TEC EIF for new ITM 6.1 User's

This is a short tutorial on the Tivoli Enterprise Console Event Integration Facility (EIF) for new ITM 6.1 user's that might not be familiar with TEC. ITM 6.1 uses the TEC EIF adapter to send it's events to TEC. All EIF based adapters share a common set of configuration keywords that can be used to control the behavior of the events being sent to TEC. This tutorial will discuss some of those keywords that can be used in configuring the ITM 6.1 TEC interface.

In the ITM 6.1 default install directory there is a file called om_tec.config that is the ITM 6.1 default EIF adapter configuration. For example on my Windows TEMS it is:

D:\IBM\ITM\cms\TECLIB\om_tec.config

You can edit this file directly or you can use the Manage Tivoli Enterprise Monitoring Services (MTEMS) console to configure this file. If you change this file you have to recycle your TEMS.

The keywords that can be used in this file are:

ServerLocation

This keyword specifies the server or IP address of the TEC server.

ServerPort

This is the port that the TEC server is listening on. The default for a Unix TEC server is 0 (i.e. portmapper) or 5529 for Windows. On the TEC server there is a file called .tec_config in the default TEC install directory that controls the listening port of TEC (e.g., d:\Tivoli\bin\w32-ix86\TME\TEC\.tec_config). The 'tec_recv_agent_port'keyword in this file defines what port TEC will listen on (e.g., tec_recv_agent_port=5529 ).

BufferEvents

This keyword controls whether the ITM 6.1 EIF adapter will buffer events in a file if the TEC server is down. In almost all cases you would want to leave this set to 'YES'?

BufEvtPath

This keyword controls the location of the buffered file if the TEC server is down. In most cases you would want to leave the default location alone (i.e., BufEvtPath=./TECLIB/om_tec.cache). However, on a very chatty TEMS (i.e., a lot of traffic to TEC) you might want to make sure this buffer file is on a file system that allows dynamic space requirements.

TestMode

This keyword is not in the default om_tec.config file. However, it can be used to test the event flow to TEC. If you set the TestMode=YES keyword then all events will be sent to a file specified by the ServerLocation keyword. For example,

ServerLocation=./TECLIB/events.out
TestMode=YES

This can be helpful if you are in a test lab and you don't have access to a TEC server or you need to debug why events are not getting forwarded over to the TEC server.

FilterMode

Most EIF adapters allow you to filter events before they are sent to TEC. For example, ITM 6.1 might be running a situation that monitors the NT_Process attribute group. Every time that situation creates an ITM 6.1 event a TEC event will be sent as well. However, in the EIF configuration file you could filter out all ITM_NT_Process events therefore suppressing them from going to TEC.

The FilterMode keyword controls whether the filters defined in the EIF config file will be used as excludes or includes. The 'FilterMode=OUT'keyword is the default. FilterMode=OUT tells the EIF adapter to exclude all events that meet the filter event criteria. The 'FilterMode=IN'keyword specifies just the opposite. With FilterMode=IN only the events that meet the filter criteria will be sent to TEC.

Filter

Filter statements in an EIF configuration file have the following format:


Filter:Class=;attribute=;attribute=;...


In our NT_Process example a filter would look as follows:

FilterMode=OUT
Filter:Class=ITM_NT_Process

You can define multiple filter statements in the EIF configuration file. For example,

FilterMode=IN
Filter:Class=ITM_NT_Services
Filter:Class=ITM_NT_Memory
Filter:Class=ITM_NT_Process

In this example the only events that ITM 6.1 will send to TEC are the ITM_NT_Services, ITM_NT_Memory, and ITM_NT_Process.

You can also use regular expression in your filter definitions as follows:

FilterMode=IN
Filter:Class=re:'ITM_NT.*'

In this example only events that start with ???????????????ITM_NT'will be sent to TEC.

You can also filter on specific attributes as follows:

FilterMode=OUT
Filter:Class=re:'ITM_NT_.*';severity='UNKNOWN'

This example will filter out all ITM 6.1 events that have a severity of UNKNOWN. By default ITM 6.1 sends all TEC events with a severity of UNKOWN unless the situation name is suffixed with the Critical or Warning severity (e.g., _Crit, _Cri, _Critical, _Warn, ???????????????)?or the tecserver.txt mapping file is used.

For more information about TEC adapter keywords see:

http://publib.boulder.ibm.com/tividd/td/tec/SC32-1242-00/en_US/HTML/ecoamsttfrm.htm