IBM Support

Making your life easier: ITM-OMNIBUS deduplication trigger

Technical Blog Post


Abstract

Making your life easier: ITM-OMNIBUS deduplication trigger

Body

 

First of all , I have to tell I'm not an expert in Omnibus and therefore I don't have a lot of skill to modify the triggers and rules in omnibus but it is not the intention of this blog at all. The Subject is to know how much important is to modify the default deduplication trigger and the different behaviors of the events arriving from ITM to Omnibus when it has been done or not.

The deduplication trigger provided by the itm event synchronization component and starndard deduplication triggers provided with Omnibus are in conflict with each other. The standard deduplication triggers modify the severity and summary attributes that results in those attributes having incorrect values for ITM events for both unidimension (ITM ----> Omnibus) and bidirectional (ITM <--->Omnibus).

 

I don't know why but usually we focus our effort installing:

  • ITM env. (TEPS,TEMS, AGENTS)

  • Omnibus

  • Event synchronization component (SUF, rule, probe..)

  • Creating eventdestination , defining the EIF in TEMS

but forgot to modify the default/standard deduplication , finding us with alarms in omnibus which don't have or have incomplete attributes, for example , the msg slot.

It is true that not having another triggers defined correctly in omnibus we may find similar issues but a great point to start is to make sure that we have done the right thing on the deduplication trigger.

 

NOTE: In architecture without high availability we modify the deduplication trigger In architecture with high availability we modify the agg_deduplication trigger  in each objectserver.

 

This blog is going to cover this subjects:

A. Preview:Setting the bases to analyze this topic

B. Behavior without standard deduplication modified

C. Behavior once the standard deduplication was changed

 

 

A. Preview:Setting the bases to analyze this topic

 

1 . Set the trace “KBB_RAS='ERROR(UNIT:KFAOT ALL)' ” in HUB/TEMS:

  • unix: <install path>/config/<tems name>_ms_<tems name>.config
  • windows: candlehome\cms\KBBENV

So we can check that the events is being sent to omnibus and how.

 

2.  Create a test situation: “Linux_Missing_Process” which is monitoring if the process "xcalc" or "xclock" are missed .

 

image

 

And define with variables the msg slot in “EIF slot configuration”.

 

image

 

 

B. Behavior without standard deduplication modified.

 

1. Close the “xcalc” and “xclock” processes getting the situation is “true” and therefore appearing in SEC.

 

image

 

2. Notice the event has been sent from TEMS to the eventdestination by looking at ms log:

5442BF23.00DE-B:kfaotste.c,86,"Send_Tec_Events") tec event<ITM_KLZ_Process;cms_hostname='VM01';cms_port='3661';integration_type='N';master_reset_flag='';appl_label='';situation_name='Linux_Missing_Process';situation_type='S';situation_origin='VM01:LZ';situation_time='10/18/2014 14:27:31.000';situation_status='Y';situation_thrunode='TEMS';situation_fullname='Linux_Missing_Process';situation_displayitem='xcalc';source='ITM';sub_source='VM01:LZ';hostname='VM01';origin='192.168.100.1';sub_origin='xcalc';adapter_host='VM01';date='10/18/2014';severity='FATAL';process_command_name='xcalc';system_name='VM01:LZ';msg='xcalc is down on VM01';situation_eventdata='~';END

(5442BF23.01C6-B:kfaotste.c,86,"Send_Tec_Events") tec event<ITM_KLZ_Process;cms_hostname='VM01';cms_port='3661';integration_type='N';master_reset_flag='';appl_label='';situation_name='Linux_Missing_Process';situation_type='S';situation_origin='VM01:LZ';situation_time='10/18/2014 14:27:31.001';situation_status='Y';situation_thrunode='TEMS';situation_fullname='Linux_Missing_Process';situation_displayitem='xclock';source='ITM';sub_source='VM01:LZ';hostname='VM01';origin='192.168.100.1';sub_origin='xclock';adapter_host='VM01';date='10/18/2014';severity='FATAL';process_command_name='xclock';system_name='VM01:LZ';msg='xclock is down on VM01';situation_eventdata='~';END

 

As we can see:

  • “situation status =Y” (open/true).
  • The msg slot is sent correctly.

 

3. Eventually the events arrive to the omnibus:

image

 

4. Open xcalc and xclock processes to return the “Linux_Missing_Process” situation to false. Therefore both situations are closed

    and removed   from SEC.

 

5. At that moment, the TEMS sends a new event to the omnibus with

  • “situation status=N” (closed)
  •  and msg slot imcomplete.

(5442DA35.0124-B:kfaotste.c,86,"Send_Tec_Events") tec event<ITM_KLZ_Process;cms_hostname='VM01';cms_port='3661';integration_type='U';master_reset_flag='';appl_label='';situation_name='Linux_Missing_Process';situation_type='S';situation_origin='VM01:LZ';situation_time='10/18/2014 16:23:01.001';situation_status='N';situation_thrunode='TEMS';situation_fullname='Linux_Missing_Process';situation_displayitem='xcalc';source='ITM';sub_source='VM01:LZ';hostname='VM01';origin='192.168.100.1';sub_origin='xcalc';adapter_host='VM01';date='10/18/2014';                           severity='FATAL';msg=' is down on VM01';situation_eventdata='~';END

(5442DA35.0095-B:kfaotste.c,86,"Send_Tec_Events") tec event<ITM_KLZ_Process;cms_hostname='VM01';cms_port='3661';integration_type='U';master_reset_flag='';appl_label='';situation_name='Linux_Missing_Process';situation_type='S';situation_origin='VM01:LZ';situation_time='10/18/2014 16:23:01.000';situation_status='N';situation_thrunode='TEMS';situation_fullname='Linux_Missing_Process';situation_displayitem='xclock';source='ITM';sub_source='VM01:LZ';hostname='VM01';origin='192.168.100.1';sub_origin='xclock';adapter_host='VM01';date='10/18/2014';                          severity='FATAL';msg=' is down on VM01';situation_eventdata='~';END

 

NOTE: it is not a bug or defect. The situation_status='N' is a result of an event has gone false. Such events will not have any situation event                       specific data including the situation formula. Just the base information such as situation_type, situation_status, originnode, timestamp,       situation_thrunode etc. will be present.

Only events with situation_status='Y' i.e. when a situation becomes true, have data values for all the slots in the event. All such events will                     have all the data and the situation formula in the msg slot.

 

6.  On the other hand, Omnibus has not deleted/removed both events but it has changed the “ITMStatus” to N , increased the “count”             and mixed  some variables in “summary” column.

image

 

 

 

C. Behavior once the standard deduplication was changed.

 

1. Modify default deduplication triggers

  • run ../omnibus/bin/nco_config to start omnibus Administrator
  • connect to the object server

  • Select Automation + Triggers from the menu

  • double click on “deduplication” or “agg_deduplication” trigger.

  • On “WHEN” tag, enter:

new.Type != 20 and new.Type != 21

image

 

  • Save the trigger and exist from nco_config interface.

 

2. When the “Linux_Missing_Process” situation is true

  • Both events arrives to the SEC
  • TEMS sends both events to omnibus as we described before with

Situation_status=Y and msg slot complete

  • Omnibus gets both complete events:

 

image

 

3. Start the “xcalc” and “xclock” processes to return the situation to false

  • The events disappears of SEC in ITM
  • TEMS sends both events to omnibus as we described before in point B. with

Situation_status=N and msg slot incomplete.

  • Omnibus both events change to ITMStatus=N , of color

image

 

  • Eventually , both events disappear:

image

 

Thanks for Reading, Fran.

 

image

 

Check out all our other posts and updates:

Academy Blogs:                   
http://ibm.co/1sPj9E8  
Academy Videos:                  http://bit.ly/1wFKveY
Academy Google+:              http://bit.ly/1sR5QTV
Academy Twitter Handle:   http://bit.ly/1CknfoF    

 

[{"Business Unit":{"code":"BU004","label":"Hybrid Cloud"},"Product":{"code":"","label":""},"Component":"","Platform":[{"code":"","label":""}],"Version":"","Edition":""}]

UID

ibm11083381