IBM Tivoli Monitoring > Version 6.3 Fix Pack 2 > Installation Guides > Installation Guide > Set up event forwarding to Netcool/OMNIbus > Understanding and Customizing the Event Contents

IBM Tivoli Monitoring, Version 6.3 Fix Pack 2

Default mapping of situation events to OMNIbus events

You can use the mapping information in this topic when you forward a situation event to the Tivoli Netcool/OMNIbus ObjectServer and want to write probe rules or SQL procedures and triggers in the ObjectServer.

The situation event forwarder generates an event integration facility (EIF) event with an event class based on the attribute group used in the situation. When the situation event is forwarded to the EIF Probe, the Tivoli Netcool/OMNIbus EIF probe translates the EIF event into an OMNIbus alert format. The EIF event contains all of the base attributes described by the Omegamon_Base class and its parent class EVENT. The EIF event also contains the agent specific attributes from the attribute group referenced by the situation definition when the event is opened. The agent specific attributes are also called extended slots in the Tivoli Enterprise Portal EIF Slot Customization function. For more information on agent-specific slots included in events, see Generic mapping for agent-specific slots.

Agent-specific attributes are not included in any event status updates (including the event status update message that is sent when the event is closed in IBM Tivoli Monitoring).

Omegamon_Base is described as follows:

As part of the generic mapping for these situations, the IBM Tivoli Monitoring event forwarder assigns associated values for each of the Omegamon_Base event class attributes when forwarding an event to the EIF Probe. In addition to these event class attributes, values are assigned to the host name, origin, severity, and message attributes that are inherited from the EVENT class as shown in Table 1.


Base IBM Tivoli Monitoring EIF attribute slots.

EIF slot attributes Values and meaning
appl_label Indicates if the event was sent from a monitoring agent. For events sent from a monitoring agent, this attribute is set to A:P:S if the event is a private situation event or is set to A:P:L if the event is a lifecycle event. For events sent from a hub monitoring server, a value is not provided for this slot.
cms_hostname TCP/IP host name of the hub Tivoli Enterprise Monitoring Server that forwards the event.
cms_port The hub monitoring server port on which the SOAP web service is listening.
ClassName ITM_ + the name of the attribute group that the situation definition is based on, for example: ITM_NT_Process.
fqhostname The fully qualified host name, if available. of the managed system where the event originated. 1
hostname The TCP/IP host name of the managed system where the event originated, if available. 1
integration_type Indicator to help OMNIbus performance.

  • N for a new event, the first time the event is raised

  • U for update event, subsequent event status changes

The integration_type value is used solely by the OMNIbus synchronization rule to improve its performance. It has no other meaning related with the event.

master_reset_flag Master reset indicator set for master reset events that indicate a hub monitoring server has been started. Value is NULL for all other events:

  • R for monitoring server recycle master_reset

  • S for hotstandby master_reset

msg The situation name and formula when a situation event is opened and the situation name for all other event messages, for example acknowledgement, close, and so on.
origin The TCP/IP address of the managed system where the event originates, if available. The address is in dotted decimal format. 1
severity The EIF severity of the event.
situation_displayitem Display item of associated situation, if available.
situation_eventdata Event data attributes in key-value pair format if multiple rows of the attribute group match the situation condition, if the situation does not have a display item, or if multiple rows have the same display item value. The data from the first row that matches the situation condition is not included in this EIF slot. The event data can be truncated because the event integration facility imposes a 2 KB size limit.
situation_group One or more situation group names (up to 5) that the situation is a member of.
situation_fullname Display name of the associated situation if it is different from the situation identifier in the situation_name slot.
situation_name Unique identifier given to the situation.
situation_origin Managed system name where the situation event originated. It has the same value as sub_source.
situation_status Status of the situation event. The following values are valid:

  • Y if the situation condition is true and event has been opened in the hub monitoring server.

  • N if the situation condition has become false and the event is closed in the hub monitoring server.

  • A if the event has been acknowledged.

  • E if the event has been resurfaced (deacknowledged).

  • F if the acknowledgment timeout for the event has expired.

  • P if the situation has been stopped.

  • D if the situation has been deleted.

  • X the situation includes an error.

situation_time Timestamp of the situation event.
situation_type Indicator of whether the IBM Tivoli Monitoring situation that caused the event is a sampled or pure situation.
situation_thrunode The hub or remote Tivoli Enterprise Monitoring Server that the managed system is connected to.
source ITM
sub_source The origin managed system name for the associated situation.

  1. If there is an IBM Tivoli Monitoring firewall gateway between the managed system and its monitoring server, these slots contain the hostname and IP address of the firewall gateway instead of the managed system.

The IBM Tivoli Monitoring rules for the Tivoli Netcool/OMNIbus EIF probe map the EIF attribute slots of the situation event into ObjectServer attributes, which are defined in the alerts.status table of the Netcool/OMNIbus ObjectServer. See Table 2 for details. Although the EIF event also contains the agent specific attribute group slots when the event is opened, these slots are not mapped to ObjectServer attributes by the probe rules.


Mapping of EIF attribute slots to OMNIbus attributes

EIF slot attribute OMNIbus attribute
situation_name + situation_origin + situation_displayitem + event_class Identifier (for ITMProblem)
situation_name + situation_origin + situation_displayitem + event_class + ITMResolution Identifier (for ITMResolution)
situation_name AlertKey
situation_origin ITMSitOrigin
situation_origin Node
situation_origin NodeAlias
source Agent
default Type (20) (for ITMProblem)
situation_status = “P” and integration_type = “U” Type (21) (for ITMResolution)
situation_status = “D” and integration_type = “U” Type (21) (for ITMResolution)
situation_status = “N” and integration_type = “U” Type (21) (for ITMResolution)
situation_displayitem ITMDisplayItem
situation_status ITMStatus
situation_thrunode ITMThruNode
situation_time ITMTime
situation_type ITMSitType
situation_eventdata ITMEventData
cms_hostname ITMHostname
master_reset_flag ITMResetFlag
integration_type ITMIntType
ClassName AlertGroup
msg Summary
“tivoli_eif probe on ”+hostname() Manager

6601 if integrating with Tivoli Business Service Manager

87722 if the event was sent by the hub monitoring server

87723 if the event was sent from an IBM Tivoli Monitoring agent

Class
severity 

    FATAL / 60 = Critical
CRITICAL / 50 = Critical
MINOR / 40 = Minor
WARNING / 30 = Warning
UNKNOWN / 10 = Indeterminate

Severity
getdate LastOccurrence/FirstOccurrence
date TECDate
repeat_count TECRepeatCount
fqhostname TECFQHostname
hostname TECHostname
cms_port ITMPort
situation_fullname ITMSitFullName
situation_group ITMSitGroup
appl_label ITMApplLabel

If you use the virtualization or predictive rules files provided with Netcool/OMNIbus, those rules might set some of the OMNIbus attributes differently than the settings in the table above, for example, Node, NodeAlias, Class, and Summary.

You should not customize the EIF probe rules or use the EIF Slot Customization window of the Situation Editor to change any of the situation EIF attribute slots that are used by the IBM Tivoli Monitoring triggers in the Netcool/OMNIbus ObjectServer to process IBM Tivoli Monitoring events. The EIF slots and OMNIbus attributes that should not be customized are shown in table Table 3.


EIF attribute slots to OMNIbus attributes, not to be customized

EIF Slot OMNIbus attribute
appl_label ITMApplLabel
cms_hostname ITMHostname
cms_port ITMPort
integration_type ITMIntType
master_reset_flag ITMResetFlag
situation_displayitem ITMDisplayItem
situation_eventdata ITMEventData
situation_name AlertKey
situation_origin ITMSitOrigin
situation_status ITMStatus
situation_thrunode ITMThruNode

The situation_origin EIF slot is also mapped to the Node and NodeAlias OMNIbus attributes. However, since the IBM Tivoli Monitoring triggers do not use the Node and NodeAlias attributes, you can customize their values in the itm_custom_override.rules file. However, if you are using the virtualization or predictive rules files provided with Netcool/OMNIbus, verify that your customizations of Node and NodeAlias are consistent with the values set by these rules.


Parent topic:

Understanding and Customizing the Event Contents

+

Search Tips   |   Advanced Search