nco_p_ncpmonitor.rules configuration reference

The $NCHOME/probes/arch/nco_p_ncpmonitor.rules file defines how the Probe for Tivoli Netcool/OMNIbus processes Network Manager event data to create a meaningful Tivoli Netcool/OMNIbus event.

In practice, this rules file maps Network Manager event data to ObjectServer fields, and can be used to customize the behavior of the probe. Knowledge of the Tivoli Netcool/OMNIbus probe rules syntax is required for rules file configuration.

The probe uses tokens and elements, and applies rules, to transform Network Manager event source data into a format that the ObjectServer can recognize. The raw event source data is converted to tokens, which are then parsed into elements. The rules file is used to perform conditional processing on the elements, and to map them to ObjectServer alerts.status fields. In the rules file, elements are identified by the $ symbol and alerts.status fields are identified by the @ symbol. The rules file configuration maps elements to fields, as shown in the following sample code:

@Summary=$Description

In this example, @Summary identifies the alerts.status field, and $Description identifies the Network Manager input field.

Where the Network Manager ExtraInfo field is used with nested fields to store additional data on entities (for example, ExtraInfo->ifIndex), these fields are available in the following format in the rules file:

$ExtraInfo_variable

Where variable represents a Management Information Base (MIB) variable (for example, ifIndex), or other data (for example, column names in NCIM tables). MIB variables are specified in mixed case characters, and other data, in uppercase characters. For example:

$ExtraInfo_ifIndex
$ExtraInfo_MONITOREDENTITYID
To configure the rules file for the Probe for Tivoli Netcool/OMNIbus, it is necessary to have an understanding of:
  • The Network Manager event source data that is available for use in the probe rules file
  • The set of alerts.status fields that can be populated with event data from Network Manager
  • The data mapping between the Network Manager and alerts.status fields