Event Observer reference

This topic contains reference information for the Event Observer.

IBM Netcool Operations Insight integration

Remember:
IBM Netcool Operations Insight Version 1.6.0.1: Up to (and including) this version, Agile Service Manager required separate installations of the IBM Tivoli Netcool/OMNIbus XML Gateway for Message Bus and the IBM Tivoli Netcool/OMNIbus Message Bus probe. These worked together with the Event Observer to integrate Agile Service Manager with Netcoool/OMNIbus.
IBM Netcool Operations Insight Version 1.6.0.2: From this version onwards, you deploy containerized and pre-configured versions of the gateway and probe while installing Agile Service Manager, and the previous versions of the probe and gateway are deprecated.

Matching Netcool/OMNIbus events to resources (on-prem and OCP): You can use a (comma-separated) list of Netcool/OMNIbus ObjectServer alerts.status field names to identify top-level resources.; If you do not supply a list, this defaults to "Node, NodeAlias".; If you do supply a list, you must list all alerts.status field names.; For on-prem, set the environment variable NETCOOL_EVENT_NODE_FIELDS in the $ASM_HOME/etc/nasm-event-observer.yml file.; For OCP, edit the eventObserver.nodeFields values.; Tip: You can define extra event properties to be added to the status displayed in the Topology Viewer using the extra_status_fields property, for example 'LocalNodeAlias'. You can then define topology viewer status tools that reference these. These fields must be passed through by the gateway (as configured in $ASM_HOME/integrations/omnibus/kafka/gateway/field_filter.map).

Additional information

For more information on configuring the XML gateway, see the following section in the Netcool/OMNIbus Knowledge Center: https://www.ibm.com/support/knowledgecenter/en/SSSHTQ/omnibus/gateways/xmlintegration/wip/concept/xmlgw_intro.html

For additional gateway configuration information, see the following IBM developerWorks discussion: https://developer.ibm.com/answers/questions/256154/how-is-the-xml-message-bus-probe-and-gateway-confi.html

State and status derived from Netcool/OMNIbus

The status of resources is derived from individual fields of the event.

Table 1. General event state rules
State	Meaning	Netcool/OMNIbus event mapping
closed	An active issue, may require attention	Active event with Severity > 0
open	Current state, working as expected	Cleared event with Severity = 0
clear	No longer relevant	Deleted event

Table 2. Use of Netcool/OMNIbus alerts.status event fields by Agile Service Manager
alerts.status fields	Use by Agile Service Manager
Agent	Provider name for events generated from Agile Service Manager
AlertGroup	Type of Agile Service Manager event
AsmStatusId	Identifies the unique ID of the topology service status node. Used as a performance improvement to bypass resource lookup.
Class	45111 for Agile Service Manager events (should be mapped in alerts.conversions)
Customer	TenantId for events generated from Agile Service Manager
EventId	Status [type] for events generated from Agile Service Manager
Identifier	Determines the type of status, populating the status field
LastOccurrence	Used for the observedTime of open events
LastOccurrenceUSec	Used for sub-second event clearing by the updated generic_clear automation, available in $ASM_HOME/integrations/omnibus/updated-generic-clear.sql
LocalPriObj	Resource lookup
LocalRootObj	Resource lookup
Manager	Observer name for events generated from Agile Service Manager
Node	Resource lookup
NodeAlias	Resource lookup
ServerName	Used to generate the unique eventId
ServerSerial	Used to generate the unique eventId
Severity	Severity 0 events represent a clear state
StateChange	Used for the observedTime of clear events
Summary	Used for the status description, shown in the UI
Type	Only Type 1 (Problem), Type 13 (Information) and Type 20 (ITMProblem) events are processed. All others are ignored.

Table 3. Netcool/OMNIbus event data mapped onto Topology Service status
Topology Service status field	Netcool/OMNIbus source
description	alerts.status Summary
eventId	<ServerName>/<ServerSerial>
eventManager	"netcool"
observedTime	closed - time event received by observer clear - alerts.status StateChange open - alerts.status ObservedTime
severity	alerts.status Severity
state	closed - deleted events clear - Severity 0 events open - none of the above
status	alerts.status Identifier