Example: Default enrichment of a Tivoli Netcool/OMNIbus trap event

Use this information to understand how a Tivoli Netcool/OMNIbus event is processed as it passes through the Event Gateway.

The Event Gateway receives a Tivoli Netcool/OMNIbus link down trap event from the ObjectServer. This event originates from a Tivoli Netcool/OMNIbus trap probe. This event therefore originates from outside of Network Manager.This example shows how the event is processed as it passes through the Event Gateway.

The steps in this process are as follows.
  1. The SNMP probe (mttrapd) receives a Link Down trap from a device.
  2. The probe rules process the trap and create a Tivoli Netcool/OMNIbus alert with the event ID SNMPTRAP-LinkDown. The snmptrap.rules rules file (from Netcool/OMNIbus Knowledge Library version 4.4.3 and above) assigns the event a value of LinkDownIfIndex.910 for the NmosEventMap field, as determined by the probe rules. The LinkDownIfIndex value specifies that the LinkDownIfIndex event map should be used to process this event. The .910 value appended to the value specifies that the event has a precedence of 910. Events with a higher precedence suppress events with a lower precedence during RCA. The SNMP probe sends the alert to the ObjectServer.
  3. The Event Gateway receives the event from the ObjectServer.
  4. The incoming event filter is applied to the event.

    This filter checks the LocalNodeAlias field of the event. The LocalNodeAlias field is not empty, and therefore the event passes the filter and moves to the next step.

  5. The Event Gateway assigns a state to the event based on the Severity, Tally, and Type fields in the event. The link down trap event has the following Severity and Tally information:
    • Severity is non-zero
    • Tally is 1
    • Type is Problem

    Based on this information, the Event Gateway assigns the Occurred state to this event. This is a problem event and is a candidate for RCA.

  6. The default incoming field filter is applied to the event. This field filter filters out alerts.status fields that do not participate in the Event Gateway processing and only allows the following fields through:
    • Acknowledged
    • AlertGroup
    • EventId
    • FirstOccurrence
    • LastOccurrence
    • LocalNodeAlias
    • LocalPriObj
    • LocalRootObj
    • Manager
    • NmosCauseType
    • NmosDomainName
    • NmosEntityId
    • NmosEventMap
    • NmosManagedStatus
    • NmosObjInst
    • NmosSerial
    • Node
    • RemoteNodeAlias
    • EventId
    • Serial
    • ServerName
    • Severity
    • Summary
    • SuppressEscl
    • Tally
    • Type
  7. The Event Gateway determines how to handle this event, by determining which event map to use. Event maps define how to handle an event. A numerical precedence value can be associated with the event by the Trap Probe rules.
    The event in this example has an NmosEventMap value of LinkDownIfIndex.910. The Event Gateway therefore processes the event using the event map LinkDownIfIndex. This event map covers link up and link down events from the Tivoli Netcool/OMNIbus SNMP probe. These events all use the ifIndex value held in the LocalPriObj field of alerts.status to identify the interface from which this trap originated. The RCA plug-in subscribes to events that are handled by the LinkDownIfIndex event map. Consequently, this event will be passed to the RCA plug-in. When the event is sent for RCA, a precedence value of 910 is used for the event.
    Note: The use of the NcoGateInserts file to define the event map and precedence is deprecated as of V4.4.3 of the Netcool/OMNIbus Knowledge Library.
  8. The Event Gateway calls the LookupIfEntry stitcher named in the eventMap to match the event to an entity.

    The selected event map is LinkDownIfIndex. In the EventGatewaySchema.cfg configuration file, the following insert is associated with this event map:

    insert into config.eventMaps 
(
    EventMapName,
    Stitcher,
    EventCanFlap
)
values
(
    "LinkDownIfIndex",
    "LookupIfEntry",
    1
);
    This insert instructs the Event Gateway to perform the following actions:
    • Use the stitcher LookupIfEntry to perform the topology lookup.

      The LookupIfEntry looks up the index entry for an interface on a device based on the field values in the event. Based on the value of the interface index extracted from the fields in the event, the stitcher retrieves a row from the NCIM cache consisting of entity and interface data. Another stitcher is called to perform event enrichment.

    • Set the EventCanFlap flag to 1 to inform the RCA plug-in that the related device or interface might be continuing to go up and down.
  9. If the Event Gateway finds a matching entity in the network topology, the enriched event data is filtered by the outgoing field filter and placed on the Event Gateway queue. The event is also passed on to plugins that have registered interest.
  10. Because the RCA plugin has registered interest, it receives the event for processing and performs RCA, using the precedence of 910 from the NmosEventMap field.
  11. The event is enriched with the results of RCA and placed on the Event Gateway queue.