ibm tivoli monitoringpublib.boulder.ibm.com/tividd/td/itm/sh19-4570-01/en_us/...contents preface...

IBM Tivoli®

MonitoringResource Model ReferenceVersion 5.1.1 SH19-4570-01

��

Tivoli Monitoring Resource Model Reference, Version 5.1.1

Copyright Notice

© Copyright IBM Corporation 1999, 2002. All rights reserved. May only be used pursuant to a Tivoli SystemsSoftware License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBMCustomer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, storedin a retrieval system, or translated into any computer language, in any form or by any means, electronic,mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBMCorporation. IBM Corporation grants you limited permission to make hardcopy or other reproductions of anymachine-readable documentation for your own use, provided that each such reproduction shall carry the IBMCorporation copyright notice. No other rights under copyright are granted without prior written permission ofIBM Corporation. The document is not intended for production and is furnished “as is” without warranty of anykind. All warranties on this document are hereby disclaimed, including the warranties of merchantabilityand fitness for a particular purpose.

U.S. Government Users Restricted Rights—Use, duplication or disclosure restricted by GSA ADP ScheduleContract with IBM Corporation.

Trademarks

IBM, Tivoli, the Tivoli logo, AIX, OS/390, S/390, OS/400, AS/400, iSeries, Tivoli Enterprise, Tivoli EnterpriseConsole, and TME 10 are trademarks or registered trademarks of International Business Machines Corporation orTivoli Systems Inc. in the United States, other countries, or both.

Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the United States, othercountries, or both.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of SunMicrosystems, Inc. in the United States and other countries.

Other company, product, and service names may be trademarks or service marks of others.

NoticesReferences in this publication to Tivoli Systems or IBM products, programs, or services do not imply that theywill be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products,programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or servicescan be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM,any functionally equivalent product, program, or service can be used instead of the referenced product, program,or service. The evaluation and verification of operation in conjunction with other products, except those expresslydesignated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patentsor pending patent applications covering subject matter in this document. The furnishing of this document doesnot give you any license to these patents. You can send license inquiries, in writing, to the IBM Director ofLicensing, IBM Corporation, North Castle Drive, Armonk, New York 10504-1785, U.S.A.

ISO 9001 Certification

This product was developed using an ISO 9001 certified quality system.

Certification has been awarded by Bureau Veritas Quality International (BVQI) (Certification No.BVQI - 92086 / A).

BVQI is a world leader in quality certification and is currently recognized by more than 20accreditation bodies.

Contents

Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviiWho Should Read This Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

What is New in this Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

What This Reference Contains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Publications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx

IBM Tivoli Monitoring Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx

Prerequisite and Related Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi

Accessing Publications Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi

Ordering Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi

Providing Feedback about Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii

Contacting Customer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii

Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii

Typeface Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii

Operating System-dependent Variables and Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii

Part I. Resource Models for Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Chapter 1. Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 2011. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 2511. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 3013. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Event ID 7023. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Indication Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Chapter 2. Logical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

High Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

High Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

iiiIBM Tivoli Monitoring Resource Model Reference

High Transfer Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

High Percentage Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Logical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Slow Logical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Chapter 3. Memory Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23


High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Low Available Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Low Available Memory Causing Hard Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Low Available Memory Causing Soft Paging and Pagefile Resizing . . . . . . . . . . . . . . . . . . . . . 29

Low Available Memory Is Causing Excessive Soft Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Low Available Memory Causing Many Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Low Available Memory with High Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Low Available Memory with a High Working Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Low Available Memory with a Small Pagefile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Low Copy Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Low Data Map Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Low MDL Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Low Pin Read Hits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Pagefile Is Resizing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Memory Leak In Private Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Memory Leak In System Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Memory Leak In System Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 4. Network Interface Card Resource Model . . . . . . . . . . . . . . . . . . . . . 45Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45


Adjust Work Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

High Broadcast Frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

High Current Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

High Errored Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

iv Version 5.1.1

Network Interface Card Overworked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Network Interface Card Too Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Redirector Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Redirector Overloaded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Redirector Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Segment Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Segment Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Server Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Server Overloaded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Server Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Chapter 5. Parametric Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . 67Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67


Windows Event Logged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Chapter 6. Parametric Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 71Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71


Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Chapter 7. Parametric TCP/IP Ports Resource Model . . . . . . . . . . . . . . . . . . . . 75Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75


State of the Defined Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Chapter 8. Physical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

vIBM Tivoli Monitoring Resource Model Reference

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80


High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81




Physical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Slow Physical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Chapter 9. Printer Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89


High Current Percent Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

High Job Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

High Job Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

High Not Ready Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

High Not Ready Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

High Out Of Paper Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

High Out Of Paper Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Chapter 10. Process Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Process Handle Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Process High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Chapter 11. Processor Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105


Busy Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

CPU Cannot Keep up with Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Hardware Keeping CPU Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

High Percent Usage Delta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

vi Version 5.1.1

High Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Processor Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Chapter 12. Server Performance Prediction Resource Model . . . . . . . . . . 115Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Chapter 13. Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119


Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Chapter 14. TCP/IP Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125


High Fragment Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

High Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Segments ReXmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Part II. Resource Models for UNIX/Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Chapter 15. CPU Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135


High CPU Overload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

High CPU Usage by System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

viiIBM Tivoli Monitoring Resource Model Reference

||

||

Chapter 16. File Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141


File Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

File Attributes Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

File not Present . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145


Chapter 17. File System Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147


Low Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Low Percent Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Fragmented File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Low Percentage of Available I-nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152


Chapter 18. Memory Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153


Low Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Low Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

System Thrashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157


Chapter 19. Network Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 159Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159


High Input Packets in Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

High Output Packets in Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

High Percentage Packet Collisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

viii Version 5.1.1

||

||

||

||

||

Interface Not Enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Interface Not Operational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

Unknown Interface Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166


Chapter 20. Network RPC-NFS Resource Model . . . . . . . . . . . . . . . . . . . . . . . . 169Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169


High NFS Buffer Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

High NFS Server Get-attribute Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

High NFS Server Read Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

High NFS Server Readlink Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

High NFS Server Write Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

High Duplicate RPC Server Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

High Retransmitted Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

High RPC Bad Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

High Timeouts and Badxids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

High Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Slow Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182



High Number of Zombie Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Process Consuming High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Process Killed or Nonexistent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Process Stopped . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188


Chapter 22. Security Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191


ixIBM Tivoli Monitoring Resource Model Reference

||

||

Duplicate Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Nonexistent File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

High Log-in Number for User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Illegal Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Illegal Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Account not Valid for Root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Null Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Suspect Supergroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Suspect Superuser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Wrong File Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198


Chapter 23. Server Performance Prediction Resource Model . . . . . . . . . . 201Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Part III. Resource Models for OS/400 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Chapter 24. ASP Disk Mirroring Resource Model . . . . . . . . . . . . . . . . . . . . . . . 209Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209


Mirroring not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Chapter 25. ASP Utilization Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213


ASP Nearing Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

ASP Overflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Chapter 26. Basic CPU Utilization Resource Model. . . . . . . . . . . . . . . . . . . . . 217Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217


Basic CPU Utilization Peak Long Running Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

x Version 5.1.1

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Basic CPU Utilization Guideline Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Basic CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Basic CPU Utilization Peak Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Chapter 27. Basic Interactive CPU Utilization Resource Model . . . . . . . . 223Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223


Basic Interactive CPU Utilization Peak Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . 224

Basic Interactive CPU Utilization Guideline Long Running Exceeded. . . . . . . . . . . . . . . . . . . 224

Basic Interactive CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Basic Interactive CPU Utilization Peak Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Chapter 28. Configuration Objects Resource Model . . . . . . . . . . . . . . . . . . . . 229Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229


Configuration Object Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Chapter 29. Database CPU Utilization Resource Model. . . . . . . . . . . . . . . . . 231Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231


Database CPU Utilization Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

Chapter 30. Distribution Queues Resource Model . . . . . . . . . . . . . . . . . . . . . . 233Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233


Normal Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

High Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Chapter 31. History Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235


List Of Jobs Not Empty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

Chapter 32. Interactive Feature CPU Utilization Resource Model . . . . . . 237

xiIBM Tivoli Monitoring Resource Model Reference

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237


Interactive Feature CPU Utilization Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Chapter 33. Job Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239


Job Log Warning Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Chapter 34. Job Queue Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243


Too Many Jobs Queued . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Job Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Job Queue Not Assigned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Chapter 35. Job Status Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247


Job Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

Chapter 36. Management Central Events Resource Model . . . . . . . . . . . . . 249Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249


Management Central Unknown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Critical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Harmless. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Chapter 37. Network Attributes Resource Model. . . . . . . . . . . . . . . . . . . . . . . . 253Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253


Network Attributes Mismatch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Chapter 38. Output Queues Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

xii Version 5.1.1

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255


No Writers Started For Output Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Output Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Chapter 39. Parametric Object and File Resource Model . . . . . . . . . . . . . . . 257Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257


Object Owner Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Last Changed Date Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Object Size Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Chapter 40. Storage Pools Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Chapter 41. Subsystem Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263


Subsystem Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

Chapter 42. System Disk Resources Resource Model . . . . . . . . . . . . . . . . . . 265Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265


Total Auxiliary Storage Reached Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 266

System ASP Used Near Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

Total Auxiliary Storage Reached Capacity Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Chapter 43. System Value Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269


System Object Mismatch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Chapter 44. TCP Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

xiiiIBM Tivoli Monitoring Resource Model Reference

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271


TCP Interface Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

Chapter 45. TCP Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273


TCP Service Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

Part IV. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Appendix A. Return Codes for Built-in Actions (Windows). . . . . . . . . . . . . 277All Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Built-in Actions of the Event Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Enlarge IRP Stack Size Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Delete Registry Action. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Raise Session Time Out Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Built-in Actions of the Network Interface Card Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Adjust Initial Work Items Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Adjust Maximum Work Items Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Built-in Actions of the Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Restart Service Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Appendix B. Correlated Events (Windows) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281Busy Drive from High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

Busy Drive from Low Avail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Congested TCP Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Critically Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

Critical Memory Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

Faulty Disk Subsystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

High Disk Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

High Disk Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

High Drive Transfer Rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

Possible Disk Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Process Hogging CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

xiv Version 5.1.1

||

||

||

||

||

||

||

||

||

Slow Hard Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

xvIBM Tivoli Monitoring Resource Model Reference

xvi Version 5.1.1

Preface

IBM Tivoli®Monitoring enables you to monitor availability and performance status ofresources on your systems to identify bottlenecks and potential resource problems. Thisreference provides key information about the resource models included in this product.

IBM Tivoli Monitoring was formerly known as Tivoli Distributed Monitoring (AdvancedEdition).

Who Should Read This ReferenceThe target audiences for this reference are system administrators and system installers.

To make effective use of the product you require knowledge and practical experience of thefollowing:

¶ Importing, installing, and managing the Tivoli Management Framework® and the Tivolimanagement environment

¶ System administration on the systems where you plan to install Tivoli Monitoringcomponents, and which you plan to monitor using the product

You should also be familiar with the Tivoli Enterprise Console® product.

What is New in this ReleaseIBM Tivoli Monitoring Version 5.1.1 is a development of, and upgrades, Tivoli MonitoringVersion 5.1 and Tivoli Distributed Monitoring (Advanced Edition) Version 4.1 and providesthe following additional functionality:

OS/400 SupportThe product now supports OS/400 endpoints. See the IBM Tivoli Monitoring: User’sGuide, for details, and Part III, “Resource Models for OS/400” of this guide for thespecific resource models.

Tivoli Enterprise Data Warehouse SupportThe product now provides a Tivoli Monitoring Data Warehouse Support componentto store data in the Tivoli Enterprise Data Warehouse schema. See the correspondingchapter of the IBM Tivoli Monitoring: User’s Guide for details.

What This Reference ContainsThis reference contains the following sections:

Part I. Resource Models for Windows®

¶ “Chapter 1, “Event Log Resource Model””

Describes the Event Log resource model.

¶ “Chapter 2, “Logical Disk Resource Model””

Describes the Logical Disk resource model.

¶ “Chapter 3, “Memory Resource Model””

Describes the Memory resource model.

¶ “Chapter 4, “Network Interface Card Resource Model””

Describes the Network Interface Card resource model, which runs on Windows NT®.

xviiIBM Tivoli Monitoring Resource Model Reference

¶ “Chapter 5, “Parametric Event Log Resource Model””

Describes the Parametric Event Log resource model.

¶ “Chapter 6, “Parametric Services Resource Model””

Describes the Parametric Services resource model.

¶ “Chapter 7, “Parametric TCP/IP Ports Resource Model””

Describes the Parametric TCP/IP resource model.

¶ “Chapter 8, “Physical Disk Resource Model””

Describes the Physical Disk resource model.

¶ “Chapter 9, “Printer Resource Model””

Describes the Printer resource model.

¶ “Chapter 10, “Process Resource Model””

Describes the Process resource model.

¶ “Chapter 11, “Processor Resource Model””

Describes the Processor resource model.

¶ “Chapter 12, “Server Performance Prediction Resource Model””

Describes the Server Performance Prediction resource model.

¶ “Chapter 13, “Services Resource Model””

Describes the Services resource model.

¶ “Chapter 14, “TCP/IP Resource Model””

Describes the TCP/IP resource model.

Part II. Resource Models for UNIX®/Linux

¶ “Chapter 15, “CPU Resource Model””

Describes the CPU resource model.

¶ “Chapter 16, “File Resource Model””

Describes the File resource model.

¶ “Chapter 17, “File System Resource Model””

Describes the File System resource model.

¶ “Chapter 18, “Memory Resource Model””

Describes the Memory resource model.

¶ “Chapter 19, “Network Interface Resource Model””

Describes the Network Interface resource model.

¶ “Chapter 20, “Network RPC-NFS Resource Model””

Describes the Network RPC-NFS resource model, which is available only for Solarisplatforms.

¶ Chapter 21, “Chapter 21, “Process Resource Model””

Describes the Process resource model.

¶ “Chapter 22, “Security Resource Model””

Describes the Security resource model.

¶ “Chapter 23, “Server Performance Prediction Resource Model””

What This Reference Contains

xviii Version 5.1.1

Describes the Server Performance Prediction resource model.

Part III. Resource Models for OS/400

¶ “Chapter 24, “ASP Disk Mirroring Resource Model””

Describes the ASP Disk Mirroring resource model.

¶ “Chapter 25, “ASP Utilization Resource Model””

Describes the ASP Utilization resource model.

¶ “Chapter 26, “Basic CPU Utilization Resource Model””

Describes the Basic CPU Utilization resource model.

¶ “Chapter 27, “Basic Interactive CPU Utilization Resource Model””

Describes the Basic Interactive CPU Utilization resource model.

¶ “Chapter 28, “Configuration Objects Resource Model””

Describes the Configuration Objects resource model.

¶ “Chapter 29, “Database CPU Utilization Resource Model””

Describes the Database CPU Utilization resource model.

¶ “Chapter 30, “Distribution Queues Resource Model””

Describes the Distribution Queues resource model.

¶ “Chapter 31, “History Log Resource Model””

Describes the History Log resource model.

¶ “Chapter 32, “Interactive Feature CPU Utilization Resource Model””

Describes the Interactive Feature CPU Utilization resource model.

¶ “Chapter 33, “Job Log Resource Model””

Describes the Job Log resource model.

¶ “Chapter 34, “Job Queue Resource Model””

Describes the Job Queue resource model.

¶ “Chapter 35, “Job Status Resource Model””

Describes the Job Status resource model.

¶ “Chapter 36, “Management Central Events Resource Model””

Describes the Management Central Events resource model.

¶ “Chapter 37, “Network Attributes Resource Model””

Describes the Network Attributes resource model.

¶ “Chapter 38, “Output Queues Resource Model””

Describes the Output Queue resource model.

¶ “Chapter 39, “Parametric Object and File Resource Model””

Describes the Parametric Object and File resource model.

¶ “Chapter 40, “Storage Pools Resource Model””

Describes the Storage Pools resource model.

¶ “Chapter 41, “Subsystem Resource Model””

Describes the Subsystem resource model.


xixIBM Tivoli Monitoring Resource Model Reference

¶ “Chapter 42, “System Disk Resources Resource Model””

Describes the System Disk Resources resource model.

¶ “Chapter 43, “System Value Resource Model””

Describes the System Value resource model.

¶ “Chapter 44, “TCP Interface Resource Model””

Describes the TCP Interface resource model.

¶ “Chapter 45, “TCP Service Resource Model””

Describes the TCP Service Resource Model.

Part IV. Appendixes

¶ “Appendix A, “Return Codes for Built-in Actions (Windows)””

Lists return codes for the Windows resource models that have built-in actions.

¶ “Appendix B, “Correlated Events (Windows)””

Describes correlated events and the indications from which each one is generated.

PublicationsThis section lists publications in the IBM Tivoli Monitoring library and any other relateddocuments. It also describes how to access Tivoli publications online, how to order Tivolipublications, and how to make comments on Tivoli publications.

IBM Tivoli Monitoring LibraryThe following documents are available in the IBM Tivoli Monitoring library:

¶ IBM Tivoli Monitoring: Resource Model Reference, SH19-4570

Provides information about using and customizing the resource models that can be usedwith IBM Tivoli Monitoring.

¶ IBM Tivoli Monitoring: User’s Guide, SH19-4569

Describes how to install, customize, and use IBM Tivoli Monitoring to manage systemand application resources.

¶ IBM Tivoli Monitoring: Workbench User’s Guide, SH19-4571

Describes how to use the IBM Tivoli Monitoring Workbench to create new resourcemodels or to modify existing ones.

¶ IBM Tivoli Monitoring: Release Notes, GI10-5793

Provides the most current information about IBM Tivoli Monitoring.

¶ IBM Tivoli Monitoring: Road Map for a Typical Installation, GI11-0938

Describes typical installation scenarios.

¶ IBM Tivoli Monitoring: Deployment Supplement, SC23-4799

Describes how to use the deployment wizard for a custom installation.

Versions of these documents in PDF and HTML formats can be found on the IBM TivoliMonitoring and IBM Tivoli Monitoring Workbench product CDs. They are stored in theBooks directory, and can be accessed by selecting the file Books/infocenter.html withyour Web browser. This displays an HTML page from which all of the documents can beaccessed in either format.


xx Version 5.1.1

Prerequisite and Related PublicationsBefore beginning the installation, read the following prerequisite and related documentationfor more information about the management options that IBM Tivoli Monitoring provides:

¶ Tivoli Management Framework: User’s Guide

Provide prerequisite information about setting up the Tivoli Management Framework andTivoli environment.

¶ Tivoli Management Framework: Planning and Installation


¶ Tivoli Management Framework: Reference Manual


¶ Tivoli Software Installation Service: User’s Guide

Provides task-oriented information on how to import, manage, and install TivoliManagement Environment® software on selected machines and managed nodes withinyour Tivoli management region.

¶ Tivoli Software Installation Service: Release Notes

Provides important information about using and installing the Tivoli SoftwareInstallation Service (SIS).

¶ Tivoli Enterprise Console: Rule Builder’s Guide

Provides information about using the Tivoli Enterprise Console rule editor and graphicalrule builder to modify existing rules and create new rules to match your specific eventmanagement needs.

¶ Tivoli Enterprise Console: Release Notes, Version 3.7 or later

Provides the most current information about Tivoli Enterprise Console.

¶ Tivoli Business Systems Management: Distributed User’s Guide, Version 1.5 (if youintend to use Tivoli Business Systems Manager to monitor IBM Tivoli Monitoringevents)

Describes how to use the Tivoli Business Systems Manager product.

¶ Tivoli Business Systems Management: Console User’s Guide, Version 1.5 (if you intendto use Tivoli Business Systems Manager to monitor IBM Tivoli Monitoring events)

Describes how to use the Tivoli Business Systems Manager console.

Accessing Publications OnlineYou can access many Tivoli publications online at the Tivoli Customer Support Web site:http://www.tivoli.com/support/documents/

These publications are available in PDF or HTML format, or both. Translated documents arealso available for some products.

Ordering PublicationsYou can order many Tivoli publications online at the following Web site:http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi

You can also order by telephone by calling one of these numbers:

¶ In the United States: 800-879-2755

Publications

xxiIBM Tivoli Monitoring Resource Model Reference

http://www.tivoli.com/support/documents

http://www.ibm.com/shop/publications/order

¶ In Canada: 800-426-4968

¶ In other countries, for a list of telephone numbers, see the following Web site:http://www.tivoli.com/inside/store/lit_order.html

Providing Feedback about PublicationsWe are very interested in hearing about your experience with Tivoli products anddocumentation, and we welcome your suggestions for improvements. If you have commentsor suggestions about our products and documentation, contact us in one of the followingways:

¶ Send an e-mail to [email protected].

¶ Complete our customer feedback survey at the following Web site:http://www.tivoli.com/support/survey/

Note: This version of the IBM Tivoli Monitoring: Resource Model Reference is notavailable in hardcopy format.

Contacting Customer SupportIf you have a problem with any Tivoli product, you can contact Tivoli Customer Support.See the Tivoli Customer Support Handbook at the following Web site:http://www.tivoli.com/support/handbook

The handbook provides information about how to contact Tivoli Customer Support,depending on the severity of your problem, and the following information:

¶ Registration and eligibility

¶ Telephone numbers and e-mail addresses, depending on the country you are in

¶ What information you should gather before contacting support

Conventions Used in This GuideThis book uses several conventions for special terms and actions, operatingsystem-dependent commands and paths, and margin graphics.

Typeface ConventionsThe following typeface conventions are used in this book:

Bold Lowercase and mixed-case commands, command options, and flags thatappear within text appear like this, in bold type.

Graphical user interface elements (except for titles of windows and dialogs)and names of keys also appear like this, in bold type.

Italic Variables, values you must provide, new terms, and words and phrases thatare emphasized appear like this, in italic type.

Monospace Commands, command options, and flags that appear on a separate line, codeexamples, output, and message text appear like this, in monospace type.

Names of files and directories, text strings you must type, when they appearwithin text and HTML and XML tags also appear like this, in monospacetype.

Publications

xxii Version 5.1.1

http://www.tivoli.com/inside/store/lit_order.html

http://www.tivoli.com/support/survey/

http://www.tivoli.com/support/handbook

Operating System-dependent Variables and PathsThis book uses the UNIX convention for specifying environment variables and for directorynotation.

When using the Windows command line, replace $variable with %variable% forenvironment variables and replace each forward slash (/) with a backslash (\) in directorypaths.

Note: If you are using the bash shell on a Windows system, you can use the UNIXconventions.

Conventions Used in This Guide

xxiiiIBM Tivoli Monitoring Resource Model Reference

Conventions Used in This Guide

xxiv Version 5.1.1

Part I. Resource Models for WindowsChapter 1. Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Event ID 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 2011. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 2511. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Event ID 3013. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Event ID 7023. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Indication Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Chapter 2. Logical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14





High Percentage Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Logical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Slow Logical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Chapter 3. Memory Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23


High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Low Available Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Low Available Memory Causing Hard Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Low Available Memory Causing Soft Paging and Pagefile Resizing . . . . . . . . . . . . . . . . . . . . . 29

Low Available Memory Is Causing Excessive Soft Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Low Available Memory Causing Many Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

1IBM Tivoli Monitoring Resource Model Reference

Low Available Memory with High Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Low Available Memory with a High Working Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Low Available Memory with a Small Pagefile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Low Copy Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Low Data Map Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Low MDL Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Low Pin Read Hits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Pagefile Is Resizing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Memory Leak In Private Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Memory Leak In System Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Memory Leak In System Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 4. Network Interface Card Resource Model . . . . . . . . . . . . . . . . . . . . . 45Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45


Adjust Work Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

High Broadcast Frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

High Current Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

High Errored Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Network Interface Card Overworked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Network Interface Card Too Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Redirector Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Redirector Overloaded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Redirector Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Segment Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Segment Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Server Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Server Overloaded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Server Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Chapter 5. Parametric Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . 67Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67


2 Version 5.1.1

Windows Event Logged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Chapter 6. Parametric Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 71Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71


Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Chapter 7. Parametric TCP/IP Ports Resource Model . . . . . . . . . . . . . . . . . . . . 75Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75


State of the Defined Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Chapter 8. Physical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80


High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81




Physical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Slow Physical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Chapter 9. Printer Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89


High Current Percent Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

High Job Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

High Job Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93


High Not Ready Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

High Not Ready Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

High Out Of Paper Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

High Out Of Paper Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99



Process Handle Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Process High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Chapter 11. Processor Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105


Busy Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

CPU Cannot Keep up with Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Hardware Keeping CPU Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

High Percent Usage Delta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

High Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Processor Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Chapter 12. Server Performance Prediction Resource Model . . . . . . . . . . 115Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Chapter 13. Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119


Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

4 Version 5.1.1

||

Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Chapter 14. TCP/IP Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125


High Fragment Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

High Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Segments ReXmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130


6 Version 5.1.1

Event Log Resource Model

This chapter describes the Event Log resource model for Windows systems.

The following table shows the key characteristics of this resource model:

Resource Model at a Glance

Internal name TMW_EventLog

Category Windows

Thresholds Yes

Parameters No

Built-in actions Yes

Clearing events No

Default cycle time 600 seconds

Overview

Resource model distributionThis resource model should be distributed to Windows NT and Window 2000endpoints.

The Event Log resource model examines the Windows System Event Log for events thatnormally require immediate attention, or can be rectified with a simple registry edit. TheEvent Log resource model highlights the following problems:

¶ Client connectivity problems

Busy networks can cause clients to time out. This indication can be trapped. When it is,the registry value that determines the time out period can be enlarged. This solutionmust only be tried a few times. After which, the problem is more likely to be caused bya problem with the network card or drivers.

¶ Detection of malfunctioning devices

Events 9, 11, and 15 are the most common events that occur when a device or driver ismisbehaving. Trapping these errors helps to correct the devices as soon as possible.

¶ Server connectivity problems

Bad IRPStackSize and OEM installs of Windows are common situations that prevent theserver service from operating correctly. If the server service is not functioning properly,clients cannot connect to the affected machine.

1


1.E

vent

Lo

gR

esou

rceM

od

el

Indications and EventsThe following table lists the events that can be generated by the Event Log resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:

Event Indication Severity Page

TMW_EventID9 Event ID 9 Warning 8


TMWEvent_ID15 Event ID 15 Warning 9





Event ID 9This indication is sent when a device or device driver times out. See “Indication Properties”on page 11 for information on the properties for this event.

No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by the threshold Maximum Number Of Logs)and has the event ID of 9, this indication is sent.

The following table shows the default settings for this indication:

Setting Default

Send indications to Tivoli Enterprise Console Yes

Send indications to Tivoli Business Systems Manager No

Occurrences 1

Holes 0

Event ID 11This indication is sent when an error is detected on a device or device controller. See“Indication Properties” on page 11 for information on the properties for this event.

No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number Of Logs) and has theevent ID of 11, this indication is sent.


Setting Default



Occurrences 1

Holes 0

Indications and Events

8 Version 5.1.1

Event ID 15This indication is sent when a drive (typically removable media, for example, CD-ROM) isnot ready for access or is not functioning properly. See “Indication Properties” on page 11for information on the properties for this event.

No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) and has theevent ID of 15, this indication is sent.


Setting Default



Occurrences 1

Holes 0

Event ID 2011This indications is sent when the IRPStackSize is too small. Event 7023 will typically occurwith this event. See “Indication Properties” on page 11 for information on the properties forthis event.



Setting Default



Occurrences 1

Holes 0

Event ID 2511This indication is sent when a shared directory no longer exists. See “Indication Properties”on page 11 for information on the properties for this event.




1.E

vent

Lo

gR

esou

rceM

od

el


Setting Default

Send indications to Tivoli Enterprise Console No


Occurrences 1

Holes 0

Event ID 3013This indication is sent when the redirector is timing out. See “Indication Properties” onpage 11 for information on the properties for this event.

No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) with the eventID of 3013, this indication is sent.


Setting Default



Occurrences 1

Holes 0

Event ID 7023This indication is sent when there is not enough server storage space. When it occurs byitself, the problem usually has to do with OEM installs of either Windows or Service Packs.Microsoft®’s Knowledge Base article Q151427 details this event. The solution is usually toreinstall of the latest service pack. See “Indication Properties” on page 11 for information onthe properties for this event.

No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) with the eventID of 7023, this indication is sent.


Setting Default



Occurrences 1

Holes 0


10 Version 5.1.1

Indication PropertiesAll the indications in the Event Log resource model have the following properties.

EvtID Identifies the event by number (key attribute)

RepeatCountNumber of Event ID events received in a cycle

LogfileThe name of the log file in which the event was generated (for example, system,security, or application)

SourceNameThe source of the event (key attribute)

TimeGeneratedThe time that the event was generated

TimeWrittenThe time that the event was written to the Event Log

ComputerNameThe name of the computer where the event occurred (key attribute)

MessageThe message text of the event

ThresholdsThe following table lists the thresholds that can be set for the Event Log resource model.For each threshold it shows the name, a short description, and the default value:

Threshold Description Default

Maximum Number of Logs(MostNumberOfLogs)

This threshold determines the maximum number of newestevents in the event log that are examined.

100

Built-in ActionsThis resource model has the following built-in actions:

Indication Built-in Actions

Event ID 20111. Notifies the system administrator that the IRPStackSize is too small.

2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEMS\CurrentControlSet\

Services\LanmanServer\Parameters\IRPStackSize and

3. Sets the value to 0xCh (Decimal value 12).

The system must be rebooted for this change to take effect.



1.E

vent

Lo

gR

esou

rceM

od

el

Indication Built-in Actions

Event ID 25111. Notifies the system administrator that a shared directory no longer exists.

2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\LanmanServer\Shares and the system must be rebooted for thischange to take effect.

3. Deletes the key that represents the sharename.

Event ID 30131. Notifies the system administrator that the redirector is timing out.

2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\LanmanServer\Parameters\SessTimeOut to a higher value. Whenthe value is not present, the default value is 0x2Dh (decimal value 45)seconds. Corrective actions consist of raising this value by an increment of0xAh (decimal value 10).

The system must be rebooted for this change to take effect. After threeattempts, user intervention is required. The system administrator shouldexamine the network subsystem and possibly reinstall or repair network driversor devices.

Built-in Actions

12 Version 5.1.1

Logical Disk Resource Model

This chapter describes the Logical Disk resource model for Windows systems.



Internal name TMW_LogicalDisk

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview

Resource model distributionThis resource model should be distributed to Windows endpoints.

The Logical Disk resource model highlights the following problems:

¶ Bytes Transferred Per Second

This indicates the raw amount of data that is transferred through the disk. The maximumbytes per second that a disk subsystem can handle depends on the type of hard drive, thetype of controller, the drive configuration, and, in the case of most IDE-based harddrives, the speed of the CPU.

¶ Disk Space

Low disk space can often make it impossible to reboot a Windows NT machine. Thethreshold value is based on the percentage of free space on the disk. Administratorsmonitoring systems with disks of less than one gigabyte should raise this value. A goodguideline is to keep enough free disk space to allow the pagefile to reach its maximumsize limit.

¶ Percentage Usage

The percentage of used disk often needs to be altered when monitoring file servers forbottlenecks. File servers, print servers, and mail servers use a high percent of disk space.

However, workstations typically use a high percentage of disk space in short bursts.Performance in CPU speed and general system response decline.

2


2.L

og

icalD

iskR

esou

rceM

od

el

PrerequisitesThe Logical Disk resource model requires disk counters to be enabled on the Windowsendpoints.

To enable disk counters, perform the following steps on each endpoint:

1. On Windows NT systems, issue the diskperf -y command.

On Windows 2000 systems, issue the diskperf -yv command.

2. Reboot the system.

Indications and EventsThe following table lists the events that can be generated by the Logical Disk resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


TMW_HighLogicalDiskReadBytesSec High Read Bytes per Second Minor 15

TMW_HighLogicalDiskWriteBytesSec High Write Bytes per Second Minor 16

TMW_HighLogicalDiskXferRate High Transfer Rate Minor 17

TMW_HighLogicalPercentDiskTime High Percentage Disk Time Warning 18

TMW_LogicalPossibleFrag Logical Disk Possible Fragmentation Minor 19

TMW_LowLogicalDiskSpace Low Disk Space Warning 20

TMW_SlowLogicalDrive Slow Logical Drive Warning 21

Prerequisites

14 Version 5.1.1

High Read Bytes per SecondThis indication is sent when a logical disk is reading a lot of data.

The indication has the following attributes:

PercentDiskReadThe percentage of the logical drive being used to read data

DiskReadBytesSecThe number of bytes read per second on the logical disk

DiskReadSecThe number of transactions that are read per second on the logical disk

PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)

LogicalDiskThe logical disk that is being analyzed (Key attribute)

The indication is generated when the following thresholds are exceeded:


High Bytes per Second(HighBytesSec)

The maximum amount of bytes transferred per second(being written or read) exceeds this threshold.

1572864

High Percent Usage(HighPercentUsage)

The time that the selected disk drive spends for read orwrite requests exceeds this threshold.

90


Setting Default



Occurrences 10

Holes 2



2.L

og

icalD

iskR

esou

rceM

od

el

High Write Bytes per SecondThis indication is sent when a logical disk is writing a lot of data.


DiskWriteBytesSecThe number of bytes written per second on the logical disk

DiskWriteSecThe number of transactions that are written per second on the logical disk

PercentDiskWriteThe percent of the logical drive used during write operations.






The amount of bytes transferred per second (beingwritten or read) exceeds this threshold.

1572864


The percent of time that the selected disk drive spendsfor read or write requests exceeds this threshold.

90


Setting Default



Occurrences 10

Holes 2


16 Version 5.1.1

High Transfer RateThis indication is sent when a logical disk is used heavily to transfer data, both for readingand writing.


DiskXfersSecThe rate of bytes read or written per second on the logical disk

DiskReadsSecThe rate of bytes read per second on the logical disk

DiskWritesSecThe rate of bytes written per second on the logical disk

PercentDiskReadTimeThe percentage of the logical drive used for read operations

PercentDiskWriteTimeThe percentage of the logical drive used for write operations






The disk read or write bytes per second exceed thisthreshold.

1572864


The percentage of time that the logical drive spends forread or write requests exceeds this threshold.

90


Setting Default



Occurrences 10

Holes 2



2.L

og

icalD

iskR

esou

rceM

od

el

High Percentage Disk TimeThis indication is sent when a logical disk is being used a high percent of the time.


PercentDiskTimeThe percentage of time that the logical drive is being used

PercentWriteTimeThe percentage of time that the logical drive is used for write operations

PercentReadTimeThe percentage of time that the logical drive is being used for read operations





High Queue Length(HighQLength)

The maximum number of outstanding requests, includingthose in progress, on the disk exceeds this threshold.

3


The time spent by the selected disk to work exceeds thisthreshold.

90


Setting Default



Occurrences 10

Holes 1


18 Version 5.1.1

Logical Disk Possible FragmentationThis indication is sent when a high percentage of logical disk is being used, but the queuelength is not long, and bytes per second reading and writing are not high.


PercentDiskTimeThe percentage of time that the logical drive is being used

DiskBytesSecThe read and write transfer rate per second






The disk bytes per seconds value does not exceed thisthreshold.

1572864



90


This threshold must not be exceeded. 3


Setting Default



Occurrences 10

Holes 1



2.L

og

icalD

iskR

esou

rceM

od

el

Low Disk SpaceThis indication is sent when a logical drive has very little free space.


PercentFreeSpaceThe percentage of free space on the logical drive

FreeMBThe actual size of free space on the logical drive in megabytes





Low Disk Space(LowDiskSpace)

The free disk space drops below this threshold. 5


Setting Default



Occurrences 5

Holes 0


20 Version 5.1.1

Slow Logical DriveThis indication is sent when the logical disk is too slow to keep up with the work it mustperform.


CurrentDiskQLengthThe number of jobs waiting to be processed by the logical disk

PercentDiskTimeThe percentage of time that the logical disk is being used

AvgQLengthThe average queue length

AvgReadQLengthThe average queue length for read operations

AvgWriteQLengthThe average queue length for write operations

DiskReadBytesSecThe number of bytes read per second on the logical disk

DiskWriteBytesSecThe number of bytes read per second on the logical disk






The disk bytes per seconds value exceeds this threshold. 1572864


The number of outstanding requests, including those inprogress, on the disk exceeds this threshold.

3


Setting Default



Occurrences 10

Holes 1



2.L

og

icalD

iskR

esou

rceM

od

el

ThresholdsThe following table lists the thresholds that can be set for the Logical Disk resource model.For each threshold it shows the name, a short description, and the default value:



This threshold determines the maximum amount of bytestransferred per second (being written or read). Thedefault is based on the average logical disk.

1572864


This threshold determines the maximum number ofoutstanding requests, including those in progress, on thedisk. This is an exact length, not an average over thetime interval.

3


This threshold determines what percent of time that theselected disk drive spends for read or write requests istoo high.

90

Low Disk Space(LowDiskSpace)

This threshold determines what percentage of free diskspace is too low.

5

LoggingThe following table shows the resource, context and properties for which data can belogged:

Resource Context Properties

LogicalDisk Bytes TransferredLogicalDisk

The logical disk to be measured

DiskBytesSecThe amount of bytes per second being written orread

Queue LengthLogicalDisk


AvgQLengthThe average queue length for jobs

Percent SpaceLogicalDisk


PercentFreeSpaceThe percentage of free space on the logical disk

Percent Disk UsageLogicalDisk


PercentDiskTimeThe percentage of time that the logical drive isbeing used

Thresholds

22 Version 5.1.1

Memory Resource Model

This chapter describes the Memory resource model for Windows systems. The Memoryresource model detects bottlenecks specifically associated with RAM. Because nearly everydevice within the system uses RAM, most bottlenecks and problems will appear here.



Internal name TMW_MemoryModel

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Memory resource model highlights the following problems:

¶ Cache

When cache is used, four different areas are examined:

v Copy Reads

v Data Maps

v MDL Reads

v Pin Reads

The Hit Percentage Rate is examined for each area. This gives an idea of how muchdata was supplied by the cache and how much was supplied from another location. Ifcache is used, ideally it should provide at least 70% of the data. A lower percentageindicates data is being lost in the cache or that the cache is not large enough.

3


3.M

emo

ryR

esou

rceM

od

el

¶ Committed bytes

Committed bytes indicate the amount of virtual memory, in bytes, that have beencommitted. The commit limit is the current limit of physical space (either RAM or inthe pagefile) that is available for the committed bytes.

If the committed bytes become larger than the commit limit, the pagefile must beenlarged. Having a pagefile that is constantly in flux causes some performance problemsbecause the system spends time extending the pagefile or shrinking it. This process alsoinvolves the slowest part of the system and is prone to becoming a bottleneck.

The committed bytes has an upper limit. This is dictated by a setting in the systemcontrol applet. If the pagefile reaches its maximum limit, it is almost guaranteed thatavailable memory will be extremely low. In this situation a major performancedegradation can be expected.

If committed bytes continues to grow and there is not enough available physical space tohold the committed memory, a core dump will probably occur.

The initial size of the pagefile is best determined by the amount of RAM in the system.A good guideline is 150% of the amount of RAM.

¶ Low available memory

Available memory is checked constantly to ensure it does not drop below 10 MB. Whenavailable memory is low, performance declines slightly, but the system still workscorrectly. However, the administrator needs to know that memory is low and may needto monitor it.

As available memory drops, Windows NT systems try to keep the available memoryabove 4 MB. At this point memory is too low and the operating system spends moretime keeping memory available than processing requests. Additionally, high pagingbegins to occur, and the pagefile reaches its maximum size.

¶ Memory leaks

These three different areas of memory need to be analyzed for a possible leak:

v Private Bytes

v System Code

v System Drivers

The top five processes are examined in the Private Bytes. The total pools of SystemCode and System Drivers are also examined for growth. This generally indicates amemory leak in the affected area of memory.

¶ Paging and page faulting

Page Faults occur when Windows NT moves a piece of data to another portion of RAMor to the pagefile. Paging moves data to the hard drive, so it is incorporated in thecounters for Page Faults.

Page faults are considered high when they reach approximately 350 page faults persecond. Paging is considered high at approximately 60 pages per second. Performancedeclines because the system moves data to and from the hard drive, typically the slowestcomponent of the system. The hard drive and processor become busier and overallperformance of the machine decreases.

Overview

24 Version 5.1.1

Indications and EventsThe following table lists the events that can be generated by the Memory resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


TMW_HighPaging High Paging Warning 26

TMW_LowAvail Low Available Memory Warning 27

TMW_LowAvailCausingHardPaging Low Available Memory CausingHard Paging

Warning 28

TMW_LowAvailCausingSoftPagePagefileResize Low Available Memory CausingSoft Paging and PagefileResizing

Warning 30

TMW_LowAvailCausingSoftPaging Low Available Memory IsCausing Excessive Soft Paging

Warning 30

TMW_LowAvailCausingManyProblems Low Available Memory CausingMany Problems

Critical 31

TMW_LowAvailHighCache Low Available Memory withHigh Cache

Warning 32

TMW_LowAvailHighWS Low Available Memory withHigh Working Set

Warning 33

TMW_LowAvailWithSmallPageFile Low Available Memory With ASmall Pagefile

Warning 35

TMW_LowCopyReadHits Low Copy Read Hits Minor 36

TMW_LowDataMapHits Low Data Map Hits Minor 37

TMW_LowMDLReadHits Low MDL Read Hits Minor 38

TMW_LowPinReadHits Low Pin Read Hits Minor 39

TMW_PageFileResizing Pagefile Is Resizing Warning 40

TMW_MemoryLeakInPB Memory Leak In Private Bytes Critical 41

TMW_MemoryLeakInSC Memory Leak in System Code Critical 42

TMW_MemoryLeakInSD Memory Leak in SystemDrivers

Critical 43



3.M

emo

ryR

esou

rceM

od

el

High PagingThis indication is sent when there is a high amount of paging to the pagefile.


PagesSecThe number of pages swapped per second

TotalAvailThe total of available memory in bytes

TotalWorkingSetThe total working set size in bytes

TotalCacheThe total cache size in bytes



ExcessivePaging The number of pages per second exceeds this threshold. 60


Setting Default



Occurrences 15

Holes 1


26 Version 5.1.1

Low Available MemoryThis indication is sent when the available memory is low, but it is not clear in which area ofmemory the problem is located.





PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache

PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache

PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory



Minimum Available Bytes(MinimumAvail)

Available memory is lower than this threshold. 10485760

N/A This indication is sent when the cache must be largerthan the total amount of Working Set and availablememory.

N/A


Setting Default



Occurrences 6

Holes 2



3.M

emo

ryR

esou

rceM

od

el

Low Available Memory Causing Hard PagingThis indication is sent when low available memory causes too much paging to the pagefile.



PageFaultsSecThe current rate of page faults per second

PagesSecThe current rate of pages per second





Minimum Committed Bytes(MinimumCommitted)

This threshold is not crossed. 5242880

ExcessivePageFaults Paging to disk and to other areas of memory is higherthan this threshold.

350

ExcessivePaging The number of pages per second exceeds thisthreshold.

60


Setting Default



Occurrences 10

Holes 1


28 Version 5.1.1

Low Available Memory Causing Soft Paging and Pagefile ResizingThis indication is sent when excessive soft paging and pagefile resizing is being caused bylow available memory.




CommittedBytesThe current total of committed bytes

CommittedLimitThe upper limit of the committed bytes





ExcessivePageFaults Paging to disk and to other areas of memory is higherthan this threshold.

350

Excessive Paging(ExcessivePaging)



The difference between the current committed bytesand the peak current bytes is smaller than thisthreshold.

5242880


Setting Default



Occurrences 1

Holes 0



3.M

emo

ryR

esou

rceM

od

el

Low Available Memory Is Causing Excessive Soft PagingThis indication is sent when the available memory is low and is causing a high amount ofpage faults


PageFaultsSecThe current value for page faults per second






ExcessivePageFaults Page faults per second are higher than this threshold. 350






Setting Default



Occurrences 10

Holes 1


30 Version 5.1.1

Low Available Memory Causing Many ProblemsThis indication is sent when multiple problems are being caused by lack of availablememory.




PagesSecThe current rate of pages per second







ExcessivePageFaults Paging to disk and to other areas of memory ishigher than this threshold.

350

ExcessivePaging The number of pages per second exceeds thisthreshold.

60



5242880


Setting Default



Occurrences 1

Holes 0



3.M

emo

ryR

esou

rceM

od

el

Low Available Memory with High CacheThis indication is sent when available memory is low due to a large amount of memorybeing taken up by cache.












N/A This indication is sent when the cache must be largerthan the total amount of Working Set and availablememory.

N/A


Setting Default



Occurrences 6

Holes 1


32 Version 5.1.1

Low Available Memory with a High Working SetThis indication is sent when available memory is low and the working set is high.








HighProcessWorkingSetThe working set of the process with the highest working set

HighProcessPrivateBytesThe private bytes of the process with the highest working set

HighProcessPoolNPBytesThe pool non-paged bytes of the process with the highest working set

HighProcessPoolPPBytesThe pool paged bytes of the process with the highest working set

HighProcessVirtualBytesThe virtual bytes of the process with the highest working set

HighProcessIDProcessThe numeric ID of the process with the highest working set

TotalProcessesThe total number of processes

HighProcessThe string name of the process with the highest working set





N/A This indication is sent when the working set must belarger than the total amount of cache and availablememory.

N/A



3.M

emo

ryR

esou

rceM

od

el


Setting Default



Occurrences 6

Holes 2


34 Version 5.1.1

Low Available Memory with a Small PagefileThis indication is sent when available memory is low and the pagefile is being resized.









Minimum Committed The difference between the committed bytes andcommitted limit is lower than this threshold.

5242880




Setting Default



Occurrences 1

Holes 0



3.M

emo

ryR

esou

rceM

od

el

Low Copy Read HitsThis indication is sent when a copy read hit from cache does not retrieve a high percentageof data.


AvrgCopyReadHitsPercentThe percentage average of copy read hits









Low Cache Hits Percent(LowCacheHitsPercent)

The number of copy read hits is lower than thethreshold.

70


Setting Default



Occurrences 10

Holes 1


36 Version 5.1.1

Low Data Map HitsThis indication is sent when a data map hit from cache does not retrieve a high percentageof data.


AvrgDataMapHitsPercentThe percentage average of data map hits










The number of copy read hits is lower than thethreshold.

70


Setting Default



Occurrences 10

Holes 1



3.M

emo

ryR

esou

rceM

od

el

Low MDL Read HitsThis indication is sent when the MDL read hit from cache does not retrieve a highpercentage of data. Continuous occurrences of this indication show that there is not enoughcache. Either adding more RAM or adjusting the registry will help this situation.


AvrgMDLReadHitsPercentThe percentage average of MDL read hits










The number of MDL read hits is lower than thisthreshold

70


Setting Default



Occurrences 10

Holes 1


38 Version 5.1.1

Low Pin Read HitsThis indication is sent when a pin read hit from cache does not retrieve a high percentage ofdata. The pin read hits are too low. Continuous occurrences of this indication show that thereis not enough cache. Either adding more RAM or adjusting the registry will help thissituation.


AvrgPinReadHitsPercentThe percentage average of pin read hits










The number of pin read hits is lower than this threshold. 70


Setting Default



Occurrences 10

Holes 1



3.M

emo

ryR

esou

rceM

od

el

Pagefile Is ResizingThe pagefile is resizing indication. This indication is sent when the pagefile is being resized.











5242880


This threshold must not be crossed. 10485760


Setting Default



Occurrences 1

Holes 0


40 Version 5.1.1

Memory Leak In Private BytesThis indication is sent when there is a memory leak in the private memory, which is thememory pages that cannot be shared with other processes.


IDProcessThe numeric ID of the process with the memory leak

CurrentWorkingSetThe current working set of the process

CurrentPrivateBytesThe current private bytes of the process

CurrentPoolNonPagedBytesThe current pool of non-paged bytes of the process

CurrentPoolPagedBytesThe current pool of paged bytes of the process

CurrentVirtualBytesThe current virtual bytes set of the process

ProcessThe name of the process

No specific threshold causes this indication to be sent. The decision tree examines the topfive processes in this memory area and compares them with the top five processes from thelast cycle. It tries to find identical processes by matching the process IDs and thencomparing the amount of memory it is using for this particular pool of memory. If thememory size has grown since the last cycle, this indication is sent.


Setting Default



Occurrences 40

Holes 1



3.M

emo

ryR

esou

rceM

od

el

Memory Leak In System CodeThis indication is sent when there is a memory leak in the system code. The system code isthe area of pageable memory in ntoskrnl.exe, hal.dll, and the boot drivers and file systemsloaded by ntldr/osloader.


OrigSizeThe original size of the system code memory

SysDriverBytesThe current size of the system code memory in bytes



N/A The decision tree examines the system code pool ofmemory and finds that the memory size has grown sincethe previous cycle.

N/A


Setting Default



Occurrences 40

Holes 10


42 Version 5.1.1

Memory Leak In System DriversThis indication is sent when there is a memory leak in the system drivers.


OrigSizeThe original size of the system driver memory

SysCodeThe current size of the system driver memory



N/A The decision tree examines the system drivers pool ofmemory and finds that the memory size has grown sincethe previous cycle.

N/A


Setting Default



Occurrences 40

Holes 10



3.M

emo

ryR

esou

rceM

od

el

ThresholdsThe following table lists the thresholds that can be set for the Memory resource model. Foreach threshold it shows the name, a short description, and the default value:


Excessive Page Faults(ExcessivePageFaults)

This threshold indicates how much paging to disk andto other areas of memory is too high.

350


This threshold indicates when pages per second are toohigh.

60


This threshold indicates what percentage is too lowwhen reading data from the cache.

70


This threshold indicates at what point available memoryis too low (in bytes).

10485760


This threshold indicates the lowest limit for thedifference between total committed bytes andcommitted limit values.

5242880



Process Process Memory UsageProcess The process being monitored

WorkingSetThe working set

PrivateBytesThe number of private bytes used by the process

VirtualBytesThe number of virtual bytes used by the process

ID The process ID

Memory Memory UsageMemory The memory instance

TotalAvailThe total available memory

TotalCacheThe total cache memory

CommittedBytesThe bytes committed to this memory

PagingPagesSec

The number of pages per second

PageFaultsSecThe rate of page faults per second

Thresholds

44 Version 5.1.1

Network Interface Card Resource Model

The Network Interface Card (NIC) resource model detects bottlenecks specifically associatedwith all network interface cards installed on Windows NT systems.

Note: The Network Interface Card (NIC) resource model is not supported on Windows2000.



Internal name TMW_NetworkIntCard

Category System

Thresholds Yes

Parameters No


Clearing events Yes


PrerequisitesThe Network Interface Card resource model requires Windows NT. SNMP and the NetworkMonitoring Agent must be installed in the Network properties.

Note: The Network Monitoring Agent must be installed prior to installing TCP/IP. Once youhave installed the Network Monitoring Agent, check the Performance Monitor tooland ensure that the Network Interface object is displayed.

Overview

Resource model distributionThis resource model should be distributed to Windows NT endpoints.

The Network Interface Card resource model highlights the following problems:

¶ Broadcast frames

If too much of the network is broadcast frames for an extended period of time, thenetwork administrator should segment the network further or redesign the network to usefewer broadcast frames.

¶ Network interface card

4


4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

The core of the network subsystem is the network interface card (NIC). If a networkcard is not fast enough to handle the number of requests from other nodes on thenetwork or from internal counterparts, all aspects of the network subsystem are affected.Tests are made to determine if a network card is too slow, or if there is too much datatrying to be sent through the network.

¶ Percentage usage

To identify the network component being overused, tests are performed on thepercentage of the network segment being used, the server service, and the workstationservice (redirector). This reveals if the system is part of a busier network, is servicingtoo many requests, or is requesting too much.

The system administrator must determine whether to upgrade the server or workstationservice, or whether to distribute the workload differently.

¶ Server and workstation services

The server and workstation services are vital to the network operations of Windows NTand Windows 2000. Performance statistics for each service, such as bytes per second inand out, sessions with errors, or high requests to the services are examined.

Indications and EventsThe following table lists the events that can be generated by the Network Interface Cardresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


TMW_AdjustWorkItems Adjust Work Items Warning 47

TMW_HighBroadcastFrames High Broadcast Frames Warning 48

TMW_HighCurrentCommands High Current Commands Warning 49

TMW_HighErroredRatio High Errored Ratio Critical 50

TMW_NICOverworked Network Interface CardOverworked

Warning 51

TMW_NICTooSlow Network Interface Card Too Slow Warning 52

TMW_RedirectorAffectingServer Redirector Affecting Server Warning 53

TMW_RedirectorOverloaded Redirector Overloaded Warning 55

TMW_RedirectorOverloadedAffectingSegment Redirector Overloaded AffectingSegment

Warning 56

TMW_SegmentAffectingRedirector Segment Affecting Redirector Warning 58

TMW_SegmentAffectingServer Segment Affecting Server Warning 60

TMW_ServerAffectingRedirector Server Affecting Redirector Warning 61

TMW_ServerOverloaded Server Overloaded Warning 62

TMW_ServerOverloadedAffectingSegment Server Overloaded AffectingSegment

Warning 63

Overview

46 Version 5.1.1

Adjust Work ItemsThe work item shortage is too high and the Windows NT registry needs to be adjusted. Thisindication occurs when there is only a high work item shortage. This can be remedied byadjusting the max work items in the registry.


WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server



High Percent Bytes Per Second(HighPercentBytesSec)

To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent.

9

High Percent Utilization(HighPercentUtilization)

This threshold determines at what point thenetwork utilization of the internal segment is toohigh.

40

High Work Item Shortages(HighWorkItemShortages)



Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

High Broadcast FramesThis indication is sent when broadcast frames are too high on the internal segment.


PercentNetworkUtilThe percentage value of network utilization on the segment

PercentBroadcastFramesThe percentage value of broadcast frames on the network segment

NetworkSegmentThe identity of the network segment being analyzed (Key attribute)



High Percent Broadcast(HighPercentBroadcast)

This threshold measures the percentage of broadcastframes on the internal network segment.

90


This threshold determines at what point the networkutilization of the internal segment is too high.

40


Setting Default



Occurrences 6

Holes 1


48 Version 5.1.1

High Current CommandsThis indication is sent when current commands are too high on the redirector. Because thepercentage utilization of bytes per second is normal, this is most likely due to a problemwith the workstation service or a software component tied into the service.


CurrentCommandsThe current commands that are queued for service on the redirector

RedirectorBPSThe bytes per second being transferred through the redirector

CurrentBandWidthThe bandwidth of the network interface card



High Current Commands Modifier(HighCurrCmdsMod)

This threshold counts the requests to theredirector that are currently queued for service.If this number is much larger than the numberof network adapter cards installed in thecomputer, the networks, servers, or both beingaccessed have serious bottlenecks. This value isused in conjunction with the number ofnetwork cards installed on the system. Thefinal threshold value is calculated bymultiplying the number of network cards in thesystem by this threshold. If the currentcommands rise above this level, there is abottleneck occurring. When the value ofcurrent commands is greater than the productof this threshold times the total number ofinstalled network cards, this indication isgenerated.

10




This threshold determines at what point thenetwork utilization of the internal segment istoo high.

40


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

High Errored RatioThis indication is sent when the ratio between the number of sessions errored out, and thesum of sessions timed out and logged off is high. This indicates how frequently networkproblems are causing dropped sessions on the server.


SessionsErroredRatioThe ratio of sessions errored out to the total sessions on the server

SessionsErroredOutThe number of sessions errored out on the server

SessionsForcedOffThe number of sessions forced off the server bandwidth of the network interfacecard

SessionsLoggedOffThe number of sessions logged off the server

ServerTotalSessionsThe total number of sessions on the server

The indication is generated when the following threshold is exceeded:


High Errored Out Ratio(HighErroredOutRatio)

This threshold indicates the ratio of sessions beingerrored out in comparison to sessions either logging outor being timed out. This number is a percentagegenerated by dividing the number of sessions errored outby the sum of the sessions forced off (timed out) andlogged off.

50


Setting Default



Occurrences 3

Holes 0


50 Version 5.1.1

Network Interface Card OverworkedThis indication is sent when the network interface card is overworked. Bytes per secondthrough the network card is too high and the outbound queue length is getting too large.


OutputQueueLengthThe number of requests queued up to be sent out the network interface card

NICBPSThe bytes per second transferred through the network interface card


NetworkInterfaceThe identity of network interface card being examined (Key attribute)



High Output Queue Length Modifier(HighOutputQueueLengthMod)

The network card has an output queue that isused to queue network requests. This thresholdis a modifier that can be adjusted by theadministrator to adjust the threshold for theoutput queue length for the network interface.This threshold is calculated using the totalnumber of network interface cards in the systemplus this value.

3


To test for a high amount of bytes per second, adynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. Because there will be an internaldynamic calculation, the threshold value is apercentile that indicates what percentage of thebandwidth is considered too high. For example:830 KBPS is considered high for 10 MBethernet networks. This value is about 8 percent.

9


Setting Default



Occurrences 3

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

Network Interface Card Too SlowThis indication is sent when the outbound queue length is getting too large but the bytes persecond traveling through the network interface card are normal.


OutputQueueLengthThe number of requests queued up to be sent out the network interface card

NICBPSThe bytes per second transferred through the network interface card


NetworkInterfaceThe identity of network interface card being examined (Key attribute)



High Output Queue Length Modifier(HighOutputQueueLengthMod)

The network card has an output queue that isused to queue network requests. This thresholdis a modifier that can be adjusted by theadministrator to adjust the threshold for theoutput queue length for the network interface.This threshold is calculated using the totalnumber of network interface cards in thesystem plus this value.

3


To test for a high amount of bytes per second,a dynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. Because there will be an internaldynamic calculation, the threshold value is apercentile that indicates what percentage of thebandwidth is considered too high. For example:830 KBPS is considered high for 10 MBethernet networks. This value is about 8percent.

9


Setting Default



Occurrences 3

Holes 1


52 Version 5.1.1

Redirector Affecting ServerThis indication is sent when there is a high work item shortage, but bytes per second on theserver are not exceeding the threshold, and bytes per second on the redirector are exceedingthe threshold. This affects the percentage utilization of the network segment.



RedirectorBPSThe number of bytes per second transferring through the redirector


PercentNetworkUtilThe percentage of network utilization on the segment





To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent. The bytes per secondthrough the redirector are greater than the number ofbytes per second. This number is reached bymultiplying the current bandwidth with thisthreshold, and dividing the result by 100.

9



40


This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the server servicereceives a request. HighWorkItemShortages indicatesthat the initial work items or maximum work itemsparameters may need tuning.

10



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el


Setting Default



Occurrences 6

Holes 1


54 Version 5.1.1

Redirector OverloadedThis indication is sent when current commands are high and bytes per second on theredirector are high, but the network segment percentage utilization is normal. The redirectoris unable to keep up with the number of requests being made to it.








This threshold counts the requests to the redirectorthat are currently queued for service. If the numberof current commands is greater than the product ofthis threshold times the total number of installednetwork cards, this indication is sent.

10




The bytes per second through the redirector aregreater than this threshold, which is calculated bymultiplying the current bandwidth with theHighPercentBytesSec threshold, and dividing theresult by 100.

9



40


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

Redirector Overloaded Affecting SegmentThis indication is sent when the redirector, or workstation service, is being overloaded and itis generating a bottleneck on the network segment. The current commands and bytes persecond on the redirector are exceeded. This usually causes the percentage utilization of thenetwork segment to be exceeded.






NetworkSegmentThe network segment being analyzed (Key attribute)




This threshold counts the requests to theredirector that are currently queued for service. Ifthis number is much larger than the number ofnetwork adapter cards installed in the computer,the networks, servers, or both being accessedhave a serious bottleneck. This value is used inconjunction with the number of network cardsinstalled on the system. The final threshold valueis calculated by multiplying the number ofnetwork cards in the system by this threshold.

10




To test for a high amount of bytes per second, adynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. When the bytes per secondthrough the redirector are greater than the numberof high bytes per second, this indication is sent.This value is calculated by multiplying thecurrent bandwidth with the High PercentageBytes per Second threshold, and dividing theresult by 100.

9


This threshold determines at what point thenetwork utilization of the internal segment is toohigh.

40


56 Version 5.1.1


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

Segment Affecting RedirectorThis indication is sent when the current commands are high, but bytes per second on boththe redirector and server services are not high. It is then assumed that the current commandsare high due to a high percentage utilization of the network segment.






ServerBPSThe bytes per second being transferred through the server



High Current CommandsModifier (HighCurrCmdsMod)

This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks, servers,or both being accessed have a serious bottleneck.This value is used in conjunction with the number ofnetwork cards installed on the system. The finalthreshold value is calculated by multiplying thenumber of network cards in the system by thisthreshold.

10




To test for a high amount of bytes per second, adynamic threshold value needs to be created based onthe current bandwidth of the network interface card.Because there will be an internal dynamic calculation,the threshold value is a percentile that indicates whatpercentage of the bandwidth is considered too high.For example: 830 KBPS is considered high for 10MB ethernet networks. This value is about 8 percent.

9



40


58 Version 5.1.1


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

Segment Affecting ServerThis indication is sent when there is a high work item shortage, but bytes per second on theredirector and the server are not high. It is assumed that the high work item shortage is dueto a percentage utilization on the network segment.










To test for a high amount of bytes per second, adynamic threshold value needs to be created based onthe current bandwidth of the network interface card.Because there will be an internal dynamic calculation,the threshold value is a percentile that indicates whatpercentage of the bandwidth is considered too high.For example: 830 KBPS is considered high for 10 MBethernet networks. This value is about 8 percent.

9



40



10


Setting Default



Occurrences 6

Holes 1


60 Version 5.1.1

Server Affecting RedirectorThis indication is sent when current commands are high, server bytes per second are high,but bytes per second on the redirector are not high. This causes the network segmentpercentage utilization to rise. The redirector for the segment is overloaded due to the highamount of information coming through the server.









High Current CommandsModifier (HighCurrCmdsMod)

This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks, servers,or both being accessed have a serious bottleneck.This value is used in conjunction with the number ofnetwork cards installed on the system. The finalthreshold value is calculated by multiplying thenumber of network cards in the system by thisthreshold.

10




The bytes per second through the server are greaterthan the number of high bytes per second. This valueis calculated by multiplying the current bandwidthwith this threshold, and dividing the result by 100.

9



40


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

Server OverloadedThis indication is sent when there is a high work item shortage and bytes per second arehigh on the server service. Because the percentage utilization of the network segment isnormal, the work demand on the server service is probably too high.


WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server (Key attribute)







9



40



10


Setting Default



Occurrences 6

Holes 1


62 Version 5.1.1

Server Overloaded Affecting SegmentThis indication is sent when there is a high work item shortage and a high bytes per secondthrough the server service. The server for a segment is overloaded due to the high amount ofdata being requested from the server.


WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server (Key attribute)



PercentNetworkUtilThe percentage value of network utilization on the segment








9



40



10


Setting Default



Occurrences 6

Holes 1



4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el

ThresholdsThe following table lists the thresholds that can be set for the Network Interface Cardresource model. For each threshold it shows the name, a short description, and the defaultvalue:



This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks,servers, or both being accessed have a seriousbottleneck. This value is used in conjunction withthe number of network cards installed on thesystem. The final threshold value is calculated bymultiplying the number of network cards in thesystem by this threshold.

10

High Errored Out Ratio(HighErroredOutRatio)

This threshold indicates the ratio of sessions beingerrored out in comparison to sessions either loggingout or being timed out. This number is a percentagegenerated by dividing the number of sessionserrored out by the sum of the sessions forced off(timed out) and logged off.

50

High Output Queue LengthModifier(HighOutputQueueLengthMod)

The network card has an output queue that is usedto queue network requests. This threshold is amodifier that can be adjusted by the administratorto adjust the threshold for the output queue lengthfor the network interface. This threshold iscalculated using the total number of networkinterface cards in the system plus this value.

3


This threshold measures the percentage of broadcastframes on the internal network segment.

90


To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent.

9



40


This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the serverservice receives a request. HighWorkItemShortagesindicates that the initial work items or maximumwork items parameters may need tuning.

10

Thresholds

64 Version 5.1.1

Built-in ActionsThis resource model has the following built-in actions:

¶ Adjust the InitWorkItems registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\InitWorkItems to a value of 512.

¶ Adjust the MaxWorkItems registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\MaxWorkItems. This value can only go to 64 on WindowsNT Workstations and 65 535 on Windows NT Servers.



Redirector Bytes RateBytesTotalSec

The rate at which the redirector is processing databytes.

RedirectorThe redirector being monitored

Current CommandsRedirector

The redirector being monitored

CurrentCommandsThe number of requests that are currently queued forthe redirector.

Network Segment Percent BroadcastSegment The segment being monitored

PercentNetworkUtilThe percent of the network being used

PercentBroadcastFramesThe percent of the network that is broadcast frames

Server Bytes RateBytesTotalSec

The total number of bytes passing through thenetwork per second

Server The server being monitored

Server ActivityServerTotalSession

The number of sessions on the server

SessionsErroredOutThe number of sessions that ended in error

SessionsForcedOffThe number of sessions forced offline

SessionsLoggedOffThe number of sessions logged off

WorkItemShortagesIdentifies work item shortages

server Identifies server being monitored

Built-in Actions


4.N

etwo

rkIn

terfaceC

ardR

esou

rceM

od

el


Network Interface Card Network TrafficBytesTotalSec

The total number of bytes passing through thenetwork per second

CurrentBandwidthThe network bandwidth

NetworkInterfaceCardThe network interface card being monitored

Output Queue LengthOutput Queue Length

The length of the queue for output

Network Interface CardThe card being monitored

Logging

66 Version 5.1.1

Parametric Event Log Resource Model

This chapter describes the Parametric Event Log resource model for Windows systems.



Internal name TMW_ParamEventLog

Category Windows

Thresholds No

Parameters Yes

Built-in actions No

Clearing events No


Overview


This resource model examines the Windows NT or Windows 2000 Event Log for events thatare specified by the user through the parameter configuration.

Indications and EventsThe following table lists the event that can be generated by the Parametric Event Logresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


TMW_NTEventLogOccurred Windows Event Logged Warning 68

5


5.P

arametric

Even

tL

og

Reso

urce

Mo

del

Windows Event LoggedThis indication is sent when the user-specified event occurs and is logged in the Windowsevent log.


EventIDIdentifies the event

RepeatCountThe number of Event ID events received during a cycle

LogfileThe name of the log file in which the event was generated (for example, system,security, or application).

SourceNameThe source of the event (Key attribute)

TimeGeneratedThe time that the event was generated

TimeWrittenThe time that the event was written to the Event Log

ComputerNameThe name of the computer where the event occurred (Key attribute)

MessageThe message text of the event

SeverityThe severity of the event


Setting Default



Occurrences 1

Holes 0


68 Version 5.1.1

ThresholdsNo particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by MostNumberOfLogs) and has the Event ID of9, this indication is sent.

ParametersThe following table lists the parameters that can be set for this resource model.

Parameter Description Default

Event IDs (Eids) Allows you to specify the number of the required eventIDs to be monitored. This must be the value of the eventID from the Windows event log.

Numeric list

Event Severity (Severity) Allows you to specify the severity of the events to bemonitored. You can choose any of the following severitylevels:

¶ Information: Set to Harmless on Tivoli EnterpriseConsole server. Default: False

¶ Warning. Default: False

¶ Error: Set to Minor on Tivoli Enterprise Consoleserver. Default: False

¶ Audit success: Set to Harmless on Tivoli EnterpriseConsole server. Default: False

¶ Audit failure: Set to Minor on Tivoli EnterpriseConsole server. Default: False

Boolean list

Log File Type (LogType) The type of log file that you are interested in. You canchoose any of the following types:

SecurityRecords security events. Default: False

SystemRecords events logged by the Windows NTsystem components. Default: False

ApplicationRecords events logged by applications. Default:False

Boolean list

Windows 2000 Logs(Win2kLogs)

The type of Windows 2000 file that you are interestedin. You can choose any of the following types:

¶ Directory Services. Default: False

¶ File Replication. Default: False

¶ DNS Server. Default: False

Boolean list

Source (Source) The source of the event log. This is the software thathas logged the event. The software can be either anapplication or a system component, such as a driver. Thename of the source must be as shown in the WindowsNT or Windows 2000 event log.

String list

Thresholds


5.P

arametric

Even

tL

og

Reso

urce

Mo

del


Computers (Computers) The computer which originated the event. You mustspecify the exact name of the computer, as shown in theWindows NT or Windows 2000 event log.

String list

Filter Type (FilterType) The type of filter applied to the parameters specifiedwith this dialog. You can select an AND or OR filter.The AND filter will trigger an event only when all ofthe conditions specified by the other parameters are met.The OR filter will trigger an event when any one of theconditions specified by the other parameters is met. Thedefault value is AND.

Choice list

Parameters

70 Version 5.1.1

Parametric Services Resource Model

This chapter describes the Parametric Services resource model for Windows systems.



Internal name TMW_ParamServices

Category Windows

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The resource model allows you to monitor the services you require.

Indications and EventsThe following table lists the event that can be generated by the Parametric Services resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


TMW_ParamServicesFailingService Services Failing Service Critical 72

TMW_ParamServicesStoppedService Services Stopped Service Critical 73

6


6.P

arametric

Services

Reso

urce

Mo

del

Services Failing ServiceThis indication is sent when one of the listed services is not stable. This can cause problemsfor the local machine and for connected machines over the network. Services that are notstable should be stopped to prevent them from causing any bottlenecks or damage.


NameThe name of the service being examined (Key attribute)

StartModeThe start mode of the service

State The current state of the service

ServiceStatusThe current status of the service


Setting Default



Occurrences 1

Holes 0


72 Version 5.1.1

|||

Services Stopped ServiceThis indication is sent when one of the listed services is stopped. If a key service is stopped,it must be restarted to ensure Windows is working properly.


Name The name of the service being examined (Key attribute)




Setting Default



Occurrences 2

Holes 0



||

6.P

arametric

Services

Reso

urce

Mo

del

ParametersThe single parameter that can be set for this resource model is Services (services). It is astring list. You must specify the exact name of the service, as defined in the Registry underthe following key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

The following lists the default services that can be monitored with the Parametric Servicesresource model:

¶ lcfd

¶ LanmanWorkstation

¶ LanmanServer

¶ NtLmSsp

¶ Netlogon

¶ EventLog

¶ Browser



Service Services StatusState The state of the service

Status The status of the service

Service The service being monitored

Parameters

74 Version 5.1.1

Parametric TCP/IP Ports Resource Model

This chapter describes the Parametric TCP/IP Ports resource model for Windows systems.



Internal name TMW_ParamPorts

Category Windows

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model checks the TCP and UDP port numbers you specify and generatesevents whenever these ports are in a specified state or states. You can customize thisresource model to monitor the state of TCP/IP ports used by an application.

The resource model includes the information provider file NetworkPortInfoProvider.dll.

PrerequisitesThe parametric TCP/IP ports resource model requires TCP/IP and SNMP to be installed.

Indications and EventsThe following table lists the event that can be generated by the Parametric TCP/IP Portsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


TMW_ParamPortStatus State of the Defined Port Warning 76

7


7.P

arametric

TC

P/IP

Po

rtsR

esou

rceM

od

el

State of the Defined PortThis indication is sent when both of the conditions set by the parameters Port Number andPossible State of a Port are met.


LocalPortThe port number (Key attribute)

LocalPortNameThe name of the port being monitored

State Indicates the state of the port being monitored


Setting Default



Occurrences 2

Holes 0


76 Version 5.1.1

ParametersThe following table lists the parameters that can be set for this resource model. Together, theparameters function as a filter.


Port Numbers(ParamPortList)

Allows you to specify the port numbers to be monitored. Numeric list

Possible State of a Port(ParamPortStatusList)

Allows you to specify the state of the defined port orports to be monitored. Ports can be monitored for one ormore of the following states:

¶ LISTENING. Default: False

¶ CLOSED. Default: True

Boolean list



Port Port StateState The state of the port

Port The port

Parameters


7.P

arametric

TC

P/IP

Po

rtsR

esou

rceM

od

el

Logging

78 Version 5.1.1

Physical Disk Resource Model

This chapter describes the Physical Disk resource model for Windows systems.



Internal name TMW_PhysicalDiskModel

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Physical Disk resource model detects bottlenecks specifically associated with allphysical disks that are configured on the system. This model highlights the followingproblems:

¶ Bytes transferred per second

Bytes transferred per second indicates the raw amount of data that is transferred throughthe disk. The maximum bytes per second a disk subsystem can handle depends on thetype of hard drive, the type of controller, the drive configuration, and, in the case ofmost IDE-based hard drives, the speed of the CPU. Bytes transferred per second can bea good indicator of whether or not too much data is being pushed through the disk.

¶ Percentage usage

Another indicator that a disk is being over worked or is causing a bottleneck is thepercentage usage of the disk. This particular threshold often needs to be altered whenmonitoring file servers for bottlenecks.

File servers, along with print and mail servers, can expect the percentage usage to beconsistently high and are generally expected to show high use. However, in the case ofworkstations, these machines should typically see high percentage usage of disks in shortbursts.

8


8.P

hysical

Disk

Reso

urce

Mo

del

Workstations experiencing high disk usage will often see declining performance in CPUspeed and general system response. In these situations, a high percentage usage of thedisk is generating a bottleneck.

PrerequisitesThis resource model requires disk counters to be enabled on the Windows endpoints.

To enable disks counters, perform the following steps on each endpoint:

1. On Windows NT systems, issue the diskperf -y command.

On Windows 2000 systems, issue the diskperf -yv command.

2. Reboot the system.

Indications and EventsThe following table lists the events that can be generated by the Physical Disk resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


TMW_HighPhysicalPercentDiskTime High Percent Disk Time Warning 81

TMW_HighPhysicalDiskReadBytesSec High Read Bytes per Second Minor 82

TMW_HighPhysicalDiskXferRate High Transfer Rate Minor 83

TMW_HighPhysicalDiskWriteBytesSec High Write Bytes per Second Minor 84

TMW_PhysicalPossibleFrag Physical Disk PossibleFragmentation

Minor 85

TMW_SlowPhysicalDrive Slow Physical Drive Warning 86

Overview

80 Version 5.1.1

High Percent Disk TimeThis indication is sent when a physical disk is in heavy use, and the drive cannot process therequests fast enough. This lengthens the queue.


PercentDiskTimeThe percentage of time that the physical drive is being used

PercentWriteTimeThe percentage of time that the physical drive is used for write operations

PercentReadTimeThe percentage of time that the physical drive is being used for read operations

PhysicalDiskThe physical disk on which the physical disk resides (Key attribute)




This threshold must not be exceeded. 1 572 864


The maximum number of outstanding requests, includingthose in progress, on the disk exceeds this threshold.

3



90


Setting Default



Occurrences 10

Holes 1



8.P

hysical

Disk

Reso

urce

Mo

del

High Read Bytes per SecondThis indication is sent when a physical drive is in heavy use reading data.


PercentDiskReadThe percentage of the physical drive being used to read data

DiskReadBytesSecThe number of bytes read per second on the physical disk

DiskReadSecThe number of transactions that are read per second on the physical disk

PhysicalDiskThe physical disk being monitored (Key attribute)




The amount of bytes transferred per second (beingwritten or read) exceeds this threshold.

1 572 864



90




Setting Default



Occurrences 10

Holes 2


82 Version 5.1.1

High Transfer RateThis indication is sent when a physical disk is used heavily to transfer data, both for readingand writing.


DiskXfersSecThe rate of bytes read or written per second on the physical disk

DiskReadsSecThe rate of bytes read per second on the physical disk

DiskWritesSecThe rate of bytes written per second on the physical disk

PercentDiskReadTimeThe percentage of the physical drive used for read operations

PercentDiskWriteTimeThe percentage of the physical drive used for write operations





The disk read or write bytes per second exceed thisthreshold.

1572864


The percentage of time that the physical drive spendsfor read or write requests exceeds this threshold.

90




Setting Default



Occurrences 10

Holes 2



8.P

hysical

Disk

Reso

urce

Mo

del

High Write Bytes per SecondThis indication is sent when a physical disk is writing a lot of data.


DiskWriteBytesSecThe number of bytes read per second on the physical disk

DiskWriteSecThe number of bytes read per second on the physical disk

PercentDiskWriteThe percent of the physical drive used during write operations





The amount of bytes written per second exceeds thisthreshold.

1572864



90




Setting Default



Occurrences 10

Holes 2


84 Version 5.1.1

Physical Disk Possible FragmentationThis indication is sent when a high percentage of physical disk is being used, but the queuelength is not long, and bytes per second reading and writing are not high.


PercentDiskTimeThe percentage of time that the physical drive is being used

DiskBytesSecThe read and write transfer rate per second





The disk bytes per seconds value does not exceed thisthreshold.

1572864



90




Setting Default



Occurrences 10

Holes 1



8.P

hysical

Disk

Reso

urce

Mo

del

Slow Physical DriveThis indication is sent when the physical disk is too slow to keep up with the work it mustperform.


CurrentDiskQLengthThe number of jobs waiting to be processed by the physical disk

PercentDiskTimeThe percentage of time that the physical disk is being used

AvgQLengthThe average queue length

AvgReadQLengthThe average queue length for read operations

AvgWriteQLengthThe average queue length for write operations

DiskReadBytesSecThe number of bytes read per second on the physical disk

DiskWriteBytesSecThe number of bytes read per second on the physical disk





The disk bytes per seconds value exceeds this threshold. 1572864


The number of outstanding requests, including those inprogress, on the disk exceeds this threshold.

3


Setting Default



Occurrences 10

Holes 1


86 Version 5.1.1

ThresholdsThe following table lists the thresholds that can be set for the Physical Disk resource model.For each threshold it shows the name, a short description, and the default value:



This threshold determines how many bytes per second(either reading per second or writing per second) is toohigh. Different disk sub-systems have differentmaximums, so the default threshold value is targetedtowards the average physical disk.

1 572 864


This threshold determines what percent of time that theselected disk drive spends for read or write requests istoo high.

90


This threshold determines the maximum number ofoutstanding requests, including those in progress, on thedisk. This is an exact length, not an average over thetime interval.

3



PhysicalDisk Bytes TransferredPhysicalDisk

The physical disk to be measured

DiskBytesSecThe amount of bytes per second being written orread

Percent Disk UsagePhysicalDisk


PercentDiskTimeThe percentage of time that the Physical drive isbeing used

Queue LengthPhysicalDisk


AvgQLengthThe average queue length for jobs

Thresholds


8.P

hysical

Disk

Reso

urce

Mo

del

Logging

88 Version 5.1.1

Printer Resource Model

This chapter describes the Printer resource model for Windows 2000 systems.



Internal name TMW_PrintModel

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview

Resource model distributionThis resource model should be distributed to Windows 2000 endpoints only.

The Printer resource model determines if there are any bottlenecks in the print engine ofWindows 2000. These bottleneck checks include determining if a print queue is generatingan abnormally high amount of errors, if a print device is being overworked, and generalfunctionality of the print server.

The Printer resource model highlights the following problems:

¶ Printer Errors

If the number of errors is too high then this should be addressed as soon as possible.Various errors include not ready errors (the print device is off-line or has a pendingmessage), out of paper errors (if a print device is consistently running out of paper, thenthe administrator should look into upgrading the paper trays), and other job relatederrors.

¶ Percentage processor time

As with all processes, the print server utilizes the CPU. Monitoring the percentageprocessor time of the print server will help catch a potential bottleneck.

9


9.P

rinter

Reso

urce

Mo

del

Indications and EventsThe following table lists the events that can be generated by the Printer resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:


TMW_HighCurrentPercentTime High Current Percentage Time Warning 91

TMW_HighJobErrors High Job Errors Warning 92

TMW_HighJobErrorsPerDay High Job Errors Per Day Harmless 93

TMW_HighNotReadyErrors High Not Ready Errors Warning 94

TMW_HighNotReadyErrorsPerDay High Not Ready Errors Per Day Harmless 95

TMW_HighOutOfPaperErrors High Out Of Paper Errors Minor 94

TMW_HighOutOfPaperErrorsPerDay High Out Of Paper Errors PerDay

Harmless 97


90 Version 5.1.1

High Current Percent TimeThis indication is sent when a job uses a lot of CPU on the print server.


CurrentPercentTimeJobThe current percentage processor time being used by the print job

CurrentPercentTimeThe total current percentage usage of the CPU

JobObjectThe identity of the print job being examined (Key attribute)



Percent Processor(PercentProcessor)

This threshold indicates when a job has a percentageusage of the processor that is too high.

80


Setting Default



Occurrences 2

Holes 0



9.P

rinter

Reso

urce

Mo

del

High Job ErrorsThis indication is sent when there is a high amount of job errors per cycle. This is typical ofcorrupted or bad drivers installed on either the workstation sending the print job, or theserver in which the printer is installed.


JobErrorsThe total number of job errors

PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)



Job Errors (JobErrors) This threshold indicates the number of job errors percycle that can occur before determining that a printer orprint device is experiencing excessive problems.

0


Setting Default



Occurrences 1

Holes 0


92 Version 5.1.1

High Job Errors Per DayThis indication is sent when there is a high amount of job related errors per day. This istypical of corrupted or bad drivers installed on either the workstation sending the print job,or the server in which the printer is installed.


JobErrorsPerDayThe total number of job errors per day

TotalJobErrorsThe total number of job errors since the last reboot

SystemUpTimeDaysThe time, in days, that the system has been running




Job Errors Per Day(JobErrorsPerDay)

This threshold indicates the number of job errors perday that can occur before determining that a printer orprint device is experiencing excessive problems.

10


Setting Default



Occurrences 3

Holes 0



9.P

rinter

Reso

urce

Mo

del

High Not Ready ErrorsThis indication is sent when the printing device is either offline or experiencing a paper jam.


NotReadyErrorsThe total number of not ready errors




Not Ready Errors(NotReadyErrors)

This threshold indicates how many not ready errors canoccur per cycle before determining that a printer or printdevice is experiencing excessive problems.

8


Setting Default



Occurrences 1

Holes 0


94 Version 5.1.1

High Not Ready Errors Per DayThis indication is sent when the printing device is either off-line or experiencing a paperjam.


NotReadyErrorsPerDayThe total number of not ready errors, calculated per day

TotalNotReadyErrorsThe total number of not ready errors since the last reboot

SystemUpTimeDaysThe time that the system has been running, in days




Not Ready Errors Per Day(NotReadyErrorsPerDay)

This threshold indicates how many not ready errors canoccur per day before determining that a printer or printdevice is experiencing excessive problems.

8


Setting Default



Occurrences 2

Holes 0



9.P

rinter

Reso

urce

Mo

del

High Out Of Paper ErrorsThis indication is sent when the paper supply is insufficient for the job demand.


OOPErrorsThe total number of out-of-paper errors




Out Of Paper Errors(OutOfPaperErrors)

This is the maximum number of times per cycle, that aprint device can report an out-of-paper error beforedetermining that the print device is experiencing toomany out-of-paper errors in a cycle.

6


Setting Default



Occurrences 1

Holes 0


96 Version 5.1.1

High Out Of Paper Errors Per DayThis indication is sent when the paper supply is insufficient for the daily job demand.


OOPErrorsPerDayThe total number of out-of-paper errors, calculated per day

TotalOOPErrorsThe total number of out of paper errors since the last reboot

SystemUpTimeDaysThe time that the system has been running, in days




Out Of Paper Errors Per Day(OutOfPaperErrorsPerDay)

This threshold indicates the maximum number oftimes per day, that a print device can report an out ofpaper error before determining that the print device isexperiencing too many out of paper errors in a day.

6


Setting Default



Occurrences 3

Holes 0



9.P

rinter

Reso

urce

Mo

del

ThresholdsThe following table lists the thresholds that can be set for the Printer resource model. Foreach threshold it shows the name, a short description, and the default value:


Job Errors (JobErrors) This threshold indicates the number of job errors percycle that can occur before determining that a printeror print device is experiencing excessive problems.

0

Job Errors Per Day(JobErrorsPerDay)

This threshold indicates the number of job errors perday that can occur before determining that a printer orprint device is experiencing excessive problems.

10

Maximum Print Jobs(MostPrintJobs)

This threshold indicates the maximum number of printjobs that will be examined when looking forbottlenecks such as job errors per day, or a job’spercentage processor usage.

60

Maximum Print Queues(MostPrintQueues)

This threshold indicates the maximum number of printqueues (or in Microsoft terms, printers), that will beexamined when looking for bottlenecks such as notready errors and out of paper errors.

30

Not Ready Errors(NotReadyErrors)

This threshold indicates how many not ready errorscan occur per cycle before determining that a printeror print device is experiencing excessive problems.

0

Not Ready Errors Per Day(NotReadyErrorsPerDay)

This threshold indicates how many not ready errorscan occur per day before determining that a printer orprint device is experiencing excessive problems.

8

Out Of Paper Errors(OutOfPaperErrors)

This is the maximum number of times per cycle, thata print device can report an out-of-paper error beforedetermining that the print device is experiencing toomany out-of-paper errors in a cycle.

0

Out Of Paper Errors Per Day(OutOfPaperErrorsPerDay)

This threshold indicates the maximum number oftimes per day, that a print device can report an out ofpaper error before determining that the print device isexperiencing too many out of paper errors in a day.

6

Percent Processor(PercentProcessor)

This threshold indicates when a job has a percentageusage of the processor that is too high.

80

Thresholds

98 Version 5.1.1



PrintQueue ErrorsPrintQueue

The queue

JobErrorsThe number of jobs in error

NotReadyErrorsThe number of not ready errors

OutOfPaperErrorsThe out-of-paper errors

Logging


9.P

rinter

Reso

urce

Mo

del

Logging

100 Version 5.1.1

Process Resource Model

This chapter describes the Process resource model for Windows systems.



Internal name TMW_Process

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Process resource model looks for bottlenecks relating to the processes running on thesystem. The Process resource model highlights the following problems:

¶ Handle leaks

The resource model performs a check to make sure there are no processes with a handleleak. If handle leaks go unchecked, other processes may not be able to run later.

¶ High CPU usage

Processes that have high CPU usage threaten the overall performance of the systembecause the CPU will not have much chance to perform requests made by otherprocesses and devices.

10


10.P

rocess

Reso

urce

Mo

del

Indications and EventsThe following table lists the events that can be generated by the Process resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:


TMW_ProcessHandleLeak Process Handle Leak Warning 102

TMW_ProcessHighCPU Process High CPU Critical 103

Process Handle LeakThis indication is sent when a process leaks handles.


CurrentHanProcessIDThe process being monitored (Key attribute)

CurrentHandleCountThe current number of handles allocated to the process

ProcessThe process being monitored (Key attribute)

The top n processes (where n is the value of the Maximum Processes threshold) that have anumber of handles in excess of the Maximum Handles threshold, are compared with the topn processes from the previous cycle. Process IDs are matched and for each process presentin both cycles the number of handles in use is compared. If the handle count has increasedsince the last cycle for a process, an indication is sent. The following thresholds are used:


Maximum Processes(MaxProcesses)

This threshold indicates the maximum number ofprocesses that will be compared. These processes will beordered from the process with the highest handle countto the lowest.

5

Maximum Handles(MaxHandles)

This threshold indicates the number of handles that aprocess can use, above which the process will beconsidered as a candidate for the Process Handle Leakindication.

300


Setting Default



Occurrences 40

Holes 1


102 Version 5.1.1

Process High CPUThis indication is sent when a process is using too much CPU time.


IDProcessThe process being monitored (Key attribute)

PrcPercentUserTimeThe percentage usage of the CPU that is being used by the process

PrcPercentPrivilegedTimeThe percentage privileged time of the CPU that is being used by the process

PrcPriorityBaseThe base priority of the process

ProcessThe process being monitored (Key attribute)

An indication is sent for each of the top n processes (where n is the value of the MaximumProcesses threshold) that have a CPU usage in excess of the High CPU Usage threshold.The full details of the thresholds are as follows:


N/A The process ID is not equal to zero. N/A

High CPU Usage(HighCPUUse)

This threshold indicates when a process is using toomuch of the processor in terms of percentage usage.

60


This threshold indicates the maximum number ofprocesses that will be taken into consideration for thisindication. These processes will be ordered from theprocess with the highest CPU usage to the lowest.

5


Setting Default



Occurrences 20

Holes 3



10.P

rocess

Reso

urce

Mo

del

ThresholdsThe following table lists the thresholds that can be set for the Process resource model. Foreach threshold it shows the name, a short description, and the default value:


High CPU Usage(HighCPUUse)

This threshold indicates when a process is using toomuch of the processors in terms of percentage usage.

60


For the Process Handle Leak indication, this thresholdindicates the maximum number of processes that will becompared. These processes will be ordered from theprocess with the highest handle count to the lowest. Forthe Process High CPU indication, this thresholdindicates the maximum number of processes that will betaken into consideration for this indication. Theseprocesses will be ordered from the process with thehighest CPU usage to the lowest.

5

Maximum Handles(MaxHandles)

This threshold indicates the number of handles that aprocess can use, above which the process will beconsidered as a candidate for the Process Handle Leakindication.

300



Process Handle UsageProcess The name of the process

HandleCountThe number of handles allocated to the process

PercentProcessorTimeThe percent of processor time used by the process

ID The process

CPU UsageProcess The name of the process

PercentUserTimeThe percentage usage of the CPU that is being usedby the process

PercentPrivilegedTimeThe percentage privileged time of the CPU that isbeing used by the process

ID The process

Thresholds

104 Version 5.1.1

Processor Resource Model

This chapter describes the Processor resource model for Windows systems.



Internal name TMW_Processor

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Processor resource model detects bottlenecks happening within or from the CentralProcessing Unit (CPU). The Processor resource model highlights the following problems:

¶ High CPU usage

Because every process and every device on the system has to interact with the CPU,either directly or through a controller, it is imperative that the CPU is not beingextensively used by a single process or device for an extended period of time. Theremay be exceptions to this rule for certain application-based servers.

The system administrator needs ultimately to decide how much utilization one processmakes of the CPU for these situations. Tests to determine how busy a CPU are includechecking the percentage usage, the percentage interrupts, and the queue length.

¶ Multiple CPU problems

With systems running with more than one processor, it is not always obvious that a CPUmay not be working. A check is made to ensure that all CPUs are being utilized atapproximately the same rate.

If there are problems with a CPU, the CPU activity will either be abnormally high ortotally inactive, in either case this check will detect the CPU that is faulty.

11


11.P

rocesso

rR

esou

rceM

od

el

Indications and EventsThe following table lists the events that can be generated by the Processor resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


TMW_BusyHardware Busy Hardware Warning 107

TMW_CPUCantKeepUpWithHW CPU Cannot Keep up with Hardware Critical 108

TMW_HWKeepingCPUBusy Hardware Keeping CPU Busy Warning 109

TMW_HighPercentUsageDelta High Percent Usage Delta Minor 110

TMW_HighProcesses High Processes Critical 111

TMW_ProcessorBusy Processor Busy Critical 112


106 Version 5.1.1

Busy HardwareThis indication is sent when one or more devices installed on the system are tying up theCPU.


PercentProcessorTimeThe total current percentage usage of the CPU

PercentInterruptTimeThe current percentage usage of the CPU as it handles interrupt requests

InterruptsSecThe number of interrupts per second that are passed to the CPU

ProcessorThe processor being monitored (Key attribute)



High CPU Usage(HighCPUUsage)

This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected to sustainthat rate for an extended amount of time.

80

High CPU Usage Interrupt(HighCPUUsageInterrupt)

This threshold indicates when a high percent of theCPU is being used for interrupt requests, generallymade by hardware devices.

20

High Interrupts per Second(HighInterruptsSec)

This threshold indicates the maximum rate at which thedevices installed on the system are accessing the CPU(interrupts per second)

600


Setting Default



Occurrences 15

Holes 3



11.P

rocesso

rR

esou

rceM

od

el

CPU Cannot Keep up with HardwareThis indication is sent when the CPU can not keep up with hardware requests.









This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected tosustain that rate for an extended amount of time.

80



20



Total CPUs Modifier(TotalCPUsMod)

This threshold is a modifier that is added to the totalnumber of CPUs in the system. The result is thethreshold that determines when the queue for thesystems processors is too long.

10


Setting Default



Occurrences 15

Holes 3


108 Version 5.1.1

Hardware Keeping CPU BusyThis indication is sent when the queue length is normal but CPU usage is high and a highpercent of the CPU is being used for interrupt requests. This keeps the CPU busy.










80



20



N/A The queue length must be normal. N/A




Setting Default



Occurrences 15

Holes 3



11.P

rocesso

rR

esou

rceM

od

el

High Percent Usage DeltaThis indication is sent when there is a high percentage of usage between multiple processorsinstalled on a system.


PercentUsageFirstIdentifies what percent of the most used processor is being used

PercentUsageLastIdentifies what percent of the least used processor is being used

ProcessPercentProcessorTimeThe percentage processor time of the process with the highest percentage processortime

IDProcessThe process with the highest percentage processor time


LowProcessorThe least used processor

ProcessThe name of the process with the highest percentage process time



High Percent Usage Delta(HighPercentUsageDelta)

This threshold indicates the difference in percentageusage between the highest used CPU and the lowestused CPU.

5


Setting Default



Occurrences 10

Holes 3


110 Version 5.1.1

High ProcessesThis indication is sent when one or more processes have a CPU usage above the High CPUUsage Process threshold.


HighProcessesThe total number of high usage processes

IDProcessThe process with the highest CPU usage

PercentProcessorTimeThe total percentage usage of the CPU

ProcessThe name of the process with the highest CPU usage that is active on the CPU






80



20

High CPU Usage Process(HighCPUUsageProcess)

This threshold indicates the maximum percent of CPUusage for a single process allowed.

40


Setting Default



Occurrences 10

Holes 2



11.P

rocesso

rR

esou

rceM

od

el

Processor BusyThis indication is sent when CPU usage is high, but there do not seem to be any particularprocess or hardware requests.




PercentUserTimeThe percentage user time of the CPU

PercentPrivilegedTimeThe percentage privileged time of the CPU





This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected to sustainthat rate for an extended amount of time.

80




Setting Default



Occurrences 20

Holes 1


112 Version 5.1.1

ThresholdsThe following table lists the thresholds that can be set for the Processor resource model. Foreach threshold it shows the name, a short description, and the default value:



This threshold indicates when a high percent ofthe CPU is being used. CPUs are expected toreach 100% marks quite often, but generally notexpected to sustain that rate for an extendedamount of time.

80


This threshold indicates when a high percent ofthe CPU is being used for interrupt requests,generally made by hardware devices.

20


This threshold indicates the maximum percent ofCPU usage for a single process allowed.

40

High CPU Usage User Privilege(HighCPUUsageUserPriv)

This threshold indicates the maximum percent ofCPU usage by all the processes running. Thisvalue is obtained by adding the percent user timeand the percent privileged time

70


This threshold indicates the maximum rate atwhich the devices installed on the system areaccessing the CPU (interrupts per second)

600

High Percent Usage Delta(HighPercentUsageDelta)

This threshold indicates the difference inpercentage usage between the highest used CPUand the lowest used CPU.

5


This threshold is a modifier that is added to thetotal number of CPUs in the system. The result isthe threshold that determines when the queue forthe systems processors is too long.The processorqueue length is the instantaneous length of theprocessor queue in units of threads. All processorsuse a single queue in which threads wait forprocessor cycles. This length does not include thethreads that are currently running.

10

Thresholds


11.P

rocesso

rR

esou

rceM

od

el



Processor Load BalanceDelta The percentage difference of usage between the

highest used processor and the least used

HighestPercentUsageIdentifies what percent of the most used processor isbeing used

LowestPercentUsageIdentifies what percent of the least used processor isbeing used

Interrupt TimeProcessor

The processor being monitored

InterruptsSecThe number of interrupts per second that are passedto the CPU

CPU UsageProcessor


PercentInterruptTimeThe current percentage usage of the CPU as ithandles interrupt requests


PercentPrivilegedTimeThe percentage privileged time of the CPU

PercentUserTimeThe percentage user time of the CPU

System Processor Queue LengthProcessor


ProcessorQueueLengthThe queue length of the processor

Logging

114 Version 5.1.1

Server Performance Prediction ResourceModel

This chapter describes the Server Performance Prediction resource model for Windowssystems.



Internal name TMW_Spp

Category Windows

Thresholds No

Parameters Yes

Built-in actions No

Clearing events No


Overview


The Server Performance Prediction resource model gathers data from Windows systems forthe Tivoli Decision Support Guide for Server Performance Prediction (Advanced Edition).This resource model does not have thresholds, indications or events.

PrerequisitesTo run this resource model the following prerequisites apply:

1. The logical and physical disk counters must be enabled (diskperf -y). A reboot isnecessary after the enablement.

2. The Network Monitor Agent must be installed prior to TCP/IP and the Network Interfaceperformance object must be available from the performance monitor.

3. The TCP/IP must be installed.

4. The SNMP must be installed.

12


|

|

||

||

|

|

12.S

erverP

erform

ance

Pred

iction

ParametersThe following table lists the parameters that can be set for the Server PerformancePrediction resource model.


Physical Disk Configuration(PhysicalDiskConf)

The instance for which you want the diskI/O and disk transfer rates calculated.

Values: 0-3.

Choice list

Network Interface Configuration(NetworkInterfacesConf)

The network interface for which you wantthe network interface values calculated.

Values: 1-4.

Choice list

Available Disk Space Configuration(DiskSpaceAvailableConf)

The instance for which you want theavailable disk space calculated.

Values: System Drive, All, C:, D:, E:, A:, allother drives.

Choice list



LogicalDisk SPP Guide for NTLogicalDisk

The logical disk being monitored

FreeMB The free megabytes on the disk

Memory SPP Guide for NTMemory The memory being monitored

PageInputSecThe number of page inputs per second

PageOutputSecThe number of page outputs per second

Avail The available memory

NetworkInterface SPP Guide for NTPacketsOutboundErrors

The number of errors sending outbound packets

PacketsReceivedErrorsThe number of errors for packets being received

PacketsSentSecThe number of packets sent per second

PacketsReceivedSecThe number of packets received per second

NetworkInterfaceThe network interface card

Objects SPP Guide for NTObjects The objects being monitored

NumberOfProcessesThe number of processes running

Parameters

116 Version 5.1.1


PhysicalDisk SPP Guide for NTPhysicalDisk

The physical disk being monitored

DiskBytesSecThe disk bytes per second being written or read

DiskXfersSecThe rate of bytes read or written per second on thephysical disk

System SPP Guide for NTSystem The name of the system being monitored

ProcessorQueueLengthThe length of the processor queue

PrcTotPrivTimeThe percentage privileged time of the CPU that isbeing used

PrcTotUserTimeThe percentage of total user time

PrcTotCpuTimeThe percentage of total CPU time

Logging


12.S

erverP

erform

ance

Pred

iction

Logging

118 Version 5.1.1

Services Resource Model

This chapter describes the Services resource model for Windows systems.



Internal name TMW_Services

Category Windows

Thresholds Yes

Parameters No


Clearing events Yes


Overview


The Services resource model checks all installed services to make sure they are functioningcorrectly and that key services are running. It highlights the following problems:

¶ Key services

Some services are vital to the operation of Windows. The resource model checks thatkey services are not stopped to ensure proper functioning of the system.

¶ Unstable services

Services, like any other installed software, can become corrupted or unstable. Theresource model checks that all installed services are stable. Unstable services must bestopped to ensure they do not harm other functions of the system.

13


13.S

ervicesR

esou

rceM

od

el

Indications and EventsThe following table lists the events that can be generated by the Services resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


TMW_ServicesFailingService Services Failing Service Critical 120

TMW_ServicesStoppedService Services Stopped Service Critical 121

Services Failing ServiceThis indication is sent when any service is not stable. Services that are not stable can causeproblems for the local machine and for connected machines over the network and should bestopped.


NameThe name of the service being examined (Key attribute)


State The current state of the service


Because the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded.


Setting Default



Occurrences 1

Holes 0


120 Version 5.1.1

Services Stopped ServiceThis indication is sent when one of the key services is stopped. If a key service is stopped,it must be restarted to ensure Windows is working properly.


Name The name of the service being examined (Key attribute)



Because the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded.


Setting Default



Occurrences 2

Holes 0



13.S

ervicesR

esou

rceM

od

el

ThresholdsBecause the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded. However, in thismodel, the threshold values act as numerical flags where 0 is false and any other number istrue. With this, the user can determine which services they want to monitor.

For example, in the threshold section, LanmanServer (Server service) is set to 1 meaning theresource model checks if the Server service is running. System Administrators may decidethat on certain systems the Server service does not need to run. On those systems they canchange the profile to set the Server threshold value to 0 and the resource model does notcheck if the Server service is running.

The following table lists the thresholds that can be set for the Services resource model. Foreach threshold it shows the name, a short description, and the default value:


Browser (Browser) This threshold determines the smooth running of thebrowser service. If the browser threshold is set to 0, thebrowser service is not checked to ensure it has started.Use the browser service to create the list of computersand networks in the network neighborhood. It is alsoneeded so that the local machine is present on othernetwork neighborhoods throughout the local network.

1

EventLog (EventLog) This threshold determines whether the EventLog serviceis running correctly. If this threshold is set to 0, theEventLog service is not checked to ensure it has started.This service logs errors and information regarding thelocal machine. Important data can be found in the eventlog when an administrator is trying to correct amalfunctioning component of Windows.

1

LanmanServer(LanmanServer)

This threshold determines whether the LanmanServerservice is running correctly. This threshold is set to 0,the LanmanServer service is not checked to ensure it hasstarted. Better known as the Server service, this serviceis used to manage shares that are accessible to otherworkstations on the network. Without this service, nomachine can connect to the local machine.

1

LanmanWorkstation(LanmanWorkstation)

This threshold determines whether theLanmanWorkstation service is running correctly. Thisthreshold is set to 0, the LanmanWorkstation service cannot be checked to ensure it has started. This service isthe workstation service; it is the counterpart of theserver service. If it is not running, the local machine cannot connect to other machines on the network.

1

Tivoli endpoint (lcfd) This threshold determines whether the Tivoli endpointservice, which provides the endpoint with connectivityto the Tivoli Management Environment, is runningcorrectly. If the Tivoli endpoint threshold is set to 0, theTivoli endpoint service will not be checked to ensurethat it has started.

1

Thresholds

122 Version 5.1.1


Netlogon (Netlogon) This threshold determines whether this service isrunning correctly. If the Netlogon threshold is set to 0,the Netlogon service is not checked to ensure it hasstarted. Use the Netlogon service when logging onto thelocal workstation as well as processing logon attemptsfrom remote machines. If the Net Logon service is notfunctioning properly, it is possible that nobody can logon to the system.

1

NtLmSsp (NtLmSsp) This threshold determines whether this service isrunning correctly. If the NtLmSsp threshold is set to 0,the NtLmSsp service is not checked to ensure it hasstarted. The NtLmSsp is the Windows LM SecuritySupport Provider. It provides Windows security toremote procedure call (RPC) programs that usetransports other than named pipes. This service does nothave to be running at all times, but if it is, this does notcause any problems.

1

Built-in ActionsThis resource model has the following built-in action:

Restart ServiceIf a key service is in a stopped or paused state, this action restarts the service. Thesystem administrator is also notified.

Thresholds


13.S

ervicesR

esou

rceM

od

el

Built-in Actions

124 Version 5.1.1

TCP/IP Resource Model

This chapter describes the TCP/IP resource model for Windows systems.



Internal name TMW_TCPIP

Category Windows

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The TCP/IP resource model looks for bottlenecks found within the TCP/IP protocol. Ithighlights the following problems:

¶ Fragmented data

Fragmented datagrams are datagrams sent through the network that are incomplete.Fragments have to wait at their destination point to be reassembled.

When datagrams have to be reassembled, it requires CPU time that could otherwise beput to use servicing current processes or interrupt request. Therefore, excessivefragmented datagrams need to be minimized whenever possible.

¶ Network congestion

Congestion can be a big problem on any type of network. One way of diagnosingcongestion is to look for retransmitted TCP segments and high ping rates.

PrerequisitesThe TCP/IP resource model requires TCP/IP and SNMP to be installed.

14


14.T

CP

/IPR

esou

rceM

od

el

Indications and EventsThe following table lists the events that can be generated by the resource model, the nameof the indication from which each event is generated, the default severity of the event, andwhere you can find a detailed description of the indication:


TMW_HighFragRatio High Fragment Ratio Warning 127

TMW_HighPing High Ping Warning 128

TMW_SegmentsReXmit Segments ReXmit Warning 129


126 Version 5.1.1

High Fragment RatioThis indication is sent when the ratio between fragmented datagrams received to totaldatagrams received is greater than the High Fragment Ratio threshold. This ratio rises themore the local network becomes congested, particularly with IP.

This particular indication is more of an informative indication, as it is usually a result ofsome other bottleneck. Indications coming from the Network Interface Card resource modelcan help determine the cause.


FragsToDGRatioThe ratio of fragmented datagrams to total datagrams

DGReceivedSecThe number of datagrams received per second

DGSentSecThe number of datagrams being sent per second

DGSecThe number of datagrams transmitted per second

FragReceivedSecThe number of fragmented datagrams received per second

FragReassembledSecThe number of fragmented datagrams reassembled per second



High Fragment Ratio(HighFragRatio)

This threshold indicates a ratio between fragmenteddatagrams and datagrams received whole. It is used todetermine when this value becomes too high.

80


Setting Default



Occurrences 6

Holes 1



14.T

CP

/IPR

esou

rceM

od

el

High PingThis indication is sent when a high amount of datagrams is being received compared to thenumber of segments, which is common when a system is being pinged excessively.



SegmentsRcvdSecThe number of segments received per second

DGSentSecThe number of datagrams being sent per second

SegmentsSentSecThe number of segments being sent per second


SegmentsSecThe number of segments transmitted per second



Low Segments(LowSegments)

This threshold indicates the minimum TCP segments persecond. This threshold, used with the Moderate DGthreshold, determines whether a system is receiving ahigh number of pings.

10

Moderate DG(ModerateDG)

This threshold indicates when the rate of datagrams persecond are moderate. This should not be treated as athreshold indicating a high amount of datagrams, but asone that indicates an above normal threshold.

60


Setting Default



Occurrences 6

Holes 1


128 Version 5.1.1

Segments ReXmitThis indication is sent when TCP segments have to be resent. This indicates congestion onthe network with the TCP protocol. Indications from the Network Interface resource modelcan lend more insight.


SegmentsReXmitSecThe number of segments retransmitted per second


SegmentsSentSecThe number of segments being sent per second

FragsToDGRatioRatio of fragmented datagrams to total datagrams



High Segment Retransmitted(HighSegmenReXmit)

This threshold indicates the maximum TCP segmentsbeing retransmitted.

1


Setting Default



Occurrences 6

Holes 1



14.T

CP

/IPR

esou

rceM

od

el

ThresholdsThe following table lists the thresholds that can be set for the TCP/IP resource model. Foreach threshold it shows the name, a short description, and the default value:


High Fragment Ratio(HighFragRatio)

This threshold indicates a ratio between fragmenteddatagrams and datagrams received whole. It is usedto determine when this value becomes too high.

80

High Segment Retransmitted(HighSegmenReXmit)

This threshold indicates the maximum TCP segmentsbeing retransmitted.

1

Low Segments(LowSegments)

This threshold indicates the minimum TCP segmentsper second. This threshold, used with the ModerateDG threshold, determines whether a system isreceiving a high number of pings.

10

Moderate DG (ModerateDG) This threshold indicates when the rate of datagramsper second are moderate. This should not be treatedas a threshold indicating a high amount of datagrams,but as one that indicates an above normal threshold.

60



TCPIP Segments RetransmittedTCP The protocol

SegmentsRetrasmittedThe number of segments retransmitted

Segments TrafficTCP Identifies the protocol

SegmentSentSecThe number of segments sent per second

SegmentsSecThe number of segments per second

SegmentRcvdSecThe number of segments received per second

IP Datagrams TrafficIP Identifies the protocol

DGSentSecThe number of datagrams sent per second

DGSec The number of datagrams per second


Fragments ReceivedIP Identifies the protocol

FragmentsReceivedSecThe number of fragments received per second

Thresholds

130 Version 5.1.1

Part II. Resource Models forUNIX/LinuxChapter 15. CPU Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135


High CPU Overload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

High CPU Usage by System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138


Chapter 16. File Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141


File Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

File Attributes Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

File not Present . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145


Chapter 17. File System Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147


Low Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Low Percent Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Fragmented File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Low Percentage of Available I-nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152


Chapter 18. Memory Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153


Low Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154


||

||

||

||

||

Low Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

System Thrashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157


Chapter 19. Network Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 159Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159


High Input Packets in Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

High Output Packets in Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

High Percentage Packet Collisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Interface Not Enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Interface Not Operational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

Unknown Interface Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166


Chapter 20. Network RPC-NFS Resource Model . . . . . . . . . . . . . . . . . . . . . . . . 169Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169


High NFS Buffer Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

High NFS Server Get-attribute Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

High NFS Server Read Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

High NFS Server Readlink Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

High NFS Server Write Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

High Duplicate RPC Server Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

High Retransmitted Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

High RPC Bad Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

High Timeouts and Badxids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

High Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Slow Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182



132 Version 5.1.1

||

||

High Number of Zombie Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Process Consuming High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Process Killed or Nonexistent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Process Stopped . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188


Chapter 22. Security Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191


Duplicate Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Nonexistent File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

High Log-in Number for User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Illegal Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Illegal Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Account not Valid for Root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Null Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Suspect Supergroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Suspect Superuser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Wrong File Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198


Chapter 23. Server Performance Prediction Resource Model . . . . . . . . . . 201Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202


||

||

134 Version 5.1.1

CPU Resource Model

This chapter describes the CPU resource model for UNIX/Linux systems.



Internal name DMXCpu

Category UNIX/Linux

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview

Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.

This resource model detects problems with the central processing unit (CPU) of a computer,for example, how long processes wait in the queue to be processed.

Indications and EventsThe following table lists the events that can be generated by the CPU resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:


Low_IdleCPUUsage High CPU Overload Warning 136

High_SysCPUUsage High CPU Usage by System Warning 137

15


15.C

PU

Reso

urce

Mo

del

High CPU OverloadThis indication is sent if a low percentage of CPU is idle.


percidlecpuThe percent of CPU that is idle

name Identifies the single instance (Key attribute)



Percentage of CPU in Idle(IdleCPUTimeThr)

This threshold indicates the minimum percentage ofCPU that should be idle to maintain satisfactory systemperformance.

20


Setting Default



Occurrences 4

Holes 1


136 Version 5.1.1

High CPU Usage by SystemThis indication is sent when a high percentage of CPU is used for system requests.


percsyscpuusageThe percent of CPU time spent on system requests




Percentage of CPU Used by System(SysCPUTimeThr)

This threshold measures the percentage ofCPU required for service system requests.

80


Setting Default



Occurrences 4

Holes 1



15.C

PU

Reso

urce

Mo

del

ThresholdsThe following table lists the thresholds that can be set for the CPU resource model. For eachthreshold it shows the name, a short description, and the default value:


Percentage of CPU in Idle(IdleCPUTimeThr)

This threshold indicates the minimumpercentage of CPU that should be idle tomaintain satisfactory system performance.

20

Percentage of CPU Used by System(SysCPUTimeThr)

This threshold measures the percentage ofCPU required for service system requests.

80



CPU Percent usagename Identifies the single instance

prcIdleTimeThe percent of the time that the CPU is idle.

prSysTimeThe percent of the time that the CPU in systemmode.

prcUserTimeThe percent of the time that the CPU is in usermode.

CPU Average Loadingname Identifies the single instance

loadAvg1The number of processes running every minute

loadAvg5The number of processes running every 5 minutes

loadAvg15The number of processes running every 15 minutes

Description of the .mof File PropertiesThis section lists all properties used by the DMXCpu.mof file for the CPU resource model.This .mof file uses one CIM class: DMXCpu.

Property Type Description

idleTime NUMERIC The percent of the time that the CPU is idle

userTime NUMERIC The percent of the time that the CPU is in usermode.

sysTime NUMERIC The percent of the time that the CPU is insystem mode.

loadAvg1 NUMERIC The number of processes running every minute.

Thresholds

138 Version 5.1.1

|

||

||||

|||

||||

||||

|||


loadAvg5 NUMERIC The number of processes running every 5minutes.

loadAvg15 NUMERIC The number of processes running every 15minutes.

Description of the .mof File Properties


|||

||||

||||

15.C

PU

Reso

urce

Mo

del


140 Version 5.1.1

File Resource Model

This chapter describes the File resource model for UNIX/Linux systems.



Internal name DMXFile

Category UNIX/Linux

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The File resource model gives information about files in the system.

Indications and EventsThe following table lists the events that can be generated by the File resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:


FileChanged File Changed Warning 142

FilesAttributeChange File Attributes Changed Warning 143

FileNotPresent File not Present Warning 144

16


16.F

ileR

esou

rceM

od

el

File ChangedThis indication is sent when the file checksum or the file modification time changes.


pathnameThe path name of the file being monitored (Key attribute)


Setting Default



Occurrences 1

Holes 0


142 Version 5.1.1

File Attributes ChangedThis indication is sent when the date and time of last updates to file are different from theprevious cycle.




Setting Default



Occurrences 1

Holes 0



16.F

ileR

esou

rceM

od

el

File not PresentThis indication is sent when the user tries to monitor a file that does not exist on themachine, for example, because it was deleted.




Setting Default



Occurrences 1

Holes 0


144 Version 5.1.1

ParametersThe following table lists the parameters that can be set for the File resource model.

Parameter Description ParameterType

Files to Be Checked(FileList)

The files that you want to monitor. Enter the file details,separated by the pipe character, in the field to the left ofthe Add button in the following format:

path_filename

String list



File File Timespathname

The file path

modificationTimeThe time when the contents of file change

changeTimeThe time when the file attributes change

File ChecksumfileName The filename

size The filesize

checksumThe checksum that changes

Description of the .mof File PropertiesThis section lists all properties used by the DMXFile.mof file for the File resource model.This .mof file uses one CIM class: DMXFile.


pathName STRING The file path name.

size NUMERIC The file size (in bytes).

accessTime NUMERIC The time when the file is accessed (number ofseconds since the standard UNIX Epoch,00:00:00 January 1, 1970 UTC).

modificationTime NUMERIC The time when the contents of the file change(number of seconds since the standard UNIXEpoch, 00:00:00 January 1, 1970 UTC).

changeTime NUMERIC The time when the file atrributes change (numberof seconds since the standard UNIX Epoch,00:00:00 January 1, 1970 UTC).

crc32 NUMERIC The 32-bit cycle redundance code.

Parameters


|

||

||||

|||

|||

|||||

|||||

|||||

|||

16.F

ileR

esou

rceM

od

el


146 Version 5.1.1

File System Resource Model

This chapter describes the File System resource model for UNIX/Linux systems.



Internal name DMXFileSystem

Category UNIX/Linux

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model measures how efficiently the file systems are being used.

Indications and EventsThe following table lists the events that can be generated by the File System resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


LowKAvail Low Space Available Critical 148

LowPercSpcAvail Low Percent Space Available Critical 148

FragmentedFileSystem Fragmented File System Minor 149

LowPercInodesAvail Low Percentage of AvailableI-nodes

Warning 150

17


17.F

ileS

ystemR

esou

rceM

od

el

Low Space AvailableThis indication is sent when the available number of kilobytes on the specified file systemgoes below the threshold.


n_availThe number of kilobytes available on the specified disk drive.

mountnameThe mount point on which the file system is mounted. (Key attribute)



Available Space (KB)(AvailableSpace)

This threshold indicates the minimum amount ofavailable space (KB) that is required on the file system.

7000


Setting Default



Occurrences 4

Holes 1

Low Percent Space AvailableThis indication is sent when the percent space available to the specified file system goesbelow the threshold.


PercSpcAvailThe percent space available.

mountnameThe mount point on which the file system is mounted. (Key attribute)



Percent Available Space(KB) (PrcAvailKspace)

This threshold indicates the minimum percentage of filesystem space that is being available.

15


Setting Default



Occurrences 4

Holes 1


148 Version 5.1.1

|

||

|

||

||

|

||||

|||||

|

|

|||

||

||

||

||

Fragmented File SystemThis indication is sent when the number of used i-nodes is high but the used file systemspace is relatively low.


percinodeusedThe percentage of used i-nodes in the file system

perckbusedThe percentage of space being used by the file system

mountnameThe mount point on which the file system is mounted (Key attribute)



Percentage of File System SpaceUsed (PrcUsedKspace)

This threshold indicates the maximumpercentage of file system space that is beingused.

85

Percentage of I-nodes Used(PrcUsedInodes)

This threshold indicates the maximumpercentage of file system space that can bededicated to i-nodes without causing highfragmentation of the file system.

80


Setting Default



Occurrences 4

Holes 1



17.F

ileS

ystemR

esou

rceM

od

el

Low Percentage of Available I-nodesThis indication is sent when the percentage of available i-nodes is below the threshold.


percavailinodesThe percentage of available i-nodes

mountnameThe mount point on which the file system is mounted (Key attribute)



Percentage of Available I-nodes(PrcAvailInodes)

This threshold indicates the minimum percentageof file system space available for i-nodes.

20


Setting Default



Occurrences 4

Holes 1


150 Version 5.1.1

ThresholdsThe following table lists the thresholds that can be set for the File System resource model.For each threshold it shows the name, a short description, and the default value:


Available Space (KB) (AvailableSpace) This threshold indicates the minimumamount of available space (KB) that isrequired on the file system.

7000

Percent Available Space (KB)(PrcAvailKspace)

This threshold indicates the minimumpercentage of file system space that is beingavailable.

15

Percentage of Available I-nodes(PrcAvailInodes)

This threshold indicates the minimumpercentage of file system space availablefor i-nodes.

20

Percentage of File System Space Used(PrcUsedKspace)

This threshold indicates the maximumpercentage of file system space that must beavailable.

80

Percentage of I-nodes Used(PrcUsedInodes)

This threshold indicates the maximumpercentage of file system space that can bededicated to i-nodes without causing highfragmentation of the file system.

80

ParametersThe following table lists the parameters that can be set for the File System resource model.


Ignored File Systems(IgnoredFileSystems)

The file systems that you want to ignore. Insert here thelist of the file systems that you want ignore. Correctsintax is:<File Systems>

String list

File Systems To MonitorWith Different Thresholds(FileSystemsToMonitorDiffThres)

Insert here the File Systems’ names that you wantmonitor with different thresholds by default. The correctsintax is:

<FS name> | a | b | c | d | e Where:

¶ a is: Percent of I-nodes used

¶ b is: Percent of FS used space

¶ c is: Avalaible space (in Kbytes)

¶ d is: Percent of available I-nodes

¶ e is: Percent of FS available space

The ″–″ character can be used to set a threshold to thedefault value.

An error code ″11″ is returned if the syntax is incorrect.

String List

Thresholds


|||||

|

|

|

|||||

|||||

|

||||

|||

|

|

|

|

|

|

||

|

|

17.F

ileS

ystemR

esou

rceM

od

el



File System File System Availabilitymountpoint

The mount point on which the file system ismounted.

percUsedThe percent of file system space that is being used

percInodesUsedThe percent of i-nodes being used

percAvailThe percent of file system space available

Description of the .mof File PropertiesThis section lists all properties used by the DMXFileSystem.mof file for the File Systemresource model. This .mof file uses one CIM class: DMXFileSystem.


mountPoint STRING The mount point of the file system.

totalKBytes NUMERIC The total file system space (in kilobytes).

usedKBytes NUMERIC The file system space that is being used (inkilobytes).

availKBytes NUMERIC The file system space that is available (inkilobytes).

totalInodeNumber NUMERIC The total of i-nodes.

usedInodeNumber NUMERIC The i-nodes being used.

availInodeNumber NUMERIC The available i-nodes.

Logging

152 Version 5.1.1

||

|

||

||||

|||

|||

||||

||||

|||

|||

|||

Memory Resource Model

This chapter describes the Memory resource model for UNIX/Linux systems.



Internal name DMXMemory

Category UNIX-Linux

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model provides information about how the memory is used.

Indications and EventsThe following table lists the events that can be generated by the Memory resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


LowStorage Low Storage Space Critical 154

LowSwap Low Swap Space Critical 155

Thrashing System Thrashing Critical 156

18


18.M

emo

ryR

esou

rceM

od

el

Low Storage SpaceThis indication is sent when the percentage of available storage space in the system is lowerthan the threshold.


percavailstorageThe percentage of available storage space

totavailstorageThe available storage space in kilobytes




Percentage of Available Virtual Storage(AvailVirtualStorage)

This threshold measures the percentageof total virtual storage that is available.

40


Setting Default



Occurrences 20

Holes 0


154 Version 5.1.1

Low Swap SpaceThis indication is sent when the percentage of swap space available on the system goesbelow the threshold.


percavailswapThe percentage of available swap space

totavailswapThe available swap space in kilobytes




Percentage of Available Swap Space(SwapSpacePrc)

This threshold indicates the minimumpercentage of all swap space that must beavailable.

30


Setting Default



Occurrences 4

Holes 0



18.M

emo

ryR

esou

rceM

od

el

System ThrashingThis indication is sent when there is excessive or unusual system paging, for example, whenthe page-in or page-out rate exceeds the threshold.


pageins The rate of paging in

pageouts The rate of paging out




Memory Page-in Rate(PageInRate)

This threshold indicates the maximum occurrences ofpaging in per second, as averaged over the cycle.

400

Memory Page-out Rate(PageOutRate)

This threshold indicates the maximum occurrences ofpaging out per second, as averaged over the cycle.

400


Setting Default



Occurrences 6

Holes 0


156 Version 5.1.1

ThresholdsThe following table lists the thresholds that can be set for the Memory resource model. Foreach threshold it shows the name, a short description, and the default value:


Memory Page-in Rate (PageInRate) This threshold indicates the maximumoccurrences of paging in per second, asaveraged over the cycle.

400

Memory Page-out Rate (PageOutRate) This threshold indicates the maximumoccurrences of paging out per second, asaveraged over the cycle.

400

Percentage of Available Swap Space(SwapSpacePrc)

This threshold indicates the minimumpercentage of all swap space that must beavailable.

30

Percentage of Available Virtual Storage(AvailVirtualStorage)

This threshold measures the percentage oftotal virtual storage that is available.

40



Memory Memory Pagingname Identifies the single instance

pageInsRateThe rate of paging in for the cycle

pageOutsRateThe rate of paging out for the cycle

Memory Memory Availabilityname Identifies the single instance

PrcAvailSwapThe percent of swap space that is available

PrcAvailStorageThe percentage of storage space that is available

Description of the .mof File PropertiesThis section lists all properties used by the DMXMemory.mof file for the Memory resourcemodel. This .mof file uses one CIM class: DMXMemory.


totalSwapSpace NUMERIC The total swap space (in kilobytes)

usedSwapSpace NUMERIC The used swap space (in kilobytes)

availSwapSpace NUMERIC The available swap space (in kilobytes)

pageInsRate NUMERIC Paging in per second (pages/sec)

pageOutsRate NUMERIC Paging out per second (pages/sec)

Thresholds


|

||

||||

|||

|||

|||

|||

|||

18.M

emo

ryR

esou

rceM

od

el


totalVirtualStorage NUMERIC The total virtual storage (in kilobytes)

usedVirtualStorage NUMERIC The used virtual storage (in kilobytes)

availVirtualStorage NUMERIC The available virtual storage (in kilobytes)


158 Version 5.1.1

|||

|||

|||

|||

Network Interface Resource Model

This chapter describes the Network Interface resource model for UNIX/Linux systems.



Internal name DMXNetworkInterface

Category UNIX/Linux

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Network Interface resource model detects problems with the following installed networkinterfaces

¶ Loopback

¶ Ethernet

¶ Token-Ring

Events are generated when performance data, such as bytes per second in and out andsessions with errors or requests, become critical.

Note: To run this resource model on AIX and HP endpoints, the SNMP deamon must beactive.


19


19.N

etwo

rkIn

terfaceR

esou

rceM

od

el


HighInputErrPacks High Input Packets in Error Warning 160

HighOutErrorPacks High Output Packets in Error Warning 161

HighPacktsCollision High Percentage Packet Collisions Critical 162

InterfaceNotEnabled Interface Not Enabled Warning 163

InterfaceNotOperat Interface Not Operational Warning 164

IntStatUnknown Unknown Interface Status Critical 165

High Input Packets in ErrorThis indication is sent when a high percentage of input packets are going into error.


totinpacksThe total input packets

percinerrpacksThe percentage of input packets that are going into error

interfacenameThe network interface (Key attribute)

interfacetypeThe network interface type



Input Packets in Error(PercInPacketErrThr)

This threshold indicates the maximum percentage ofinput packets in error allowed.

20


Setting Default



Occurrences 3

Holes 0


160 Version 5.1.1

High Output Packets in ErrorThis indication is sent when a high percentage of output packets are going into error.


totoutpacksThe total output packets

percouterrpacksThe percentage of output packets that are going into error

interfacenameThe network interface (Key attribute)

interfacetypeThe network interface type



Output Packets in Error(PercOutPacketErrThr)

This threshold indicates the maximum percentage ofoutput packets in error allowed.

10


Setting Default



Occurrences 3

Holes 0



19.N

etwo

rkIn

terfaceR

esou

rceM

od

el

High Percentage Packet CollisionsThis indication is sent when a high percentage of output packets are colliding. This indicatesthat the packets being sent might be corrupted or that there might be a network overload.


totoutpacksThe total output packets

percPacktsCollisionThe percentage of packets that are colliding

interfacenameThe interface name (Key attribute)

interfacetypeThe interface card type

The indication is generated only if the system uses an Ethernet card and when the followingthreshold is exceeded:


Packet Collision Percentage(PercPacketCollisionThr)

This threshold indicates the maximum percentage ofcorrupted packets allowed.

10


Setting Default



Occurrences 2

Holes 0


162 Version 5.1.1

Interface Not EnabledThis indication is sent when the interface status is not up


interfacenameThe name of the network interface (Key attribute)

interfacetypeThe type of the interface card


Setting Default



Occurrences 1

Holes 0



19.N

etwo

rkIn

terfaceR

esou

rceM

od

el

Interface Not OperationalThis indication is sent when the interface has been enabled, but is not in a running state. Theinterface driver might not be correctly installed.



interfacetypeThe type of interface card


Setting Default



Occurrences 1

Holes 0


164 Version 5.1.1

Unknown Interface StatusThis indication is sent when the status of the monitored interface can not be retrieved.



intercafetypeThe type of interface card

interfacestatusThe status of the interface card


Setting Default



Occurrences 1

Holes 0



19.N

etwo

rkIn

terfaceR

esou

rceM

od

el

ThresholdsThe following table lists the thresholds that can be set for the Network Interface resourcemodel. For each threshold it shows the name, a short description, and the default value:


Input Packets in Error(PercInPacketErrThr)

This threshold indicates the maximum percentageof input packets in error allowed.

20

Output Packets in Error(PercOutPacketErrThr)

This threshold indicates the maximum percentageof output packets in error allowed.

10

Packet Collision Percentage(PercPacketCollisionThr)

This threshold indicates the maximum percentageof corrupted packets allowed.

10



Network Interface CardInterfacename

The name of the interface card

InPacks The total number of input packets

InPacksErrThe percent of input packets in error

OutPacksThe total number of output packets

OutPackErrThe percent of output packets in error

OutPackCollThe percent of output packets colliding

Description of the .mof File PropertiesThis section lists all properties used by the DMXNetworkInterface.mof file for theNetwork Interface resource model. This .mof file uses one CIM class:DMXNetworkInterface.


networkInterface STRING The name of the network interface card.

type STRING The type of interface card (″ETHERNET″,″TOKENRING″, ″LOOPBACK″,″NOTSUPPORTED″).

status STRING The interface status (″DOWN″,″UP&RUNNING″, ″UP&NOTRUNNING″,″UNKNOWN″).

deltaInPackets NUMERIC The delta number of input packets.

deltaInPacketsErr NUMERIC The delta number of input packets in error.

Thresholds

166 Version 5.1.1

|

|||

||||

|||

|||||

|||||

|||

|||


deltaOutPackets NUMERIC The delta number of output packets.

deltaOutPacketsErr NUMERIC The delta number of output packets in error.

deltaCollisions NUMERIC The delta number of corrupted packets.



|||

|||

|||

|||

19.N

etwo

rkIn

terfaceR

esou

rceM

od

el


168 Version 5.1.1

Network RPC-NFS Resource Model

This chapter describes the Network RPC-NFS resource model for Solaris systems.



Internal name DMXNetworkRPCNFS

Category Solaris

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview

Resource model distributionThis resource model should be distributed to Solaris endpoints.

The Network RPC-NFS resource model detects problems and monitors the performance ofthe RPC and NFS servers and clients.



HighNFSBufferSize High NFS Buffer Size Warning 170

HighNFSSrvGetattr High NFS Server Get-attribute Operations Warning 171

HighNFSSrvRead High NFS Server Read Operations Warning 171

HighNFSSrvReadLink High NFS Server Readlink Operations Warning 173

HighNFSSrvWrites High NFS Server Write Operations Warning 174

HighPercDupReqs High Duplicate RPC Server Calls Warning 175

HighPercRetrans High Retransmitted Calls Critical 176

HighPercRPCBadCalls High RPC Bad Calls Warning 177

20


20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el


HighTimeoutsAnd_Badxids High Timeouts and Badxids Warning 178

NetworkBusy High Network Traffic Warning 179

NetworkSlow Slow Network Warning 180

High NFS Buffer SizeThis indication is sent when the percentage of client RPC calls that were retransmitted ortimed out is too high, and there are no duplicate acknowledgements.


totrpccallsThe total client RPC calls

percrpcretransThe percentage of client RPC calls that were retransmitted

percrpctimeoutsThe percentage of client RPC calls that timed out




Percentage of Client RPC Calls in Time-out(RPCCLCallsToutPercThr)

This threshold indicates the maximumpercentage of timed-out client RPCcalls allowed to maintain acceptablenetwork traffic level.

5

Percentage of Client RPC Retransmissions(RPCCLRetransPercThr)

This threshold indicates the maximumof client RPC retransmissionsallowed.

5


Setting Default



Occurrences 3

Holes 0


170 Version 5.1.1

High NFS Server Get-attribute OperationsThis indication is sent when the percentage of NFS server calls to read the client attributecache is too high.


totnfssrvcallsThe total NFS server calls

percnfssrvgetattrThe percentage of NFS server requests to read the client attribute cache




Percentage of NFS Server Getattr Operations(NFSSrvGettatrThr)

This threshold indicates the maximumpercentage of NFS server calls to readthe client cache attribute withoutimpacting NFS server performance.

40


Setting Default



Occurrences 3

Holes 0



20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el

High NFS Server Read OperationsThis indication is sent when the percentage of NFS server calls for read operations is toohigh.


totnfssrvcallsThe total NFS server calls

percnfssrvreadThe percentage of NFS server calls for read operations




Percentage of NFS Server Read Operations(NFSSrvReadThr)

This threshold indicates the maximumpercentage of NFS server readoperations allowed.

30


Setting Default



Occurrences 3

Holes 0


172 Version 5.1.1

High NFS Server Readlink OperationsThis indication is sent when the percentage of NFS server calls for readlink operationscompared to the total lookup calls on the NFS server is too high.


totnfssrvlookupThe total lookup calls on the NFS server

percnfssrvreadlinkThe percentage of NFS server calls for readlink operations




Percentage of NFS Server Readlink Operations(NFSSrvReadlinkThr)

This threshold indicates themaximum percentage of NFS serverread operations using symbolic linkson file systems exported by theserver.

10


Setting Default



Occurrences 3

Holes 0



20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el

High NFS Server Write OperationsThis indication is sent when the percentage of NFS server calls for write operations is toohigh.


totnfssrvcallsThe total number of NFS server calls

percnfssrvwritesThe percentage of NFS server calls for write operations




Percentage of NFS Server Write Operations(NFSSrvWriteThr)

This threshold indicates the maximumpercentage of NFS server writeoperations allowed without impactingNFS performance.

15


Setting Default



Occurrences 3

Holes 0


174 Version 5.1.1

High Duplicate RPC Server CallsThis indication is sent when the percentage of RPC server calls that are duplicates is toohigh. This can be due to transmission problems.


totrpcsrvdupreqsThe total number of RPC server calls that are duplicate requests

percrpcsrvdupreqsThe percentage of RPC server calls that are duplicate requests




Percentage of Server RPC Duplicate Requests(RPCSrvDupCallsThr)

This threshold indicates the maximumpercentage of duplicate RPC callsallowed.

60


Setting Default



Occurrences 3

Holes 0



20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el

High Retransmitted CallsThis indication is sent when the percentage of client RPC calls being retransmitted is toohigh.


totrpccallsThe total number of RPC client calls

percrpcretransThe percentage of RPC client calls being retransmitted





This threshold indicates the maximum ofclient RPC retransmissions allowed.

5


Setting Default



Occurrences 5

Holes 0


176 Version 5.1.1

High RPC Bad CallsThis indication is sent when the percentage of RPC server or client calls being rejected bythe RPC is too high.


totrpcsrvcallsThe total number of RPC server calls

percrpcsrvbadcallsThe percentage of RPC server calls being rejected

totrpcclcallsThe total number of RPC client calls

percrpcclbadcallsThe percentage of RPC client calls being rejected




Percentage of Bad RPC Calls(RPCBadCallsPercThr)

This threshold indicates the maximum number ofbad RPC calls allowed to maintain acceptablenetwork performance. It refers to both client andserver RPC bad calls.

30


Setting Default



Occurrences 5

Holes 0



20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el

High Timeouts and BadxidsThis indication is sent when the percentages of timed-out RPC client calls and badxids(duplicate acknowledgements) are too high.


totrpccallsThe total number of RPC client calls

percrpctimeoutsThe percentage of timed-out RPC client calls

percrpcbadxidsThe percentage of badxids




Percentage of Client RPC Badxids(RPCCLBAdXidsPercThr)

This threshold indicates the maximumpercentage of badxids (duplicateacknowledgements) allowed by RPCclient maintaining acceptable networktraffic level.

5



5


Setting Default



Occurrences 3

Holes 0


178 Version 5.1.1

High Network TrafficThis indication is sent when the number of client RPC calls being retransmitted is close tothe client RPC calls timing out.


numrpcretransThe number of RPC retransmissions

numrpctimeoutsThe number of timed-out RPC client calls



Setting Default



Occurrences 3

Holes 0



20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el

Slow NetworkThis indication is sent when the number of timed-out client RPC calls approaches thenumber of client RPC duplicate acknowledgements (badxids) for a single NFS request.


numrpcbadcallsThe number of timed-out client RPC calls

numrpcdupacksThe number of client RPC duplicate acknowledgements (badxids) for a single NFSrequest



Setting Default



Occurrences 3

Holes 0


180 Version 5.1.1

ThresholdsThe following table lists the thresholds that can be set for the Network resource model. Foreach threshold it shows the name, a short description, and the default value:


Percentage of Bad RPC Calls(RPCBadCallsPercThr)

This threshold indicates the maximumnumber of bad RPC calls allowed tomaintain acceptable networkperformance. It refers to both clientand server RPC bad calls.

30

Percentage of Client RPC Badxids(RPCCLBAdXidsPercThr)

This threshold indicates the maximumpercentage of badxids (duplicateacknowledgements) allowed by RPCclient maintaining acceptable networktraffic level.

5



5


This threshold indicates the maximumof client RPC retransmissions allowed.

5

Percentage of NFS Server Getattr Operations(NFSSrvGettatrThr)

This threshold indicates the maximumpercentage of NFS server calls to readthe client cache attribute withoutimpacting NFS server performance.

40

Percentage of NFS Server ReadlinkOperations (NFSSrvReadlinkThr)

This threshold indicates the maximumpercentage of NFS server readoperations using symbolic links on filesystems exported by the server.

10

Percentage of NFS Server Read Operations(NFSSrvReadThr)

This threshold indicates the maximumpercentage of NFS server readoperations allowed.

30

Percentage of NFS Server Write Operations(NFSSrvWriteThr)

This threshold indicates the maximumpercentage of NFS server writeoperations allowed without impactingNFS performance.

15

Percentage of Server RPC DuplicateRequests (RPCSrvDupCallsThr)

This threshold indicates the maximumpercentage of duplicate RPC callsallowed.

60

Thresholds


20.N

etwo

rkR

PC

-NF

SR

esou

rceM

od

el



NFS Servername Identifies the single instance

NFScalls The NFS calls

NFSbadcallsThe NFS calls that are timed out

NFSgetattrThe NFS requests to read the client attribute cache

NFSread The NFS read operations

NFSwriteThe NFS write operations

NFSlookupThe lookup calls on the NFS server

NFSreadlinkThe NFS server calls for readlink operations

Clientname Identifies the single instance

NFScalls The NFS calls

NFSbadcallsThe NFS calls that are timed out

RPC Clientname Identifies the single instance

RPCcallsThe client RPC calls

RPCbadcallsThe number of timed-out client RPC calls

RPCretransThe RPC client calls being retransmitted

RPCbadxidsThe badxids

RPCtimeoutsThe client RPC calls that timed out

Servername Identifies the single instance

RPCCallsThe client RPC calls

RPCBadcallsThe number of timed-out client RPC calls

RPCDuprequestsThe RPC server calls that are duplicate requests

RPCDupchecksThe number of RPC server calls that are looked upin the duplicate request cache.

Logging

182 Version 5.1.1

Process Resource Model

This chapter describes the Process resource model for UNIX systems.



Internal name DMXProcess

Category UNIX/Linux

Thresholds Yes

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The Process resource model looks for bottlenecks in running processes. Problems highlightinclude:

¶ A process uses too much CPU time

¶ Too many zombie processes in the system

¶ A process is stopped or killed

¶ A process that was requested does not exist

21


21.P

rocess

Reso

urce

Mo

del

Indications and EventsThe following table lists the events that can be generated by the Process resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:


HighZombieProcesses High Number of Zombie Processes Warning 184

ProcessHighCPU Process Consuming High CPU Minor 185

ProcessKilledOrNotExisting Process Killed or Nonexistent Critical 186

ProcessStopped Process Stopped Critical 187

High Number of Zombie ProcessesThis indication is sent when the number of processes in a zombie state is too high. Aprocess is a zombie when it has been terminated and its results have not been gathered bythe parent process.


numZombieThe number of zombie processes




Maximum Number of Zombie Processes(HighZombieProcess)

This threshold indicates the maximumnumber of zombie processes allowedwithout impacting system performance.

20


Setting Default



Occurrences 6

Holes 1


184 Version 5.1.1

Process Consuming High CPUThis indication is sent when a process uses too much CPU time.


IDProcess The ID of the process being monitored (Key attribute)

PrcProcessorTimeThe percentage of CPU time used for the process

Process The process being monitored (Key attribute)

state The status of the process



Percentage of CPU Used(HighCPUUsed)

This threshold indicates the maximum percentage ofCPU that can be used by a single process withoutimpacting system performance. When a process uses ahigh percentage of CPU, it reduces available CPU timefor other processes.

60


Setting Default



Occurrences 20

Holes 3



21.P

rocess

Reso

urce

Mo

del

Process Killed or NonexistentThis event is sent when a process is stopped using the command sh ... stop, or when theresource model detects that the process is no longer present in the system. Specify anyprocesses in the Processes parameters.


name The process being monitored (Key attribute)


Setting Default



Occurrences 1

Holes 0


186 Version 5.1.1

Process StoppedThis event is generated when the process has the state stopped. The process continues to bepresent in the system, and can be monitored using the ps -ef command. Specify anyprocesses in the Processes parameters.


ProcessIDThe ID of the process being monitored (Key attribute)

ParentProcessIDThe parent of the process being monitored

name The process being monitored (Key attribute)

ProcessStatusThe status of the process being monitored


Setting Default



Occurrences 3

Holes 0



21.P

rocess

Reso

urce

Mo

del

ThresholdsThe following table lists the thresholds that can be set for the Process resource model. Foreach threshold it shows the name, a short description, and the default value:


Maximum Number of Zombie Processes(HighZombieProcess)

This threshold indicates the maximumnumber of zombie processes allowedwithout impacting system performance.

20

Percentage of CPU Used (HighCPUUsed) This threshold indicates the maximumpercentage of CPU that can be used by asingle process without impacting systemperformance. When a process uses a highpercentage of CPU, it reduces availableCPU time for other processes.

60

ParametersThe following table lists the parameter that can be set for the Process resource model.


Processes (processes) The single processes to be monitored for the ProcessStopped and Process Killed or Nonexistent events.

String list



Process Processor UsageProcess The name of the process

PID The ID of the process

PercentProcessUsageThe percentage of CPU that the process is using

Description of the .mof File PropertiesThis section lists all properties used by the DMXProcess.mof file for the Process resourcemodel. This .mof file uses one CIM class: DMXProcess.


pid NUMERIC The ID of the process.

name STRING The name of the process.

ppid NUMERIC The ID of the parent process.

uid NUMERIC The User ID.

gid NUMERIC The Group ID.

Thresholds

188 Version 5.1.1

|

||

||||

|||

|||

|||

|||

|||


euid NUMERIC The effective User ID.

egid NUMERIC The effective Group ID.

state STRING The status of the process (″Waiting″, ″Ready″,″Running″, ″Stopped″, ″Zombie″)

memUsed NUMERIC The memory being used (in kilobytes).

percentProcessorTime NUMERIC The percentage of CPU time used for theprocess.



|||

|||

|||

||||

|||

||||

21.P

rocess

Reso

urce

Mo

del


190 Version 5.1.1

Security Resource Model

This chapter describes the Security resource model for UNIX/Linux systems.



Internal name DMXSecurity

Category UNIX/Linux

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The Security resource model provides information about files and the users logged onto thesystem. It highlights the following items or changes that might indicate security breaches:

¶ Property changes, such as the owner, group, or attributes, for certain files

¶ The number of logons onto the system by the same user

¶ A suspect superuser

¶ An account that is not valid for root

Indications and EventsThe following table lists the events that can be generated by the Security resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


DuplicatedAccount Duplicate Account Minor 192

FileNotExisting Nonexistent File Warning 193

HighLoggingNumber High Log-in Number for User Minor 193

22


22.S

ecurity

Reso

urce

Mo

del


IllegalGroup Illegal Group Critical 194

IllegalOwner Illegal Owner Critical 194

NotRegularRootAccount Account not Valid for Root Harmless 195

PasswdNull Null Password Critical 195

SuspectSuperGroup Suspect Supergroup Critical 196

SuspectSuperUser Suspect Superuser Critical 196

WrongMode Wrong File Mode Critical 197

Duplicate AccountThis indication is sent when two users or groups have the same user or group ID.

The indication has the following attribute:

id The ID that has been duplicated (Key attribute)


Setting Default



Occurrences 4

Holes 0


192 Version 5.1.1

Nonexistent FileThis indication is sent when the user wants to monitor a file that does not exist on themachine, for example, because it was deleted.

The indication has the following attribute:

pathnameThe pathname of the file specified (Key attribute)


Setting Default



Occurrences 1

Holes 0

High Log-in Number for UserThis indication is sent when a specified user is logged to the system a number of timeshigher than what specified in the Defined Users parameter.


numlogged The number of times the user has logged in

username The ID of the user (Key attribute)


Setting Default



Occurrences 4

Holes 1



||

22.S

ecurity

Reso

urce

Mo

del

Illegal GroupThis indication is sent when a security-sensitive file does not have a superuser group.


fullname The full file path (Key attribute)

group The file group being monitored


Setting Default



Occurrences 1

Holes 0

Illegal OwnerThis indication is sent when a security-sensitive file has an owner who is not a superuser.


owner The owner of the file

fullname The full file path (Key attribute)


Setting Default



Occurrences 1

Holes 0


194 Version 5.1.1

Account not Valid for RootThis indication is sent when the account ID is not valid for root.


id The ID of the root account that was created (Key attribute)


Setting Default



Occurrences 1

Holes 0

Null PasswordThis indication is sent when a user and/or a group has a password that is set to null.


id The ID of the user or group (Key attribute)

name Identifies the single instance


Setting Default



Occurrences 1

Holes 0



22.S

ecurity

Reso

urce

Mo

del

Suspect SupergroupThis indication is sent when the supergroup is suspected of being an intruder.


groupidThe ID of the suspicious group

groupnameThe group name of the file that is suspicious (Key attribute)


Setting Default



Occurrences 1

Holes 0

Suspect SuperuserThis indication is sent when superuser is suspected of being an intruder.


id The user ID that is suspicious

userName The user name (Key attribute)


Setting Default



Occurrences 1

Holes 0


196 Version 5.1.1

Wrong File ModeThis indication is sent when security-sensitive files have a file mode that is different fromthe default mode.


actualmode The type of access permission that the file actually has on the system.

rightmode The type of access permission that the file should have in the parameters asdefined from the IBM Tivoli Monitoring desktop.

filename The name of the file (Key attribute).


Setting Default



Occurrences 1

Holes 0



22.S

ecurity

Reso

urce

Mo

del

ParametersThe following table lists the parameters that can be set for the Security resource model.


Alternative Groups(AlternativeGroup)

Groups other than root that can own certain securityfiles in the system

String list

Alternative Owners(AlternativeOwners)

Users that can own certain security files in the system String list

Defined Users (Users) Users to be monitored in the following format:

username | login_limit

String list

Files to Be Monitored(FilesList)

The files that you want to monitor. Enter the file details,separated by the pipe character, in the field to the left ofthe Add button in the following format:

filename | string_mode (as listed with the ls -lacommand) | owner | group

String list

Special Groups(Supergroups)

The groups that can become supergroups in the system String list

Special Users (Superusers) Users that can become superusers in the system String list



User LogginguserName

The name of the user logging on

id The ID of the suspicious user

numLoggedThe number of times the user is logged in

Note: The above properties are logged only if the user islogged to the system a number of times higher than whatspecified in the Defined Users parameter.

File File UsagefileName The file name being monitored

group The file group being monitored

owner The file owner being monitored

mode The type of access permission to the file

size The file size being monitored

Parameters

198 Version 5.1.1

||

|

|

|||

Description of the .mof File PropertiesThis section lists all properties used by the DMXSecurity.mof file for the Security resourcemodel. This .mof file uses three CIM classes: DMXFileSec, DMXUser, DMXGroup.


pathName STRING The name of the path.

owner STRING The file owner.

group STRING The file group.

mode STRING The type of access permission to the file.

numMode NUMERIC The UNIX (numeric) mode of the file.

size NUMERIC The file size (in bytes)

userName STRING The name of the user.

id NUMERIC The id of the user.

numLogged NUMERIC The number of times the user has logged in.

passwordNull NUMERIC Is the password null ? (boolean: ″1″ not definedfor user, ″0″ otherwise )

duplicated NUMERIC Is the user duplicated ? (boolean: ″1″ duplicated,″0″ not duplicated)

groupName STRING The name of the group

id NUMERIC The id of the group

passwordNull NUMERIC Is the password null ? (boolean: ″1″ not definedfor group, ″0″ otherwise )

duplicated NUMERIC Is the group duplicated ? (boolean: ″1″duplicated, ″0″ not duplicated)



|

||

||||

|||

|||

|||

|||

|||

|||

|||

|||

|||

||||

||||

|||

|||

||||

||||

22.S

ecurity

Reso

urce

Mo

del


200 Version 5.1.1

Server Performance Prediction ResourceModel

This chapter describes the Server Performance Prediction resource model for UNIX/Linuxsystems.



Internal name DMXSpp

Category UNIX/Linux

Thresholds No

Parameters Yes

Built-in actions No

Clearing events No


Overview


The Server Performance Prediction resource model gathers data from UNIX and Linuxsystems for the Tivoli Decision Support Guide for Server Performance Prediction (AdvancedEdition). This resource model does not have thresholds, indications or events.

Note: To run this resource model on AIX and HP endpoints, the SNMP deamon must beactive.

ParametersThe following table lists the parameters that can be set for the Server PerformancePrediction resource model.


Network Interface Configuration(NetworkInterfacesConf)

The network interface for which you want thenetwork interface values calculated. Values: 1-4.

Choice list

23


23.S

erverP

erform

ance

Pred

iction


Available File System Space Configuration(FileSystemSpaceAvailableConf)

The instance for which you want the availablefile system space calculated. Values: /, /usr,/tmp, /var, /home.

String list



Cpu SPP Guide for UNIXidleTime The idle cpu time as a percentage of total cpu time

userTimeThe cpu time spent on user applications as apercentage of total cpu time

sysTime The cpu time spent by the system as a percentageof total cpu time

loadAvg1The average number of processes running in themost recent calendar minute

FileSystem SPP Guide for UNIXmountPoint

The directory on which the file system is mounted

availKBytesThe free kilobytes on the disk

prcInodeUsedThe percentage of Inodes used in the file system

Memory SPP Guide for UNIXavailSwapSpace

The amount of space available to be swapped

pageInsRateThe number of page inputs per second

pageOutsRateThe number of page outputs per second

pctusedVirtualStorageThe percentage of total memory (including cachememory and swap space) being used

Parameters

202 Version 5.1.1


NetworkInterface SPP Guide for UNIXdeltaInPackets

The delta of packets received, compared with theprevious cycle

deltaInPacketsErrThe delta of errors for packets received, comparedwith the previous cycle

deltaOutPacketsThe delta of packets sent, compared with theprevious cycle

deltaOutPacketsErrThe delta of errors for packets sent, compared withthe previous cycle

deltaCollisionsThe delta of packet collisions, compared with theprevious cycle

networkInterfaceThe network interface card

NetworkRPCNFS SPP Guide for UNIXdeltaNFSClientCalls

The number of calls from the NFS client,compared with the previous cycle.

Processes SPP Guide for UNIXnumberWaitProcesses

The number of processes waiting to run

numberOfProcessesThe total number of processes

Logging


23.S

erverP

erform

ance

Pred

iction

Logging

204 Version 5.1.1

Part III. Resource Models for OS/400Chapter 24. ASP Disk Mirroring Resource Model . . . . . . . . . . . . . . . . . . . . . . . 209

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209


Mirroring not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Chapter 25. ASP Utilization Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213


ASP Nearing Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

ASP Overflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Chapter 26. Basic CPU Utilization Resource Model. . . . . . . . . . . . . . . . . . . . . 217Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217


Basic CPU Utilization Peak Long Running Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Basic CPU Utilization Guideline Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Basic CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Basic CPU Utilization Peak Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Chapter 27. Basic Interactive CPU Utilization Resource Model . . . . . . . . 223Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223


Basic Interactive CPU Utilization Peak Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . 224

Basic Interactive CPU Utilization Guideline Long Running Exceeded. . . . . . . . . . . . . . . . . . . 224

Basic Interactive CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Basic Interactive CPU Utilization Peak Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Chapter 28. Configuration Objects Resource Model . . . . . . . . . . . . . . . . . . . . 229Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229


Configuration Object Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230


||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Chapter 29. Database CPU Utilization Resource Model. . . . . . . . . . . . . . . . . 231Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231


Database CPU Utilization Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

Chapter 30. Distribution Queues Resource Model . . . . . . . . . . . . . . . . . . . . . . 233Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233


Normal Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

High Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Chapter 31. History Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235


List Of Jobs Not Empty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

Chapter 32. Interactive Feature CPU Utilization Resource Model . . . . . . 237Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237


Interactive Feature CPU Utilization Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Chapter 33. Job Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239


Job Log Warning Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Chapter 34. Job Queue Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243


Too Many Jobs Queued . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Job Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Job Queue Not Assigned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

206 Version 5.1.1

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Chapter 35. Job Status Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247


Job Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

Chapter 36. Management Central Events Resource Model . . . . . . . . . . . . . 249Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249


Management Central Unknown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Critical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Management Central Harmless. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Chapter 37. Network Attributes Resource Model. . . . . . . . . . . . . . . . . . . . . . . . 253Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253


Network Attributes Mismatch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Chapter 38. Output Queues Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255


No Writers Started For Output Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Output Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Chapter 39. Parametric Object and File Resource Model . . . . . . . . . . . . . . . 257Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257


Object Owner Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Last Changed Date Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Object Size Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Chapter 40. Storage Pools Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262


||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

Chapter 41. Subsystem Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263


Subsystem Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

Chapter 42. System Disk Resources Resource Model . . . . . . . . . . . . . . . . . . 265Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265


Total Auxiliary Storage Reached Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 266

System ASP Used Near Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

Total Auxiliary Storage Reached Capacity Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Chapter 43. System Value Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269


System Object Mismatch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Chapter 44. TCP Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271


TCP Interface Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

Chapter 45. TCP Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273


TCP Service Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

208 Version 5.1.1

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

||

ASP Disk Mirroring Resource Model

This chapter describes the Auxiliary Storage Pool (ASP) Disk Mirroring resource model forOS/400 systems.



Internal name ASPDiskMirroringStatus400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview

Resource model distributionThis resource model should be distributed to OS/400 endpoints.

The ASP Disk Mirroring resource model, given in input one or more ASP numbers, gets alist of disks for each ASP, checking the mirroring status of each disk.

Indications and EventsThe following table lists the events that can be generated by the ASP Disk Mirroringresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


MirroringNotActive MirroringNotActive Warning 210

24


|

|

||

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

|||||

24.A

SP

Disk

Mirro

ring

Reso

urce

Mo

del

Mirroring not ActiveThis indication is sent when a disk unit is part of a mirrored pair, but the mirroring iscurrently not active. You may need to investigate why the mirroring is not active. There maybe a hardware problem.


diskResourceNameThe name of the disk being monitored


Setting Default



Occurrences 2

Holes 0


210 Version 5.1.1

|

|||

|

||

|

|||

||

||

||

|||

ParametersThe following table lists the parameters that can be set for the ASP Disk Mirroring resourcemodel.


ASPs to monitor for DiskMirroring Status (ASPs)

The ASP numbers that you want to monitor. Duringeach cycle the mirroring status of each disk is checked.

String list

Parameters


|

||

|||||

|||||

24.A

SP

Disk

Mirro

ring

Reso

urce

Mo

del

212 Version 5.1.1

ASP Utilization Resource Model

This chapter describes the Auxiliary Storage Pool (ASP) Utilization resource model forOS/400 systems.



Internal name ASPUtilization400

Category OS/400

Thresholds Yes

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The ASP Utilization resource model monitors the Auxiliary Storage Pool (ASP) Utilizationfor the specified ASPs and sends events if the ASP is approaching being filled.

Indications and EventsThe following table lists the events that can be generated by the ASP Utilization resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


ASPNearingCapacity ASP nearing capacity Warning 214

ASPOverflow ASP overflow Warning 215

25


|

|

||

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

||||

|||||

25.A

SP

Utilizatio

nR

esou

rceM

od

el

ASP Nearing CapacityThis indication is sent when the ASP is nearing capacity with the specified percent value.The percent used has remained above the threshold value for several hours. You shouldconsider adding storage to the ASP, or archiving or removing objects that are no longerneeded.


ASPInstanceThe instance being monitored

totalAvailableMbytesPercentageThe percent value



total Available MBytesPercentage Threshold

This threshold indicates a percent value above whichthe specified ASPInstance is nearing capacity.

90


Setting Default



Occurrences 1

Holes 0


214 Version 5.1.1

|

||||

|

||

||

|

||||

|||||

|

|

|||

||

||

||

|||

ASP OverflowThis indication is sent when the ASP has overflowed to the system ASP. You shouldconsider adding storage to the ASP, or archiving or removing objects that are no longerneeded.


overflowStorageMBytesThe amount of overflow

ASPInstanceThe instance being monitored


Setting Default



Occurrences 1

Holes 0



|

|||

|

||

||

|

|||

||

||

||

|||

25.A

SP

Utilizatio

nR

esou

rceM

od

el

ParametersThe following table lists the parameters that can be set for the ASP Utilization resourcemodel.


Auxiliary Storage PoolInstances (ASPs)

The ASP instances. You can enter one or more numbersas enumeration parameters, or can enter the string’*ALL’ to enumerate all ASPs.

String list



ASP UtilizationASPInstance

The instance being moniored on

overflowStorageMBytesThe amount of overflow

totalAvailableMBytesPercentageThe percent value above which the specified ASPinstance is nearing capacity

Parameters

216 Version 5.1.1

|

||

|||||

|||||

|

|

|

||

|||

|

||

|

||

|||||

||

|||

Basic CPU Utilization Resource Model

This chapter describes the Basic CPU Utilization resource model for OS/400 systems.



Internal name BasicCPU400

Category OS/400

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the overall CPU utilization of the system.

Indications and EventsThe following table lists the events that can be generated by the Basic CPU Utilizationresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


BasicCPUUtilizationPeakLongRunningExceeded Basic CPU Utilization Peak LongRunning Exceeded

Warning 218

BasicCPUUtilizationGuidelineLongRunningExceeded

Basic CPU Utilization GuidelineLong Running Exceeded

Warning 218

BasicCPUUtilizationGuidelineExceeded Basic CPU Utilization GuidelineExceeded

Warning 219

BasicCPUUtilizationPeakExceeded Basic CPU Utilization PeakExceeded

Warning 220

26


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|

|

|||

|||||

|||||

||||||

|||||

|||||

|

26.B

asicC

PU

Utilizatio

nR

esou

rceM

od

el

Basic CPU Utilization Peak Long Running ExceededThis indication is sent when the overall CPU utilization has been over its threshold value forpeak usage for several hours. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet processing demands.


basicAverageCPUPctThe percent value.



CPU Utilization Peak SingleProcessor Long RunningThreshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a singleprocessor system.

90

CPU Utilization Peak DoubleProcessor Long RunningThreshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a doubleprocessor system.

93

CPU Utilization Peak TripleProcessor Long RunningThreshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a triple processorsystem.

95

CPU Utilization PeakMultiple Processor LongRunning Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a multipleprocessor system.

97


Setting Default



Occurrences 180

Holes 20

Basic CPU Utilization Guideline Long Running ExceededThis indication is sent when the overall CPU utilization has been over its guideline value forseveral hours. You may need to investigate adding CPU resources or determining if jobs areusing more CPU than they should. Having too high a CPU utilization can result in inabilityto satisfactorily meet peak processing demands.





CPU Utilization GuidelineSingle Processor LongRunning Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a singleprocessor system.

80


218 Version 5.1.1

|

||||

|

||

|

||||

|||

|||

|

|||

|||

|

|||

|||

|

|||

|||

|

|

|

|||

||

||

||

|||

|

||||

|

||

|

||||

|||

|||

|


CPU Utilization GuidelineDouble Processor LongRunning Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a doubleprocessor system.

85

CPU Utilization GuidelineTriple Processor LongRunning Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a tripleprocessor system.

89

CPU Utilization GuidelineMultiple Processor LongRunning Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a multipleprocessor system.

93


Setting Default



Occurrences 180

Holes 20

Basic CPU Utilization Guideline ExceededThis indication is sent when the overall CPU utilization has been over its guideline value forpeak usage for more than an hour. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet peak processing demands.





CPU Utilization GuidelineSingle Processor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a singleprocessor system.

85

CPU Utilization GuidelineDouble Processor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a doubleprocessor system.

88

CPU Utilization GuidelineTriple Processor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a tripleprocessor system.

91

CPU Utilization GuidelineMultiple Processor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a multipleprocessor system.

95


Setting Default




|||

|||

|||

|

|||

|||

|

|||

|||

|

|

|

|||

||

||

||

|||

|

||||

|

||

|

||||

|||||

|

|||||

|

|||||

|

|||||

|

|

|

|||

||

26.B

asicC

PU

Utilizatio

nR

esou

rceM

od

el

Setting Default


Occurrences 10

Holes 2

Basic CPU Utilization Peak ExceededThis indication is sent when the overall CPU utilization has been over its threshold value forpeak usage for more than an hour. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet processing demands.





CPU Utilization Peak SingleProcessor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a singleprocessor system.

94

CPU Utilization Peak DoubleProcesso Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a doubleprocessor system.

96

CPU Utilization Peak TripleProcessor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a triple processorsystem.

97

CPU Utilization PeakMultiple Processor Threshold

Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a multipleprocessor system.

99


Setting Default



Occurrences 10

Holes 2


220 Version 5.1.1

||

||

||

|||

|

||||

|

||

|

||||

|||||

|

|||||

|

|||||

|

|||||

|

|

|

|||

||

||

||

|||



BasicCPU Utilizationspare A key property

basicAverageCPUPctThe percent value

numOfProcessorsThe number of processors

Logging


|

||

|||

|

||

|

||

|||||

||

||

26.B

asicC

PU

Utilizatio

nR

esou

rceM

od

el

222 Version 5.1.1

Basic Interactive CPU Utilization ResourceModel

This chapter describes the Basic Interactive CPU Utilization resource model for OS/400systems.



Internal name BasicInteractiveCPU400

Category OS/400

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the interactive CPU utilization of the system. This should onlybe used on system models which support the interactive CPU metric.

Indications and EventsThe following table lists the events that can be generated by the Basic Interactive CPUUtilization resource model, the name of the indication from which each event is generated,the default severity of the event, and where you can find a detailed description of theindication:


BasicInteractiveCPUUtilizationPeakLongRunningExceeded

Basic Interactive CPU UtilizationPeak Long Running Exceeded

Warning 224

BasicInteractiveCPUUtilizationGuidelineLongRunningExceeded

Basic Interactive CPU UtilizationGuideline Long RunningExceeded

Warning 224

27


|

|

|

||

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

||||

|||||

||||||

|||||

||

27.B

asicIn

teractiveC

PU

Utilizatio

nR

esou

rceM

od

el


BasicInteractiveCPUUtilizationGuidelineExceeded

Basic Interactive CPU UtilizationGuideline Exceeded

Warning 225

BasicInteractiveCPUUtilizationPeakExceeded Basic Interactive CPU UtilizationPeak Exceeded

Warning 226

Basic Interactive CPU Utilization Peak Long Running ExceededThis indication is sent when the overall interactive CPU utilization has been over itsthreshold value for peak usage for several hours. You may need to investigate addinginteractive CPU resources or determining if interactive jobs are using more CPU than theyshould. Having too high an interactive CPU utilization can result in inability to satisfactorilymeet interactive processing demands.


basicInteractiveCPUPctThe percent value.



CPU Utilization Peak SingleProcessor Long RunningThreshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a singleprocessor system.

60

CPU Utilization Peak DoubleProcessor Long RunningThreshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a doubleprocessor system.

75

CPU Utilization Peak TripleProcessor Long RunningThreshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a tripleprocessor system.

85

CPU Utilization PeakMultiple Processor LongRunning Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a multipleprocessor system.

90


Setting Default



Occurrences 180

Holes 20

Basic Interactive CPU Utilization Guideline Long Running ExceededThis indication is sent when the interactive CPU utilization has been over its guideline valuefor several hours. You may need to investigate adding interactive CPU resources ordetermining if interactive jobs are using more CPU than they should. Having too high aninteractive CPU utilization can result in inability to satisfactorily meet peak interactiveprocessing demands.



224 Version 5.1.1

||||

||||||

|||||

|

|

|||||

|

||

|

||||

|||

|||

|

|||

|||

|

|||

|||

|

|||

|||

|

|

|

|||

||

||

||

|||

|

|||||

|




CPU Utilization GuidelineSingle Processor LongRunning Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a singleprocessor system.

45

CPU Utilization GuidelineDouble Processor LongRunning Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a doubleprocessor system.

60

CPU Utilization GuidelineTriple Processor LongRunning Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a tripleprocessor system.

70

CPU Utilization GuidelineMultiple Processor LongRunning Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with amultiple processor system.

75


Setting Default



Occurrences 180

Holes 20

Basic Interactive CPU Utilization Guideline ExceededThis indication is sent when the interactive CPU utilization has been over its guideline valuefor peak usage for more than an hour. You may need to investigate adding interactive CPUresources or determining if interactive jobs are using more CPU than they should. Havingtoo high a CPU utilization can result in inability to satisfactorily meet interactive processingdemands.





CPU Utilization GuidelineSingle Processor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a singleprocessor system.

56

CPU Utilization GuidelineDouble Processor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a doubleprocessor system.

71

CPU Utilization GuidelineTriple Processor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a tripleprocessor system.

81



||

|

||||

|||

|||

|

|||

|||

|

|||

|||

|

|||

|||

|

|

|

|||

||

||

||

|||

|

|||||

|

||

|

||||

|||||

|

|||||

|

|||||

|

27.B

asicIn

teractiveC

PU

Utilizatio

nR

esou

rceM

od

el


CPU Utilization GuidelineMultiple Processor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with amultiple processor system.

86


Setting Default



Occurrences 10

Holes 2

Basic Interactive CPU Utilization Peak ExceededThis indication is sent when the interactive CPU utilization has been over its threshold valuefor peak usage for more than an hour. You may need to investigate adding interactive CPUresources or determining if interactive jobs are using more CPU than they should. Havingtoo high a CPU utilization can result in inability to satisfactorily meet interactive processingdemands.





CPU Utilization Peak SingleProcessor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a singleprocessor system.

70

CPU Utilization Peak DoubleProcesso Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a doubleprocessor system.

83

CPU Utilization Peak TripleProcessor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a tripleprocessor system.

91

CPU Utilization PeakMultiple Processor Threshold

Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a multipleprocessor system.

94


Setting Default



Occurrences 10

Holes 2


226 Version 5.1.1

|||

|||||

|

|

|

|||

||

||

||

|||

|

|||||

|

||

|

||||

|||||

|

|||||

|

|||||

|

|||||

|

|

|

|||

||

||

||

|||



InteractiveCPU Utilizationspare A key property

basicInteractiveCPUPctThe percent value

numOfProcessorsThe number of processors

Logging


|

||

|||

|

||

|

||

|||||

||

||

27.B

asicIn

teractiveC

PU

Utilizatio

nR

esou

rceM

od

el

228 Version 5.1.1

Configuration Objects Resource Model

This chapter describes the Configuration Objects resource model for OS/400 systems.



Internal name ConfigurationObjects400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the status of configuration objects. The user can enter one ormore configuration object name and type. Then, during each cycle, the resource modelmonitors the status of each object.

Indications and EventsThe following table lists the events that can be generated by the Configuration Objectsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


ConfigurationObjectNotActive Configuration Object Not Active Warning 229

Configuration Object Not ActiveThis indication is sent when the configuration object is not active. You may need toinvestigate whether it is purposely varied off, or whether there is a problem with it or anassociated configuration object. For example, a line may not be active because its controlleris not active.

28


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

|||||

|

||||

28.C

on

figu

ration

Ob

jectsR

esou

rceM

od

el


cfgObjectNameThe configuration object name


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Configuration Objectsresource model.


Configuration Objects(ConfigurationObjects)

The Configuration Object’s name and type separated bya comma. One or more parameter strings of″<name>,<type>″ are allowed where type can be: NWS- Network Server, NWI - Network Interface, LIN - Line,CTL - Controller, DEV - Device, Name is maximum 10character long string and can contain wildcards of ’*’and ’?’. For example, a parameter string of ’*,lin’ willcheck all line configuration objects.

String list


230 Version 5.1.1

|

||

|

|||

||

||

||

|||

|

||

|||||

||||||||||

|

Database CPU Utilization Resource Model

This chapter describes the Database CPU Utilization resource model for OS/400 systems.



Internal name DatabaseCPUUtilization400

Category OS/400

Thresholds No

Parameters No

Built-in actions No

Clearing events Yes


Overview


The Database CPU Utilization resource model checks if the system is exceeding itsthreshold limit for database CPU utilization. This metric is supported on certain models ofnewer hardware. If the Database CPU Threshold is 100, then there is no threshold limit onthe system. These checks are for systems which have a Database CPU Threshold limit lessthan 100.

Indications and EventsThe following table lists the events that can be generated by the Database CPU Utilizationresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


DatabaseCPUUtilizationExceeded Database CPU UtilizationExceeded

Warning 231

Database CPU Utilization ExceededThis indication is sent when Database CPU utilization has been over its threshold value forover an hour. You may need to investigate adding database CPU resources or determining if

29


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||||

|

|||

|||||

|||||

|

|

||

29.D

atabase

CP

UU

tilization

Res.

Mo

del

jobs are using more database CPU than they should. Having a too high database CPUutilization can result in inability to satisfactorily meet processing demands.


databaseCapabilityCPUPctThe percent value


Setting Default



Occurrences 10

Holes 2



DatabaseCPU Utilizationspare

databaseCapabilityCPUPctThe percent value

databaseThresholdPctThe database CPU threshold limit


232 Version 5.1.1

||

|

||

|

|||

||

||

||

|||

|

||

|||

|

||

|

||

||||

||

||

Distribution Queues Resource Model

This chapter describes the Distribution Queues resource model for OS/400 systems.



Internal name DistributionQueues400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Note: This resource model should have a cycle time of at least several minutes.

Overview


The Distribution Queues resource model monitors the status of the high and normal priorityservice levels for distribution queues.

Indications and EventsThe following table lists the events that can be generated by the Distribution Queuesresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


NormalPriorityDistributionQueueNotActive Normal Priority DistributionQueue Not Active

Warning 234

HighPriorityDistributionQueueNotActive High Priority Distribution QueueNot Active

Warning 234

30


|

|

|

|

||

||

||

||

||

||

||

|||

|

|

|||||

||

|

|||

|||||

|||||

|||||

|

30.D

istribu

tion

Qu

eues

Reso

urce

Mo

del

Normal Priority Distribution Queue Not ActiveThis indication is sent when the normal priority service level for the distribution queue isnot active.


distributionQueueNameThe name of the distribution queue

statusNormalPriorityThe status of the normal priority service level


Setting Default



Occurrences 1

Holes 0

High Priority Distribution Queue Not ActiveThis indication is sent when the high priority service level for the distribution queue is notactive.


distributionQueueNameThe name of the distribution queue

statusHighPriorityThe status of the high priority service level


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Distribution Queues resourcemodel.


Distribution Queue Names(DistributionQueues)

The name of the distribution queues to monitor. You canenter one or more name strings each a maximum of 10characters long. The name strings can contain wildcardscharacters of ’*’ and ’?’.

String list


234 Version 5.1.1

|

||

|

||

||

|

|||

||

||

||

|||

|

||

|

||

||

|

|||

||

||

||

|||

|

||

|||||

||||||

|

History Log Resource Model

This chapter describes the History Log resource model for OS/400 systems.



Internal name HistoryLog400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events No


Overview


This resource model finds specific messages in the history log. The history log containsmany status and error messages from the system. You may enter message numbers and textstrings as parameters. They will be compared to history log entries.

Indications and EventsThe following table lists the events that can be generated by the History Log resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


ListOfJobsNotEmpty List Of Jobs Not Empty Warning 235

List Of Jobs Not EmptyThis indication is sent when the list of jobs is not empty. One or more jobs have issuedmessages to the History Log. The input message ID and test string match one or moreentries in the History Log. The job names are included in the event. You may need toinvestigate why the jobs have issued the messages.

31


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

|||||

|

||||

31.H

istory

Lo

gR

esou

rceM

od

el


ListOfJobsThe list of jobs


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the History Log resource model.


Message Match Parameters(MatchParms)

The message IDs and text strings to match againstHistory Log entries. The input fomat for each parameteris ″<message ID>,<pattern to match>″. The message IDis a maximum of 7 characters and can contain wildcardsof ’*’ and ’?’. The pattern to match can be a maximumof 100 characters and can contain wildcards of ’*’ and’?’.Note: The message text from the History Log recordson the OS/400 endpoint will be in the primary languageof the system. So the match parameter text should be inthat language.

String list


236 Version 5.1.1

|

||

|

|||

||

||

||

|||

|

|

|||||

|||||||||||||

|

Interactive Feature CPU UtilizationResource Model

This chapter describes the Interactive Feature CPU Utilization resource model for OS/400systems.



Internal name InteractiveFeatureCPUUtilization400

Category OS/400

Thresholds No

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model checks if the system is exceeding its threshold limit for InteractiveFeature CPU utilization. This is supported only on certain models. If the Interactive FeatureCPU Threshold is 100, then there is no threshold limit on the system. These checks are forsystems which have an Interactive Feature CPU threshold limit less than 100.

Indications and EventsThe following table lists the events that can be generated by the Interactive Feature CPUUtilization resource model, the name of the indication from which each event is generated,the default severity of the event, and where you can find a detailed description of theindication:


InteractiveFeatureCPUUtilizationExceeded Interactive Feature CPUUtilization Exceeded

Warning 238

32


|

|

|

||

|

||

||

||

||

||

||

||

|||

|

|||||

||||

|

||||

|||||

|||||

|

32.In

teractiveF

eature

CP

UU

tilization

Res.

Mo

del

Interactive Feature CPU Utilization ExceededThis indication is sent when the Interactive Feature CPU utilization has been over itsthreshold value for over an hour. You may need to investigate adding Interactive FeatureCPU resources or determining if interactive jobs are using more CPU than they should.Having too high an Interactive Feature CPU utilization can result in inability to satisfactorilymeet processing demands.




Setting Default



Occurrences 10

Holes 2



InteractiveFeatureCPU Utilizationspare


interactiveThresholdPctThe threshold limit


238 Version 5.1.1

|

|||||

|

||

|

|||

||

||

||

|||

|

||

|||

|

||

|

||

||||

||

||

Job Log Resource Model

This chapter describes the Job Log resource model for OS/400 systems.



Internal name JobLog400

Category OS/400

Thresholds Yes

Parameters Yes

Built-in actions No

Clearing events No


Overview


This resource model checks a job’s Job Log for specific messages. The parameters containthe message numbers and text strings to match. They will be compared to the log entries forthe input jobs.

Indications and EventsThe following table lists the events that can be generated by the Job Log resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


JobLogWarningMessage Job Log Warning Message Warning 239

Job Log Warning MessageThis indication is sent when the a job has issued warning messages to its Job Log. The inputmessage ID and test string matches one or more entries in the job’s log. The job name isincluded in the event. You may need to investigate why the job has issued the message.


33


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

|||||

|

|||

|

33.Jo

bL

og

Reso

urce

Mo

del

JobNameThe name of the job.

MessageIDThe message ID.

MessageTextThe text of the message.



Number of matches threshold(numOfMatchesThreshold)

This threshold indicates the number of matches abovewhich the job log warning message is sent.

1


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Job Log resource model.


Matching Parameters(matchParms)

The message IDs and text strings to match. The inputfomat for each parameter is ″<message ID>,<pattern tomatch>″. The message ID is a maximum of 7 charactersand can contain wildcards of ’*’ and ’?’. The pattern tomatch can be a maximum of 100 characters and cancontain wildcards of ’*’ and ’?’. The pattern will matchif it is found anywhere in the message text. The fullmessage including variable insert text will be used in thematch processing.Note: The message text from the Job Log entries on theOS/400 endpoint will be in the primary language of thesystem. So the match parameter text should be in thatlanguage.

String list


240 Version 5.1.1

||

||

||

|

||||

|||||

|

|

|||

||

||

||

|||

|

|

|||||

|||||||||||||||

|


Job Names (JobNames) One or more job names to search their logs. Theparameter format is: ″[<subsystem library> / ]<subsystem name>,<job name>,<job user> [ , <jobnumber> ]″ where the items contained in brackets (’[ ]’)are optional. If the ″< subsystem library> /″ is not inputthen QSYS library is assumed. If ″, <job number>″ isnot input then ’*’ is assumed. Each of the input itemscan contain wild card characters ’*’ and ’?’ where ’*’matches any number of any characters, and ’?’ matchesany one character. Each parameter item can be up to amaximum of 10 characters long except for job numberwhich can be a maximum of 6 characters long.

String list

Parameters


||||

|||||||||||||

|

33.Jo

bL

og

Reso

urce

Mo

del

242 Version 5.1.1

Job Queue Resource Model

This chapter describes the Job Queue resource model for OS/400 systems.



Internal name JobQueue400

Category OS/400

Thresholds Yes

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors that one or more job queues, which have jobs queued to them,are assigned to a subsystem so that the jobs can be started.

Indications and EventsThe following table lists the events that can be generated by the Job Queue resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


TooManyJobsQueued Too Many Jobs Queued Warning 243

JobQueueNotActive Job Queue Not Active Warning 244

JobQueueNotAssigned Job Queue Not Assigned Warning 244

Too Many Jobs QueuedThis indication is sent when a job queue has more than the threshold number of jobsqueued. You may need to investigate if the job queue is running properly, or if the overallsystem is running properly.

34


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

||||

||||

|||||

|

|||

34.Jo

bQ

ueu

eR

esou

rceM

od

el


numberOfJobsThe number of jobs.

jobQueueNameThe name of the job queue.



Maximum number of allowedqueued jobs

This threshold indicates the maximum number ofallowed queued jobs in a job queue.

5


Setting Default



Occurrences 1

Holes 0

Job Queue Not ActiveThis indication is sent when the a job queue is not active. You may need to investigate whythe job queue is not active. It may have never been started, or it was held.


jobQueueStatusThe status of the job queue.



Setting Default



Occurrences 1

Holes 0

Job Queue Not AssignedThis indication is sent when the job queue has a number of jobs to run, however the jobqueue has not been assigned to a subsystem. You may want to investigate if the job queueshould be assigned to a subsystem so that the jobs can be started.





244 Version 5.1.1

|

||

||

|

||||

|||||

|

|

|||

||

||

||

|||

|

||

|

||

||

|

|||

||

||

||

|||

|

|||

|

||

|

Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Job Queue resource model.


Job Queues To BeMonitored (JobQueues)

Job queues to be monitored. Enter the library and nameof the job queues to be monitored. The parameter formatis ″<library>/<name>″ where both items are a maximum10 characters long and can contain wildcards ’*’ and ’?’.For example, ’*/*’ will find all Job Queues.

String list



|||

||

||

||

|||

|

|

|||||

|||||||

|

34.Jo

bQ

ueu

eR

esou

rceM

od

el

246 Version 5.1.1

Job Status Resource Model

This chapter describes the Job Status resource model for OS/400 systems.



Internal name JobStatus400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the job status. Given a list of job names, it sends an event ifany of the jobs are not active. The input job names can contain wild cards.

Indications and EventsThe following table lists the events that can be generated by the Job Status resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


JobNotActive Job Not Active Warning 247

Job Not ActiveThis indication is sent when a job is not active.


jobNameThe name of the job.

35


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

|||||

|

|

|

||

35.Jo

bS

tatus

Reso

urce

Mo

del


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Job Status resource model.


Job Names (Jobs) The list of jobs to be monitored. The parameter formatis: [<subsystem library> / ] <subsystem name>,<jobname>,<job user> [,<job number>]

String list


248 Version 5.1.1

|

|||

||

||

||

|||

|

|

|||||

||||

|

Management Central Events ResourceModel

This chapter describes the Management Central Events resource model for OS/400 systems.



Internal name ManagementCentralEvent400

Category OS/400

Thresholds No

Parameters No

Built-in actions No

Clearing events No


Overview


This resource model monitors all Management Central events and forwards them to TEC.This resource model should be distributed to all Management Central central systems thatare actively being managed by Management Central.the network attributes.

Indications and EventsThe following table lists the events that can be generated by the Management Central Eventsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


ManagementCentralUnknown Management Central Unknown Minor 250

ManagementCentralCritical Management Central Critical Critical 250

ManagementCentralWarning Management Central Warning Warning 250

ManagementCentralHarmless Management Central Harmless Harmless 250

36


|

|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

||||

||||

||||

|||||

36.M

anag

emen

tC

entral

Even

tsR

esou

rceM

od

el

Management Central UnknownThis indication is sent when a mangement unknown central event is detected.


event The event.


Setting Default



Occurrences 1

Holes 0

Management Central CriticalThis indication is sent when a mangement critical central event is detected.


event The event.


Setting Default



Occurrences 1

Holes 0

Management Central WarningThis indication is sent when a mangement warning central event is detected.


event The event.


Setting Default



Occurrences 1

Holes 0

Management Central HarmlessThis indication is sent when a mangement harmless central event is detected.


event The event.



250 Version 5.1.1

|

|

|

||

|

|||

||

||

||

|||

|

|

|

||

|

|||

||

||

||

|||

|

|

|

||

|

|||

||

||

||

|||

|

|

|

||

|

Setting Default



Occurrences 1

Holes 0



|||

||

||

||

||

36.M

anag

emen

tC

entral

Even

tsR

esou

rceM

od

el

252 Version 5.1.1

Network Attributes Resource Model

This chapter describes the Network Attributes resource model for OS/400 systems.



Internal name NetworkAttributes400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the network attributes. The user provides one or more networkattribute names along with a corresponding value. During each cycle the resource modelmonitors that the network attribute’s value is equal to its desired value.

Indications and EventsThe following table lists the events that can be generated by the Network Attributes resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


NetworkAttributeMismatch Network Attributes Mismatch Warning 253

Network Attributes MismatchThis indication is sent when the network attribute is not currently set to the desired value.You may need to investigate why the network attribute was changed and whether it shouldbe changed back to the desired value.


37


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

|||||

|

|||

|

37.N

etwo

rkA

ttribu

tesR

esou

rceM

od

el

networkAttributeNameThe name of the network attribute.

expectedValueThe value desired for the network attribute.

valueMetricThe actual value.


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Network Attributes resourcemodel.


Attribute Names(AttributeNames)

The list of network attribute names. The full name mustbe used with no wildcard characters.

String list

Attribute Values(AttributeValues)

The list of network attribute values to be comparedagainst the monitored resource’s value. This parametervalue is associated with the respective attribute name inits parameter list. For example, the first value in thisparameter list is compared against the current value ofthe first attribute in the name list.

String list


254 Version 5.1.1

||

||

||

|

|||

||

||

||

|||

|

||

|||||

|||||

||||||||

|

Output Queues Resource Model

This chapter describes the Output Queue resource model for OS/400 systems.



Internal name OutputQueues400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The Output Queues resource model checks if the output queues and their writers are active.

Indications and EventsThe following table lists the events that can be generated by the Output Queues resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


NoWritersStartedForOutputQueue No Writers Started For OutputQueue

Minor 255

OutputQueueNotActive Output Queue Not Active Minor 256

No Writers Started For Output QueueThis indication is sent when the output queue has one or more jobs waiting, but no writersare started to handle the jobs. You may need to assign a writer or find out if the jobs shouldbe removed.


38


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|

|

|||

|||||

|||||

|||||

|

|||

|

38.O

utp

ut

Qu

eues

Reso

urce

Mo

del

numberOfFilesThe number of files in the queue

numberStartedWritersThe number of writers handling the files

outputQueueNameThe name of the output queue

writerJobStatusThe status of the writer


Setting Default



Occurrences 1

Holes 0

Output Queue Not ActiveThis indication is sent when the output queue has files queued but it is not active. You mayneed to check on why the queue is not active, or why it has files queued.


outputQueueNameThe name of the output queue

currentStatusThe status of the output queue


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Output Queues resourcemodel.


Output Queue Library andName (OutputQueues)

The library and name for the output queues to monitor.The parameter format is ″<library>/<name>″ where bothitems are a maximum 10 characters long and cancontain wildcards ’*’ and ’?’.

String list


256 Version 5.1.1

||

||

||

||

|

|||

||

||

||

|||

|

||

|

||

||

|

|||

||

||

||

|||

|

||

|||||

||||||

|

Parametric Object and File ResourceModel

This chapter describes the Parametric Object and File resource model for OS/400 systems.



Internal name ParametricObjectAndFile400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model allows you to monitor native objects and files for owner, size, andchange date. The object or file can be in the QSYS native or Integrated File System.

Indications and EventsThe following table lists the events that can be generated by the Parametric Object and Fileresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


ObjectOwnerDifferent Object Owner Different Warning 257

LastChangedDateDifferent Last Changed Date Different Warning 258

ObjectSizeExceeded Object Size Exceeded Warning 258

Object Owner DifferentThis indication is sent when the object’s owner does not match the input parameter. Youmay need to investigate why the object owner is not the desired owner.

39


|

|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

||||

||||

|||||

|

||

39.P

arametric

Ob

jectan

dF

ileR

esou

rceM

od

el


objectNameThe name of the object.

objectOwnerThe owner of the object.


Setting Default



Occurrences 1

Holes 0

Last Changed Date DifferentThis indication is sent when the object has changed since the input parameter date. You mayneed to investigate why the object has changed.


lastChangedDateThe date of the last change.



Setting Default



Occurrences 1

Holes 0

Object Size ExceededThis indication is sent when the object size is larger than the threshold value. You may needto investigate why the object is too large.


objectSizeThe size of the object.



Setting Default



Occurrences 1


258 Version 5.1.1

|

||

||

|

|||

||

||

||

|||

|

||

|

||

||

|

|||

||

||

||

|||

|

||

|

||

||

|

|||

||

||

||

Setting Default

Holes 0

ParametersThe following table lists the parameters that can be set for the Parametric Object and Fileresource model.


Object Size (ObjectSize) The size of the object (in bytes) to compare against. Numeric list.

Last Changed Date(LastChangedDate)

The date to compare against. The format isYYYY/MM/DD where YYYY is four digits for the year,MM is two digits for the month, and DD is two digitsfor the day. For example, 2002/01/17 for January 17,2002.

String list.

Fully qualified objectnames (Objects)

Enter one or more fully qualified object or file pathnames. For example, ’/mydir/myfile’ for IFS files, and’/qsys.lib/mylib.lib/myfile.file’ for QSYS objects

String list.

Object Owner(ObjectOwner)

The object owner. Enter the user profile name tocompare against the object’s owner.

String list.



||

|||

|

||

|||||

|||

|||||||

|

|||||

|

|||||

39.P

arametric

Ob

jectan

dF

ileR

esou

rceM

od

el

260 Version 5.1.1

Storage Pools Resource Model

This chapter describes the Storage Pools resource model for OS/400 systems.



Internal name StoragePools400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events No


Overview


The Storage Pools resource model monitors and logs the metrics for storage pools. Thisresource model does not produce events.

ParametersThe following table lists the parameters that can be set for the Storage Pools resource model.


Storage Pool Names(StoragePools)

The names of the storage pools. The names are each amaximum 10 characters long and can contain wildcardscharacters ’*’ and ’?’. The names are system definedand include ’MACHINE’, ’BASE’, ’INTERACT’,’SPOOL’, and ’SHRPOOL1’ through ’SHRPOOL60’.

String list

40


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|

|||||

|||||||

|

|

40.S

torag

eP

oo

lsR

esou

rceM

od

el



StoragePool PerformancestoragePoolName

The name of the storage pool

databaseFaultsThe number of database faults

nonDatabaseFaultsThe number of non database faults

databasePagesThe number of database pages

nonDatabasePagesThe number of non database pages

activeToWaitTransitionsThe number of active to wait transitions

activeToIneligibleTransitionsThe number of active to ineligible transitions

waitToIneligibleTransitionsThe number of wait to ineligible transitions

activityLevelThe activity level

totalSizeMBytesThe total size

Logging

262 Version 5.1.1

|

||

|||

|

||

|

||

|||||

||

||

||

||

||

||

||

||

||

Subsystem Resource Model

This chapter describes the Subsystem resource model for OS/400 systems.



Internal name SubsystemStatus400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model checks the status of a list of subsystems and sends an event if there is asubsystem that is not active.

Indications and EventsThe following table lists the events that can be generated by the Subsystem resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:


SubsystemNotActive Subsystem Not Active Warning 263

Subsystem Not ActiveThis indication is sent when the subsystem is not active.


sbsNameThe name of the subsystem.

41


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

||

|

|||

|||||

|||||

|

|

|

||

41.S

ub

systemR

esou

rceM

od

el


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the Subsystem resource model.


Subsystem Names(Subsystems)

The list of subsystem to be monitored. Enter one ormore Subsystem names. The parameter format is’<library>/<name>’. Both the library and name are amaximum 10 characters long and can contain wildcardcharacters ’*’ and ’?’.

String list


264 Version 5.1.1

|

|||

||

||

||

|||

|

|

|||||

|||||||

|

System Disk Resources Resource Model

This chapter describes the System Disk Resources resource model for OS/400 systems.



Internal name SystemDiskResources400

Category OS/400

Thresholds Yes

Parameters No

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the overall system resources for system and ASP utilization.

Indications and EventsThe following table lists the events that can be generated by the System Disk Resourcesresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:


TotalAuxiliaryStorageReachedPeakCapacityGuidelines

Total Auxiliary Storage ReachedPeak Capacity Guidelines

Warning 266

SystemASPUsedNearPeak System ASP Used Near PeakCapacity Guidelines

Warning 266

TotalAuxiliaryStorageReachedCapacityGuidelinesTotal Auxiliary Storage ReachedCapacity Guidelines

Warning 267

42


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|

|

|||

|||||

||||||

|||||

|||||

|

42.S

ystemD

iskR

esou

rcesR

es.M

od

el

Total Auxiliary Storage Reached Peak Capacity GuidelinesThis indication is sent when the total auxiliary storage has reached peak capacity guidelinesfor percent used. The percent used has remained above the threshold value for several hours.You should consider adding auxiliary storage to the system, or archiving or removing objectsthat are no longer needed.


TotalAuxiliaryStorageAvailablePercentThe percent value of total auxiliary storage.



Total Auxiliary StorageAvailable Peak Threshold

If this threshold is exceeded, the total auxiliary storageusage has reached peak capacity guidelines.

90


Setting Default



Occurrences 8

Holes 0

System ASP Used Near Peak Capacity GuidelinesThis indication is sent when the system ASP is nearing its peak capacity guidelines forpercent used. The percent used has remained above the threshold value for several hours.You should consider adding storage to the system ASP, or archiving or removing objects thatare no longer needed.


systemASPUsedPctThe percent value of used System ASP.



System ASP Used PercentThreshold

If this threshold is exceeded, the System is nearingpeak capacity guidelines.

90


Setting Default



Occurrences 4

Holes 0


266 Version 5.1.1

|

||||

|

||

|

||||

|||||

|

|

|||

||

||

||

|||

|

||||

|

||

|

||||

|||||

|

|

|||

||

||

||

|||

Total Auxiliary Storage Reached Capacity GuidelinesThis indication is sent when the the total auxiliary storage has reached capacity guidelinesfor percent used. The percent used has remained above the threshold value for several hours.You should consider adding auxiliary storage to the system, or archiving or removing objectsthat are no longer needed.


TotalAuxiliaryStorageAvailablePercentThe percent value of total auxiliary storage.



Total Auxiliary StorageAvailable Threshold

If this threshold is exceeded, the total auxiliary storageusage has reached capacity guidelines.

80


Setting Default



Occurrences 30

Holes 2



Disk Utilizationspare

systemASPusedPctThe percent value of used system ASP

totalAuxiliaryStorageAvailablePercentageThe percent value of total auxiliary storage



|

||||

|

||

|

||||

|||||

|

|

|||

||

||

||

|||

|

||

|||

|

||

|

||

||||

||

||

42.S

ystemD

iskR

esou

rcesR

es.M

od

el

268 Version 5.1.1

System Value Resource Model

This chapter describes the System Value resource model for OS/400 systems.



Internal name SystemValue400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


The user inputs one or more system value names along with a corresponding value as itsdesired value. Then in each cycle this resource model checks if the system value’s value isequal to the desired value.

Indications and EventsThe following table lists the events that can be generated by the System Value resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


SystemObjectMismatch System Object Mismatch Warning 269

System Object MismatchThis indication is sent when the system value is not set to the desired value. You may needto investigate why the system value was changed and whether it should be changed back tothe desired value.

This indication has the following attributes:

43


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|||

|

|||

|||||

|||||

|

|||

|

43.S

ystemV

alue

Reso

urce

Mo

del

systemValueNameThe name of the system value.

valueMetricThe metric of the value.

expectedValueThe desired value.


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the System Value resource model.


System Value Names(SystemValues)

The System Value names to be monitored. The fullSystem Value name must be entered with no wildcardcharacters.

String list

System Value Values(SystemValueValues)

Values to be used to verify the contents of a specificSystem Value. These entries must be in the same orderas their respective System Value name parameters.

String list


270 Version 5.1.1

||

||

||

|

|||

||

||

||

|||

|

|

|||||

|||||

|

|||||

|

TCP Interface Resource Model

This chapter describes the TCP Interface resource model for OS/400 systems.



Internal name TCPInterface400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the status of one or more TCP interface.

Indications and EventsThe following table lists the events that can be generated by the TCP Interface resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


TCPInterfaceNotActive TCP Interface Not Active Warning 271

TCP Interface Not ActiveThis indication is sent when the TCP Interface is not active. You may need to investigatewhy the interface was not started or has ended.


interfaceNameThe interface name.

44


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|

|

|||

|||||

|||||

|

||

|

||

44.T

CP

Interface

Reso

urce

Mo

del


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the TCP Interface resourcemodel.


TCP IP Interfaces(TCPIPInterfaces)

The list of TCP IP interfaces to be monitored. Theaddress can be an IP address or host name (e.g. 9.5.1.2or david.mycompany.com). No wildcards are allowed inthe parameter. The user may optionally enter the numberof seconds to delay waiting for the connection torespond. This is separated by a comma from the TCPaddress. If not entered the default wait time is 3seconds. (e.g. 127.0.0.1,3)

String list


272 Version 5.1.1

|

|||

||

||

||

|||

|

||

|||||

||||||||||

|

TCP Service Resource Model

This chapter describes the TCP Service resource model for OS/400 systems.



Internal name TCPService400

Category OS/400

Thresholds No

Parameters Yes

Built-in actions No

Clearing events Yes


Overview


This resource model monitors the TCP service.

Indications and EventsThe following table lists the events that can be generated by the TCP Service resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:


TCPServiceNotActive TCP Service Not Active Warning 273

TCP Service Not ActiveThis indication is sent when the TCP Service is not active. You may need to investigate whythe service was not started or has ended.


serviceNameThe service name.

45


|

|

|

|

||

||

||

||

||

||

||

|||

|

|||||

|

|

|||

|||||

|||||

|

||

|

||

45.T

CP

Service

Reso

urce

Mo

del


Setting Default



Occurrences 1

Holes 0

ParametersThe following table lists the parameters that can be set for the TCP Service resource model.


TCP IP Services(TCPIPServices)

The list of TCP address and service name separated by acomma. The TCP address can be an IP address or hostname (e.g. david.mycompany.com or 9.5.1.2). Theservice name can be a number (port number) or the fullservice name. No wildcards are allowed in either item.

String list


274 Version 5.1.1

|

|||

||

||

||

|||

|

|

|||||

|||||||

|

Part IV. Appendixes


276 Version 5.1.1

Return Codes for Built-in Actions(Windows)

This appendix describes the return codes for built-in actions for resource models running onWindows systems.

The following table lists the return codes by category:

Return Code Category See Page

Common to all built-in actions 277

Built-in actions of the Event Log resource model only 278

Built-in actions of the Network Interface Card resource model only 279

Built-in actions of the Service resource model only 280

All Built-in ActionsThe return codes common to all built-in actions are as follows:

RETURN CODE 99It was not possible to get the definition of the output parameters of the calledmethod.

RETURN CODE 98It was not possible to spawn an instance of the output parameters of the calledmethod. This might be because there is not enough memory.

RETURN CODE 97The called method is not implemented by this method provider.

RETURN CODE 9The resource model does not implement this method.

A


A.

Retu

rnC

od

esfo

rB

uilt-in

Actio

ns

(Win

do

ws)

Built-in Actions of the Event Log Resource ModelThe Event Log resource model has the following built-in actions:

¶ EnlargeIRPStackSize action

¶ DeleteRegistry action

¶ RaiseSessTimeOut action

Enlarge IRP Stack Size ActionThe return codes specific to the EnlargeIRPStackSize built-in action of the Event Logresource model are as follows:

RETURN CODE 0The action has been successfully executed.

RETURN CODE 1An error occurred while accessing the system registry.

RETURN CODE 2The registry key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\IRPStackSize wasnot updated because its value is already greater than 12 (its suggested value).

Delete Registry ActionThe return codes specific to the DeleteRegistry built-in action of the Event Log resourcemodel are as follows:


Raise Session Time Out ActionThe return codes specific to the RaiseSessTimeOut built-in action of the Event Log resourcemodel are as follows:


RETURN CODE 1The registry key: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SessTimeOut was not updated because its value is already greater than 70 (itsmaximum suggested value).

RETURN CODE 2The registry key: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SessTimeOut was not found in the registry, it has been created and its value hasbeen set to 55.

Built-in Actions of the Event Log Resource Model

278 Version 5.1.1

Built-in Actions of the Network Interface Card Resource ModelThe Network Interface Card resource model has the following built-in actions:

¶ AdjustInitWorkItems action

¶ AjustMaxWorkItems action

Adjust Initial Work Items ActionThe return codes specific to the AdjustInitWorkItems built-in action of the Network InterfaceCard resource model are as follows:


RETURN CODE 1The registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\InitWorkItems was set to a value that is alreadygreater than the suggested value.

Adjust Maximum Work Items ActionThe return codes specific to the AdjustMaxWorkItems built-in action of the NetworkInterface Card resource model are as follows:


RETURN CODE 1The registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\MaxWorkItems was set to a value that is alreadygreater than the suggested value.

Built-in Actions of the Network Interface Card Resource Model


A.

Retu

rnC

od

esfo

rB

uilt-in

Actio

ns

(Win

do

ws)

Built-in Actions of the Service Resource ModelThe Service resource model has only one built-in action, the RestartService action.

Restart Service ActionThe return codes specific to the RestartService built-in action of the Service resource modelare as follows:


RETURN CODE 1An error occurred while retrieving the input parameters.

RETURN CODE 2Wrong type of Input Parameters.

RETURN CODE 3Unable to open the service control manager.

RETURN CODE 4Unable to open the service. This might be because the service does not exist on thetarget machine.

RETURN CODE 5Unable to query the status of the service.

RETURN CODE 6It was not possible to start the service. This might be because some serviceprerequisites have not been met.

RETURN CODE 7It was not possible to start the service. This might be because the service iscorrupted.

RETURN CODE 8It was not possible to restart the service. This might be because some serviceprerequisites have not been met.

Built-in Actions of the Service Resource Model

280 Version 5.1.1

Correlated Events (Windows)

This appendix describes all correlated events and the indications from which each one isgenerated. Correlated events are only generated for Windows resource models.

The following table lists the correlated events:

Correlated Event See Page

Busy Drive from High Paging 282

Busy Drive from Low Avail 283

Congested TCP Network 284

Critically Low Disk Space 285

Critical Memory Leak 286

Faulty Disk Subsystem 287

High Disk Read Bytes per Second 288

High Disk Write Bytes per Second 289

High Drive Transfer Rate 290

High Percent Disk Time 291

Possible Disk Fragmentation 292

Process Hogging CPU 293

Slow Hard Drive 294

B


B.

Co

rrelatedE

vents

(Win

do

ws)

Busy Drive from High PagingThe TMW_BusyDriveFromPaging indication is generated from the following indications:

¶ TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource model

¶ TMW_HighPaging indication from the Memory resource model

This event is generated when it is determined that the local logical disk is busy which ismost likely being caused by excessive hard page faulting.

TMW_BusyDriveFromPaging has the following event properties:

Disk The logical disk being analyzed

PercentDiskTime The percentage usage of the logical drive

PagesSec The number of pages per second

TotalAvail The total of available memory in bytes

TotalWorkingSet The total working set size in bytes

TotalCache The total cache size in bytes

Severity The default value is warning

Busy Drive from High Paging

282 Version 5.1.1

Busy Drive from Low AvailThe TMW_BusyDriveFromLowAvail indication is generated from the following indications:

¶ TMW_LowAvailCausingManyProblems indication from the Memory resource model


This event is a relatively serious event because it indicates not only that the local disk isunusually busy, but also that memory is low, paging is high, and the page file is changing.This combination will ultimately cause a core dump if left unchecked.

TMW_BusyDriveFromLowAvail has the following event properties:

Disk The logical disk that is being analyzed

PercentDiskTime The percentage usage of the logical drive


PageFaultsSec The current value for page faults per second

PagesSec The current value of pages per second

CommittedBytes The current total of committed bytes

CommittedLimit The upper limit of the committed bytes

Severity The default value is critical

Busy Drive from Low Avail


B.

Co

rrelatedE

vents

(Win

do

ws)

Congested TCP NetworkThe TMW_CongestedTCPNetwork indication is generated from the following indications:

¶ TMW_NICOverworked indication from the NIC resource model

¶ TMW_SegmentsReXmit indication from the TCP/IP resource model

This indicates that the TCP/IP network segment that the originating machine is on may becongested. Congested TCP Network is generated when an indication of an overworked NICand a high amount of retransmitted segments are sent.

TMW_CongestedTCPNetwork has the following event properties:

NetworkInterface The identity of network interface card being examined

SegmentsReXmitSec The number of segments retransmitted per second

DGSec The number of datagrams transmitted per second

SegmentsSec The number of segments being sent per second

FragsToDGRatio Ratio of fragmented datagrams to total datagrams

OuputQueueLength The length of the output queue

NICBPS The bytes per second transferred through the networkinterface card

CurrentBandWidth The bandwidth of the network interface card


Congested TCP Network

284 Version 5.1.1

Critically Low Disk SpaceThe TMW_CriticallyLowDiskSpace indication is generated from the following indications:

¶ TMW_LowAvailCausingSoftPagePagefileResize indication from the Memory resourcemodel

¶ TMW_LowLogicalDiskSpace indication from the Logical Disk resource model

This indicates that disk space is low, and it may soon come into demand. If the systemneeds additional space to resize a pagefile, and the logical disk where the pagefile resides islow on space, a core dump may occur.

TMW_CriticallyLowDiskSpace has the following event properties:

Disk The logical disk that is being analyzed

PercentFreeSpace The percentage amount of free space on the logical drive

FreeMB The actual size of free space on the logical drive inMegabytes

CommittedBytes The current total of Committed Bytes

CommittedLimit The upper limit of the Committed Bytes


PageFaultsSec The current value for page faults per second


Critically Low Disk Space


B.

Co

rrelatedE

vents

(Win

do

ws)

Critical Memory LeakThe TMW_CriticalMemoryLeakInWS indication is generated from the following indications:

¶ TMW_MemoryLeakInPB indication from the Memory resource model

¶ TMW_LowAvailHighWS indication from the Memory resource model

A memory leak together with an indication of low available memory due to a high workingset will generate this event. This indicates that not only is memory low, but it is also beingconsumed and will soon run out.

TMW_CriticalMemoryLeakInWS has the following event properties:

LeakyProcess The process with the memory leak

IDLeakyProcess The numeric ID of the process with the memory leak

CurrentWorkingSet The current working set of the process

CurrentPrivateBytes The current private bytes of the process


TotalWorkingSet The total working set size in bytes

TotalCache The total cache size in bytes

PercentAvail The percentage of available memory in comparison to thesize of the working set and the cache

PercentWS The percentage of working set memory in comparison to thesize of available memory and the cache

PercentCache The percentage of cache memory in comparison to the sizeof the working set and the available memory

IDHighWSProcess The numeric ID of the process with the highest working set

NumProcesses The total number of processes

HighWSProcess The working set of the process with the highest working set


Critical Memory Leak

286 Version 5.1.1

Faulty Disk SubsystemThe TMW_FaultyDiskSubsystem indication is generated from the following indications:

¶ TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource model

¶ TMW_BusyHardware indication from the Processor resource model


A faulty disk subsystem event is generated when a disk is very busy both in terms of justitself and how busy it is keeping the CPU. Sometimes, as in the case of major file servers,this can be expected. However, for most machines, an extremely busy drive over anextended period of time indicates a disk or controller is failing.

TMW_FaultyDiskSubsystem has the following event properties:

LogicalDisk The logical disk that is being analyzed

PhysicalDisk The physical disk that is being analyzed

LogicalPercentDiskTime The percentage usage of the logical drive

PhysicalPercentDiskTime The percentage usage of the physical drive

Processor The identity of the CPU

PercentProcessorTime The current percentage use of the CPU

PercentInterruptTime The current percentage usage of the CPU as it handlesinterrupt requests

InterruptsSec The number of interrupts per second that are passed to theCPU


Faulty Disk Subsystem


B.

Co

rrelatedE

vents

(Win

do

ws)

High Disk Read Bytes per SecondThe TMW_HighDiskReadBytesSec indication is generated from the following indications:

¶ TMW_HighPhysicalDiskReadBytesSec indication from the Physical Disk resource model

¶ TMW_HighLogicalDiskReadBytesSec indication from the Logical Disk resource model

This correlation is generated when a high read bytes per second is indicated in both thelogical drive and the physical drive. This usually indicates that bytes per second read fromthe physical drive is high.

TMW_HighDiskReadBytesSec has the following event properties:


PhysicalDisk The physical disk on which the logical disk resides

LogicalDiskReadBytes The number of bytes read per second on the logical disk

PhysicalDiskReadBytesSec The number of bytes read per second on the physical disk

LogicalDiskReadSec The number of read transactions per second on the logicaldisk

PhysicalDiskReadSec The number of read transactions per second on the physicaldisk

LogicalPercentDiskRead The percentage usage of the logical drive during a readoperation

PhysicalPercentDiskRead The percentage usage of the physical drive during a readoperation


High Disk Read Bytes per Second

288 Version 5.1.1

High Disk Write Bytes per SecondThe TMW_HighDiskWriteBytesSec indication is generated from the following indications:

¶ TMW_HighLogicalDiskWriteBytesSec indication from the Logical Disk resource model

¶ TMW_HighPhysicalDiskWriteBytesSec indication from the Physical Disk resource model

This correlation is generated when a high write bytes per second is indicated in both thelogical drive and physical drive. This usually indicates that bytes per second written to thephysical drive is high.

TMW_HighDiskWriteBytesSec has the following event properties:



LogicalDiskWriteBytesSec The number of bytes read per second on the logical disk

PhysicalDiskWriteBytesSec The number of bytes read per second on the physical disk

LogicalDiskWriteSec The number of read transaction per second on the logicaldisk

PhysicalDiskWriteSec The number of read transaction per second on the physicaldisk

LogicalPercentDiskWrite The percentage usage of the logical drive during a writeoperation

PhysicalPercentDiskWrite The percentage usage of the physical drive during a writeoperation


High Disk Write Bytes per Second


B.

Co

rrelatedE

vents

(Win

do

ws)

High Drive Transfer RateThe TMW_HighDriveXferRate indication is generated from the following indications:

¶ TMW_HighLogicalDiskXferRate indication from the Logical Disk resource model

¶ TMW_HighPhysicalDiskXferRate indication from the Physical Disk resource model

This correlation is generated when a high read and written bytes per second is indicated inboth the logical drive and physical drive. This usually indicates that bytes per secondtransferred through the physical drive is high.

TMW_HighDriveXferRate has the following event properties:

LogicalDisk The logical disk that is being analyzed.

PhysicalDisk The physical disk on which the logical disk resides.

LogicalDiskXfersSec The rate of bytes transmitted (read or write) per second onthe logical disk.

PhysicalDiskXfersSec The rate of bytes transmitted (read or write) per second onthe physical disk.

LogicalPercentDiskReadTimeThe percentage usage of the logical drive during a readoperation.

PhysicalPercentDiskReadTimeThe percentage usage of the physical drive during a readoperation.

Severity The default value is warning.

High Drive Transfer Rate

290 Version 5.1.1

High Percent Disk TimeThe TMW_HighPercentDiskTime indication is generated from the following indications:

¶ TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource model


This correlation is generated when a high percentage disk time is indicated in both thelogical drive and physical drive. A busy physical disk is the most likely cause.

TMW_HighPercentDiskTime has the following event properties:

LogicalDisk The logical disk that is being analyzed.

PhysicalDisk The physical disk on which the logical disk resides.

LogicalPercentDiskTime The percentage usage of the logical drive.

PhysicalPercentDiskTime The percentage usage of the physical drive.

LogicalPercentReadTime The percentage usage of the logical drive during a readoperation.

PhysicalPercentReadTime The percentage usage of the physical drive during a readoperation.

LogicalPercentWriteTime The percentage usage of the logical drive during a writeoperation.

PhysicalPercentWriteTime The percentage usage of the physical drive during a writeoperation.

Severity The default value is warning.

High Percent Disk Time


B.

Co

rrelatedE

vents

(Win

do

ws)

Possible Disk FragmentationThe TMW_PossibleFrag indication is generated from the following indications:

¶ TMW_LogicalPossibleFrag indication from the Logical Disk resource model

¶ TMW_PhysicalPossibleFrag indication from the Physical Disk resource model

This correlation is generated when a possible fragmentation is indicated in both the logicaldrive and physical drive. It signifies that there is possibly some fragmentation on thephysical drive.

TMW_PossibleFrag has the following event properties:


PhysicalDisk The physical disk that is being analyzed

LogicalPercentDiskTime The percentage usage of the logical disk

PhysicalPercentDiskTime The percentage usage of the physical disk

LogicalDiskBytesSec The transfer rate (both read and write) per second of logicaldisk

PhysicalDiskBytesSec The transfer rate (both read and write) per second ofphysical disk

Severity The default value is minor

Possible Disk Fragmentation

292 Version 5.1.1

Process Hogging CPUThe TMW_ProcessHoggingCPU indication is generated from the following indications:

¶ TMW_HighProcesses indication from the Processor resource model

¶ TMW_ProcessHighCPU indication from the Process resource model

This indication is generated when CPU has a high percentage utilization and one or moreprocesses use an unusually high percentage of CPU.

TMW_ProcessHoggingCPU has the following event properties:

Process The name of the active process with the highest CPU usage.

IDProcess The process identity (pid) of the active process with thehighest CPU usage.

Processor The CPU being examined.

PercentProcessorTime The total percentage usage of the CPU.

PrcPercentUserTime The percentage usage of the CPU that is being used by theprocess.

PrcPercentPriviledgedTime The percentage privileged time of the CPU that is being usedby the process.

PrcPriorityBase The base priority of the process.

Severity The default value is critical.

Process Hogging CPU


B.

Co

rrelatedE

vents

(Win

do

ws)

Slow Hard DriveThe TMW_SlowHardDrive indication is generated from the following indications:

¶ TMW_SlowPhysicalDrive indication from the Physical Disk resource model

¶ TMW_SlowLogicalDrive indication from the Logical Disk resource model

This correlation is generated when a slow drive is indicated in both the logical drive and thephysical drive. In this situation, the physical hard drive is possibly too slow.

TMW_SlowHardDrive has the following event properties:



CurrentLogicalQLength The current queue length for the logical disk

CurrentPhysicalQLength The current queue length for the physical disk

PercentLogicalDiskTime The percentage usage of the logical disk

PercentPhysicalDiskTime The percentage usage of the physical disk


Slow Hard Drive

294 Version 5.1.1

Glossary

A

Adapter Configuration Facility. In the Tivoli EnterpriseConsole, a graphical user interface that enables a Tivoliadministrator to easily configure and customize event adapters.

C

cache. A buffer storage that contains frequently accessedinstructions and data; it is used to reduce access time.

configuration file. A file that specifies the characteristics of asystem device or network.

D

data view. In IBM Tivoli Monitoring, a way of displayingdata in the Web Health Console.

database browser. In IBM Tivoli Monitoring, the Web HealthConsole component that provides hierarchical access toinformation about current resource problems. This informationcan come from any endpoint to which the Web Health Consolehas access, and it might pertain to any resource model installedon that endpoint. See also Web Health Console and resourcemodel.

default policy. In a Tivoli environment, a set of resourceproperty values that are assigned to a resource when theresource is created.

defragmentation. The process of running a software utility torewrite fragmented data to contiguous sectors of a computerstorage medium to improve access and retrieval time.

Desktop Management Task Force (DMTF). An alliance ofcomputer vendors that was convened to define streamlinedmanagement of the diverse operating systems commonly foundin an enterprise.

E

endpoint. In a Tivoli environment, a Tivoli client that is theultimate recipient for any type of Tivoli operation.

event. In a Tivoli environment, any significant change in thestate of a system resource, network resource, or networkapplication. An event can be generated for a problem, for theresolution of a problem, or for the successful completion of atask. Examples of events are the normal starting and stoppingof a process, the abnormal termination of a process, and themalfunctioning of a server. See also indication.

event class. In the Tivoli Enterprise Console, a classificationfor an event that indicates the type of information that the eventadapter will send to the event server.

F

fragmentation. An operating system’s process of writingdifferent parts of a file to discontiguous sectors on a computerstorage medium when contiguous space that is large enough tocontain the entire file is not available. When data is thusfragmented, the time that it takes to access the data mayincrease because the operating system must search differenttracks for information that should be in one location.

G

gateway. In a Tivoli environment, software running on amanaged node that provides all communication servicesbetween a group of endpoints and the rest of the Tivolienvironment. This gateway includes the multiplexed distribution(MDist) function, enabling it to act as the fanout point fordistributions to many endpoints.

H

Web Health Console. In IBM Tivoli Monitoring, a componentthat displays real-time and historical data for any resourcemodel at any endpoint. Using the graphical user interface, userscan locate individual problems associated with one or moreresources. The status is displayed as a value between 0(representing an identified problem, that is, an event) and 100(representing no recent indications). Users can select views ofresource problems as tabular data, different types of charts, andso on.

I

IBM Tivoli Monitoring. A Tivoli application that appliespreconfigured, automated best practices to the automatedmonitoring of essential system resources. The applicationdetects bottlenecks and other potential problems and providesfor the automatic recovery from critical situations, whicheliminates the need for system administrators to manually scanthrough extensive performance data. The application alsointegrates seamlessly with other Tivoli Availability solutions,including the Tivoli Business Systems Manager and the TivoliEnterprise Console. Previously called Tivoli DistributedMonitoring (Advanced Edition).

indication. An entity triggered by the occurrence of a problemin an endpoint relating to one or more resources. Indications areconsolidated into events within the endpoint being monitored.See also event.

installation repository (IR). In Tivoli Software InstallationService (SIS), the directory that contains reusable installationimages and other data that is used by SIS.


Glo

ssary

M

managed node. In a Tivoli environment, any managedresource on which the Tivoli Management Framework isinstalled.

monitoring collection. In IBM Tivoli Monitoring, a collectionof predefined monitors. Several monitoring collections arepackaged with IBM Tivoli Monitoring, but Tivoli administratorscan also use custom-developed and third-party monitoringcollections. See also custom monitor.

O

object. In object-oriented design or programming, a concreterealization of a class that consists of data and the operationsassociated with that data.

P

policy region. In a Tivoli environment, a group of managedresources that share one or more common policies. Tivoliadministrators use policy regions to model the management andorganizational structure of a network computing environment.The administrators can group similar resources, define access toand control the resources, and associate rules for governing theresources.

policy subregion. In a Tivoli environment, a policy regioncreated or residing in another policy region. When a policysubregion is created, it initially uses the resource and policyproperties of the parent policy region. The Tivoli administratorcan later change or customize these properties to reflect thespecific needs and differences of the subregion.

profile. In a Tivoli environment, a container forapplication-specific information about a particular type ofresource. A Tivoli application specifies the template for itsprofiles; the template includes information about the resourcesthat can be managed by that Tivoli application. A profile iscreated in the context of a profile manager; the profile managerlinks a profile to the Tivoli resource (for example, a managednode) that uses the information contained in the profile. Aprofile does not have any direct subscribers.

profile manager. In a Tivoli environment, a container forprofiles that links the profiles to a set of resources, calledsubscribers. Tivoli administrators use profile managers toorganize and distribute profiles. A profile manager is created inthe context of a policy region and is a managed resource in apolicy region.

R

reference model. In the context of Tivoli software, the modelconfiguration for a system or set of systems that is used tomaintain consistent configurations in a distributed environment.In Tivoli Inventory, reference models are created in theconfiguration repository.

resource. In IBM Tivoli Monitoring context, a resource isanything that affects the operation of the system and includesphysical and logical disks, CPUs, memory, printers, as well asthe processes running, services, such as LanMan and theWindows event log, and TCP/IP.

resource model. In IBM Tivoli Monitoring, the logicalmodeling of one or more resources, along with the logic onwhich cyclical data collection, data analysis, and monitoring arebased. Related events and actions are triggered, if required. Forany resource model, users can specify individual thresholds andevent aggregation rules. See also event.

rule base. In the Tivoli Enterprise Console, one or more rulesets and the event class definitions for which the rules arewritten. The Tivoli Enterprise Console uses the rule base inmanaging events. An organization can create many rule bases,with each rule base fulfilling a different set of needs fornetwork computing management.

S

Software Installation Service (SIS). A Tivoli product thatprovides an easy-to-use, efficient interface for installing TivoliEnterprise™ software. SIS uses Tivoli’s MDist technology andprovides automated checking for prerequisite software, areusable repository of installation images, and both graphicaland command line interfaces for deploying Tivoli products to alarge number of computers.

subscriber. In a Tivoli environment, a managed node, aprofile manager, an endpoint, or another Tivoli client that issubscribed to a profile manager. Although profiles aredistributed to a subscriber, the subscriber may or may not bethe final destination of the profile distribution.

T

task library. In a Tivoli environment, a container in which aTivoli administrator can create and store tasks and jobs.

threshold. (1) In software products, a value that defines alimit for a monitored condition. (2) In IBM Tivoli Monitoring,a threshold is a named property with a user-defined value.Typically, the value specified for a threshold represents asignificant level of a performance-related entity, which, ifexceeded, a system administrator might want to know about.

Tivoli Distributed Monitoring. Previous name of TivoliDistributed Monitoring (Classic Edition).

Tivoli Distributed Monitoring (Advanced Edition). Previousname of IBM Tivoli Monitoring.

Tivoli Distributed Monitoring (Classic Edition). A Tivoliapplication that provides distributed monitors for monitoringsystem resources. The application initiates necessary correctiveactions and informs system administrators of potentialproblems. These monitors can be centrally configured anddeployed to monitor individual machines. The application also

managed node • Tivoli Distributed Monitoring (Classic Edition)

296 Version 5.1.1

integrates seamlessly with other Tivoli Availability solutions,including the Tivoli Enterprise Console. Previously called TivoliDistributed Monitoring.

Tivoli Enterprise Console. A Tivoli product that collects,processes, and automatically initiates corrective actions forsystem, application, network, and database events; it is thecentral control point for events from all sources. The TivoliEnterprise Console provides a centralized, global view of thenetwork computing environment; it uses distributed eventmonitors to collect information, a central event server toprocess information, and distributed event consoles to presentinformation to system administrators.

Tivoli environment. The Tivoli applications, based upon theTivoli Management Framework, that are installed at a specificcustomer location and that address network computingmanagement issues across many platforms. In a Tivolienvironment, a system administrator can distribute software,manage user configurations, change access privileges, automateoperations, monitor resources, and schedule jobs.

Tivoli management agent. In the Tivoli environment, anagent that securely performs administrative operations.

Tivoli Management Framework. The base software that isrequired to run the applications in the Tivoli product suite. Thissoftware infrastructure enables the integration of systemsmanagement applications from Tivoli Systems Inc. and theTivoli Partners. In a Tivoli environment, the Tivoli ManagementFramework is installed on every client and server; however, theTMR server is the only server that holds the full objectdatabase.

Tivoli management region. In a Tivoli environment, a Tivoliserver and the set of clients that it serves. An organization canhave more than one Tivoli management region. A Tivolimanagement region addresses the physical connectivity ofresources whereas a policy region addresses the logicalorganization of resources.

Tivoli Enterprise Console • Tivoli management region


Glo

ssary

Glossary

298 Version 5.1.1

Index

Aaccount not valid for root indication 195account not valid for root problem 191actions, built-in (Windows)

adjust initial work items 65, 279adjust maximum work items 65, 279common 277delete registry 278delete registry key shares 12description 277enlarge IRP stack size 11, 278Event Log resource model 11, 278Network Interface Card resource model 65, 279raise session timeout 12, 278restart service 123, 280Services resource model 123, 280

adjust initial work items action 65, 279adjust maximum work items action 65, 279adjust work items indication 47alternative groups parameter 198alternative owners parameter 198ASP Disk Mirroring resource model

description 209indications 209mirroring not active indication 210parameters 211

ASP nearing capacity indication 214ASP overflow indication 215ASP Utilization

resource modeldescription 213

ASP Utilization resource modelASP nearing capacity indication 214ASP overflow indication 215indications 213logging 216parameters 216

available disk space configuration parameter 116available file system space configuration parameter 202available space threshold 148, 151

BBasic CPU Utilization


Basic CPU Utilization Guideline Exceeded indication 219Basic CPU Utilization GuidelineLong Running Exceeded

indication 218Basic CPU Utilization Peak Exceeded indication 220Basic CPU Utilization Peak Long Running Exceeded

indication 218

Basic CPU Utilization resource modelBasic CPU Utilization Guideline Exceeded indication 219Basic CPU Utilization Guideline Long Running Exceeded

indication 218Basic CPU Utilization Peak Exceeded indication 220Basic CPU Utilization Peak Long Running Exceeded

indication 218indications 217logging 221

Basic Interactive CPU Utilizationresource model

description 223Basic Interactive CPU Utilization Guideline Exceeded

indication 225Basic Interactive CPU Utilization Peak Exceeded

indication 226Basic Interactive CPU Utilization resource model

Basic Interactive CPU Utilization Guideline Exceededindication 225

Basic Interactive CPU Utilization Peak Exceededindication 226

indications 223logging 227

booksfeedback xxonline xxordering xx

broadcast frames problem 45browser threshold 122built-in actions (Windows)

adjust initial work items 279adjust maximum work items 279common 277decription 277delete registry 278enlarge IRP stack size 278Event Log resource model 278Network Interface Card resource model 279raise session timeout 278restart service 280Services resource model 280

busy drive from high paging correlated event 282busy drive from low avail correlated event 283busy hardware indication 107bytes transferred per second problem 13, 79

Ccache problem 23client connectivity problems 7committed bytes problem 24computers parameter 70


Ind

ex

Configuration object not active indication 229Configuration Objects


Configuration Objects resource modelConfiguration object not active indication 229indications 229parameters 230

congested TCP network correlated event 284correlated events

busy drive from high paging 282busy drive from low avail 283congested TCP network 284critical memory leak 286critically low disk space 285description 281faulty disk subsystem 287high disk read bytes per second 288high disk write bytes per second 289high drive transfer rate 290high percent drive time 291possible disk fragmentation 292process hogging CPU 293slow hard drive 294

CPU cannot keep up with hardware indication 108CPU resource model

description 135high CPU overload indication 136high CPU usage by system indication 137indications 135logging 138percentage of CPU in idle threshold 136, 138percentage of CPU used by system threshold 137, 138thresholds 138

critical memory leak correlated event 286critically low disk space correlated event 285Customer Support xxii

DDatabase CPU Utilization


Database CPU Utilization Exceeded indication 231Database CPU Utilization resource model

Database CPU Utilization Exceeded 231indications 231logging 232

defined users parameter 198delete registry action 278delete registry key shares action 12detection of malfunctioning devices problem 7directory names, notation xxiiidisk fragmentation (possible) correlated event 292disk space problem 13Distribution Queues


Distribution Queues resource modelHigh priority distribution queue not active indication 234indications 233Normal priority distribution queue not active

indication 234parameters 234

DMXCpu resource model 135DMXFile resource model 141DMXFileSystem resource model 147DMXMemory resource model 153DMXNetworkInterface resource model 159DMXNetworkRPCNFS resource model 169DMXProcess resource model 183DMXSecurity resource model 191DMXSpp resource model 201duplicate account indication 192

Ee-mail contact xxiienlarge IRP stack size action 11, 278environment variables, notation xxiiievent ID 11 indication 8event ID 15 indication 9event ID 2011 indication 9event ID 2511 indication 9event ID 3013 indication 10event ID 7023 indication 10event ID 9 indication 8event IDs parameter 69Event Log resource model

actions 11built-in actions 278client connectivity problems 7delete registry action 278delete registry key shares action 12description 7detection of malfunctioning devices problem 7enlarge IRP stack size action 11, 278event ID 11 indication 8event ID 15 indication 9event ID 2011 indication 9event ID 2511 indication 9event ID 3013 indication 10event ID 7023 indication 10event ID 9 indication 8indication properties 11indications 8problems highlighted 7raise session timeout action 12, 278server connectivity problems 7thresholds 11

event severity parameter 69EventLog threshold 122events, correlated (Windows) 281excessive page faults threshold 44excessive paging threshold 29, 30, 44

300 Version 5.1.1

Ffaulty disk subsystem correlated event 287feedback about publications xxiifile attributes changed indication 143file changed indication 142file not present indication 144File resource model

description 141file attributes changed indication 143file changed indication 142file not present indication 144file to be checked parameter 145, 151ignored file system parameter 151indications 141logging 145parameters 145

File System resource modelavailable space threshold 148, 151description 147fragmented file system indication 149indications 147logging 152low percent space available indication 148low percentage of available I-nodes indication 150low space available indication 148parameters 151percent available space threshold 148, 151percentage of available I-nodes threshold 150, 151percentage of file system space used threshold 149, 151percentage of I-nodes used threshold 149, 151thresholds 151

file to be checked parameter 145, 151files to be monitored parameter 198filter type parameter 70fragmented data problem 125fragmented file system indication 149

Hhandle leaks problem 101hardware keeping CPU busy indication 109high broadcast frames indication 48high bytes per second threshold 22, 81, 82, 83, 84, 85, 86, 87high CPU overload indication 136high CPU usage by system indication 137high CPU usage indication 103, 104high CPU usage interrupt threshold 107, 108, 109, 111, 113high CPU usage problem 101, 105high CPU usage process threshold 111, 112, 113high CPU usage threshold 107, 108, 109, 111, 112, 113high CPU usage user privilege threshold 113high current commands indication 49high current commands modifier threshold 49, 55, 56, 58, 61,

64high current percent time indication 91high disk read bytes per second correlated event 288high disk write bytes per second correlated event 289high drive transfer rate correlated event 290high duplicate RPC server calls indication 175

high errored out ratio threshold 50, 64high errored ratio indication 50high fragment ratio indication 127high fragment ratio threshold 127, 130high input packets in error indication 160high interrupts per second threshold 107, 108, 109, 113high job errors indication 92high job errors per day indication 93high log-in number for user indication 193high network traffic indication 179high NFS buffer size indication 170high NFS server get-attribute operations indication 171high NFS server read operations indication 172high NFS server readlink operations indication 173high NFS server write operations indication 174high not ready errors indication 94high not ready errors per day indication 95high number of zombie processes indication 184high out of paper errors indication 96high out of paper errors per day indication 97high output packets in error indication 161high output queue length modifier threshold 51, 52, 64high paging indication 26high percent broadcast threshold 48, 55, 56, 58, 60, 61, 63, 64high percent bytes per second threshold 47, 49, 51, 52, 53, 55,

56, 58, 60, 61, 62, 63, 64high percent disk time indication 81high percent drive time correlated event 291high percent usage delta indication 110high percent usage delta threshold 110, 113high percent usage threshold 22, 81, 82, 83, 84, 85, 87high percent utilization threshold 47, 48, 49, 53, 55, 56, 58,

60, 61, 62, 63, 64high percentage disk time indication 18high percentage packet collisions indication 162high ping indication 128High priority distribution queue not active indication 234high processes indication 111high queue length threshold 19, 22, 81, 82, 83, 84, 85, 86, 87high read bytes per second indication 15, 82high retransmitted calls indication 176high RPC bad calls indication 177high segments retransmitted threshold 129, 130high timeouts and badxids indication 178high transfer rate indication 17, 83high work item shortages threshold 47, 53, 60, 62, 63, 64high write bytes per second indication 16, 84History Log


History Log resource modelindications 235List of jobs not empty indication 235parameters 236


Ind

ex

Iignored file system parameter 151illegal group indication 194illegal owner indication 194indications

OS/400ASP Disk Mirroring resource model 209ASP nearing capacity 214ASP overflow 215ASP Utilization resource model 213Basic CPU Utilization Guideline Exceeded 219Basic CPU Utilization Guideline Long Running

Exceeded 218Basic CPU Utilization Peak Exceeded 220Basic CPU Utilization Peak Long Running

Exceeded 218Basic CPU Utilization resource model 217Basic Interactive CPU Utilization Guideline

Exceeded 225Basic Interactive CPU Utilization Peak Exceeded 226Basic Interactive CPU Utilization resource model 223Configuration object not active 229Configuration Objects resource model 229Database CPU Utilization Exceeded 231Database CPU Utilization resource model 231Distribution Queues resource model 233High priority distribution queue not active 234History Log resource model 235Interactive Feature CPU Utilization Exceeded 238Interactive Feature CPU Utilization resource model 237Job Log resource model 239Job Log Warning Message 239Job Not Active 247Job Queue Not Active 244Job Queue Not Assigned 244Job Queue resource model 243Job Status resource model 247Last Changed Date Differentt 258List of jobs not empty 235Management Central Critical 250Management Central Events resource model 249Management Central Harmless 250Management Central Unknown 250Management Central Warning 250mirroring not active 210Network Attributes Mismatch 253Network Attributes resource model 253No writers started for output queue 255Normal priority distribution queue not active 234Object Owner Different 257Object Size Exceeded 258Output queue not active 256Output Queues resource model 255Parametric Object and File resource model 257Subsystem Not Active 263Subsystem resource model 263System ASP Used Near Peak Capacity Guidelines 266System Disk Resources resource model 265System Object Mismatch 269System Value resource model 269TCP Interface Not Active 271

indications (continued)OS/400 (continued)

TCP Interface resource model 271TCP Service Not Active 273TCP Service resource model 273Too Many Jobs Queued 243Total Auxiliary Storage Reached Capacity

Guidelines 267Total Auxiliary Storage Reached Peak Guidelines 266

UNIX/Linuxaccount not valid for root 195CPU resource model 135duplicate account 192file attributes changed 143file changed 142file not present 144File resource model 141File System resource model 147fragmented file system 149high CPU overload 136high CPU usage by system 137high duplicate RPC server calls 175high input packets in error 160high log-in number for user 193high network traffic 179high NFS buffer size 170high NFS server get-attribute operations 171high NFS server read operations 172high NFS server readlink operations 173high NFS server write operations 174high number of zombie processes 184high output packets in error 161high percentage packet collisions 162high retransmitted calls 176high RPC bad calls 177high timeouts and badxids 178illegal group 194illegal owner 194interface not enabled 163interface not operational 164low percent space available 148low percentage of available I-nodes 150low space available 148low storage space 154low swap space 155Memory resource model 153Network Interface resource model 159Network RPC-NFS resource model 169nonexistent file 193null password 195process consuming high CPU 185process killed or nonexistent 186Process resource model 184process stopped 187Security resource model 191slow network 180suspect supergroup 196suspect superuser 196system thrashing 156unknown interface status 165wrong file mode 197

302 Version 5.1.1

indications (continued)Windows

adjust work items 47busy hardware 107CPU cannot keep up with hardware 108event ID 11 8event ID 15 9event ID 2011 9event ID 2511 9event ID 3013 10event ID 9 8event ID7023 10Event Log resource model 8hardware keeping CPU busy 109high broadcast frames 48high current commands 49high current percent time 91high errored ratio 50high fragment ratio 127high job errors 92high job errors per day 93high not ready errors 94high not ready errors per day 95high out of paper errors 96high out of paper errors per day 97high paging 26high percent disk time 81high percent usage delta 110high percentage disk time 18high ping 128high processes 111high read bytes per second 15, 82high transfer rate 17, 83high write bytes per second 16, 84logical disk possible fragmentation 19Logical Disk resource model 14low available memory 27low available memory causing hard paging 28low available memory causing many problems 31low available memory causing soft paging and pagefile

resizing 29low available memory is causing excessive soft

paging 30low available memory with a high working set 33low available memory with a small pagefile 35low available memory with high cache 32low copy read hits 36low data map hits 37low disk space 20low MDL read hits 38low pin read hits 39memory leak in private bytes 41memory leak in system code 42memory leak in system drivers 43Memory resource model 25network interface card overworked 51Network Interface Card resource model 46network interface card too slow 52pagefile is resizing 40Parametric Services resource model 71Parmetric Event Log resource model 67

indications (continued)Windows (continued)

Parmetric TCP/IP Ports resource model 75physical disk possible fragmentation 85Physical Disk resource model 80Printer resource model 90process handle leak 102process high CPU 103Process resource model 102processor busy 112Processor resource model 106properties 11redirector affecting server 53redirector overloaded 55redirector overloaded affecting segment 56segment affecting redirector 58segment affecting server 60segments ReXmit 129server affecting redirector 61server overloaded 62server overloaded affecting segment 63services failing service 72, 120Services resource model 120services stopped service 73, 121slow logical drive 21slow physical drive 86state of the defined port 76TCP/IP resource model 126Windows event logged 68

input packets in error threshold 160, 166Interactive Feature CPU Utilization


Interactive Feature CPU Utilization Exceeded indication 238Interactive Feature CPU Utilization resource model

indications 237Interactive Feature CPU Utilization Exceeded

indication 238logging 238

interface not enabled indication 163interface not operational indication 164

Jjob errors per day threshold 93, 98job errors threshold 92, 98Job Log


Job Log resource modelindications 239Job Log Warning Message indication 239parameters 240

Job Log Warning Message indication 239Job Not Active indication 247Job Queue


Job Queue Not Active indication 244


Ind

ex

Job Queue Not Assigned indication 244Job Queue resource model

indications 243Job Queue Not Active indication 244Job Queue Not Assigned indication 244parameters 245Too Many Jobs Queued indication 243

Job Statusresource model

description 247Job Status resource model

indications 247Job Not Active indication 247parameters 248

Kkey services problem 119

LLanmanServer threshold 122LanmanWorkstation threshold 122Last Changed Date Different indication 258List of jobs not empty indication 235log file type parameter 69logging

OS/400ASP Utilization resource model 216Basic CPU Utilization resource model 221Basic Interactive CPU Utilization resource model 227Database CPU Utilization resource model 232Interactive Feature CPU Utilization resource model 238Storage Pools resource model 262System Disk Resources resource model 267

UNIX/LinuxCPU resource model 138File resource model 145File System resource model 152Memory resource model 157Network Interface resource model 166Network RPC-NFS resource model 182Process resource model 188Security resource model 198Server Performance Prediction resource model 202

WindowsLogical Disk resource model 22Memory resource model 44Network Interface Card resource model 65Parmetric Services resource model 74Parmetric TCP/IP Ports resource model 77Physical Disk resource model 87Printer resource model 99Process resource model 104Processor resource model 114Server Performance Prediction resource model 116TCP/IP resource model 130

logical disk possible fragmentation indication 19Logical Disk resource model

bytes transferred per second problem 13description 13disk space problem 13high bytes per second threshold 22high percent disk time indication 18high percent usage threshold 22high queue length threshold 19, 22high read bytes per second indication 15high transfer rate indication 17high write bytes per second indication 16indications 14logging 22logical disk possible fragmentation indication 19low disk space indication 20low disk space threshold 22percent usage problem 13prerequisites 14problems highlighted 13slow logical drive indication 21thresholds 22

logons by same user problem 191low available memory causing hard paging indication 28low available memory causing many problems indication 31low available memory causing soft paging and pagefile resizing

indication 29low available memory indication 27low available memory is causing excessive soft paging

indication 30low available memory problem 24low available memory with a high working set indication 33low available memory with a small pagefile indication 35low available memory with high cache indication 32low cache hits percent threshold 44low copy read hits indication 36low data map hits indication 37low disk space indication 20low disk space threshold 22low MDL read hits indication 38low percent space available indication 148low percentage of available I-nodes indication 150low pin read hits indication 39low segments threshold 128, 130low space available indication 148low storage space indication 154low swap space indication 155

MManagement Central Critical indication 250Management Central Events


Management Central Events resource modelindications 249Management Central Critical indication 250Management Central Harmless indication 250Management Central Unknown indication 250

304 Version 5.1.1

Management Central Events resource model (continued)Management Central Warning indication 250

Management Central Unknown indication 250Management Central Warning indication 250Management CentralHarmless indication 250manuals

feedback xxonline xxordering xx

maximum handles indication 102, 104maximum number of zombie processes threshold 184, 188maximum print jobs threshold 98maximum print queues threshold 98maximum processes indication 102, 103, 104Memory (UNIX/Linux) resource model

description 153indications 153logging 157low storage space indication 154low swap space indication 155memory page-in rate threshold 156, 157memory page-out rate threshold 156, 157percentage of available swap space threshold 155, 157percentage of available virtual storage threshold 154, 157system thrashing indication 156thresholds 157

Memory (Windows) resource modelcache problem 23committed bytes problem 24description 23excessive page faults threshold 44excessive paging threshold 29, 30, 44high paging indication 26indications 25logging 44low available memory causing hard paging indication 28low available memory causing many problems

indication 31low available memory causing soft paging and pagefile

resizing indication 29low available memory indication 27low available memory is causing excessive soft paging

indication 30low available memory problem 24low available memory with a high working set

indication 33low available memory with a small pagefile indication 35low available memory with high cache indication 32low cache hits percent threshold 44low copy read hits indication 36low data map hits indication 37low MDL read hits indication 38low pin read hits indication 39memory leak in private bytes indication 41memory leak in system code indication 42memory leak in system drivers indication 43memory leaks problem 24minimum available bytes threshold 44minimum committed bytes threshold 28, 44pagefile is resizing indication 40paging and page faulting problem 24

Memory (Windows) resource model (continued)problems highlighted 23thresholds 44

memory leak in private bytes indication 41memory leak in system code indication 42memory leak in system drivers indication 43memory leaks problem 24memory page-in rate threshold 156, 157memory page-out rate threshold 156, 157minimum available bytes threshold 44minimum committed bytes threshold 28, 44mirroring not active indication 210moderate DG threshold 128, 130Mof file properties

CPU resource model 138File resource model 145File System resource model 152Memory resource model 157Network Interface resource model 166Process resource model 188Security resource model 199

multiple CPU problems 105

NNetlogon threshold 123Network Attributes


Network Attributes Mismatch indication 253Network Attributes resource model

indications 253Network Attributes Mismatch indication 253parameters 254

network congestion problem 125network interface card overworked indication 51network interface card problem 45Network Interface Card resource model

actions 65adjust initial work items action 65, 279adjust maximum work items action 65, 279adjust work items indication 47broadcast frames problem 45built-in actions 279description 45high broadcast frames indication 48high current commands indication 49high current commands modifier threshold 49, 55, 56, 58,

61, 64high errored out ratio threshold 50, 64high errored ratio indication 50high output queue length mod threshold 51, 52, 64high percent broadcast threshold 48, 55, 56, 58, 60, 61, 63,

64high percent bytes per second threshold 47, 49, 51, 52, 53,

55, 56, 58, 60, 61, 62, 63, 64high percent utilization threshold 47, 48, 49, 53, 55, 56,

58, 60, 61, 62, 63, 64high work item shortages threshold 47, 53, 60, 62, 63, 64


Ind

ex

Network Interface Card resource model (continued)indications 46logging 65network interface card overworked indication 51network interface card problem 45network interface card too slow indication 52prerequisites 45problems highlighted 45redirector affecting server indication 53redirector overloaded affecting segment indication 56redirector overloaded indication 55segment affecting redirector indication 58segment affecting server indication 60server affecting redirector indication 61server and workstation services problem 46server overloaded affecting segment indication 63server overloaded indication 62thresholds 64

network interface card too slow indication 52network interface configuration parameter 116, 201Network Interface resource model

description 159high input packets in error indication 160, 161high percentage packet collisions indication 162indications 159input packets in error threshold 160, 166interface not enabled indication 163interface not operational indication 164logging 166output packets in error threshold 161, 166packet collision percentage threshold 162, 166thresholds 166unknown interface status indication 165

Network RPC-NFS resource modeldescription 169high duplicate RPC server calls indication 175high network traffic indication 179high NFS buffer size indication 170high NFS server get-attribute operations indication 171high NFS server read operations indication 172high NFS server readlink operations indication 173high NFS server write operations indication 174high retransmitted calls indication 176high RPC bad calls indication 177high timeouts and badxids indication 178indications 169logging 182percentage of bad RPC calls threshold 177, 181percentage of client RPC badxids threshold 178, 181percentage of client RPC calls in time-out threshold 178,

181percentage of client RPC retransmissions threshold 176,

181percentage of NFS server getattr operations threshold 171,

181percentage of NFS server read operations threshold 172,

181percentage of NFS server readlink operations

threshold 173, 181percentage of NFS server write operations threshold 174,

181

Network RPC-NFS resource model (continued)percentage of server RPC duplicate requests threshold 175,

181slow network indication 180thresholds 181

No writers started for output queue indication 255nonexistent file indication 193Normal priority distribution queue not active indication 234not ready errors per day threshold 95, 98not ready errors threshold 94, 98notation

environment variables xxiiipath names xxiiitypeface xxiii

NtLmSsp threshold 123null password indication 195

OObject Owner Different indication 257Object Size Exceeded indication 258online publications xxiordering publications xxiout of paper errors per day threshold 97, 98out of paper errors threshold 96, 98output packets in error threshold 161, 166Output queue not active indication 256Output Queues


Output Queues resource modelindications 255No writers started for output queue indication 255Output queue not active indication 256parameters 256

Ppacket collision percentage threshold 162, 166paging and page faulting problem 24parameters

OS/400ASP Disk Mirroring resource model 211ASP Utilization resource model 216Configuration Objects resource model 230Distribution Queues resource model 234History Log resource model 236Job Log resource model 240Job Queue resource model 245Job Status resource model 248Network Attributes resource model 254Output Queues resource model 256Parametric Object and File resource model 259Storage Pools resource model 261Subsystem resource model 264System Value resource model 270TCP Interface resource model 272

306 Version 5.1.1

parameters (continued)OS/400 (continued)

TCP Service resource model 274UNIX/Linux

alternative groups 198alternative owners 198available file system space configuration 202defined users 198File resource model 145File System resource model 151file to be checked 145, 151files to be monitored 198ignored file system 151network interface configuration 201Process resource model 188processes 188Security resource model 198Server Performance Prediction resource model 201special groups 198special users 198

Windowsavailable disk space configuration 116computers 70event IDs 69event severity 69filter type 70log file type 69network interface configuration 116Parmetric Event Log resource model 69Parmetric Services resource model 74Parmetric TCP/IP Ports resource model 77physical disk configuration 116port numbers 77possible state of a port 77Server Performance Prediction resource model 116services 74source 69Windows 2000 logs 69

Parametric Event Log resource modelcomputers parameter 70description 67event IDs parameter 69event severity parameter 69filter type parameter 70indications 67log file type parameter 69parameters 69source parameter 69thresholds 69Windows 2000 logs parameter 69Windows event logged indication 68

Parametric Object and Fileresource model

description 257Parametric Object and File resource model

indications 257Last Changed Date Different indication 258Object Owner Different indication 257Object Size Exceeded indication 258parameters 259

Parametric Services resource modeldescription 71indications 71logging 74parameters 74port numbers parameter 77possible state of a port parameter 77services failing service indication 72services parameter 74services stopped service indication 73

Parametric TCP/IP Ports resource modeldescription 75indications 75logging 77parameters 77prerequisites 75state of the defined port indication 76

path names, notation xxiiipercent available space threshold 148, 151percent processor threshold 91, 98percent processor time problem 89percent usage problem 13, 79percentage of available I-nodes threshold 150, 151percentage of available swap space threshold 155, 157percentage of available virtual storage threshold 154, 157percentage of bad RPC calls threshold 177, 181percentage of client RPC badxids threshold 178, 181percentage of client RPC calls in time-out threshold 178, 181percentage of client RPC retransmissions threshold 176, 181percentage of CPU in idle threshold 136, 138percentage of CPU used by system threshold 137, 138percentage of CPU used threshold 185, 188percentage of file system space used threshold 149, 151percentage of I-nodes used threshold 149, 151percentage of NFS server getattr operations threshold 171,

181percentage of NFS server read operations threshold 172, 181percentage of NFS server readlink operations threshold 173,

181percentage of NFS server write operations threshold 174, 181percentage of server RPC duplicate requests threshold 175,

181physical disk configuration parameter 116physical disk possible fragmentation indication 85Physical Disk resource model

bytes transferred per second problem 79description 79high bytes per second threshold 81, 82, 83, 84, 85, 86, 87high percent disk time indication 81high percent usage threshold 81, 82, 83, 84, 85, 87high queue length threshold 81, 82, 83, 84, 85, 86, 87high read bytes per second indication 82high transfer rate indication 83high write bytes per second indication 84indications 80logging 87percent usage problem 79physical disk possible fragmentation indication 85prerequisites 80problems highlighted 79slow physical drive indication 86


Ind

ex

Physical Disk resource model (continued)thresholds 87

port numbers parameter 77possible disk fragmentation correlated event 292possible state of a port parameter 77prerequisites

WindowsLogical Disk resource model 14Network Interface Card resource model 45Parametric TCP/IP Ports resource model 75Physical Disk resource model 80TCP/IP resource model 125

printer errors problem 89Printer resource model

description 89high current percent time indication 91high job errors indication 92high job errors per day indication 93high not ready errors indication 94high not ready errors per day indication 95high out of paper errors indication 96high out of paper errors per day indication 97indications 90job errors per day threshold 93, 98job errors threshold 92, 98logging 99maximum print jobs threshold 98maximum print queues threshold 98not ready errors per day threshold 95, 98not ready errors threshold 94, 98out of paper errors per day threshold 97, 98out of paper errors threshold 96, 98percent processor threshold 91, 98percent processor time problem 89printer errors problem 89problems highlighted 89thresholds 98

problems highlightedUNIX/Linux

account not valid for root 191logons by same user 191process is stopped or killed 183Process resource model 183process uses too much CPU time 183property changes 191requested process does not exist 183Security resource model 191suspect superuser 191too many zombie processes in the system 183

Windowsbroadcast frames 45bytes transferred per second 13, 79cache 23client connectivity problems 7committed bytes 24detection of malfunctioning devices 7disk space 13fragmented data 125handle leaks 101high CPU usage 101, 105key services 119

problems highlighted (continued)Windows (continued)

low available memory 24memory leaks 24multiple CPU problems 105network congestion 125network interface card 45paging and page faulting 24percent processor time 89percent usage 13, 79printer errors 89server and workstation services 46server connectivity problems 7unstable services 119

Process (UNIX/Linux) resource modeldescription 183high number of zombie processes indication 184indications 184logging 188maximum number of zombie processes threshold 184, 188parameters 188percentage of CPU used threshold 185, 188problems highlighted 183process consuming high CPU indication 185process is stopped or killed problem 183process killed or nonexistent indication 186process stopped indication 187process uses too much CPU time problem 183processes parameter 188requested process does not exist problem 183thresholds 188too many zombie processes in the system problem 183

Process (Windows) resource modeldescription 101handle leaks problem 101high CPU usage indication 103, 104high CPU usage problem 101indications 102logging 104maximum handles indication 102, 104maximum processes indication 102, 103, 104problems highlighted 101process handle leak indication 102process high CPU indication 103thresholds 104

process consuming high CPU indication 185process handle leak indication 102process high CPU indication 103process hogging CPU correlated event 293process is stopped or killed problem 183process killed or nonexistent indication 186process stopped indication 187process uses too much CPU time problem 183processes parameter 188processor busy threshold 112Processor resource model

busy hardware indication 107CPU cannot keep up with hardware indication 108description 105hardware keeping CPU busy indication 109

308 Version 5.1.1

Processor resource model (continued)high CPU usage interrupt threshold 107, 108, 109, 111,

113high CPU usage problem 105high CPU usage process threshold 111, 112, 113high CPU usage threshold 107, 108, 109, 111, 112, 113high CPU usage user privilege threshold 113high interrupts per second threshold 107, 108, 109, 113high percent usage delta indication 110high percent usage delta threshold 110, 113high processes indication 111indications 106logging 114multiple CPU problems 105problems highlighted 105processor busy threshold 112thresholds 113total CPUs modifier threshold 108, 109, 113

property changes problem 191publications

feedback xxonline xxordering xx

Rraise session timeout action 12, 278redirector affecting server indication 53redirector overloaded affecting segment indication 56redirector overloaded indication 55requested process does not exist problem 183resource models

OS/400ASP Disk Mirroring 209ASP Utilization 213Basic CPU Utilization 217Basic Interactive CPU Utilization 223Configuration Objects 229Database CPU Utilization 231Distribution Queues 233History Log 235Interactive Feature CPU Utilization 237Job Log 239Job Queue 243Job Status 247Management Central Events 249Network Attributes 253Output Queues 255Parametric Object and File 257Storage Pools 261Subsystem 263System Disk Resources 265System Value 269TCP Interface 271TCP Service 273

Solaris onlyNetwork RPC-NFS - see resource models,

UNIX/Linux 169

resource models (continued)UNIX/Linux

CPU 135File 141File System 147Memory 153Network Interface 159Network RPC-NFS 169Process 183Security 191Server Performance Prediction 201

WindowsEvent Log 7Logical Disk 13Memory 23Network Interface Card 45Parametric Event Log 67Parametric Services 71Parametric TCP/IP Ports 75Physical Disk 79Printer 89Process 101Processor 105Server Performance Prediction 115Services 119TCP/IP 125TMW_Spp 115

restart service action 123, 280

SSecurity resource model

account not valid for root indication 195account not valid for root problem 191alternative groups parameter 198alternative owners parameter 198defined users parameter 198description 191duplicate account indication 192files to be monitored parameter 198high log-in number for user indication 193illegal group indication 194illegal owner indication 194indications 191logging 198logons by same user problem 191nonexistent file indication 193null password indication 195parameters 198problems highlighted 191property changes problem 191special groups parameter 198special users parameter 198suspect supergroup indication 196suspect superuser indication 196suspect superuser problem 191wrong file mode indication 197

segment affecting redirector indication 58segment affecting server indication 60


Ind

ex

segments ReXmit indication 129server affecting redirector indication 61server and workstation services problem 46server connectivity problems 7server overloaded affecting segment indication 63server overloaded indication 62Server Performance Prediction (UNIX/Linux) resource model

available file system space configuration parameter 202description 201logging 202network interface configuration parameter 201parameters 201

Server Performance Prediction (Windows) resource model 115available disk space configuration parameter 116logging 116network interface configuration parameter 116parameters 116physical disk configuration parameter 116

services failing service indication 72, 120services parameter 74Services resource model

actions 123browser threshold 122built-in actions 280description 119EventLog threshold 122indications 120key services problem 119LanmanServer threshold 122LanmanWorkstation threshold 122Netlogon threshold 123NtLmSsp threshold 123problems highlighted 119restart service action 123, 280services failing service indication 120services stopped service indication 121thresholds 122Tivoli endpoint threshold 122unstable services problem 119

services stopped service indication 73, 121slow hard drive correlated event 294slow logical drive indication 21slow network indication 180slow physical drive indication 86source parameter 69special groups parameter 198special users parameter 198state of the defined port indication 76Storage Pools


Storage Pools resource modellogging 262parameters 261

Subsystemresource model

description 263Subsystem Not Active indication 263Subsystem resource model

indications 263parameters 264

Subsystem resource model (continued)Subsystem Not Active indication 263

suspect supergroup indication 196suspect superuser indication 196suspect superuser problem 191System Disk Resources


System Disk Resources resource modelindications 265logging 267System ASP Used Near Peak Capacity Guidelines

indication 266Total Auxiliary Storage Reached Capacity indication 267Total Auxiliary Storage Reached Peak Capacity Guidelines

indication 266System Object Mismatch indication 269system thrashing indication 156System Value


System Value resource modelindications 269parameters 270System Object Mismatch indication 269

TTCP Interface


TCP Interface Not Active indication 271TCP Interface resource model

indications 271parameters 272TCP Interface Not Active indication 271

TCP Serviceresource model

description 273TCP Service Not Active indication 273TCP Service resource model

indications 273parameters 274TCP Service Not Active indication 273

TCP/IP resource modeldescription 125fragmented data problem 125high fragment ratio indication 127high fragment ratio threshold 127, 130high ping indication 128high segments retransmitted threshold 129, 130indications 126logging 130low segments threshold 128, 130moderate DG threshold 128, 130network congestion problem 125prerequisites 125problems highlighted 125segments ReXmitindication 129

310 Version 5.1.1

TCP/IP resource model (continued)thresholds 130

thresholdsUNIX/Linux

available space 148, 151CPU resource model 138File System resource model 151input packets in error 160, 166maximum number of zombie processes 184, 188memory page-in rate 156, 157memory page-out rate 156, 157Memory resource model 157Network Interface resource model 166Network RPC-NFS resource model 181output packets in error 161, 166packet collision percentage 162, 166percent available space 148, 151percentage of available I-nodes 150, 151percentage of available swap space 155, 157percentage of available virtual storage 154, 157percentage of bad RPC calls 177, 181percentage of client RPC badxids 178, 181percentage of client RPC calls in time-out 178, 181percentage of client RPC retransmissions 176, 181percentage of CPU in idle 136, 138percentage of CPU used 185, 188percentage of CPU used by system 137, 138percentage of file system space used 149, 151percentage of I-nodes used 149, 151percentage of NFS server getattr operations 171, 181percentage of NFS server read operations 172, 181percentage of NFS server readlink operations 173, 181percentage of NFS server write operations 174, 181percentage of server RPC duplicate requests 175, 181Process resource model 188

Windowsbrowser 122Event Log resource model 11EventLog 122excessive page faults 44excessive paging 29, 30, 44high bytes per second 22, 81, 82, 83, 84, 85, 86, 87high CPU usage 103, 104, 107, 108, 109, 111, 112, 113high CPU usage interrupt 107, 108, 109, 111, 113high CPU usage process 111, 112, 113high CPU usage user privilege 113high current commands modifier 49, 55, 56, 58, 61, 64high errored out ratio 50, 64high fragment ratio 127, 130high interrupts per second 107, 108, 109, 113high output queue length modifier 51, 64high output queuelength modifier 52high percent broadcast 48, 55, 56, 58, 60, 61, 63, 64high percent bytes per second 47, 49, 51, 52, 53, 55,

56, 58, 60, 61, 62, 63, 64high percent usage 22, 81, 82, 83, 84, 85, 87high percent usage delta 110, 113high percent utilization 47, 48, 49, 53, 55, 56, 58, 60,

61, 62, 63, 64high queue length 19, 22, 81, 82, 83, 84, 85, 86, 87high segments retransmitted 129, 130

thresholds (continued)Windows (continued)

high work item shortages 47, 53, 60, 62, 63, 64job errors 92, 98job errors per day 28, 93, 98LanmanServer 122LanmanWorkstation 122Logical Disk resource model 22low cache hits percent 44low disk space 22low segments 128, 130maximum handles 102, 104maximum print jobs 98maximum print queues 98maximum processes 102, 103, 104memory resource model 44minimum available bytes 44minimum committed bytes 44moderate DG 128, 130Netlogon 123Network Interface Card resource model 64not ready errors 94, 98not ready errors per day 95, 98NtLmSsp 123out of paper errors 96, 98out of paper errors per day 97, 98Parmetric Event Log resource model 69percent processor 91, 98Physical Disk resource model 87Printer resource model 98Process resource model 104Processor resource model 113Services resource model 122TCP/IP resource model 130Tivoli endpoint 122total CPUs modifier 108, 109, 113

Tivoli Customer Support xxiiTivoli endpoint threshold 122TMW_EventLog resource model 7TMW_LogicalDisk resource model 13TMW_MemoryModel resource model 23TMW_NetworkIntCard resource model 45TMW_ParamEventLog resource model 67TMW_ParamPorts resource model 75TMW_ParamServices resource model 71TMW_PhysicalDiskModel resource model 79TMW_PrintModel resource model 89TMW_Process resource model 101TMW_Processor resource model 105TMW_Services resource model 119TMW_Spp resource model 115TMW_TCPIP resource model 125Too Many Jobs Queued indication 243too many zombie processes in the system problem 183Total Auxiliary Storage Reached Capacity indication 267Total Auxiliary Storage Reached Peak Capacity Guidelines

indication 266total CPUs modifier threshold 108, 109, 113


Ind

ex

Uunknown interface status indication 165unstable services problem 119

Vvariables, notation for xxiii

Wwhat’s new in this release xviiWindows 2000 logs parameter 69Windows event logged indication 68wrong file mode indication 197

312 Version 5.1.1

��

SH19-4570-01

ibm tivoli monitoringpublib.boulder.ibm.com/tividd/td/itm/sh19-4570-01/en_us/...contents preface...

Documents