hp OpenView TeMIP Event Logging User s Guide Edition: for the UNIX Operating System March 2003

Transcription

1 hp OpenView TeMIP Event Logging User s Guide Edition: for the UNIX Operating System March 2003 Copyright 2003 Hewlett-Packard Company

2 Legal Notices Warranty Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material. A copy of the specific warranty terms applicable to your Hewlett-Packard product can be obtained from your local Sales and Service Office. Restricted Rights Legend Use, duplication or disclosure by the U.S. Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause in DFARS Hewlett-Packard Company United States of America Rights for non-dod U.S. Government Departments and Agencies are as set forth in FAR (c)(1,2). Copyright Notices Copyright Hewlett-Packard Company, all rights reserved. No part of this document may be copied, reproduced, or translated to another language without the prior written consent of Hewlett-Packard Company. The information contained in this material is subject to change without notice. Trademark Notices Adobe and Acrobat are trademarks of Adobe Systems Incorporated. HP-UX Release and later and HP-UX Release and later (in both 32 and 64-bit configurations) on all HP 9000 computers are Open Group UNIX 95 branded products. Java is a U.S. trademark of Sun Microsystems, Inc. Microsoft is a U.S. registered trademark of Microsoft Corporation. Netscape is a U.S. trademark of Netscape Communications Corporation. NMOS is a trademark of RiverSoft Technologies Limited. Oracle is a registered U.S. trademark of Oracle Corporation, Redwood City, California. Oracle7 and Oracle7 Server are trademarks of Oracle Corporation, Redwood City, California. PostScript is a trademark of Adobe Systems Incorporated. Riversoft is a trademark of RiverSoft Technologies Limited. UNIX is a registered trademark of The Open Group. Windows and Windows NT are U.S. registered trademarks of Microsoft Corporation. X/Open is a registered trademark, and the X device is a trademark of X/Open Company Ltd. in the UK and other countries. All other product names are the property of their respective trademark or service mark holders and are hereby acknowledged. 2

3 Contents Preface... 5 Chapter 1 Introduction Event Collection Event Logging Event Record Classes OSI System Object Event Log States Event Record Retrieval Time Modes TeMIP Process Architecture Foreground Process Background Processes Framework Command Line Interface System Considerations Full Entity Name for Alarm Rules Maximum Event Size Low Level Filtering of Events Chapter 2 Defining The Event Logging Environment Event Logging in a Distributed System Distributed Configuration Example How to Configure a Distributed System ASCII Synonym Support Customization Creating ASCII Synonyms ASCII Synonym Display Preconditions Creating and Defining an Event Log on Tru64 UNIX Event Log Arguments Associated Domain Discriminator Construct Scheduling Package Reference Log Name Initial Administrative State Max Log Size Capacity Alarm Threshold Log Full Action Repository Location Event Filtering Event Collection Scheduling Using the Framework Command Line (FCL) Chapter 3 Managing Event Logging Managing the Event Logging Environment Accessing the Event Log

4 3.3 Starting and Stopping Event Logging Displaying the Event Log Attributes Changing the Event Log Attribute Values Self-Monitoring Event Log Panel Window What the Window Shows Viewing Event Records Management Operations From the Window on Tru64 UNIX The Menu Bar The Buttons Chapter 4 Handling Event Records Using The Mouse Desktop Manager Window on Tru64 UNIX Viewing Event Records on Tru64 UNIX Stand-Alone Operation Segmented Retrieval Event Records View Window Menu Bar Event Record Information Displayed The Event Records View Window Buttons Refreshing the Display Using the Search Events Function Selecting Search Criteria Expanding a Search Handling Event Records Displaying Full Information Displaying Other Records Printing Event Record Information Printing Event Record Information to File Deleting Event Records Chapter 5 Online Customizing Options Introduction Changing the Default Printer Changing the Segment Size Value Saving Window Sizes Customizing the Event List Search Scope Dependence Saving the New Values Chapter 6 User Messages TeMIP Framework Exception Messages TeMIP Internal Error Messages User Information Messages Appendix A Operation Context and Log Error Messages A.1 List of Error Messages Index

5 Preface This document explains how to configure and use the TeMIP Fault Management Event Logging function. It contains information related to the TeMIP Event Logging FM and the associated GUI (TeMIP Event Logging PM), accessible from the TeMIP Client. All references to the TeMIP Iconic Map are for Tru64 UNIX only. Supported Software The supported software referred to in this document is as follows: TeMIP HP OpenView TeMIP Alarm Handling and Event Log Server 5.0 UNIX HP Tru64 UNIX Sun Solaris HP-UX The term UNIX is used as a generic reference to the operating system, unless otherwise specified. Typographical Conventions Courier Font: Source code and examples of file contents. Commands that you enter on the screen. Pathnames Keyboard key names Italic Text: Filenames, programs and parameters. The names of other documents referenced in this manual. Bold Text: To introduce new terms and to emphasize important words. Associated Documents The following documents contain useful reference information: OpenView TeMIP Product Family Introduction. OpenView TeMIP Customization Guide. OpenView TeMIP Iconic Map and FCL User s Guide. OpenView TeMIP Director Configuration Management Guide. OpenView TeMIP Fault Management Reference Guide. OpenView TeMIP Alarm Handling User s Guide. 5

6 OpenView TeMIP Classic Alarm Handling Client User s Guide. OpenView TeMIP Event Filtering and Correlation User s Guide. For a full list of TeMIP documents, refer to Appendix A of the OpenView TeMIP Product Family Introduction. Support Please visit our HP OpenView web site at: HP OpenView There you will find contact information as well as details about OpenView products, services and support. The OpenView support area of the OpenView web site includes: Downloadable documentation Troubleshooting information Patches and updates Problem reporting Training information Support program information 6

7 Chapter 1 Introduction This chapter introduces general information about the TeMIP Event Logging function. Topics covered are: Section 1.1 Event Collection Section 1.2 Event Logging Section 1.3 Event Record Classes Section 1.4 OSI System Object Section 1.5 Event Log States Section 1.6 Event Record Retrieval Section 1.7 Time Modes Section 1.8 TeMIP Process Architecture Section 1.9 Framework Command Line Interface Section 1.10 System Considerations Section 1.11 Low Level Filtering of Events 1.1 Event Collection The TeMIP Event Logging function is concerned with the collection and storing of all types of OSI events occurring in the network. Once stored, the event information can later be retrieved and used for analysis or whatever processing is required by the fault management system. Even status changes of Event Logs themselves (and operation contexts) are events that can be logged by the Event Logging function. Instances of the Event Log Multiple instances of Event Logs can be created, each with its own event collection characteristics. This enables the event traffic to be filtered and collected in different ways, to suit the various requirements of your particular fault management scheme. In each Event Log instance that you create, the Discriminator Construct and Scheduling Package provide you with the means for defining the way in which events are filtered and when they are collected. Background Event Collection When event collection has been started for an Event Log (the Administrative State of the Log set to Unlocked), the collection of events continues without user intervention. Events are collected according to how the Discriminator Construct and Scheduling Package are defined, until 7

8 event collection is specifically stopped, through one of the following conditions: The Administrative State is changed to Locked by the user. The Operational State is changed to disabled due to management module or service malfunction. The Event Log becomes full. The scheduled period of logging activity is over. 1.2 Event Logging TeMIP is based on object-oriented technology and makes use of two OSI compliant support objects in the Event Logging process. These are the Log Object and the Log Record Object. The Log Object controls the way in which event collection is carried out, and also provides the repository for the Log Record Objects. The Log Record Object enables the user to handle and manipulate the event information through the user interface. Events that are successfully collected, that is, events that pass through the discriminator filter during a scheduled period of logging activity, are stored by the Event Log in a repository as OSI-compliant Event Records. You define the location of the repository when creating an Event Log by assigning an appropriate UNIX path name. Note In this user guide, the Log Object and Log Record Object are referred to less formally as the Event Log and Event Record respectively. TeMIP logs events according to how you have constructed and configured the Event Logging function. As a user of the Event Logging function you therefore need to know how to: Set up the Event Logging environment - Create and define Event Log instances - Set the event collection characteristics of the Event Log Control the Event Logging activity: - Start or stop the Event Logging activity - Change the Event Logging characteristics Handle the event data: - Retrieve event records from the database - Display, print or delete the event records 1.3 Event Record Classes Different types of events occurring in the network produce event records with differing information formats. The OSI standards define seven possible classes of events, and these are supported by the TeMIP Event Logging function, namely: 8

9 Alarm record Security alarm record Object creation record Object deletion record Attribute value change record State change record Relationship change records Generic Record Class In additional to the seven OSI-defined record classes, TeMIP supports one extra class, identified as Log Record. The purpose of the Log Record class is to assist in the retrieval of event records from the repository. The Log Record class performs a "wildcard" function by allowing you to make a search through all event record classes in a single operation. See Section 1.6 for an explanation and an example of usage. 1.4 OSI System Object TeMIP Event Logging function makes use of the OSI-defined OSI System Object to support Event Logging. When you create an instance of an Event Log it is created as a Child of the OSI System Object class. The OSI System Object is a global entity class. The Event Log hierarchy is shown in Figure 1-1. Figure 1-1 The Event Log Hierarchy Local OSI System The OSI System represents the current system where the TeMIP Operations System (OS) is located. Therefore, a single OSI System Object is created and registered on each TeMIPdirector that is installed in the network. During the setup and configuration process (see the OpenView TeMIP Director Configuration and Management Guide), a name is assigned to identify the "local" instance of the OSI System, which is usually the same name as your local node or processor. You can only create an Event Log as a child of a Local OSI System. However, you can create an Event Log as a child of a Local OSI System on a remote Director. 9

10 OSI System Directives Five directives are provided for the OSI System: Show, to return the identifier attributes of the OSI System Register, to register the current OSI System Deregister, to de-register the current OSI System Create, to create an OSI System Delete, to delete an OSI System Creating the OSI System in the Domain In order to create Event Logs in a given domain, the local OSI System must be added to the domain map. This is done in the same way as creating any other entity on the domain map using the TeMIP Graphics Toolbar. When you create the OSI System, TeMIP verifies that the entity class is registered and allows you to add the OSI System icon to the domain map. 1.5 Event Log States The event collection capability of an Event Log depends on the Log's two states, which are the: Administrative State Operational State The Administrative State and Operational State of the Event Log together determine whether the Log's ability to collect events is Enabled or Disabled. The Administrative State The Administrative State of the Event Log is controlled by the user through directives that are available at the TeMIP management interface. These directives are: Suspend - Puts the Event Log into the Locked state and disables event collection. Resume - Puts the Event Log into the Unlocked state and enables event collection. Delete - Puts the Event Log into the transient state of ShuttingDown as the delete operation is carried out. See Table 3-7 for a summary of the operations that are possible in the Locked and Unlocked Administrative States. The Operational State The Operational State of the Event Log is governed by internal incidents, such as: Internal Event Log Function Module (FM) processing failure The serviceability or availability of other FMs that provide services for, or are used by, the Event Log FM. 10

11 See also Section The Availability Status The Availability Status is an Event Log attribute that provides additional information concerning the Operational State. The Operational State is dependent on the availability of other modules and services. A situation could arise, where a service that is not essential becomes unavailable, and in this case the Operational State could be reduced in effectiveness (degraded), but not disabled. In other words, the Operational State is qualified according to the Availability Status of external support. The Availability Status is indicated in the Event Log Panel window. For Example: If TeMIP detects that: An event has been lost (checked by the event manager and reported by the Notification FM) or A remote director has been stopped during collection of an alarm/event it assumes that a problem has occurred that has reduced the reliability of the event collection mechanism. In this case the Availability Status is set to degraded to indicate a possible collection capability of less than 100%. The Availability Status remains degraded until the problem is cleared using the Cleanup directive, available from the Event Log Panel window Operation menu (LOG Directives... entry). This resets the Availability Status and its associated Error Condition Explanation. Note that a State Change event is generated. See also Section The possible Availability Status indications are given in Table 1-1. Table 1-1 Availability Status Operational State Possible Status Indications Comment Enabled No indication All OK Degraded Off duty A transient problem was detected but collection is still running Scheduling in operation, an inactive interval Disabled Failed A fatal processing error, collection stopped Dependency Log Full Failed, Dependency Failed, Log Full Failed, Dependency, Log Full In Test Power off Non-fatal processing error, but collection stopped The Event Log is full Values as described above Values as described above Values as described above The TeMIP Event Logging function is starting up The collection process has been stopped 11

12 1.6 Event Record Retrieval In order to retrieve and view event record data from the repository, it is necessary to specify the class of records to be searched. When you first select the View Event Records option from the TeMIP Client, TeMIP automatically begins to retrieve all event records, by using the Log Record class. You can restrict the scope of the search by specifying the event record class to be searched, within the set of seven defined sub-classes, plus other criteria such as event type and so on. Generic Searches using the Log Record Class In some cases, the need to specify a particular event record class for a search is somewhat restrictive. For example, suppose you needed to retrieve and analyze all events that occurred during a certain period of time. Using the OSI-defined record classes, you would need to carry out separate searches through each of the seven classes. The Log Record class is provided for this type of situation. By specifying Log Record as the class to be searched, the search is actually made through all the event record classes. The Log Record class effectively provides a "wildcard" function for event record searches. 1.7 Time Modes During TeMIP configuration you are asked to specify default input and output time modes. If you want to change this format later, you can do so by changing the time mode variables contained in the configuration file.temip_config, located in the directory /var/opt/temip/conf. Refer to the OpenView TeMIP System Reference Manual for further details. 1.8 TeMIP Process Architecture This section gives a brief explanation of the TeMIP process architecture, to help in the understanding of TeMIPoperation and the use of certain utility programs. There are two categories of TeMIPprocess that need to be considered: Foreground Process - The TeMIP Function Module process that runs under the director_user_name of the individual TeMIP users (Foreground process Userid = director_user_name). Background Processes - Alarm and event collection management processes that run under TeMIP itself (Background process Userid = director_user_name) Foreground Process The foreground process handles the directives that the user requests through a user interface. The foreground process communicates with the background processes by way of the TeMIP Framework Event Manager. 12

13 1.8.2 Background Processes Background processes provide support for all users of the TeMIP functions and are further divided into two groups: 1. Server Process - The Event Logging FM has a single server process that handles the creation and deletion of Event Log instances. The server process also creates and performs general management of the Child processes. 2. Child Processes - Child processes are created to handle event collection for each Event Log. There are as many child processes as there are instances of Event Logs. The child processes also manage the status of the Event Logs with which they are associated. The background processes are common to all TeMIP users. For example, if the Event Logging background processes are stopped, the Event Logging function is disabled for all users. Figure 1-2 illustrates the TeMIP process structure. Figure 1-2 Event Logging Process Architecture 1.9 Framework Command Line Interface The FCL is a standard TeMIP Framework Presentation Module that is available to the TeMIP user. It is a simple command line facility that enables the TeMIP Framework User Commands to be entered from character cell terminals. The FCL makes possible the management of TeMIP from almost anywhere in the network. This is convenient for management personnel who may 13

14 need access while temporarily away from the normal X-Windows workstations with only a character cell terminal available. Starting the FCL At the UNIX prompt, type manage: > manage This will produce the TeMIP Framework prompt: TeMIP Framework (V5.0.0) TeMIP > You can now use any of the FCL commands to manage the Event Logging function System Considerations This section provides a number of practical points to consider in the configuration and usage of TeMIP Full Entity Name for Alarm Rules When defining alarm rules you must use the FullEntityName identifier of the instance. This is because the TeMIP PM uses Target Entity or Managed Object values to work with, but waits for a full name Maximum Event Size The maximum event size that can be handled by the Event Log FM is 64 K- bytes Low Level Filtering of Events In TeMIP, filtering of events takes place at two levels, a low level and a high level. High level filtering takes place at the level of the Log entity, which provides a particular view of network activity. Low level filtering takes place at source and is designed to prevent a flood of events arriving at the user interface in the event of a problem. Several types of low level filter can be defined, to provide you with the flexibility to use filters that suit a particular type of problem or that match your specific network requirements. A detailed description of how to create, use and manage Event Filters is given in the OpenView TeMIP Event Filtering and Correlation User s Guide. 14

15 Defining The Event Logging Environment Chapter 2 This chapter explains how to set up the event logging environment after the installation process is completed. Topics covered are: Section 2.1 Event Logging in a Distributed System Section 2.2 ASCII Synonym Support Section 2.3 Preconditions Section 2.4 Creating and defining an Event Log Section 2.5 Event Log Arguments Section 2.6 Event Filtering Section 2.7 Event Collection Scheduling. 2.1 Event Logging in a Distributed System Distributed event logging enables you to access and monitor Logs located on remote nodes (or Directors). The Log Panel window (launched from the TeMIP Client) opens and displays a list of all the registered Logs known to the system for the selected OSI System, see Section 3.7. You can choose the Logs you want to monitor from this list regardless of whether they are managed by a local Director or a remote Director. If you select more than one OSI System, a Log Panel window is opened for each OSI System. In TeMIP Event Logging, access to remote Logs is based exclusively on Entity Access Distribution. This uses the Managing Director attribute, allocated at OSI System registration time, to locate the Director on which the Log exists. This Director is designated as the Managing Director for the OSI System parent entity and is responsible for all call requests and responses to and from it. Note that the Director holding the OSI System (and its associated Log and Log Record repository), may not be the Director holding the domain associated with the Log. Refer to the following documents for more detailed information on TeMIP distribution: OpenView TeMIP Product Family Introduction OpenView TeMIP Director Configuration and Management Guide. 15

16 2.1.1 Distributed Configuration Example Figure 2-1 shows an example of a simple configuration that has a log_a01 associated with domain_a0. These two entities are located on Director Toledo. A log_b21 associated with domain_b2 is located on Director Madrid; domain_b2 is also a subdomain of domain_a0. In this configuration, the distribution of TeMIP allows you to use a Presentation Module situated on either Director to: Monitor transparently and in real-time, any Event Log situated locally or remotely. Monitor transparently and in real-time, any domain, its subdomains and members situated locally or remotely. Access transparently any entity in the distributed system and perform (allowed) management operations on it. Access transparently the Event Log Record repository information of any datastore in the system. The only condition is that the target OSI Systems must have a Managing Director assigned to them to grant access and handle the calls. Once you have created an entity and assigned a Managing Director, the entity is always accessed through this Director using Entity Access Distribution. 16

17 Figure 2-1 Distributed Event Logs (only on Tru64 UNIX using IMPM) How to Configure a Distributed System You can configure your system in three ways: From the Iconic Map (only on Tru64 UNIX) From the FCL PM. From the TeMIP Map Editor Client. For more details refer to the OpenView TeMIP Client Overview. 17

18 Configuring from the Iconic Map on Tru64 UNIX Refer to Section 2.4 for details of how to create Event Logs from the Iconic Map. For details of how to create domains and domain members, refer to the OpenView TeMIP Iconic Map and FCL User s Guide Configuring from the FCL You may want to populate your database from the FCL using a script file. However, you must take care to ensure that the entities are created on the correct Managing Director. Correct configuration requires a "partial registration" to be done before the entity is created; otherwise the Managing Director of the entity you are about to create is not known to TNS. If the Managing Director attribute is not defined, the default value is used, which is the Director from where you issue the command. The following example shows the steps involved to create the configuration shown in Figure Use the following commands to "partially register" domain_a0 and domain_b2 in TNS specifying a Managing Director for each domain: register domain palerm_ns:.domain_a0 Operation = plan, Managing Director = palerm_ns:.temip.toledo_director register domain palerm_ns:.domain_b2 Operation = plan, Managing Director = palerm_ns:.temip.madrid_director 2. Use the following commands to create the domains domain_a0, domain_a1 and domain_b2: create domain palerm_ns:.domain_a0 create domain palerm_ns:.domain_b2 If these commands are entered alone, the domains are created on the local Director. 3. Use the following commands to "fully register" the domains domain_a0, domain_a1 and domain_b2: register domain palerm_ns:.domain_a0 register domain palerm_ns:.domain_b2 4. Use the following commands to create domain_b2 as a subdomain of domain_a0: create domain palerm_ns:.domain_a0 member palerm_ns:.domain_b2 5. Use the following command to "partially register" the OSI System osi_a in TNS with the Managing Director Toledo: register OSI palerm_ns:.osi_a Operation = plan, Managing Director = palerm_ns:.temip.toledo_director 18

19 6. Use the following command to create the OSI System osi_a: create OSI palerm_ns:.osi_a 7. Use the following command to "fully register" the OSI System osi_a: register OSI palerm_ns:.osi_a 8. Use the following command to "partially register" the OSI System osi_b in TNS with the Managing Director Madrid: register OSI palerm_ns:.osi_b Operation = plan, Managing Director = palerm_ns:.temip.madrid_director 9. Use the following command to create the OSI System osi_b: create OSI palerm_ns:.osi_b 10. Use the following command to "fully register" the OSI System osi_b: register OSI palerm_ns:.osi_b 11. Use the following command to create log_a01 and associate it with domain_a0: create OSI palerm_ns:.osi_a log log_a01 Associated Domain = palerm_ns:.domain_a0, INITIAL ADMINISTRATIVE STATE = locked 12. Use the following command to create log_b21 and associate it with domain_b2: create OSI palerm_ns:.osi_b log log_b21 Associated Domain = palerm_ns:.domain_b2, INITIAL ADMINISTRATIVE STATE = locked 13. OSI Systems can be defined as members of domain(s) that are managed by different Directors. You can define OSI Systems as members of domains using commands such as the following (these commands are not represented in Figure 2-1): create domain palerm_ns:.domain_a0 member palerm_ns:.osi_a create domain palerm_ns:.domain_b2 member palerm_ns:.osi_b 2.2 ASCII Synonym Support ASCII synonyms enable you to define an alternative name (synonym) for the entities that exist in your TeMIP system, and display this name in any Presentation Module (PM) or application capable of displaying TeMIP entities. An ASCII synonym can be associated with an entity specification to provide a platform wide instance naming alternative, including user friendly names. An alternate naming system could, for example, involve the use of 19

20 shorter names, which avoids "crowding" of the display, especially in the case of large networks displaying many entities. For example, the entity: NETWORK daz1 NE 28 SHELF 3 SLOT 4 DEVICE 12a could be represented by the synonym: DEVICE ` a` Customization ASCII synonym support can be configured on a director (global) or application (specific) basis using the environment variables: TEMIP_SYNO_ASCII_USE <APPLI_NAME>_SYNO_ASCII_USE You can use these variables to set the display of ASCII synonyms to On or Off. The default value is Off (disabled). For further details of synonyms and the environment variables you can use to customize the ASCII synonym behavior, refer to the OpenView TeMIP Customization Guide Creating ASCII Synonyms ASCII synonyms can be created using the Iconic Map PM Add Entity function or by directly inputting commands at the FCL PM. Refer to the OpenView TeMIP Iconic Map and FCL User s Guide for further details ASCII Synonym Display ASCII synonyms are supported for the following windows: Event Records View window; see Section 4.3. Search Event Records window; see Section 4.4. The following fields support ASCII synonyms in the two windows listed above: Managed Object Target Entity Domain Figure 2-2 shows an example of the Event Records View window with synonyms displayed for the Managed Object and Domain fields. 20

21 Figure 2-2 Synonyms in the Event Records View Window 2.3 Preconditions In Section 2.4 to Section 2.7 the following assumptions have been made: The Local OSI System object has been created and registered; see the OpenView TeMIP Director Configuration and Management Guide. The management domain in which you will be working is defined and populated. 2.4 Creating and Defining an Event Log on Tru64 UNIX The basic steps required to create a new Event Log instance are as follows: 1. Select and display the required domain 2. Double click on the OSI System to display the next lower level - The Children of the OSI System are displayed (LOG) 3. Click on the No Entry icon in the top right-hand corner of the Iconic Map window to unlock and display the Graphics Toolbar and the Add Entity icon at the bottom of the window. 4. Either click on the Add Entity icon or select Add Entity from the Edit pull-down menu - the Add Entity window opens. 5. Double click on OSI_SYSTEM in the left-hand panel to display the child entities and then select LOG - The Event Log Create form is displayed. 21

22 You can also select the icon you want to use for this Event Log in the right-hand panel. 6. Enter the LOG creation arguments. 7. Add the new Event Log to the domain in the map window. 8. Add the new Event Log to the Event Log Panel window. Figure 2-3 shows the Event Log Create Form that enables you to define the Event Log arguments. Figure 2-3 The Event Log Creation Form Note 1. An argument name in bold typeface means that a value must be provided (mandatory field). 2. If you add an entity to a domain with which an Event Log is already associated and collecting events, events from the new entity will not be taken into account until you perform a Suspend, then a Resume on the Event Log. This is a feature of the TeMIP Framework Notification FM. 22

23 2.5 Event Log Arguments The Event Log arguments are described in Section to Section Associated Domain Description: Name of the management domain with which this Event Log is associated, or the top level domain if this is a domain tree. Parameter format: Character string Domain_Name. FullName, 404 characters maximum. Default value: None, this is a mandatory entry Discriminator Construct Description: An event filter to select specified types of event. Parameter format: See Section 2.6. Default value: No discriminator construct filtering, all OSI compliant events accepted Scheduling Package Description: When, and for how long, the event collection mechanism is to be active. Parameter format: See Section 2.7. Default value: No scheduling, event collection continuously active, On 24 hours every day Reference Log Name Description: This argument allows you to specify an existing Log to be used as reference when creating a new Log. All characteristics of the new Log will be inherited from the referenced Log, with the exception of the Associated Domain Name (mandatory argument) and any other arguments that have been specifically defined in the creation process. Format: Character string FullName (TeMIP Framework datatype). Default: None. Example TeMIP> Create Osi_system Local_osi_system Log Europe_backup - TeMIP_> Associated Domain = domain_europe, - TeMIP_> Reference Log Name = Europe, - TeMIP_> Repository Location = /var/kits/temip_backup This command will create the Log Europe_backup, with all its characteristics inherited from Log Europe (for example, Scheduling Package, Discriminator Construct, and so on) except for the Associated Domain name, which will be domain_europe, and the repository location Initial Administrative State Description: The initial state of the Event Log when TeMIP is started. 23

24 Parameter format: Locked or Unlocked Default value: Unlocked Note If the initial Administrative State of the Event Log is set to Locked, you must use the Resume directive to begin event logging Max Log Size Description: The maximum size the Event Log can reach Parameter format: value in Octets Default value: Note If the value zero (0) is entered, this defines the Max Log Size as "system dependent". This means that all available free disk space will be used Capacity Alarm Threshold Description: At what capacity levels an OSI Processing Error alarm should be generated to indicate that the Event Log is filling up. At each level specified, an alarm is generated relative to the percentage of Max Log Size. Parameter format: A set of percentage integer values Default value: {80, 90, 100} Note 1. The input required for this argument is a SET of integers. When entering values you must click MB3 on the label of the field to begin the assignment, not on the text field itself as is usually the case. 2. Severity levels for the Processing Error alarm are hard-coded to produce the following alarms for the given percentage ranges: 00 to 39% = WARNING 40 to 59% = MINOR 60 to 79% = MAJOR 80 to 100% = CRITICAL If Max Log Size is set to null (0), alarms are generated according to disk usage. 24

25 3. When a Log is collecting, a Clearance alarm and/or a Processing Error alarm may be received. The behavior of the Capacity Alarm Threshold is as follows: When the Capacity Alarm Threshold is crossed, a Processing Error alarm is generated. When the storage capacity is returned to a value less than the Capacity Alarm Threshold, a Clearance alarm is generated. After a TeMIP startup, a Clearance alarm is generated to clear any previous Processing Error alarm concerning a storage capacity problem. If a storage capacity problem still exists, a new Processing Error alarm is generated. When any characteristic attribute is Set, a Clearance alarm is generated to clear any previous Processing Error alarm concerning a storage capacity problem. If a storage capacity problem still exists, a new Processing Error alarm is generated. When a Resume operation is performed, a Clearance alarm is generated to clear any previous Processing Error alarm concerning a storage capacity problem. If a storage capacity problem still exists, a new Processing Error alarm is generated Log Full Action Description: Action to be taken when the Event Log is full. In the present release, logging can only be stopped. Parameter format: Halt Default value: Halt Repository Location Description: The directory path name to where the event records file repository for this Event Log is to be located. This attribute is not settable once defined. Parameter format: UNIX directory/path name Default value: /var/opt/temip Note The repository filename is given by the Event Logging FM itself. 2.6 Event Filtering The Discriminator Construct attribute defines how event activity is to be filtered for this Event Log instance. When the Discriminator Construct attribute is selected from the Iconic Map (clicking MB3), a dedicated editor is called that enables you to make the required definitions quickly and easily. Full details on how to use the Discriminator editor are given in the OpenView TeMIP Classic Alarm Handling Client User s Guide. For further details of DC and SC Editor activation from the TeMIP Map Editor Client, please refer to the OpenView TeMIP Client Overview. 25

26 2.7 Event Collection Scheduling The Scheduling Package attribute defines when event collection by this Event Log instance is to be active. When the Scheduling Package attribute is selected from the Iconic Map (clicking MB3), a dedicated editor is called that enables you to make the required definitions quickly and easily. Full details on how to use the Scheduling package editor is given in the OpenView TeMIP Classic Alarm Handling Client User s Guide. For further details of DC and SC Editor activation from the TeMIP Map Editor Client, refer to the OpenView TeMIP Client Overview. 2.8 Using the Framework Command Line (FCL) An Event Log can be created using the FCL interface and all arguments can be entered, including the Discriminator Construct and Scheduling Package; see the OpenView TeMIP Alarm Handling User s Guide. If an Event Log is created using the FCL and the Discriminator Construct and Scheduling Package are not given a value, they are assigned their default values, which are - No filtering, all events accepted and On 24 hours every day respectively. 26

27 Chapter 3 Managing Event Logging This chapter describes the management operations you can perform to monitor and control the Event Logging environment. Topics covered are: Section 3.1 Managing the Event Logging Environment Section 3.2 Accessing the Event Log Section 3.3 Starting and stopping Event Logging Section 3.4 Displaying Event Log Attributes Section 3.5 Changing Event Log Attribute Values Section 3.6 Monitoring of the Event Logging Section 3.7 Event Log Panel Window 3.1 Managing the Event Logging Environment Management of the event logging environment is carried out by means of the Event Log directives (commands). These are described in Table 3-1. By means of the Log directives you can examine the status of the event logging environment and modify the way event collection is carried out by an Event Log. In order to perform a management function on an Event Log, the relevant Event Log must be selected. 3.2 Accessing the Event Log You can access the Event Log directives from three points: From the Iconic Map on Tru64 UNIX From the Event Log Panel window From the TeMIP Map Viewer Client. Refer to the OpenView TeMIP Client Overview. The following procedures apply to any management operation you wish to perform on an Event Log: Accessing from the Iconic Map on Tru64 UNIX 1. Display the required domain map 2. Double click on the OSI System - The next lower level of the hierarchy is displayed (LOG) 3. Double click on LOG - All the Event Log instances are displayed 27

28 4. Click on the required Log to select it 5. Select the operation you wish to perform on the Log from the Operations menu. Accessing from the Event Log Panel 1. Click on the required Event Log in the list to select it 2. Select LOG Directives... from the Operation menu 3. Select the required directive from the displayed pull-down menu. Table 3-1 Event Log Management Directives Directive Create Delete Suspend Resume Set Show Effect Creates a new Event Log instance Deletes an Event Log instance, provided that all event records have been deleted and the Log is in the Locked Administrative State Changes the Administrative State to Locked. Event Logging for this Log instance is stopped Changes the Administrative State to Unlocked. Event Logging for this Log instance is restarted Used to change characteristics of the Event Log that were entered in the Create operation Displays the Event Log status and other attributes. 3.3 Starting and Stopping Event Logging Event Logging is controlled from the user interface by means of the directives: Suspend Resume Suspend The Suspend directive changes the Administrative State of the selected Event Log to Locked. Event collection is stopped. However, the Show, Set and Delete directives are still effective. This directive causes an OSI Status Change event to be generated. To use the Suspend directive from Iconic Map: 1. Select the required Event Log 2. From the Operations menu select Suspend - The Suspend Form is displayed 3. Click on the Start button to initiate the Suspend directive. The result of the operation is displayed in the Suspend Form window. Resume The Resume directive changes the Administrative State of the selected Event Log to Unlocked. Event collection is restarted (or started, if the 28

29 initial Administrative State of the Event Log at create time was set to Locked). This directive causes an OSI Status Change event to be generated. To use the Resume directive from Iconic Map: 1. Select the required Event Log 2. Select Resume from the Operations menu - The Resume Form is displayed 3. Click on the Start button to initiate the Resume directive. The result of the operation is displayed in the Resume Form window. 3.4 Displaying the Event Log Attributes You display the current attribute values of a selected Event Log by means of the Show directive. To use the Show directive from Iconic Map: 1. Select the required Event Log 2. Select Show from the Operations menu 3. From the resulting pop-up menu select the attribute group required: - Identifiers (see Table 3-2) - Characteristics (see Table 3-3) - Status (see Table 3-4) - Counters (see Table 3-5). The Show Attributes Form is displayed showing the values of the attributes requested. The Identifier Attribute The Identifier Attribute is shown in Table 3-2. Table 3-2 Event Log Identifier Attribute Attribute LogId Comment Identity of the Log instance, given by the user at the time of the Create directive. 29

30 The Characteristic Attributes The Characteristic Attributes are shown in Table 3-3; these are the attributes whose values are defined during the Create directive, see Section 2.5. Table 3-3 Event Log Characteristic Attributes Attribute Domain Name Discriminator Construct Scheduling Package Max Log Size Capacity Alarm Threshold Repository Location Log Full Action Comment Monitored domain. All the OSI alarms or OSI events generated by entities within this domain are collected. This is a mandatory entry. Select the Expand option to read the current setting of the discriminator construct Select the Expand option to read the current setting of the scheduling package Maximum number of octets Set of percentage values Directory Pathnames of the repository Halt The Status Attributes The Status Attributes are shown in Table 3-4. Table 3-4 Event Log Status Attributes Attribute Administrative State Operational State Comment Locked or Unlocked Enabled or Disabled Availability Status See Table 1-1 The Counter Attributes The Log Counter Attributes are shown in Table 3-5. Table 3-5 Event Log Counter Attributes Attribute Current Log Size Number of Records Comment The current size of the log, measured in octets Shows the current number of records in the log 3.5 Changing the Event Log Attribute Values You can change the values of certain Event Log attributes by means of the Set directive, and so modify the event collection characteristics. Note that this operation can be performed when the Event Log is in the Locked or Unlocked Administrative State. 30

31 To change attribute values from Iconic Map: 1. Select the required Event Log 2. Select the Set directive from the Operation menu. When Set is selected, the Set Attributes Form is displayed, showing the attributes which you are able to change. Enter your new values as appropriate and Click on the Start button to accept them as the current values. Table 3-6 summarizes the operations that are possible in the two Administrative States of the Event Log. Table 3-6 Log Administrative Stat Options Summary Event Log Administrative State Operation Locked Unlocked Delete Event Records Yes Yes Delete Event Log Yes No Set Attributes Yes Yes Show Attributes Yes Yes Suspend No Yes Resume Yes No This operation can be carried out without loss of events during a Suspend / Resume sequence. 3.6 Self-Monitoring In addition to the monitoring of managed entities in the domain, an Event Log also monitors itself and all other Event Logs in the domain. When operations are performed on an Event log, OSI Events are generated. Table 3-7 summarizes these OSI events. Table 3-7 Summary of Event Log OSI Events OSI Event Operation State Change Attribute Value Change Object Creation Object Deletion Create Event Records - - Yes - Delete Event Log Yes Set - Yes - - Suspend Yes Resume Yes

32 3.7 Event Log Panel Window Entry from: Window Operation Remark Iconic Map (Tru64 UNIX) Iconic Map (Tru64 UNIX) Iconic Map (Tru64 UNIX) Applications menu - TeMIP Event Logging Select an OSI_System, then - Monitor Logs from the Operations menu Select an OSI_System, then - Select Icon from the Applications bar menu Opens the Event Log Panel window for the default OSI_System. This method will not function on a TeMIP PM Client because there is no local OSI_System. Opens the Event Log Panel window for the selected OSI_System. This is the only method that will function from a TeMIP PM Client. Opens the Event Log Panel window for the local OSI_System. This method will not function on a TeMIP PM Client because there is no local OSI_System. The Event Log Panel window allows you to perform the following: Monitor the status of the LOGs - children of the Local OSI_SYSTEM that are included in the Event Logging function View selected event records in the LOG repository. An example of the Event Log Panel window on Tru64 UNIX is shown in Figure 3-1. Note that the LOG Directives... and Open Associated Map Window buttons are not available on the Sun Solaris and HP-UX versions. Figure 3-1 The Event Log Panel Window What the Window Shows The following information is displayed in the Event Log Panel window: Administrative State (Icon, updated in real-time), locked or unlocked Operational State (Icon, updated in real-time), enabled or disabled TeMIP Status (Icon), at startup or event display initialization 32

33 LOG Name (Text) Domain Name (Text) Availability Status (Text) (see below) Error Condition Explanation (Text) (see below) Error Status Text (Text) (see below). Availability Status Values: The Availability Status qualifies the Operational State of the Log (Enable/ Disable). When there is no Availability Status displayed, the Operational State is fully enabled. If the Operational State is degraded in some way by external conditions, the Availability Status indicates the cause. The Availability Status values constitute a set, of which more than one value may be displayed at the same time. The possible values are listed in Table 1-1. The Availability Status is updated in real-time. Error Condition Explanation: This attribute qualifies and refines the Administrative State and the Operational State of the Log by a text describing the current activity being processed. The Error Condition Explanation is updated in real-time. Error Status Text: This attribute qualifies the Error Condition Explanation. When an error is detected in the process, the current (and worst) Status (or CVR) is displayed. Nothing is displayed if no errors are being detected by the process. The Error Status text is updated in real-time. The Status Icons Administrative State is LOCKED Administrative State is UNLOCKED Operational State is ENABLED Operational State is DISABLED Event Log is being deleted TeMIP startup or event display initialization 33

34 3.7.2 Viewing Event Records From the Operation menu of the Event Log Panel window you can open the Event Records View window to begin a retrieval of event records from the repository for the selected Log. Select the menu item: View Event Records,; see Table Management Operations From the Window on Tru64 UNIX The Menu Bar From the Operation menu and the buttons you can access the management directives for the selected Event Log (see Table 3-8). This enables you to directly manage the Event Logging environment from the Event Log Panel window. The menu bar contains the items: File, Operation, Help. Table 3-8 summarizes the menu items, preconditions for using the menu items, and the results of selecting them. Table 3-8 Log Panel Window Menu Menu Menu Item Must Have Selected Result File Quit n/a Closes the window Operation View Event Records One or more Logs Opens the Event Records View window Log Directives... (Tru64 UNIX) One Log Gives access to the directives Show, Set, Suspend, Resume and Cleanup for the selected Log Open Associated Map Window (Tru64 UNIX) One Log Opens a Map window for the Domain with which the Log is associated Help On Version n/a Help on TeMIP On Window n/a Help on Event Log Panel window The Buttons The window contains several buttons that allow you to quickly perform some common functions: View Event Records, to open up the Event Records View window and display event records LOG Directives..., (Tru64 UNIX) to gain access to the directives available for the selected Log. Open Associated Map Window, (Tru64 UNIX) to open a domain in the Iconic Map window with which the selected Log is associated. 34