IBM Tivoli Enterprise Console. Rule Set Reference SC

Transcription

1 IBM Tioli Enterprise Console Rule Set Reference SC

2

3 IBM Tioli Enterprise Console Rule Set Reference SC

4 Note Before using this information and the product it supports, read the information in Notices on page 73. First Edition (August 2003) This edition applies to ersion 3, release 9 of IBM Tioli Enterprise Console (product number 5698-TEC) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this guide Who should read this guide Publications IBM Tioli Enterprise Console library..... Related publications i Accessing publications online i Ordering publications ii Contacting software support ii Participating in newsgroups ii Conentions used in this guide iii Typeface conentions iii Operating system-dependent ariables and paths ix Introduction Modifying the rule base Actiating and deactiating rule sets Rule set sequencing and dependencies Cleanup rule set (cleanup.rls) Correlation rule set (correlation.rls)... 7 Database cleanup rule set (db_cleanup.rls) Dependency rule set (dependency.rls) 11 e-business rule set (ebusiness.rls) Escalation rule set (escalate.rls) Eent actiity rule set (eent_actiity.rls) Eent threshold rule set (eent_thresholds.rls) Forwarding rule set (forwarding.rls).. 33 Heartbeat rule set (heartbeat.rls) Maintenance mode rule set (maintenance_mode.rls) NetView rule set (netiew.rls) Notification rule set (notify.rls) HP OpenView rule set (o_default.rls) 61 NetView for z/os eent forwarding rule set (tecad_n390fwd.rls) NetView for z/os message rule set (tecad_n390msg.rls) SNA eent rules tecad_snaeent.rls.. 67 Trouble ticket rule set (troubleticket.rls) 69 Notices Trademarks Index Eent filtering rule set (eent_filtering.rls) Copyright IBM Corp iii

6 i IBM Tioli Enterprise Console: Rule Set Reference

7 About this guide Who should read this guide Publications The IBM Tioli Enterprise Console product is a rule-based, eent management application that integrates system, network, database, and application management to help ensure the optimal aailability of an organization s IT serices. The IBM Tioli Enterprise Console Rule Set Reference proides information about the rule sets proided for processing common application and infrastructure eents. This guide is for system administrators who need to deploy rules for automating management of Tioli Enterprise Console eents receied by the Tioli Enterprise Console eent serer. Readers should be familiar with the following topics: The operating systems and e-business applications that your enterprise uses The Tioli Management Framework The IBM Tioli NetView product The IBM Tioli Enterprise Console product This section lists publications in the IBM Tioli Enterprise Console library and related documents. It also describes how to access Tioli publications online and how to order Tioli publications. IBM Tioli Enterprise Console library The following documents are aailable in the IBM Tioli Enterprise Console library: IBM Tioli Enterprise Console Adapters Guide, SC Proides information about supported adapters, including how to install and configure these adapters. IBM Tioli Enterprise Console Command and Task Reference, SC Proides details about IBM Tioli Enterprise Console commands, predefined tasks that are shipped in the task library, and the enironment ariables that are aailable to tasks that run against an eent. IBM Tioli Enterprise Console Installation Guide, SC Describes how to install, upgrade, and uninstall the IBM Tioli Enterprise Console product. IBM Tioli Enterprise Console Release Notes, SC Proides release-specific information that is not aailable until just before the product is sent to market. IBM Tioli Enterprise Console Rule Deeloper s Guide, SC Describes how to deelop rules and integrate them for eent correlation and automated eent management. IBM Tioli Enterprise Console Rule Set Reference, SC Proides reference information about the IBM Tioli Enterprise Console rule sets. IBM Tioli Enterprise Console User s Guide, SC Copyright IBM Corp. 2003

8 Proides an oeriew of the IBM Tioli Enterprise Console product and describes how to configure and use the IBM Tioli Enterprise Console product to manage eents. IBM Tioli Enterprise Console Warehouse Enablement Pack: Implementation Guide, SC Describes how to install and configure the warehouse enablement pack for the IBM Tioli Enterprise Console product and describes the data flow and structures that are used by the warehouse pack. Tioli Eent Integration Facility Reference, SC Describes how to deelop your own eent adapters that are tailored to your network enironment and the specific needs of your enterprise. This reference also describes how to filter eents at the source. Related publications IBM Tioli Monitoring: User s Guide, SH IBM Tioli Monitoring for Business Integration: WebSphere MQ: User s Guide, GC IBM Tioli Monitoring for Business Integration: WebSphere MQ: Reference Guide, GC IBM Tioli Monitoring for Databases: DB2 : User s Guide, SC IBM Tioli Monitoring for Databases: DB2: Reference Guide, SC IBM Tioli Monitoring for Web Infrastructure: WebSphere Application Serer: User s Guide, SC IBM Tioli Monitoring for Web Infrastructure: Reference Guide, GC The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. TheTioli Software Glossary is aailable, in English only, at the following Tioli software library Web site: Access the glossary by clicking the Glossary link on the left pane of the Tioli software library window. Accessing publications online The documentation CD contains the publications that are in the product library. The format of the publications is PDF, HTML, or both. Refer to the readme file on the CD for instructions on how to access the documentation. IBM posts publications for this and all other Tioli products, as they become aailable and wheneer they are updated, to the Tioli Software Information Center Web site. Access the Tioli Software Information Center by first going to the Tioli software library at the following Web address: Scroll down and click the Product manuals link. In the Tioli Technical Product Documents Alphabetical Listing window, click the IBM Tioli Enterprise Console link to access the product library at the Tioli Information Center. Note: If you print PDF documents on other than letter-sized paper, select the Fit to page check box in the Adobe Acrobat Print window. This option is aailable i IBM Tioli Enterprise Console: Rule Set Reference

9 when you click File Print. Fit to page ensures that the full dimensions of a letter-sized page print on the paper that you are using. Ordering publications You can order many Tioli publications online at the following Web site: Contacting software support Participating in newsgroups cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: In the United States: In Canada: In other countries, see the following Web site for a list of telephone numbers: If you hae a problem with any Tioli product, refer to the following IBM Software Support Web site: If you want to contact software support, see the IBM Software Support Guide at the following Web site: The guide proides information about how to contact IBM Software Support, depending on the seerity of your problem, and the following information: Registration and eligibility Telephone numbers and addresses, depending on the country in which you are located Information you must hae before contacting IBM Software Support User groups proide software professionals with a forum for communicating ideas, technical expertise, and experiences related to the product. They are located on the Internet and are aailable using standard news reader programs. These groups are primarily intended for user-to-user communication and are not a replacement for formal support. To access a newsgroup, use the instructions appropriate for your browser. Use these instructions for a Microsoft Internet Explorer browser. 1. Open an Internet Explorer browser. 2. From the Tools menu, click Internet Options. 3. On the Internet Options window, click the Programs tab. 4. In the Newsgroups list, click the Down Arrow and then click Outlook Express. 5. Click OK. 6. Close your Internet Explorer browser and then open it again. About this guide ii

10 7. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup. Use these instructions for a Netscape Naigator browser. 1. Open a Netscape Naigator browser. 2. From the Edit menu, click Preferences. The Preferences window is displayed. 3. In the Category iew, click Mail & Newsgroups to display the Mail & Newsgroups settings. 4. Select the Use Netscape mail as the default mail application check box. 5. Click OK. 6. Close your Netscape Naigator browser and then open it again. 7. Cut and paste the newsgroup address of a product into the browser Address field, and press Enter to open the newsgroup. IBM Tioli Enterprise Console news://news.software.ibm.com/ibm.software.tioli.enterprise-console IBM Tioli NetView for UNIX and IBM Tioli NetView for Windows news://news.software.ibm.com/ibm.software.tioli.netiew-unix-windows Conentions used in this guide This guide uses seeral conentions for special terms and actions, operating system-dependent commands and paths, and margin graphics. Typeface conentions This guide uses the following typeface conentions: Bold Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) Column headings in a table Keywords and parameters in text Italic Citations (titles of books, diskettes, and CDs) Words defined in text Emphasis of words (words as words) Letters as letters New terms in text (except in a definition list) Variables and alues you must proide Monospace Examples and code examples File names, programming keywords, and other elements that are difficult to distinguish from surrounding text iii IBM Tioli Enterprise Console: Rule Set Reference

11 Message text and prompts addressed to the user Text that the user must type Values for arguments or command options Operating system-dependent ariables and paths This guide uses the UNIX conention for specifying enironment ariables and for directory notation. When using the Windows command line, replace $ariable with %ariable% for enironment ariables and replace each forward slash (/) with a backslash ( \) in directory paths. Note: If you are using the bash shell on a Windows system, you can use the UNIX conentions. About this guide ix

12 x IBM Tioli Enterprise Console: Rule Set Reference

13 Introduction The Tioli Enterprise Console rule engine processes eents based on rules written in the Tioli Enterprise Console rule language. A rule defines a set of actions that are taken when certain conditions are met; these conditions might include the arrial of a particular class of eent (or an eent with certain attribute alues), changes to an eent, or the expiration of a timer. See the IBM Tioli Enterprise Console Rule Deeloper s Guide for more information about rules and the rule language. A rule set is a file containing a group of logically related rules written in the rule language, while a rule base is a collection of compiled rule sets and supporting data (including class definitions and Prolog predicates) used by those rule sets. The default rule base proided with the Tioli Enterprise Console product includes a number of preconfigured rule sets that proide support for processing common application and infrastructure eents. These rules proide powerful duplication detection, filtering, escalation, notification, and correlation capabilities without requiring any additional rule deelopment. The rules included in the default rule base proide functions that include (but are not limited to) the following: Causal analysis of network infrastructure and e-business application eents based on serice impact and dependency relationships Scheduling of maintenance windows and discarding of eents from systems currently undergoing maintenance Integration with external trouble ticket systems Heartbeat monitoring and detection of missed heartbeat pulses Some of the rule sets in the default rule base are already actiated, while others must be actiated before use. In addition, some of the rule sets must be configured for your enironment. In general, configuration requires only modification of global parameters defined in the configuration rule at the beginning of the rule set; other rule sets might require configuration of external files. The reference sections of this book proide specific configuration information for each rule set. The rule set files are located in the default rule base directory ($BINDIR/TME/TEC/default_rb). The following table lists all of the rule sets in the default rule base and indicates which are already actiated, as well as which require configuration before use. Table 1. Rule sets included in the default rule base Rule set Description Actiated Configuration required cleanup.rls Closes old open eents Yes No correlation.rls Eent correlation No Yes db_cleanup.rls Deletes old closed eents No No dependency.rls Defines dependency relationships for e-business Yes No rules ebusiness.rls Causal analysis of eents from e-business Yes Yes applications escalate.rls Automatic seerity escalation No No Copyright IBM Corp

14 Table 1. Rule sets included in the default rule base (continued) Rule set Description Actiated Configuration required eent_actiity.rls Generation of eent actiity reports No No eent_filtering.rls Filtering of unwanted eents No Yes eent_thresholds.rls Seerity escalation based on repeated eents No Yes forwarding.rls Eent forwarding No Yes heartbeat.rls Heartbeat monitoring Yes No 1 maintenance_mode.rls Maintenance mode support Yes No netiew.rls Clearing and synchronizing of network eents Yes No notify.rls or pager notification No Yes o_default.rls Processing of HP OpenView eents No No tecad_n390fwd.rls Forwarding of NetView for z/os eents No Yes tecad_n390msg.rls Processing of NetView for OS/390 Message No No Adapter eents tecad_snaeent.rls Processing of SNA alert eents No No troubleticket.rls Integration with trouble ticket systems No Yes Notes: 1. Configuration is required for notification. Modifying the rule base You cannot directly modify the default rule base proided with the Tioli Enterprise Console product. If you want to make any changes to this rule base (including actiating or deactiating rule sets, modifying rule sets, or changing rule base targets), you must first do the following: 1. Create a new rule base using the wrb crtrb command. 2. Copy the default rule base to the new rule base using the wrb cprb command. By default, this command copies the rule sets, BAROC files, Prolog templates, and rule base targets. It also copies the rule_sets file, which lists the rule sets in the rule base and indicates which are actie. (See Actiating and deactiating rule sets on page 3 for more information.) After you hae made a copy of the default rule base, you can then make any changes you want to make to the copy. In general, follow these steps to modify the rule base: 1. Make the necessary changes, including any of the following: Actiating or inactiating rule sets (see Actiating and deactiating rule sets on page 3) Editing rule set or BAROC files Creating or deleting rule base targets using the wrb crttarget and wrb delrbtarget commands Importing or deleting rule sets in rule base targets using the wrb imptgtrule and wrb deltgtrule commands 2. Compile the new rule base using the wrb comprules command. 3. Load the new rule base using the wrb loadrb command. 2 IBM Tioli Enterprise Console: Rule Set Reference

15 See the IBM Tioli Enterprise Console Rule Deeloper s Guide for more information about working with rule bases, and the IBM Tioli Enterprise Console Command and Task Reference for more information about the wrb command. Actiating and deactiating rule sets The rule_sets file, located in the TEC_RULES subdirectory of each rule base, lists all of the rule sets included in that rule base. It also indicates which rule sets are actie and which are inactie. All of the rule sets listed in rule_sets are considered part of the rule base and are included when the rule base is copied. Howeer, only actie rule sets can be imported into rule base targets. The contents of the rule_sets file consist of a series of Prolog statements, each in the following form: rule_set(label, filename, status). In each statement, label is the name used to identify the rule set in the trace file, filename is the name of the rule set RLS file, and status is either actie or inactie. For example, the following statement defines two rule sets, one actie and one inactie: rule_set(maintenance_mode, maintenance_mode.rls, actie). rule_set(correlation, correlation.rls, inactie). To actiate or deactiate rule sets, follow these steps. (Note that you cannot make these changes directly to the default rule base; see Modifying the rule base on page 2 for more information.) 1. Using a text editor, modify the corresponding statements in the rule_sets file, specifying the actie or inactie keyword as appropriate. 2. If you are actiating rule sets, use the wrb imptgtrule command to import those rule sets into one or more rule base targets. 3. If you are deactiating rule sets, use the wrb deltgtrule command to delete those rule sets from any rule base targets that currently contain them. 4. Recompile the rule base using the wrb comprules command. 5. Reload the rule base using the wrb loadrb command. See the IBM Tioli Enterprise Console Command and Task Reference for more information about the wrb command. Rule set sequencing and dependencies The rule engine processes the actie rule sets in the order in which they are listed in the rule_sets file, and in some cases this sequencing is important. In addition, some rule sets depend upon supporting functions proided by other rule sets. When you make changes to the rule_sets file, keep the following guidelines in mind: The eent filtering rule set (eent_filtering.rls) should be near the beginning of the sequence, preferably first. This aoids unnecessary processing of eents that are to be filtered out by this rule set. The maintenance mode rule set (maintenance_mode.rls) should be near the beginning of the sequence, preferably immediately after eent_filtering.rls. This aoids unnecessary processing of eents sent from systems in maintenance mode. The correlation rule set (correlation.rls) should be near the end of the sequence. This ensures that any eent-specific correlation rules run before the general-purpose correlation rules. Introduction 3

16 The escalation rule set (escalate.rls) should be near the end of the sequence, and should come after correlation.rls. This ensures that eent seerities can be appropriately adjusted after other processing takes place. The e-business rule set (ebusiness.rls) should be near the end of the sequence, and should come after the NetView rule set (netiew.rls) and any other rule sets that process eents from e-business serices monitored by IBM Tioli Monitoring products. The notification rule set (notify.rls) should be near the end of the sequence, preferably last. This ensures that notification is based on the most current eent information. The escalation rule set (escalate.rls) depends upon the notification rule set (notify.rls) to proide notification of escalated eents. If you want to use this function, both rule sets must be actiated. The e-business rule set (ebusiness.rls) depends upon the dependency rule set (dependency.rls), which supports definition of dependency relationships. If you want to use the e-business rules, both rule sets must be actiated. The e-business rule set (ebusiness.rls) generates missed heartbeat eents in response to certain network eents. If you want these eents to be handled properly, the heartbeat rule set (heartbeat.rls) must also be actiated. The NetView rule set (netiew.rls) correlates heartbeat eents with other network eents. If you want this correlation to take place, the heartbeat rule set (heartbeat.rls) must also be actiated. 4 IBM Tioli Enterprise Console: Rule Set Reference

17 Cleanup rule set (cleanup.rls) Oeriew Usage The cleanup rule set contains rules that are used to purge old open eents from the eent cache. In general, eents that remain open for a long time without being addressed should be closed, on the assumption that they hae been resoled or hae otherwise become inactie. Typically, a rule of this sort would be applied only to eents with low seerity; for example, you might want to automatically close any HARMLESS or UNKNOWN eent that has remained in the OPEN state for more than 48 hours. By customizing this rule set, you can specify which eents you want to close and how long you want to wait before closing them. The cleanup rule set is already actiated in the default rule base. If you make any changes to this rule set, you must then recompile and reload the rule base. See Modifying the rule base on page 2 for more information. Optional configuration The cleanup rule set is preconfigured and ready to use. Howeer, you can customize this rule set by modifying statements in the cleanup_start configuration rule. The following options are configurable: Age limit for open eents. You can specify the timeout alue that controls how old open eents must be before they are closed automatically. The default age limit is 48 hours. To change the age limit, modify the statement that sets the _default_span parameter as follows: _default_span = seconds, seconds is the length of time, in seconds, you want to allow eents to remain open before being automatically closed. Cleanup frequency. You can specify how frequently you want the rules to check for old eents to close. The default frequency is eery 30 minutes. To change the cleanup frequency, modify the statement that sets the _cleanup_interal parameter as follows: _cleanup_interal = seconds seconds is the length of time, in seconds, you want to elapse between cleanups. Seerities of eents to close. You can specify the seerities of eents you want to be closed automatically when they reach the specified age. The default behaior is to close eents with seerities of HARMLESS or UNKNOWN. To change this alue, modify the statement that sets the cleanup_list parameter as follows: _cleanup_list = [e_ses], e_ses is a list of alid eent seerities, each enclosed in single quotation marks, and separated by commas. Copyright IBM Corp

18 Administrator name. You can specify the administrator name to use when the cleanup rules automatically close eents. The default administrator name is cleanup.rls. To change the administrator name, modify the statement that sets the cleanup_admin parameter as follows: _cleanup_admin = admin, admin is the administrator name to use, enclosed in single quotation marks. Rules Startup rule rule: cleanup_start The cleanup_start rule is a configuration rule that runs upon receipt of the TEC_Start eent, which is sent during intialization of the eent serer. This rule sets global parameters for the cleanup rules and then sets the Cleanup timer with the duration specified by the _cleanup_interal parameter. By customizing this rule, you can configure the behaior of the cleanup rules. See Usage on page 5 for more information. Cleanup rules rule: do_the_cleanup The do_the_cleanup rule runs upon receipt of the TEC_Cleanup_eent eent, which is generated by the cleanup_old_eents timer rule to trigger periodic cleanups. When this eent is receied, the eent cache is searched for open eents that match the cleanup criteria specified in the cleanup_start rule. Any matching eents are closed. The receied TEC_Cleanup_eent eent is then dropped. timer_rule: cleanup_old_eents The cleanup_old_eents timer rule runs upon expiration of the Cleanup timer. This rule generates a TEC_Cleanup_eent eent, which triggers the do_the_cleanup rule. It then resets the Cleanup timer with the duration specified by the _cleanup_interal parameter in the configuration rule. 6 IBM Tioli Enterprise Console: Rule Set Reference

19 Correlation rule set (correlation.rls) Oeriew Usage The correlation rule set contains rules that correlate incoming eents based on preiously defined relationships. There are two types of possible relationships: Clearing eents A clearing eent is an eent that resoles a preious problem eent. For example, an eent of class Su_Failure might be cleared by Su_Success from the same host and user. Eent sequences An eent sequence is a series of eents that are linked by causal relationships. In an eent sequence, each eent is an effect of the preious eent. For example, the upsonbattery eent (indicating that an uninterruptible power supply is operating on battery power) might be the root cause of an eent sequence that also includes the lowbattery eent and finally the upsdischarged eent. The correlation rule set is not actiated in the default rule base. Before you can use this rule set, you must actiate it. See Modifying the rule base on page 2 for more information on actiating rule sets. Note: If actiated, the correlation rule set should be listed near the end of the rule_sets file. See Rule set sequencing and dependencies on page 3 for more information. Before using this rule set, you might also need to modify the correlation_parameters action of the correlation_configure rule to define the clearing eents and eent sequences you want the rules to correlate. To define a clearing eent, use the create_clearing_eent predicate; to define an eent sequence, use the create_eent_sequence predicate. (See the IBM Tioli Enterprise Console Rule Deeloper s Guide for more information about these predicates.) Clearing eents and eent sequences can be defined either in this rule set or in any other actie rule set. Note: After modifying this rule set, you must recompile and reload the rule base. Optional configuration You can customize the correlation rule set by modifying statements in the correlation_parameters action of the correlation_configure rule. The following options are configurable: Latency. You can specify the time range, or latency, to be used when searching the eent cache for eents to correlate. By default, searches are limited to ten minutes (600 seconds) backward in the eent cache. To change the latency, modify the statement that sets the _correlation_time_window parameter as follows: _correlation_time_window = seconds, seconds is the number of seconds representing how far backward you want to search the cache for eents. Copyright IBM Corp

20 Note: This parameter sets an upper limit on how far back in time the search will go, but it does not guarantee that eents within that time period are still aailable. If your eent cache is too small, eents might be discarded een if they are more recent than the specified time. If this happens, consider increasing the size of your eent cache. (See the IBM Tioli Enterprise Console User s Guide for more information.) Administrator name. You can specify the administrator name to use when automatically acknowledging or closing eents. The default administrator name is correlation.rls. To change the administrator name, modify the statement that sets the _correlation_admin parameter as follows: _correlation_admin = admin, admin is the administrator name to use, enclosed in single quotation marks. Rules Startup rule rule: correlation_configure The correlation_configure rule is a configuration rule that runs upon receipt of the TEC_Start eent, which is sent during initialization of the eent serer. This rule defines the clearing eents and eent sequences that are correlated by the correlation rules; it also configures the _correlation_time_window parameter, which defines the latency used for eent searches. By customizing this rule, you can configure the behaior of the correlation rules. See Usage on page 7 for more information. Correlation rules rule: clearing_eent The clearing_eent rule runs upon receipt of any eent. If the receied eent has been defined as a clearing eent (using the create_clearing_eent predicate), any cleared eents in the eent cache receied within the time window defined by the _correlation_time_window parameter are closed. rule: correlate The correlate rule runs upon receipt of any eent. If the receied eent has been defined as part of an eent sequence, the rule uses the first_related_eent predicate to search the eent cache for the a related eent receied within the time window defined by the _correlation_time_window parameter. If the receied eent is found to be an effect of a preiously receied cause eent, it is correlated with the cause eent using the link_effect_to_cause predicate. The receied eent is then acknowledged, because it is an effect of a known cause. If the receied eent is found to be a cause of a preiously receied effect eent, the effect eent is correlated with the cause eent using the link_effect_to_cause predicate. The effect eent is then acknowledged, because it is now known to be an effect of the newly receied cause eent. 8 IBM Tioli Enterprise Console: Rule Set Reference

21 Database cleanup rule set (db_cleanup.rls) Oeriew Usage Rules The database cleanup rule set periodically deletes old closed eents from the Tioli Enterprise Console database. This rule set uses a timer rule to peridocally generate DB_Cleanup_eent eents. These eents can also be sent from other sources if you want to explicitly trigger a database cleanup. When DB_Cleanup_eent is receied, the wtdbclear command is used to delete old closed eents from the eent repository, task repository, extended eent attribute table, and reception log. See the IBM Tioli Enterprise Console Command and Task Reference for more information about the wtdbclear command. The database cleanup rule set is not actiated in the default rule base. Before you can use this rule set, you must actiate it. See Modifying the rule base on page 2 for more information on actiating rule sets. Optional configuration You can customize the database cleanup rule set by modifying the timer interal that determines how frequently the database cleanup takes place. The default interal is one hour (3600 seconds). To change this interal, modify the statement in the db_cleanup_start rule that sets the _cleanup_timer parameter as follows: Startup rule _cleanup_timer = seconds, seconds is the length of time (in seconds) you want to elapse between database cleanups. rule: db_cleanup_start The db_cleanup_start rule runs upon receipt of the TEC_Start eent, which is sent during initialization of the eent serer. This rule first sets the _cleanup_timer parameter and then starts the the DB_Cleanup timer, which is used to periodically generate DB_Cleanup_eent eents. By customizing this rule, you can configure the duration of the cleanup timer. See Usage for more information. Database cleanup rules rule: do_the_db_cleanup The do_the_db_cleanup rule runs upon receipt of the DB_Cleanup_eent eent. This eent is periodically generated by the time_to_cleanup_the_database timer rule, and it can also be generated from other sources in order to trigger a database cleanup. When this eent is receied, the rule uses the following command to delete closed eents that are older than the length of time specified by the _cleanup_timer parameter in the configuration rule: wtdbclear -e -l -s CLOSED -t seconds -a 1000 Copyright IBM Corp

22 seconds is the alue of the _cleanup_timer parameter. The receied DB_Cleanup_eent eent is then closed. timer_rule: time_to_cleanup_the_database The time_to_cleanup_the_database timer rule runs when the DB_Cleanup timer expires. This rule generates a DB_Cleanup_eent eent in order to trigger the do_the_db_cleanup rule. It then resets the timer. 10 IBM Tioli Enterprise Console: Rule Set Reference

23 Dependency rule set (dependency.rls) Oeriew Usage The dependency rule set contains rules that support the definition of dependency relationships used by the e-business rule set (ebusiness.rls). These rules process TEC_Dependency eents, which are sent by the wrb imptdp and wrb deldp commands. See e-business rule set (ebusiness.rls) on page 13 for more information about dependency relationships. The dependency rule set is already actiated in the default rule base. If you make any changes to this rule set, you must then recompile and reload the rule base. This rule set must be actie if the e-business rule set is actie. Note: This rule set proides required support for the e-business rule set (ebusiness.rls). If the e-business rule set is actie, the dependency rule set must also be actie. In order to ensure correct functioning of the e-business rules, do not make any changes to this rule set apart from the optional configuration parameters described below. Optional configuration The dependency rule set is preconfigured and ready to use. Howeer, you can customize this rule set by modifying statements in the setup action of the startup configuration rule. The following options are configurable: Dependency fact file name. You can specify the name of the Prolog file that is used to store dependency facts in the knowledge base. You can either specify an absolute location for the file or specify the file name only, in which case the file is created in the $DBDIR directory. The default file name is dependencies.pro. To specify a different file name, modify the statement that defines the _dependency_file parameter as follows: _dependency_file = filename, filename is the name of the Prolog fact file you want to use, optionally including a relatie or absolute path, and enclosed in single quotation marks. Debug logging. You can specify whether you want debugging information written to a log file. This can be useful if you are modifying the rule set. This function should always be disabled before the rule set is deployed in a production enironment because it can affect performance. To change this behaior, modify the statement that sets the _dependency_debug parameter as follows: _dependency_debug = flag, flag is either yes or no. Debug log file name. You can specify the name of the file used for logging debugging messages. This file is only used if _dependency_debug is set to yes. You can either specify an absolute location for the file or specify the file name only, in which case the file is created in the $DBDIR directory. The default alue is dependency.log. To specify a different file, modify the statement that sets the dependency_logger parameter as follows: Copyright IBM Corp

24 _dependency_logger = filename, filename is the name of the log file you want to use, optionally including a relatie or absolute path, and enclosed in single quotation marks. Rules Startup and shutdown rules rule: startup The startup rule is a configuration rule that runs upon receipt of the TEC_Start eent, which is sent during intialization of the eent serer. This rule first loads the auxiliary predicates used by the dependency rules and any persistent dependency relationships preiously defined; it then sets global parameters for the dependency rules and initializes the log files for the rule set. By customizing this rule, you can configure the behaior of the dependency rules. See Usage on page 11 for more information. rule: shutdown The shutdown rule runs upon receipt of the TEC_Stop eent, which is sent when the eent serer shuts down. This rule closes any open log files for the rule set. Dependency processing rule rule: process_op The process_op rule processes TEC_Dependency eents, which are sent by the wrb imptdp and wrb deldp commands. When this eent is receied, the rule updates the dependency knowledge base accordingly (asserting or retracting a dependency fact), and then it drops the eent. 12 IBM Tioli Enterprise Console: Rule Set Reference

25 e-business rule set (ebusiness.rls) Oeriew The e-business rule set analyzes eents related to e-business resources in order to determine whether they are causally related to one another, or to network eents. This analysis relies upon user-defined dependency relationships stored as facts in the knowledge base. These relationships define dependencies among e-business serices running on different hosts in your enironment. Supported e-business serices include those proided by IBM WebSphere Application Serer, IBM DB2 software, and IBM WebSphere MQ. These serices frequently depend upon the aailability of other e-business serices. WebSphere Application Serer serices on one host might depend upon the aailability of DB2 serices on another host. Similarly, two interconnected WebSphere MQ hosts each depend upon the aailability of the other. By using the e-business rule set, you can identify these dependencies, making it possible for the rule engine to identify causal relationships between eents receied from these serices. (See Usage on page 16 for information about defining these relationships.) Currently, two kinds of dependency relationships are supported: WMQ_DEPENDS_ON_WMQ Indicates that a WebSphere MQ resource on one host is dependent upon a WebSphere MQ resource on another host. WAS_DEPENDS_ON_DB2 Indicates that a WebSphere Application Serer resource on one host is dependent upon a DB2 resource on another host, or on the same host. For example, suppose host appserer is running WebSphere Application Serer serices that depend upon DB2 serices on host dbserer. In this case, you would define a dependency fact indicating a WAS_DEPENDS_ON_DB2 relationship between the two hosts. If the eent serer receies an eent indicating a problem with the DB2 serices on dbserer, and later receies an eent indicating a database-aailability problem with the WebSphere Application Serer serices on appserer, it is likely that the DB2 problem is the cause of the WebSphere Application Serer problem. Because the knowledge base contains a dependency fact describing this relationship, the eent serer can automatically associate the two eents as causally related. Similarly, the eent serer can identify other cause eents that might affect the aailability of dbserer, such as serice-impact network eents and maintenance eents. WAS DB2 appserer dbserer Figure 1. Dependency relationship between WebSphere Application Serer and DB2 serices Copyright IBM Corp

26 In addition, the e-business rules can optionally generate probable-cause informational eents in cases where a likely causal relationship is found but cannot be matched to a defined dependency fact. This can happen if no dependency relationship is defined for the hosts inoled, or if the NetView component is not configured to generate serice-impact eents. The following table summarizes the categories of possible effect and cause eents. (For detailed information about specific cause and effect eents, see Rules on page 19.) Table 2. Categories of cause and effect eents for the e-business rules Effect eents WebSphere Application Serer eents WebSphere MQ eents Cause eents e-business network maintenance DB2 eents WebSphere MQ eents NetView node serice impact eents (DB2 serices) NetView node serice impact eents (WebSphere MQ serices) TEC_Maintenance The e-business eents analyzed by the e-business rules are generated by the following products: IBM Tioli Monitoring for Business Integration: WebSphere MQ (WebSphere MQ eents) IBM Tioli Monitoring for Web Infrastructure: WebSphere Application Serer (WebSphere Application Serer eents) IBM Tioli Monitoring for Databases: DB2 (DB2 eents) For more information about e-business eents, refer to the documentation for these products. In addition to associating causally related ebusiness and network eents, the e-business rules also generate TEC_Heartbeat_missed eents in response to heartbeat status eents from IBM Tioli Monitoring. This eent can be processed by the heartbeat rule set (heartbeat.rls) or NetView rule set (netiew.rls), if those rule sets are actie. How eents are analyzed The primary analysis of e-business eents is handled by the rules in the Eent Association section of the e-business rule set. These are the rules that identify causal relationships between e-business and network eents based upon the dependency relationships you define. When an effect eent related to WebSphere Application Serer or WebSphere MQ serices arries, the e-business rules search the knowledge base for a dependency fact inoling the host and serice that generated the eent. If the effect eent is related to WebSphere Application Serer serices, the rule searches for a WAS_DEPENDS_ON_DB2 dependency fact; if the effect eent is related to WebSphere MQ serices, the rule searches for a WMQ_DEPENDS_ON_WMQ dependency fact. If found, the dependency fact indicates the fully qualified host name of the host upon which the e-business serice depends (the host proiding the required DB2 or WebSphere MQ serices). The rules then search the eent cache for a cause 14 IBM Tioli Enterprise Console: Rule Set Reference

27 eent originating from the specified host and affecting the releant serice. There are three categories of cause eents, searched for in the following order: An e-business cause eent. An e-business cause eent is an eent originating a host and e-business serice identified by a dependency fact. This can be either a DB2 cause eent sent by IBM Tioli Monitoring for Databases: DB2 or a WebSphere MQ cause eent sent by IBM Tioli Monitoring for Business Integration: WebSphere MQ. The specific class of the cause eent depends upon the class of the effect eent and the type of dependency. If an e-business cause eent is found, the effect eent is associated with it using the link_effect_to_cause predicate. A network cause eent. A network cause eent is a NetView node serice impact eent specifying a host identified by a dependency fact and affecting the releant serice. This can be a TEC_ITS_NODE_SERVICE_IMPACT eent with the sub_source attribute equal to either IBM_DB2 or IBM_WebSphere_MQ, depending upon the type of dependency. If a serice impact cause eent is found, it is likely that the monitored host cannot send an e-business cause eent because of the network problem. Therefore, the serice impact eent is considered the cause eent, and the effect eent is associated with it using the link_effect_to_cause predicate. If the effect eent is of low seerity (HARMLESS or UNKNOWN), the effect eent is also automatically acknowledged. A maintenance cause eent. This eent indicates that the specified host has entered maintenance mode. A maintenance cause eent is a TEC_Maintenance eent with current_mode equal to ON and specifying a host identified by a dependency fact. Because all other eents from a host in maintenance mode are typically discarded, in this case the maintenance eent itself is considered the cause eent. If a maintenance cause eent is found, the effect eent is associated with it using the link_effect_to_cause predicate. (For more information about handling maintenance eents, see Maintenance mode rule set (maintenance_mode.rls) on page 39.) If a cause eent cannot be identified from one of these three categories, the rules can optionally continue searching for an indication of a probable cause eent. (This function is enabled or disabled by the ebusiness_hints parameter; see Usage on page 16 for more information.) If this function is enabled, the rules continue searching for the following categories of probable cause eents (in the following order): A network probable cause eent. A network probable cause eent is a NetView TEC_ITS_NODE_STATUS eent with nodestatus equal to either MARGINAL or DOWN and originating from a host identified by a dependency fact. If this eent is found, it indicates that there is a network problem with the specified host, but the NetView component is not configured to generate serice impact eents. Instead, the rules generate an informational TEC_ITS_Not_Monitoring_eBusiness eent specifying the effect eent and the probable network cause eent. This eent indicates that NetView needs to be configured to monitor the related e-business serice. An e-business probable cause eent. An e-business probable cause eent is an eent originating from the type of serice identified by a dependency fact, but not from a matching host. This might indicate that the correct dependency relationships hae not been defined. If an e-business probable cause eent is found, the rules generate an informational TEC_PROBABLE_EVENT_ASSOCIATION eent specifying the effect eent and the probable cause eent. This eent indicates that the defined dependency relationships may need to be updated. e-business rule set (ebusiness.rls) 15

28 In some situations, an effect eent might arrie before the cause eent. If this happens, the rules cannot identify the causal relationship when the effect eent arries, because the cause eent is not yet in the eent cache. In order to handle this situation, when a potential cause eent arries, the rules repeat the dependency analysis for any possible effect eents already in the eent cache. Note: Because of the potential performance impact, reanalysis does not take place for TEC_Maintenance or TEC_ITS_NODE_STATUS eents. In order for association to take place, these eents must already be in the eent cache when e-business effect eents arrie. Usage The e-business rule set is already actiated in the default rule base. If you make any changes to this rule set, you must then recompile and reload the rule base. See Modifying the rule base on page 2 for more information. Note: If actiated, the e-business rule set should be listed near the end of the rule_sets file (following the NetView rule set, if that rule set is actie). In addition, the dependency rule set (dependency.rls) proides required support for the e-business rule set. If the e-business rule set is actie, the dependency rule set must also be actie. Configuration The e-business rule set is preconfigured and ready to use. Howeer, you can customize this rule set by modifying statements in the startup configuration rule. The following options are configurable: Generation of informational eents. You can specify whether you want the rules to generate informational TEC_PROBABLE_EVENT_ASSOCIATION and TEC_ITS_Not_Monitoring_eBusiness eents. These eents are generated in cases where a probable cause eent is found, but there is insufficient information for a causal association. (See How eents are analyzed on page 14 for more information.) By default, this function is enabled; if you want to change this preference, modify the statement that sets the ebusiness_hints parameter as follows: rerecord(ebusiness_hints, no ), Debug logging. You can specify whether you want debugging information written to a log file. This can be useful for testing modifications to the rule set. This function should always be disabled before the rule set is deployed in a production enironment because it can affect performance. To enable or disable debugging messages, modify the statement that sets the ebusiness_debug parameter as follows: rerecord(ebusiness_debug, flag), flag is either yes or no. Debug log file name. You can specify the name of the file used for logging debuging messages. This file is used only if ebusiness_debug is set to yes. You can either specify an absolute location for the file or specify the file name only, in which case the file is created in the $DBDIR directory. The default alue is ebusiness.log. To specify a different file, modify the statement that sets the ebusiness_logger parameter as follows: rerecord(ebusiness_logger, filename), 16 IBM Tioli Enterprise Console: Rule Set Reference

29 filename is the name of the log file you want to use, optionally including a relatie or absolute path, and enclosed in single quotation marks. Administrator name. You can specify the administrator name to use when the e-business rules automatically acknowledge or close eents. The default administrator name is ebusiness.rls. To change the administrator name, modify the statement that sets the ebusiness_admin parameter as follows: rerecord(ebusiness_admin, admin), admin is the administrator name to use, enclosed in single quotation marks. Latency. You can specify the time range to be used when searching the eent cache for eents to associate. This time range affects both backward and forward eent searches. By default, searches are limited to ten minutes (600 seconds) backward or forward in the eent cache. To change the latency, modify the statement that sets the ebusiness_latency parameter as follows: rerecord(ebusiness_latency, seconds), seconds is the number of seconds representing how far backward or forward you want to search the cache for eents. Note: This parameter sets an upper limit on how far back in time the search will go, but it does not guarantee that eents within that time period will still be aailable. If your eent cache is too small, eents might be discarded een if they are more recent than the specified time. If this happens, consider increasing the size of your eent cache. (See the IBM Tioli Enterprise Console User s Guide for more information.) Defining dependency relationships Before using the e-business rule set, you must define the dependency relationships that apply to the e-business serices and network resources in your enironment. To define these relationships, create a text file containing a series of dependency statements, each of which will be conerted into a dependency fact in the knowledge base. Each dependency statement is on a separate line, and each statement consists of three parts, separated by white space: host_a dependency_type host_b host_a is the fully qualified name of the host that has a dependency on another host, dependency_type is the nature of the dependency, and host_b is the fully qualified name of the host upon which host_a depends. The following example shows three dependency statements: mq1.raleigh.ibm.com WMQ_DEPENDS_ON_WMQ mq2.raleigh.ibm.com mq2.raleigh.ibm.com WMQ_DEPENDS_ON_WMQ mq1.raleigh.ibm.com appserer.raleigh.ibm.com WAS_DEPENDS_ON_DB2 appserer.raleigh.ibm.com These statements define the following dependency relationships (see Figure 2 on page 18): The first statement indicates that WebSphere MQ serices on mq1.raleigh.ibm.com depend upon WebSphere MQ serices on mq2.raleigh.ibm.com. The second statement indicates that WebSphere MQ serices on mq2.raleigh.ibm.com depend upon WebSphere MQ serices on mq1.raleigh.ibm.com. The third statement indicates that WebSphere Application Serer serices on appserer.raleigh.ibm.com depend upon the aailability of DB2 serices running on the same host. e-business rule set (ebusiness.rls) 17