Use the tacmd createSit command to create a new situation.

The tacmd createSit command enables you to create situations without using the Tivoli Enterprise™ Portal. However, if you mistype the name of an attribute when using this command, you do not receive an error. The situation is created, skipping the attribute that you meant to type in the command. If the created situation had, for example, 6 attributes to monitor, the new created situation has only 5 if you made a mistake in typing 1 of the attribute names in the command.

If you are using the IBM® Tivoli® Monitoring command line tacmd createSit function for situation creation, you can use the Situation editor in the Tivoli Enterprise Portal to validate your specified attributes.

where:

-s|--situation sitname

This is the name of the new situation, up to 32 letters, numbers, underscores (_).

-b|--basedOn basename

Specifies the name of the situation on which you are basing the new situation. The new situation will be identical to the base situation except for the name and any situation properties that are specified on the command line.

-p|--property|--properties name=value ...

Specifies one or more name=value pairs that identify the properties of the new situation and their values. Valid property entries for name are:

Desc or Description

The descriptive of the situation, consisting of fewer than 64 characters. Input given as text enclosed between double quotes, such as:

   -p Desc="Alerts user to save the work.."

Interval

Sampling interval. Input Given in format ddd/hhmmss within double quotes, such as:

-p Interval="000/001500"

To change the interval. The format is ddd/hh:mm:ss where ddd is the number of days, from 0 to 999; hh is the hour, from 0 to 23; mm is the minute, from 0 to 59; and ss is the second, from 0 to 59, except if ddd, hh, mm are 0, in which case it is 30 to 59.

Formula

The situation formula for the conditions to test. Input given within double quotes. Keywords are prefixed with *, such as:

-p Formula="*IF *VALUE Local_Time.Minutes *GT 31"

Use the tacmd viewSit command to see the format of the base situation formula:

   "*IF CONDITION [*UNTIL (*SIT SITUATION | *TTL INTERVAL | 
                         *SIT SITUATION *OR *TTL INTERVAL)]"

CONDITION can be one condition or a list of conditions, each separated by an *AND or *OR logical operator and, if needed, grouped in parentheses. The condition is: a function, an attribute or situation, a comparison operator, and a value. More specifically:

   {*VALUE|*CHANGE|*PCTCHANGE|*MISSING|*SCAN|*STR|*DATE|*TIME|*AVG|
     *COUNT|*MAX|*MIN|*SUM}
   ATTRIBUTE_GROUP.ATTRIBUTE
   {*EQ|*NE|*GT|*GE|*LT|*LE}
   VALUE

 or

   *SIT SITUATION *EQ *TRUE

When using the *MISSING function with multiple values, separate each entry with a comma and enclose the list in parentheses, such as "*MISSING NT_Process.Process_Name *EQ (Notepad, System)".

The *STR function requires that you specify at what position in the string to begin looking for a match. For example, *IF *STR NT_Process.Process_Name *EQ 4,hos will find any process names that have "hos" as the fourth, fifth and sixth characters.

The comparison operators are *EQ for equal, *NE for not equal, *GT for greater than, *GE for greater than or equal, *LT for less than, and *LE for less than or equal.

Depending on the function specified, the VALUE can be a word, text enclosed in single quotes, a number, or time.

If you specify an interval for the UNTIL clause, use the syntax d:hh:mm:ss, such as *UNTIL (*TTL 5:01:00:00) for five days and one hour.

See the Formula Functions appendix of the ITM User's Guide for a complete description of each function and any restrictions or special syntax requirements. Sample formulas are:

   "*IF *VALUE NT_Event_Log.Event_ID *EQ 529"

   "*IF *VALUE NT_Process.%_Processor_Time *GE 65 *AND 
        *VALUE NT_Process.Priority_Base *NE 0"

   "*IF (*SIT NT_Memory_Pages_Sec *EQ *TRUE) *AND 
        (*SIT NT_Percent_Processor_Time *EQ *TRUE)"

Note:

You cannot nest double-quotes inside the double-quotes that surround the formula, although you can have one pair of single quotes within the double-quote pair.

Distribution

The situation description. Input should be a valid managed system name or names, such as:

-p Distribution="Primary:HDCHASDSTC0219:NT,Primary:

HDCHASDSTC0420:NT"

For multiple managed systems, separate each with a comma (,). To distribute to all monitoring agents of a given type, specify that type (such as '*NT_SYSTEM', '*ALL_UNIX', and '*LINUX_SYSTEM').

Advice

Expert Advice for situation. Input given as text enclosed between double quotes, such as:

-p Advice="Save the work.."

Action

Action to be performed when the situation becomes true. Program name or command to be executed, given as text enclosed between quotes.

-p Action="net send HDCHASDSTC0219 Save ur Work.."

You may need to use the situation editor to test the proper values. Limitations: It is not possible to specify in the CLI that the action is to be taken on each item should the condition be true for more than one item, nor that the action should be executed at the managed system, nor that the action is to take place at each interval should the condition stay true over multiple intervals.

RunOnStart

Determines whether the situation will start running on the managed systems upon creation, after editing, and whenever the monitoring agent or the monitoring server is started, a 'Yes' setting; or whether it required a manual start, a 'No' setting.

-p RunOnStart=Yes

SitInfo

Holds the Tivoli Enterprise Console® EIF data. It is all or any one of the following separated by ';' The SitInfo parameters must be enclosed in double quotes.

• Sev=severity

  can take values Critical or Warning or Minor or Harmless or Unknown.

• TFWD=[Y|N]
• TDST=n1[,n2...,n5]

  TDST can take up to 5 valid Tivoli Enterprise Console destination server IDs. For finding valid server IDs use the tacmd listeventdest command.

-p SitInfo="SEV=Critical;TFWD=Y;TDST=100"

-i|--import filename

Specifies the situation definition to import.

The command in this example creates a new situation called Sit1 based on an existing situation NT_Service_Error with the run on startup option set to no.

   tacmd createSit -s Sit1 -b NT_Service_Error -p runonstart=no

The command in this example creates a new situation called LogSpaceLow with a formula that tests the usage percentage attribute from the Windows® OS Monitored Logs group. A 90% or higher capacity causes an event to open and the advice given is to clear the log.

   tacmd createSit -s LogSpaceLow  -b NT_Log_Space_Low
                   -p formula="*IF *VALUE NT_Monitored_Logs_Rep *GE 90"
                   Advice="Clear log." runonstart=yes

The command in this example creates a new situation called DiskSpaceLow with a Critical severity, TEC event forwarding, and the Tivoli Enterprise Console destination.

   tacmd createSit -s new_test_Sit  -b NT_Disk_Space_Low
                   -p SitInfo="SEV=Critical;TFWD=Y;TDST=1,2"

The command in this example creates a new situation called ServiceError with a Critical severity, TEC event forwarding, and the Tivoli Enterprise Console destination. An elapsed time of more than 31 minutes causes an event to open and the advice given is to save your work.

tacmd createsit -s SaveWork -b NT_Service_Error -p Desc="Alerts User to save.." 
Formula="*IF *VALUE Local_Time.Minutes *GT 31" Advice="Please save your work..."
Interval="000/001500" Distribution="Primary:HDCHASDSTC0219:NT"
Action="net send HDCHASDSTC0219 Please Save your Work.." RunOnStart=Yes
SitInfo="SEV=Critical;TFWD=Y;TDST=100"

See Return codes

tacmd deleteSit

tacmd editSit

tacmd listSit

tacmd viewDepot

tacmd viewSit