Situation limitations

IBM Tivoli Monitoring > Version 6.3 Fix Pack 2 > Administrator's Guide > Agent-based services
IBM Tivoli Monitoring, Version 6.3 Fix Pack 2

Situation limitations

The types of formula functions that can be used in situations are limited. Private situations can be defined for Tivoli Enterprise Monitoring Agents and Tivoli System Monitor Agents. To use private situations effectively, you need to understand how they are different from enterprise situations.

Availability of situation formula functions for enterprise situations whose events are emitted from the hub monitoring server and private situations whose events are emitted from the monitoring agent

Situation functions that can be evaluated at the monitoring server Situation functions that can be evaluated at the monitoring agent
Formula function Supported in enterprise situations Supported in enterprise situations Supported in private situations
Cell functions
CHANGE available available not available
DATE available available not available
MISSING available available available
PCTCHANGE available available not available
SCAN available available not available¹
STR available available not available¹
TIME available not available not available
VALUE available available available
IN available available not available
REGEX not available not available available
Group functions can be applied to multiple row attribute groups and to those configured for historical data collection. Table and chart views require that a time range be set to show a span of data samplings.
AVG available not available not available
COUNT available not available not available
MAX available not available not available
MIN available not available not available
SUM available not available not available
Situation characteristics
Embedded, including correlated situations available not available not available
Multiple attribute groups available not available not available
Persistence enabled available available available²
Display item selected available not available available³
Uses duper process available not available not available
Distribution to managed system group available available not available
Combination AND and OR logical connectors available available not available⁴

¹ Use the REGEX function instead.
² Situation persistence is not evaluated at the agent when the situation is configured to emit a SNMP trap. It is supported when the situation is configured to emit an EIF event. SNMP traps can be emitted in two modes: RC (Rising Continuous) whereby a trap is emitted every time the situation is true; HY (Hysteresis) whereby a trap is emitted the first time the situation is true and a clearing trap is emitted when the situation is no longer true. As well, persistence can be enabled at the trap destination by implementing a persistence rule.
³ If the situation is configured to emit an EIF event, a separate EIF event is sent for each row with a unique display item value. However, when situations are configured to emit SNMP events situations that include a display item (available for multiple row attribute groups) they are limited to sending one SNMP alert for the first row that evaluates to true; no alerts can be sent for any subsequent rows that evaluate to true.
⁴ Private situations are limited to all AND or all OR connectors.

Restriction: Private situations with the MISSING function distributed to subnodes must have a list of subnodes in the DISTRIBUTION tag. Private situations with the MISSING function distributed to agents do not require this.

SNMP alerts from enterprise monitoring agents with subnodes

Monitoring agents that use subnodes, such as subnode agents created with Agent Builder, Monitoring for Energy Management, and Agentless Monitors, can emit an SNMP alert for only one subnode per agent instance where the situation evaluates to true; and for no other subnodes where the same situation evaluates to true.
For each agent instance, data samples are collected in one attribute group table. These metrics are filtered by subnode when displayed in the Tivoli Enterprise Portal, but situations running on multiple subnodes for an agent instance are actually evaluating on a single table. If a situation becomes true on one subnode, an SNMP alert defined for that situation is emitted, but no SNMP alerts are emitted for that situation on any other subnodes because no further rows are processed in the table.
Here are some alternatives to emitting SNMP alerts for agents with subnodes:
Forward events from the monitoring server to an EIF receiver.

When you configure the agent, define only one subnode for an agent instance.
Define a separate situation for each subnode and distribute that situation to only a single subnode. In the following example,

situation KAB_Log_Message is distributed to ALL LOG subnodes in the AB agent

situation KAB_Log1only_Message is distributed to only the AB:uxlog1:LOG subnode

situation KAB_Log2only_Message is distributed to only the AB:uxlog2:LOG subnode
Instance 1 of the AB log monitoring agent is monitoring three logs (there is a subnode for each log file): uxlog1, uxlog2, and uxlog3:

If a message appears in the file monitored by subnode uxlog1, these situations become true: KAB_Log_Message and KAB_Log1only_Message.

If a message appears in the file monitored by subnode uxlog3, this situation becomes true: KAB_Log_Message
The private situation configuration file for the agent:
<PRIVATECONFIGURATION>
   <PRIVATESIT>
     <SITUATION>KAB_Log_Message</SITUATION>
      <CRITERIA><![CDATA[ *IF *VALUE KAB_LOGFILE.Message *NE "" ]]>
      </CRITERIA>
     <INTERVAL>000000</INTERVAL>
     <DISTRIBUTION>AB:uxlog:LOG</DISTRIBUTION>
   </PRIVATESIT>
   <PRIVATESIT>
     <SITUATION>KAB_Log1only_Message</SITUATION>
      <CRITERIA><![CDATA[ *IF *VALUE KAB_LOGFILE.Message *NE "" ]]>
      </CRITERIA>
     <INTERVAL>000000</INTERVAL>
     <DISTRIBUTION>AB:uxlog1:LOG</DISTRIBUTION>
   </PRIVATESIT>
   <PRIVATESIT>
     <SITUATION>KAB_Log2only_Message</SITUATION>
      <CRITERIA><![CDATA[ *IF *VALUE KAB_LOGFILE.Message *NE "" ]]>
      </CRITERIA>
     <INTERVAL>000000</INTERVAL>
     <DISTRIBUTION>AB:uxlog2:LOG</DISTRIBUTION>
  </PRIVATESIT>
</PRIVATECONFIGURATION>   
Parent topic:
Agent-based services
Related concepts:

Customize event integration with Tivoli Netcool/OMNIbus
Customize event integration with Tivoli Enterprise Console
Related reference:

Private situation operation

+
Search Tips | Advanced Search

	Situation functions that can be evaluated at the monitoring server	Situation functions that can be evaluated at the monitoring agent
Formula function	Supported in enterprise situations	Supported in enterprise situations	Supported in private situations
Cell functions
CHANGE	available	available	not available
DATE	available	available	not available
MISSING	available	available	available
PCTCHANGE	available	available	not available
SCAN	available	available	not available¹
STR	available	available	not available¹
TIME	available	not available	not available
VALUE	available	available	available
IN	available	available	not available
REGEX	not available	not available	available
Group functions can be applied to multiple row attribute groups and to those configured for historical data collection. Table and chart views require that a time range be set to show a span of data samplings.
AVG	available	not available	not available
COUNT	available	not available	not available
MAX	available	not available	not available
MIN	available	not available	not available
SUM	available	not available	not available
Situation characteristics
Embedded, including correlated situations	available	not available	not available
Multiple attribute groups	available	not available	not available
Persistence enabled	available	available	available²
Display item selected	available	not available	available³
Uses duper process	available	not available	not available
Distribution to managed system group	available	available	not available
Combination AND and OR logical connectors	available	available	not available⁴
¹ Use the REGEX function instead. ² Situation persistence is not evaluated at the agent when the situation is configured to emit a SNMP trap. It is supported when the situation is configured to emit an EIF event. SNMP traps can be emitted in two modes: RC (Rising Continuous) whereby a trap is emitted every time the situation is true; HY (Hysteresis) whereby a trap is emitted the first time the situation is true and a clearing trap is emitted when the situation is no longer true. As well, persistence can be enabled at the trap destination by implementing a persistence rule. ³ If the situation is configured to emit an EIF event, a separate EIF event is sent for each row with a unique display item value. However, when situations are configured to emit SNMP events situations that include a display item (available for multiple row attribute groups) they are limited to sending one SNMP alert for the first row that evaluates to true; no alerts can be sent for any subsequent rows that evaluate to true. ⁴ Private situations are limited to all AND or all OR connectors.