Business Service Management
Home > Integration Scenarios > Enriching ITM Events for TBSM
Enriching ITM Events For TBSM
Business Services are a collection, grouping of Hardware, OS, Devices, Networks, Databases, Webservers, and Applications etc. presented on a dashboard for executives to make strategic and business decisions.
In a company, there can be thousand of systems running several different homes grown, 3rd party applications. To consolidate all the data coming from all these systems in form of events, from external resources such as databases (cmdb), they have to have some common data to identify and differentiate and map to a service being provided by the company. Basically tagging the data (events in this case), so they can be assigned to there appropriate services in the service tree to reflect an accurate picture of the services provided to end users.
In this document we will refer this to enriching the events with appropriate slots.
To assist in this effort, there are three ways to enrich IBM® Tivoli® Monitoring (ITM) events:
- Using Mapping Files mechanism provide by ITM
- Using SCE (State Correlation Engine)
- Using Netcool Impact product
In this paper, we will discuss how to enrich ITM Events using the ITM Product provided mapping files.
Here are the assumptions:
- IBM Tivoli Monitoring is installed.
- HUB TEMS is configured to send events to TEC (by enabling TEC Integration Facility for port 5529)
- IBM Tivoli Business Service Manager (TBSM) is installed
- Omnibus installed and configured
- EIF probe is installed and listening on a port (for e.g. 5529)
Here's an overview on how the events flow all the way from Agents to HUB TEMS, via EIF to Omnibus and eventually utilized by TBSM.
- Situations are created in ITM and distributed to Agents
- When the thresholds are violated in situations, Event is fired
- Event goes through the mapping file, as its mapping is defined, and custom slots are appended to the events
- Events reaches EIF probe and are gone through the rules file and then inserted into omnibus objectserver
- Next Event is available for TBSM to create services, indications etc.
In our example below we have 2 separate systems:
- ITM TEPS/TEMS/Windows OS Agent all are installed on same system (Windows 2003)
- TBSM, Omnibus and EIF are all installed on same systems (Windows 2003)
Starting with the mapping file on HUB TEMS, the default maping files are located under C:\IBM\ITM\CMS\TECLIB directory on the HUB TEMS.
Note: As a best practice, when adding slots for the events from ITM, create your own mapping file. It will be easy to keep track of changes as well as when the new fix packs are applied on the system, the file will not get overwritten.
The mapping file has to be 3 characters in length (before extension), just like the default ones knt.map, kux.map etc.
<id> tag is recommended to be 99 for the user defined event mapping (to identify that the Events are mapped to a custom mapping file)
mapAllAttributes="Y", will let you carry over all the default slots plus the new slots defined in you custom mapping file
situation name, specify the ones, to which you want and can use regular expression
class name, use the Attribute Groups name from which the situation is created
Here's a custom mapping file, we will use to append slots to all situations starting with BSM
<?xml version="1.0" encoding="UTF-8"?>
<itmEventMapping:agent
xmlns:itmEventMapping="http:
xmlns:xsi="http:
xsi:schemaLocation="http:>
<id>99</id>
<version>6.2.0</version>
<event_mapping>
<situation name="BSM*" mapAllAttributes="Y">
<class name="ITM_NT_Processor"/>
<slot slotName="Lob">
<literalString value="Finite Credit"/>
</slot>
<slot slotName="ServiceName">
<literalString value="Finite Co."/>
</slot>
<slot slotName="ApplicationName">
<literalString value="Process Credit Applications"/>
</slot>
<slot slotName="LocationName">
<literalString value="Boston"/>
</slot>
<slot slotName="OSType">
<literalString value="Windows 2003 EE"/>
</slot>
<slot slotName="HardwareVendor">
<literalString value="IBM"/>
</slot>
<slot slotName="HardwareModel">
<literalString value="XSeries"/>
</slot>
<slot slotName="SupportGroup">
<literalString value="Finite IT"/>
</slot>
</situation>
</event_mapping>
</itmEventMapping:agent>
You can see the below the contents of the event fired.
Highlighted in BLUE, are the slots added by the mapping file.
ITM_NT_Processor
cms_hostname='chafe.tivlab.austin.ibm.com'
cms_port='3661'
integration_type='N'
master_reset_flag=''
appl_label=''
situation_name='BSM_NT_Percent_Processor_Time'
situation_type='S'
situation_origin='Primary:CHAFE:NT'
situation_time='04/08/2008 16:18:51.003'
situation_status='Y'
severity='CRITICAL'
date='04/08/2008'
situation_displayitem='3'
source='ITM'
sub_source='Primary:CHAFE:NT'
hostname='CHAFE'
origin='9.48.139.136'
sub_origin='3'
adapter_host='CHAFE'
Lob='Finite Credit'
ServiceName='Finite Co.'
ApplicationName='Process Credit Applications'
LocationName='Boston'
OSType='Windows 2003 EE'
HardwareVendor='IBM'
HardwareModel='XSeries'
SupportGroup='Finite IT'
pct__dpc_time='0'
pct__interrupt_time='6'
pct__privileged_time='27'
pct__processor_time='45'
pct__user_time='19'
apc_bypasses_per_sec='0'
dpc_bypasses_per_sec='0'
dpc_queued_per_sec='56'
dpc_rate='1'
interrupts_per_sec='87'
processor='3'
server_name='Primary:CHAFE:NT'
timestamp='1080408161850875'
msg='[(%_Processor_Time>=30 AND Processor<>"_Total" ) ON Primary:CHAFE:NT ON 3 (%_Processor_Time=45 Processor=3 )]'
situation_eventdata='~'
END
For testing purposes to see the contents of Events (before sent to EIF/Omnibus) users can change the om_tec.config (specifies the location of EIF Probe running/listening for Events from HUB TEMS) file present under the C:\IBM\ITM\CMS\teclib directory, to dump into a file, to validate the Event.
Specify an invalid hostname for ServerLocation variable.
Restart HUB TEMS
Events when fired, will be written to the cache file (om_tec.cache) specified by the BufEvtPath variable.
# Component: OMEGAMON - Tivoli Event Integration
# Description: OMEGAMON - TEC Event Integration configuration file
# (C) COPYRIGHT IBM Corporation 2005
# Licensed Material - Property of IBM Corporation
# this variable points to the T/EC host where we forward events
ServerLocation=testevents
#
ServerPort=5529
#
#EventMaxSize=4096
#
RetryInterval=5
getport_total_timeout_usec=50500
NO_UTF8_CONVERSION=YES
ConnectionMode=co
BufferEvents=YES
BufEvtMaxSize=4096
BufEvtPath=./TECLIB/om_tec.cache
FilterMode=OUT
Filter:Class=ITM_Generic;master_reset_flag='';
Note: If there's a need to modify the mapping file, user can do that and issue this command when changes are made, without restarting the HUB TEMS.
C:\IBM\ITM\BIN>tacmd refreshTECinfo -t all
Once we determine the contents and correct slots for our Events, the next step is to add these new slots in the rules file running on the EIF Probe, so the slots in the events coming from HUB TEMS can be picked up and processed by the EIF probe rules file.
There is a rules file names tivoli_eif.rules under the C:\IBM\Netcool\omnibus\probes\win32 directory on the system where EIF probe is installed.
The tivoli_eif.rules contains the basic event processing rules used by the tme10tecad probes in support of TBSM. The file is primarily used to map event tokens to columns in the alerts.status table which is contained in the Omnibus ObjectServer database schema.
Edit the file, and you will find this section, mid way in the file.
Add the slot names in that section as shown below in BLUE in this format
@SlotName=$SlotName
\### Handle ITM Events
if ( exists( $situation_name ) )
{
@Identifier = $situation_name + ":" + $situation_origin + ":" + $situation_displayitem + ":" + $ClassName
@AlertKey = $situation_name
@Node = $situation_origin
@NodeAlias = $situation_origin
@Agent = $source
@Type = 20
@ITMDisplayItem = $situation_displayitem
@ITMStatus = $situation_status
@ITMTime = $situation_time
@ITMEventData = $situation_eventdata
@ITMHostname = $cms_hostname
@ITMIntType = $integration_type
@Lob = $Lob
@ServiceName = $ServiceName
@ApplicationName = $ApplicationName
@LocationName = $LocationName
@OSType = $OSType
@HardwareVendor = $HardwareVendor
@HardwareModel = $HardwareModel
@SupportGroup = $SupportGroup
\### Populate BSM specific columns.
Now we will have to add the above defined slots into the Omnibus ObjectServer database.
Here are the steps to do that.
C:\IBM\Netcool\omnibus\bin>isql.bat \-S NCOMS \-U root
Password:
1> alter table alerts.status add column Lob varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column ServiceName varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column ApplicationName varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column LocationName varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column OSType varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column HardwareVendor varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column HardwareModel varchar(128);
2> go
(0 rows affected)
1> alter table alerts.status add column SupportGroup varchar(128);
2> go
(0 rows affected)
1> quit
Note: The Slot names defined in the mapping files, rules file and in the objectserver needs to be all same case (either lowercase, UPPERCASE or CamelCase).
Now restart the EIF probe and we will see the events in omnibus object server via Event List gui.
The next step is to create services based on these Events data in TBSM.
First we will create templates. Based on these templates, Service is created either manually or automatically by using the Event Slots.
In this example, we created templates and used auto pop rule to create Services.
The template structure is created as follow.
Here's the resulting Service Tree from the above defined templates. This tree is created because we used the auto pop rule, using the slots from the Event listed above
Note: You will notice here, the tree structure contains the name, which we added to slots in the mapping files in ITM
Here's the auto pop rule
The ITMHostname variable will result into "chafe.tivlab.austin.ibm.com"
The ApplicationName variable will result into "Process Credit Applications"
The Lob variable will result into "Finite Credit"
For more details on how to create templates and services in Tivoli Business Service Manager, please take a look at the Scenario Guide for TBSM (IBM Tivoli Business Service Manager, Scenarios Guide, Version 4 Release 1.1, SC23-6043-01) on the information center (http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=/com.ibm.tivoli.itbsm.doc/welcome.htm
)
For more details on how to use the mapping files and description of xml tags, please take a look at the "Coding an event mapping file for ITM TEC Event Forwarder" posted on OPAL website (http://www.ibm.com/software/tivoli/opal)
