operator is responsible for this event." >> ${TMP_FILE}fi

# Finalize logecho "Stop log for event ${EVENT_ID}" >> ${TMP_FILE}echo " " >> ${TMP_FILE}

Associating an action with a custom button in the Web versionof the event consoleWhen an operator selects an event and then selects a custom button in the Webversion of the event console, the attributes of the selected event are passed to theURL that you defined when you created the custom button. The following exampleis a sample servlet that can be associated with a custom button.package test.launch;

import java.io.IOException;import java.io.Writer;import java.util.Enumeration;import java.util.Iterator;import java.util.Map;

import javax.servlet.ServletException;import javax.servlet.http.HttpServlet;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;

/***<code>SampleLaunchIntoAppServlet</code> services HTTP requests from event console.* It does not have a mapping in the web.xml for the event console web application.

* The purpose of this servlet is to demonstrate the initialization of* different parts of an application when the event console custom buttons* are configured.* **/public class SampleLaunchIntoAppServlet extends HttpServlet {public static final String CLASSNAME = SampleLaunchIntoAppServlet.class.getName();

/***************************************************************************** Implements HttpServlet.doPost()* * Launch the task specified by the pathInfo of the URI.** @param request The HTTP request* @param response The HTTP response*****************************************************************************/public void doPost(HttpServletRequest request, HttpServletResponse response)throws ServletException, IOException {// trace entrydoGet(request, response);// trace exit}

/***************************************************************************** Implements HttpServlet.doGet()* * Launch the task specified by the pathInfo of the URI.** @param request The HTTP request* @param response The HTTP response*****************************************************************************/public void doGet(HttpServletRequest request, HttpServletResponse response)throws ServletException, IOException {// trace entry

// expire all responses immediately so that no pages get cachedConsoleUtilities.setNoCachingHeaders(response);

// let’s read some request parms!Map parmMap = request.getParameterMap();

StringBuffer content = new StringBuffer("Event Context Information");content.append("\nRequest Parameter Map:\n");String key = null;String[] val = new String[1];for (Iterator i=parmMap.keySet().iterator(); i.hasNext(); ) {content.append("");key = (String)i.next();content.append(key);content.append(": ");System.arraycopy(parmMap.get(key), 0, val, 0, 1);content.append(val[0]);}response.setContentType("text/html"); //$NON-NLS-1$Writer respOut = response.getWriter();// write some basic html hererespOut.write("<HTML><HEAD><TITLE>A sample web app launched

from a web custom button in context of an event</TITLE></HEAD><BODY>");respOut.write(content.toString());respOut.write("</BODY></HTML>");

respOut.close();// trace exit}}

Exporting and importing event console definitionsExporting and importing console definitions is an efficient way to create backupsand a base set of event consoles in one Tivoli region and import them into otherTivoli regions for implementation or additional configuration. Therefore, you canuse the event console definitions in one Tivoli region as a single point of controlfor console configuration in an environment with multiple Tivoli regions. To dothis, you export the definitions of event groups, event consoles, and operators to afile and then import the definitions to a different installation of the TivoliEnterprise Console product in another Tivoli region. After you import thedefinitions, all Tivoli administrators have the same configuration view of objectdefinitions for event consoles in a Tivoli region.

Exporting and importing definitions from the Tivoli desktopThe following table lists the context and authorization role required to export andimport definitions from the Tivoli desktop.


Exporting and Importing Java version of the eventconsole

senior

For more information about exporting and importing event console definitions, seethe Exporting a Console and Importing a Console entries in the online help.

Exporting and importing definitions from the command lineFor information about using the command line to export and import event consoledefinitions, refer to the wtecexport and the wtecimport commands in the IBMTivoli Enterprise Console Command and Task Reference.

Managing Tivoli region definitions for the Web version of the eventconsole

When the Tivoli Enterprise Console product is installed, an administrator canconfigure the Tivoli region definitions for the Web version of the event consolewithin the IBM WebSphere Application Server product. These definitions specifythe following items:v Managed nodes to which an operator can connect when logging on to the Web

version of the event consolev User ID and password used to access the RIM databasev Cache timeout values for the event console

A Tivoli region is represented in the IBM WebSphere Application Server productby an authentication alias, a data source, and a connection factory as follows:v The authentication alias is used to encode and store the user name and

password, which the data source uses to access the RIM database.v The data source represents the connection to the event database. Event data,

console definitions, and operator preferences are stored in the event database.v The connection factory performs the following functions:


– Interfaces with the Tivoli Management Framework to authenticate operatorsand validate that they are authorized to use the event console

– Interfaces with the Tivoli Management Framework to obtain task information,start tasks, and obtain task results

– Interfaces with the UI server to update events and receive notifications foroperators

– Caches event and summary information after the information is retrievedfrom the event database

You might need to add or change the Tivoli region definitions after installation forthe following reasons:v If you add a Tivoli region after installationv If the host name of the Tivoli server has changedv If you want to change the user ID and password that is used to access the RIM

databasev If you want to change the cache timeout values for the event consolev If you delete a Tivoli region after installation

The procedure in this section describes the information that is relevant to the TivoliEnterprise Console product. For specific information about the IBM WebSphereApplication Server product, refer to the online help in the WebSphere ApplicationServer Administrative console and the IBM WebSphere Application Server productdocumentation, which you can access from the WebSphere InfoCenter at thefollowing Web site:

http://www-3.ibm.com/software/webservers/appserv/library/index.html

To add, change, or delete a Tivoli region definition, follow this general procedure:1. From the WebSphere Application Server Administrative Console, navigate to

Security —> JAAS Configuration —> J2C Authentication Data to create orchange the alias using the following information.

Name Type the name of the alias in the following format:TEC_region_host_name_DS_ALIAS

User IDType the user ID to access the RIM database.

PasswordType the password for the specified user ID.

Note: If you are deleting a Tivoli region definition, select the name of theappropriate alias and click Delete.

2. Navigate to the Resources —> JDBC providers. Select Server and then selectthe JDBC provider for the Tivoli Enterprise Console product, TEC 3.9.0 RIMJDBC Provider.

3. Click Data Sources.

Note: If you are deleting a Tivoli region definition, select the name of theappropriate data source, and click Delete.

4. If you want to change the host name or port number of the Tivoli server, go tostep 5 on page 40. If you want to create a Tivoli region definition, create a datasource using the following information:

Name Type the name of the data source in the following format:



TEC_region_host_name_DS

Where region_host_name is the fully qualified host name of the Tivoliserver.

JNDI NameType jdbc/TEC_region_host_name_DS.

Datasource Helper ClassnameType com.tivoli.tec.rimds.RIMDataStoreHelper.

Component-managed Authentication AliasSelect the name of the alias you created in Step 1 on page 39 from thedrop-down list.

Note: Do not create a container-managed authentication alias.5. Select the name of the data source and click Custom Properties. Add or

change two custom properties, one for the server name and one for the portnumber.v To add a custom property for the server name, use the following

information:

Name Type serverName.

Value Type the host name of the Tivoli server.

Type Select java.lang.String from the drop-down list.v Add the property for the port number with the following information:

Name Type portNumber.

Value Type the port number for the Tivoli server. The default port numberis 94.

Type Select java.lang.String from the drop-down list.6. Optionally, change the connection pool properties. To do this, select the name

of the data source and click Connection Pool.7. Navigate to Resources —> Resource Adapters. Select Node and then select

the resource adapter for the Tivoli Enterprise Console product, TEC 3.9.0Resource Adapter.

8. Click J2C Connection Factories.

Note: If you are deleting a Tivoli region definition, select the name of theappropriate connection factory and click Delete.

9. If you want to change the cache timeout values, go to step 10 on page 41. Ifyou are creating a Tivoli region definition, define one connection factory forthe Tivoli region using the following information:

Name Type the name of the connection factory in the following format:TEC_region_host_name_CF

Where region_host_name is the host name of the Tivoli server.

JNDI NameType the following string:eis/tec3_9/TEC_region_host_name_CF

Note: Do not define any authentication aliases.


10. Select the name of the connection factory and optionally change the customproperties. You can also optionally change the connection pool properties.You can change any of the following custom properties:

eventDataCacheTimeoutSpecifies the amount of time (in seconds) to cache event data from theevent database.

Note: Setting the eventDataCacheTimeout value to less than 60seconds can impact performance.

eventSummaryCacheTimeoutSpecifies the amount of time (in seconds) to cache event summarydata.

managedNodeListSpecifies a list of host names, each host name separated by a space, towhich an operator can connect when logging on to the event console.This parameter is required.

rimDataSourceNameType the JNDI name of the data source:jdbc/TEC_region_host_name_DS

This parameter is required.

taskCacheTimeoutSpecifies the amount of time (in minutes) to cache task informationfrom the Tivoli Management Framework.

11. Click Save on the taskbar.12. Stop and restart the WebSphere Application Server for the changes to take

effect.

Tuning the performance of the Web version of the event consoleFor optimal performance of the Web version of the event console, consider thefollowing recommendations:v Consider the number of open and active event groups that are available to

operators using the Web version of the event console. As the number of activeand open event groups increases and the event database grows, you might needto adjust the frequency at which event views are refreshed or the rate at whichoutdated events are deleted from the event database.

v Ensure that the maximum number of connections for the J2C connection pool isgreater than the number of users logged in to the Web version of the eventconsole at a given time. By default, the maximum number of connections for theJ2C connections pool is 50.To change the maximum number of connections for the J2C connection pool,follow these steps from the WebSphere Application Server AdministrativeConsole:1. Navigate to Resources —> Resource Adapters.2. Select Node and then select the resource adapter for the Tivoli Enterprise

Console product, TEC 3.9.0 Resource Adapter.3. Click J2C Connection Factories in the Additional Properties section.4. Select the appropriate connection factory and click Connection Pool in the

Additional Properties section.


5. Type the appropriate value in the Max connections field and click OK.6. Save and confirm your changes.7. Stop and restart the IBM WebSphere Application Server to incorporate the

changes.

Backing up and tuning the event databaseTo ensure optimal performance of the Tivoli Enterprise Console product, back upand tune your event database on a regular basis. For detailed information aboutbacking up and tuning your database, refer to the appropriate RDBMS databasedocumentation.

Also, perform the following tasks on a regular basis:v Clear unneeded data from the event database. To do this, use the wtdbclear

command. For information about the wtdbclear command, refer to the IBMTivoli Enterprise Console Command and Task Reference.

v Update database statistics and reorganize tables and indexes to eliminatefragmentation. To do this, use the wdbmaint.sh command. For informationabout the wdbmaint.sh command, refer to the IBM Tivoli Enterprise ConsoleCommand and Task Reference.

Stopping and starting the event serverSome configuration tasks require that you stop and restart the event server.



Stop or start the event server Tivoli desktop senior

To stop the event server, right-click the Event Server icon on the Tivoli desktopand select Shut Down.

To start the event server, right-click the Event Server icon on the Tivoli desktopand select Start-up.

You can also stop and restart the event server manually using the wstopesvr andthe wstartesvr commands, respectively. For more information about the wstopesvrand wstartesvr commands, refer to the IBM Tivoli Enterprise Console Command andTask Reference.

If an event server goes down, the UI server reconnects automatically when theserver comes back up. It is not necessary to shut down the UI server or an eventconsole to establish communication with the event server.


Chapter 3. Sample IT environment with configurationexamples

This chapter provides examples that are based on the IT environment in the AcmeCompany, a fictitious company, and the key personnel in the Acme Company whoare responsible for ensuring the optimal availability of the IT resources in theAcme Company. The examples illustrate how you can use the preconfiguredfeatures of the Tivoli Enterprise Console product to begin managing yourenvironment quickly, efficiently, and effectively. The examples also illustrate howyou can extend the management capabilities that the Tivoli Enterprise Consoleproduct provides.

Sample IT environmentThis sample customer scenario assumes that the Acme Company has its mainoffice in Raleigh, North Carolina, and branch offices in New York, Chicago, andLos Angeles. To support its business, the Acme Company uses the followingapplications:v Business applications that run on IBM WebSphere Application serversv WebSphere MQ for messaging services among the business applicationsv DB2 product for data storage

The business applications are distributed among the branch offices with the coreparts of the applications installed in the main office in Raleigh.

The IP addresses for hosts in the main office range from 9.27.1 to 9.27.9. The IPaddresses for hosts in the branch offices begin with 9.27.10 (for New York), 9.27.11(for Chicago), and 9.27.12 (for Los Angeles).

The Acme Company has the following departments in its main office in Raleigh,North Carolina.

Data entryConsists of seven people who primarily enter data into the businessapplications. The data is stored in a DB2 database that is running on anAIX® system in the main office.

MarketingConsists of five people who plan and implement sales strategies.Marketing personnel use the business applications to gather and analyzedata. The analytical data is stored in a DB2 warehouse that is running onan AIX system in the main office.

TradingConsists of ten people who buy and sell securities. Trading personnel usethe business applications, including Web-based applications, to performtheir jobs.

Information technologyConsists of six people who maintain the computer systems and thenetwork. IT personnel use the Tivoli Enterprise Console product and otherTivoli products to manage and ensure the optimal availability of the ITresources.


The following people are the system administrators and operators in the AcmeCompany.v Mary is the Database Manager. Mary is responsible for resolving

database-related problems.v Susan and George are Network Managers. Susan and George are responsible for

installing, configuring, and maintaining a heterogeneous network. Susan is theroot user and has the administrator role.

v Jim is the System Manager. Jim is responsible for maintaining and configuringthe workstations, printers, and mail systems.

v Carla is a System Manager. Carla is responsible for installing, configuring andmaintaining the business application infrastructure, consisting of IBMWebSphere Application servers and WebSphere MQ messaging servers.

v Mark is the Help Desk Manager. Mark primarily answers questions aboutapplications that the Acme Company uses. Mark receives notification of allevents so that he can be informed of the types of problems that users mightencounter.

All system administrators and operators are located in the main office in Raleighand are responsible for maintaining the availability of the business applicationsand the infrastructure that supports the applications without impacting thebusiness objectives of the company. The Acme Company relies on the TivoliEnterprise Console product to maintain availability of its IT resources because theTivoli Enterprise Console product unifies system and network management andprovides optimized event management for the following key e-businessapplications:v WebSphere MQv DB2v IBM WebSphere Application Server

Fast path to managing eventsThis example illustrates how Susan, the root administrator, can set up the TivoliEnterprise Console product to manage events quickly and efficiently. Susan doesnot need to configure the Tivoli Enterprise Console product because she can usethe predefined rule sets, event groups, and event consoles. Susan only needs toinstall and set up the adapters and install the rule base with the predefined rulesets to begin managing events. Susan can also associate each predefined eventgroup to an event console and associate the appropriate operator to that area ofresponsibility so that operators can begin managing events immediately.

Event adaptersThe main office uses the IBM Tivoli NetView component to manage its network.The local networks in the branch offices are managed with an SNMP-type adapter.A log-file adapter is installed on each individual employee’s computer (endpoint)on the network. The event adapters are installed on the same nodes as theirrespective resources.

A Tivoli Management Framework gateway is created on a managed node in eachlocation. The Tivoli Management Framework gateway is installed on Shamrock(9.27.1.6) in the Raleigh office, on Wheeler (9.27.10) in the New York City office, onFairview (9.27.11) in the Chicago office, and on Bandera (9.27.12) in the LosAngeles office. A Tivoli Enterprise Console gateway is set up in each TivoliManagement Framework gateway to perform event correlation and filtering close


to the event source. Endpoints are created on each host (managed node) andindividual computer (endpoint). Although a host is considered a managed node,an endpoint must be installed to run an event adapter.

The Adapter Configuration Facility is used to distribute and start each adapter onendpoints in the network. This facility is installed on the Tivoli server and allmanaged nodes in the network. This facility must be used to distribute the adapterto each endpoint. For additional information about the Adapter ConfigurationFacility, refer to the IBM Tivoli Enterprise Console Adapters Guide.

Event serverThe event server is located in the Raleigh office. It is installed on host wichita,which has an IP address of 9.27.1.5. The default event server configuration is used.

Server configurationThe default values are used for the event server as follows:

Log events in reception logThe default value is 84 600 seconds (24 hours).

Maximum number of event messages buffered in memoryThe default value is 500 events.

Event cache sizeThe default value is 1 000 events.

Time to keep closed events in cacheThe default value is 24 hours.

Time to keep non-closed eventsThe default value is 180 days.

Time allowed for server initializationThe default value is 300 seconds.

Event sourcesThe sources used correspond to the event adapters installed throughout the AcmeCompany as follows:v NV6Kv LOGFILEv SNMP

Rule basesSusan uses the Default rule base, which includes the following rule sets:

ebusiness.rlsAnalyzes events related to the following key e-business services (IBMWebSphere Application Server, DB2, and WebSphere MQ) to determinewhether the events are causally related to one another or to networkevents.

To use the ebusiness.rls rule set, Susan defines the dependencyrelationships that apply to the e-business services and network resourcesand loads the relationships into the knowledge base.

netview.rlsManages events from the Tivoli NetView component. The netview.rls rulescorrelate related Tivoli NetView events and manage the synchronization ofthe event server with the Tivoli NetView component.

Susan also loads and activates the following rule sets:

Chapter 3. Sample IT environment with configuration examples 45

maintenance_mode.rlsProvides automated event processing for a monitored system that is inmaintenance mode. By default, events received from a system inmaintenance mode are closed.

notify.rlsSupports sending notification to support personnel about new or changedevents.

Susan configures the notify.rls rule set to send e-mail notification to Mary,the Database Manager, whenever a critical DB2 event is received.

Event groupsSusan uses the predefined event groups to monitor the e-business services andnetwork resources. The predefined event groups are:v AllActiveEventsv EbusinessEventsv UnMonitoredEBusinessv ProbableEventAssnv Maintenancev OpenNetViewv OtherNetViewv ServiceUnavailable

The Tivoli Enterprise Console product also provides the following predefined eventconsoles:

AdministrativeConsoleDefault event console to which all predefined event groups are assigned.When the Tivoli Enterprise Console product is installed, Susan, the rootadministrator, is automatically assigned to the AdministrativeConsole.Because all predefined event groups are automatically assigned to theAdministrativeConsole, Susan can start managing IT resourcesimmediately, receiving and displaying events in their related event groupsfor network impacts, impacts to e-business services, and so forth.

EBusinessEventsConsoleEvent console to which the e-business event groups are assigned. Susanassigns Carla, who is responsible for maintaining the availability of thebusiness application infrastructure, to the EBusinessEventsConsole.

Susan associates the responsibilities of each operator with the predefined eventgroups so that the operators can monitor the resources for which they areresponsible. To do this, Susan assigns one or more events groups to an eventconsole and then assigns the appropriate operator to that event console. Forexample, Susan assigns the OpenNetView and the OtherNetView event groups toan event console and then assigns George, who is responsible for maintaining theavailability of the network, to that event console. Susan assigns theAllActiveEvents to an event console and assigns Mark, the Help Desk Manager, tothat event console.


Extending event management capabilitiesThe examples in this section illustrate how you can extend the event managementcapabilities that the Tivoli Enterprise Console product provides. For example,Susan can add new adapters and event sources, change event server defaults, andcreate new event groups.

Event adaptersTo extend the event management capabilities that the Tivoli Enterprise Consoleprovides, Susan can customize the adapters that the Tivoli Enterprise Consoleproduct provides using the Adapter Configuration Facility. For information aboutthe Adapter Configuration Facility, refer to the IBM Tivoli Enterprise ConsoleAdapters Guide. Susan can also create new adapters that are tailored to the networkenvrionment using the Tivoli Event Integration Facility. For information about theTivoli Event Integration Facility, refer to the Tivoli Event Integration FacilityReference.

Event serverThe default values for the event server can be changed to ensure optimalperformance. The default values determine how the event server stores andprocesses logs and how long it should wait for event server initialization. Todetermine the values to use for the event server, Susan starts with an estimate ofthe number of events that the event server processes on a daily basis. After theevent server runs for some time and Susan can determine the actual number ofevents that the event server processes on a daily basis, Susan adjusts the values toensure optimal performance. Susan determines the values for the event serverbased on the following information:v Average number of events that the tec_reception process receives daily and

stores in the reception log. To determine this information, Susan runs thefollowing command on the event server:wtdumper –t start_time –e end_time | grep END | wc

For more information about the wtdumper command, refer to the IBM TivoliEnterprise Console Command and Task Reference.

v Average number of open events that are stored daily in the event repository. Todetermine this information, Susan runs the following command on the eventserver:wtdumper –t start_time –e end_time | grep "status=OPEN" | wc

v Maximum number of events that the event server can potentially store inmemory. Susan must consider the peak periods in which a large number ofevents are sent to the event server and are queued until the event server is ableto process them. The event server stores queued events in the reception log andalso keeps queued events in memory.

v Time period in which to keep open events for correlation.v Time period in which to keep closed events for correlation.

This example assumes the following information:v The event server receives an average of 50 000 events daily.v The average number of open events that are stored daily in the event repository

is 15 000.v The maximum number of queued events is 3 000.v Keep non-closed events for two days for correlation.


v Do not keep closed events for correlation.

Server configurationBased on the information in this example, Susan configures the event server asfollows:

Log events in reception logThe default value, 84 600 seconds (24 hours), is used for this example.

Maximum number of event messages buffered in memoryThe default value, 500, is changed to 3 900. This value is based on themaximum number of queued events (3 000 in this example) plus 30% more(900) for padding.

If events get in a WAITING state, the buffer is too small, and the size ofthe buffer should be increased.

Event cache sizeThe default value, 1 000, is changed to 39 000. This value is based on theaverage number of events stored daily in the event repository (15 000 inthis example) multiplied by the number of days in which Susan wantsevents to remain in open state for correlation (2 in this example) plus 30%more (900) for padding.

If the event cache size is too small, events might be deleted from the cachewhen new events must be stored. In this situation, a Rule Cache full:forced cleaning event is sent to the event server, and the event cache sizeshould be increased. On the other hand, configuring the event cache to toolarge a value can affect performance when searching the event cache.

Time to keep closed events in cacheThe default value, 24 hours, is changed to 1 hour. This example assumesthat closed events do not need to be correlated and, therefore, do not needto be kept in the event cache.

Time to keep non-closed eventsThe default value, 180 days, is changed to 2 days. This example assumesthat open events are kept for two days for correlation.

Time allowed for server initializationThe default value, 300 seconds, is used for this example.

Event sourcesIf Susan adds new adapters, she must create event sources for the new adapters inaddition to the following event sources that have already been defined:v NV6Kv LOGFILEv SNMP

For more information, see “Creating a source item” on page 23.

Rule basesSusan can create a rule set that filters events based on the event sources thatcorrespond to the adapters that are installed in the Acme Company. Forinformation about creating a rule set, refer to the IBM Tivoli Enterprise Console RuleDeveloper’s Guide. For information about loading and activating a rule set, refer tothe IBM Tivoli Enterprise Console Rule Set Reference.

Event groupsThe following examples show how Susan, the root administrator, creates new eventgroups for the Acme Company. Each example contains worksheets for defining


possible event groups and operator roles. The examples use a subset of theattributes that you can use to specify filters. You can use any basic attribute of anevent to define a filter.v All operators get all eventsv Geographic differentiationv Network topology differentiationv Organizational differentiationv Event-type differentiation

Susan can assign the new event groups to the predefined event consoles, or shecan create new event consoles and assign the event groups to the new eventconsoles.

Example 1: All operators get all eventsIn this example, all operators are notified of all events. Susan, the rootadministrator, receives event notification for informational purposes.

Event Group Filter Constraints

All Events None (specifying no filter meansall events are received.)

None

Event Console Operators Event Group Roles

All Events Mary, George, Jim,Carla

All Events admin user

All Events – root Susan All Events super senior adminuser

All Events – ReadOnly

Mark All Events user

Example 2: Geographic differentiationIn this example, George in Raleigh resolves network problems for the branchoffices in New York, Chicago, and Los Angeles. Susan receives notification becauseshe is George’s backup. Because the origins of the remote sites cannot be expressedas a single value (the main office IP addresses are 9.27.1 to 9.27.9), three filters arecreated.


Sales Network Subnet 9.27.10 Source = ‘SNMP’ Origin LIKE9.27.10.%

Subnet 9.27.11 Source = ‘SNMP’ Origin LIKE9.27.11.%

Subnet 9.27.12 Source = ‘SNMP’ Origin LIKE9.27.12.%


Sales Network – root George Sales Network super senior adminuser

Sales Network Susan Sales Network senior admin user


Example 3: System management differentiationIn this example, Jim is responsible for resolving all hardware and operating systemproblems not related to the network. Carla is Jim’s backup.


SystemManagement

Monitored Sources Source IN ‘LOGFILE’, ‘OS2’, ‘NT’


System Management– root

Jim System Management super senior adminuser

System Management Carla System Management admin user

Example 4: Organizational differentiationIn this example, Susan and George are responsible for resolving the network andsystem problems for the Marketing department. The members of the Marketingdepartment use IP addresses beginning with 9.27.1.


Marketing Subnet 9.27.1 Origin LIKE ‘9.27.1.%’


Marketing Susan, George Marketing super senior adminuser

Example 5: Event-type differentiationIn this example, Susan is responsible for resolving very specific Tivoli NetViewproblems. George is Susan’s backup. The classes are defined in the BAROC file forthe Tivoli NetView adapter. Three filters are required.


Tivoli NetViewFaults

NetView Faults Class IN ‘TEC_ITS_INTERFACE_STATUS’,‘TEC_ITS_NODE_STATUS’,‘TEC_ITS_SUBNET_CONNECTIVITY’

Source = ‘NV6K’


NetView Faults –root

Susan Tivoli NetView Faults super senior adminuser

NetView Faults George Tivoli NetView Faults senior admin user


Chapter 4. Managing events

This chapter is intended for operators. It describes how to use the event console tomanage events. The Tivoli Enterprise Console product provides two versions of theevent console: a Java version and a Web version. You can use the Java version orthe Web version, or both, to manage events. Managing events using the Webversion of the event console is very similar to managing events using the Javaversion of the event console. However, you need to understand the differencesbetween the two versions of the event console.v You can run automated tasks that you configure only from the Java version of

the event console.v You can start Tivoli NetView functions only from the Java version of the event

console.v You can sort events based on any number of columns in the Java version of the

event console. You can sort events based on up to three columns in the Webversion of the event console.

v Custom buttons are implemented differently in the Java version and the Webversion of the event console. If your administrator has configured one or morecustom buttons for the Java version of the event console, selecting an event andthen clicking a custom button runs a script or a local command on the selectedevent. If your administrator has configured one or more custom buttons for theWeb version of the event console, selecting an event and then clicking a custombutton passes the attributes of the selected event to a predefined URL and runs aWeb application.

Key concepts for event managementThis section describes the following concepts, which are basic to managing events:v Event statusv Event severityv Primary operator tasks

Event statusAn event begins in the open state, and an operator can change events to otherstates. The possible states of an event include the following:

ACK An operator has acknowledged the event and assumed responsibility for it.

CLOSEDThe event has been resolved. An event adapter can also send an event witha status of CLOSED to indicate that a previously received event of thespecified class should have the status changed to CLOSE. The previouslyreceived event to be closed is the most recent duplicate of the same eventdescription. The event is dropped and not stored in the event database.

Do not change the status of a CLOSED event.

custom_statusA status that has been added to the STATUS enumeration for site-specificpurposes. An administrator defines the STATUS enumeration in theroot.baroc file.

OPEN No action has been taken on the event.


RESPONSEA rule has automatically responded to the event. The RESPONSE status isassigned by a rule language predicate and is not available from an eventconsole.

Event severityEvents are classified with different severity levels. The severity levels help you tofocus on the most severe problems first. The event console uses the followingindicators, listed in order of decreasing severity, to indicate the severity of anincoming event:v FATALv CRITICALv MINORv WARNINGv HARMLESSv UNKNOWN

Custom severities can be created by adding new enumeration values to theroot.baroc file.

Primary operator tasksWhether you use the Java version or the Web version of the event console tomanage events, your primary tasks are the same. To manage events, use this basicprocedure:1. Start the event console.2. View the events in an event group. If an event is for informational purposes

only, go to step 5. If you are responsible for resolving the problem associatedwith the event, go to the next step.

3. Acknowledge the event.You must first acknowledge an event before you can resolve the problemassociated with the event. When you acknowledge an event, you let otheroperators know that you have taken responsibility for the event. You must havethe appropriate event group role to acknowlege the event.

4. Run system management tasks on the event.A task is a script that runs other Tivoli commands. Variable values are passedto a task when you run the task. The values passed can come from inputparameters and options specified or from event attributes available to the task.For tasks that need the attributes of an event available to them, you mustassociate the event with the task.The event console provides a set of predefined tasks in the task library namedT/EC Tasks. The name, T/EC Tasks, shows in task dialogs and is used whenspecifying the task library from a command line.

5. Close the event.When you have completed all the activities associated with an event, you canclose the event. Closing an event requires the same event console event grouprole as acknowledging the event.

6. Exit the event console.


Using the Java version of the event consoleThis section describes the tasks you can perform using the Java version of theevent console.

Starting the event consoleYou can start the event console from the command line in a bash shell or you canstart the event console from the Windows task bar.

Starting the event console from the command line in a bashshellTo start the event console from the command line in a bash shell, follow thesesteps:1. Enter the following command from the bash shell:

v From a DOS prompt or the bash shell on Windows:tec_console.cmd

v From a UNIX shell:tec_console

The Tivoli Management Environment® dialog is displayed.2. From the Tivoli Management Environment dialog, type the following

information in the text fields:v The name and port number of your host computer in the following format:

host_computer_name:port_number

v Your Tivoli Management Framework login IDv Your Tivoli Management Framework password

3. Click OK.

Starting the event console from the Windows task barTo start an event console from the Start menu in a Windows environment, followthese steps:

Note: This option is available only when you install an event console in anon-Tivoli environment.

1. From the Windows task bar, click Start —> Programs —> IBM Tivoli EventConsole —> IBM Tivoli Enterprise Console. The Tivoli ManagementEnvironment dialog is displayed.

2. From the Tivoli Management Environment dialog, type the followinginformation in the text fields:v The name and port number of your host computer in the following format:

host_computer_name:port_number

v Your Tivoli Management Framework login IDv Your Tivoli Management Framework password

3. Click OK.

The tec_console command starts the event console. This command is located in the$BINDIR/bin directory on the managed node where the event console is installed.On a host in a non-Tivoli environment or an endpoint with the non-Tivoli versionof the event console installed, the command is located in the directory where theevent console was installed. For more information about the tec_console command,refer to the IBM Tivoli Enterprise Console Command and Task Reference.

Chapter 4. Managing events 53

Exiting the event consoleTo exit the event console, select Close from the File menu in the initial view in theevent console. The initial view can be the Summary View, the Priority View, or theConfiguration View.

Viewing eventsThe Summary Chart view is the initial view, which offers a quick view of the eventactivity of all event groups for an event console using stacked bar charts. Click anybar representation of an event group to display details about that event group. Youcan change the initial event console view to the Priority view and click on thebutton representing a specific event group to view events. For more informationabout event viewer options, refer to the online help.

The event viewer displays all events for a selected event group. The top pane ofthe event viewer displays the Working Queue and the bottom pane displays theAll Events Queue. To hide the Working Queue or the All Events Queue, expand orcollapse the appropriate view using the arrow button displayed on the horizontalbar between the two views. The All Events Queue displays all events at all times.You can filter the events displayed in the Working Queue using the filter buttonson the tool bar of the event viewer.

You can view an event from the event console or from the command line. To viewan event from the event console, select the event and click View. For informationabout using the command line to list events, refer to the wlsemsg command in theIBM Tivoli Enterprise Console Command and Task Reference.



View an event Java version of the eventconsole

user, rim_view

Acknowledging eventsYou must have the event viewer displayed to acknowledge an event. When youselect an event group in the event viewer, all events for that event group aredisplayed. To acknowledge events, select one or more events from the WorkingQueue and click Acknowledge. For information about using the command line toacknowledge an event, refer to the wsetemsg command in the IBM Tivoli EnterpriseConsole Command and Task Reference.

The following table lists the context and event group role required to perform thistask.


Acknowledge an event Java version of the eventconsole

admin

Running tasksYou can configure and run tasks from task libraries using event console dialogs.You can also configure and run most tasks from the command line using the


wruntask command. For more information about the wruntask command, refer tothe Tivoli Management Framework Reference Manual.

Note: In this section, the term configure means to specify the input parameters andtarget hosts for the task.

To configure and run a task immediately, select Task Execution from the Selectedmenu in the event viewer.

Details about each task and how to configure and run tasks from the commandline are described in the Tivoli Enterprise Console Reference and the TEC LibraryTasks entries in the online help.

The event console also provides the ability to run automated tasks from the eventconsole. Automated tasks are configured ahead of time and run when a particularevent is received. For example, an administrator can configure an automated taskto send an e-mail message to an administrator when an event matching the criteriayou defined is received by the event console. To configure automated tasks, selectAutomated from the Selected menu in the event viewer.

From the Automated Tasks dialog, you can define or modify the followingproperties:v Namev Descriptionv When an event matchesv Execute these tasks

When an automated task completes, the task issues information about its successor failure and the output of the task, if any. A task-completion icon is displayed inthe first column of the event viewer when an automated task completes. You canclick the icon to view details about the automated task results.

Automated task results can also be written to a text file, which an administratorconfigures in the Console Properties dialog for each console. For more informationabout running an automated task, refer to the Automated Task entries in the onlinehelp.

Running local commandsYou can run a user-defined local command on selected events by running auser-defined script. The attributes of the event are passed to the script asenvironment variables. The name of the attribute environment variables can bereferenced by using the non-formatted attribute name. The full list ofnon-formatted attribute names is contained in the SLOTS environment variable,which is passed to the script.

To run a local command, follow these steps:1. From the event viewer, select the appropriate event in the Working Queue.2. From the Selected menu, click Local Command.3. From the Run dialog box, browse to the location of the script that you want to

run.4. Click OK.


Closing eventsYou must have the event viewer displayed to close an event. When you select anevent group in the event viewer, all events for that event group are displayed. Toclose events, select one or more events from the Working Queue and click Close.

For information about using the command line to close an event, refer to thewsetemsg command in the IBM Tivoli Enterprise Console Command and TaskReference.



Close an event Java version of the eventconsole

admin

Starting the Tivoli NetView componentYou can start a Tivoli NetView console from the event viewer in the context of anevent and drill down with Tivoli NetView tools to troubleshoot a networkproblem. You can open the Tivoli NetView Submap Explorer, Object Properties, orDiagnosis windows to view information about a problem node and take action ifnecessary.

To successfully use Tivoli NetView functions from the event viewer, certainprerequisite Tivoli NetView software must be installed and configured. For moreinformation, refer to the IBM Tivoli Enterprise Console Installation Guide.

To run Tivoli NetView functions, select NetView from the Selected menu in theevent viewer. For information about using the Tivoli NetView functions, refer tothe online help in the event console. For information about using the TivoliNetView network management console, refer to the Tivoli NetView documentationat the following Web site:


Opening a trouble ticketYou can use trouble tickets to track events or send notification of an event tosomeone who does not normally use the event console. To open a trouble ticket,follow these steps:1. From the event viewer, select an event in the Working Queue.2. From the Selected menu in the event viewer, click Trouble Ticket.

Note: The implementation of trouble tickets depends on how your administratorintegrated your trouble ticket system with the trouble ticket rules that theTivoli Enterprise Console provides.



Open a trouble ticket Java version of the eventconsole

user



Viewing event informationYou can view additional information about an event in a Web page. To do this, anadministrator must have configured the event console and a CGI program mustexist that provides the event information. To view event information in a Webbrowser, select the appropriate event in the Working Queue.



View event information in theevent viewer

Java version of the eventconsole

user, rim_view

Viewing event propertiesTo view details about an event in the event viewer, double-click the event or selectone or more events in the Working Queue and click Details. If you selected morethan one event, you can navigate between the details of each event by clickingNext or Previous in the event details window.

To view a category of the details of an event, click one of the tabs in the eventdetails window.



View event details in theevent viewer


user, rim_view

Customizing the event viewerThis section describes the following topics related to customizing the event viewer:v “Changing general preferences”v “Changing severity colors” on page 58.v “Sorting events” on page 59v “Filtering events” on page 59

Changing general preferencesThe preferences control how events are shown in the event viewer. To change thegeneral preferences, from the Edit menu in the event viewer, click Preferences. Youcan change one or more of the following general preferences:

Refresh TimeSpecifies the rate (in seconds, minutes, or hours) at which events areautomatically refreshed in the event viewer.

Maximum Age of Closed Event to DisplaySpecifies the maximum age (in seconds, minutes, hours, days, weeks,months, or years) of closed events to display in the event viewer.

Note: When setting event time limits on the event consoles, be aware thatevent consoles compare local system time with the date of theevents to determine which event should be displayed on the event


console. For example, if the time on the node is 9:00 and the time onthe event server is 10:30, all new events appear to be 90 minutes oldto the event consoles.

Maximum Number of EventsSpecifies the maximum number of events to display in the event viewer.

For more information about changing general preferences, refer to the online help.



Change general preferences Java version of the eventconsole

user

Because the general user preferences, the name of the last managed node youlogged in to, and your user ID are stored locally in the $HOME/.tmeconsoledirectory, your preferences are maintained between sessions. Similarly, thepreferences you set are used when you log on to the Java version of the eventconsole on another computer.

Changing severity colorsYou can change the severity colors only if your administrator has made this optionavailable to you. Each event is color-coded to indicate the severity level for thatevent. The following table lists each default severity level and the correspondingdefault color.

Table 7. How event severity is indicated in the Java version of the event console

Severity Color

FATAL Black

CRITICAL Red

MINOR Orange

WARNING Yellow

HARMLESS Green

UNKNOWN Blue

To change the severity colors, follow these steps:1. From the Edit menu in the event viewer, select Preferences. The Preferences

window is displayed.2. From the Preferences window, expand Event Viewer and then click Severity

Colors.3. Change the settings in the Severity Colors window, referring to the online help

for additional information.



Change severity colors Java version of the eventconsole

user


Sorting eventsYou can sort all events or only events in the Working Queue based on any eventfield in the event viewer. Initially events are sorted based on event severity. Ifmultiple events have the same severity, the events are sorted based on the eventdate. Events with the highest severity are displayed at the bottom, and events withthe lowest severity are displayed at the top.

To sort events, follow these steps:1. From the Edit menu in the event viewer, select Preferences. The Preferences

window is displayed.2. From the Preferences window, expand Event Viewer and then click either All

Events to sort all events or Working Queue to sort events in the WorkingQueue.

3. Set the sort criteria you want in the Sort window, referring to the online helpfor additional information.



Sort events Java version of the eventconsole

user

Filtering eventsYou can filter the events in the Working Queue based on severity, status, andoperator ownership to help you focus on important events. When you filter eventsfor one event group, other event groups are not affected. To filter events, followthese steps:1. From the Options menu in the event viewer, select Filter Events.2. Select the checkboxes for the types of events you want to display in the event

viewer. Clear the checkboxes for the types of events you do not want to displayin the event viewer.



Filter events by severity andstatus


user

For information about using a command to list events based on severity and statusto standard output, refer to the wlsemsg command in the IBM Tivoli EnterpriseConsole Command and Task Reference.

Using the Web version of the event consoleThis section describes the tasks you can perform using the Web version of theevent console.

Overview of the Web version of the event consoleThe Web version of the event console is comprised of the following areas:


PortfolioThe primary way that your work is organized within the event console. Itis titled My Work. Each entry in the portfolio represents a task that youcan perform. The following table describes the tasks in the portfolio.

Table 8. Portfolio tasks in the Web version of the event console

Task Function

Select an Event Group Lists the event groups available to the operator. Anoperator can select an event group to view the eventsassigned to the operator.

View Summary of Events Displays a table that summarizes events by severity.

Run Tasks Runs predefined tasks from task libraries when an eventis not required to run the task.Note: When an event is required to run the task, youmust run the task from the event viewer.

Change User Preferences Changes how events are shown in the event viewer.

Welcome Displays the Welcome page.

The portfolio is open when you start the event console. To close and openthe portfolio, click the Hide Tasks and Show Tasks icons, respectively, onthe left side of the tool bar in the event console. You might want to closethe portfolio to increase the size of the work area.

Work AreaThe area in which task windows are displayed. When the portfolio isclosed, the entire page is the work area.

taskbar

The bar that is located above the work area. The taskbar contains a buttonfor each task that you start so that you can switch between tasks. Thetaskbar also contains the following icons:

All TasksDisplays the Task Manager, which contains a list of all tasks youhave started. To switch to a task, select the task and click SwitchTask. To end a task, select the task and click End Task. The AllTasks icon is located on the far left corner of the taskbar.

Sign OffSigns off the event console. The Sign Off icon is located on the farright corner of the taskbar.

Recent Event GroupsThe area of the portfolio that contains the last five event groups that havebeen viewed in the event viewer.

Task buttonA button on the taskbar that represents each portfolio task that you havestarted. When you click a task button, the associated task window opens inthe work area.

Task AssistantHelp for the currently displayed portfolio task. The Task Assistant isrepresented by a question mark in the upper right corner of the eventconsole. When it is open, the Task Assistant is displayed within the eventconsole to the right of the work area. For windows that require user input,


you can also display field descriptions. The icon for field descriptions isrepresented by an i. This icon is located to the left of the Task Assistanticon.

Task CloseThe icon on the far right of the title bar of the work area, which you canuse to close the task that is displayed.

Note: When using the Web version of the event console, you might find that somepages display better if you reduce the size of the text. Use the controls thatyour Web browser provides to reduce the size of the text.

Starting the Web version of the event consoleTo sign on to the the event console, follow these steps:1. Open your Web browser.2. Type the address your administrator provided, which is similar to the following

example:http://computer_name:9080/TecConsoleWeb

Where computer_name is the fully-qualified name of a computer where the Webserver is running.

3. Type your Tivoli Management Framework user ID in the User Name field.4. Type the password for the specified user ID in the Password field.5. Select the appropriate managed node from the Server Name drop-down list.6. Click OK.

Exiting the event consoleTo exit the event console, click the Sign Off icon in the right corner of the taskbar.

Viewing eventsTo view events, follow these steps:1. Click Select an Event Group from the portfolio in the event console. A list of

event groups is displayed.2. Click the name of the appropriate event group. An event viewer is opened,

which contains the events in the selected event group.The event viewer automatically refreshes at specific time intervals. To suspendthe automatic refresh, click the Suspend icon on the toolbar. To resume therefresh, click the Resume icon. The status bar at the bottom of the windowindicates if automatic refresh is enabled, suspended, or needed (automaticrefresh has been suspended and the refresh interval has been exceeded).

You can also select an event group from the Summary of Events table. To view theSummary of Events table, click View Summary of Events from the portfolio.

Acknowledging eventsTo acknowledge events, select one or more events in the event viewer and clickAcknowledge on the tool bar.

You can also use wsetemsg command to acknowledge an event. For moreinformation about the wsetemsg command, refer to the IBM Tivoli EnterpriseConsole Command and Task Reference.


Running tasksTo run a task, choose one of these methods:v If the task requires a source event, select one or more events in the event viewer.

Then select Run Task from the Action menu in the event viewer and click Go.v If the task does not require a source event, select Run Tasks from the portfolio.

The task wizard guides you through the steps required to run the task. For moreinformation about running a task, refer to the online help in the event console.

The task results are shown in a new window of your Web browser. Use the printoption of your Web browser controls to print the task results.

You can also run most tasks from the command line using the wruntask command.For more information about the wruntask command, refer to the Tivoli ManagementFramework Reference Manual.

For information about tasks in the T/EC Tasks library, refer to the Tivoli EnterpriseConsole Reference.

Closing eventsTo close events, select one or more events in the event viewer and click Close onthe tool bar.

You can also use the wsetemsg command to close an event. For information aboutthe wsetemsg command, refer to the IBM Tivoli Enterprise Console Command andTask Reference.

Viewing a summary of eventsTo view a summary of the events contained in each event group, select ViewSummary of Events from the portfolio. By default, the table shows the number ofevents for each severity in each event group, the total number of events in eachevent group, and the total number of events for each severity.

To show the percentage of events in each category, click Percentage on the tool bar.If the percentage of events in each category is shown and you want to show thenumber of events in each category, click Absolute on the tool bar.

The window automatically refreshes at specific time intervals. To suspend theautomatic refresh, click the Suspend icon on the toolbar. To resume the refresh,click the Resume icon. The status bar at the bottom of the window indicates ifautomatic refresh is enabled, suspended, or needed (automatic refresh has beensuspended and the refresh interval has been exceeded).

Opening a trouble ticketTo open a trouble ticket, follow these steps:1. Select one or more events in the event viewer.2. Select Trouble Ticket from the Action menu on the toolbar and click Go.

When multiple events are selected, a separate trouble ticket is opened for eachselected event.


Note: The implementation of trouble tickets depends on how your administratorintegrated your trouble ticket system with the trouble ticket rules that theTivoli Enterprise Console provides.

Viewing event informationTo view information for an event, select an event in the event viewer and clickInformation on the tool bar. The information is displayed in a new window ofyour Web browser.

Viewing event propertiesDetails about events are called properties. To display event properties, choose oneof these methods:v Select the appropriate event in the event viewer and click Properties on the tool

bar.v Click on the severity in the Severity column of the event viewer for the

appropriate event.

An event properties notebook is displayed that contains the following pages:

GeneralDisplays general information about the selected event, such as status anddate received. If a rule has automatically responded to the event (the eventstatus is RESPONSE), you can view the rule engine output. To do this,click View Rule Engine Output on this page. The results are shown in anew window of your Web browser.

Cause EventsDisplays the cause events of the selected event when you click ShowCause Events. The cause events are listed in a table. To manage one ormore cause events, select the events and then select Manage Events fromthe table menu. An event viewer is opened for the selected events.

Effect EventsDisplays the effect events of the selected event when you click Show EffectEvents. To manage one or more effect events, select the events and thenselect Manage Events from the table menu. An event viewer is opened forthe selected events.

AttributesDisplays the attributes of the selected event.

If you want to print the event properties, click Format a Print Version on any pageof the event properties notebook. The formatted version of the event properties isshown in a new window of your Web browser. Use the print option of your Webbrowser to print the event properties.

Customizing the event viewerThis section describes the following topics related to customizing the event viewer:v “Changing preferences” on page 64v “Sorting events” on page 65v “Filtering events” on page 65


Changing preferencesThe preferences control how events are shown in the event viewer. The changesyou make, except for changes to the maximum number of events to show in theeach event viewer, are reflected immediately in all open event viewers.

Because changes to the preferences are stored in cookies, ensure that the privacysettings for your Web browser are set to allow cookies if you want the changes tobe persistent. If cookies are not allowed, changes to the preferences affect only thecurrent session. The preferences you set do not affect a Web console on a differentcomputer.

To change the preferences, click Change User Preferences in the portfolio. You canchange one or more of the following user preferences:

Refresh rateSpecifies the rate at which you want events automatically refreshed in theevent viewer and in the summary of events.

Maximum number of events to show on each pageSpecifies the maximum number of events you want to show on each pagein the event viewer.

Severity countsSpecifies whether or not to show the number of events in each severity onthe event filter icons in the event viewer.

Maximum number of events to show in each event viewerSpecifies the maximum number of events you want to show in the eventviewer. The value for this preference is determined in combination withthe preference setting for the maximum number of events in the Javaversion of the event console. If the value specified in the Web version ofthe event console differs from the value specified in the Java version of theevent console, the maximum number of events is set to the lower of thetwo values.

Changes to the maximum number of events to show in each event viewerare reflected the next you time open an event viewer.

BannerSpecifies whether or not to show the banner in the event viewer.

Show the event severity asSpecifies how to show the event severity in the event viewer.

The event console uses color and icons to indicate the severity level for anevent. The following table describes the color and icon that corresponds toeach event severity.

Table 9. How event severity is indicated in the Web version of the event console

Severity Color Icon

Fatal Black

Critical Red

Minor Orange

Warning Yellow


Table 9. How event severity is indicated in the Web version of the eventconsole (continued)

Severity Color Icon

Harmless Green

Unknown Blue

Sorting eventsBy default, events are sorted in the event viewer by the date received field. Youcan sort events based on up to three event fields. To do this, click the Edit Sorticon on the tool bar in the event viewer.

Filtering eventsYou can filter events in the event viewer by event severity, event status, and eventowner. Filtering events in this manner helps you focus on the events of interest. Tofilter events, use the event filter icons on the tool bar in the event viewer.


Chapter 5. Tivoli Enterprise Console gateway

The Tivoli Enterprise Console gateway can receive events from TME adapters andnon-TME adapters. The Tivoli Enterprise Console gateway forwards events to theevent server and communicates with the event server using the Tivoli EventIntegration Facility. The Tivoli Enterprise Console gateway is comprised of thetec_gateway and the tec_gwr programs.

The tec_gateway program processes events from TME adapters. The tec_gatewayprogram and all of the necessary adapter files for each endpoint operating systemare installed when the Adapter Configuration Facility is installed on a managednode. The Adapter Configuration Facility must be installed on any managed nodethat is configured as a Tivoli Enterprise Console gateway. For more informationabout the Adapter Configuration Facility, refer to the IBM Tivoli Enterprise ConsoleAdapters Guide.

The tec_gwr program receives events from non-TME adapters and sends them tothe tec_gateway program. The tec_gwr program is installed when a TivoliEnterprise Console gateway adapter configuration profile is distributed to anendpoint using the Adapter Configuration Facility. The tec_gwr program isessentially an endpoint adapter that receives events from non-TME adapters. Thetec_gwr program uses the LCF (endpoint) transport type to send events to thetec_gateway program in a manner similar to that of the SNMP and logfileendpoint adapters. By default, the Tivoli Enterprise Console gateway does notreceive events from non-TME adapters. You can configure the Tivoli EnterpriseConsole gateway to receive events from non-TME adapters using a keyword in theTivoli Enterprise Console gateway configuration file.

For information about adapters that send events to the Tivoli Enterprise Consolegateway, refer to the IBM Tivoli Enterprise Console Adapters Guide.

Configuring the gatewayYou can use the Tivoli Enterprise Console gateway as installed, or you can create agateway configuration file. You might want to configure the Tivoli EnterpriseConsole gateway for the following reasons:v To enable the Tivoli Enterprise Console gateway to receive events from non-TME

adapters. See “Configuring the gateway to receive events from non-TMEadapters” on page 74.

v To control network traffic and improve event server and network performanceas follows:– Use state correlation at the Tivoli Enterprise Console gateway. See

“Configuring the gateway for state correlation” on page 75.– Control the rate at which the Tivoli Enterprise Console gateway sends events

to the event server. See “Configuring the rate at which events are sent to theevent server” on page 76.

Note: To control the number of events sent from an adapter, refer to the eventfiltering information in the IBM Tivoli Enterprise Console Adapters Guide.

To configure the Tivoli Enterprise Console gateway, modify the keywords in thegateway configuration file as appropriate. Then create and distribute an adapter


configuration profile that contains the tec_gateway or the tec_gateway_sce profile.Use the tec_gateway_sce profile if you want to use state correlation at the TivoliEnterprise Console gateway. For information about the gateway configuration file,see “Gateway configuration file”. For more information about using an adapterconfiguration profile, refer to the IBM Tivoli Enterprise Console Adapters Guide.

Note: To distribute a modified Tivoli Enterprise Console gateway adapterconfiguration profile to a managed node with a gateway installed, themanaged node must also have an endpoint installed on it. When youdistribute the adapter configuration profile, the subscriber must be theendpoint on that managed node.

Gateway configuration fileThe Tivoli Enterprise Console gateway configuration file is optional and does notexist on the managed node until an adapter configuration profile containing thegateway configuration information is distributed to the endpoint on that managednode. The Tivoli Enterprise Console gateway uses default values unless youmodify the keywords in the Tivoli Enterprise Console gateway configuration fileand distribute an adapter configuration profile containing the changed gatewayconfiguration information. Also, if you do not specify a value for a keyword, thedefault value is used.

The Tivoli Enterprise Console gateway uses one of the following configurationfiles:

UNIX:

/etc/Tivoli/tec/tec_gateway.conf

Windows:

%SystemRoot%\drivers\etc\Tivoli\tec\tec_gateway.conf

The following example shows how the Windows path notation can be expanded:c:\winnt\system32\drivers\etc\Tivoli\tec\tec_gateway.conf

The configuration file defines the behavior of the Tivoli Enterprise Consolegateway. For information about the common keywords for the configuration file,refer to the IBM Tivoli Enterprise Console Adapters Guide or the Tivoli EventIntegration Facility Reference. The configuration file can also use the followingcustom keywords:

APPEND_CLASSPATH=stringSpecifies the string that is appended to the CLASSPATHenvironment variable before Java-based state correlation is started.The string is appended using the appropriate delimiter, asemicolon (;) for Windows or a colon (:) for UNIX. The string mustcontain valid data for your environment as shown in the followingexample:

UNIX:APPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar

Windows:APPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar


For the tec_gateway program, the specified string is appended tothe list of jar files used for state correlation. For a C Adapter, thespecified string is appended to the CLASSPATH environmentvariable.

Notes:

1. The CLASSPATH environment variable will not be changed.The CLASSPATH information is only passed to the Java codewhen state correlation is started.

2. You can specify the APPEND_CLASSPATH keyword only onetime in your configuration file.

BufEvtPath Specifies the file in which to buffer events when the TivoliEnterprise Console gateway cannot forward the events to the eventserver. Because a single Tivoli Enterprise Console gateway canforward events to multiple event servers, it must have an eventbuffer file for each event server. When the Tivoli EnterpriseConsole gateway reestablishes the connection to the event server, itsends the buffered events to the event server. The Tivoli EnterpriseConsole gateway creates a buffer file for each event server byappending the event server location specified by theServerLocation keyword to the name of the file specified by theBufEvtPath keyword.

Assume that the ServerLocation and the BufEvtPath keywords arespecified as follows:ServerLocation=@EventServer#tmr-central

BufEvtPath=/etc/Tivoli/tec/gateway_cache

The Tivoli Enterprise Console gateway creates the /etc/Tivoli/tec/gateway_cache@EventServer#tmr-central buffer file.

If the Tivoli Enterprise Console gateway receives an event from anadapter that specified server location as @EventServer#tmr-east,the Tivoli Enterprise Console gateway also creates a buffer filenamed /etc/Tivoli/tec /gateway_cache@EventServer#tmr-east.

The default value is one of the following:

UNIX: /etc/Tivoli/tec/cache@EventServer#region

Windows: $DBDIR/cache.dat@EventServer#region (on managednodes)

$TIVOLIHOME/tec/$(AC_TYPE).cache@ EventServer#region (onendpoints)

Note: To reduce network traffic and improve performance, filterevents as close to the source as possible by specifying filteroptions in adapter configuration files. You can also use theFilter, FilterCache, FilterMode, and UseStateCorrelationkeywords in the Tivoli Enterprise Console gatewayconfiguration file.

EventSendThresholdSpecifies the maximum number of events per second to send to theevent server. Use this keyword in conjunction with the

Chapter 5. Tivoli Enterprise Console gateway 69

BufferFlushRate keyword. For more information about how to setthe value for this keyword, see “Gateway configuration example”on page 76.

GatewayAckIntervalSpecifies the timeout interval, in seconds, to wait foracknowledgement from the event server. The default value is 30seconds. This keyword works in conjunction with theGatewayTMEAckEnabled keyword for event delivery.

GatewayQueueSize

Specifies the size, in bytes, for the event buffers. If any of the eventbuffers fill before expiration of the interval specified by theGatewaySendInterval keyword, the Tivoli Enterprise Consolegateway immediately sends the the waiting events to the eventserver.

The minimum value for this keyword is 4096 bytes. If theGatewayQueueSize keyword is set to a value lower than 4096, thiskeyword is set to 40000, which is the default.

GatewaySendInterval

Specifies the interval, in seconds, at which to forward events to theevent servers. The Tivoli Enterprise Console gateway holds eventswhen they are received. When this interval expires, the TivoliEnterprise Console gateway bundles and forwards the events in amessage to the appropriate event servers.

The default interval is five seconds.

GatewayTMEAckEnabledSpecifies whether or not an acknowledgement is expected from theevent server. To ensure event delivery, set this keyword to YES(connection-oriented). The default value is NO.

gwr_ActiveConnections=nnSpecifies the number of active connections that the tec_gwrprogram manages at one time. The number of possible connectionsranges from 2 to 1000. If the value specified for this keyword isgreater than 1000, the number of active connections is set to 1000.If the value specified for the keyword is less than 2, the number ofactive connections is set to 2. If you do not specify a value for thiskeyword, the number of possible active connections is not limited.

gwr_ActiveConnectionsSafety=nnSpecifies the percentage of active connections that the connectionsspecified by gwr_ActiveConnections keyword must be reduced tobefore connections can be processed again. Valid values range from10 to 90. When the number of active connections specified in thegwr_ActiveConnections keyword is reached, no new connectionsare accepted until the number of connections drops below thisspecified threshold. For example, if the gwr_ActiveConnectionskeyword is set to 20 and the gwr_ActiveConnectionsSafety is setto 80, the tec_gwr program stops accepting connections when 20connections are reached. The tec_gwr program accepts newconnections when the number of active connections is reduced to16 or less (80% of 20). The default value is 80. This keyword isused only when a value is specified for thegwr_ActiveConnections keyword.


gwr_ConnectionsQueued=nnSpecifies the number of connections that the server socket queues.The server socket queues connections that are waiting to beaccepted by the tec_gwr program. Use this option to limit thenumber of connections that can be queued. Valid values rangefrom 1 to 1000. The actual number of queued connections can beslightly more or less than the value you specify. The default valueis 500. This keyword is optional.

gwr_Enable=YES|NOSpecifies whether or not the tec_gateway program receives eventsfrom non-TME adapters. To enable the tec_gateway program toreceive events from non-TME adapters, specify YES. The defaultvalue is NO. This keyword is optional.

gwr_OptionPortNotAvailable=ERROR|WAITSpecifies how the tec_gwr program processes events when the portspecified by the gwr_ReceptionPort keyword is not available.When this keyword is set to ERROR, the tec_gwr program ends ifthe port specified in the gwr_ReceptionPort keyword is notavailable. When this keyword is set to WAIT, the tec_gwr programcontinues processing instead of returning an error when the port isnot available. When the port becomes available, a server socket iscreated. The default value is ERROR. This keyword is optional.

gwr_ReceptionPort=portSpecifies the port on which to listen and receive events fromnon-TME adapters. The default value is 5539. This keyword isoptional.

gwr_ReceptionTestMode=pathSpecifies the path and the file name from which to read test modeevents. This keyword is similar to the TestMode keyword in thatevents are read from a data file as opposed to being received on aport. This keyword is optional.

gwr_RetryCount=nnSpecifies the number of times to resend an event when thetec_gateway program fails to receive an event from the tec_gwrprogram. The default value is 10. This keyword is optional.

gwr_RetryInterval=nnSpecifies the interval, in seconds, between retry attempts specifiedby the gwr_RetryCount keyword. The default value is 1. Thiskeyword is optional.

gwr_ServerLocation=host_nameSpecifies the name of the host on which the event server isinstalled. The default value is the value of the ServerLocationkeyword. This keyword is optional.

gwr_ServerPort=port_numberSpecifies the server port to use for the host specified by thegwr_ServerLocation keyword when events are received fromnon-TME adapers. The specified server port is used when thevalue for gwr_ServerLocation is any value other than@EventServer. The default value is 0. This keyword is optional.

gwr_ServiceServer=host_name:port_numberSpecifies the host and port number to which to send service-related


events. The tec_gwr program sends service status events thatbelong to the TEC_Notice class to the event server specified by thiskeyword. The tec_gwr program sends a service status event whenthe tec_gwr program is started or stopped or when the submissionhandle is reset. Specify the host and port number as follows:myEventServerHost:5529

To send service status events from the tec_gwr program to thetec_gateway program, set this keyword to SAME as follows:gwr_ServiceServer=SAME

gwr_SubmissionTestMode=pathSpecifies the path and file name from which to read test modeevents. This keyword is similar to the TestMode keyword in thatevents are read from a data file instead of being received on a port.This keyword is optional.

MaxGWCacheSizeMegsSpecifies the maximum size, in megabytes, of the event cache. Bydefault, the maximum size of the event cache is 1 MB. Thekeyword is not included in the configuration file as provided.

PREPEND_CLASSPATH=stringSpecifies the string that is prepended to the CLASSPATHenvironment variable before Java-based state correlation is started.The specified string is prepended using the appropriate delimiter, asemicolon (;) for Windows or a colon (:) for UNIX. The string mustcontain valid data for your environment as shown in the followingexample:

UNIX:PREPEND_CLASSPATH=/my_product/my_java.class:/my_product/my_jar.jar

Windows:PREPEND_CLASSPATH=\my_product\my_java.class;d:\my_product\my_jar.jar

For the tec_gateway program, the specified string is prepended tothe list of jar files used for state correlation. For a C Adapter, thespecified string is prepended to the CLASSPATH environmentvariable.

Notes:

1. The CLASSPATH environment variable will not be changed.The CLASSPATH information is only passed to the Java codewhen state correlation is started.

2. You can specify the PREPEND_CLASSPATH keyword only onetime in your configuration file.

RetryInterval Specifies the interval, in seconds, to wait before connecting to asecondary event server when the Tivoli Enterprise Consolegateway cannot send events to the event server. While the TivoliEnterprise Console gateway is waiting for this time interval toexpire, the Tivoli Enterprise Console gateway continues to receiveand cache new events. To adjust the size of the Tivoli EnterpriseConsole gateway memory queues, use the GatewayQueueSizekeyword.


The RetryInterval keyword enables adapters to send all events tothe primary event server even if the primary event server isstopped briefly, such as when loading a new rule base. If you usethis option to wait for the event server to restart, set the value for aperiod of time longer than needed for the event server to bestopped and restarted.

The RetryInterval keyword is optional.

ReceiveAckPort=numberSpecifies the port number that the Tivoli Enterprise Consolegateway uses to receive acknowledgements from state correlation.The acknowledgements indicate that state correlation has receivedand stored the events. This keyword is used in conjunction withthe SendEventPort keyword. This keyword is required when theUseStateCorrelation keyword is set to YES.

ReceiveEventPort=numberSpecifies the port number that the Tivoli Enterprise Consolegateway uses to recieve events from state correlation. Thiskeyword is used in conjunction with the SendAckPort keyword.This keyword is required when the UseStateCorrelation keywordis set to YES.

SendAckPort=numberSpecifies the port number that the Tivoli Enterprise Consolegateway uses to acknowledge the reception of events sent fromstate correlation. This keyword is required when theUseStateCorrelation keyword is set to YES.

SendEventPort=numberSpecifies the port number that the Tivoli Enterprise Consolegateway uses to send events to state correlation. This keyword isrequired when the UseStateCorrelation keyword is set to YES.

ServerLocationSpecifies the default event server location if adapters do notspecify an event server location in an event instance. If theServerLocation keyword is specified in the configuration file for anadapter, the Tivoli Enterprise Console gateway sends events to theadapter-specified event server. If ServerLocation is not specified inan adapter configuration file, the Tivoli Enterprise Consolegateway sends events to the event server specified byServerLocation keyword in the Tivoli Enterprise Console gatewayconfiguration file. If the ServerLocation keyword is not specified inthe Tivoli Enterprise Console gateway configuration file, the TivoliEnterprise Console gateway sends the event to the event server inthe local Tivoli region.

The default value is @EventServer.

You can specify multiple event server names as a comma-delimitedlist. Event server names later in the list can be backup eventservers when the Tivoli Enterprise Console gateway cannot contactits primary event server for an event and the interval specified bythe RetryInterval keyword has expired without successfullycontacting the primary server. You can specify a host name as youwould for a non-TME adapter, and the events are then forwarded


to that host using non-Tivoli communication. For moreinformation, see the examples in the description of the ServerPortkeyword.

When the Tivoli Enterprise Console gateway cannot contact theadapter-specified event server, the event server names specified inthe list are backup event servers. If ServerLocation is not presentin the Tivoli Enterprise Console gateway configuration file, theTivoli Enterprise Console gateway uses the default @EventServervalue as the backup event server.

To prevent event delivery to backup event servers, set theServerLocation keyword to NONE.

Note: When the ServerLocation keyword is used in conjunctionwith the TestMode=YES keyword, the ServerLocationkeyword defines the path and the file name for loggingevents instead of the event server.

ServerPort Specifies the port that the event server uses to send events usingnon-Tivoli communication.

The default value is 0, which causes the portmapper daemon onthe specified host to determine the port on which the event serveris listening for incoming events. If you are forwarding events to aTivoli Availability Intermediate Manager, you cannot specify 0 asthe port because the Tivoli Availability Intermediate Manager doesnot register itself with the portmapper daemon.

If you specify a value for the ServerPort keyword, the value mustbe either a single port number or a comma-delimited list of portnumbers that correspond to the list of event servers specified in theServerLocation keyword. If you specify a single port number andyou have specified multiple event servers in the ServerLocationkeyword, all event servers use the port number specified.

Assume that you have a Tivoli Availability Intermediate Managerrunning on hosts aim.xyz.com and aimbkup.xyz.com, and theServerLocation and the ServerPort keywords are specified asfollows:ServerLocation=aim.xyz.com,aimbkup.xyz.com,@EventServer

ServerPort=5530,5531,0

Events are sent to port 5530 on the host aim.xyz.com usingnon-Tivoli communication. If that fails, events are sent to port 5531on the host aimbkup.xyz.com. If that also fails, events are sentdirectly to the event server in the local Tivoli region using Tivolicommunication. The port value of 0 specified for @EventServer isignored because port numbers are not needed when using Tivolicommunication.

Configuring the gateway to receive events from non-TMEadapters

To configure the tec_gwr program to receive events receive events from non-TMEadapters, set the value of the gwr_Enable keyword in the gateway configurationfile to YES. The tec_gwr program listens on a socket port for incoming events fromnon-TME adapters. The port used must not be in use by another application, suchas the event server.


If an event sent from the tec_gwr program to the tec_gateway program fails, thetec_gwr program resends the event when the gwr_RetryCount keyword is set to avalue greater than or equal to 1. The tec_gwr program resends the event afterwaiting for the time period specified by the gwr_RetryInterval keyword. Thenumber of retry attempts is equal to the value specified for the gwr_RetryCountkeyword.

To configure non-TME adapters to use the IBM Tivoli Enterprise Console gateway,set the ServerLocation/channelServerLocation and the ServerPort/channelPortkeywords in the configuration file of the adapter to the host name and portnumber that the tec_gwr program uses. If the tec_gwr program is not running onthe same host as the event server, you can register the tec_gwr program with theportmapper daemon. To do this, set the value of the gwr_ReceptionPort keywordin the Tivoli Enterprise Console gateway configuration file to 0.

Note: Messages received on the socket are generated by non-TME adapters andmust be in the correct format as defined by the Tivoli Event IntegrationFacility in the Tivoli Enterprise Console product. Other types of messagesare discarded.

The Tivoli Enterprise Console product uses the following files to receive eventsfrom non-TME adapters:v UNIX and Windows:

tec_gwr.cfgInstallation script.

init.tec_gwrScript used to start and shut down the tec_gwr program.

v Windows only

tec_gwr.exeExecutable file.

tec_gwrs.exeExecutable file as a service.

sctlgwr.exeService controller and installation utility.

v UNIX only

tec_gwrExecutable file.

Configuring the gateway for state correlationTo decrease the number of events that are sent to the event server, you canconfigure the Tivoli Enterprise Console gateway for state correlation. Using statecorrelation at the Tivoli Enterprise Console gateway to perform advanced filtering,duplication detection, and event correlation closer to the source off-loads filteringand event correlation from the event server.

For information about writing rules for state correlation, refer to the IBM TivoliEnterprise Console Rule Developer’s Guide.

Activating state machinesBefore you activate the state machine, ensure that you have written your rulesbased on the information described in the IBM Tivoli Enterprise Console RuleDeveloper’s Guide.


Follow this procedure to run a state machine:1. Modify the state correlation keywords in the configuration file. The following

code fragment illustrates the use of the appropriate keywords:UseStateCorrelation=YES# for Windows NT onlyStateCorrelationConfigURL=file:C:\tmp\test.xml# for all other INTERPs# StateCorrelationConfigURL=file:///tmp/test.xml# SendEventPort=1234# ReceiveAckPort=4321# ReceiveEventPort=5678# SendAckPort=8765

2. To run state correlation on an IBM Tivoli Enterprise Console gateway, changethe adapter configuration profile (ACP) record, tec_gateway_sce, as follows:a. In the Current EIF Environment list, ensure that the UseStateCorrelation,

SendEventPort, ReceiveAckPort, ReceiveEventPort, and SendAckPortkeywords are set.

b. Select the XML file to distribute, which you specified in step 1.c. Distribute the tec_gateway_sce ACP.

After the state machine is running, you can test whether state correlation isproperly filtering events in the following ways:v If you have written rules to generate event summaries, ensure that the event

server is receiving the event summaries.v If you have written rules to suppress events, ensure that suppressed events do

not arrive at the event server.

Configuring the rate at which events are sent to the eventserver

At certain times, the number of events coming from endpoint adapters canoverwhelm the Tivoli Enterprise Console gateway, the event server, and even thenetwork. You can control the rate at which the Tivoli Enterprise Console gatewaysends events to the event server using the EventSendThreshold, theBufferFlushRate, and the MaxGWCacheSizeMegs keywords in the TivoliEnterprise Console gateway configuration file. The example in this section showshow to determine the values for the BufferFlushRate and EventSendThresholdkeywords in the Tivoli Enterprise Console gateway configuration file to improveevent server performance.

Gateway configuration exampleThis example assumes that the event server processes an average of 120 events persecond without degrading its performance. The example environment contains twoTivoli Enterprise Console gateways, where gateway A is responsible for Webcommerce servers and gateway B is responsible for the secretaries’ systems.

The values provided in this example can vary greatly from installation toinstallation, depending on how many events, adapters, and Tivoli EnterpriseConsole gateways are in a particular environment. Use the worksheets provided in“Worksheets and calculations” on page 77 to collect and calculate the data for yourenvironment. All numerical values are expressed in events per second, exceptwhere noted.1. Determine the average number of events that the event server can process (120

in this example).


2. Determine the number of Tivoli Enterprise Console gateways and the resultingnumber of events that they can send to the event server. Divide the averagecapacity of the event server by the number of Tivoli Enterprise Consolegateways as shown in the following example:120 ÷ 2 = 60

The resulting value of 60 indicates the average number of events each TivoliEnterprise Console gateway can send without overwhelming the event server.Continue with step 3 to obtain the adjusted values for the Tivoli EnterpriseConsole gateway send rate.

3. Calculate the value for the EventSendThreshold keyword.The EventSendThreshold keyword sets the maximum number of events persecond that the Tivoli Enterprise Console gateway sends to the event server.Because gateway A forwards events from mission-critical systems, moregateway A events should be sent to the event server than gateway B events.Thus, the EventSendThreshold keyword for gateway A is set to 80 events persecond. Gateway B has the EventSendThreshold keyword set to 40 events persecond. This way, more gateway A events get to the event server.The sum of the values for gateway A and gateway B must be less than or equalto the 120 events that the event server can process:80 + 40 ≤ 120

4. Determine the value for the BufferFlushRate keyword.Any events above the value specified for the EventSendThreshold keyword arestored in the cache on the Tivoli Enterprise Console gateway. To regulate thenumber of events being sent to the event server, the BufferFlushRate keywordcontrols the number of events per minute to be sent from the cache, when thegateway recovers a lost connection to the event server.For gateway A, the BufferFlushRate keyword is set to 5400 events per minute(90 events per second), and for gateway B the keyword is set to 3000 events perminute (50 events per second). Thus at peak traffic times, the event server isreceiving 140 events per second from both Tivoli Enterprise Console gateways:90 + 50 = 140

Although 140 events per second is greater than the average capacity of theevent server (120 events per second), the event server has the capability toprocess excess events during brief, intermittent periods of time.

Tip: Remember to convert events per second to events per minute beforesetting the value for the BufferFlushRate keyword.

5. Modify the adapter configuration profile for the Tivoli Enterprise Consolegateway with the values calculated in step 3 and step 4.

6. Distribute the Tivoli Enterprise Console gateway adapter configuration profile.

Depending on the number of Tivoli Enterprise Console gateways and endpoints inyour environment, you need to carefully consider the rates you specify for thekeywords. For instance, an improper configuration might have multiple TivoliEnterprise Console gateways sending events at the same rate, thus flooding theevent server at the same time. See “Gateway configuration file” on page 68 fordetails about these keywords.

Worksheets and calculationsTable 10 on page 78 and Table 11 on page 78 summarize the values for this example.You can use these tables as worksheets to assemble the values you measure andcalculate for your environment. All numerical values are expressed in events per


second, except where noted.

Table 10. Example rate at which the event server processes events

Average Receive Rate Expected Peak Rate for High Traffic

120 140

Table 11. Example rate at which events are sent to the event server

Event SendRate

AdjustedRate EventSendThreshold BufferFlushRate

Gateway A 60 80 80 5400 events perminute

(90 events per second)

Gateway B 60 40 40 3000 events perminute

(50 events per second)

Total EventsSent to EventServer

120 120 120 140 events per second

The following are the calculations to control event traffic:event server average rate ≥ gateway A events + gateway B events

EventSendThreshold = adjusted send rate for gateway

gateway A gateway BBufferFlushRate + BufferFlushRate ≤ event server peak rate

Starting and stopping the tec_gwr programBy default, the tec_gwr program is automatically started when the host starts. Thetec_gwr program is automatically started when an adapter configuration profilecontaining the tec_gateway or tec_gateway_sce entry is distributed using theAdapter Configuration Facility. You can also manually start the tec_gwr program.Starting the tec_gwr program causes the tec_gwr program to reread thetec_gateway.conf configuration file and restart the daemons.

The tec_gwr program is automatically stopped when you distribute an adapterconfiguration profile that has the init.tec_gwr start command removed from theafter-file-distribution actions. You can also manually stop the tec_gwr program.

Starting the tec_gwr program manuallyTo start the tec_gwr program manually, use one of the following commands:v UNIX:

init.tec_gwr start &

v Windows:net start TECGWR

Stopping the tec_gwr program manuallyTo manually stop the tec_gwr program, use one of the following commands:v UNIX:

init.tec_gwr stop


v Windows:net stop TECGWR

Obtaining the status of the tec_gwr program on UNIXTo obtain the status of the tec_gwr program on a UNIX system, use theinit.tec_gwr command as follows:v To obtain status, type the following command:

init.tec_gwr status &

v To obtain the process ID, type the following command:init.tec_gwr pid &

v To obtain environment settings, type the following command:init.tec_gwr env &


Appendix A. Troubleshooting

This appendix contains suggestions for isolating problems that you mightencounter when using the Tivoli Enterprise Console product. To use thetroubleshooting information in this appendix, you must have administrationexperience with the the Tivoli Enterprise Console product and you must be able toread Tivoli Management Framework log and trace files. The troubleshootinginformation in this appendix also requires that you have knowledge about thefollowing items:v SQLv Three-tier architecture (database management, process management, and user

system interface)v Installed Tivoli applicationsv Tivoli Management Framework

Getting started with problem determinationTo begin isolating where you might have a problem with the Tivoli EnterpriseConsole product, ask yourself the following questions:v Where is the event?v What is the most likely candidate for the problem in my specific environment?

– Event server– Rules– Performance

Problems locating an eventThis section describes the various commands and tools that you can use todetermine where processing stopped for an event and where an event is currentlylocated. The following commands can be useful:

wtdumprlGenerates a report of events that the event server receives by producingthe contents of the reception log.

The following example is a sample of an output fragment from runningthe wtdumprl command.$ wtdumprl -o DESC|more1~10782~65537~993068402(Jun 20 15:20:02 2001)### EVENT ###BadClass;source=EVENT;msg=’Test Parsing’;origin=69.1.6.100;END

### END EVENT ###PARSING_FAILED~’Line 1: Class BadClass undefined’

1~10781~65537~993068400(Jun 20 15:20:00 2001)### EVENT ###BadClass;source=EVENT;msg=’Test Parsing’;origin=69.1.6.100;END

### END EVENT ###PARSING_FAILED~’Line 1: Class BadClass undefined’

1~10780~2~993068145(Jun 20 15:15:45 2001)### EVENT ###

TEC_Notice;source=LOGFILE;severity=HARMLESS;msg=’HARMLESS

postemsg test’;origin=69.1.6.100;END


### END EVENT ###PROCESSED

Note the PARSING_FAILED line in the wtdumprl output. For detailedinformation about how PARSING_FAILED affects performance, refer to theIBM Tivoli Enterprise Console Rule Developer’s Guide.

wtdumperGenerates a report of events in the event repository. The event repository isa table of received events in the event database.

The following example is a sample output fragment from running thewtdumper command.$ wtdumper -o DESC|moreES~1~993068442(Jun 20 15:20:42 2001)~6~TEC_Notice~LOGFILE~~69.1.6.100~~~~OPEN~~[ admin]~CRITICAL~Jun 20 15:20:42 2001~CRITICAL postemsg test~~0~0~0~ES~1~993068442(Jun 20 15:20:42 2001)~1~Su_Success~TEC~LOGFILE~69.1.6.100~N/A~~N/A~OPEN~~[ admin]~WARNING~Jun 20 15:20:42 2001~WARNING wpostemsg test~none~0~

wtdbclearDeletes events from the event database. Use the wtdbclear command todelete events from the event database on a regular basis. Doing so helps tomaintain good performance of the Tivoli Enterprise Console product.

Use caution when running the wtdbclear command from a managed nodeother than the event server. The time from the local machine from whichthe command has been run is used to determine which events to clear, notthe time from the event server.

Note: For optimal performance, run the wtdbclear command duringnon-peak processing hours.

For more information about the wtdumprl, the wtdumper, and the wtdbclearcommands, refer to the IBM Tivoli Enterprise Console Command and Task Reference.

Understanding event server processesTo effectively use reports generated by the wtdumprl and the wtdumpercommands, you need to understand how an event is processed before the event isdisplayed on an event console.

The event server architecture consists of five processes, each of which impactsdeveloping and running rules. An additional process, the UI server process, playsan integral part in the overall Tivoli Enterprise Console architecture. The UI serveris not a part of the event server, although it communicates with the event server.

The event server runs as five main processes, as shown in the following table:

Table 12. Event server processes

Process Name Description

tec_server The master process

tec_reception The reception engine process


Table 12. Event server processes (continued)

Process Name Description

tec_rule The rule engine process

tec_dispatch The dispatch engine process

tec_task The task engine process

If any of the event processes fail, messages are written to files defined in the$BINDIR/TME/TEC/.tec_diag_config file. For more information about this file andthe log files, see “Event server process log files” on page 85.

The following figure illustrates the relationships among the event server processes.The arrows represent the flow of communications.

The following sections describe the flow of an event through each of the TivoliEnterprise Console’s five processes.

Master processThe controlling (master) process, tec_server, initializes the tec_dispatch, thetec_reception, the tec_rule, and the tec_task processes and restarts them if theystop.

The tec_server process manages events as follows:1. The tec_server process receives incoming events from Tivoli communication.2. The tec_server process forwards received events to the tec_reception process.

If errors are encountered during the tec_server process, the error messages arewritten to the /tmp/tec_master file by default.

Reception engine processWhen an event is received, the event is immediately placed in the reception bufferby the reception engine process, tec_reception.

Task engine(tec_task)

Master(tec_server)

External tasksor programs

UI server(tec_ui_server)

Eventcache(RAM)


Receptionengine

(tec_reception)

Receptionbuffer(RAM)

RDBMS

Rule engine(tec_rule)

Dispatchengine

(tec_dispatch) Console

Console

Console

from non-Tivolicommunication



Figure 5. Relationship among event server processes

Appendix A. Troubleshooting 83

The following list explains what happens to an event during the tec_receptionprocess:1. An event is received by the tec_reception process.2. The event is stored in the reception buffer with a status of QUEUED.3. If the reception buffer is full, the event is stored in an event database table

named tec_t_evt_rec_log with a status of WAITING.4. When space is available in the reception buffer, the events in the database in

WAITING status are read into the reception buffer and marked as QUEUED.

If errors are encountered by the tec_reception process, the error messages arewritten to the /tmp/tec_reception file by default.

Rule engine processEvents with a status of QUEUED are now available for rule processing.

The rule engine process, tec_rule, manages events as follows:1. Events are passed from the tec_reception process to the tec_dispatch process

and then to the tec_rule process.2. A copy of the event is stored in the event cache where event correlation (rule

processing) can occur.

If errors are encountered during rule processing, the error messages are written tothe /tmp/tec_rule file by default.

Dispatch engine processThe dispatch engine process, tec_dispatch, uses the tec_server process to notify thetec_reception process that an event has completed processing.

The tec_dispatch process manages events as follows:1. The tec_dispatch process places a copy of the event (including changes made

during rule processing) in the event repository using RDBMS Interface Module(RIM).The event repository table name is tec_t_evt_rep.

2. The tec_dispatch process sends a message to the tec_task process to runassigned tasks or programs associated with the event.

3. The event is now available to the appropriate event consoles for viewing.4. After the event is stored in the event repository, an acknowledgement is sent to

the tec_reception process, which updates the status to PROCESSED.If the event is labeled as PROCESSED in the reception log, the rules haveprocessed the event.

If errors are encountered during the tec_dispatch process, the error messages arewritten to the /tmp/tec_dispatch file by default.

UI server processThe UI server process provides communication services between event consolesand the event server, and between event consoles and the event database. Itcommunicates with the dispatch engine when it needs contact with the eventserver. The UI server provides the event consoles with updated event informationand provides the dispatch engine with change requests to events from eventconsoles.

For more information about the UI server process, see the IBM Tivoli EnterpriseConsole Rule Developer’s Guide.


Task engine processThe task engine process, tec_task, is responsible for managing actions as directedby the tec_rule process and manages running the rule language predicates. Theprocess runs programs, tasks, scripts, and commands initiated by the rules. Theexit status of the monitored items is returned to the dispatch engine, which writesthe status to the event database if watch status is set to YES in the exec_prog orexec_task predicates.

The num_actions attribute for an event contains the number of actions (tasks orprograms) currently being tracked by the event server for the event.

The tec_task process passes the event through the following assigned activitysources (rule language predicates):

exec_taskAssigned tasks are run on the event.

exec_programAssigned scripts or programs are run on the event.

forward_eventThe event is forwarded to another event server with changes applied fromrunning the assigned task and program.

If errors are encountered during the tec_task process, the error messages arewritten to the /tmp/tec_task file by default.

For additional information about event server architecture and details about theevent server processes, refer to the IBM Tivoli Enterprise Console Rule Developer’sGuide.

Event server process log filesError information is written to specific log files when event server processes fail.The log files are defined in the $BINDIR/TME/TEC/.tec_diag_config file.

The following table lists each event server process and its corresponding defaultlog file name and location:

Table 13. Log files for event server processes

Process Name Log File

tec_server /tmp/tec_master

tec_reception /tmp/tec_reception

tec_rule /tmp/tec_rule

tec_dispatch /tmp/tec_dispatch

tec_task /tmp/tec_task

Note: In a Windows or UNIX environment, the /tmp directory must already existon your system for the log files to be properly created and saved. UNIXsystems usually have a /tmp directory by default, but Windows temporarydirectories are named /temp. Rename /temp to /tmp, or add a directorynamed /tmp.

For information about .tec_diag_config file parameters, refer to the IBM TivoliEnterprise Console Command and Task Reference.


Checking the event flowTo check the event flow and determine why an event is not displayed on the eventconsole:v Examine the adapter and the Tivoli Enterprise Console gateway cache files. If

the event server is down, the Tivoli Enterprise Console gateway buffers events atthe gateway. Locate and inspect the cache files to find events that stop at theTivoli Enterprise Console gateway. The file location is specified in the adapterconfiguration file. If events are found in the cache files, these events have notbeen forwarded to the event server. Ensure that the endpoint, the TivoliEnterprise Console gateway, the Tivoli Management Framework gateway, andthe event server are running.

v Ensure that you do not filter out this event class at the adapter with the PreFilterand Filter adapter configuration options.

v Use the wtdumprl command to check the reception log and determine if theevent server received the event.For more information about using the wtdumprl command, see “Problemslocating an event” on page 81.

v Use the wtdumper command to check the event repository. If the event is in theevent repository, it should be displayed on the event console. If the event is notdisplayed on the event console and the event is in the wtdumper commandoutput, first check the time limits that were set during configuration fordisplaying events. Ensure that the time limits fit the criteria for the event inquestion. Time limits for displaying events can be modified in the followingareas:– Event server parameters– Event group filters– Event viewer filtering– Rule processing

For more information about using the wtdumper command, see “Problemslocating an event” on page 81.

v Use the rule tracing facility to ensure that events are being processed throughthe rule engine. If the event is shown in the wtdumprl command output but notin the wtdumper command output, you might have a rule that is causing theevent to be dropped.

Checking the event flow in a Tivoli environmentTo check the event flow in a Tivoli environment, use the wpostemsg command.The wpostemsg command sends an event to the event server. Sending events is agood way to test the event server after you have created new event groups, createdevent group assignments, edited rules, or otherwise changed the behavior of eventprocessing at the event server level.

The following example sends a test message with the source of LOGFILE to theevent server:wpostemsg -m “test message from EP” TEC_Notice LOGFILE

For additional troubleshooting using the wpostemsg command, use the wtracecommand, as described in “Analyzing Tivoli Management Framework trace logs”on page 90. For defining specific results using the wtrace command, use the odstatcommand to filter for specific details.


Notes:

1. The wpostemsg command is a form of the Event Integration Facilityimplementation that uses caching ability.

2. If the connect_agent method call returns an e=12 return code, the wpostemsgcommand caches the event. The e=12 return code indicates that the event serveris not available.

For more information about using the wpostemsg command, see the IBM TivoliEnterprise Console Command and Task Reference.

Checking the event flow in a non-Tivoli environmentTo check the event flow in a non-Tivoli environment, use the postemsg command.The postemsg command sends an event to the event server. Sending events is agood way to test the server after you have created new event groups, created eventgroup assignments, edited rules, or otherwise changed the behavior of eventprocessing at the server level.

The following example sends a test message that displays an Su_Failure event onthe event console.postemsg -S tecbox -r WARNING -m “su login failure.” Su_Failure LOGFILE

Using the –f option with the postemsg command specifies the name of the adapterconfiguration file. The adapter configuration file must specify the ServerLocationkeyword and, if necessary, the ServerPort keyword.

You can use any of the keywords in the adapter configuration file specified by the–f option with the postemsg command. Using the –f option with the postemsgcommand is preferred over the –S option because it offers more flexibility andbecause you can specify a standard configuration file.

Note: Output from the postemsg command is not included in Tivoli ManagementFramework trace file output.

For more information about the postemsg command, refer to the IBM TivoliEnterprise Console Command and Task Reference.

Problems starting the Tivoli Enterprise Console productWhen you cannot start the Tivoli Enterprise Console product from the Tivolidesktop or the command line, look first at the following items:v Tivoli Management Framework or Tivoli Enterprise Console environment

problems:– If the tec_server event server process is no longer responding, restart it using

the wstartesvr command. To check the status of the event server, use thewstatesvr command. When the event server is restarted, event consoles thatwere connected to it are automatically reconnected.For details about using the wstartesvr or wstatesvr commands, refer to theIBM Tivoli Enterprise Console Command and Task Reference.

– Ensure that all interconnected Tivoli regions are running.If your environment contains several Tivoli regions that are connected,administration can be complex if you do not have a good diagram of theconnections between the Tivoli regions. Before you begin troubleshooting,create a diagram of the connections between the Tivoli regions to assist you indetermining the location of your Tivoli regions and the connection types.


The following list describes the common problem types you can encounterwith interconnected Tivoli regions:- Inter-region passwords- Secure and remote connections- One-way and two-way connections- Inability to connect to a previously connected Tivoli region- Unable to disconnect a Tivoli region- Updating the name registry- Updating resources- Remote resources are not visible or accessible- Inability to perform actions on remote objects- Application failures across Tivoli region boundaries

For information about troubleshooting each of these potential problems withinterconnected Tivoli regions, refer to the Tivoli Management FrameworkMaintenance and Troubleshooting Guide.

v For troubleshooting possible database and RIM problems, see “Problems withthe RIM database” on page 89.

v If you suspect problems with the rule base, load and run the default rule base ora known working rule base as a test. If this confirms a problem with the rulebase, see “Problems with rules” on page 88 and the IBM Tivoli Enterprise ConsoleRule Developer’s Guide for additional troubleshooting information.

Problems with rulesThe most common problems related to rules are:v Failure to recompile, reload, and activate the rule base.v Failure to restart all Tivoli Enterprise Console processes after making changes to

the rule base.For information about the Tivoli Enterprise Console processes, see“Understanding event server processes” on page 82.

v Introduction of hidden characters or the Windows end-of-line (^M) character ina rule set causing unpredictable results, such as the product failing to start orthe event console not being updated.

For more information about writing rules, refer to the IBM Tivoli Enterprise ConsoleRule Developer’s Guide.

Enabling rule tracingThe Tivoli Enterprise Console product provides a rule tracing facility fordebugging problems related to rules. You can use the rule tracing facility to tracerules at different levels of granularity. For example, you can trace all rules, aparticular rule set, part of a rule set, or a particular rule. To enable rule tracing,follow these steps:1. Compile the rule base with tracing enabled. To do this, use the wrb –comprules

–trace command with a trace directive specified in a rule or rule set.You can also trace rules from the rule builder. To do this, select Trace Rules inthe Compile Rule Base dialog box.

2. Turn on tracing using the wsetesvrcfg command with the –t option.3. Load and activate the compiled rule base.


Note: When a rule base is compiled for the production environment, disablerules tracing because rule tracing impacts event processing performance.

Rules generate trace output in a file. You can examine the resulting trace file toanalyze and debug problems related to rules. The name and location of the tracefile is set when the event server is configured.

The following table describes the information found in rule trace files.

Table 14. Output in rule trace files

Output Type Description

action The action set when the rule trace is entered and exited

condition The condition set when the rule trace is entered and exited

prolog calls The prolog calls trace, limited to a level of one depth

rule The trace rule whose header matches the current event

predicate The predicate used when entering, exiting, or failing a predicateaction

For more information and specific instructions for determining the level ofgranularity for your trace results, refer to the IBM Tivoli Enterprise Console RuleDeveloper’s Guide.

Tuning rulesThe following list describes suggested techniques for tuning rules.v Write rules to drop unneeded events immediately (as one of the first rules

encountered so that events do not have to process through all rules in the rulebase).

v Use the commit_action, commit_rule, and commit_set rule language predicatesfrequently.

v Monitor the number of rule timers used.v When writing rules, limit the use of the following predicates:

– all_instances– all_duplicates– generate_event predicates

For detailed information about tuning rules, refer to the IBM Tivoli EnterpriseConsole Rule Developer’s Guide.

Problems with the RIM databaseThe following commands are useful tools for troubleshooting problems with theRIM database.

For additional information about the RIM commands, refer to the TivoliManagement Framework Reference Manual.

wrimtestVerifies the connectivity and functionality of a RIM object as follows:wrimtest –l tec

Use the wrimtest command to connect to a specified database and runRIM methods.


wlookup RIMDisplays a list of available RIM objects as follows:wlookup –ar RIM

wrimtraceEnables or disables tracing for RIM objects.

The contents of the Inter-Object Message (IOM) packets are passedbetween the RIM object and client program. RDBMS errors are thenprinted to the RIM log file.

Note: The RIM tracing function is intended for debugging purposes. Ifenabled for extended periods of time, tracing can decreaseperformance and considerably slow the processing of RIM calls.

For additional information about RIM Troubleshooting, refer to the TivoliManagement Framework User’s Guide and the Tivoli Management FrameworkMaintenance and Troubleshooting Guide.

Additional information about troubleshooting RIM problems and RIM tuning canbe found in the Using Databases with Tivoli Applications and RIM redbook.

Analyzing Tivoli Management Framework trace logsThe Tivoli Management Framework product supports an object tracing mode thatrecords in a log file either all operations or only those operations that fail. Use thewtrace log file to diagnose problems.

The wtrace command extracts information used to debug methods and diagnoseproblems in custom methods and executable files. The wtrace command examinesthe method input, transactions, and method output.

The wtrace log file provides detailed information and should be used inconjunction with an odstat command listing option. The odstat command lists thestatus of current and recent object calls. The odstat service status commanddisplays the currently running operations and the previous 200 operations for aspecific managed node. You can find an error in the odstat command listing anduse the thread ID associated with it to find additional information in a wtrace logfile. Using the odstat command results in more explicit way to view the outputdata from the wtrace command.

For more information about Tivoli Management Framework trace logs, refer to theTivoli Management Framework Maintenance and Troubleshooting Guide. For informationabout using the wtrace and the odstat commands, refer to the Tivoli ManagementFramework Reference Manual.

Problems with the Tivoli Enterprise Console gatewayThis section describes how to troubleshoot problems with the tec_gateway and thetec_gwr programs of the Tivoli Enterprise Console gateway.

Problems with the tec_gateway programTo troubleshoot problems with the tec_gateway program, you can configure tracingfor the tec_gateway process. Tracing for the tec_gateway process is controlled byone of the following files:v UNIX:


/etc/Tivoli/tec/.tec_gateway_diag_configv Windows:

%SystemRoot%\system32\drivers\etc\Tivoli\.tec_gateway_diag_config

To configure tracing for the tec_gateway process, follow these steps:1. Edit the .tec_gateway_diag_config file to specify the level of tracing that you

want. The sample .tec_gateway_diag_config file is located on the event serverin the $BINDIR/../generic_unix/TME/ACF_REP directory. By default, the.tec_gateway_diag_config file looks similar to the following:Highest_level errorTruncate_on_restart true

# tec_gateway#############tec_gateway Highest_level errortec_gateway GW_Send error /tmp/tec_gatewaytec_gateway State_Correlator error /tmp/tec_gateway

Both Highest_level keywords set the highest trace level possible within thefollowing sections in the file. The tracing levels from least verbose to mostverbose are:

error

warning

trace0

trace1

trace2

The Truncate_on_restart keyword specifies whether or not trace files aretruncated to zero bytes when the tec_gateway process starts up.

2. Distribute a gateway configuration profile with the Adapter ConfigurationFacility.

Note: If you have upgraded from a previous release of the Tivoli EnterpriseConsole product, the Distribution tab for existing gateway configurationprofiles is not updated with the .tec_gateway_diag_config file. If you wantto enable tracing, you must delete the existing gateway configuration profileand distribute a new gateway configuration profile.

Set tracing on to determine the cause of a problem. Otherwise, disable tracing orset tracing at the error level. If you are distributing a gateway configuration profileand you want to disable tracing, delete the .tec_gateway_diag_config file from thegateway configuration profile. If you have already distributed the.tec_gateway_diag_config file and you want to disable tracing, delete the.tec_gateway_diag_config file manually from the Tivoli Enterprise Consolegateway.

Problems with the tec_gwr programTo troubleshoot problems with the tec_gwr program, follow these steps:1. Stop all tec_gwr processes currently running on the machine.2. Type the following command to cold start the tec_gwr program:

tec_gwr [-d] [-c configuration_file]

Where:


–d Starts the tec_gwr program in debug mode.

–c configuration_fileSpecifies the location of the Tivoli Enterprise Console gatewayconfiguration file. If you do not specify this parameter, the tec_gwrprogram searches one of the following directories to locate thetec_gateway.conf configuration file.v UNIX:

/etc/Tivoli/tec/tecv Windows:

\WINNT\system32\drivers\etc\Tivoli\tec3. Ensure that no other processes are listening on the reception port. To determine

if the reception port is in use, type the following command:netstat –a | grep port_number

Where port_number is the port that the tec_gwr program uses to receive events.

The first process to start on a port uses the port, and subsequent processescannot receive events from that same port.

4. Use the postzmsg or the postemsg command to send events to the tec_gwrprogram for testing.

Problems with the Web version of the event consoleIf you experience problems with the Web version of the event console, you cancreate trace files that IBM Customer Support can use to determine the cause of theproblem. To create the trace files, use the following general procedure from theWebSphere Application Server Administrative Console. The following proceduredescribes the information that is relevant to the Tivoli Enterprise Console product.For specific information about the IBM WebSphere Application Server product,refer to the online help in the WebSphere Application Server Administrativeconsole and the IBM WebSphere Application Server product documentation, whichyou can access from the WebSphere InfoCenter at the following Web site:

http://www-3.ibm.com/software/webservers/appserv/library/index.html1. From the WebSphere Application Server Administrative console, navigate to

Troubleshooting —> Logs and Trace.2. Select your server. The default name is server1.3. Select Diagnostic Trace.4. Do one of the following:

v Select the Configuration tab to change the trace settings that are stored inthe WebSphere Application Server configuration files.

v Select the Runtime tab to change the trace settings of the currently runningWebSphere Application Server. The Runtime tab contains the Save Traceoption, which saves your settings in the WebSphere Application Serverconfiguration files so that the changes remain in effect the next time theWebSphere Application Server is started.

5. In the Trace Specification field, click Modify. The Trace Service page isopened in a new window.

6. Select the Components tab on the Trace Service page.7. On the Trace Service page, expand the com.tivoli.tec and the com.tivoli.tec.wc

components. The following trace files are useful to IBM Customer Support:



v com.tivoli.paa.jdbc.util.AbstractJDBCv com.tivoli.tec.rimds.RIMJDBCProvv com.tivoli.tec.wc.TecTracev com.tivoli.tec.wc.jca.TECResAdap

Note: The com.tivoli.tec.wc.TecTrace file produces a large amount of data.8. Select a trace file group or an individual trace file name to specify the level of

tracing you want.9. Optionally, change the maximum trace file size and the number of old trace

files to maintain in the Trace Output field on the Runtime tab.10. Click Save on the taskbar.

Problems with performanceNo two work environments are the same and there are typically many things anadministrator can do to tune the environment for optimal performance.

As a starting point, the following items should be considered when tuning yourenvironment:v Attempt to tune first at the source. Tuning the sources that send events, such as

filtering at the adapter level, can reduce unnecessary network traffic.For information about filtering at the adapter level, refer to the IBM TivoliEnterprise Console Adapters Guide.

v Ensure that the Tivoli region and the Tivoli Enterprise Console product reside onseparate machines, free of other major processes.

v Ensure that the Tivoli Enterprise Console database resides on a separatemachine.

v Do not run event consoles on the Tivoli server or the UI server.v Avoid shutting down the database while the Tivoli Enterprise Console product is

running.v Tuning RDBMS

– The RDBMS server can be tuned for locking and recovery considerations thatcan impact the performance of the Tivoli Enterprise Console product.For more information about database configuration and tuning the RDBMSserver, see the IBM Tivoli Enterprise Console Installation Guide.

– To check RDBMS error logs, see “Problems with the RIM database” onpage 89.

v Use filters and rules to view only required events.

For optimal performance, avoid the following practices:v Attempting to monitor everything possible in an environmentv Attempting to dump everything possible to a central log filev Inefficient rulesv Improper event handling

Configuring the event databaseThe Tivoli Enterprise Console product offers automated database vendorconfiguration options to customize your event database application for optimalperformance.


The following tables are the largest, most frequently accessed Tivoli EnterpriseConsole tables:

TEC_T_EVT_REPTEC_T_EVT_TEC_LOGTEC_T_SLOTS_EVT

These tables frequently read, insert, delete, and update information and thereforerequire indexes so that rows can be quickly returned to the application. Forexample, if each of the tables and their indexes are split across six differentinput/output (I/O) devices, they will not encounter I/O contention from theread/write (R/W) head on the device. Database transaction logs operate moreefficiently when placed on their own I/O device. Use higher performance devicesfor index tables, temporary work areas, and transaction logs to provide optimalresults when updating and retrieving data.

If you cannot attain these specifications, you can achieve optional performanceimprovements by combining various tables and indexes across available I/Odevices so that tables accessed less frequently are mixed with frequently-accessedtable and data table operations are split from index table operations.

After the TEC_T_EVT_REP, the TEC_T_EVT_TEC_LOG, and theTEC_T_SLOTS_EVT tables, the TEC_T_TASK_REP table is the next most frequentlyaccessed table in the event server. This table contains an index for performance, asdo most Tivoli Enterprise Console tables. A row cannot be inserted into theTEC_T_EVT_REP or the TEC_T_SLOTS_EVT tables unless the row has a parentrow in the TEC_T_EVT_REP table. Referential integrity is therefore established onthese tables so that a row deleted from the TEC_T_EVT_REP table causes rows inthe two tables with the same server handle, event handle, and date reception, to bedeleted. Referential integrity enhances data integrity by speeding up the deletionprocess.

The event console tables are small and usually contain a LONG or a text column.These columns store a descriptor in the table pointing to the actual location of thedata. The event console tables are only updated during the event consoleconfiguration processes, such as creating consoles, assigning operators and eventgroups, creating filters, or assigning console preferences. In cases where there arelarge numbers of consoles, operators, event groups, and filters, these tables containindexes that enhance performance.

The TEC_T_CONSOLES, the TEC_T_EVENT_GROUPS, and theTEC_T_OPERATORS tables are the base tables for storing event consoleinformation. The TEC_T_ASSIGN_OP, the TEC_T_ASSIGN _EG, and theTEC_T_EG_WHRCLAUS tables provide data needed for correlation to determinewhich operators and event groups are assigned to which event consoles and whichevent filters are assigned to which event groups. A row in these tables can onlyexist if a corresponding row also exists in the parent table. Referential integrityensures that a row deletion from a parent table deletes the corresponding row inthe child table. These tables can be installed on the same I/O device because thesetables have less frequent I/O requests. The TEC_T_ISA and theTEC_T_ENUMERATIONS tables are cleared and reloaded when the TivoliEnterprise Console product starts but are subsequently read on an infrequent basis.The TEC_T_ARCHIVE table is installed in the event database when the TDS®

Tivoli Enterprise Console Event Management Guide is installed and is only updatedwhen events are closed. Therefore, the table has less frequent I/O requests. Thesetables are all good candidates to install on the same I/O device as with the othermore active tables for a mix of workload types.


For more information about automated event database configuration using theevent database installation assistant, refer to the IBM Tivoli Enterprise ConsoleInstallation Guide.

Additional information sourcesThis section lists information sources that discuss troubleshooting and experiencewith the administration of the Tivoli Enterprise Console product. The Web siteslisted in this section were current at the time of this publication.v Tivoli Field Guides for Technical Issues

Tivoli Field Guides for technical issues are white papers and scripts written byTivoli software developers and customers. The papers address complex technicalscenarios or concepts, such as the following:– Endpoint Mobility– Migration– Heartbeat Monitoring in Large Environments– Using Precompiled Fact Files Within the Rule Base– Getting the Most out of Traces– Endpoint Policy Issues

Tivoli Field Guides for Technical Issues are located at the following Web site:

v Tivoli Field Guides for Business IssuesTivoli Field Guides for Business Issues are white papers written by Tivolisoftware developers and customers that are designed to address specificbusiness practices and have a high impact on the success or failure of anEnterprise System Management (ESM) project. The business papers include thefollowing topics:– Change Management– Asset Management– Project Management– Developing Requirements– Building a Case for a Test Environment– Going for the Quick Win– Understanding the Phases of Development

Tivoli Field Guides for Business Issues are located at the following Web site:

v Tivoli Customer Support Knowledge Base (Ask Tivoli)Tivoli software customers can access a Web-based support tool called Ask Tivolito search the support knowledge base for resolution of issues with Tivoliproducts. You can search multiple databases simultaneously for informationfrom redbooks, white papers, Release Notes, and Tivoli Service Desk (TSD) forCustomer Relationship Management (CRM) solutions.The solutions accessed from the Tivoli Customer Support Knowledge Base aredeveloped by the Tivoli product support staff and have been reviewed to assurevalidity and accuracy.

http://www-3.ibm.com/software/sysmgmt/products/support/Field_Guides_Technical.html

http://www-3.ibm.com/software/sysmgmt/products/support/Field_Guides_Business.html




Solutions provided through the Ask Tivoli tool are located at the following Website:http://www-3.ibm.com/software/sysmgmt/products/support/– Ask Tivoli Frequently Asked Questions (FAQ)

Tips and instructions for using the Ask Tivoli tool on the Tivoli CustomerSupport Knowledge Base are located at the following Web site:

v TME10 Mailing ListThe TME10™ mailing list is an e-mail list, which is read and posted to by over 1200 subscribers around the world. Members subscribing to TME10 listserv arethose who create, maintain, support, and use Tivoli software. Members shareexperiences and ask questions.Access to the TME10 mailing list is controlled. You can subscribe to the TME10mailing list at the following Web site:.http://publib-b.boulder.ibm.com/Redbooks.nsf/Portals/TivoliCustom1

v Rule WritingDeveloping Tivoli Enterprise Console rules requires considerable skill andknowledge. Proper rule writing and sharing rule writing experience with otherscan help increase the power and performance of the Tivoli Enterprise Consoleproduct.You can find articles on rule writing topics, such as rule writing and tuning,multiple inheritance in BAROC, and how to use assertion lists with rules at thefollowing Web site:http://www.orb-data.com

The communication on the referenced Web sites is primarily customer experienceand dialog and is not intended to replace IBM Customer Support. For informationabout contacting IBM Customer Support, see “Contacting software support” onpage vii.

http://www-3.ibm.com/software/sysmgmt/products/support/Support_Site_FAQ.html


http://www-3.ibm.com/software/sysmgmt/products/support/

http://publib-b.boulder.ibm.com/Redbooks.nsf/Portals/TivoliCustom1

http://www.orb-data.com

http://www-3.ibm.com/software/sysmgmt/products/support/Support_Site_FAQ.html

Appendix B. Messages

This appendix describes messages related to using the Web version of the eventconsole.

ECOWEP001E An error occurred when retrievingevent details from the event serverdatabase. Retry the operation or closethe Event Properties window.

Explanation: The connection to the event serverdatabase or the event server database itself might bedown.

Operator Response: See message.

If the problem persists, contact your administrator.

Administrator Response: To determine the cause ofthe problem, look in the Web console server log filesfor problems logged by the resource adapter or theJDBC provider.

ECOWEP002E The cause events cannot be retrievedfrom the event server database. Retrythe operation or close the EventProperties window.





ECOWEP003E The effect events cannot be retrievedfrom the event server database. Retrythe operation or close the EventProperties window.





ECOWEV001E The events cannot be retrieved fromthe event server database. Refresh theevent viewer.

Explanation: The event server retrieves events from adatabase when an event viewer is displayed for thefirst time or when the list of events shown in anexisting event viewer is refreshed. If the events cannotbe retrieved, the event group definition might not becorrect or the connectivity to the event server databasemight be down.




ECOWEV002E The status of the event cannot beupdated. Refresh the event viewer.

Explanation: The event server updates the status of anevent on a database when an action is submitted froman event viewer.




ECOWEV003I A trouble ticket has been opened forthe selected events.

Explanation: No additional information is availablefor this message.

ECOWEV004E A trouble ticket cannot be openedfor the selected events.

Explanation: Possible causes for this problem includethe following:

v You might not have the appropriate authorizationrole to open a trouble ticket. Either admin or userrole is required.

v A problem exists with the trouble ticket integrationsoftware.


Operator Response: Contact the administrator of theevent server.

ECOWEV005E The trouble ticket integrationprogram for the selected events did notcomplete.

Explanation: The trouble ticket integration program,which is supplied by the IBM Tivoli EnterpriseConsole, integrates your problem reporting softwarewith the IBM Tivoli Enterprise Console.


ECOWEV006W Do you want to exit this eventviewer?

Explanation: This message confirms whether or notyou want to exit the event viewer.

Operator Response: If you want to exit the eventviewer, click Exit. If you do not want to exit the eventviewer, click Cancel.

ECOWEV007E The details for the selected eventcannot be retrieved from the eventserver. The action associated with thecustomized button cannot run.

Explanation: When you click a customized button, thefull set of event details for the selected event isretrieved from the event server. If the communicationwith the event server fails, the action associated withthe customized button cannot run.


ECOWEV008W You have selected actual_sels events.Running the requested action againstthis many events results in actual_selspopup windows. Do you want tocontinue?

Explanation: More than one event was selected whenyou performed an action from the event viewer.Proceeding with this action will result in a popupwindow for each of the selected events. This messageconfirms whether or not you want to continue with theaction.

Operator Response: If you want to continue with theaction, click Continue. If you do not want to continuewith the action, click Cancel.

ECOWEV009W You have selected actual_sels events.Running the requested action againstthis many events results in a heavyprocessing load on the event server. Doyou want to continue?

Explanation: See message.

This message confirms whether or not you want tocontinue with the action.

Operator Response: If you want to continue with theaction, click Continue. If you do not want to continuewith the action, click Cancel.

ECOWGE001E An internal error has occurred.

Explanation: Your request could not be completed dueto an internal error.

Operator Response: Contact your administrator.

Administrator Response: To determine the cause ofthe problem, look in the IBM Web Application Serverlog files.

ECOWPV001I The user preferences were saved.


ECOWPV002W Do you want to continue makingchanges or cancel without saving?

Explanation: This message confirms whether or notyou want to exit the user preferences without savingthe changes.

Operator Response: If you want to continue makingchanges to the user preferences, click Continue. If youwant to cancel the changes to the user preferences, clickCancel.

ECOWPV003I The user preferences cannot be savedbecause cookies are not enabled foryour browser.

Explanation: The user preferences are saved on yourcomputer as a cookie, but the cookie option on yourbrowser is disabled.

Operator Response: To save the user preferences,change the privacy settings for your browser to acceptcookies. If you do not enable the cookie option, theuser preferences affect only the current session.

ECOWEV005E • ECOWPV003I


ECOWPV004I The user preferences cannot be savedbecause cookies are not enabled foryour browser. Do you want to exit theuser preferences?

Explanation: The user preferences are saved on yourcomputer as a cookie, but the cookie option on yourbrowser is disabled.

Operator Response: To save user preferences, changethe privacy settings for your browser to accept cookies.If you do not enable the cookie option, the userpreferences affect only the current session.

If you want to exit the user preferences, click Exit. Ifyou do not want to exit the user preferences, clickCancel.

ECOWRA001W The event group event_group_id isnot recognized.

Explanation: The specified event group ID does notcorrespond to any known event group.

System Action: The command that referenced thespecified event group failed. Other processing isunaffected.

Administrator Response: This error indicates aninternal problem in the Web console server. ContactIBM Customer Support.

ECOWRA002W The event ID class_name is notrecognized.

Explanation: The specified event ID does notcorrespond to any known event ID class.

System Action: The command that referenced thespecified event ID failed. Other processing isunaffected.


ECOWRA003W ConnectionSpec class_name is notsupported.


System Action: The command that specified theConnectionSpec failed. Other processing is unaffected.


ECOWRA004W InteractionSpec class_name is notsupported.


System Action: The command that specified theInteractionSpec failed. Other processing is unaffected.


ECOWRA005W The Web console serverencountered an error communicatingwith server server for user ID userid.


System Action: The command that encountered theproblem communicating with the Tivoli ManagementFramework failed. Other processing is unaffected.

Operator Response: Contact the SystemAdministrator.

Administrator Response: TheCommunicationFailureException that includes thismessage includes a nested exception that providesadditional details about the failure. To correct theproblem, use the information in the nested exceptiontogether with other Tivoli Management Frameworkdiagnostic tools to determine why the Web consoleserver is unable to communicate with the TivoliManagement Framework.

ECOWRA006W User userid on server server is notauthorized to view event data.


System Action: The specified user is denied access tothe Web console server.


Administrator Response: Ensure that the user isdefined to the Tivoli Management Framework and thatthe user has read access to the event server database.Then use the event console to assign the operator to anevent console.

ECOWRA007W The Web console serverencountered an unexpected exceptionwhen logging on to the IBM TivoliManagement Framework: exception.


System Action: The user is denied access to the Webconsole server.


Administrator Response: To determine the cause ofthe problem, use the included exception text.

ECOWPV004I • ECOWRA007W

Appendix B. Messages 99

ECOWRA008W The task taskName failed.

Explanation: The Web console server could not runthe task due to an internal error.

System Action: The current task failed. Depending onthe severity of the error, processing on other tasksmight also be impacted.


ECOWRA009W User userid does not have the rolerequired to update events in this eventgroup.


System Action: The specified user is denied access tothe actions.


Administrator Response: Ensure that the user isdefined to the Tivoli Management Framework and thatthe user has the appropriate roles to make updates.Then use the event console properties to assign theoperator roles to an event console.

ECOWRA050E An internal error has occurred.

Explanation: The Web console server has detected aninternal error.

System Action: The current thread’s processing fails.Depending on the severity of the error, processing onother threads might also be impacted.


ECOWRA051E The Web console server encountereda problem communicating with theevent server database.


System Action: The system continues to run, butcommunication with the event server database mightnot be possible.

Administrator Response: An exception should havebeen logged along with this message. For informationabout how to correct this problem, refer to the help textfor the message contained in the exception.

ECOWRA052W The UI server has taken longer thanseconds seconds to process a statuschange for event event_id.


System Action: The Web console server discards the

pending status change for the event. The status for theevent reverts to its previous value until the event isupdated in the database and the caches for the Webconsole event data expire.

Administrator Response: This message indicates thatthe UI server either never received the status change orit has not processed all of the status change requests. Ifthis message occurs occasionally during periods ofheavy workload on the UI server, you can ignore thismessage. Otherwise, determine why the UI server ishaving problems receiving and processing statuschange requests.

ECOWRA053W The event data cache timeout valuemust be minimum_cache_time seconds orgreater. The default value,default_cache_time seconds, is used.


System Action: See message.

Administrator Response: Change the event data cachetimeout value as specified in the message. The timeoutvalue must be specified in seconds.

ECOWRA054W The event summary cache timeoutvalue must be minimum_cache_timeseconds or greater. The default value,default_cache_time seconds, is used.


System Action: See message.

Administrator Response: Change the event summarycache timeout value as specified in the message. Thetimeout value must be specified in seconds.

ECOWRA100W The pending change for eventevent_id to status status timed out beforecompleting.


System Action: The Web console server discards thepending status change for the event. The status for theevent reverts to its previous value until the event isupdated in the database and the Web console eventdata caches expire.

Operator Response: The status change for the eventmight have been lost before the UI server processed therequest. Acknowledge or close the event again toensure the change is processed. If this error persists,contact the System Administrator.

Administrator Response: The Web console server logsmessage ECOWRA052 in the IBM WebSphereApplication Server log file in conjunction with thismessage. For more information, refer to the help formessage ECOWRA052.

ECOWRA008W • ECOWRA100W


ECOWRA101W action on event event_id has beenskipped due to previously pendingaction.


System Action: The Web console server skips thespecified action for the event. Processing of otheractions continues.

Operator Response: Another operator has requestedan action on the event. Open or refresh the eventviewer to see the updated status of the event with thepending action.

ECOWRA102W Your request could not becompleted in its entirety. The events youwere attempting to modify have beenmodified since your last refresh or werebeing modified by another operator.


Operator Response: Open or refresh the event viewerto see the current status of the events you wereattempting to modify. If your changes are stillnecessary, modify the events again.

ECOWRJ001W Connection pool properties cannotbe changed when open connectionsexist.

Explanation: An attempt was made to change aproperty of the connection pool when the connectionpool contained open connections. Connection poolproperties can only be changed when there are no openconnections.

System Action: The system continues to use theprevious property values.


ECOWRJ002E The extract directory directory_namecould not be created.

Explanation: The Web console server could not extractthe required files to the specified directory.

System Action: The Web console server continues torun, but information stored in the database is notaccessible until the error is corrected.

Administrator Response: This problem prevents theWeb console server from accessing event data andoperator console definitions that are stored in the eventserver database.

Ensure that the operating system identity that IBMWebSphere Application Server uses has permission tocreate and write to the specified directory. Also, ensurethat the file system has at least 8MB of free space to

store the extracted files. Restart IBM WebSphereApplicaton Server to force the Web console server toretry the file extraction.

ECOWRJ003E The ClassLoader URL url is notrecognized.

Explanation: The Web console server encountered anunrecognized URL when examining its own classloader.

Administrator Response: Ensure that IBM WebSphereApplication Server is using its own JRE and not anunsupported JRE. If this problem persists, contact IBMCustomer Support.

ECOWRJ004W The SQL AS keyword is notsupported.

Explanation: IBM Tivoli Enterprise Console RIM JDBCProvider does not support the SQL AS keyword.

System Action: The erroneous SQL command failedwith an exception. Other processing is unaffected.


ECOWRJ005W The SQL WHERE keyword wasexpected but token was found instead.

Explanation: The IBM Tivoli Enterprise Console RIMJDBC Provider found the specified token in the SQLquery instead of the SQL WHERE keyword.



ECOWRJ006W The SQL query must contain aFROM clause.

Explanation: The SQL query did not contain therequired SQL FROM clause.



ECOWRJ007W A locale was not specified in aLOCALE clause.

Explanation: The LOCALE keyword was not followedby a locale specifier.


Administrator Response: This error indicates an

ECOWRA101W • ECOWRJ007W


internal problem in the Web console server. ContactIBM Customer Support.

ECOWRJ008W A condition was not specifiedspecified for a WHERE clause.

Explanation: The SQL WHERE keyword was notfollowed by any conditions.



ECOWRJ009W An SQL query must start with theSELECT keyword.

Explanation: The SQL query does not begin with therequired SELECT keyword.



ECOWRJ010W The Column column in table table isnot recognized.

Explanation: The SQL query specified a column or atable that is not understood by the IBM TivoliEnterprise Console RIM JDBC Provider.



ECOWRJ011W The data class class for column columnis not recognized.

Explanation: The internal metadata for the indicatedcolumn specifies an unrecognized data class.



ECOWRJ012W The Connection is no longer active.

Explanation: An attempt was made to use aconnection that has been closed.


Administrator Response: This error indicates an

internal problem in the Web console server. ContactIBM Customer Support.

ECOWRJ050E An internal error has occurred.

Explanation: The Web console server has detected aninternal error.

System Action: The current thread’s processing failed.Depending on the severity of the error, processing onother threads might also be impacted.


ECOWRJ051E The Web console server encountereda problem extracting the JCF and JRIMJAR files.

Explanation: The Web console server was unable toextract the required JAR files. Communication with theevent server database is not possible without thesefiles.

System Action: The system continues to run, butcommunication with the event server database is notpossible.

Administrator Response: An exception should havebeen logged along with this message. Refer to the helptext for the message contained in that exception foradditional information.

ECOWRJ052E The Web console server encountereda problem communicating with theevent server database.


System Action: The system continues to run, butcommunication with the event server database mightnot be possible.

Administrator Response: An exception should havebeen logged along with this message. Refer to the helptext for the message contained in that exception foradditional information.

ECOWSO001E An error occurred whencommunicating with the Tivoli managednode.


Operator Response: Retry the operation. If theproblem persists, contact your administrator.

Administrator Response: This error indicates aproblem with the connection between the Web consoleserver, which uses the system information provided tothe Web console, and the managed node. Theinformation in the configuration preferences is used to

ECOWRJ008W • ECOWSO001E


establish a system-level connection to the managednode.

If the problem occurs on a consistent basis at startupfor many or all Web consoles that attempt to connect tothe Web console server, verify that the followingconditions are met:

v The server name, the user name, and the passwordspecified in the configuration preferences are correct.

v The computer running the Web console is connectedto the network, and TCP/IP is functioning correctly.

v The Web console server is running.

v The Web console server and any firewalls betweenthe computer running the Web console and the Webconsole server are configured consistently.

v The port specified for access to the Web consoleserver is valid.

v If the problem is intermittent, it might be due tonetwork traffic or a transient network problem. If theproblem seems to be related to a specific operation,contact IBM Customer Support.

ECOWSO002E Authentication failed.

Explanation: The user name and password specifiedon the logon screen are not valid.

Operator Response: Enter your user name andpassword again, ensuring that your user name andpassword are spelled correctly.

ECOWSO003E The bootstrap process for the Webconsole application failed. The Webconsole might not function correctly.Report this problem to youradministrator.



Administrator Response: To determine the cause ofthe problem, look in the IBM Web Application Serverlog files.

ECOWSO004I Your logon session has expired.

Explanation: A logon session expires after a prolongedperiod of inactivity.

Operator Response: If you want to use the Webconsole, log on again.

ECOWSO005I Signoff is complete.


ECOWSV001E An error occurred when retrievingevent summary data from the eventserver database. Retry the operation orclose the View Summary of Eventswindow.





ECOWTE001E An error occurred when retrievingtask library names from the eventserver. Try running the task again.

Explanation: The connection to the event server or theevent server itself might be down.

Operator Response: If the problem persists, contactyour administrator.

Administrator Response: To determine the cause ofthe problem, look in the Web console server and theevent server log files.

ECOWTE002E An error occurred when retrievingtask names from the event server. Tryrunning the task again.




ECOWTE003E An error occurred when retrievingtask information from the event server.Run the task again.




ECOWSO002E • ECOWTE003E


ECOWTE004E An error occurred when retrievingthe names of the managed nodes fromthe event server. Retry the operation orcancel the task.




Administrator Response: To determine the cause ofthe problem, look in the Web console server log filesfor problems logged by the resource adapter or theJDBC provider. Also, look in the event server log files.

ECOWTE005E An error occurred retrieving the hostnames from the event server. Retry theoperation or cancel the task.





ECOWTE006E The attempt to check the task prior torunning it on the event server failed.Run the task again or cancel the task.





ECOWTE007E The task failed to start on the eventserver. Make sure that the task can berun on the selected events, and run thetask again.

Explanation: The task might have failed for one of thefollowing reasons:

v An event was not selected prior to running the task.

v The task cannot be run on one of the selected events.

v The connection to the event server or the eventserver itself might be down.

Operator Response: Select an event prior to runningthe task, or make sure that the task can be run on all ofthe selected events. Then run the task again.



ECOWTE008W You must select a task library and atask name.

Explanation: When running a task, a task library anda task name have not been selected.

Operator Response: Select a task library and a taskname.

ECOWTE009W You must select a task name.

Explanation: When running a task, a task name hasnot been selected.

Operator Response: Select a task name.

ECOWTE010W You must select one or more targethosts.

Explanation: When running a task, one or more targethosts have not been selected.

Operator Response: Select one or more target hosts.

ECOWTE011E The task failed because theconfiguration of the task isunsupported.



Administrator Response: The layout for the task isunsupported. The Web console supports seven standardlayouts:

v text (0)

v choice (1)

v text choice (2)

v choice button (3)

v radio button (4)

v crypto text (5)

v list selector (6)

ECOWTE012E Your logon session is no longer valid.

Explanation: Your session might have timed out, oryou might have tried to access the Web console from abookmark.

Operator Response: Log on to the IBM TivoliEnterprise™ console again.

ECOWTE004E • ECOWTE012E


ECOWTE013E The task failed due to a shortage ofresources in the Web console server.


Operator Response: Run the task again. If the failurepersists, contact your administrator.

Administrator Response: The Web console servercould not create a thread to run the task. ConfigureIBM WebSphere Application Server to make moreresources available.

ECOWTE014E The task output has not beenreceived.

Explanation: The task output was not received withinthe timeout period. However, the task might havecompleted on the event server. It is also possible thatthe task did not complete or was never started if theconnection to the event server or the event server itselfis down.

Operator Response: Run the task again if doing sowill not cause problems if the original task completed.If the problem persists, contact your administrator.

Administrator Response: To determine the cause ofthe problem, look in the Web console server log file forproblems logged by the resource adapter or the JDBCprovider. Also, look in the event server log files.

ECOWTE015E The task did not complete due to aproblem in the Web console server.


Operator Response: Run the task again. If theproblem persists, contact your administrator.

Administrator Response: To determine the cause ofthe problem, look in the Web console server log files.

ECOWTE016E The task cannot run on the eventsource host because the event does notcontain the event source host name.

Explanation: A task has been configured to run on theevent source host in one or more events. However, thehostname slot in one or more of the events does notcontain the event source host name.

Operator Response: Run the task on the appropriatehost instead of on the event source host.

ECOWTE017W Do you want to exit the task wizard?

Explanation: This message confirms whether or notyou want to exit the task wizard.

Operator Response: If you want to exit the taskwizard, click Exit. If you do not want to exit the taskwizard, click Cancel.

ECOWTE018W Do you want to continue?

Explanation: This message confirms whether or notyou want to cancel this operation in the task wizard.

Operator Response: If you want to continue thisoperation, click Continue. If you do not want to cancelthis operation, click Cancel.

ECOWUM001E You are not authorized the run theaction_name action on the selected itemnumber sel_row.

Explanation: You must log on with the appropriateauthorization to run this action.

Operator Response: Contact your adminstrator to getthe appropriate authorization.

ECOWUM002E You have selected actual_sels items.You must select needed_sels to run theaction_name action.

Explanation: Each action requires that you select aspecific number of items.

Operator Response: Select the appropriate number ofitems and retry the action.

ECOWUM003E Because you are not authorized therun the action_name action on some ofthe selected items, the action has notbeen run on any of the selected items.

Explanation: You must have the appropiateauthorization to run the action on all of the items youselect.

Operator Response: Deselect the items for which youdo not have appropriate authorization and try theaction again.

ECOWUM004E An error occurred when running theaction_name action against the selecteditem number sel_row.

Explanation: The Web console encountered an errorwhen communicating with the event server.

Operator Response: Try the operation again. If theproblem persists, contact your administrator.

Administrator Response: This error indicates aproblem with the connection between the Web consoleserver, which uses the system information provided inthe Web console configuration preferences, and theevent server. The information in the configurationpreferences is used to establish a system-levelconnection to the event server.

If the problem persists at startup for many or allconsoles that attempt to connect to the Web consoleserver, ensure that the following conditions are met:

ECOWTE013E • ECOWUM004E


v The server name, user name, and password specifiedin the configuration preferences are correct.

v The computer running the Web console is connectedto the network, and TCP/IP networking isfunctioning correctly.

v The Web console server is running.

v The Web console server and any firewalls betweenthe computer running the Web console and Webconsole server are configured consistently.

If the problem is intermittent, it might be due tonetwork traffic or a transient network problem. If theproblem seems to be related to a specific operation,contact IBM Customer Support.


Notices

This information was developed for products and services offered in the U.S.A.IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user’s responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not give youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBMIntellectual Property Department in your country or send inquiries, in writing, to:

IBM World Trade Asia CorporationLicensing2-31 Roppongi 3-chome, Minato-kuTokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any othercountry where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION ″AS IS″ WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certaintransactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM Web sites are provided forconvenience only and do not in any manner serve as an endorsement of those Websites. The materials at those Web sites are not part of the materials for this IBMproduct and use of those Web sites is at your own risk.


IBM may use or distribute any of the information you supply in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM Corporation2Z4A/10111400 Burnet RoadAustin, TX 78758 U.S.A.

Such information may be available, subject to appropriate terms and conditions,including in some cases payment of a fee.

The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.

Any performance data contained herein was determined in a controlledenvironment. Therefore, the results obtained in other operating environments mayvary significantly. Some measurements may have been made on development-levelsystems and there is no guarantee that these measurements will be the same ongenerally available systems. Furthermore, some measurement may have beenestimated through extrapolation. Actual results may vary. Users of this documentshould verify the applicable data for their specific environment.

This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to the names and addresses used by an actual businessenterprise is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, whichillustrate programming techniques on various operating platforms. You may copy,modify, and distribute these sample programs in any form without payment toIBM, for the purposes of developing, using, marketing or distributing applicationprograms conforming to the application programming interface for the operatingplatform for which the sample programs are written. These examples have notbeen thoroughly tested under all conditions. IBM, therefore, cannot guarantee orimply reliability, serviceability, or function of these programs. You may copy,modify, and distribute these sample programs in any form without payment toIBM for the purposes of developing, using, marketing, or distributing applicationprograms conforming to IBM‘s application programming interfaces.

TrademarksIBM, the IBM logo, Tivoli, the Tivoli logo, AIX, AS/400, DB2, NetView, TivoliEnterprise, Tivoli Enterprise Console, TME, TME 10, Tivoli ManagementEnvironment, and WebSphere are trademarks or registered trademarks ofInternational Business Machines Corporation or Tivoli Systems Inc. in the UnitedStates, other countries, or both.


Java and all Java-based trademarks and logos aretrademarks or registered trademarks of Sun Microsystems,Inc. in the United States, other countries, or both.

Microsoft and Windows NT are registered trademarks of Microsoft Corporation inthe United States, other countries, or both.

UNIX is a registered trademark of the Open Group in the United States and othercountries.

Other company, product, and service names may be trademarks or service marksof others.

Notices 109

Index

Special characters.tec_diag_config file 15

AACK event status 51acknowledging events

event console (Java version) 54event console (Web version) 61from the command line 54

acl event attribute 21adapter

backup event server 5buffering events 5configuring 22description 4non-TME 5secondary event server 5source

changing 23creating 23deleting 24

source name 23Tivoli Event Integration Facility 6TME 5

Adapter Configuration Facility 4adapter configuration profile (ACP) 76adding

custom buttonsample script for event console (Java version) in

UNIX 35sample script for event console (Java version) in

Windows 34sample servlet for event console (Web version) 36to event console (Java version) 34to event console (Web version) 36

AdministrativeConsole 20AllActiveEvents event group 19APPEND_CLASSPATH keyword 68assigning

event group 28operator to an event console 29

attributeacl 21EventClass 12origin 12severity 12source 12status 12sub_origin 12

authorization roles, required 13automated tasks

Java version of the event console 55

Bbackup event server 5books

see publications vibuffering events 5

ButEvtPath keyword 69

Cchanging

event consolepassword 39server name 40user ID 39Web version, cache timeout values 41Web version, Tivoli region definition 38

event groupfilter 27properties 27

preferencesevent console (Java version) 57event console (Web version) 64

severity colorsevent console (Java version) 58

source 23CLOSED event status 51closing an event


commandspostemsg command 87tec_console 53tec_console.cmd 53TroubleTicket.sh 29wconsole 26wcrtsrc 23wdbmaint.sh 42wdelsrc 24wlookup 89wlsemsg 54, 59wpostemsg 86wrb 26wrimtest 89wrimtrace 90wruntask 55wsesvrcfg 26wsetemsg 54, 56wsetesvrcfg 18, 26wsetsrc 24wstartesvr 42wstopesvr 42wtdbclear 42, 82wtdumper 82wtdumprl 17, 81wtdumprl command 86wtecexport 38wtecimport 38

componentsadapter

configuring 22description 4

Adapter Configuration Facility 4event adapter

configuring 22description 4


components (continued)event console

creating 26description 9differences between Web version and Java version 51event management 51

event databasebacking up 42description 8tuning 42

event server 7configuring 22description 6log files 85performance, improving 76processes 15starting 42stopping 42

relationship of 3Tivoli Enterprise Console gateway

configuration example 76configuration file 68configuring 22, 67description 6, 67event traffic, controlling 76files 75receiving events from non-TME adapters 74retry, configuring 74starting 78status, obtaining 79stopping 78tec_gateway program 67tec_gwr program 67troubleshooting 90

Tivoli Event Integration Facility 6UI server 8

configuration file keywordsgateway

ReceiveAckPort 73Configuration view 10configuring

custom buttonfor event console (Java version) 34for event console (Web version) 36sample script for event console (Java version) in

UNIX 35sample script for event console (Java version) in

Windows 34sample servlet for event console (Web version) 36

event adapter 22event server

logging 24rule base 26source list 23source, changing 23source, creating 23source, deleting 24

Tivoli Enterprise Console gateway 22conventions

typeface viiicopying

event groups to another consolefrom the command line 38from the desktop 38

correlation, state 75creating

event console 26

creating (continued)event group 27source 23

CRITICAL severity level 64custom button

configuringfor event console (Java version) 34for Web version 36

sample script for UNIXfor event console (Java version) 35

sample script for Windowsfor event console (Java version) 34

sample servletfor event console (Web version) 36

SLOTS environment variable, use of 34custom_status event status 51customer support

see software support viicustomizing

event consoleJava version 33password 39server name 40user ID 39Web version 33Web version, cache timeout values 41

Ddeleting

event group 28event group filter 28source 24

directory names, notation ixdispatch engine process 18

EEbusinessEvents event group 19EBusinessEventsConsole 20environment variables, notation ixevent

acknowledgingevent console (Java version) 54event console (Web version) 61from the command line 54

attributesacl 21num_actions 18

buffering 5closing


credibility attribute 14database

backing up 42description 8troubleshooting 89tuning 42

description 14filtering

event console (Java version) 59event console (Web version) 65

flow, troubleshooting 86non-Tivoli environment 87


event (continued)flow, troubleshooting (continued)

Tivoli environment 86group

assigning to an event console 28copying to another console from the command line 38copying to another console from the desktop 38creating 27deleting 28description 11filter, deleting 28filter, modifying 27properties, modifying 27

groups, predefinedAllActiveEvents 19EbusinessEvents 19Maintenance 20OpenNetView 20OtherNetView 20ProbableEventAssn 19ServiceUnavailable 20UnMonitoredEBusiness 19

information, viewingevent console (Java version) 57event console (Web version) 63

internal 14local commands, running

event console (Java version) 55logging 7management

differences between Web version and Java version of anevent console 51

key concepts 51management, overview 52management, planning for

event group roles 21overview 19

processing, troubleshootingevent server processes 82log files 85wtdbclear command 82wtdumper command 82wtdumprl command 81

properties, viewingevent console (Java version) 57event console (Web version) 63

severity 52sorting


source 4starting the Tivoli NetView component 56states

PARSING_FAILED 17PROCESSED 17QUEUED 17WAITING 17

states, reception process 17status

ACK 51CLOSED 51custom_status 51OPEN 51RESPONSE 52

summary, viewingevent console (Web version) 62

event (continued)task, running


traffic, controlling 76trouble ticket criteria, defining 30trouble ticket, opening


updating from a trouble ticket 32viewing


event adapterbackup event server 5buffering events 5configuring 22description 4example 44, 47non-TME 5secondary event server 5source

changing 23creating 23deleting 24

source name 23Tivoli Event Integration Facility 6TME 5

event consoleassigning operator to 29creating 26definitions

exporting and importing 38event group

assigning 28creating 27deleting 28filter 27properties 27

event group filterdeleting 28

event managementdifferences between Web version and Java version 51key concepts 51

Java versionacknowledging events 54automated tasks 55Configuration view 10creating 26custom button, configuring 34custom button, description 33custom button, sample script for UNIX 35custom button, sample script for Windows 34description 9event information, viewing 57event properties, viewing 57event, closing 56events, filtering 59events, sorting 59exiting 54features 9local commands, running 55preferences, changing 57preferences, customizing 33Priority view 10

Index 113

event console (continued)Java version (continued)

severity colors, changing 58starting 53starting the Tivoli NetView component 56Summary Chart view 10task, running 54trouble ticket, opening 56viewing events 54

operatorcreating 29

predefinedAdministrativeConsole 20EBusinessEventsConsole 20

trouble ticket system, integratingdescription 29trouble ticket rules, customizing 30

trouble ticket system, integrating with rulestrouble ticket, generating automatically 31updating events from a trouble ticket 32

Web versionacknowledging events 61cache timeout values, changing 41creating 26custom button, configuring 36custom button, description 33description 9event information, viewing 63event properties, viewing 63event summary, viewing 62event, closing 62events, filtering 65events, sorting 65exiting 61features 10messages 97overview 59password 39performance tuning 41preferences, changing 64preferences, customizing 33sample servlet 36server name 40signing off 61signing on 61starting 61task, running 62Tivoli region definition, managing 38trouble ticket, opening 62troubleshooting 92user ID 39viewing events 61

event databasebacking up 42description 8RIM

description 8troubleshooting 89

tuning 42event group

assigning to an event console 28copying to another event console

from the command line 38from the desktop 38

creating 27deleting 28description 11

event group (continued)example 48filter 11

modifying 27filter, deleting 28management, planning for 20modifying

properties 27predefined

AllActiveEvents 19EbuisnessEvents 19Maintenance 20OpenNetView 20OtherNetView 20ProbableEventAssn 19ServiceUnavailable 20UnMonitoredEBusiness 19

rolesplanning for 21worksheet 21

worksheet 20event group filter

example 48event group role

defined 13examples 48

event managementdifferences between Web version and Java version of an

event console 51key concepts

event severity 52event status 51

overview 52event server

backup 5configuring

logging 24source list 23source, changing 23source, creating 23source, deleting 24

description 6example 47log files 85logging incoming events 7performance, improving 76processes

dispatch engine 18master 15, 16reception engine 16rule engine 18task engine 18tec_dispatch 18tec_reception 16tec_rule 18tec_server 15, 16tec_task 18

rule base 26rules

common problems 88debugging 88description 7tracing 88tuning 89

secondary 5starting 42stopping 42


event statesdescribed 17

event-type differentiation, example 50events

states 17EventSendThreshold keyword 69example

event adapter 44, 47event group 48event server 47event-type differentiation 50geographic differentiation 49organizational differentiation 50system management differentiation 50

examplescustom button

sample script for event console (Java version) inUNIX 35

sample script for event console (Java version) inWindows 34

sample servlet for event console (Web version) 36Tivoli Enterprise Console gateway configuration 76trouble ticket event criteria 31

exitingevent console

Java version 54Web version 61

exportingevent console definitions

exporting and importing from the command line 38exporting and importing from the desktop 38from the desktop 38

FFATAL severity level 64files

.tec_diag_config 15$BINDIR/TME/TEC/.ui_server_diag_config 8for non-TME adapters

init.tec_gwr 75sctgwr.exe 75tec_gwr.cfg 75tec_gwr.exe 75

tec_dispatch 15tec_gateway.conf 68tec_master 15tec_rule 15tec_task 15Tivoli Enterprise Console gateway configuration 68trace

for event console (Web version) 92Tivoli Management Framework 90

troubleticket.rls 29filter, event group 11filtering events

event console (Java version) 59event console (Web version) 65testing 76

GGatewayAckInterval keyword 70GatewayQueueSize keyword 70gateways, IBM Tivoli Enterprise Console

running state machines 75

gateways, IBM Tivoli Enterprise Console (continued)state machines, running 76

GatewaySendInterval keyword 70GatewayTMEAckEnabled keyword 70geographic differentiation, example 49gwr_ActiveConnections keyword 70gwr_ActiveConnectionsSafety keyword 70gwr_Enable keyword 71gwr_OptionPortNotAvailable keyword 71gwr_ReceptionPort keyword 71gwr_ReceptionTestMode keyword 71gwr_RetryCount keyword 71gwr_RetryInterval keyword 71gwr_ServerLocation keyword 71gwr_ServerPort keyword 71gwr_ServiceServer keyword 71gwr_SubmissionTestMode keyword 72

HHARMLESS severity level 65

Iicons

event server ixprofile ixrule base ix

information sources, additional 95internal events 14

Llocal commands, running

event console (Java version) 55logging

changing defaults 24logging events 7

MMaintenance event group 20managing

eventsdifferences between Web version and Java version of an

event console 51event severity 52event status 51management, overview 52

Tivoli region definitions for event console (Webversion) 38

manualssee publications vi

master process 15, 16MaxGWCacheSizeMegs keyword 72messages 97MINOR severity level 64modifying

event groupfilter 27properties 27

monitoring source 4, 6

Index 115

Nnewsgroups viinon-TME interface 5notation

environment variables ixpath names ixtypeface ix

num_actions attribute 18

Oonline publications

accessing viOPEN event status 51OpenNetView event group 20operator

assigning to an event console 29creating 29

operators 13roles 13

ordering publications viiorganizational differentiation, example 50OtherNetView event group 20overview

event management for key e-business applications 2highlights of this release 1product description 1unified system and network management 1

PPARSING_FAILED event state 17path names, notation ixperformance

practices to avoid 93performance, tuning

event console (Web version) 41IBM WebSphere Application Server configuration 41

planning for event managementevent group

worksheet 20event group roles

worksheet 21overview 19

postemsg command 87preferences, changing


PREPEND_CLASSPATH keyword 72Priority view 10ProbableEventAssn event group 19PROCESSED event state 17processes

master 16tec_dispatch 18tec_reception 16tec_rule 18tec_server 15, 16tec_task 18tec_ui_server 8

profile, tec_gateway_sce 76publications

accessing online viordering vii

QQUEUED event state 17

RReceiveAckPort keyword 73, 76ReceiveEventPort keyword 73, 76reception buffer 18reception engine process 16RESPONSE event status 52RetryInterval keyword 72RIM


rolesdifferences 13event group 13required roles 13RIM_update 13RIM_view 13Tivoli 13Tivoli authorization 13user 13

rule baseoperations 26

rule engineaction 18event under analysis 18process 18

rulescommon problems 88debugging 88description 7tracing 88tuning 89

running tasksevent console (Java version) 54event console (Web version) 62from the command line 55

Ssecondary event server 5SendAckPort keyword 73, 76SendEventPort keyword 73, 76ServerLocation keyword 73ServerPort keyword 74ServiceUnavailable event group 20severity colors, changing

event console (Java version) 58severity level

CRITICAL 64FATAL 64HARMLESS 65MINOR 64UNKNOWN 65WARNING 64

severity of events 52SLOTS environment variable 34software support

contacting viisorting events


sourcechanging 23


source (continued)creating 23defined 4deleting 24names for 23

source list, updating 23starting

event console (Java version)from the command line 53from the Windows task bar 53

event console (Web version) 61Tivoli Enterprise Console gateway

manually 78Tivoli NetView functions 56

state correlation 75running state machines 75tec_gateway_tstate profile 76testing 76

state machinesgateways, IBM Tivoli Enterprise Console 76running 75

status, Tivoli Enterprise Console gateway 79stopping

Tivoli Enterprise Console gateway 78Summary Chart view 10summary of events

event console (Web console) 62system management differentiation, example 50

Ttask engine process 18task, running


tasksautomated

using Java version 55tec_console command 53tec_console.cmd command 53tec_dispatch log file 15tec_dispatch process 18tec_gateway program

description 67tracing, controlling 90troubleshooting 90

tec_gateway_sce profile 76tec_gateway_tstate profile 76tec_gateway.conf file 68tec_gwr program


tec_master log file 15tec_reception process 16tec_rule log file 15tec_rule process 18tec_server process 16tec_server processes 15tec_task log file 15tec_task process 18tec_ui_server process 8testing

event filtering 76state correlation 76

Tivoli Enterprise Console gatewaybenefits 6

Tivoli Enterprise Console gateway (continued)configuration file

APPEND_CLASSPATH keyword 68BufEvtPath keyword 69description 68EventSendThresold keyword 69GatewayAckInterval keyword 70GatewayQueueSize keyword 70GatewaySendInterval keyword 70GatewayTMEAckEnabled keyword 70gwr_ActiveConnections keyword 70gwr_ActiveConnectionsSafety keyword 70gwr_Enable keyword 71gwr_OptionPortNotAvailable keyword 71gwr_ReceptionPort keyword 71gwr_ReceptionTestMode keyword 71gwr_RetryCount keyword 71gwr_RetryInterval keyword 71gwr_ServerLocation keyword 71gwr_ServerPort keyword 71gwr_ServiceServer keyword 71gwr_SubmissionTestMode keyword 72MaxGWCacheSizeMegs keyword 72PREPEND_CLASSPATH keyword 72ReceiveAckPort keyword 73ReceiveEventPort keyword 73RetryInterval keyword 72SendAckPort keyword 73SendEventPort keyword 73ServerLocation keyword 73ServerPort keyword 74

configuring 22description 67event traffic, controlling 76example 76receiving events from non-TME adapters 74retry 74

description 6, 67starting

manually 78status, obtaining 79stopping 78troubleshooting 90

Tivoli Event Integration Facility 6Tivoli NetView, starting 56Tivoli region definition

adding for event console (Web version) 38changing for event console (Web version) 38deleting for event console (Web version) 38

Tivoli roles, required 13Tivoli Software Information Center viTME interface 5trouble ticket

event criteria, defining 30opening from event console (Java version) 56opening from event console (Web version) 62

trouble ticket systemintegrating with rules

customizing the rules 30description 29trouble ticket, generating automatically 31updating events from a trouble ticket 32

troubleshootingevent database 89event flow 86

non-Tivoli environment 87Tivoli environment 86

Index 117

troubleshooting (continued)event processing

event flow 86event flow in a non-Tivoli environment 87event flow in a Tivoli environment 86event server processes 82log files 85wtdbclear command 82wtdumper command 82wtdumprl command 81

getting started 81information sources 95performance 93performance, practices to avoid 93problems starting the Tivoli Enterprise Console

product 87RIM 89rules

common problems 88debugging 88tracing 88tuning 89

tec_gateway program 90tec_gwr program 91Tivoli Enterprise Console gateway 90trace logs, creating

for event console (Web version) 92Tivoli Management Framework 90

tuning 93troubleticket.rls file 29TroubleTicket.sh command 29typeface conventions viii

UUI server

$BINDIR/TME/TEC/.ui_server_diag_config log file 8description 8

UNKNOWN severity level 65UnMonitoredEBusiness event group 19user interface server

see UI server 8users

operators 13UseStateCorrelation keyword 76

Vvariables, notation for ixviewing

event informationevent console (Java version) 57event console (Web version) 63

event propertiesevent console (Java version) 57event console (Web version) 63

eventsevent console (Java version) 54event console (Web version) 61from the command line 54

events, summary ofevent console (Web version) 62

WWAITING event state 17WARNING severity level 64wconsole command 26wcrtsrc command 23wdbmaint.sh command 42wdelsrc command 24wlookup command 89wlsemsg command 54, 59worksheet

event group 20event group roles 21

wpostemsg command 86wrb command 26wrimtest command 89wrimtrace command 90wruntask command 55wsessvrcfg command 26wsetemsg command 54wsetesvrcfg command 18, 26wsetsrc command 24wssetmsg command 56wstartesvr command 42wstopesvr command 42wtdbclear command 42, 82wtdumper command 82wtdumprl command 17, 81, 86wtecexport command 38wtecimport command 38


��

Printed in U.S.A.

SC32-1235-00