BMC Impact Manager Knowledge Base Reference Guide. Version

Transcription

1 BMC Impact Manager Knowledge Base Reference Guide Version July 2003

2 Copyright 2003 BMC Software, Inc. All rights reserved. BMC Software, the BMC Software logos, and all other BMC Software product or service names are registered trademarks or trademarks of BMC Software, Inc. All other trademarks belong to their respective companies. BMC Software considers information included in this documentation to be proprietary and confidential. Your use of this information is subject to the terms and conditions of the applicable End User License Agreement for the product and the proprietary and restricted rights notices included in this documentation. Restricted Rights Legend U.S. Government Restricted Rights to Computer Software. UNPUBLISHED -- RIGHTS RESERVED UNDER THE COPYRIGHT LAWS OF THE UNITED STATES. Use, duplication, or disclosure of any data and computer software by the U.S. Government is subject to restrictions, as applicable, set forth in FAR Section , DFARS , DFARS , DFARS , and DFARS , as amended from time to time. Contractor/Manufacturer is BMC Software, Inc., 2101 CityWest Blvd., Houston, TX , USA. Any contract notices should be sent to this address. Contacting BMC Software You can access the BMC Software Web site at From this Web site, you can obtain information about the company, its products, corporate offices, special events, and career opportunities. United States and Canada Address Telephone BMC Software, Inc CityWest Blvd. Houston TX or Fax Outside United States and Canada Telephone Fax (01) (01)

3 Customer Support You can obtain technical support by using the Support page on the BMC Software Web site or by contacting Customer Support by telephone or . To expedite your inquiry, please see Before Contacting BMC Software. Support Web Site You can obtain technical support from BMC Software 24 hours a day, 7 days a week at From this Web site, you can read overviews about support services and programs that BMC Software offers find the most current information about BMC Software products search a database for problems similar to yours and possible solutions order or download product documentation report a problem or ask a question subscribe to receive notices when new product versions are released find worldwide BMC Software support center locations and contact information, including addresses, fax numbers, and telephone numbers Support by Telephone or In the United States and Canada, if you need technical support and do not have access to the Web, call Outside the United States and Canada, please contact your local support center for assistance. To find telephone and contact information for the BMC Software support center that services your location, refer to the Contact Customer Support section of the Support page on the BMC Software Web site at Before Contacting BMC Software Before you contact BMC Software, have the following information available so that Customer Support can begin working on your problem immediately: product information product name product version (release number) license number and password (trial or permanent) operating system and environment information machine type operating system type, version, and service pack or other maintenance level such as PUT or PTF system hardware configuration serial numbers related software (database, application, and communication) including type, version, and service pack or maintenance level iii

4 sequence of events leading to the problem commands and options that you used messages received (and the time and date that you received them) product error messages messages from the operating system, such as file system full messages from related software iv BMC Impact Manager Knowledge Base Reference Guide

5 Contents Contents About This Book ix Chapter 1 Chapter 2 BMC Impact Manager Overview Understanding BMC Impact Manager Event Management with BMC EM Service-Impact Management with BMC SIM BMC Impact Manager Product Components About BMC Impact Manager About BMC Impact Explorer About BMC Impact Explorer Server About BMC Impact Event Adapters BMC Impact Manager Concepts Understanding BMC Impact Manager Event Processing Event Flow Between Cells Rule Phases for Event Processing Understanding the BMC Impact Manager Knowledge Base Knowledge Base Installation and Upgrade Components of the BMC Impact Manager Knowledge Base Knowledge Base Files Knowledge Base Directories The BAROC Language Basic Concepts Inheritance BAROC Syntax Generalities Symbols Syntax Rules Class Definitions Contents v

6 Class Definition Basic Syntax Slots Slot Types Universal Event and Data Identifiers Facets Class Definition Examples Class Instances Instance Syntax Instance Definition Example Enumerations Enumeration Syntax Enumeration Definition Example Global Records Record Syntax Record Definition Example Addressing Global Records Product Internals Product Base Internal Classes EVENT Root Class DATA Root Class Internal Enumerations Other Internal Definitions Chapter 3 Chapter 4 The Cell Rule Engine Order of Rule Evaluation in the Knowledge Base Incoming Event Processing Internal Event Processing Internal Requests Propagation The Master Rule Language General Rule Syntax Objects, Types, and Variables Events Data Global Records Interfaces Types Selection Criteria Event Selection Criteria vi BMC Impact Manager Knowledge Base Reference Guide

7 Where Clauses Using Clause When Clauses Body Clauses The if-then-else Construct General Rule Writing Constraints Chapter 5 The Rule Phases Refine Rule Phase Syntax: Refine Rules Semantics: Refine Rules Examples: Refine Rules Filter Rule Phase Syntax: Filter Rules Semantics: Filter Rules Examples: Filter Rules Regulate Rule Phase Syntax: Regulate Rules Semantics: Regulate Rules Examples: Regulate Rules New Rule Phase Syntax: New Rules Semantics: New Rules Examples: New Rules Abstract Rule Phase Syntax: Abstract Rules Semantics: Abstract Rules Examples: Abstract Rules Correlate Rule Phase Syntax: Correlate Rules Semantics: Correlate Rules Examples: Correlate Rules Execute Rule Phase Syntax Semantics Examples Propagate Rule Phase Syntax Semantics Examples Contents vii

8 Timer Rule Phase Syntax Semantics Examples Delete Rule Phase Syntax Semantics Examples Chapter 6 Appendix A Collectors Collector Operation Collector Security Setting Up Collector Permissions How Collector Permissions Work Static and Dynamic Collectors Collector Definition BMC Impact Manager Default Collectors Collector Syntax Static Collector Examples Dynamic Collector Examples Performance Considerations Master Rule Language Reference Data Types A-2 Operators A-3 Operator Definitions A-4 Boolean (Logical) Operators A-12 String Operators A-13 Arithmetic Operators A-14 Primitives A-14 Cell Operation Control A-16 Conversion Primitives A-17 Instance Control Primitives A-19 List Primitives A-24 Run Program Primitives A-29 Retrieve Data Primitives A-32 String Primitives A-33 Time Primitives A-38 Functions A-42 Conditional Function A-45 viii BMC Impact Manager Knowledge Base Reference Guide

9 Conversion Functions A-45 Enumeration Functions A-46 List Functions A-47 Mathematical Functions A-49 Retrieve Data Functions A-51 String Functions A-52 Time Functions A-58 Trigonometric Functions A-59 MRL Syntax A-60 BMC Impact Manager Base Classes A-87 Glossary Index Contents ix

10 x BMC Impact Manager Knowledge Base Reference Guide

11 About... About This Book This book contains detailed information about BMC Impact Manager and is intended for anyone who will be creating BMC Impact Manager Knowledge Bases and collectors to be used by the cell and the Console. Note This book assumes that you are familiar with your host operating system. You should know how to perform basic actions in a window environment, such as choosing menu commands and dragging and dropping icons. About This Book ix

12 How This Book Is Organized This book is organized as follows. In addition, this book contains a glossary of terms and an index. Chapter/Appendix Chapter 1, BMC Impact Manager Overview Chapter 2, The BAROC Language Chapter 3, The Cell Rule Engine Chapter 4, The Master Rule Language Chapter 5, The Rule Phases Chapter 6, Collectors Appendix A, Master Rule Language Reference Description provides an overview of BMC Impact Manager and defines the Knowledge Base and provides information on how to configure the Knowledge Base files describes the BMC Impact Manager classes, their definitions and how they are used in the Knowledge Base rules and collectors describes the general behavior of the rule engine introduces the Master Rule Language (MRL) and how to use it in creating and using BMC Impact Manager rules and collectors in the Knowledge Base discusses the ten BMC Impact Manager rule phases and the event processing procedure provides procedures for creating collectors for the Knowledge Base contains reference information about rules and collectors, such as operators, primitives, functions, the syntax used in writing BMC Impact Manager rules and base classes x BMC Impact Manager Knowledge Base Reference Guide

13 Related Documentation BMC Software products offer several types of documentation, including online and printed books and release notes. In addition to this book, you can find useful information in the publications listed in the following table. As Online and Printed Books on page xii explains, these publications are available on request from BMC Software. Category Document Description installation documents BMC Impact Manager core documents BMC Impact Integration documents BMC Impact Manager Installation Guide BMC Impact Explorer Console User Guide BMC Impact Manager Administrator Guide Building a Service Model BMC Impact Event Adapters User Guide BMC Impact Database Gateway Administrator Guide BMC Impact Integration for Remedy AR System User Guide BMC Impact Integration for Tivoli User Guide BMC Impact Integration for PATROL User Guide BMC Impact Integration for PATROL Enterprise Manager User Guide provides instructions for installing BMC Impact Manager and related software components contains instructions for accessing, analyzing, and responding to event and service model component data provides information and procedures for configuring BMC Impact Manager, BMC Impact Explorer Server, and BMC Impact Explorer provides information on designing, developing, and maintaining BMC Impact Manager service models contains descriptions of adapter files and instructions for configuring and running the event adapters contains information about exporting data from BMC Impact Manager into databases provides information about bidirectional integration between BMC Impact Manager servers and Remedy servers contains steps for streamlining TEC performance by using the BMC Impact Manager product provides instructions for sharing data between PATROL and BMC Impact Manager by using the BMC Impact Integration for PATROL product provides instructions for installing and configuring the component that connects BMC Impact Manager to PATROL EM so that they can share alerts and events About This Book xi

14 Category Document Description supplemental documents BMC Impact Manager Release Notes BMC Impact Explorer Release Notes BMC Impact Integration for Tivoli Release Notes BMC Impact Database Gateway Release Notes other release notes and technical bulletins contain last-minute information on the product and changes to the installation procedures Online and Printed Books The books that accompany BMC Software products are available in online and printed formats. Online books are formatted as Portable Document Format (PDF) files. Some online books are also formatted as HTML files. To Access Online Books To view any online book that BMC Software offers, visit the Customer Support page of the BMC Software Web site at You can also access PDF books from the documentation compact disc (CD) that accompanies your product. Use the free Acrobat Reader from Adobe Systems to view, print, or copy PDF files. In some cases, installing the Acrobat Reader and downloading the online books is an optional part of the product-installation process. For information about downloading the free reader from the Web, go to the Adobe Systems site at To Request Additional Printed Books BMC Software provides some printed books with your product order. To request additional books, go to xii BMC Impact Manager Knowledge Base Reference Guide

15 Release Notes Printed release notes accompany each BMC Software product. Release notes provide up-to-date information such as updates to the installation instructions last-minute product information The latest versions of the release notes are also available on the Web at Conventions The following conventions are used in this book: This book includes special elements called notes, warnings, examples, and tips: Note Notes provide additional information about the current subject. Warning Warnings alert you to situations that can cause problems, such as loss of data, if you do not follow instructions carefully. Example An example clarifies a concept discussed in text. Tip Tips contain information that might improve product performance or that might make procedures easier to follow. About This Book xiii

16 All syntax, operating system terms, and literal examples are presented in this typeface. In instructions, boldface type highlights information that you enter. File names, directories, Web addresses, addresses, and names of GUI elements also appear in boldface type. The symbol => connects items in a menu sequence. For example, Actions => Create Test instructs you to choose the Create Test command from the Actions menu. The symbol» denotes one-step instructions. In syntax, path names, or system messages, italic text represents a variable, as shown in the following examples: The table tablename is not available. system/instance/filename In syntax, the following additional conventions apply: A vertical bar ( ) separating items indicates that you must choose one item. In the following example, you would choose a, b, or c: a b c An ellipsis (... ) indicates that you can repeat the preceding item or items as many times as necessary. Square brackets ( [ ] ) around an item indicate that the item is optional. xiv BMC Impact Manager Knowledge Base Reference Guide

17 1 BMC Impact Manager Overview 1 This chapter describes the BMC Impact Manager product and provides an introduction to the Knowledge Base. This chapter presents the following topics: Understanding BMC Impact Manager BMC Impact Manager Concepts Understanding BMC Impact Manager Event Processing Understanding the BMC Impact Manager Knowledge Base Components of the BMC Impact Manager Knowledge Base BMC Impact Manager Overview 1-1

18 Understanding BMC Impact Manager BMC Impact Manager provides two separate solutions for automated event and service management: The BMC Event Manager (BMC EM) solution that provides proactive real-time event management. The BMC Service Impact Manager (BMC SIM) solution that provides service-impact management, which is the ability to manage the business services that IT delivers. These solutions are described in the sections that follow. Event Management with BMC EM Event management is the collection and correlation of events across the enterprise to enable IT operations to focus the proper resources on the most critical events. Event management is the first step in service-impact management. The BMC EM solution provides the following event management capabilities: intelligent and distributed event management BMC EM includes a customized, rules-based system that processes events as defined for different areas of the network. By distributing BMC Impact Managers throughout the enterprise, events are processed as close to their source as possible, reducing network traffic.the processing of large numbers of events simultaneously Because many BMC Impact Managers can be distributed throughout the enterprise and each operates independently, many events can be processed at the same time. 1-2 BMC Impact Manager Knowledge Base Reference Guide

19 the capturing of event details from its source Events are validated as close to their sources as possible, enabling the collection of any additional information needed for processing the event. BMC EM includes a base set of these product components: BMC Impact Manager the event-management technologies BMC Impact Explorer the cross-platform GUI for the product Service Explorer Server the security and user access server BMC Impact Event Adapters processes that convert data from various sources into BMC Impact Manager events Service-Impact Management with BMC SIM Service-impact management is the management of IT resources from the perspective of the business services that they provide. Service-impact management applies event analysis to recognizing and managing issues in the delivery of business services. BMC SIM provides the same event-management capabilities as BMC EM and, in addition, provides service-impact-management capabilities, such as real-time service-impact management The BMC SIM Service Model enables BMC Impact Manager to transform raw data from IT resources into the real-time status of business services. a Service Model that is easily adaptable to IT environment changes The Service Model with its class-based IT entity definitions enables you to rapidly define new IT resources and services whenever the IT environment changes. a real-time business view of service impacts Business managers can monitor the dynamic status of their business services in BMC Impact Explorer Service Views. BMC Impact Manager Overview 1-3

20 BMC SIM includes these product components: BMC Impact Manager the event-management technologies BMC Impact Explorer the cross-platform GUI for the product Service Explorer Server the security and user access server BMC Impact Event Adapters processes that convert data from various sources into BMC Impact Manager events BMC Impact Manager Service components components to extend the service-management environment In addition, BMC SIM provides integration with PATROL, PATROL Enterprise Manager, and Remedy AR System by means of the appropriate BMC Impact Integration product component. BMC Impact Manager Product Components Table 1-1 lists the components that make up the BMC Impact Manager solutions and describes each component's functionality: Table 1-1 BMC Impact Manager Product Components Component Functionality Solution BMC Impact Manager (BMC IM) BMC Impact Explorer (BMC IX) Service Explorer Server (BMC IXS) BMC Impact Event Adapters (BMC IEA) Provides event management and service-impact management technologies. It receives events, processes them, and provides service-impact and modeling functionality. Provides a Java GUI for the BMC Impact Manager product solutions. This cross-platform console enables secure, distributed access to EM or SIM information and functionality. Provides security and controls user access to BMC Impact Manager resources. Audits data from event sources, such as log files, event logs, or SNMP. The adapters evaluate the data for specific conditions and create events by transforming the data into the format understood by BMC Impact Manager. BMC EM BMC SIM BMC EM BMC SIM BMC EM BMC SIM BMC EM BMC SIM 1-4 BMC Impact Manager Knowledge Base Reference Guide

21 Table 1-1 BMC Impact Manager Product Components Component Functionality Solution BMC Impact Manager Service components BMC Impact Integration for PATROL Enterprise Manager (BMC II for PATROL EM) BMC Impact Integration for PATROL (BMC II for PATROL) BMC Impact Integration for Remedy AR System (BMC II for AR System) Enables customers to increase the IT assets represented in their Service Models and to scale their needs as their service-management environment grows. Enables the synchronized, bidirectional flow of events and data between BMC Impact Manager and PATROL Enterprise Manager. Enables the synchronized, bidirectional flow of events and data between BMC Impact Manager and PATROL. Enables the synchronized, bidirectional flow of events and data between BMC Impact Manager and Remedy AR System. BMC SIM BMC EM BMC SIM BMC EM BMC SIM BMC EM BMC SIM About BMC Impact Manager The BMC Impact Manager product includes these technologies that provide its event-management and service-impact-management capabilities: cell the event-processing unit Knowledge Base the collection of information repository the event storage facility dynamic data tables a facility to maintain dynamic data command line interface (CLI) the CLI that provides access to and execution of product functionality BMC Impact Manager Overview 1-5

22 Cell The cell is the basic event-processing unit within the BMC Impact Manager product. Cells provide the following event-management capabilities in both the BMC EM and BMC SIM solutions: Receives events Event sources connect to the cell and send it events. Analyzes and processes events A cell uses the definitions and rules in its associated Knowledge Base to determine how to process events, group events, and establish relationships between events. Stores events The cell stores events in the repository maintained on a disk. The most recent events are held in memory and you can use the BMC Impact Explorer to view them. Responds to events The cell can respond to events by executing actions, as defined in scripts or programs in the Knowledge Base. Propagates events The cell can forward selected events to specified destinations, typically other cells. The cell maintains the currency of propagated events when those events are updated or changed at the event source. In addition to the event-management tasks, the cell also performs the following service-management tasks: Builds associations Using the definitions and rules in its Knowledge Base, the cell can relate an event to the appropriate Service-Model component. Stores components and relationships The cell stores Service-Model components and their relationships in its repository. Computes and propagates component status Using the designated status computation models, the cell computes the status of Service-Model components and propagates their status to the related components automatically. 1-6 BMC Impact Manager Knowledge Base Reference Guide

23 Generates history events The cell generates history events to record status changes of Service-Model components. An individual cell can provide local event management or function as part of a larger distributed network of cells. When you install a cell, you also install a Knowledge Base in the cell along with the BMC Impact Manager CLI. Knowledge Base The Knowledge Base for the cell includes event class definitions, rules, executables, and collector definitions. The cell uses Knowledge Base data to determine which events are received and how the events are handled after receipt. The Knowledge Base is installed with a default set of rules that provide basic event processing in BMC EM and advanced service-impact management in BMC SIM. Rules are statements that combine tests and queries that are applied to events to determine how they are processed, such as discarding unneeded events or responding to significant events, and to perform actions on the events according to the rule type in the Knowledge Base. Event analysis is organized into a series of rule phases through which an event is processed when it is received by the cell. For further information, see Rule Phases for Event Processing on page The BMC Impact Manager administrator maintains the Knowledge Base. Although many Knowledge Bases can exist within a distributed BMC Impact Manager environment, the following requirements apply: Each cell must contain a Knowledge Base directory structure. Each cell can be associated with only one Knowledge Base at a time. Repository The repository is the persistent storage facility in which event information is stored. Events enter the repository after they have been processed by the cell. BMC Impact Manager Overview 1-7

24 Dynamic Data Tables Dynamic data is contextual reference data that is stored in a table in the repository (mc.db) and that can be updated during runtime. A dynamic data table is a set of data instances of a particular data class. Command Line Interface (CLI) The BMC Impact Manager CLI provides an extensive set of commands for executing product operations. For complete information on the BMC Impact Manager CLI, see the BMC Impact Manager Administrator Guide. About BMC Impact Explorer BMC Impact Explorer is a GUI with which you access the event data and service models for an enterprise. BMC Impact Explorer consists of the following views: Events View provides the primary interface for the viewing and manipulation of event data. You can access event lists from any cell, then filter and display the events in a customized window. Within a custom event view, operators can sort, refilter, and manipulate events. Services View enables organizations to organize, view, manipulate, and analyze events in the context of the Service Model. The Service Model enables real-time adaptive service management by modeling the status of IT resources, service level agreements, business services, customer groups and their interdependencies, based on correlated raw events from the IT components. Administration View allows administrators to stop, pause, restart or reconfigure a remote cell. Administrators can also modify the behavior of a remote cell through changes to the Dynamic Data tables. For complete information on BMC Impact Explorer, see the BMC Impact Explorer User Guide. 1-8 BMC Impact Manager Knowledge Base Reference Guide

25 About BMC Impact Explorer Server The BMC Impact Explorer Server is the configuration server that administrators use to manage user access to BMC Impact Manager and its resources. The BMC Impact Explorer Server component is a Java-based Windows service or Unix daemon to which the BMC Impact Explorer connects. The BMC Impact Explorer Server provides distributed, role-based security so that multiple departments or organizations can centralize user-management responsibilities. It provides selective access control to information and actions based on user roles, and it can leverage existing user and group definitions in enterprise Lightweight Directory Access Protocol (LDAP) directories. All BMC Impact Explorer Server communication is fully encrypted. The BMC Impact Explorer Server also serves as the central repository for the dynamic configuration of BMC Impact Explorer. It stores BMC Impact Explorer settings for a user role, including what cells are available in BMC Impact Explorer, color settings, and custom views. A BMC Impact Explorer can obtain configuration information from one or more BMC Impact Explorer Servers, although you can connect to only one BMC Impact Explorer Server at a time. About BMC Impact Event Adapters The BMC Impact Event Adapters (BMC IEA) are background processes that monitor SNMP traps, log files, and event logs. The adapters also translate event data from any source into Basic Recorder of Objects in C (BAROC) language structures. The translated event data becomes a BMC Impact Manager event and the adapter forwards the event to its target cell. The following event adapters are included with BMC Impact Manager: SNMP trap adapter (Windows and Unix) listens for SNMP traps, and converts information from MIBs into compatible classes and other data used to format traps into BMC Impact Manager traps BMC Impact Manager Overview 1-9

26 log file adapters (Windows and Unix) can monitor any text file. They extract data from log files and convert the data to the BAROC language, and create events Windows event log adapter reads the events generated by a Windows platform, translates the events into BAROC language structures and forwards the events to a cell. This adapter is the BMC Impact Adapter for Windows (BMC IELA) BMC Impact Manager Concepts The following terms have special meanings in BMC Impact Manager. Term action adapter BAROC language BMC Impact Integration (BMC II) product cell class collector Definition An executable that can be run by a cell. Actions are called in an Execute rule. You can request the execution of actions in the BMC Impact Explorer. A background process that audits data from various sources, evaluates it for specific conditions, and creates the corresponding events. Adapters also transform event data into the format understood by BMC Impact Manager. Basic Recorder of Objects in C. A structured language used to create and modify class definitions. A class definition is similar to a structure in the C programming language. An interface that enables the synchronized, bidirectional flow of events and data between a BMC Impact Manager instance and another BMC Software product or a specific third-party product. The event-processing engine that collects, processes, and stores events within a BMC Impact Manager instance. Each cell uses the information in the associated Knowledge Base to identify the types of events to accept and how to process and distribute them. A BAROC-language data structure that defines a type of object used in this product. A class is made up of data fields, called slots, that define its properties. An event grouping whose content is defined by its collector rule. Collectors are displayed in the BMC Impact Explorer and are defined in the BMC Impact Manager Knowledge Base BMC Impact Manager Knowledge Base Reference Guide

27 Term event event propagation Knowledge Base (KB) rule Service Model (SM) Service-Model component (SMC) slot Definition A structured message passed to and from cells in a BMC Impact Manager environment. It is an instance of an event class. The act of forwarding events and maintaining their synchronization among multiple BMC Impact Managers. A collection of information that forms the intelligence of a BMC Impact Manager instance and enables it to process events and perform service-impact-management activities. This information includes event class definitions, Service-Model component definitions, record definitions, interface definitions, collector definitions, data associations, and processing rules. A conditional statement that, if determined to be true, executes actions. The cell evaluates events by comparing each event to a series of rules during event processing. Rules are grouped in phases that are processed one by one. An extensible system for defining the various resources that combine to deliver business services, for modeling their behaviors and functional relationships, and for managing the delivery of the resulting services. A logical or physical resource that participates in the delivery of services. There are the following types of Service-Model components: connectivity components, IT components, logical components, and service-levelagreement components. An SMC can provide services to or consume services from another component. In technical terms, a Service-Model component is any data class that is a subclass of the MC_SM_COMPONENT base class. An attribute in a BAROC class definition. A class definition consists of one or more slots. Each slot has a data type and can have specific attributes, called facets, that can control the values that the slot can have or control aspects of a class instance s processing. A class that is a subclass to another class inherits all the slots of the parent class. BMC Impact Manager Overview 1-11

28 Understanding BMC Impact Manager Event Processing Figure 1-1 illustrates how BMC Impact Manager processes events. Figure 1-1 Event Processing BMC Impact Manager 1. Events 2. Adapters 3. Cell 8. BMC Impact Explorer 10. text editor 7. Repository 4. Knowledge 9. BMC Impact Base CLI Explorer Server 5. Command Line Interface 6. Dynamic Data Tables Table 1-2 describes how the events are processed. Table 1-2 Event Processing Step Process 1 Events occur in an enterprise. 2 Event adapters monitor files or SNMP traps and translate event data into BAROC format. 3 The cell checks whether the incoming events match the BAROC definitions in the cell s Knowledge Base BMC Impact Manager Knowledge Base Reference Guide

29 Table 1-2 Event Processing Step Process 4 The Knowledge Base determines the types of events that are received and how the events are handled once they reach the cell. 5 The Command Line Interface (CLI) allows users to issue product commands on the OS command line for immediate execution and to automate product operations. 6 The Dynamic Data Model feature uses dynamic data classes to define configuration data about types of machines, applications, services, and equipment available in an enterprise. 7 The cell stores the events in the repository as an event class instance. 8-9 BMC Impact Explorer connects to cells via the BMC Impact Explorer Server. Operators use BMC Impact Explorer to view events, change the status of events, and act on events stored in the repository. Event Flow Between Cells The BMC Impact Manager components that are deployed throughout your enterprise create a distributed network of cells. You can configure the cells and Knowledge Bases so that a diminishing volume of events travel upward in the cell network. As events pass through a series of cells, the cells discard unneeded events, identify and leave behind unimportant events, and resolve some of the problems reported by other events. In deploying the BMC Impact Manager product it is important to note that a cell s name must be unique throughout the enterprise. Cells with identical cell names on different machines within your enterprise can and will cause unexpected results. BMC Impact Manager Overview 1-13

30 Figure 1-2 illustrates a cell network that is collecting and processing numerous events. Based on configurable criteria, some of those events are propagated, or forwarded, for management by other cells. Figure 1-2 Distributed Event Management Some events are propagated for management by other cells in the cell network. cell cell cell cell cell cell cell event sources event sources event sources event sources 1-14 BMC Impact Manager Knowledge Base Reference Guide

31 Rule Phases for Event Processing Each cell processes events according to the rules stored in its individual Knowledge Base. The rules are statements that use an event s BAROC data to determine whether and how to act on events, such as discarding unneeded events or responding to significant events. The cell processes events through a series of rule phases. As an event passes through each phase, it is acted on by every applicable rule until all the rules are exhausted or the event is discarded. See Chapter 3, The Cell Rule Engine, for a detailed discussion of the cell rule engine processes. Figure 1-3 illustrates the phases of event processing by the rules. BMC Impact Manager Overview 1-15

32 Figure 1-3 Event Processing Through the Rule Phases Event 1. Refine 2. Filter 3. Regulate 4.New The New, Abstract, Correlate, and Execute phases can trigger Timer execution. 5. Abstract 6. Correlate 9. Timers 7. Execute 8. Propagate Repository to other cells 10. Delete When a record is deleted during repository cleanup, Delete rules are evaluated and actions are taken to ensure data integrity BMC Impact Manager Knowledge Base Reference Guide

33 Table 1-3 Rule Phases Phase Description 1. Refine Refine rules are evaluated to validate incoming events and, if necessary, collect additional data needed before further event processing can occur. 2. Filter Filter rules are evaluated to determine which events need additional processing or are unneeded and are to be discarded. 3. Regulate Regulate rules are evaluated and, if true, collect duplicate events for a time period and, if a specified threshold of duplicates is reached, passes an event to the next processing phase. 4. New New rules are evaluated to determine which events in the repository should be updated with new information from new incoming events. This is the last opportunity to prevent an event from entering the repository. 5. Abstract Abstract rules are evaluated and, if conditions are met, abstraction events are generated. An abstraction event is a conceptual or summary event based on other events that are occurring. 6. Correlate Correlate rules are evaluated to determine whether any events have a cause-and-effect relationship. 7. Execute Execute rules are evaluated and, if conditions are met, specified actions are performed. 8. Propagate Propagate rules are evaluated to determine the events to be forwarded to another cell or to an Integration product. 9. Timer Timer rules for the delayed execution of another rule type are evaluated. The Timer phase spans the New, Abstract, Correlate, and Execute phases of event processing. 10. Delete When an event is deleted from the repository during the cleanup process, Delete rules are evaluated and actions are taken to ensure that data integrity is maintained. The Refine, Filter, and Regulate rules can discard an event before it reaches the repository. In that case the discarded events do not appear in BMC Impact Explorer. Once an event reaches the New rule phase it is stored in the repository. Rule phases in the shaded area can trigger timers within the rule. The Delete rule is triggered for events that are deleted from the repository. Details of each rule phase is available in Chapter 5, The Rule Phases. BMC Impact Manager Overview 1-17

34 Understanding the BMC Impact Manager Knowledge Base The BMC Impact Manager Knowledge Base Knowledge Base (KB) is a collection of processing rules, class definitions, files, and executables. The cell uses the Knowledge Base to process events according to the contents of this collection. You can create more than one Knowledge Base, but only one Knowledge Base can be active at one time in a cell. The cell loads its Knowledge Base at start time. Knowledge Base Installation and Upgrade Installation of the BMC Impact Manager Knowledge Base is described in the BMC Impact Manager Installation Guide. This BMC Impact Manager Knowledge Base Reference Guide focuses on one cell component, the Knowledge Base (KB). The KB resides in the cell and it must be remembered at all times that the KB functions within this context. Event processing is configured through rules contained in the cell s Knowledge Base. The default Knowledge Base, MCELL_HOME\etc\<HostName>\kb, is an empty Knowledge Base that is created when you install the cell. The event analysis is organized into a series of phases through which an event is processed when it is received by the cell. Rules are statements that combine tests and queries that are applied to the events, with actions performed on the events according to the rule type in the Knowledge Base. For simplicity, the home directory environment variable is represented throughout this document by MCELL_HOME, which identifies both the Unix platforms variable $MCELL_HOME, and the Windows platforms variable %MCELL_HOME%. This variable defines the directory in which the files for the cell reside. The default definition is /opt/mcell/ for Unix platforms and C:\Program Files\BMC Software\MasterCell\server for Windows platforms BMC Impact Manager Knowledge Base Reference Guide

35 Components of the BMC Impact Manager Knowledge Base The BMC Impact Manager Knowledge Base contains the following components. Event class definitions are written using the BAROC language. The syntax is discussed in Chapter 2, The BAROC Language. Rules are written in the Master Rule Language (MRL) and stored in files with an.mrl extension. Compiled rules have either a.wic or.pkg file extension. Collector definitions also are written in MRL. They primarily affect the console s access to the cells. The creation of collectors is discussed in Chapter 6, Collectors. Actions, such as executables called by the cell or by an operator, are defined in MRL format and stored in the bin directory of the Knowledge Base. Implementations, such as scripts and binaries, are stored in platform-specific subdirectories of the bin directory. Actions are discussed in Chapter 3, The Cell Rule Engine. Global record definitions, written in the BAROC language, are discussed later in Chapter 2, The BAROC Language, and in Chapter 4, The Master Rule Language. Data classes and instances used by the Dynamic Data feature also are part of the database and are defined in the BAROC language. They are discussed in Chapter 2, The BAROC Language, and in Chapter 4, The Master Rule Language. BMC Impact Manager Overview 1-19

36 Knowledge Base Files Classes, interfaces, data definitions, and global records are written in the BAROC language and stored in files with a.baroc extension. Event, data, and interface classes are stored in the classes directory while global record declarations are stored in the records directory. Initial data instances are stored in the data directory. Rules and collectors are written in MRL and stored in files with an.mrl extension. Rules are stored in the rules directory while collectors are stored in the collectors directory. Actions, such as executables called by the cell or by an operator, are stored in the bin directory. The bin directory contains action definitions written in MRL. Implementations such as scripts and binaries, are stored in platform-specific subdirectories of bin. Each of the Knowledge Base directories contains an index file named.load. This text file contains one entry per component to be loaded by the cell or the compiler. The.load file also determines the order in which these components are loaded. Files Classes, interfaces, data definitions File Extensions.baroc Directories kb\classes Global records.baroc kb\records Data instances.baroc kb\data Rules.mrl kb\rules Collectors.mrl kb\collector Actions.mrl kb\bin Action Executables kb\bin\<architecture type> 1-20 BMC Impact Manager Knowledge Base Reference Guide

37 Compiling the Knowledge Base The Knowledge Base must be recompiled each time a rule is added, deleted, or modified. You can compile the Knowledge Base by using the CLI command mccomp as follows: cd %MCELL_HOME%\etc\<cell_name>\kb mccomp manifest.kb -ORmccomp MCELL_HOME\etc\<cell_name>\kb\manifest.kb The mccomp command parses event, data class and global records, and compiles the rules. Once the KB has been recompiled with the mccomp command, you can use the new mcontrol command to reload the Knowledge Base into the running cell. mcontrol -n reconfigure kb You also can use the mcontrol command to reload when collectors are added, deleted or modified. mcontrol -n reconfigure collect In prior versions of the BMC Impact Manager product the Knowledge Base compiled with the -t option could be deployed in a production environment. In the current version of the BMC Impact Manager product, deploying a Knowledge Base compiled with the -t option may degrade performance by as much as 50%. It is strongly recommended that you not use the -t option when compiling the Knowledge Base. Note Any change to the cell s Knowledge Base requires a recompilation of the Knowledge Base before the change is effective. BMC Impact Manager Overview 1-21

38 Knowledge Base Directories The Knowledge Base employs a defined directory structure to organize files and executables. Each subdirectory under the main kb directory is named for the type of files or executables it stores. When you install or create a cell, the default files define and create an empty Knowledge Base and directory structure. The default files are updated each time you create or modify rules or collectors. You can change these files with a text editor. Executables you create for the Knowledge Base must be in the correct subdirectory, as defined by the cell, or they will not execute. The host system you use determines where the executables reside. The Knowledge Base directories exist in two locations: The default Knowledge Base exists in MCELL_HOME\etc\kb on Windows platforms and in MCELL_HOME/etc/kb on Unix platforms. The installation process copies this directory into each cell created. This Knowledge Base is the default Knowledge Base in newly created cells. The cell s working Knowledge Base is located in MCELL_HOME\etc\<CellName>\kb (Windows) or MCELL_HOME/etc/<CellName>/kb (Unix). The cell references this is the Knowledge Base during run time. The manifest.kb file points to directories for class events, interfaces, records, rules, libraries, and actions and its location is MCELL_HOME\etc\<CellName>\kb\manifest.kb BMC Impact Manager Knowledge Base Reference Guide