Course Guide · Your new filter is listed in the list of the filters. Important Never put a space character in the filter name. The database interprets a space as a delimiter character

®

Course Guide

Tivoli Network Manager 4.2 Operations and AdministrationCourse code TN325 ERC 2.0

IBM Training

August 2017 edition

NOTICESThis information was developed for products and services offered in the USA.

IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785United States of America

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

TRADEMARKSIBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtml.

Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries.

Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

IT Infrastructure Library is a Registered Trade Mark of AXELOS Limited.

ITIL is a Registered Trade Mark of AXELOS Limited.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and other countries.

© Copyright International Business Machines Corporation 2017. This document may not be reproduced in whole or in part without the prior written permission of IBM.

US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

http://www.ibm.com/legal/copytrade.shtml




Contents

Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi

Unit 1. Introduction to Netcool Operations Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1This unit has no student exercises.

Unit 2. Tivoli Network Manager 4.2 introduction and architecture . . . . . . . . . . . . . . . . . . . . . . . . . 2-1Task 1 Preparing for the lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1

Task 2 Logging on to the virtual machines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6

Task 3 Starting Tivoli Network Manager core processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8

Task 4 Modifying CtrlServices.cfg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13

Task 5 Using a signal to change logging level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-16

Unit 3. Discovery basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1Task 1 Configuring a discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1

Task 2 Reducing finding time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-13

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20

Unit 4. Advanced discovery options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-12

Unit 5. Topology visualization basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1Task 1 Preparing for the lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1

Task 2 Configuring an event filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1

Task 3 Configuring an event view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7

Task 4 Enabling default chassis and interface ping polls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-11

Task 5 Exploring topology views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-17

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-30

Unit 6. Advanced visualization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1Task 1 Adding a device with the Topology Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1

Task 2 Adding a connection with the Topology Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5

Task 3 Exploring cross-domain network views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-8

Task 4 Removing previous discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-10

Task 5 Configuring and running a new discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-10

Task 6 Creating the second domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-18

Task 7 Configuring and running a discovery in the second domain . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-25

Task 8 Creating AGGREGATION network view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-32

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-41

Course materials may not be reproduced in whole or in part without the prior written permission of IBM.

© Copyright IBM Corp. 2017 iii

Contents

V7.0

Uempt
yUnit 7. The Network Health Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1
This unit has no student exercises.

Unit 8. Monitoring and polling network devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1Task 1 Creating real-time MIB graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2

Task 2 Troubleshooting tools for real-time graphing (optional task) . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-15

Task 3 Creating a custom poll definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-18

Task 4 Editing the poll policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-24

Task 5 Modifying the event view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-26

Task 6 Configuring default polls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-33

Task 7 Configuring a network view for adaptive polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-34

Unit 9. Understanding DNCIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1This unit has no student exercises.

Unit 10. Customizing discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1Task 1 Creating custom database tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1

Task 2 Implementing a custom stitcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-5

Task 3 Populating the customData table in NCIM database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-10

Task 4 Running discovery and view the results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-13

Task 5 Modifying Dashboard Application Services Hub to use the customData table . . . . . . . . . . . . 10-16

Task 6 Creating custom network views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-19

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-26

Unit 11. The gateway and RCA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1Task 1 Enabling the gateway Disco plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1

Task 2 Assigning the event to an eventMap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3

Task 3 Modifying the mttrapd rules files and lookup tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-8

Task 4 Testing the processing of coldStart traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-10

Unit 12. Tivoli Network Manager scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-1This unit has no student exercises.

Unit 13. Tivoli Network Manager failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-1This unit has no student exercises.

Unit 14. Installing Tivoli Network Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14-1This unit has no student exercises.

Unit 15. Tivoli Network Manager reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-1Task 1 Viewing a report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-1

Task 2 Scheduling automatic report snapshots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-3

Task 3 Saving a report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-5

Task 4 Creating a report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-6

Task 5 Adding report parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-14

Unit 16. Event searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-1Task 1 Populating event data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-1

Task 2 Extending the event record. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-2


© Copyright IBM Corp. 2017 iv

Contents

V7.0

Uempt
yTask 3 Populating the event record with customer-specific data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-3
Task 4 Creating dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-14

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-30

Task 5 Analyzing event data with Log Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-31

Task 6 Using launch-in-context tools from Netcool Web GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-43

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-51

Unit 17. Log analysis basics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-1Task 1 Analyzing WebSphere Application Server log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-1

Task 2 Analyzing DB2 logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-13

Task 3 Analyzing web server access logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-21

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-24

Unit 18. Seasonal events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-1Task 1 Verifying configuration objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-1

Task 2 Working with seasonal events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-4

Task 3 Creating a seasonal event rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-11

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-17

Unit 19. Related events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-1Task 1 Verifying configuration objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-1

Task 2 Working with related events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-4

Task 3 Viewing grouped events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-13

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-17

Unit 20. Optical transport and Radio Access Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20-1This unit has no student exercises.


© Copyright IBM Corp. 2017 v

V11.0

TMK


© Copyright IBM Corp. 2017 0vi

Trademarks

The reader should recognize that the ++following terms, which appear in the content of this training document, are official trademarks of IBM or other companies:

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide.

The following are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide:

ITIL is a Registered Trade Mark of AXELOS Limited.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Windows is a trademark of Microsoft Corporation in the United States, other countries, or both.

Java™ and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

UNIX is a registered trademark of The Open Group in the United States and other countries.

VMware is a registered trademark or trademark of VMware, Inc. or its subsidiaries in the United States and/or other jurisdictions.

Other product and service names might be trademarks of IBM or other companies.

AIX® Cognos® DB™DB2® FileNet® IBM Connections™Informix® Insight™ Jazz™Netcool® Notes® Tivoli®WebSphere® 400®

Unit 1. Introduction to Netcool Operations Insight



© Copyright IBM Corp. 2017 1-1

Unit 1. Introduction to Netcool Operations Insight

V7.0

Uempt
y


Unit 2. Tivoli Network Manager 4.2 introduction and architecture

Task 1 Preparing for the lab

This class is taught with various delivery methods. In this exercise, determine which of the following class delivery methods is being used for your class. Follow the setup instructions for the training environment that is being used for this class.

Instructor-led training (ILT) in a classroom environment

__ 1. Instructor-led training (ILT) classes are taught in a classroom environment.

__ 2. Each student uses a computer that is hosting two VMware virtual machines.

__ a. The NOI14-ITNM42 virtual machine is the IBM Tivoli Network Manager software that is used during the course.

__ b. The GNSTN325 (or GNS3) virtual machine hosts a simulated network that can be discovered and monitored during student exercises.

__ 3. Your instructor starts these virtual machines for you or guides you through the necessary steps to do so.

Instructor-led online (ILO) training for IBM employees and Business Partners

IBM employees and Business Partners in ILO courses connect to remote lab machines with a virtual private network (VPN) client.

__ 1. IBM employees must authenticate to the IBM internal network with the same VPN client that they normally use to connect to the internal network.

__ 2. Business Partners use a Cisco or Nortel VPN client to connect to the network.

__ 3. The instructor provides to each student the IP address of the host machine, a student login name, and password.

__ 4. Students connect to the host servers with VNC or Remote Desktop connections. The host system typically runs Linux.



V11.2

EXemp


ty__ 5. To prepare for lab exercises in this environment, complete the following steps:

__ a. Start the appropriate VPN client. IBM employees use the same VPN client and connection that they use when connecting to the IBM internal network. Business Partners connect to the lab environment with a Nortel client. This client is provided to them when they register for an ILO class.

__ b. From a Windows PC, run the Remote Desktop Connection and specify the correct IP address that is provided to you by your instructor.

__ c. Enter the student user name and password that your instructor provided to you. Click OK to log on to the host PC.

__ d. On the host desktop, double-click the VMware Workstation icon.



V11.2

EXemp


ty__ e. On the Home tab, click the option to Open a Virtual Machine.

__ f. Navigate to the directory with the GNSTN325 directory. Your path might be different from the one that is shown here.



V11.2

EXemp


ty__ g. Double-click the file name GNSTN325.vmx or GNS3 file to start the machine. If you see

an error message, click the option to Never show this hint again and click OK.

__ h. Click Power on this virtual machine.

__ i. Click the Home tab. Click Open a virtual machine.

__ j. Following the same procedure that you used to start the GNSTN325 (or GNS3) image, start the NOI14-ITNM42 virtual machine. Navigate to the directory that contains the NOI14-ITNM42.vmx file. Double-click the file name to start the machine. If any error messages are seen, click the option to Never show this hint again and click OK.

__ k. Click Power on this virtual machine.

__ l. Proceed to “Logging on to the virtual machines” on page 2-6.

Note

If you receive a message that indicates that someone else owns the virtual machine, it means that a lock file is on the virtual machine. It is located in the same directory with the virtual machine. The *.vmx file is a subdirectory that ends with *.vmx.lck. Make sure that the virtual machine is not running, and delete this *.vmx.lck directory. Then, attempt to start the virtual machine again. If you still have problems, ask for assistance.



V11.2

EXemp


tyTraining on Skytap hosting platform

__ 1. In an internet browser, go the Uniform Resource Locator (URL) that IBM Training provided for your Skytap student session.

__ 2. Click the arrow in each image box to start the corresponding image..

__ 3. To access an image, click in the center of the image icon.

__ 4. When you are in the image, you see a small auto-hiding toolbar in the top of your window. Hover your mouse over this toolbar to expand it. Familiarize yourself with the controls in the toolbar before proceeding further.

__ a. One icon toggles the full screen mode. Whenever you are working in the NOI14-ITMNM42 image, use full-screen mode so that you can more easily see all of the Tivoli Network Manager graphical user interface (GUI).

__ b. Several times during this course you are asked to switch between the two virtual machines to do various tasks. It is important that you know how to access the Skytap virtual machine menu.



V11.2

EXemp


ty__ 5. Proceed to “Logging on to the virtual machines” on page 2-6.

Task 2 Logging on to the virtual machines

Hint

If you are using VMware Workstation, press Ctrl+Alt+Enter to toggle between full-screen mode and a window view of the virtual machine. Because you do not have to access the simulator often during this course, it is best to run the NOI14-ITNM42 virtual machine in full-screen mode.

__ 1. In the GNSTN325 virtual machine, log on as root with a password of object00.

__ a. From the system desktop, double-click the RouterSim-lab1 icon.

__ b. Click the green arrow for Start/Resume all devices.

__ 2. Select the NOI14-ITNM42 virtual machine.



V11.2

EXemp


ty

Hint

If you are using VMware Workstation, press Ctrl+Alt+Enter to toggle between full-screen mode and a window view of the virtual machine. Since you do not need to access the simulator often during this course, it is best to run the NOI14-ITNM42 virtual machine in full-screen mode.

__ 3. Log on as netcool with a password of object00.



V11.2

EXemp


ty__ 4. Right-click the desktop and select Open Terminal.

Task 3 Starting Tivoli Network Manager core processes

Many Linux servers do not enable multicast by default. Tivoli Network Manager requires the use of the multicast service for the ncp_ctrl process to function properly.

__ 1. If you are not logged on to the Linux server, log on to the system as user netcool with a password of object00.

__ 2. Right-click the desktop and click Open Terminal.

__ 3. At the terminal prompt, type the following command to make sure that your environment variables are properly set before you continue the exercises in this unit:

. /opt/IBM/tivoli/netcool/env.sh

Note

A space follows the initial period in the preceding command.

__ 4. Type the following command.

netstat -rn



V11.2

EXemp


ty__ 5. Verify that a route exists to the 224.0.0.0 / 240.0.0.0 network. This routing entry verifies that

multicasting is enabled.

The following example shows no multicast routing:

__ a. If you see the multicast route to the 224.0.0.0 network, proceed to Step 7 on page 2-11.

__ b. If you do not see the route to the 224.0.0.0 network, proceed to Step 6.

__ 6. Enable multicast.

__ a. Change to the root user. Enter a password of object00 when prompted.

su -

__ b. Run the following command to enable multicast routing on your server.

/sbin/route add -net 224.0.0.0 netmask 240.0.0.0 dev eth0

__ c. Change to the directory contain networking scripts.

cd /etc/sysconfig/network-scripts

__ d. With vi or gedit, create and save a file that is called route-eth0, which contains the following text that causes multicast to be enabled after a system restart:

224.0.0.0/4 dev eth0

__ e. Return to the netcool user with the exit command.

exit



V11.2

EXemp


ty__ f. Verify with the netstat -rn command that a route exists to the 224.0.0.0 / 240.0.0.0

network. This routing entry indicates that multicasting is enabled.

Note

Always make sure that multicasting is enabled because it might be used for some component communications. The Linux administrator can place a command in the ip-routes script or create a route-eth0 file to enable multicasting each time the Linux server is restarted.



V11.2

EXemp


ty__ 7. Verify that Tivoli Network Manager processes started earlier. Use the itnm_status

command. If the processes are running (showing similar output to the following example), proceed to Task 4, “Modifying CtrlServices.cfg,” on page 2-13.

itnm_status

__ 8. If Tivoli Network Manager processes are not running, start them with the itnm_start command. Start IBM Tivoli Network Manager and its associated processes by running the following command:

itnm_start -domain NOI_AGG_P



V11.2

EXemp


ty

Important

If you do not see the Apache Storm processes running and receive the following error message:

you must navigate to the /opt/IBM/tivoli/netcool/var/precision/storm directory and run the following command:

rm -f sup.sktitnm_stopitnm-start

Allow several minutes for processes to start. You see the following message:

__ 9. Verify that Tivoli Network Manager processes started earlier. Use the itnm_status command. Observe that the output of the itnm_start command is similar to the itnm_status command from the preceding step.

Note

If the ncp_model process fails to start, Tivoli Network Manager might not have a connection to the NCIM database on your DB2 or Oracle server. You can verify whether the DB2 database is running by using the following method:

cd /home/db2inst1/sqlib/adm/./db2start

SQL1063N DB2START processing was successful.

Or you see this message:

SQL1026N The database manager is already active.



V11.2

EXemp


ty

Note

If the db2start command results in a message that says SQL1026N The database manager is already active, it means that the DB2 database is already running and you do not have to do anything else. Your virtual image is configured to automatically start DB2 and Tivoli Network Manager processes. You are confirming that these processes are started.

__ 10. Verify that you are the netcool user by entering the id command. If you are still the root user, type exit to return to the netcool user.

[netcool@host1 bin]$ iduid=501(netcool) gid=501(ncoadmin) groups=501(ncoadmin),102(db2iadm1)

Task 4 Modifying CtrlServices.cfg

The file specifies the following information:

• What Tivoli Network Manager processes to start

• What processes must be started first because other processes are dependent upon them

• What level of logging to use for each process

This exercise configures the CTRL service to increase the logging level for the ncp_disco process. Changing the logging level gives you greater detail about your problem.

__ 1. Open a terminal window unless one is already open on your desktop.

__ a. Right-click your desktop background.

__ b. Select Open Terminal.

__ c. At the terminal prompt, type the following command to make sure that your environment variables are properly set before you continue the exercises in this unit.


__ 2. Open the CtrlServices.cfg file in an editor.

__ a. If you are familiar with the UNIX vi editor, run the following command:

vi $NCHOME/etc/precision/CtrlServices.cfg

__ b. If you are not familiar with the use of vi, use the graphical editor by running the following command:

gedit $NCHOME/etc/precision/CtrlServices.cfg

__ 3. Search for the entry into services.inTray for ncp_disco.

__ 4. Edit that entry to use a -debug value of 3 and a -messagelevel value of error.

__ 5. Save the file.



V11.2

EXemp


ty__ 6. View the current log files for ncp_disco with the UNIX more command. Take note of the

level of detail currently in the file.

more $NCHOME/log/precision/ncp_disco.NOI_AGG_P.log more $NCHOME/log/precision/ncp_disco.NOI_AGG_P.trace

__ 7. Stop Tivoli Network Manager.

itnm_stop ncp

__ 8. After you wait 1 – 2 minutes, verify that Tivoli Network Manager processes stopped. The ObjectServer, probes, Dashboard Application Services Hub, and process automation can be running. But other ncp_ processes should stop. Use the itnm_status command to verify.

[netcool@localhost precision]$ itnm_stop ncp[netcool@localhost precision]$ itnm_status

__ 9. Restart Tivoli Network Manager.

itnm_start ncp -domain NOI_AGG_P

Note

The itnm_start and itnm_stop commands, when used without any command-line parameters, start or stop all processes on the server that are related to Tivoli Network Manager. These commands start or stop all ObjectServers, probes, Tivoli Network Manager processes, and Dashboard Application Services Hub that are running on this server. You can also use these commands with a parameter that limits what they start and stop. For example, itnm_stop tip stops only the Dashboard Application Services Hub server, but leaves the ObjectServer and Tivoli Network Manager processes running. The itnm_start ncp command starts only the Tivoli Network Manager processes, but does not attempt to start ObjectServer or Dashboard Application Services Hub processes. Available command-line options for itnm_start, itnm_stop, and itnm_status are:

• storm for Apache Storm processes and topology

• ncp for Tivoli Network Manager processes

• tip for Dashboard Application Services Hub



V11.2

EXemp


ty__ 10. View the current log files for ncp_disco with the UNIX more command.

more $NCHOME/log/precision/ncp_disco.NOI_AGG_P.logmore $NCHOME/log/precision/ncp_disco.NOI_AGG_P.trace

Hint

When troubleshooting a problem, it can be helpful to continuously monitor the log file for a process as it is running. The log files are in the $NCHOME/log/precision directory. Use the tail -f ncp_processName.domainName.trace command. For example, to monitor the ncp_disco process in your training environment, type tail -f ncp_disco.NOI_AGG_P.trace. It helps to open a second terminal window for running commands while you monitor the log file activity in real time.

__ 11. Take note of the level of detail currently in the file. How does the level of detail differ from what you saw in Step 6 on page 2-14?

Task 5 Using a signal to change logging level

__ 1. When you change the CtrlServices.cfg file, you must stop and restart Tivoli Network Manager to get it to reread the CtrlServices.cfg file. You can dynamically change the level of logging by sending a signal to the process.

__ 2. Open two terminal windows, including the ones already active on your desktop. If you already have any terminal windows open, enter the clear command in each terminal window and proceed to Step 3.

__ a. Right-click the desktop background and select Open Terminal.

__ b. At the terminal prompt, type the following command to make sure that your environment variables are properly set before you continue the exercises in this unit.


__ 3. Arrange the windows so you can view them side-by-side simultaneously.

__ 4. In the right window, begin viewing the trace file for ncp_disco.

tail -f $NCHOME/log/precision/ncp_disco.NOI_AGG_P.trace

__ 5. In the left window, determine the process ID (PID) of the ncp_disco process. Run the itnm_status command and look for the PID associated with ncp_disco in the results.

itnm_status

__ 6. In the left window, run the following command to increment the trace level for ncp_disco.When you run the command, watch the results in the second window. Use the PID value that corresponds to the ncp_disco process on your server.

kill -USR2 PID

Example: kill -USR2 1387



V11.2

EXemp


ty

Note

Each time that you use the kill -usr2 PID command, a message in the trace file indicates that the debug level increased. When the debug level gets to 3, you can see other messages that show what Tivoli Network Manager is doing in the background. At debug level 4, you see messages that show interaction between Tivoli Network Manager processes. For diagnosing problems with Tivoli Network Manager processes, debug level 3 usually provides sufficient information.

__ 7. Run the kill -USR2 process-id command several more times. Watch what happens in the terminal window where you are watching the log file. Keep incrementing the debug level until it returns to a value of zero.

__ 8. In the right window, press Ctrl+C to stop monitoring the trace file.

__ 9. In that right window, type the following command:

tail -f $NCHOME/log/precision/ncp_disco.NOI_AGG_P.log

__ 10. In the left window, run the following command several times and watch the results in the right window. Use the PID value that corresponds to the ncp_disco process on your server.

kill -USR1 PID

Example: kill -USR1 1387

__ 11. Continue to increment the logging detail level until it returns to a value of info.

__ 12. Press Ctrl+C to stop monitoring the log file.

Summary

In this exercise, you learned how to do the following tasks:

• Prepare the lab

• Log on to the virtual machines

• Start Tivoli Network Manager core processes

• Modify CtrlServices.cfg

• Task 5: Use a signal to change logging level



Unit 3. Discovery basics

The exercises for this unit consist of running a basic discovery with ping and file finders.

Task 1 Configuring a discovery

This self-paced exercise begins with configuring a network discovery in IBM Tivoli Network Manager 4.2. Make sure that your Tivoli Network Manager server is already running. Your instructor can tell you how to start your server or can start it for you. When the NOI14-ITNM42 virtual machine is running, press Ctrl+Alt+Enter to work in a full-screen view.

__ 1. Start the Firefox browser by selecting Applications > Internet > Firefox Web Browser from the menu.

__ 2. Go to the https://localhost:16311/ibm/console URL.



V11.2

EXemp


ty__ 3. Log on as the itnmadmin user with a password of object00.

__ 4. From the left menu, select Discovery > Network Discovery Configuration.

__ 5. Verify that the NOI_AGG_P domain from the domain drop-down list is set.

Note

The list contains only one domain until a later exercise when you add a second domain.



V11.2

EXemp


ty__ 6. On the Network Discovery Configuration tab, click the New icon, under the scope tab, to

add the 10.10.1.0/24, 10.10.2.0/24, 10.10.255.0/24, and the 10.191.101.0/24 subnets to the Scope Configuration.

__ 7. In the Scope Properties box, set the scope to 10.10.1.0/24. Select the Add to Ping Seed List check box. Click OK.

Note

If you do not see that the scope list is updated after clicking OK, click the refresh icon in the Firefox browser to refresh the screen. If the problem persists, stop and start Dashboard Application Services Hub with the commands itnm_stop tip and itnm_start tip. Then, log on again to the Dashboard Application Services Hub.



V11.2

EXemp


ty__ 8. Repeat the preceding two steps to add the 10.191.101.0/24, 10.10.2.0/24, and

10.10.255.0/24 subnets. Make sure to select the Add to Ping Seed List option.

__ 9. On the Passwords tab, complete these steps:

__ a. Click the icon to add a community string.

__ b. Add the community string 4IBM twice (once as SNMP Version 2 and once as Version 1).

__ c. Add the community string IBM4 twice (once as SNMP Version 2 and once as Version 1).

__ d. Add the community string tivoli twice (once as SNMP V2 and once as SNMP V1).

__ e. Use the arrow keys to adjust the positions of the strings so that the order from top to bottom is 4IBM, IBM4, tivoli.



V11.2

EXemp


ty__ f. Use the arrow keys to make sure that the Version 2 string in each password pair is

above the Version 1 string.

Hint

When you enter a global SNMP community string, you can get a warning message about the use of global strings. For this exercise, ignore the warning message and continue the exercise.

__ 10. In the Telnet / SSH section of this tab, enter object00 as the telnet password.



V11.2

EXemp


ty__ 11. On the Full Discovery Agents tab, select the Full Layer 2 and Layer 3 Discovery check

box.

__ 12. On the Advanced tab, select the following options:

- Allow Broadcast Pinging

- Allow Multicast Pinging (to speed up discovery)

- Enable VLAN Modeling

- Enable SysName Naming (to get names from devices)

- Enable Rediscovery Rebuild Layers

- Enable Rediscovery of Related Devices

- Enable ifName/ifDescr Interface Naming (to get interface names from devices)



V11.2

EXemp


ty__ 13. Make sure that all of the Enable Inference options are cleared.

__ 14. Click the icon to save the discovery configuration.

__ 15. Use the netstat -rn command to determine whether the networks you added in Step 7 on page 3-3 and Step 8 on page 3-4 are included in the routing table. In the following example, the routes for the added networks are not there.

Kernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface10.191.101.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1



V11.2

EXemp


ty224.0.0.0 0.0.0.0 240.0.0.0 U 0 0 0 eth00.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth1

__ a. If you do not see that the networks are added in Step 7 on page 3-3 and Step 8 on page 3-4, complete the following steps:

1) Change to the root user with password object00.

su -

2) Use vi or gedit to edit the /etc/sysconfig/network-scripts/route-eth0 file. Add the following lines to route traffic to the simulator networks through 10.191.101.126 (the IP address of the GNSTN325 virtual machine that runs the network simulator).

#default via 192.168.100.100 dev eth010.191.101.0/24 dev eth0224.0.0.0/4 dev eth010.10.1.0/24 via 10.191.101.125 dev eth010.10.2.0/24 via 10.191.101.125 dev eth010.10.255.0/24 via 10.191.101.125 dev eth0

Note

If the default route is not commented out in this file, then comment it out as seen in the previous code example.

3) Use vi or gedit to edit the /etc/sysconfig/network-scripts/ifcfg-eth0 file. Delete the following comment symbol (#) to route traffic through the VMware networks to 10.191.101.125 (the IP address of the GNSTN325 or GNS3 virtual machine that runs the network simulator).



V11.2

EXemp


ty4) Stop and restart networking with the following commands as the root user:

/etc/init.d/network stop/etc/init.d/network start

5) Check the network routing table again with the netstat -rn command. The following example shows a routing table that contains the routes to the three networks added in Step 7 on page 3-3 and Step 8 on page 3-4.

[netcool@host1 scripts]$ su -Password: [root@host1 ~]# netstat -rnKernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 eth010.10.2.0 10.191.101.125 255.255.255.0 UG 0 0 0 eth010.191.101.0 0.0.0.0 255.255.255.0 U 0 0 0 eth010.10.1.0 10.191.101.125 255.255.255.0 UG 0 0 0 eth010.10.255.0 10.191.101.125 255.255.255.0 UG 0 0 0 eth0169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0224.0.0.0 0.0.0.0 240.0.0.0 U 0 0 0 eth00.0.0.0 192.168.100.1 0.0.0.0 UG 0 0 0 eth0

6) Continue to Step 16 on page 3-9.

7) Exit the root user. Check to ensure that you are back to the netcool user. Use exit and then id commands.

id [root@host1 ~]# exitlogout[netcool@host1 scripts]$ iduid=501(netcool) gid=501(ncoadmin) groups=501(ncoadmin),102(db2iadm1)

__ b. If you already see that the routes for the networks were added in Step 7 on page 3-3 and Step 8 on page 3-4, continue to Step 16.

__ 16. Select Network Discovery Status from the left menu.



V11.2

EXemp


ty__ 17. Click the green play arrow to start a full discovery or select the drop-down menu and the

option Start Full Discovery.

Important

Discovery happens in three basic phases. First, finders locate devices either by reading a hosts file or by pinging a list of subnets or key devices. Then, agents interrogate devices with discovery protocols to determine what interfaces each device has and to what other devices it is connected. Finally, stitchers sew together the network map. The stitchers build a list of entities (EntityType 1 = chassis, EntityType 2 = interface, EntityType 3 = logical interface). Then, containment relationships are identified, showing which entities are contained inside of other entities, such as an interface contained within a chassis. Stitchers then build a list of connections between devices. Because there are many types of connections between devices, each layer of connectivity is built separately. The final step of discovery merges all the layers of connectivity into a cohesive map. This data is sent to the MODEL (ncp_model binary) service.



V11.2

EXemp


ty__ 18. Wait until discovery completes. The Status column shows check marks for each of the four

stages of discovery that is complete.

__ a. Discovery is complete when you see the discovery type as Discovery is Not Running. The Work Completed column has a value of 100%.

Hint

After you complete the preceding steps in this exercise, a successful discovery has approximately 46 network devices. This number can vary slightly according to your classroom environment. If you have significantly fewer devices, verify that your routing table contains the correct networks as seen in Step 15 on page 3-7. If you are still experiencing difficulty, ask your instructor for assistance.



V11.2

EXemp


ty__ b. You can also see when discovery is complete by viewing the Event Viewer List. To see

this list, select Incident icon > Events > Event Viewer. Look for a message that indicates the Topology Transfer to NCIM completed. Check the time stamp on that event to confirm that discovery finished.

__ 19. In the Event Viewer, navigate to the search box and enter NOI_AGG_P and click the Apply button.



V11.2

EXemp


ty__ 20. Observe the event with the Topology Transfer to NCIM completed summary.

[

Task 2 Reducing finding time

In this exercise, generate a hosts file. Use that hosts file as the new seed file for your discovery to reduce the time that was previously spent doing ping sweeps. Remove seeds from the ping seed list.

__ 1. Go to the $ITNMHOME/scripts/perl/scripts directory by entering the following command:

cd $ITNMHOME/scripts/perl/scripts/

Note

In earlier versions of IBM Tivoli Network Manager IP Edition, the user environment included the $PRECISION_HOME variable. This variable is now labeled $ITNMHOME. Both of these variable names are included in the /opt/IBM/tivoli/netcool/env.sh file. The updated name reflects a change in product name from IBM Tivoli Netcool Precision to IBM Tivoli Network Manager. These variables are interchangeable, but this exercise guide always refers to the $ITNMHOME variable in command-line examples.



V11.2

EXemp


ty__ 2. Run the following command:

ncp_perl ./BuildSeedList.pl -domain NOI_AGG_P

Important

Make sure that you do not stop discovery before you run the script to generate the seedfile.txt file. Doing so empties the discovery tables that create the seed list and results in an empty seed list.

Note

The preceding command results in a lengthy message in the terminal window that indicates that you can use the file by manually inserting the file name in the fileFinder.parseRules section of the $NCHOME/etc/precision/DiscoFileFinderParseRules.NOI_AGG_P.cfg file. This manual process is necessary if you want to use the third column in the seed list to set a value for a Customer field. You can also use this same process to make the third field represent a value for Location. However, if you need only to use the seed file to insert an IP address and host name in discovery, you can ignore the displayed message and continue to the next step.



V11.2

EXemp


ty__ 3. View the results. Your results can differ from the following example.

cat $NCHOME/etc/precision/seedfile.txt

## ## Test Network Seed data ## ## IP NameCustomer##

## Primary IPs 10.10.255.1 BRU-Core-01 IBM10.10.255.7 MOS-Core-01 IBM10.10.255.2 PAR-Core-01 IBM10.10.255.3 LON-Core-01 IBM10.10.255.10 BRU-SW-01 IBM10.10.255.12 BRU-CPE-01 IBM10.10.255.4 NYC-Core-01 IBM10.10.255.11 BRU-ACS-01 IBM10.10.255.6 SYD-Core-01 IBM10.10.255.5 WAS-Core-01 IBM10.10.255.15 BRU-PE-01 IBM10.10.255.13 BRU-NAS-01 IBM10.10.255.14 BRU-NAS-02 IBM10.10.255.16 BRU-PE-02 IBM10.10.255.17 BRU-PE-03 IBM

## Secondary IPs 10.10.1.1 BRU-Core-01 IBM10.10.1.5 BRU-Core-01 IBM10.10.2.1 BRU-Core-01 IBM10.191.101.125 BRU-Core-01 IBM10.10.1.2 MOS-Core-01 IBM10.10.1.26 MOS-Core-01 IBM10.10.1.6 PAR-Core-01 IBM10.10.1.9 PAR-Core-01 IBM10.10.1.10 LON-Core-01 IBM10.10.1.13 LON-Core-01 IBM10.10.2.5 BRU-SW-01 IBM10.10.2.2 BRU-SW-01 IBM10.10.2.9 BRU-SW-01 IBM10.10.2.6 BRU-CPE-01 IBM10.10.2.14 BRU-CPE-01 IBM10.10.2.18 BRU-CPE-01 IBM10.10.2.22 BRU-CPE-01 IBM10.10.1.14 NYC-Core-01 IBM10.10.1.17 NYC-Core-01 IBM10.10.2.29 BRU-ACS-01 IBM10.10.2.10 BRU-ACS-01 IBM



V11.2

EXemp


ty10.10.2.25 BRU-ACS-01 IBM10.10.1.22 SYD-Core-01 IBM10.10.1.25 SYD-Core-01 IBM10.10.1.18 WAS-Core-01 IBM10.10.1.21 WAS-Core-01 IBM10.10.2.13 BRU-PE-01 IBM10.10.2.26 BRU-NAS-01 IBM10.10.2.30 BRU-NAS-02 IBM10.10.2.17 BRU-PE-02 IBM10.10.2.21 BRU-PE-03 IBM

Note

After you run the preceding command, the output indicates a message Seed file complete. However, that message has text that directs you to make sure that the DiscoFileFinderParseRules.NOI_AGG_P.cfg file has a special insert into it. You do not need to follow this instruction. In the following steps, you change the discovery configuration in the GUI, which does this step for you.



V11.2

EXemp


ty__ 4. Configure discovery to use the new seed file. In the discovery configuration GUI, click the

Seed tab.

__ a. Check the box to Use File Finder in Discovery.

__ b. Click the /etc/hosts file name and change it to the following path (see the Important note about the Delimiter field):

/opt/IBM/tivoli/netcool/etc/precision/seedfile.txt



V11.2

EXemp


ty

Important

If you clicked the /etc/hosts link and are changing only the file name, you already specified the correct delimiter characters. If you configure a server to use more than one host file, remember that host files are often inconsistent in the delimiters between the name and IP address. Sometimes people who are editing the file add extra spaces to make the columns align. By specifying a delimiter of one or more tabs or spaces, these files tend to parse without problems. To make this specification, you set the delimiter to a tab and a space that is contained within square brackets followed by a + (plus) sign. However, using a graphical browser makes it impossible to press the Tab key to paste a tab character into the delimiter window. For that reason, open a word processor and type a single tab followed by a single space. Then, copy both of these characters and paste into this delimiter field between the square brackets. Add a plus sign after the right square bracket. In this exercise, you are editing an existing definition; so the delimiter is already correct.

__ c. Click OK. You now see the new file name in the Seed tab.

__ 5. Remove the seeds from the ping finder list.

__ a. Click the icon to select all the entries.

__ b. Click the icon to delete the entries.

__ c. Make sure to leave the Use Ping Finder in Discovery check box selected.



V11.2

EXemp


ty__ 6. Save your discovery configuration.

__ 7. Go to the discovery status window and run another full discovery.



V11.2

EXemp


ty__ 8. View the difference in discovery times in the Active Discovery Status window. The current

discovery takes less time than the previous discovery.

Note

In a production environment with a large network discovery, the reduction in discovery time by using the file finder is significant. However, in this lab exercise, you might see little or no discovery time improvement because the simulated network is so small. The small size of the simulated network is because you have a small network, and the virtual machines that are used in the training environment are sharing processor time with other student sessions.

Summary


• Configure a discovery

• Reduce finding time



Unit 4. Advanced discovery options

This unit consists of gathering discovery data from a collector.

This exercise shows you how to configure the comma-separated value (CSV) file collector. Tivoli Network Manager uses this collector to import topology information from the CSV file and then represents those devices in the GUI.

Read each step thoroughly, including any hints or notes before completing the actions in that step.

__ 1. Make sure that you run the command to properly set environment variables:


Important

Make sure to put a space after the period (.) at the beginning of the preceding command. The ncp_df_collector process relies on library files.

__ 2. To ensure reliable operation of the collector, set the LD_LIBRARY_PATH variable with the following command as one continuous entry:

export LD_LIBRARY_PATH=$NCHOME/platform/linux2x86/lib:$ITNMHOME/platform/linux2x86/lib:$LD_LIBRARY_PATH

Note

In the bash shell, you can type the first few letters of a file or directory name or environment name and press the TAB key. The shell supplies the next few letters or the rest of the word for you. For example, you can type cd $ITN and press the Tab key. If your environment variables are properly set, the system finishes typing cd $ITNMHOME for you. Use this technique when you are typing long commands and file paths to reduce keystrokes.



V11.2

EXemp


ty

Hint

Set the value for LD_LIBRARY_PATH in either the /etc/profile or the $NCHOME/env.sh file to ensure that it is set consistently.

__ 3. Make a domain-specific backup copy of the DiscoCollectorFinderSeeds.cfg file.

cd $NCHOME/etc/precisioncp DiscoCollectorFinderSeeds.cfg DiscoCollectorFinderSeeds.NOI_AGG_P.cfg

__ 4. Edit and save the $NCHOME/etc/precision/DiscoCollectorFinderSeeds.NOI_AGG_P.cfg file and make sure to specify port 8081.

__ a. Locate the following text:

//insert into collectorFinder.collectorRules//( // m_Port//) //values//( // 8081//)

__ b. Remove the backslash characters to designate port 8081.

insert into collectorFinder.collectorRules( m_Port )values(8081);

Hint

If you are using vi to edit this file, you can quickly remove the comment lines with these steps: 1) Press the ESC key followed by the colon (:) key. 2) Enter the following keystrokes and press Enter to remove the two forward slashes from the beginning of lines 19 – 26: 19,26s/\/\//



V11.2

EXemp


ty__ 5. Change to the $ITNMHOME/collectors/perlCollectors/GenericCsv directory.

cd $ITNMHOME/collectors/perlCollectors/GenericCsv

__ 6. Copy the GenericCsvCollector.cfg file to a file called itnmClassCsvCollector.cfg.

cp GenericCsvCollector.cfg itnmClassCsvCollector.cfg

__ 7. Use vi or gedit to edit itnmClassCsvCollector.cfg.

__ a. Locate the following text:

( General => { Debug => 0, Listen => 8081, },DataSource => { CsvCfg => 'exampleCsv.cfg',SourceInfo => { Id => 1, Descr => 'Primary Data Source', # EmsHost => '', # EmsName => '', # EmsVersion => '', # EmsIdentifier => '', # EmsRole => '', # EmsStatus => '', },DataAcquisition => { GetEntities => 1, GetGenericEntities => 1, GetLayer2Vpns => 1, GetLayer3Vpns => 1, GetLayer1Connections => 1, GetLayer2Connections => 1, GetLayer3Connections => 1, GetMplsInterfaces => 1 } }



V11.2

EXemp


ty__ b. In the SourceInfo section of the file, remove all number or hash (#) characters except

the ones that are used to comment out the Entity Management System (EMS) section.

1) Locate this section:

SourceInfo => { Id => 1, Descr => 'Primary Data Source', # EmsHost => '', # EmsName => '', # EmsVersion => '', # EmsIdentifier => '', # EmsRole => '', # EmsStatus => '', },

2) Change it to look like this example:

SourceInfo => { Id => 1, Descr => 'Primary Data Source', EmsHost => '', EmsName => '', EmsVersion => '', EmsIdentifier => '', EmsRole => '', EmsStatus => '', },

Hint

In vi, press Esc followed by a colon and enter the following keystrokes to uncomment the SourceInfo section: 103,108s/#//

__ 8. Open $ITNMHOME/collectors/perlCollectors/GenericCsv/exampleCsv.cfg with an editor.



V11.2

EXemp


tyLook for the delimeter section of the file. (It is spelled as shown.) Make sure that the delimiter character for MainEntityData is a pipe symbol: '|' (most of the example CSV files use ',' as the column delimeter).

# as the MainEntityData contains sysDescr values that commonly # have embedded ',' we will use an alternative delimeter '|' for this data. # delimeter => { MainEntityData => '|', InterfaceData => ',', EntityData => ',', GenericEntityData => ',', L3ConnectivityData => ',', L2ConnectivityData => ',', L1ConnectivityData => ',', MicrowaveConnectivityData => ',', L3VpnData => ',', L3VpnInterfaceData => ',', L3VpnRTData => ',', L2VpnData => ',', MplsInterfaceData => ',', })

Note

Your exampleCsv.cfg file has the correct delimiter already set. However, if you are using a CSV file in your production environment, change the delimiter in the configuration file to match the input file that you are using.



V11.2

EXemp


ty__ 9. In the Network Discovery Configuration GUI, select the Full Discovery Agents tab.

__ 10. Select the Collector Discovery and Entity agents.



V11.2

EXemp


ty__ 11. On the Scope tab, modify your discovery scope to add the 10.1.0.0/16 subnet to your

discovery. Make sure that you do not check the Add to Ping Seed List option. Click OK.

__ 12. On the Advanced Discovery Configuration tab, select the two options for enabling inference of devices.



V11.2

EXemp


ty

Note

The option Enable Inference of Dumb Hubs is deprecated even though the option remains in the GUI.

__ 13. Save your discovery configuration.

__ 14. From the Discovery Status GUI, stop discovery completely. Click OK to accept to confirm stopping discovery.

__ 15. Start the collector script and send output to a log file for troubleshooting purposes.

cd $ITNMHOME/collectors/perlCollectors/GenericCsvncp_perl ./main.pl -cfg itnmClassCsvCollector.cfg &



V11.2

EXemp


ty__ 16. Verify that the collector starts properly. Make sure that you see a response similar to the

following example. It contains starting, load, and listening messages.

[netcool@host1 GenericCsv]$ ncp_perl ./main.pl -cfg itnmClassCsvCollector.cfg &[1] 29611[netcool@host1 GenericCsv]$ Starting collector...GenericCsv LoadDeviceList() @ 1477453277GenericCsv LoadInterfaceList() @ 1477453277GenericCsv LoadEntityList() @ 1477453277GenericCsv LoadGenericEntityList() @ 1477453277GenericCsv LoadLayer3Vpns() @ 1477453277GenericCsv LoadLayer2Vpns() @ 1477453277GenericCsv LoadMplsInterfaces() @ 1477453277GenericCsv LoadConnections() - Layer1 @ 1477453277GenericCsv LoadConnections() - Microwave @ 1477453277GenericCsv LoadConnections() - Layer2 @ 1477453277GenericCsv LoadConnections() - Layer3 @ 1477453277Listening for Precision calls...

__ 17. Start a new full discovery from the Discovery Status GUI.



V11.2

EXemp


ty__ 18. In the Network Discovery Status tab, select Agents Status.

__ a. During active discovery, the status display indicates how many devices are in the queue of the selected collector agents. If collector agents never show any devices in their queues, the collector finder is not running properly.



V11.2

EXemp


ty__ 19. After discovery completes, complete the following steps:

__ a. Open a Network Hop View.

__ b. Enter DeviceA in the Seed Device box. Select a Layer 2 view with 1 Hops in each direction. Click the green Play button.

DeviceA and DeviceB were discovered with a collector that read a comma-separated value (CSV) file. Tivoli Network Manager can also authenticate to a number of element managers and read device data directly from them.



V11.2

EXemp


ty__ c. Double-click the DeviceA chassis icon to view its Device Structure browser details in a

separate tab. (If the tab does not launch, make sure that your browser allows pop-up windows for the localhost.)

Summary

In this exercise, you learned how to configure the comma-separated value file collector.



Unit 5. Topology visualization basics

Task 1 Preparing for the lab

Make sure that the NOI14-ITNM42 and GNSTN325 (or GNS3) Dashboard Application Services Hub simulator virtual machines are running. During these exercises, you stop certain network devices in the simulator so that you can see what happens when a network failure occurs.

Task 2 Configuring an event filter

__ 1. If you do not still have the Firefox web browser open from the exercises of the previous unit, start the Firefox web browser inside the NOI14-ITNM42 virtual machine. Click Applications > Internet > Firefox Web Browser or the Firefox icon at the top of the desktop.

__ 2. Log on to the Dashboard Application Services Hub interface unless it is already running in your browser.

__ a. Go to the following location:

https://localhost:16311/ibm/console

__ b. Log on with a user name of itnmadmin with a password of object00.

__ 3. Create an event filter to show events that from the Tivoli Network Manager poller (Class=8000).

__ a. Click Administration icon > Event Management Tools > Filters to access display filters.



V11.2

EXemp


ty

Hint

Sometimes a Tivoli Network Manager menu option does not work because the browser is blocking pop-up windows. If you see a message that indicates that your browser is blocking a pop-up window, select the option to always allow pop-up windows for localhost.

__ b. Click OK or Run to enable the Java applications to run when you are prompted with messages similar to the two following examples.



V11.2

EXemp


ty__ c. Select Global Filters from the Category menu.

__ d. Click the icon to create a new filter.



V11.2

EXemp


ty__ e. Select the public global group to enable that group to use this filter. Click OK.



V11.2

EXemp


ty__ f. Enter ITNM_Events as the name of the filter. Enter a description for the filter. Select the

Data Sources drop-down arrow and ensure that both are selected.

__ g. Set a basic filter of Class = 8000. This class number is assigned to all events from the IBM Tivoli Network Manager poller.



V11.2

EXemp


ty__ h. Click Save.

Your new filter is listed in the list of the filters.

Important

Never put a space character in the filter name. The database interprets a space as a delimiter character. If you want to separate words in a filter name, use an underscore character or a hyphen.

__ i. Using the same method that you used to create the ITNM_Events filter, create a filter that is called RootCause. Define the filter to include events where NmosCauseType=1.



V11.2

EXemp


ty__ j. Using the same method that you used to create the ITNM_Events filter, create a filter

that is called Symptoms. Define the filter to include events where NmosCauseType=2.

__ k. Click Close. Close the Filters tab.

Task 3 Configuring an event view

__ 1. From the left menu in Dashboard Application Services Hub, select Administration > Event Management Tools > Views.

__ 2. Select Global Views in the pull-down menu.

__ 3. Click the icon to create a new view.



V11.2

EXemp


ty__ 4. Select the public global check box. Click OK.



V11.2

EXemp


ty

__ a. Create a view that is called ITNMEvents. Configure the view to show the following ObjectServer fields in the specified order.

○ Node with a column width of 18 ○ Tally with a column width of 10 ○ Summary with a column width of 45 ○ LastOccurrence with a column width of 15 ○ CauseType with a column width of 15

Hint

If you see a Serial [locked] field in the Event list view, highlight the field and clear the Lock column check box. Click the left arrow to delete that field from the view.

__ b. Click Save and close. Close the Views tab.



V11.2

EXemp


ty__ 5. Open the Event Viewer.

__ a. Select the ITNM_Events filter and the ITNMEvents view.

__ b. Display events with the Symptoms filter. You might not have any events yet.



V11.2

EXemp


ty__ c. Display events with the RootCause filter. You might not have any events here yet.

Task 4 Enabling default chassis and interface ping polls

__ 1. Click the Administration icon > Network > Network Polling from the menu.



V11.2

EXemp


ty__ 2. Under the Configure Poll Policies area, locate the links for Default Chassis Ping and

Default Interface Ping policies.

__ 3. Change the properties for these two policies by completing the following steps:

__ a. Click the link.

__ b. Set the polling interval to 30 seconds.

__ c. Select the Poll Enabled check box.



V11.2

EXemp


ty__ d. Click Save.

__ e. Click OK when you see the following question: Save changes to Monitor Config database?

__ f. After updating both policies, close the Network Polling tab.



V11.2

EXemp


ty

Note

The graphic shows an example of one policy: the Default Chassis Ping. However, the instructions also include modifying the Default Interface Ping. Make sure that you configure and enable both polling policies.



V11.2

EXemp


ty__ 4. In the GNSTN325 (or GNS3) virtual machine, right-click the BRUSW device icon and select

Stop from the menu.



V11.2

EXemp


ty__ 5. Open the Event Viewer.

__ a. Select the ITNM_Events filter and the ITNMEvents view.

__ 6. Run the following commands in a terminal window:

nco_sql -server NOI_AGG_P -user root -password object001> delete from alerts.status;2> go

Press Enter after each of the previous commands and observe the results similar to the following example:

(47 rows affected)



V11.2

EXemp


ty__ 7. Go back to the Event Viewer you just opened and wait for new events to show.

__ 8. Observe the new poll and ping failure events.

Task 5 Exploring topology views

Hint

If Dashboard Application Services Hub becomes unresponsive for a long time, stop and restart it with the following two commands:

/opt/IBM/JazzSM/profile/bin/stopServer.sh server1 –username smadmin –password object00

and

/opt/IBM/JazzSM/profile/bin/stopServer.sh server1.

Allow several minutes for Dashboard Application Services Hub to restart. Never start the Jazz Dashboard as the root user. Doing so causes log files to be owned by the root user, making it impossible for a non-root user to later start Jazz unless the root user deletes the log files first.

__ 1. Click an event for 10.10.255.10 in your event list to select it.



V11.2

EXemp


ty__ 2. Right-click the event and select Find In Hop View.



V11.2

EXemp


ty



V11.2

EXemp


ty__ 3. Wait for up to 1 full minute for this view to normalize. Observe the results. All but the core

device turns red to indicate a critical severity.



V11.2

EXemp


ty__ 4. Create an IP Filter network view that is called LabS2 by completing the following steps:

__ a. Select Network Views from the Jazz DASH menu incident icon.

Note

The map in the preceding step might open in a separate tab or window. Make sure to return to the window where you can select the preceding option.



V11.2

EXemp


ty__ b. Select the Libraries tab.

__ c. Select Global Views and click the icon to create a view.



V11.2

EXemp


tyd. Create an IP Filter view and put all 10.10.2.* hosts in this view.

1) Enter a name LabS2 on the General tab and select the IP Filter type.

2) Select the Filter tab.

3) Type 10.10.2 in the Address Patterns box and click Add.

4) Select Layer 2 connectivity.

5) Click OK.



V11.2

EXemp


ty

Hint

If you cannot see the Connectivity option, click and drag the lower-right corner of the window until you can see the option and the OK button.



V11.2

EXemp


ty__ e. Look at the network partition view that you created. The devices change to red within a

minute.

The appearance of your map depends on which layout button you select.



V11.2

EXemp


ty__ 5. Create a global network partition view that is called ITNMClass that contains all Class A, B,

and C subnets by completing the following steps:

__ a. Click the icon to create a new network partition view.

__ b. Enter a view name of ITNMClass.

__ c. Select as a view type Dynamic Views - Subnet and as a layout Hierarchical.

__ d. Click the Filter tab.



V11.2

EXemp


ty__ e. Select A, B & C for the Subnet Classes.

__ f. Select the view that you created.

__ g. Click the Copy or Move View icon.



V11.2

EXemp


ty__ h. Copy the view to itnmuser Views.

__ i. Switch to the itnmuser views. You can now see that you copied a view to a specific user without having to re-create the view for that user.



V11.2

EXemp


ty__ 6. Double-click a subnet from the network view tree.

__ 7. In the topology view, right-click a device that has a router or switch icon. Click the Show Device Structure menu item.



V11.2

EXemp


tySummary


• Configure an event filter

• Configure an event view

• Enable default chassis and interface ping polls

• Explore topology views



Unit 6. Advanced visualization

Task 1 Adding a device with the Topology Editor

At times, it can be necessary to add a device manually.

• Firewalls often block SNMP queries. In this case, it can be necessary to manually instantiate the firewall and the connections to accurately represent the network topology.

• A service provider provides connectivity between several sites. You do not have access permissions to interrogate the provider network. However, you can use the topology editor to instantiate a device to represent the service provider. This graphic representation helps your personnel understand the network topology.

__ 1. On the left menu, click Incident icon > Network Availability > Network Hop View.

__ 2. In the Seed Device box, type: LON-Core-01

__ 3. Enter a value of 1 hop and select Layer 2 connectivity.



V11.2

EXemp


ty__ 4. Click the green play arrow to show the hop view.

__ 5. Right-click the LON-Core-01 device in the hop view. Click Topology Management > Add Device.



V11.2

EXemp


ty__ 6. Create a router device manually to represent a router to which you do not have access.

Create the router device by completing the following steps:

__ a. Enter Lab5Device as the entityName and displayLabel of the entity you are creating.

__ b. Enter a description and a reason for adding the device.

__ c. Click Next.



V11.2

EXemp


ty__ d. Enter Chassis Details for the device. Click Next.

○ className = Cisco7xxx ○ sysName = Lab5-TN325.class.ibm.com ○ sysDescr = Cisco 7000 lab router ○ sysLocation = Dallas, building 3 ○ sysContact = Ima Geek, 555-1212 ○ Set ipForwarding to forwarding ○ serialNumber = 123456654321 ○ accessIPAddress = 10.10.2.233 ○ accessProtocol = IPv4

__ e. On the Confirm Details window, click Finish, unless corrections are necessary. A success message shows that you created a device.



V11.2

EXemp


tyTask 2 Adding a connection with the Topology Editor

Important

The Topology Editor is available only in the Hop view.

__ 1. In the Hop view, right-click the Lab5Device icon.

__ 2. Click Topology Management > Add Connection.



V11.2

EXemp


ty__ 3. In the Device Selection window, click Next.

__ 4. In the Entity Search window, complete the following steps:

__ a. Enter LON% in the Device Name box.

__ b. Click Find.

__ c. In the results window, click the LON-Core-01 device.

__ d. Click Select and Close. If you cannot see the Select and Close option, expand the window.

Hint

Some browsers do not properly size windows to show you all buttons when the window is opened. If you do not see a button in any of the exercises, drag the corner of the window down and to the right until you can see the appropriate button.



V11.2

EXemp


ty__ 5. In the Device Selection window, click Next.

__ 6. In the Connection Details box, complete the following steps:

__ a. Select an interface for each device.

__ b. Select Layer 2 conductivity.

__ c. Enter a speed of 10000000 bits per second.

__ d. Enter a reason for adding this manual connection.

__ e. Click Next.

Hint

If either of your devices has None as the only selection in the To Interface field, specify the Speed and Reason field values, and click Next. Only interfaces that are found during discovery are available in the To Interface box.



V11.2

EXemp


ty__ 7. In the Confirm Details window, click Finish. Wait for the success confirmation message.

__ 8. Confirm that the details for the connection you are adding are correct, and click Finish. The resulting topology view shows that you have a manually added device and a manually added connection.

Task 3 Exploring cross-domain network views

IBM Tivoli Network Manager IP Edition 4.2 discovers, monitors, and maps network devices that operate at Layers 2 and 3 of the open systems interconnection (OSI) model. It also isolates network communication faults between network devices. This network fault isolation reduces the mean time to repair (MTTR) network services in your organization.

In larger environments, it often becomes necessary to separate portions of the discovery into separate domains. A domain is a collection of Tivoli Network Manager processes. So if you are running two domains, then you would have two copies of the discovery process, two copies of the store process, and two copies of all of the other Tivoli Network Manager processes. Each set of processes stores its data in database files that are related to a particular domain.

Discovery and polling activities must sometimes be split into separate domains for a number of reasons. The IP address of a device is a key field in the database. For that reason, you cannot have two devices with duplicate IP addresses in the same database. However, if you are a managed service provider, it is not uncommon for you to serve two customers that have overlapping IP address ranges. Therefore, each customer needs to be in its own Tivoli Network Manager domain. Sometimes customers want to separate discoveries by geographic criteria. For example, a large corporation can discover its Chicago office in one domain and its Dallas office in another domain with servers that are local to each site.



V11.2

EXemp


tyIn some customer environments, business jurisdiction determines the allocation of discovery domains. For example, the group responsible for electronic payments does not want to see devices that are related only to inventory and shipping processes. In this case, devices that perform functions for separate areas of the business can be placed in separate domains.

Personnel who must maintain network and systems devices need to see all of the involved connectivity, even when devices are in separate domains. In Tivoli Network Manager 4.2, you can use a cross-domain network view to see devices from separate discovery domains in the same topology display. This view enables support personnel to more clearly understand the context of the network problem. It also extends the function of the root-cause analysis engine to be able to do cross-domain correlation and network fault isolation.

Tivoli Network Manager can use any of several types of information to build links between devices in separate domains:

• Information from /30 subnet: These subnets can have only two IP addresses so that Tivoli Network Manager can easily match the addresses on each end of a link.

• Pseudowire connections

• Border Gateway Protocol (BGP) session information

• Cisco Discovery Protocol (CDP)

• Multiprotocol Label Switching (MPLS) Traffic Engineering (TE) information

• Open Shortest Path First (OSPF) neighbor information

• Protocol Independent Multicast information

• Preset layer information (manually configured)

In this exercise, you add a second domain to the Tivoli Network Manager server. You then add a second domain and configure a separate set of processes for that domain. After running a discovery in each domain, you can see devices from both domains in a single network or hop view. While the simulated networks are small, this same methodology can be used to tie together large networks in a consolidated view.

After you complete this exercise, you should be able to do the following tasks:

• Create a second domain

• Configure discovery for a second domain

• Enable cross-domain linking

• Open a consolidated cross-domain network view

Important

Make sure that you set environment variables correctly at the beginning of each exercise. Use the following command to set environment variables:. /opt/IBM/tivoli/netcool/env.sh



V11.2

EXemp


tyTask 4 Removing previous discovery

To complete this exercise, you need to first delete data from the previous discoveries.


itnm_stop ncp

__ 2. Remove the DNCIM files that contain the information about the last discovery.

cd $ITNMHOME/embeddedDb/sqlite/ncp_disco.NOI_AGG_Prm -rf dncim.dbcd $NCHOME/var/precisionrm -rf *.NOI_AGG_P

__ 3. Restart Tivoli Network Manager.

itnm_start ncp

__ 4. Wait for all processes to start. Use the itnm_status command periodically until you see that all services are running.

Task 5 Configuring and running a new discovery

__ 1. Before you run a new discovery, make sure that all of the devices in the GNSTN325 virtual machine are running. If you stopped a device in a previous unit exercise, restart that device now.

__ a. If you are running full-screen, press Ctrl+Alt+Enter to return to a windowed view.

__ b. Click the GNSTN325 (or GNS3) tab.

__ c. Right-click the device that was stopped in the previous lab.

__ d. Click Start.



V11.2

EXemp


ty__ 2. If the web browser is not still open, start Firefox by selecting Applications > Internet >

Firefox Web Browser from the menu.

__ 3. Log on as the itnmadmin user with a password of object00.

__ 4. From the left menu, select Discovery > Network Discovery Configuration.



V11.2

EXemp


ty__ 5. Make sure that the domain window shows NOI_AGG_P.

__ 6. On the Network Discovery Configuration tab, make sure that only the following subnets are in the scope settings. Make sure that the Add to Ping Seed List box remains cleared for each of these subnets.

__ a. 127.0.0.0 / 24

__ b. 127.0.0.1 / 32

__ c. 10.10.0.0 / 16

__ d. 10.191.101.0 / 24

__ e. 10.1.0.0 / 24



V11.2

EXemp


ty

Hint

If you do not see that the scope list is updated after clicking OK, click the Refresh icon in the Firefox browser to refresh the screen. If the problem persists, stop and start Dashboard Application Services Hub with these commands:


/opt/IBM/JazzSM/profile/bin/startServer.sh server1

Log on again to the Dashboard Application Services Hub.

__ 7. From a terminal window, copy discovery seed files into the $NCHOME/etc/precision directory. Copy these files over any seed files that exist in the directory.

cd /home/netcool/Labfiles/ETC_Precisioncp seed* $NCHOME/etc/precision

__ 8. On the Seed tab, complete the following configuration steps:

__ a. Clear Use Ping Finder in Discovery.

__ b. Check Use File Finder in Discovery.

__ c. Click the file name hyperlink.



V11.2

EXemp


ty__ d. Change the Filename to /opt/IBM/tivoli/netcool/etc/precision/seedfile.txt.

Click OK.

__ 9. On the Passwords tab, verify that the 4IBM community string appears twice (as SNMP Version 2 and Version 1). The Version 2 string should show above the Version 1 string.



V11.2

EXemp


ty__ 10. On the Full Discovery Agents tab, select the Full Layer 2 and Layer 3 Discovery check

box.

__ 11. On the Advanced tab, select the following options:

__ a. Allow Multicast Pinging (to speed up discovery).

__ b. Enable SysName Naming (to get names from devices).

__ c. Enable ifName/ifDescr Interface Naming (to get interface names from devices).



V11.2

EXemp


ty__ d. Make sure that all of the Enable Inference options are cleared.


Select and clear these boxes to get thisconfiguration



V11.2

EXemp


ty__ 13. Select Network Discovery Status from the left menu.

__ 14. Click the green play arrow to start a full discovery or select the drop-down menu and the option Start Full Discovery.

Important

Discovery happens in three basic phases. First, finders locate devices either by reading a hosts file or by pinging a list of subnets or key devices. Then, agents interrogate devices with discovery protocols to determine which interfaces each device has and to which other devices it is connected. Finally, stitchers sew together the network map. First, the stitchers build a list of entities (EntityType 1 = chassis, EntityType 2= interface, EntityType 3 = logical interface). Then, containment relationships are identified, showing which entities are contained inside other entities, such as an interface contained within a chassis). Then, stitchers build a list of connections between devices. Because devices have many types of connections between them, each layer of connectivity is built separately. The final step of discovery merges all the layers of connectivity into a cohesive map, and this data is sent to the MODEL (ncp_model binary) service.



V11.2

EXemp


ty__ 15. Wait until discovery completes. The Status column shows check marks for each of the four

stages of discovery that is complete.

Task 6 Creating the second domain

Tivoli Network Manager stores information about discovered devices in a database. Before you can add a second domain your existing server, you must add the database tables and fields necessary to support that second domain. The easiest way to add a second domain is to clone an existing domain. This process duplicates only the data schema and structure; it does not duplicate data that is stored within the tables. The second domain name that is used in this exercise is NOI_AGG_P2.

__ 1. If you do not have a terminal window open yet, right-click the desktop of the NOI14-ITNM42 virtual machine and select Open Terminal.

__ 2. Change to the $NCHOME/etc/precision directory where Tivoli Network Manager configuration files are located.

__ 3. Make a copy of the ConfigItnm.NOI_AGG_P.cfg file that was created during software installation to a domain-specific copy for a second domain.

cp ConfigItnm.NOI_AGG_P.cfg ConfigItnm.NOI_AGG_P2.cfg

__ 4. Make a copy of the DbLogins.NOI_AGG_P.cfg file that was created during software installation to a domain-specific copy for a second domain.

cp DbLogins.NOI_AGG_P.cfg DbLogins.NOI_AGG_P2.cfg



V11.2

EXemp


ty

Note

The DbLogins.cfg file is a template and does not contain accurate login information for any of the databases. If adding a second database, always copy the domain-specific file (such as DbLogins.NOI_AGG_P.cfg) to a second file that contains the name of the second domain (such as DbLogins.NOI_AGG_P2.cfg).

__ 5. Stop Tivoli Network Manager with the itnm_stop ncp command. Enter the password object00 if prompted to do so. Use the itnm_status command to verify that processes stop.

itnm_stop ncpStopping Network Manager domain NOI_AGG_P

Hint

By using the itnm_stop ncp command, you stop only the Tivoli Network Manager processes. If you used the itnm_stop command, it also stopped the OMNIbus processes and Dashboard Application Services Hub. Shut down or restart only those processes that you need to implement necessary changes.

itnm_status

[netcool@host1 precision]$ itnm_statusNetwork Manager:

ncp_ctrl NOT RUNNINGApache Storm:

supervisord RUNNING PID=15562 storm_nimbus RUNNING PID=15565 storm_supervisor RUNNING PID=15566 zookeeper RUNNING PID=15564

Storm topologies:NMStormTopology ACTIVE



V11.2

EXemp


ty

Important

Dashboard Application Services Hub uses the Network Connectivity and Inventory Model (NCIM) database. When new domains are added to that database, Dashboard Application Services Hub is not aware of all the changes to the database. By stopping and restarting Dashboard Application Services Hub, it is forced to read the entire database and then becomes aware of new information. This stopping and restarting prevents a problem with a discovery that completes in one domain but stalls in another domain.

__ 6. As the netcool user, run the domain_create.pl script to create the NOI_AGG_P2 domain as a clone of the existing NOI_AGG_P domain.

cd $ITNMHOME/scripts/perl/scripts

ncp_perl domain_create.pl -domain NOI_AGG_P2 -clone NOI_AGG_P



V11.2

EXemp


ty

Important

The Network Connectivity and Inventory Model (NCIM) database is where topology data is stored. The topology visualization component of Dashboard Application Services Hub accesses the data. NCIM is the name of the schema inside the ITNM database. Login information for all Tivoli Network Manager databases is contained in the DbLogins.primaryDomainName.cfg file. Creating domain-specific copies of this file and others makes it possible to use different databases or database servers to store polling and topology information separately for each domain.

__ 7. Enable cross-domain linking before doing a discovery.

__ a. Change to the $NCHOME/etc/precision directory.

cd $NCHOME/etc/precision

__ b. Use vi or gedit to edit the DiscoConfig.NOI_AGG_P.cfg file.

vi DiscoConfig.NOI_AGG_P.cfg

OR

gedit DiscoConfig.NOI_AGG_P.cfg



V11.2

EXemp


ty

Note

The vi editor is a text-only editor for students who are familiar with Linux. The gedit editor is a graphical editor similar to Windows Notepad.

__ c. Locate the line that sets the value of m_EnableCrossDomainProcessing. By default, it is set to 0 (cross-domain linking is turned off). If you are using gedit, you can click Find to search for this property. If you are using the vi editor, press Esc and a forward slash (/), and type the characters for which you want to search.

__ d. Change the value from 0 to 1.

Hint

The INSERT statement in DiscoConfig.domainName.cfg contains a list of field names followed by the corresponding values that are inserted into the fields. Make sure that you change the correct integer to insert a value into the m_EnableCrossDomainProcessing field.



V11.2

EXemp


ty__ e. Save and close the file.

__ f. Copy the file that you edited to domain-specific files.

cp DiscoConfig.NOI_AGG_P.cfg DiscoConfig.NOI_AGG_P2.cfg

Important

As part of discovery, cross-domain links are created. After discovery completes, the topology is updated. Aggregation domain stitching runs each time that the topology is updated.

__ 8. Start Tivoli Network Manager for each domain. Use the ncp option since the ObjectServer and Dashboard Application Services Hub are still running.

itnm_start ncp -domain NOI_AGG_Pitnm_start ncp -domain NOI_AGG_P2



V11.2

EXemp


ty__ 9. Use the itnm_status command several times until you can see that the processes are

running for both domains. It can take several minutes for all processes to start.

itnm_status

[netcool@host1 precision]$ itnm_statusNetwork Manager: Domain: NOI_AGG_P ncp_ctrl RUNNING PID=15180 NOI_AGG_P ncp_store RUNNING PID=15398 NOI_AGG_P ncp_class RUNNING PID=15399 NOI_AGG_P ncp_model RUNNING PID=15845 NOI_AGG_P ncp_disco RUNNING PID=15906 NOI_AGG_P ncp_d_helpserv RUNNING PID=15400 NOI_AGG_P ncp_config RUNNING PID=15401 NOI_AGG_P ncp_poller_default RUNNING PID=16839 NOI_AGG_P ncp_poller_admin RUNNING PID=16840 NOI_AGG_P nco_p_ncpmonitor RUNNING PID=15402 NOI_AGG_P ncp_g_event RUNNING PID=16225 NOI_AGG_P ncp_webtool RUNNING PID=15403 NOI_AGG_P ncp_virtualdomain RUNNING PID=17402 NOI_AGG_P Domain: NOI_AGG_P2 ncp_ctrl RUNNING PID=16058 NOI_AGG_P2 ncp_store RUNNING PID=16456 NOI_AGG_P2 ncp_class RUNNING PID=16457 NOI_AGG_P2 ncp_model RUNNING PID=17372 NOI_AGG_P2 ncp_disco RUNNING PID=17473 NOI_AGG_P2 ncp_d_helpserv RUNNING PID=16458 NOI_AGG_P2 ncp_config RUNNING PID=16459 NOI_AGG_P2 ncp_poller_default RUNNING PID=17861 NOI_AGG_P2 ncp_poller_admin RUNNING PID=17862 NOI_AGG_P2 nco_p_ncpmonitor RUNNING PID=16460 NOI_AGG_P2 ncp_g_event RUNNING PID=17606 NOI_AGG_P2 ncp_webtool RUNNING PID=16461 NOI_AGG_P2 ncp_virtualdomain RUNNING PID=18347 NOI_AGG_P2 Apache Storm: supervisord RUNNING PID=15562 storm_nimbus RUNNING PID=15565 storm_supervisor RUNNING PID=15566 zookeeper RUNNING PID=15564 Storm topologies: NMStormTopology ACTIVE



V11.2

EXemp


tyTask 7 Configuring and running a discovery in the second

domain

Important

Before proceeding, you must log out of the Jazz DASH portal, restart the Firefox browser, and log back in.

Configure a discovery for the second domain (NOI_AGG_P2). Make sure that in each step, the NOI_AGG_P2 domain is selected. Because you are configuring another discovery, many of the steps are identical to the preceding exercise. However, this discovery uses a different seed file.


__ 2. Log on as the itnmadmin user with a password of object00.



V11.2

EXemp


ty__ 3. From the left menu, select Discovery > Network Discovery Configuration.

__ 4. In Network Discovery Configuration, select the NOI_AGG_P2 domain.

__ 5. In the Scope tab, add or delete subnet entries so that you have only four entries: 127.0.0.0/24, 127.0.0.1/32, 10.191.101.0/24, and 10.10.0.0/16.



V11.2

EXemp


ty

Hint

The discovery configuration for the NOI_AGG_P2 domain is identical to the NOI_AGG_P domain except that it uses a different seed file. Many of these configuration steps might already be done as a result of your cloning the NOI_AGG_P domain. Verify that the specified configuration is complete, and if not, implement the configuration step.

__ 6. If you do not see this entry already in the Scope Properties box, set the scope to 10.10.0.0/16. Do not check the Add to Ping Seed List box. Click OK.

__ 7. If the 10.191.101/24 subnet is missing, repeat the preceding two steps as necessary to add it. Make sure that the Add to Ping Seed List option is cleared for each 10.x.x.x subnet.

__ 8. On the Seed tab, complete the following configuration steps:

__ a. Clear Use Ping Finder in Discovery.

__ b. Check Use File Finder in Discovery.

__ c. Click the Filename hyperlink.



V11.2

EXemp


ty__ d. Change the Filename to /opt/IBM/tivoli/netcool/etc/precision/seedfile2.txt.

Click OK.

__ 9. On the Passwords tab, verify that the 4IBM community string shows twice (as SNMP Version 2 and Version 1).

__ 10. On the Full Discovery Agents tab, select the Full Layer 2 and Layer 3 Discovery check box.

__ 11. On the Advanced tab, in the NOI_AGG_P2 domain, select the following options:

__ a. Allow Broadcast Pinging.



V11.2

EXemp


ty__ b. Allow Multicast Pinging (to speed up discovery).

__ c. Enable VLAN Modeling.

__ d. Enable SysName Naming (to get names from devices).

__ e. Enable Rediscovery Rebuild Layers.

__ f. Enable Rediscovery of Related Devices.

__ g. Enable ifName/ifDescr Interface Naming (to get interface names from devices).

__ h. Make sure that all of the Enable Inference options are cleared.


Select and clear these boxes to get thisconfiguration



V11.2

EXemp


ty__ 13. Select Network Discovery Status from the left menu.

__ 14. Click the green play arrow to start a full discovery, or select the drop-down menu and the option Start Full Discovery. Make sure that the NOI_AGG_P2 domain is selected.



V11.2

EXemp


ty

Important

Discovery happens in three basic phases. First, finders locate devices either by reading a hosts file or by pinging a list of subnets or key devices. Then, agents interrogate devices with discovery protocols to determine what interfaces each device has and to what other devices it is connected. Finally, stitchers sew together the network map. First, the stitchers build a list of entities (EntityType 1 = chassis, EntityType 2= interface, EntityType 3 = logical interface). Containment relationships are identified, showing which entities are contained inside of other entities, such as an interface contained within a chassis). Stitchers then build a list of connections between devices. Because devices have many types of connections between them, each layer of connectivity is built separately. The final step of discovery merges all the layers of connectivity into a cohesive map, and this data is sent to the MODEL (ncp_model binary) service.

__ 15. Wait until discovery completes. The Status column shows check marks for each of the four stages of discovery that is complete.



V11.2

EXemp


tyTask 8 Creating AGGREGATION network view

__ 1. Select Availability > Network Availability > Network Views.

__ 2. Click the Libraries tab. From the libraries tab, select itnmadmin Views > NOI_AGG_P > All routers.



V11.2

EXemp


ty

This map shows all the routers in the NOI_AGG_P domain.

Note

The All Routers view for the NOI_AGG_P domain shows the manually added Lab5Device icon. Earlier, you created a link between that device and the LON-Core-01 device. You do not see the link for the Lab5Device in the NOI_AGG_P domain All Routers view because the LON-Core-01 device to which it is connected is not in this domain.




V11.2

EXemp


ty__ 4. Enter the name NOI_AGG_P and select Dynamic Views - Template as the type.



V11.2

EXemp


ty__ 5. Click the Filter tab. Select the NOI_AGG_P domain and the IP Default template, and click

OK.



V11.2

EXemp


ty__ 6. From the network view tree, select NOI_AGG_P2 > All Routers.




V11.2

EXemp


ty__ 8. Enter the name AGGREGATION_VIEW and select Dynamic Views - Template as the type.



V11.2

EXemp


ty__ 9. Click the Filter tab. Select the AGGREGATION domain and the IP Default template. Click

OK.

__ 10. Select AGGREGATION_VIEW > All Routers from the network view tree.



V11.2

EXemp


ty

The resulting view contains devices from both domains. Tivoli Network Manager used information about the /30 subnets to build the links between the domains.

__ 11. Normalize the environment for the next exercises. Run the following command to stop the second domain:

itnm_stop -domaiin NOI_AGG_P2



V11.2

EXemp


ty__ 12. Go to the Network Discovery Configuration. Select the NOI_AGG_P domain and select the

Scope tab. Adjust and enter the following scopes to match the following screen capture:

# Address Netmask

1 127.0.0.0 24

2 127.0.0.1 32

3 10.10.1.0 24

4 10.10.2.0 24

5 10.191.101.0 24

6 10.10.255.0 24

7 10.1.0.0 24

8 10.1.1.0 24



V11.2

EXemp


ty__ 13. On the Seed tab, adjust the configuration to not use the file finder.

__ 14. Go to Network Discovery Status and run a full discovery on the NOI_AGG_P domain.

Summary

In this exercise, you added a second domain. You then ran discoveries in each domain and saw the topology of each domain. You then viewed both domains together in an aggregated domain view that you created. This aggregated domain view helps you to understand the network topology more easily when you must discover domains separately.





Unit 7. The Network Health Dashboard


Unit 8. Monitoring and polling network devices

Complete these exercises to familiarize yourself with the polling features of IBM Tivoli Network Manager 4.2.

Note

The value in the following exercise on real-time Management Information Base (MIB) graphing is completing the steps to configure a real-time MIB graph. However, because of the limitations of the network simulator, few SNMP MIBs are available for graphing. The graph that is populated in this exercise might resemble a flat line. Do not let this concern you.

Note

To monitor a MIB on a server, the SNMP daemon must be running on that server. SNMP is already enabled on the devices in the network simulator for this course. No action is required to start SNMP for these exercises. However, if you need to enable SNMP on Linux or UNIX devices in your environment, you can start the SNMP daemon with the following command, which the root user enters:service snmpd start



V11.2

EXemp


tyTask 1 Creating real-time MIB graphs

Note

If you already have the Tivoli Network Manager GUI on your screen, skip this step.

__ 1. Log on to the Tivoli Network Manager workstation.

__ 2. From a terminal window, source the environment variables.

__ 3. Make sure to source the Netcool environment variables unless you already did so. Source the Netcool variables by running the following command:


Hint

The preceding command contains a space character after the leading period.




V11.2

EXemp


ty__ 5. Log on as the itnmadmin user with a password of object00.



V11.2

EXemp


ty__ 6. From the left menu, click the Incident icon, Events, and Event Viewer.



V11.2

EXemp


ty__ 7. In a terminal window, run the following query to see a list of chassis entities in your network

discovery. If you enter the command correctly but see no results, run a new full discovery and run the query again.

ncp_oql -domain NOI_AGG_P -username ncim -password object00 -service DbId -dbId NCIM -query "select * from entityData where EntityType=1;"

If you have a discovered topology, Dashboard Application Services Hub displays entity records from the database. After the last record is a total number of records in the database. The number for the simulated network is small (less than 100).

Note

Previous versions of IBM Tivoli Network Manager IP Edition required the -username and -password parameters whenever you execute a ncp_oql query. These parameters are no longer necessary for the native Tivoli Network Manager databases, such as the discovery database. However, in the preceding command example, ncp_oql is accessing a DB2 database, and so authentication information is required. The ncim user has the appropriate rights to access the DB2 database, so the command authenticates as that user.



V11.2

EXemp


ty__ 8. Generate reachability failure events in the ObjectServer.

__ a. If the NOI14_ITNM42_2017 virtual machine is operating in full-screen, press Ctrl+Alt+Enter to return to a window view.

__ b. Select the GNSTN325 (or GNS3) tab.

__ c. In the network map, right-click the BRUACS device. Select Stop from the device menu.



V11.2

EXemp


ty__ d. Wait a few moments and look at the Event Viewer list inside the Red Hat Enterprise

Linux 5 64-bit NOI_TN325 virtual machine. Observe that the failure events indicate a loss of connectivity in the network.

__ 9. From the Jazz DASH Portal menu on the left side of the browser window, select Incident icon, Network Availability, and Fault-Finding View. Wait until the view is loaded.



V11.2

EXemp


ty__ 10. In the top Event Viewer window, select the red Default Chassis Ping Fail for the 10.1.1.20

device. The corresponding device shows in the Network Hop View window in the bottom frame.

Right-click that event and select Find in Hop View.

Hint

You can right-click an event in any event list and select Find in Hop View or Find in Network View to see the topology representation. If no device icon is displayed, it means that the event is from a device that is not in the discovered topology.



V11.2

EXemp


ty__ 11. After the Hop View window opens, change the Hops value to 1 and select Layer 1

connectivity. Click the green play arrow to refresh the display.

__ 12. Restore the broken connectivity.

__ a. On the GNSTN325 (or GNS3) tab, right-click the BRUACS icon.

__ b. Select Start from the menu.



V11.2

EXemp


tyThe device links return to a green status.

__ 13. Close the Fault-Finding View tab.

__ 14. Open the Network Hop View from the left menu (click Incident icon > Network Availability > Network Hop View). Enter BRU-Core-01 into the Seed Device box. Change Hops to 1 and select Layer 2 connectivity. Click the green play arrow to view the device and its neighbors.



V11.2

EXemp


ty

Hint

You can view the Structure browser frame on the bottom of the screen. By selecting a device, you can switch the Device Structure browser information.

p

__ 15. Right-click the BRU-Core-01 device and select Polling and MIB Info > Graph SNMP MIB Data.



V11.2

EXemp


ty__ 16. In the new window that was started in the preceding step, click the Configure icon in the

lower-left corner.

__ 17. Set variables to be polled by completing the following steps:

__ a. If the existing variable is snmpInBandwidth, delete that variable by selecting it and clicking the Delete icon. The Delete icon is a red X.

__ b. Click the icon to add a poll definition.

__ c. With MIB OID selected, enter the OID number of 1.3.6.1.2.1.11.15 and click OK.

The results put snmpInGetRequests in the Poll data window.

__ d. Click the icon again to add a poll definition.



V11.2

EXemp


ty__ e. With MIB OID selected, enter the OID number of 1.3.6.1.2.1.11.1 and click OK. The

results put snmpInPkts in the Poll data window.

__ f. Add a second polling definition for sysUpTime.LIST

__ g. Set the polling interval to 20 seconds. Under the Additional Preferences drop-down list, you can change the graph’s refresh rate down to 15 seconds and click Save.

Note

You can select the OID to monitor in two ways:

• You can enter the OID value manually in the MIB OID field.

• You can click the Browse window to select a value from the MIB tree GUI.



V11.2

EXemp


ty__ 18. On the Discovery Status tab, start a new full discovery for the domain that contains this

device. The discovery causes SNMP traffic to go to the device. As the discovery process interrogates this device, the graph populates with data. Because of the limitations of the training environment, the graph resembles a flat line. On one y axis, you see the number of snmpInGetRequests. On a second y axis, you see the number of snmpInPkts. Because the discovery is brief, that graph does not change much.

Note

The reason that you are running a discovery in the preceding step is to send some SNMP requests to the simulated network devices. As devices receive SNMP get requests, new data populates the MIB graph that you created.



V11.2

EXemp


tyTask 2 Troubleshooting tools for real-time graphing

(optional task)

Note

This optional exercise acquaints you with methods of troubleshooting real-time graphing.

__ 1. Use an Object Query Language (OQL) query to verify which real-time polls are enabled. This type of query can be useful as a troubleshooting aid if you cannot get real-time MIB graphing to work.

ncp_oql -domain NOI_AGG_P-service realtimepolls -updates -snoop

After the real-time polling begins, you see output that looks like the following example:

ncp_oql -domain NOI_AGG_P-service realtimepolls -updates -snoopncp_oql (IBM Tivoli Network Manager OQL Interface)Copyright (C) 1997 - 2010 By IBM Corporation. All Rights Reserved. See product license for details.

IBM Tivoli Network Manager Version 4.2 (Build 32) created by ncpbuild at 04:09:53 Wed Feb 9 GMT 2011Using no authenticationListening for updates on RealTimePolls services|localhost:1Update -->{

DOMAIN_NAME='NOI_AGG_P'; POLICY_NAME='RTGraph - 172.31.1.17 - snmpInBandwidthsnmpInGetRequests'; POLICY_ID=61; IP_ADDRESS='172.31.1.17'; MAIN_NODE_ENTITY_ID=17206; HOSTNAME='group-1-r2.class.example.org'; MONITORED_INSTANCE_ID=188; INSTANCE_NAME=NULL; INSTANCE_ID=NULL; IFNAME=NULL; IFALIAS=NULL; IFTYPE=NULL; POLLDEF_NAME='RTGraph - snmpInGetRequests'; POLDEF_ID=53; MONITORED_OBJECT_ID=25; DATA_LABEL='RTGraph - snmpInGetRequests';



V11.2

EXemp


ty OID='1.3.6.1.2.1.11.15'; REALTIME='true'; SAMPLE_ID=1326136862;

POLL_TIME=1120109192102000; ERROR_CODE=100; VALUE=12057;}

__ 2. View trace information for real-time polling. This information can be useful for diagnostic purposes.

cd /opt/IBM/netcool/gui/precision_gui/profile/logs/tnm/tail -f ncp_mib.0.trace

[2012-01-09T19:19:18.047] [Thread-3970] com.micromuse.precision.monitorconfiguration.da.MonitorConfigDAOImpl.deleteRows INFO: HNMPA0024I=Deleted rows from database [60] of type 4[2012-01-09T19:19:19.122] [WebContainer : 10] com.ibm.tivoli.mibgrapher.GraphConfigValidate.doGet INFO: Received action: initializeServlet[2012-01-09T19:19:19.123] [WebContainer: 10] com.ibm.tivoli.mibgrapher.GraphConfigValidate.doGet INFO: Got initializeServlet request[2012-01-09T19:19:19.127] [WebContainer: 10] MonitorConfigDAOImpl.getTemplateData FINE: Query to be processed is: SELECT templateId, templateName, templateType, monitorStatus, description, dataLabel FROM ncmonitor.template WHERE templateId=31[2012-01-09T19:19:19.193] [WebContainer: 10] com.micromuse.precision.monitorconfiguration.da.MonitorConfigDAOImpl.insertNewTemplate INFO: HNMPA0019I=Poll definition RTGraph - snmpInGetRequests added to the database[2012-01-09T19:19:19.194] [WebContainer: 10] com.ibm.tivoli.mibgrapher.GraphThread.createPolicy INFO: Using default poller[2012-01-09T19:19:19.217] [WebContainer: 10] com.micromuse.precision.monitorconfiguration.da.MonitorConfigDAOImpl.insertNewPolicy INFO: HNMPA0020I=Poll policy RTGraph - 172.31.1.17 - snmpInBandwidthsnmpInGetRequests added to the database with ID 61[2012-01-09T19:19:19.351] [WebContainer: 10] com.ibm.tivoli.mibgrapher.GraphConfigValidate.initializeServlet INFO: done[2012-01-09T19:19:19.356] [WebContainer: 21] com.ibm.tivoli.mibgrapher.GraphConfigValidate.doGet INFO: Received action: fetchLabelImage[2012-01-09T19:19:19.360] [WebContainer: 21] com



V11.2

EXemp


ty__ 3. View the log file for real-time polling:

cd /opt/IBM/netcool/gui/precision_gui/profile/logs/tnm/

tail -f ncp_mib.0.log

[2012-01-09T19:19:17]:INFO:HNMPA0024I:[Thread-3970]:Deleted rows from database [52] of type 0[2012-01-09T19:19:18]:INFO:HNMPA0024I:[Thread-3970]:Deleted rows from database [60] of type 4[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 10]:Received action: initializeServlet[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 10]:Got initializeServlet request[2012-01-09T19:19:19]:INFO:HNMPA0019I:[WebContainer: 10]:Poll definition RTGraph - snmpInGetRequests added to the database[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 10]:Using default poller[2012-01-09T19:19:19]:INFO:HNMPA0020I:[WebContainer: 10]:Poll policy RTGraph - 172.31.1.17 - snmpInBandwidthsnmpInGetRequests added to the database with ID 61[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 10]:done[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 21]:Received action: fetchLabelImage[2012-01-09T19:19:19]:INFO:HNMTrace:[WebContainer: 21]:Received action: fetchLabelImage



V11.2

EXemp


tyTask 3 Creating a custom poll definition

Create a generic threshold poll definition, CustomSNMPLink, which generates an alarm when ifAdminStatus=1 and ifOperStatus=0. This poll definition detects a link problem on an interface that is enabled but nonoperational.

__ 1. Create the poll definition CustomSNMPLink by completing the following steps:

__ a. Select the Administration icon > Network > Network Polling from the Jazz DASH Portal menu.

__ b. Click the Add New icon in the top section of the polling window in the bottom half of your screen.



V11.2

EXemp


ty

Hint

Previous versions of Tivoli Network Manager labeled the top section for configuring poll policies and the bottom section for configuring poll definitions. To maximize screen space, those labels are no longer included in Tivoli Network Manager 4.2. Remember that the top section is for polling policies, which is why it contains an Enable column, because you enable policies and not definitions. The bottom section contains a list of polling definitions.

__ c. Select Generic Threshold as the poll type and click OK.

Important

A Basic Threshold poll is based on only one SNMP varbind. A Generic Threshold can use multiple SNMP varbinds and test for multiple conditions.



V11.2

EXemp


ty__ d. Assign a default severity of 4 to this event.

__ e. Assign a name of CustomLabPoll to the definition.

__ f. On the Trigger Threshold tab, specify the event threshold with a Boolean AND by selecting ALL in the GUI. The alarm triggers when ifAdminStatus=1 and ifOperStatus=0. This condition indicates an interface that was configured to be active but was not working at the moment. Also, specify an event description for the threshold violation that uses the interface description.

Interface problem on eval(text,'&SNMP.VALUE.ifDescr')



V11.2

EXemp


ty__ g. Specify a Clear Threshold that clears the event when the interface becomes

operational again (ifOperStatus=1). Also, specify a message to be sent to the ObjectServer.

Interface operational on eval(text,'&SNMP.VALUE.ifDescr')

__ h. Save the poll definition.

__ 2. Create a CustomAdvancedPoll definition.

__ a. Select the check box for the CustomLabPoll that you created in the previous step.

__ b. Click the Copy icon to create a copy of that poll.

__ c. Edit the new CustomLabPoll_1 poll definition by clicking its name in the list of poll definitions. Change the name to: CustomAdvancedPoll

__ d. Click the Trigger Threshold tab. Click Advanced.



V11.2

EXemp


tyUse an Advanced trigger threshold to generate an alarm when any of the following conditions are true:

○ The ifAdminStatus=1 and ifOperStatus< >1 and ifDescr not like ‘BRI’.

This setting generates an alarm if an enabled non-ISDN interface becomes nonoperational.

○ The ifAdminStatus=1, ifOperStatus=1, and ifDescr like ‘BRI’.

This setting generates an alarm if an ISDN interface becomes operational. An ISDN backup interface becomes active when another link is down. So this event might indicate a network error.

__ e. Enter the following command lines into the Advanced text box.

((( eval(int,'&SNMP.VALUE.ifAdminStatus') = 1 ) AND ( eval(int,'&SNMP.VALUE.ifOperStatus') = 0 ) AND ( eval(text,'&SNMP.VALUE.ifDescr') not like 'BRI' ) )OR (( eval(int,'&SNMP.VALUE.ifAdminStatus') = 1 ) AND ( eval(int,'&SNMP.VALUE.ifOperStatus') = 1 ) AND ( eval(text,'&SNMP.VALUE.ifDescr') like 'BRI' )))

Hint

The values in the preceding command are case-sensitive. The use of parentheses must also be correct. It is often helpful to find a similar query, copy and paste that query text into the Advanced box, and edit it there.

__ f. Modify the corresponding Clear Threshold to clear the event when any of the preceding conditions are resolved.

((( eval(int,'&SNMP.VALUE.ifOperStatus') = 1 ) AND ( eval(int,'&SNMP.VALUE.ifAdminStatus') = 1 ) AND( eval(text,'&SNMP.VALUE.ifDescr') not like 'BRI' ))OR(( eval(int,'&SNMP.VALUE.ifOperStatus') = 0 ) AND ( eval(int,'&SNMP.VALUE.ifAdminStatus') = 1 ) AND( eval(text,'&SNMP.VALUE.ifDescr') like 'BRI' )))



V11.2

EXemp


ty

Note

The preceding steps to create the CustomAdvancedPoll formed a common field customization in Tivoli Network Manager IP Edition 3.7 and previous versions. Beginning with version 3.8, a new default poll definition, isdnLinkUp, helped to solve the problem of needing inverse logic to handle ISDN dial backup links. However, this exercise has value because you learn how to create complex polls.



V11.2

EXemp


tyTask 4 Editing the poll policy

In the Configure Poll Policy window (in the top half of your screen), select the SNMP Link State policy, and modify it by completing the following steps:

__ 1. Select the SNMP Link State definition.

__ 2. Select the box next to that definition.

__ 3. Click the Delete icon.

__ 4. Click the Add icon.



V11.2

EXemp


ty__ 5. Select the CustomLabPoll definition that you created. Make sure that the interval is set to

30 seconds. Check the Poll Enabled box.

__ 6. Select the Network Views tab. Then, select itnmadmin views from the drop-down menu.

__ 7. Select the NOI_AGG_P domain.

__ 8. Apply this polling policy to the network partition views showing All Routers and All Switches by checking the box for each view. Click Save.



V11.2

EXemp


ty__ 9. Confirm that you want to save changes to the Monitor Config database.

Task 5 Modifying the event view

__ 1. Configure the NmosManagedStatus column to be viewed in the Active Event List by completing the following steps:

__ a. Open the Event Viewer.

__ b. Click the View icon.

__ c. Select Global Views and click the Add New icon. Make it a global view.



V11.2

EXemp


ty

__ d. Call this view ManagedStatus and add the NmosManagedStatus field to the event view.

__ e. Save the view.



V11.2

EXemp


ty__ 2. Select the Default filter and the newly created Managed Status view. Your event list shows

the NmosManagedStatus for each event.



V11.2

EXemp


ty__ 3. Modify a chassis ping failure event by completing the following steps:

__ a. Right-click an event that indicates a chassis ping failure or a Confirm Device Down message.

Hint

If you no longer have any chassis ping failure events, repeat the earlier process of right-clicking a device icon in the GNSTN325 virtual machine network simulator and selecting Stop. This procedure results in ping fail events. The ping poll interval determines how quickly you detect these ping failures. After you complete this exercise, return the simulated device to normal operation by right-clicking the icon and selecting Start.

__ b. Look at that device in the Hop View.



V11.2

EXemp


ty__ c. Right-click that device and click Unmanage.

The icon changes to indicate that the device is now unmanaged.

Hint

If the icon does not reflect the change in the managed status, hover over the device icon for a moment. The icon should update. In a busy environment, it can take up to 2 minutes for these state changes to be observed because the polling database must be updated.



V11.2

EXemp


ty__ 4. Right-click the unmanaged device and select Show Events.

__ 5. Look at the Event Viewer. The NmosManagedStatus for the selected device can still indicate a status of Managed. The row contains events that were detected when the device was managed.



V11.2

EXemp


ty__ 6. Select all events and delete them. Watch the event list for several minutes. You do not see

any new chassis ping errors for the unmanaged device because the poller no longer polls the unmanaged device.



V11.2

EXemp


tyTask 6 Configuring default polls

__ 1. From the left navigation menu, click the Administration icon, Network, Network Polling.

__ 2. In the Configure Poll Policies window (top half of screen), make sure that both the Default Chassis Ping and Default Interface Ping poll policies are enabled. If either one is disabled, click the check box on the left side and click the green Enable button to activate the checked policy.



V11.2

EXemp


ty__ 3. Click Default Chassis Ping and set the interval for this ping at 30 seconds. Click Save.

Click OK when asked whether you want these changes to be made to the Monitor Config database.

__ 4. In the same way that you modified the Default Chassis Ping, set the interval for the Default Interface Ping to be every 180 seconds.

Task 7 Configuring a network view for adaptive polling

In this exercise, you create a network view that shows devices that have a certain event condition. As alarms enter the ObjectServer, devices that match this criteria automatically populate this view. You create a polling policy that applies to devices as they enter this view. In doing so, you create an adaptive poll. Tivoli Network Manager polls the devices that meet a certain condition and then applies a special polling policy to those devices.



V11.2

EXemp


ty

Note

IBM Tivoli Network Manager 4.2 has a Confirm Device Down polling policy that is based on the Initial Ping Fail Events network partition view. This view is automatically created during the installation process. It shows events that have an EventId of NmosPingFail and a Tally count less than 18. You can use this filtered network partition view or create one of your own.

__ 1. From the left menu, select Incident icon > Network Availability > Network Views.

__ 2. Select the Libraries tab, itnmadmin Views, and click the New View icon.



V11.2

EXemp


ty__ 3. Name the view CustomPingFail and make it a Filtered view.



V11.2

EXemp


ty__ 4. On the Filter tab (1), change the table name from mainNodeDetails to activeEvent. Click

the arrow to the right of mainNodeDetails and scroll up and select the activeEvent table (2).

__ 5. Click the filter builder button (3).

__ 6. Specify a filter of EventId=NmosPingFail and Tally<20, change Any to All, and click OK.

This filter shows all devices with ping failure events that have a Tally count less than 20. This lab exercise applies an adaptive poll to devices in this network partition view. It then



V11.2

EXemp


typolls them at the specified interval. If the condition can be resolved before that time, the ObjectServer generic clear automation clears the alarm.

__ 7. Click OK in the Filter Builder window.

__ 8. Configure this view to include end nodes and show Converged Topology connectivity. Click OK.

__ 9. Open Network Polling. Go to the Configure Poll Policies window.

__ 10. Edit the ConfirmDeviceDown policy by completing the following steps:

__ a. Click the ConfirmDeviceDown policy name.

__ b. Make sure that the polling interval is set to 15 seconds.



V11.2

EXemp


ty__ c. Select the Poll Enabled check box. Click Save and click OK to save changes.

__ d. Verify that the policy is enabled.

__ e. Click the Network Views tab.



V11.2

EXemp


ty__ f. Select itnmadmin Views and verify that the CustomPingFail partition view that you

created is visible. Selecting CustomPingFail limits the application of the ConfirmDeviceDown polling policy to only those devices in this network partition view.

__ 11. Generate reachability failure events in the ObjectServer.

__ a. If the NOI14_ITNM42_2017 virtual machine is operating in full-screen, press Ctrl+Alt+Enter to return to a window view.

__ b. Select the GNSTN325 (or GNS3) tab.



V11.2

EXemp


ty__ c. In the network map, right-click the BRUACS device. Select Stop from the device menu.

__ 12. Open the Event Viewer by clicking the Incident icon > Events > Event Viewer on the left menu. Within a few moments, ConfirmDeviceDown/DefaultChassis Ping fail events show in the active event list. The count for these events increases quickly because you are pinging them at a faster interval. These events demonstrate that the adaptive polling policy is working as you configured it.



V11.2

EXemp


ty

Note

You can also use adaptive polling to do other polls that gather more information to help you to diagnose other types of events. These polls might include information such as bandwidth utilization, outbound port utilization, CPU utilization, or other data useful to you.

__ 13. Complete the following optional step to place the system name in the Node column.

The alarms for devices came into the ObjectServer with the IP address as the value in the Node column instead of the system name. You can change the probe rules file to cause the file to put the system name in the Node column with the following steps:

__ a. Edit the $NCHOME/probes/linux2x86/nco_p_ncpmonitor.rules file.

__ b. Look in this file, beginning approximately at line 48. Locate the following code.

if (exists($ExtraInfo_ACCESSIPADDRESS))(

@Node = $ExtraInfo_ACCESSIPADDRESS)else(

@Node = $EntityName)

__ c. Comment out the preceding code and replace with the following text:

@Node = $EntityName

__ d. Determine the process ID for the nco_p_ncpmonitor probe by running the pgrep command:

pgrep -fl nco_p_ncpmonitor

__ e. Force the probe to reread its rules file by sending it a kill -HUP signal:

kill -HUP processID

kill -HUP 14720

Note

As the new events came in after the probes rules file change occurred, data deduplication would increment only the Tally field. To see the events with the newly updated node values, you must first remove the old events from the event list.



V11.2

EXemp


ty__ f. Run the following to remove events from the current event list:

nco_sql -server NOI_AGG_P -user root -password object001> delete from alerts.status;2> go

Observe the output of the affected rows.

(47 rows affected)

The probe now sends events with the system name that shows in the Node field. To see the node names in the Event Viewer, you might have to delete existing ping failure events and generate new ones by stopping a device in the network simulator.

Note

If you do not see the node names in the Event Viewer, select and delete all the events. When new events come into the ObjectServer, you should see that the Node column is filled with device names.





Unit 9. Understanding DNCIM


Unit 10.Customizing discovery

Task 1 Creating custom database tables


itnm_stop ncp -domain NOI_AGG_Pitnm_stop ncp -domain NOI_AGG_B

__ 2. Remove the existing DNCIM database.

cd $ITNMHOME/embeddedDb/sqliterm -rf ncp_disco.*

__ 3. Use a modified createCustomization.sql script to build a new customData table and lookup tables. The following script creates lookup tables that assign values based on parsing a host name. Copy this SQL script to the $ITNMHOME/scripts/sql/sqlite and $ITNMHOME/scripts/sql/db2 directories. Take time to examine this script.

cd $ITNMHOME/scripts/sql/sqlitemv createCustomization.sql createCustomization.sql.orig

cp /home/netcool/LabFiles/CustomDisco/sqlite/createCustomization.sql $ITNMHOME/scripts/sql/sqlite/createCustomization.sql

cat $ITNMHOME/scripts/sql/sqlite/createCustomization.sql

Note

This script runs from the $ITNMHOME/scripts/sql/sqlite/createCustomization.sql location to create tables inside the sqlite database. It is a good practice to also copy custom scripts to the $ITNMHOME/scripts/sql/db2 directory. You can use that copy of the script to create the same tables in the NCIM database.



V11.2

EXemp

Unit 10. Customizing discovery

ty__ 4. Review this script to understand it. It creates two lookup tables and one empty table into

which a discovery stitcher can populate data.

-- -------------------------------------------------------------------- --------------------------------------------------------------------- This section creates a customData table into which entity records-- will be inserted after using lookup tables to assign Continent,-- Country, City, and DeviceType. You must create the same table manually-- in the DB2 NCIM database so that when discovery runs, it can copy-- data from this table into the DB2 NCIM version of this same table.-- Additionally, you must define the dbModel.customData table in the-- $NCHOME/etc/precision/ModelNcimDb.cfg file.

CREATE TABLE dncim.customData( entityId integer not null, slaId VARCHAR(255), Continent varchar(64), Country varchar(64), City varchar(64), DeviceType varchar(16),

CONSTRAINT customData_pk PRIMARY KEY (entityId),

CONSTRAINT customData_entData_fk FOREIGN KEY (entityId) REFERENCES entityData(entityId) ON DELETE CASCADE);

-- --------------------------------------------------------------------------- This section creates lookup tables to be used by the CustomEnrichmentNew-- sticher. There is no need to insert these tables into the DB2 NCIM database.

CREATE TABLE dncim.locationLookup( CityCode char(3) not null, Continent varchar(64), Country varchar(64), City varchar(64),

CONSTRAINT locationLookup_pk PRIMARY KEY (CityCode));

INSERT INTO dncim.locationLookup (CityCode, Continent, Country, City) VALUES('BRU','Europe','Belgium','Brussels'),('LON','Europe','United Kingdom','London'),('MOS','Europe','Russia','Moscow'),('SYD','Australia','Australia','Sydney'),



V11.2

EXemp


ty('PAR','Europe','France','Paris'),('NYC','North America','United States','New York City'),('WAS','North America','United States','Washington DC');

CREATE TABLE dncim.deviceType( DevCode varchar(16) not null, DeviceType varchar(64),

CONSTRAINT deviceType_pk PRIMARY KEY (DevCode));

INSERT into dncim.deviceType (DevCode, DeviceType) VALUES ('Core','Backbone'), ('PE','Provider Edge'), ('CPE','Customer Premise Equipment'), ('SW','Switch with Routing Blade'), ('NAS','Network Access Server'), ('ACS','Secure Access Control Server');

Note

When discovery starts, Tivoli Network Manager checks for the existence of a DNCIM database for the specified domain. If it does not find the database, it creates it. As a part of the database creation process, the createCustomization.sql script runs and creates whatever custom tables you specify within that script. You removed the DNCIM database in Step 2 on page 10-1. The next time that you start discovery, this script runs and creates the new tables that are specified in the createCustomization.sql file.

__ 5. Create the same tables in the NCIM database. Only tables in the NCIM database can be used later to create custom network views.

__ 6. Copy the script to create the customData table in the NCIM database.

cp /home/netcool/LabFiles/CustomDisco/db2/customTables.sql $ITNMHOME/scripts/sql/db2/customTables.sql

__ a. Use gedit to edit the file to match the following example.



V11.2

EXemp


ty

Note

For the sake of clarity, you are changing some of the references from customData to ncim.customData to make sure that the references are precise when creating tables. You are also changing the UPPERCASE NCIM value to lowercase. Leave existing commented lines in the file, but make the other lines match the following syntax.

-- =======================================================================-- Addded the DROP TABLE statement to drop the table here instead of -- in the RefreshDNCIM script. This prevents the table from disappearing-- so it can be queried at any time to look at the results during student-- exercises.CONNECT TO ncim;

DROP TABLE ncim.customData;

CREATE TABLE ncim.customData( entityId INTEGER NOT NULL, Continent VARCHAR(64), Country VARCHAR(64), City VARCHAR(64), DeviceType VARCHAR(64),

CONSTRAINT customData_pk PRIMARY KEY (entityId),

CONSTRAINT customData_entData_fk FOREIGN KEY (entityId) REFERENCES entityData(entityId) ON DELETE CASCADE);

GRANT ALL PRIVILEGES ON TABLE ncim.customData TO PUBLIC;

-- ========================================================================

__ b. Change to the ncim user.

su ncim

__ c. Run these commands to create tables inside the NCIM database.

cd $ITNHMHOME/scripts/sql/db2db2 -svtf customTables.sql



V11.2

EXemp


ty__ d. Verify that the script ran successfully.

[ncim@host1 db2]$ db2 -svtf customTables.sql CONNECT TO ncim

Database Connection Information

Database server = DB2/LINUXX8664 10.5.3 SQL authorization ID = NCIM Local database alias = NCIM

DROP TABLE ncim.customDataDB20000I The SQL command completed successfully.

CREATE TABLE ncim.customData ( entityId INTEGER NOT NULL, Continent VARCHAR(64), Country VARCHAR(64), City VARCHAR(64), DeviceType VARCHAR(64), CONSTRAINT customData_pk PRIMARY KEY (entityId), CONSTRAINT customData_entData_fk FOREIGN KEY (entityId) REFERENCES entityData(entityId) ON DELETE CASCADE )DB20000I The SQL command completed successfully.

GRANT ALL PRIVILEGES ON TABLE ncim.customData TO PUBLICDB20000I The SQL command completed successfully.

__ e. Return to running as the netcool user.

exit

Task 2 Implementing a custom stitcher

__ 1. Make a backup copy of the existing PopulateDNCIM.stch.

cd $ITNMHOME/disco/stitchers/DNCIMmv PopulateDNCIM.stch PopulateDNCIM.stch.orig

__ 2. Copy the stitchers for this exercise into the DNCIM stitchers directory.

cd /home/netcool/LabFiles/CustomDisco/customStitchers/cp *.stch $ITNMHOME/disco/stitchers/DNCIM/



V11.2

EXemp


ty__ 3. Look at the PopulateDNCIM.stch to see how it calls the new CustomEnrichmentNew

stitcher.

Note

Use StitcherTimeCheck statements to insert messages into the discovery log files that record the starting and completion of discovery stitchers. These statements create log file messages in the DISCO trace file so that you can see when the stitcher starts and ends.

__ 4. Review the $ITNMHOME/disco/stitchers/DNCIM/CustomEnrichmentNew stitcher to better understand the syntax.

UserDefinedStitcher{ StitcherTrigger { }StitcherRules { // Initialize Variables int chassisId = 0; int entityId = 0; text chassisName = NULL; text domainPattern = NULL; text Continent = NULL; text Country = NULL; text City = NULL; text DeviceType = NULL; text DevCode = NULL; text CityCode = NULL;

// Define procedures// The following statment will be evaluated as soon as it is read since we// are passing all parameters to the PrepareSQL when we define it.



V11.2

EXemp


tySQLData getChassis = PrepareSQL(

"select entityName, entityId from entityData where entityType = 1;", "DNCIM" );// In the following select statements, the ? prevents ITNM from evaluating the// the select statement until we call it later. If we don't use that ?,// the statement evaluates now and will not be re-evaluated if we use it// later in the script.SQLData getLocation = PrepareSQL(

"select Continent, Country, City from locationLookup where CityCode = ?", "DNCIM", eval(text,'$CityCode') );SQLData getDeviceType = PrepareSQL( "select DeviceType from deviceType where DevCode = ?", "DNCIM", eval(text,'$DevCode') );// This section prepares 4 routines for inserting enrichment data into// the entityDetails table. SQLDATA insertCountry = PrepareSQL( "insert into entityDetails ( entityId, keyName, keyValue ) values ( ?, ?, ? );", "DNCIM", eval(text,'$chassisId'), "Country", eval(text,'$Country') );

SQLDATA insertContinent = PrepareSQL( "insert into entityDetails ( entityId, keyName, keyValue ) values



V11.2

EXemp


ty ( ?, ?, ? );", "DNCIM", eval(text,'$chassisId'), "Continent", eval(text,'$Continent') );

SQLDATA insertCity = PrepareSQL( "insert into entityDetails ( entityId, keyName, keyValue ) values ( ?, ?, ? );", "DNCIM", eval(text,'$chassisId'), "City", eval(text,'$City') ); SQLDATA insertDeviceType = PrepareSQL( "insert into entityDetails ( entityId, keyName, keyValue ) values ( ?, ?, ? );", "DNCIM", eval(text,'$chassisId'), "DeviceType", eval(text,'$DeviceType') ); // Retrieve entity records -- this is pulling data from the // evaluation that was already done during the PrepareSQL definition



V11.2

EXemp


ty ExecuteSQL(getChassis); int count=0; foreach(getChassis) { // In the stitcher, any time we pull data from a database, the column // names are returned in all uppercase letters. So we must refer to them // as uppercase when we use them in statements. chassisName = eval(text,'&ENTITYNAME'); chassisId = eval(int,'&ENTITYID'); // The following pattern will look for a host name with 3 initial capital // letters followed by a hyphen and then some more text with mixed // uppercase and lowercase followed by a hyphen and then some irrelevant // alphanumeric characters. The value inside the first set of parentheses // is $REGEX1, the second set is $REGEX2, etc. $REGEX0 refers to the entire // string. domainPattern = "^([A-Z][A-Z][A-Z])-([A-Za-z]+)-.*";// The following statement returns a value of 1 if the in-scope record// matches the defined pattern. Since we used a foreach statement to begin// this section, we are only evaluating one chassisName at a time. count = MatchPattern(chassisName, domainPattern); if(count > 0) { CityCode = eval(text, '$REGEX1'); DevCode = eval(text, '$REGEX2'); Print ("City code: ", CityCode); Print ("DevCode: ", DevCode); ExecuteSQL(getLocation); ExecuteSQL(getDeviceType);// Retrieve the appropriate data for the entity. Begin // building the record to be inserted into DNCIM.// Only those lines that begin with @customData will be written into// the customData table. We first "turn on the recorder" to build up the// insert that will go into the customData table. Record customData; @customData.entityId = eval(int, '$chassisId');

foreach(getLocation) {// First, enrich the values needed for entityDetails (for structure browser) entityId = eval(int, '$chassisId'); Country = eval(text,'&COUNTRY'); Continent = eval(text, '&CONTINENT'); City = eval(text, '&CITY'); ExecuteSQL(insertContinent); ExecuteSQL(insertCountry); ExecuteSQL(insertCity);// Now add data to customData table (for network views)



V11.2

EXemp


ty @customData.Country = eval(text,'&COUNTRY'); @customData.Continent = eval(text, '&CONTINENT'); @customData.City = eval(text, '&CITY'); } foreach(getDeviceType) { DeviceType = eval(text, '&DEVICETYPE'); ExecuteSQL(insertDeviceType); @customData.DeviceType = eval(text, '&DEVICETYPE'); }// The following statement should cause an entry for each statement // to go into the log file. PrintRecord("Custom data record is ", customData);// Use chassisId as the first parameter. This first parameter is interepreted// as text. DncimInsert( chassisId, "customData", customData );// We delete the in-scope record after doing the insert. This prevents// memory leaks and prevents "garbage" data from going into the next iteration.// delete( customData );} else { // DNS Name does not match naming convention. Print("DNS name does not match naming convention", chassisName); } } }

Task 3 Populating the customData table in NCIM database

__ 1. Rename the existing ModelNcimDb.cfg file.

cd $NCHOME/etc/precisionmv ModelNcimDb.cfg ModelNcimDb.cfg.orig

__ 2. Copy the modified /home/netcool/LabFiles/ModelNcimDb.cfg file to $NCHOME/etc/precision.

cd /home/netcool/LabFiles/CustomDisco/etccp ModelNcimDb.cfg $NCHOME/etc/precision/ModelNcimDb.NOI_AGG_P.cfg



V11.2

EXemp


ty__ 3. Examine the portion of this file that defines the customData table. Even though you created

the file in DNCIM (sqlite) and in NCIM (DB2), the table must be defined to be able to populate it with data.

///////////////////////////////////////////////////////////////////Create definition for customData table to be used in class exercies// Note that definitions here use more generic data types compared// to what is in the sql files used to create the tables in the// databases.create table dbModel.customData( entityId int not null primary key, slaId int, Continent text, Country text, City text, DeviceType text);

__ 4. Examine the portion of the configuration file that maps data from the DNCIM database into the NCIM database.

/////////////////////////////////////////////////// For lab exerciseinsert into dbModel.entityMap( EntityFilter, TableName, FieldMap, StitcherDefined)values( "m_EntityType = 1 OR m_EntityType = 8", "customData", { entityId = "eval(int, '&m_EntityId')", Continent = "eval(text, '&Continent')", Country = "eval(text, '&Country')", City = "eval(text, '&City')", DeviceType = "eval(text, '&DeviceType')" }, 1);



V11.2

EXemp


ty

Important

Other lines in ModelNcimDb.cfg refer to &m_EntityId. However, the customData table that you created in Step c on page 10-4 uses a field that is called entityId. The syntax in this file is case-sensitive.

__ 5. Restart the Tivoli Network Manager processes.

itnm_start ncp -domain NOI_AGG_P

__ 6. Use the itnm_status command to verify that the Tivoli Network Manager processes started.

__ 7. If all processes do not start, look for errors in the log and trace files in the $NCHOME/log/precision directory.



V11.2

EXemp


tyTask 4 Running discovery and view the results

__ 1. Run a new full discovery in the NOI_AGG_P domain. Configure and start the discovery according to the instructions that begin in Unit 3, “Discovery basics” Step 1 on page 3-1 and end at Step 17 on page 3-10.

__ 2. After discovery starts and the ncp_disco process finds several devices, run the following two database queries to see whether Tivoli Network Manager created the DNCIM tables properly. If the tables exist, rows of data are returned.

ncp_oql -domain NOI_AGG_P -service DNCIM -query "select * from locationLookup;"

ncp_oql -domain NOI_AGG_P -service DNCIM -query "select * from DeviceType;"

Note

Query results show field names in uppercase letters even though the column names were in lowercase letters when the table was created. This behavior is normal.

The ncp_oql query does not require a user name and password because the command line specifies -service DNCIM. Services that are internal to Tivoli Network Manager do not require the use of user name or password parameters. However, to access the NCIM database in DB2, you must supply both a user name and a password.



V11.2

EXemp


ty__ 3. After discovery completes, run the following query to verify that the customData table in the

DNCIM database received data:

ncp_oql -domain NOI_AGG_P -service DNCIM -query "select * from customData;"

Hint

If you do not see results similar to the preceding example, check to make sure that you completed all the preceding steps in the specified order. Repeat the steps if necessary. Then, examine the ncp_model.NOI_AGG_P.trace and ncp_disco.NOI_AGG_P.trace files in the $NCHOME/log/precision directory. Look for errors that indicate problems with database inserts. If these steps do not provide sufficient information to solve your problem, contact your instructor.

__ 4. Verify that the discovery populated new fields in the entityDetails table. This information appears in the Device Structure browser.

ncp_oql -domain NOI_AGG_P -service DNCIM -query "select * from entityDetails;"

For each device, you see a set of field names and the values that are assigned to them.

{ ENTITYID=35; KEYNAME='Continent'; KEYVALUE='Europe';}{ ENTITYID=35;



V11.2

EXemp


ty KEYNAME='Country'; KEYVALUE='Belgium';}{ ENTITYID=35; KEYNAME='DeviceType'; KEYVALUE='Provider Edge';}

__ 5. Open the hop view and select a device. Double-click that device and open the Device Structure browser. The new fields are displayed in the Structure browser. The data in the Structure browser comes from the entityDetails table. The CustomEnrichmentNew stitcher put data into this table.



V11.2

EXemp


ty

Task 5 Modifying Dashboard Application Services Hub to use the customData table

Note

Beginning with IBM Tivoli Network Manager Version 4.2, any fields that you add to the entityDetails table are available in the Network Views GUI to create a custom network view that uses the added field. If you added a City field to entityDetails, you can create a network view for any city in the discovery. If you want to create a custom network view based on some data that was not added to the entityDetails table, you can also make an entire custom table available in the GUI.

__ 1. Log out of the Dashboard Application Services Hub GUI.

__ 2. Close your browser.



V11.2

EXemp


ty__ 3. Stop Dashboard Application Services Hub.


__ 4. In a terminal window, change to the $ITNMHOME/profiles/TIPProfile/etc/tnm directory.

cd /opt/IBM/netcool/gui/precision_gui/profile/etc/tnm

__ 5. Edit the ncimMetaData.xml file.

cp ncimMetaData.xml ncimMetaData.xml.origgedit ncimMetaData.xml

Hint

To edit files, you can use either vi or gedit. The latter utility is easier for people who do not have much experience with vi.

__ 6. Locate this section near the end of the file.

__ 7. Replace the preceding code with the following lines. Save and exit the file.O

__ 8. Restart Dashboard Application Services Hub.

/opt/IBM/JazzSM/profile/bin/startServer.sh server1



V11.2

EXemp


ty

Hint

The Dashboard Application Services Hub process takes several minutes to start on the lab virtual machines. After running the preceding command, wait 2 – 5 minutes for Dashboard Application Services Hub to start. Use the itnm_status command repeatedly until you see that the Dashboard Application Services Hub server starts successfully. If it fails to enter a RUNNING condition after 6 – 7 minutes, check for syntax or case errors in the ncimMetaData.xml file that you edited in Step 5 on page 10-17.

__ 9. Verify that Dashboard Application Services Hub restarted successfully.

/opt/IBM/JazzSM/profile/bin/serverStatus.sh server1 –user smadmin –password object00

[netcool@host1 bin]$ pwd/opt/IBM/JazzSM/profile/bin[netcool@host1 bin]$ ./serverStatus.sh server1 -user smadmin -password object00ADMU0116I: Tool information is being logged in file /opt/IBM/JazzSM/profile/logs/server1/serverStatus.logADMU0128I: Starting tool with the JazzSMProfile profileADMU0500I: Retrieving server status for server1ADMU0508I: The Application Server "server1" is STARTED[netcool@host1 bin]$



V11.2

EXemp


tyTask 6 Creating custom network views

__ 1. Log on to the Dashboard Application Services Hub server as the itnmadmin user with a password of object00.

__ 2. Open the Network Views tab.

__ 3. Click the Libraries tab. Click the icon to create a new network view.s



V11.2

EXemp


ty__ 4. Create a container that is called Continent. This container can hold network views.

__ 5. After you see the Continent container in the Network Views tree, click the icon to create another new view.

__ 6. Create a view that is called Europe.

__ a. On the General tab, specify Europe as the view name.

__ b. Designate the Continent container as the parent view.



V11.2

EXemp


ty__ c. Select Filtered as the view type.

O

__ 7. On the Filter tab, select the customData table that you created in Task 3, "Populating the customData table in NCIM database," on page 10-10.



V11.2

EXemp


ty__ 8. Select Layer 2 connectivity. Click the Filter Builder icon.

__ 9. Select Continent from the Field list. Use the equals (=) comparator. Enter Europe as the value. Click OK.

__ 10. Click OK on the filter tab.



V11.2

EXemp


ty__ 11. Click the new Europe view to see the resulting topology. If you see any Java permission

messages, click the appropriate option to approve or run the Java application.

__ 12. Using the same method that you used to create the Europe view, create network views for Australia and North America under the Continent container.

__ 13. Create a new filtered view that is called European Access Servers and specify Europe as the parent view.

__ a. Click the icon to create a network view.

__ b. Specify the view name as European Access Servers.

__ c. Select a Filtered view.

__ d. Choose an Orthogonal layout.



V11.2

EXemp


ty__ e. Click the Filter tab.

__ 14. Configure the filter.

__ a. Select the customData table.

__ b. Specify Layer 2 connectivity.

__ c. Click the Filter Builder icon.



V11.2

EXemp


ty__ 15. On the Filter tab, specify two conditions to result in finding only Network Access Server

entities in Europe. Make sure that the All radio button is selected. Click OK.

__ 16. Click OK on the Filter tab.

__ 17. Select the new view.

Note

You see no connections in the preceding network view. The view filter eliminated the devices that connect to the Network Access Server devices. Because no connections exist between these two devices, no connections are shown.



V11.2

EXemp


ty__ 18. Look again at the Europe network view to see the new icon that starts the child view when

you double-click it.

__ 19. (Optional) Using the same methods as the views that you created in preceding steps, create a view that shows all provider edge devices in your network.

__ a. Remember that filters are case-sensitive and that you must have an exact string match for the DeviceType field.

__ b. Before you create the filtered network view, check the contents of the DeviceType table to see how it designates provider edge devices.

Summary

In these exercises, you did these tasks:

• Created a customData table inside the NCIM database

• Edited the ModelNcimDb.NOI_AGG_P.cfg file to populate that table with discovery data

• Implemented the CustomEnrichmentNew stitcher to use a lookup table data to specify Continent, Country, City, and DeviceType for each entity in the topology based on the entity naming schema

• Inserted key-value pairs into the entityDetails table, which resulted in new fields that are displayed in the Device Structure browser view for a chassis entity

• Edited the ncimMetaData.xml file so that Dashboard Application Services Hub includes the new customData table in the list of available tables for filtered network views

• Created network views that used one or more fields from the customData table

The exercises for these two units demonstrate the ability to enrich topology with business information and then create meaningful network views with the enriched topology data. These



V11.2

EXemp


tysame processes can be used to add other types of useful information to the topology such as these examples:

• Customer data

• Service level agreement (SLA) data

• Warranty contract information

• System contact information

• Geographic location information such as latitude and longitude

• Building location data (such as building number, closet number, and rack number

• Any other information that helps you more quickly locate devices or relevant business information to reduce mean time to repair (MTTR)



Unit 11. The gateway and RCA

The exercise for this unit demonstrates the ability to configure Tivoli Network Manager gateway plug-ins. In this exercise, you configure a gateway plug-in to automatically rediscover a device when it sends a cold start trap to the gateway. This exercise demonstrates one method of creating a triggered partial rediscovery. Customers often need this ability to rediscover network components when they have a cold start or experience a configuration change. The latter condition is detectable because of a syslog message. The ability to dynamically update network discoveries when devices change keeps discovery information more relevant and accurate.

Task 1 Enabling the gateway Disco plug-in

__ 1. Source environment variables from $NCHOME/env.sh by running the following command:

. $NCHOME/env.sh

__ 2. Determine what plug-ins are currently enabled on the gateway by running the following command:

$ITNMHOME/scripts/perl/scripts/ncp_gwplugins.pl -domain NOI_AGG_P

|------------------|------------|| Plugin name | Is enabled ||------------------|------------|| Adaptive Polling | true || Disco | false || Failover | true || RCA | true || SAE IP Path | true || SAE ITNM Service | true || SAE MPLS VPN | true || zNetView | false ||------------------|------------|

Hint

If you get an error when you try to run a script from the $ITNMHOME/scripts/perl/scripts directory, insert ncp_perl before the command. This Perl wrapper script pulls environment variables from your system before processing the Perl script. This addition of ncp_perl is not necessary if you properly set environment variables by sourcing the $NCHOME/env.sh script.



V11.2

EXemp


ty__ 3. If the Disco plug-in shows false in the Is enabled column, run the following command to

enable the plug-in:

$ITNMHOME/scripts/perl/scipts/ncp_gwplugins -domain NOI_AGG_P -plugin Disco -enable

Enabled 'Disco' plugin in domain NOI_AGG_P

__ 4. Repeat Step 2 on page 11-1 of this unit to verify that the Disco plug-in is now enabled.

|------------------|------------|| Plugin name | Is enabled ||------------------|------------|| Adaptive Polling | true || Disco | true || Failover | true || RCA | true || SAE IP Path | true || SAE ITNM Service | true || SAE MPLS VPN | true || zNetView | false ||------------------|------------|

__ 5. Determine what kind of events the Disco plug-in processes by running the following command:

$ITNMHOME/scripts/perl/scripts/ncp_gwplugins.pl -domain NOI_AGG_P -plugin Disco

------------------------------------------------------------------Plugin Disco is enabled in domain NOI_AGG_P------------------------------------------------------------------

This plugin has registered interest in eventMaps:

Reconfiguration

This plugin handles events with states:

Occurred

This plugin has the configuration variables set:

StitcherSubDir = Disco------------------------------------------------------------------



V11.2

EXemp


tyTask 2 Assigning the event to an eventMap

This exercise begins by identifying to what eventMap a cold start trap is assigned. If it is not assigned to an eventMap, you must determine how to handle that event. The mapping is made in the gateway config.precedence OQL table or by setting the NmosEventMap field in the probe rules file.

__ 1. Determine whether the EventId for a cold start trap is listed in the gateway config.precedence OQL table by running the following commands:

cd $NCHOME/etc/precisiongrep -i SNMPTRAP NcoGateInserts.cfg

Note

This command returns all the EventId mappings for SNMP traps. To more quickly see whether the cold start trap is there, try this command instead: grep -i SNMPTRAP-coldStart NcoGateInserts.cfg

__ 2. The SNMPTRAP-coldStart is not in the NcoGateInserts.cfg file. Determine whether the NmosEventMap field of the event is populated by choosing one of the following options:

__ a. In a production environment, you can double-click a cold start trap event in the ObjectServer. Look at the fields for that event to see whether the NmosEventMap is set.

__ b. In the classroom environment, you do not yet have any cold start traps, unless your instructor can generate one with equipment in the classroom.

1) Examine the probe rules file. Using vi or gedit, look at the $NCHOME/etc/rules/snmptrap.rules file to determine how cold start traps are handled.



V11.2

EXemp


ty2) Search for coldStart in the file (case-sensitive). Review the field assignments.

Then, exit the file.

case "0": ### coldStartn# A coldStart trap signifies that the sending protocol entity# is reinitializing itself such that the agent's configuration# or the protocol entity implementation might be altered.##########$OS_EventId = "SNMPTRAP-coldStart"

@AlertGroup = "Generic"@AlertKey = ""@Summary = "Cold Start"$DEFAULT_Severity = 2$DEFAULT_Type = 13$DEFAULT_ExpireTime = 1800

@Identifier = @Node + " " + @AlertGroup + " " + @Type + " " + @Agent + " " + @Manager + " " + $generic-trap

Note

You see that the snmptrap.rules file does not set the NmosEventMap field for a coldStart trap. You see that the NcoGateInserts.cfg file does not have an insert for SNMPTRAP-coldStart. When nothing sets the NmosEventMap field or assigns the event to an eventMap, the genericip-event eventMap processes the event.

As you saw in Step 5 on page 11-2, the Disco plug-in works only on those events that are assigned to the Reconfiguration event map. You are now left with some choices about how to handle the cold start trap:

▪ You can modify the probe rules file to set NmosEventMap = “Reconfiguration” for the cold start trap.

▪ You can create an insert into the config.precedence table to assign SNMPTRAP-coldStart events to the Reconfiguration eventMap.

Important

Change the eventMap assignment for a particular event only if you are sure that you do not break the existing function of the gateway. In this case, you have a cold start trap that is getting handled by the genericip-event eventMap. Before you can reassign this event to the Reconfiguration event map, determine whether the genericip-event eventMap did anything unique to the event.



V11.2

EXemp


tyNever reassign an event if doing so causes a stitcher that previously ran on that event to no longer run. When changing an eventMap is not possible, configure a gateway plug-in to register interest in an extra eventMap. It is important that you never change the gateway plug-ins without fully understanding the consequences of those changes.

__ 3. Determine the differences between the Reconfiguration eventMap and the genericip-event eventMap by following these steps.

__ a. With vi or gedit, open the $NCHOME/etc/precision/EventGatewaySchema.cfg file. This file lists the eventMaps and designates a stitcher to run for each eventMap.

__ b. Search for Reconfiguration and then genericip-event eventMaps. See what eventMap runs each stitcher.

//-------------------------------------------------------------// An event map to allow feedback to discovery, via the Disco /// plugin.//// Expected input fields:// - LocalNodeAlias = node IP address, DNS name, sysName or // entityName//-------------------------------------------------------------

insert into config.eventMaps( EventMapName, Stitcher) values ( "Reconfiguration", "LookupMainNode"); //-------------------------------------------------------------// Any event not matching another eventMap will be passed to // this default eventMap. Note that this is intended as a catch-// all. Plugins should not register interest in this eventMap -// events of interest should instead be passed to the // EntityFailure eventMap.// // Expected input fields:// - LocalNodeAlias = IP address or DNS name



V11.2

EXemp


ty

//------------------------------------------------------------insert into config.eventMaps ( EventMapName, Stitcher)values ( "genericip-event", "LookupMainNode");

In this case, both the Reconfiguration and genericip-event eventMaps call the same LookupMainNode stitcher. Therefore, you can reassign the coldStart trap to the Reconfiguration eventMap without compromising how the event was previously handled.

__ 4. Edit the NcoGateInserts.cfg file to assign SNMPTRAP-coldStart to the Reconfiguration eventMap by following these steps:

Hint

SNMPTRAP-coldStart is case-sensitive. All SNMP traps start with SNMPTRAP- in the config.precedence table of NcoGateInserts.cfg. Look at the probe rules file to determine the correct case for what comes after that prefix. The $NCHOME/etc/rules/snmptrap.rules file shows a cold start trap with the trap name of coldStart. Make sure that you preserve the case of the trap name.

__ a. Using vi or gedit, open the NcoGateInserts.cfg file.

vi $NCHOME/etc/precision/NcoGateInserts.cfg

__ b. Locate the section where SNMP traps are processed.

__ c. Add the following lines near the top of that section to process rebooted devices.

insert into config.precedence values (0,"Reconfiguration","SNMPTRAP-coldStart");

insert into config.precedence values (0,"Reconfiguration","SNMPTRAP-cisco-CISCOTRAP-MIB-reload");



V11.2

EXemp


ty

Note

The first entry in the preceding example is a generic coldStart trap that is sent from many types of devices. The second entry specifies a trap name that is sent from many Cisco devices when they are restarted.

• Events with a precedence value of zero can be suppressed by other events but can never become root cause events.

• A cold start trap can never be a root cause event, so a value of zero (0) is appropriate here.

• These added entries specify the Reconfiguration eventMap for SNMPTRAP-coldStart events.

__ 5. Restart the gateway process so that it rereads the NcoGateInserts.cfg file by following these steps:

__ a. Determine the process ID (PID) associated with the ncp_g_event process by running the itnm_status command.

[netcool@host1 precision]$ itnm_statusNetwork Manager: Domain: NOI_AGG_P ncp_ctrl RUNNING PID=909 NOI_AGG_P ncp_store RUNNING PID=1146 NOI_AGG_P ncp_class RUNNING PID=1147 NOI_AGG_P ncp_model RUNNING PID=1618 NOI_AGG_P ncp_d_helpserv RUNNING PID=1148 NOI_AGG_P ncp_config RUNNING PID=1149 NOI_AGG_P ncp_poller_default RUNNING PID=2583 NOI_AGG_P ncp_poller_admin RUNNING PID=2584 NOI_AGG_P nco_p_ncpmonitor RUNNING PID=1150 NOI_AGG_P ncp_g_event RUNNING PID=2407 NOI_AGG_P ncp_webtool RUNNING PID=1151 NOI_AGG_P ncp_virtualdomain RUNNING PID=3093 NOI_AGG_P ncp_disco RUNNING PID=15141 NOI_AGG_P Apache Storm: supervisord RUNNING PID=15562 storm_nimbus RUNNING PID=15565 storm_supervisor RUNNING PID=15566 zookeeper RUNNING PID=15564 Storm topologies: NMStormTopology ACTIVE



V11.2

EXemp


ty__ b. Stop that PID by running the kill -9 command with the process ID for the

ncp_g_event binary. To stop the gateway that was running in the preceding example, use the following command. Substitute the correct PID number for the ncp_g_event process on your server.

kill -9 31494

__ c. Wait 1 – 2 minutes and run the itnm_status command. Verify that the gateway is running with a new process ID.

ncp_g_event RUNNING PID=14284 NOI_AGG_P

If you have no syntax errors, the gateway restarts under a new PID.

Task 3 Modifying the mttrapd rules files and lookup tables

__ 1. Edit the $NCHOME/etc/rules/snmptrap.rules file:

/opt/IBM/tivoli/NcKL/rules/snmptrap.rules

__ 2. Add the following line to the section of the rules file that processes coldStart traps. Assign those traps to the Reconfiguration NmosEventMap field. Save and exit the file.

@NmosEventMap = "Reconfiguration"



V11.2

EXemp


ty

Note

The use of the NmosEventMap field assignment in probe rules files became more common since the release of Tivoli Network Manager 4.x.

__ 3. Modify the SNMP lookup files so that coldStart traps have a Type of 1 (problem) instead of 13 (information). The Disco plug-in operates only on problem events.

__ a. Change the following line in $NCHOME/etc/rules/snmptrap.sev.lookup

{"SNMPTRAP-coldStart","2","13","1800"},

so that it reads as follows:

{"SNMPTRAP-coldStart","2","1","1800"},

__ b. Save and exit the snmptrap.sev.lookup file.

__ c. Change the following line in $NCHOME/etc/rules/include-snmptrap/cisco/ cisco-CISCOTRAP-MIB.sev.snmptrap.lookup:

{"SNMPTRAP-cisco-CISCOTRAP-MIB-reload","2","13","1800"},

so that it reads as follows:

{"SNMPTRAP-cisco-CISCOTRAP-MIB-reload","2","1","1800"},

__ d. Save and exit the cisco-CISCOTRAP-MIB.sev.snmptrap.lookup file.



V11.2

EXemp


ty__ 4. Restart the nco_p_mttrapd probe.

__ a. Identify the process ID (PID) associated with this process.

pgrep -fl nco_p_mttrapd

__ b. Use kill -HUP PID to restart the mttrapd probe so that it reads the modified lookup files.

4839 /opt/IBM/tivoli/netcool/omnibus/probes/linux2x86/nco_p_mttrapd -server NOI_AGG_Psu -object00kill -HUP 4839

Observe as follows:

[netcool@host1 rules]$ su -Password: [root@host1 ~]# kill -HUP 2729exit

Observe as follows:

[root@host1 ~]# exitlogout[netcool@host1 rules]$

Important

Log out of root user.

Task 4 Testing the processing of coldStart traps

__ 1. Select all events and delete them with the following commands:

nco_sql -server NOI_AGG_P -user root -password object00delete from alerts.status;go

Press ENTER after line 1 and line 2. Observe the number of rows that are affected.

__ 2. From the interface where you can select either of the two virtual machines that are used in this class, select the GNSTN325 virtual machine. Then, do the following tasks to configure the GNS3 server to send SNMP traps to the NOI server.

__ a. At the command prompt, enter the following command to start the snmpd service.

service snmpd start



V11.2

EXemp


ty

Important

The preceding command enables the SNMP service on the GNS3 server. If this service is not running, no traps are sent. If you do not see the alarms in the Event Viewer on the NOI server after typing the following commands, it means that your SNMP service is not enabled.

__ b. Type the following command to enable the GNS3 server to route traffic to the NOI server.

route add -net 192.168.100.0 netmask 255.255.255.0 gateway 10.191.101.126 dev eth0

__ c. Verify that the new route is now in the routing table.

netstat -rn

Kernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface192.168.100.0 10.191.101.126 255.255.255.0 UG 0 0 0 eth010.191.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo

Important

The GNS3 server runs a network simulator. The GNS3 server has an IP address of 10.191.101.126 and has a host-only network connection to the NOI14_ITNM42_2017 server, which has an IP address of 192.168.100.100. The preceding command creates a route so that the GNS3 server knows how to send traffic to the Tivoli Network Manager server. You should see the new route in the routing table.

__ d. Configure the GNS server to send SNMP traps with the following command:

export SNMP_PERSISTENT=/tmp

__ e. Send the following trap four or five times by entering the following command. Use the up arrow to repeat it, and enter it again. You are entering the command multiple times so that you can see the tally count increase in the ObjectServer.

snmptrap -v 1 -c public 192.168.100.100 1.3.6.1.4.1.3.1.1 10.10.255.1 0 0 ''



V11.2

EXemp


ty

Note

The preceding snmptrap command is a single line. Do not use the Enter key until you finish typing the final apostrophe marks. This command sends an SNMP coldStart trap to the mttrapd probe that is running on 192.168.100.100. The trap reports a coldStart on the device at 10.10.255.1. By sending this trap, you can test the correct processing of coldStart traps without needing to power cycle a device.

__ 3. Look at your Events Viewer and verify that a coldStart trap is in the ObjectServer. It can take a few seconds before you see the event in the ObjectServer. Double-click the event to verify that the NmosEventMap field is set to Reconfiguration and that the Type=1 (problem).

Note

If the snmp daemon (snmpd) is not running on your GNS3 server, you cannot generate the traps. The principles in this lab work with devices that send traps to a trap probe that enters events into the ObjectServer alerts.status table.



V11.2

EXemp


ty__ 4. Double-click the Cold Start event in the AEL. Scroll through the list of fields to locate the

value for the NmosEventMap field. Make certain that it says Reconfiguration.

Hint

If it does not show the correct value of Reconfiguration, make sure that you restarted the mttrapd probe as seen in Step 4 on page 11-10.

__ 5. Determine the process ID for the ncp_g_event process.

pgrep -fl ncp_g_event



V11.2

EXemp


ty__ 6. Use the kill -USR2 PID command three times to change the debug level from 0 to 2 for

the gateway.

__ 7. Look at the gateway trace and log files to verify whether the 10.10.255.1 IP address was sent to the discovery process.

tail -f /opt/IBM/tivoli/netcool/log/precision/ncp_g_event.NOI_AGG_P.trace The IP address that is shown in the log file can differ from the address that is sent in the SNMP trap. The gateway begins by looking up the main node IP for an IP address. This main node IP address is sent to the DISCO service finders.rediscovery table.

Note

The Unable to determine which entity is the MainNode message in the preceding example can be ignored because the 10.10.255.1 address is a main node IP address. The SendToDisco output in the trace file indicates that the device IP address is being sent to discovery service for a partial rediscovery.





Unit 12.Tivoli Network Manager scripts




Unit 13.Tivoli Network Manager failover




Unit 14. Installing Tivoli Network Manager


Unit 15.Tivoli Network Manager reports

This exercise acquaints you with viewing, scheduling, and building reports.

Task 1 Viewing a report

__ 1. Log on to the Tivoli Network Manager console at https://10.191.101.52:16311/ibm/console with a user name of itnmadmin and a password of netcool.

__ 2. From the navigation menu on the left side, select Common Reporting.

Hint

For Tivoli Integrated Portal to work properly, the Tivoli Common Reports must start successfully. If you get the following Cognos error message, shut down Tivoli Integrated Portal and restart.IBM Cognos 8 An error has occurred.DPR-ERR-2109 The dispatcher cannot service the request at this time.The dispatcher is still initializing. Contact your administrator if this problem persists. Please try again or contact your administrator.



V11.2

EXemp

Unit 15. Tivoli Network Manager reports

ty__ 3. From the Public Folders view, select Network Manager.

__ 4. Select Asset Reports.

__ 5. To the right of the Hardware MAC Vendor report name, click the green Play icon.

__ 6. Select the report format options and click Run.



V11.2

EXemp


ty__ 7. Select the NOI_AGG_P domain name and click Finish at the bottom of your browser

window.

Note

Tivoli Network Manager presents you with the option of selecting a domain name even if you have only one domain on your server.

__ 8. View the report in your browser.

__ 9. Click the Home icon in the upper-right corner of your browser window to return to the main screen for reporting.

Task 2 Scheduling automatic report snapshots

Follow these steps to create scheduled report snapshots for comparing data over time.

__ 1. From Public Folders > Network Manager > Asset Reports, select the Schedule icon to the right of the Hardware Mac Vendor report name.

__ 2. Set the report to run every Monday at 7:00 PM and click OK when done.



V11.2

EXemp


tyIf prompted for a password, enter netcool.



V11.2

EXemp


tyTask 3 Saving a report

__ 1. From the Public Folders > Network Manager > Utility Reports menu, click the Play icon next to the Discovered nodes and interfaces flat file list.

__ 2. Click the Add this report link in the upper-right corner and select Add to My Folders.

__ 3. Specify a name and description, and click Finish.

__ 4. Click the Home icon in the upper-right corner of your browser window to return to the main screen for reporting.

__ 5. Click the My Folders tab.



V11.2

EXemp


tyThe saved report is listed in your folder.

Task 4 Creating a report

This exercise covers how to create a basic asset report by using the included data model.

__ 1. From the Tivoli Common Reporting window, click Launch > Report Studio.

__ 2. If prompted to select a package, select Network Manager.

__ 3. Click Create new report or template.



V11.2

EXemp


ty__ 4. Select Blank and click OK.

__ 5. Under Insertable Objects, click the Toolbox tab and drag the Table object onto the page.



V11.2

EXemp


ty__ 6. Enter 1 column and 3 rows and click OK.

__ 7. Select the image object and drag into the first row of the table that you created.

__ 8. Double-click the image icon in your table and enter the following image URL:

https://10.191.101.52:16311/tarf/tivoli/tcr_common/images/tivoli.gif

Note

The IP address in the preceding URL must be the IP address of the Tivoli Common Reporting server. In many environments, this IP address is the same as the Tivoli Integrated Portal server.



V11.2

EXemp


ty__ 9. Click OK.

A Tivoli Software icon now shows in your table:

__ 10. Drag the List object into the third row.



V11.2

EXemp


ty__ 11. Drag the Text Item into the first row next to the image.

__ 12. Enter Basic Asset Report. Format the text to suit you.

__ 13. Click the source tab.



V11.2

EXemp


ty__ 14. Locate entityName under Network Manager > Network Manager Query > Network

Manager (Network Manager Query) > Chassis, and drag it onto the list object of your page.

__ 15. Drag the Manufacturer object onto the top of the entityName column of the list object. Do the same for Model and IP Address.



V11.2

EXemp


ty__ 16. Run the report to test it by clicking the Play icon.

__ 17. 13. View the report.

__ 18. Close the report view.



V11.2

EXemp


ty__ 19. Save the report in the Asset Report Folder as Basic Asset Report.

Hint

If you see the following error when opening or closing files in Report Studio, disable the XSS filter in your browser.



V11.2

EXemp


tyYour report is now in Tivoli Common Reporting under Asset Reports.

Task 5 Adding report parameters

__ 1. Open the report that you created in the previous exercise in Report Studio.

__ 2. Click the Page Explorer and select Prompt Pages.

__ 3. Select Page for the insertable object and drag it into the prompt pages section.

__ 4. Under properties, change the name of the Prompt page to Domain Prompt.



V11.2

EXemp


ty__ 5. Double-click the Domain Prompt page.

__ 6. Double-click the page title and change it to Basic Asset Report.

__ 7. Insert a 2x1 table into the main body of the page.

__ 8. Insert a Text Item object into the first row of the table and enter Domain in the text body.



V11.2

EXemp


ty__ 9. Insert a Value Prompt into the second row of the table. In the Prompt wizard, create a

parameter that is called DomainName and click Next.

__ 10. Select the Domain Name package item and click Next.



V11.2

EXemp


ty__ 11. Click Next.

__ 12. Rename the query to DomainNameQuery and choose the Domain Name package for Values to display.

__ 13. Click Finish.

Your Prompt Page resembles the following example.



V11.2

EXemp


ty__ 14. In the Query Explorer, select Query1, which corresponds to the Asset List in the report.

__ 15. Verify that in the Detail Filter, your prompt wizard created an entry for the Domain Name.

__ 16. Double-click the entry in the Detail Filters frame to see further details.

__ 17. Click OK when you are done.



V11.2

EXemp


ty__ 18. Save the report as Basic Asset Report by Domain.

__ 19. Run the report that you just created to verify that it works. Make sure to select your domain name when prompted to do so.



Unit 16.Event searches

When you integrate IBM Operations Analytics Log Analysis with Netcool/OMNIbus, you can use the text analytics features to find patterns and trends in event data. With the integration of these two products, you can view and search both historical and real-time event data from Netcool/OMNIbus in the IBM Operations Analytics Log Analysis user interface.

IBM Operations Analytics Log Analysis parses event data into a format suitable for searching and indexing. The event data is transferred from IBM Netcool/OMNIbus to IBM Operations Analytics Log Analysis by the Netcool/OMNIbus Message Bus Gateway.

When a new event arrives or an existing event is reinserted in the ObjectServer, event data is sent to the Gateway for Message Bus. The data is sent with an IDUC (Insert, Delete, Update, or Control) signal or an AEN (Accelerated Event Notification) channel. The gateway then sends the event through an HTTPS interface to the IBM Operations Analytics Log Analysis server.

Task 1 Populating event data

One of the most powerful features of Netcool/OMNIbus is the ability to organize the event records based on business context. This feature helps improve operational efficiency because a user can use it to quickly evaluate the severity of various issues as they relate to the overall business.

Two functions support this capability:

• Extending the event record to incorporate customer-specific business context. This extension is accomplished by adding customer-specific fields to the event record definition.

• Populating the event record with customer-specific data. This function is referred to as event enrichment. The business data can come from various sources, and is added to event records automatically.

The following exercises provide a brief overview of how to use Netcool/OMNIbus to organize event data by using customer-specific business context.



V11.2

EXemp

Unit 16. Event searches

tyTask 2 Extending the event record

A Netcool/OMNIbus event, or alert, is defined as a table in the ObjectServer. The name of the table is the status table that is stored in the alerts database. This table contains approximately 100 column names by default. You can add more columns to the table. You can add column names to the table with the Administrator utility or through the command-line interface with SQL commands.

The following steps demonstrate how you can add column definitions to the event record table with a text file. The file contains a series of SQL commands that create column names.

__ 1. Open a terminal window unless one is already open.

__ 2. Examine the file of SQL commands as follows:

cd /software/enrichmentmore usisa.sql

The file contains SQL commands that create 11 columns in the alerts.status table.



V11.2

EXemp


ty__ 3. Create the columns by running the following command:

nco_sql –server NOI_AGG_P –user root –password object00 < usisa.sql

The messages that state 0 rows affected are the normal response. It is safe to ignore the two error messages.

Task 3 Populating the event record with customer-specific data

The SQL commands in the previous exercise create the column definitions in the alerts.status table. The next step is to populate the columns with customer-specific data. This technique is referred to as event enrichment: you enrich the event by adding business context. Netcool/Impact is the ideal solution for event enrichment. Netcool/Impact queries the ObjectServer and retrieve records that meet specific criteria. For event enrichment, the criteria are typically empty columns. Netcool/Impact uses the data in one or more columns of the selected event record to search a repository of business context. The repository can be something like an asset management database or customer care database. After Netcool/Impact locates the corresponding record in the business context repository, it uses one or more columns from the repository to populate the corresponding columns in the event record. After the columns are populated, Netcool/Impact updates the event record in the ObjectServer.

Three functional components within Netcool/Impact are related to event enrichment:

• Data Model: The data model defines the business context repository. The model consists of a data source, which defines the physical database, and a data type that defines the database table.

• Policy: The policy is defined in a scripting-like language and contains the instructions that Netcool/Impact uses to search the repository and update the event record.

• Event Reader: The event reader is the component that queries the ObjectServer, selects one or more events, and passes the selected event record to the policy for processing. It is also the event reader that returns the enriched event record to the ObjectServer.

For this exercise, all of the Netcool/Impact components are provided. The following steps demonstrate how to examine the component configuration and how to activate the enrichment process.



V11.2

EXemp


tyAccessing Netcool/Impact

You can access the Netcool/Impact console through Dashboard Application Services Hub.

__ 1. Open a Firefox browser unless it is already open.

__ 2. Log in to Dashboard Application Services Hub as the ncoadmin user with password object00.

Important

Only two user IDs have the rights to access Netcool/Impact: impactadmin and ncoadmin. Both users have the same Netcool/Impact administrative privileges.

__ 3. Click the icon and select Impact.



V11.2

EXemp


ty__ 4. Click the arrow, and select USISA as the project.

__ 5. Click OK to confirm the switch.

All of the enrichment components are defined within the USISA project.

Verifying the data model

The data model for the enrichment consists of a data source that defines access to a DB2 database. The data model also contains a data type that defines a DB2 table.

__ 6. Click the Data Model tab.



V11.2

EXemp


ty__ 7. Click USISA to select it, and click the pencil icon to open the data source for edit.

The data source entry defines the location of a database. This database contains the customer data that you use as the source of enrichment.

__ 8. Examine the definition.

The first part of the definition contains the data source name, database user name, and password.

The next part of the definition contains the name of the server that hosts the database, the port number, and the database name.

__ 9. Scroll down in the window and click Test Connection.



V11.2

EXemp


ty__ 10. Verify that Netcool/Impact can access the DB2 database. Click OK to close the box.

__ 11. Click the X to close the data source edit window.

__ 12. Expand the entry for USISA. Click USISA_VIEW to select it and click the pencil icon to open the data type for edit.

The data type defines a table within the database.

__ 13. Examine the definition.

The definition contains the data type name, the DB2 schema name, and the DB2 table name.



V11.2

EXemp


ty__ 14. Scroll down in the window and examine the column names.

__ 15. Click the X to close the data type edit window.

__ 16. Click USISA_VIEW to select it, click the arrow, and select View Data Items.



V11.2

EXemp


ty__ 17. Examine the output.

A window opens and the contents of the USISA_VIEW table are displayed.

This exercise uses a database that is created specifically for this workshop exercise. In a production environment, the database that is used for enrichment is typically something like a customer care database or asset management database.

__ 18. Click the X to close the data items window.

Examining the policy

The policy is a set of instructions that are written in the Impact Policy Language (IPL) or JavaScript. The instructions tell Netcool/Impact what to do when an event is retrieved from the ObjectServer. For this exercise, the policy defines how to search the business context repository and what columns to use for event enrichment.

__ 19. Click the Policies tab.



V11.2

EXemp


ty__ 20. Click USISA_Enrichment to select it, and click the pencil icon to open the policy for edit.

__ 21. Examine the policy.

The policy that is shown here is written in the Impact Policy Language (IPL).

__ 22. Click the X to close the policy window.

Examining the event reader

The event reader is the Netcool/Impact component that queries the ObjectServer and searches for events that meet some condition. For event enrichment, the condition is typically configured to search for events that have empty columns. When the event reader finds one or more events that meet the condition, those events are passed to a policy.



V11.2

EXemp


ty__ 23. Click the Services tab.

The red X to the right of USISA_EventReader indicates that the service is stopped. In a production environment, the service is configured to start whenever Netcool/Impact starts.

__ 24. Click USISA_EventReader to select it, and click the pencil icon to open the service for edit.

__ 25. Examine the service definition.

The data source name identifies the ObjectServer. The Polling Interval defines how frequently Netcool/Impact queries the ObjectServer for new events. The default is every 3 seconds.

__ 26. Click the Event Mapping tab.

__ 27. Scroll down in the view and locate the Restriction Filter section.



V11.2

EXemp


ty__ 28. Click the entry to select it and click Edit to view the event mapping rule.

__ 29. Examine the event mapping rule.

The Filter Expression defines the event search condition. For this example, the event reader queries the ObjectServer for any event where the contents of the Location column are empty. When the event reader finds one or more events, they are passed to the USISA_Enrichment policy for processing.

This example uses a simple filter that contains a single condition. In a production environment, it might be necessary to create a filter with a more complex condition statement.

__ 30. Click Cancel to close the event mapping definition.

This example contains a single event mapping rule. A production environment typically has many event mapping rules. Each rule is defined to select events that match a specific condition, and configured to pass the events to a different policy because you can use Netcool/Impact for more than just event enrichment.

__ 31. Click the X to close the USISA_EventReader tab.



V11.2

EXemp


ty__ 32. Click OK to discard any changes.

__ 33. Click USISA_EventReader to select it, and click the green arrow to start the service.

__ 34. Verify that the USISA_EventReader service starts.

__ 35. Click the X to close the Impact console.

Leave the browser session as it is. You return to it shortly.

Generating synthetic events

The lab image contains a probe that creates synthetic events. You must start that probe.

__ 36. Start the probe by entering the following command in a terminal window:

nco_pa_start –server HOST1_PA –password object00 –process SimnetProbe

__ 37. Verify the status by entering the following command:

nco_pa_status –server HOST1_PA –password object00



V11.2

EXemp


tyTask 4 Creating dashboards

The process of creating a dashboard typically consists of the following steps:

1. Define event view. The event view defines which columns of information from the event record are of interest to the user. A typical event record might contain over 100 columns of data. Most users are generally interested in only a handful of columns: the information that they need to do their jobs.

2. Define the event filter. The event filter defines which event records are of interest to the user. In most production environments, the ObjectServer contains events from various infrastructure components. Most users, based on their job role, are interested only in events for specific types of components or issues.

3. Create the dashboard page.

In this exercise, you create a dashboard that is used to provide status for a managed service provider. The service provider is responsible for managing several customer agencies. The dashboard isolates the events into individual customer buckets. A user can see the overall health of each customer based on the status of each bucket. The user can drill down into any customer bucket to see all of the issues for that agency.

Observing the default event view

Netcool/OMNIbus includes a default event view.

Note

You are currently logged in to Dashboard Application Services Hub as the ncoadmin user.

__ 1. Click the icon to open Events and select Event Viewer.



V11.2

EXemp


ty__ 2. Examine the default event view.

The default event view provides basic information that is related to infrastructure issues, such as device name, date, and time of the issue and other data. The user can configure the type of information that is shown. In the previous exercise, you enabled Netcool/Impact to do event enrichment. However, the new columns of event information do not show in the default view.

__ 3. Click the X to close the Event Viewer.

Creating the event view

The following steps demonstrate how to create an event view that contains the enriched column names.

__ 4. Click the icon to open Event Management Tools and select Views.



V11.2

EXemp


ty__ 5. Click the icon to create a new view.

__ 6. If a window opens concerning security, select Continue.

__ 7. Select global, scroll to the bottom of the page, and click OK.

__ 8. Enter USISA for the name.

Hint

A view name cannot contain spaces or special characters except for the underscore.

__ 9. Modify the list of columns as follows:



V11.2

EXemp


tyThe column names in the pane on the right are the columns that are currently in the view. The column names on the left are the remaining column names in the event record that you can add to the view.

__ a. Click Serial on the right and click the left arrow to remove it from the view.

__ b. Click AgencyId on the left, and click the right arrow to add it to the view.

__ c. Repeat the previous step to add the following columns to the view:

○ ContactEmail ○ ContactName ○ ContactPhone ○ SiteAddr ○ SiteCity ○ SiteId ○ SiteName ○ SiteState

__ d. Click AgencyId to select it, and click the up arrow until the column is at the top of the list.



V11.2

EXemp


ty__ e. Repeat this process and arrange the column names as follows:

AgencyIdSiteIdNodeLastOccurrenceSummaryTallyContactNameContactEmailContactPhoneSiteNameSiteAddrSiteCitySiteState

Each column has an associated width value. For many columns, this value is not correct. The value is either too large and wastes space, or the value is too low and the column value is truncated.

__ f. Click AgencyId to select it, and change the column width to 10.



V11.2

EXemp


ty

Hint

Change the value in the column title to change the value that is displayed in the user desktop, for example: Agency ID instead of AgencyId.

__ g. Repeat the previous step and change the column width values as shown here:

__ h. Click Sort Columns. Click the arrow and select Descending.

By sorting the events in descending sequence by severity, the events with the highest severity are listed first, or at the top of the event view.

SiteId 10Node 15LastOccurrence 15Summary 40Tally 10ContactName 15ContactEmail 15ContactPhone 15SiteName 15SiteAddr 20SiteCity 15SiteState 10



V11.2

EXemp


ty__ i. Click Group Columns.

You can select one or more columns to use to group the event records. The grouping causes the events to display in a hierarchical manner.

__ j. Click AgencyId on the left to select it. Click the right arrow to add the column to the grouping criteria.

__ k. Repeat this step to add the SiteId column.

The completed grouping is displayed as follows.

__ l. Scroll to the bottom of the page and click Save and Close.

__ m. Click the X to close the Views page.

For this exercise, you create a single custom view for all users. In a production environment, it is likely that different users have various requirements for data. In a production environment, you often create several views to accommodate the user requirements.



V11.2

EXemp


tyCreating the event filters

The AgencyId column identifies the managed customers in this scenario. Netcool/Impact populates that column with the other custom columns. You use the AgencyId column to organize the events based on individual customer. You do so by creating several event filters. Each filter is configured to select events for only one customer.

__ 10. Click the icon to open Event Management Tools and select Filters.

__ 11. Click the icon to create a new filter.

__ 12. Select global, scroll to the bottom of the page, and click OK.

__ 13. Enter USISA for the name.

Hint

A filter name cannot contain spaces or special characters except for the underscore.

__ 14. Click the arrow and select the USISA view.



V11.2

EXemp


ty__ 15. Scroll to the bottom of the page and configure the filter condition.

__ a. Click the first arrow and select AgencyId for the field.

__ b. Click the next arrow and select the not equals sign (!=) for the comparator.

__ c. Leave the Value field blank.

__ d. Click the green plus sign (+) to add another condition.

__ e. Click the circle to set the option to All.

__ f. Click the arrow and select AgencyId for the field.

__ g. Click the next arrow and select the not equals sign (!=) for the comparator.

__ h. Enter UNKNOWN for the value.

The Netcool/Impact enrichment policy sets the value of AgencyId to UNKNOWN for any device that is not found in the DB2 database. The USISA filter locates all event records with a valid AgencyId value: not blank and not UNKNOWN.

__ 16. Scroll to the bottom of the page and click Save and Close.

__ 17. Click the X to close the Filters page.



V11.2

EXemp


tyCreating a dashboard

The following steps demonstrate how to create a simple dashboard page. A dashboard is a page that contains one or more widgets. Widgets are applications that display data in various formats. Some widgets render data as charts or graphs. Other widgets render data as lists or tables. In this exercise, you create a page with a single widget.

__ 18. Click the icon to open Console Settings and select Pages.

__ 19. Click New Page.

__ 20. Create the page as follows:

__ a. Enter USISA Customer Status for the page name.

Hint

Page names can contain spaces.

__ b. Accept the default location.

__ c. Select Proportional for page layout.



V11.2

EXemp


ty__ d. Click the arrow to expand Optional setting.

__ e. Click Add.

The Optional Setting page is used to define which users are allowed to access the page.

__ f. Select all authenticated portal users.

Adding this role allows access to the page for any valid user.

__ g. Scroll to the bottom of the page and click Add.

__ h. Scroll to the bottom of the page and click OK to create the page.



V11.2

EXemp


tyThe new page opens in the page editor.

The page editor has two functional areas: widget library and page layout area. The process of creating a page consists of dragging one or more widgets into the page layout area. You move and resize the widgets as necessary. And you configure the properties for each widget.

In this exercise, you use a single widget. The process to use multiple widgets is the same.

__ 21. Click Netcool/OMNIbus Widgets to open the folder and display the contents.

__ 22. Click the Event Viewer widget and drag it to the page layout area.

__ 23. Configure the widget properties as follows:

__ a. Click the arrow in the upper-right corner of the widget and select Edit.



V11.2

EXemp


ty

Note

If this feature is not available, click outside the widget first. Then, the edit menu should be available.

__ b. Select USISA for the filter. Select USISA for the view.

The filter determines which event records are shown in the Event Viewer. The view determines which column names are shown in the Event Viewer.

__ c. Click the Appearance tab. Change the title to Customer Status.



V11.2

EXemp


ty__ d. Scroll to the bottom and click Save.

__ 24. Click the arrow in the upper-right corner of the widget and select Fill Work Page.

The widget expands to completely fill the available space.

__ 25. Click Save and Exit to save the page.

__ 26. Click the X to close the page.

__ 27. Log out as the ncoadmin user.



V11.2

EXemp


tyVerifying dashboard

You created the page as the ncoadmin user. The ncoadmin user has administrative privileges. The following steps verify that a normal user has the appropriate access to event records through the dashboard page.

__ 28. Log in to Dashboard Application Services Hub as user ncouser with password object00.

__ 29. Click the icon and select USISA Customer Status.

The dashboard page opens.

The default filter and view are configured in the widget properties. The user can dynamically change the filter or view by selecting the appropriate arrow.

The grouping criteria is defined in the view. The groups aggregate the event records based on the column values. In this example, you see four customer agencies, and the total events for each customer.



V11.2

EXemp


ty__ 30. Click the group that is labeled bma. Click the plus sign to expand the bma group.

The grouping criteria consist of agency and site. You can see in this example that the bma customer has issues at three site locations. Each line in the grouping area provides a dynamic filter. If you select bma, the event display changes to show event records for only that customer.

__ 31. Scroll to the right in the event view.

The event record contains the contact information for the site point of contact. It also contains the exact site location. Netcool/Impact event enrichment populates the information.



V11.2

EXemp


ty__ 32. Click an event to select it, right-click, and open the list of tools.

The ncouser is configured with read/write access to event records. The user has access to all available tools.

Important

The number and severity of events in your view might be different. The events are generated over time by the Simnet probe. The probe generates different events at various times.

__ 33. Log out as ncouser.

__ 34. Close the Firefox browser.

Summary

In this section, you learned how to do the following tasks:

• Add columns to the Netcool/OMNIbus event record

• Use Netcool/Impact to enrich event records with customer-specific data

• Define an event view and event filter

• Create an event dashboard



V11.2

EXemp


tyTask 5 Analyzing event data with Log Analysis

Generating events

Netcool/OMNIbus can create event records with information from a multitude of sources. For this task, you use a supplied script to generate simulated SNMP traps. The Netcool/OMNIbus SNMP probe receives the trap and creates events in the ObjectServer. After the events that are shown in the ObjectServer, the Message Bus Gateway retrieves them and sends them to Operations Analytics Log Analysis.

__ 1. Verify the status of the SNMP probe by entering the following command:

nco_pa_status –server HOST1_PA –password object00

The next step is to generate the SNMP traps.

__ 2. Enter the following command:

/software/omnibus/events/send_traps.sh

__ 3. Examine the event records.

__ a. Open a Firefox browser.



V11.2

EXemp


ty__ b. Log in to Dashboard Application Services Hub as ncouser with password object00.

Important

You must use ncouser as this user ID has the authority to access Web GUI features and Operations Analytics Log Analysis.

__ 4. Click the icon to open the Incident folder and select Event Viewer.

Important

If the flag icon is not in the navigation bar, log out of Dashboard Application Services Hub, and close the browser. Open a new browser, and repeat the previous steps.



V11.2

EXemp


ty__ 5. Examine the event records.

All of the events with an IP address value for Node are the result of the simulated SNMP trap messages.

__ 6. Click the X to close the Event Viewer page.

Analyzing event data

__ 7. Open the Operations Analytics Log Analysis user interface:

__ a. Click the plus sign to open a new Firefox tab.



V11.2

EXemp


ty__ b. Click Bookmarks and select IBM Operations Analytics - Log Analysis.

The user interface for Operations Analytics Log Analysis opens.

__ c. Log in as ncouser with password object00.

__ d. Click New Search.

__ 8. Configure the search as in previous exercises:

__ a. Select omnibus as the data source.

__ b. Change Last 15 minutes to Last Hour.

Note

The events that result from the simulated SNMP traps contain the current date and time.



V11.2

EXemp


ty__ 9. Click Search.

The format of the search results is the same as searches for other types of files. The search patterns are unique to Netcool/OMNIbus event records. The results show that events are found for over 20 devices.

__ 10. Expand the list of Node values. One of these nodes is 192.168.110.44. Click the IP address of the node to use it to narrow your search.



V11.2

EXemp



__ 12. Create a chart that shows data about events from this node.

__ a. Click the Grid View icon to show the log fields in columns.

__ b. Scroll to the right in the search results and click the column title that is named Severity. Click the Plot Column icon.



V11.2

EXemp


ty__ c. Click Plot Chart (All Data).

__ d. Edit the chart by clicking the Settings icon at the upper-right portion of the chart.

__ e. Change the chart type to Pie Chart. Click Render.

__ f. Click the Settings icon again to hide the settings options.

The new chart shows the relative quantity of each event severity for this node.



V11.2

EXemp


ty__ g. Hover over a data series in the chart. A tooltip shows the actual event count for the

corresponding severity. Click the data series that shows Major events. This action drills down to a filtered list of events.

You return to the search results. Now you see a filtered list of events that have a severity of Major for that node.



V11.2

EXemp


ty__ h. Close the pie chart.

Analyzing and reducing event volumes

Netcool Operations Insight includes a series of prebuilt applications that you can use to evaluate your events with the intent to reduce event volumes. Some of the applications provide textual guidance on how to use the applications to evaluate your events. The other application summarizes the event data in various formats.

__ 13. Click the icon to open Search Dashboards. Expand OMNIbusInsightPack. Expand Event Analysis and Reduction and double-click Analyze and reduce event volumes.

Note

The first three applications under Event Analysis and Reduction are textual descriptions of how to evaluate your events.



V11.2

EXemp


tyThis first application provides some guidance on how to investigate alarm volumes.



V11.2

EXemp


tyThe second application provides a list of links to more resources that you can use to understand the source of event records.

The third application provides a detailed description of each remaining application.

The suggestion for use of this feature is to read the information in the first application to understand how to evaluates event volumes. Then, read the information in the third application



V11.2

EXemp


tyto understand the use and output for the remaining applications. Finally, use the remaining application to generate the graphical representation of your event volumes.

__ 14. Click the icon to open Search Dashboards. Expand OMNIbusInsightPack. Expand Event Analysis and Reduction and double-click Event Trend by Severity.

The dashboard page opens. app shows five common dimensions for analyzing trends in event volumes over time. It is a good starting point for analyzing event volumes.

If time allows, you can examine the other event analysis applications.

__ 15. Close the Firefox tab for Operations Analytics Log Analysis.



V11.2

EXemp


tyTask 6 Using launch-in-context tools from Netcool Web

GUI

The integration of IBM Tivoli Netcool/OMNIbus with IBM Operations Analytics Log Analysis also provides right-click tools in the Web GUI. These tools are for users to access from the Active Event List (AEL) or the Event Viewer within the Web GUI component of IBM Tivoli Netcool/OMNIbus. In this exercise, you use the tools with the Event Viewer.

The automated search that is implemented with the launch-in-context tools uses the FirstOccurrence time stamp in the event record as the basis of the search. FirstOccurrence is used because the tools are designed to find other events, not the event that is used as the basis for the search. The search criterion is designed to look for events with a time stamp that is less than the FirstOccurrence. This feature eliminates the possibility of finding the event that is used to launch the search.

__ 1. Open a Firefox browser, if necessary.

__ 2. Log in to Dashboard Application Services Hub as ncouser with password object00.

Hint

You might still be logged in from the previous exercise.

__ 3. Click the icon to open the Incident folder and select Event Viewer.

When investigating a problem with a device, one question that often comes to mind is whether other devices are experiencing the same or similar issues. The Search for similar events right-click tool is designed for this scenario.

__ 4. Use the tool to find all devices with EGP Neighbor Loss issues:

__ a. Locate an event with EGP Neighbor Loss in the Summary field.



V11.2

EXemp


ty__ b. Click the event to select it. Right-click and select Event Search > Search for similar

events > 1 day before event.

A new Firefox tab opens. You are logged in to Operations Analytics Log Analysis, and a search initiates. After a short time, the results open in the window.

A number of things must be pointed out:

• The search text is configured based on values for the AlertGroup, Type, and Severity event columns. The values are extracted from the event record.

• The time range is defined based on the value of FirstOccurence that is extracted from the event record.

• The login to Operations Analytics Log Analysis used the same user as is logged in to Dashboard Application Services Hub.

• The login did not require a password because the applications are configured to support single sign-on.



V11.2

EXemp


ty

Important

Your search results might vary slightly depending on how fast you do the labs and how long it takes the image to process the data.

In the lab image, Operations Analytics Log Analysis and Dashboard Application Services Hub are installed on the same server. If the two applications are installed on separate servers, the launch-in-context tools still function exactly as shown.

__ 5. Click the X to close the Operations Analytics - Log Analysis tab.

When investigating a problem with a device, another question that often comes to mind is whether the problem device experienced other issues. The Search for events by node right-click tool is designed for this scenario.

__ 6. Use the tool to find all events for a specific device:

__ a. Click the blue icon to filter the events to show only the events with severity of Information.

__ b. Locate a device with a value for count greater than 3.

A larger count value ensures that there is more than one event record in Log Analysis.



V11.2

EXemp


ty__ c. Click the event to select it, right-click, and select Search for events by node > 1 hour

before event.

A new Firefox tab opens and the search results are shown.

The results contain all events for the selected node for just the hour previous to the value for FirstOccurrence within the selected event.



V11.2

EXemp


ty__ 7. Click the X to close the Operations Analytics - Log Analysis tab.

The following steps demonstrate how to combine search criteria to facilitate event troubleshooting.

__ 8. Generate some new event data by running the following command:

/software/log_samples/scripts/Syslog.sh

The script copies a log file sample to a directory where Operations Analytics Log Analysis processes the data. The script also generates three event records.

__ 9. Return to the Event Viewer.

__ 10. Change the filter to BRU-Only. Click the blue icon to remove the restriction on informational events.

The BRU-Only filter selects all events with a node like BRU.



V11.2

EXemp


ty__ 11. Examine the events.

The Event Viewer shows a critical event that indicates a ping failure to device BRU-PE3-dca.gov. Two more events, one for BRU-CPE-dca.gov and one for BRU-PE3-dca.gov, indicate OSPF adjacency issues. The initial observation seems to indicate that an OSPF issue might be causing the ping failure.

__ 12. Click the BRU-CPE-dca.gov OSPF event to select it.

__ 13. Right-click and select Event Search > Show keywords and event count > 1 year before event.

Important

You must select greater than one year for the time because the events are taken from an old system.



V11.2

EXemp


tyIn a short time, the Operations Analytics Log Analysis window opens. The custom application that is associated with the tool is run. The results are a list of patterns that are associated with the selected event. Notice that a zero follows each pattern. The application is designed to locate the event records and extract various text strings. The next step is to select the text of interest, and do a search.

Note

The list of textual results is hidden to save space on the user interface.

__ a. Click the arrow to expand the list of search patterns.

The values in this list are extracted from various locations within the event record, including the body of the Summary column.

__ b. Click bru-cpe-dca.gov to add the value to the search criteria.



V11.2

EXemp


ty__ c. Click the arrow to open the list of data sources and select Syslog.

The omnibus data source is selected when the custom application runs. You add the Syslog data source to the search criteria.

__ d. Change the time to Last Year and click Search.

Important

The sample data that is used for this exercise is taken from a production system. The dates in the sample data are old. You must change the time for the search to find the records by using the old data. In a production environment, you typically select a date that is more recent.



V11.2

EXemp


ty__ e. Examine the search results.

In this example, the routers are configured to forward their console messages to a syslog server. Log Analysis is configured to process those syslog messages. The search locates a syslog record that indicates that the router configuration was modified. The router modification is the most likely reason for the OSPF adjacency issue and ping failure.

__ 14. Close the Operations Analytics - Log Analysis tab.

__ 15. Log out of Dashboard Application Services Hub.


Summary

In this lab exercise, you learned how to use Operations Analytics Log Analysis to analyze Netcool/OMNIbus event records. You learned how to do the following tasks:



V11.2

EXemp


ty • Create a custom search based on time frame

• Create charts to help visualize event volumes and peak periods

• Use launch-in-context tools from Web GUI for these tasks:

▪ Find devices with similar issues

▪ Find all issues for the same device

▪ Combine data from multiple sources to facilitate troubleshooting

The exercises are complete for this lab. As time permits, you can continue to explore the event analysis capabilities.



Unit 17.Log analysis basics

Log files are unstructured text data that is generated continually from IT assets. The data in these logs represents a high but usually untapped potential for troubleshooting purposes. Logs can reflect the root cause of a technical problem. The root cause can often be derived by using system health statistics, software errors and exceptions stack traces, customer transactions and sessions, transaction timing, configuration information, or ticketing data.

A log file holds valuable information, but is it realistic to manually read and analyze the file? Given an infrastructure of 5,000 servers that run more than 100 applications, more than a terabyte of such data is typically generated every day, and approximately 97% is in unstructured text.

You can use IBM Operations Analytics Log Analysis to analyze unstructured data to help identify, isolate, and resolve problems. The software integrates data from multiple sources by including logs, events, metrics, support documents, and trouble tickets.

In this lab, you use Operations Analytics Log Analysis to analyze DB2 logs, WebSphere Application Server logs, and web-access (Apache) logs. You play the role of a user who searches through log data to find error and fault conditions for troubleshooting.

Task 1 Analyzing WebSphere Application Server log files

Operations Analytics Log Analysis provides prebuilt support to evaluate the following WebSphere Application Server logs:

• SystemOut

• SystemErr

• Trace

Operations Analytics Log Analysis defines individual log file sources in the context of a data source. The data source definition identifies the log file by name and path, the type of log file, and whether the log file is configured to rotate periodically. In most cases, the log files are processed in real time. For the exercises in this lab, the log files are processed in batch mode. The data source definitions exist. You merely run a utility that copies a log file to a specific directory. After the file is copied, Operations Analytics Log Analysis processes the file and indexes the contents.

Note

The workshop image contains sample data for the three types of WebSphere log files. However, due to time constraints, you examine only one type of file.



V11.2

EXemp

Unit 17. Log analysis basics

tyExamining the data source definitions

The following steps demonstrate how to view a data source definition. The same process is also used to create a new data source, or modify an existing data source.

__ 1. Open a Firefox browser, if not already open.

Important

Make sure that you are not logged in to Dashboard Application Services Hub. If you are logged in, log out now.

__ 2. Click the icon and select IBM Operations Analytics - Log Analysis.

__ 3. Log in as user unityadmin with password object00.

__ 4. Click Administrative Settings.

The administrative interface opens in a new browser tab.

__ 5. Click the Data Sources tab.



V11.2

EXemp


ty__ 6. Click the WAS_SystemOut entry to select it and click the pencil icon to open the definition for

edit.

The location page defines the server that holds the file.

__ 7. Click Next.

The next page defines the file name and type.

__ 8. Click Next.

The last page defines the data source name.



V11.2

EXemp


ty__ 9. Click Cancel.

__ 10. Click OK to confirm the cancel operation.

Note

The image contains data source definitions for the other WebSphere file types. Feel free to examine the other definitions as time allows.

__ 11. Close the administration Firefox tab.

Leave the other browser tab as is. You return to it shortly.

__ 12. Open a terminal window, if necessary.

__ 13. Copy the sample WebSphere log files to their respective target directories by using the supplied script.

/software/log_samples/scripts/WAS_Logs.sh

After the log files are copied to their respective locations, as defined by the data source definitions, Operations Analytics Log Analysis processes and indexes the log file content. The default behavior for



V11.2

EXemp


tyLog Analysis is to process only new log data. By copying the log files, you simulate creating new log records.

Note

The script copies samples for all three log file types. In this exercise, you examine only one type of file.

Analyzing WebSphere SystemOut log data

The following steps demonstrate how to use the prebuilt features of IBM Operations Analytics Log Analysis to evaluate the contents of a SystemOut log file.

Important

The sample log file data is taken from active systems. The date and time stamps in the log records do not reflect the current date and time. In a production environment, you typically search data by using a current time reference such as last hour or last day. To use the sample data, you must use a much older time reference.

__ 14. Return to the Firefox browser.

You are currently logged in as the unityadmin user. If not, log in as unityadmin with password object00.

__ 15. Click New Search.



V11.2

EXemp


ty__ 16. Click the icon to open the list of data sources and click Clear All.

__ 17. If you receive the following error, it means that your user session expired. Log back in as the unityadmin user.

__ 18. Scroll down in the list and click WAS_SystemOut.

__ 19. Click Last 15 Minutes and select Last Year.



V11.2

EXemp



You defined a search of only SystemOut records for the previous calendar year. After a short time, the results open in the window.

There are over 4000 SystemOut records for the previous calendar year. All of these records are contained in the log file sample that you copied in the previous step. The values that are listed under Search Patterns represent the text in the log file that is unique to the WebSphere SystemOut log file. The numbers in parentheses represent the number of unique text values that matched the corresponding pattern.

__ 21. Under Search Patterns, expand javaException.

In this example, the log has seven different Java exceptions. One of these exceptions is java.sql.SQLException. This exception occurs two times in the log file. Click the exception to use it to narrow your search.



V11.2

EXemp


ty__ 22. Click java.sql.SQLException, which adds the text to the search criteria. Click Search.

The log is now filtered to just these two error messages.

__ 23. Click the Grid View icon.



V11.2

EXemp


ty__ 24. Scroll to the right and look for the following information:

- The time stamp field shows that the two messages were generated at almost the same time. - The Java exception is the same, but the method and class names are different. - The log messages in the logRecord field are slightly different, but they still point to the same

exception.

__ 25. Return to your original search and save it as a quick search.

__ a. Click the search drop-down list, select the asterisk, and click Search.

__ b. Click the Save icon.



V11.2

EXemp


ty__ c. Enter WAS_SystemOut for the name and click OK.

The search is configured for a relative time span of 1 year. The exact time period is determined when you run the search. The saved search has an option to fix the specific date range.

__ 26. Click the icon to open Saved Searches and double-click WAS_SystemOut.

The results of the original search open.

__ 27. Close the WAS_SystemOut search results page.



V11.2

EXemp


ty__ 28. Click OK to close the page.

__ 29. Use the WAS Errors and Warnings search dashboard to show a predefined dashboard based on the SystemOut log. This search dashboard is available as part of the WebSphere Application Server Insight Pack.

__ a. Click the icon to open Search Dashboards. Expand WASAppInsightPack. Double-click WAS Errors and Warnings.



V11.2

EXemp


ty__ b. Scroll down and examine the WAS Errors and Warnings page.

This page shows useful troubleshooting graphics, such as number of errors and warnings and top five message counts.

Important

This custom application is modified to show data for the previous year, instead of the previous day. This modification means that you can use static log files in this lab environment. In a production environment, you use a rotating copy of the most recent log file instead of a static one-time-use file.

__ 30. Click the X to close the WAS Errors and Warnings page.

The image is configured with sample data for the other two WebSphere log types. If time allows, feel free to repeat the previous exercise and examine the other log files.



V11.2

EXemp


tyTask 2 Analyzing DB2 logs

Operations Analytics Log Analysis provides prebuilt support to evaluate DB2 diagnostic log files.

Analyzing DB2 diagnostic log data

The following steps demonstrate how to use the prebuilt features of IBM Operations Analytics Log Analysis to evaluate the contents of a DB2 diagnostic log file.

__ 1. Copy the sample DB2 log file to the target directory by using the supplied script.

/software/log_samples/scripts/DB2_Logs.sh

Important

The sample log file data is taken from live systems. The date and time stamps in the log records do not reflect the current date and time. In a production environment, you typically search data by using a current time reference such as last hour or last day. To use the sample data, you must use a much older time reference.


You are currently logged in as the unityadmin user. If not, log in as unityadmin with password object00.

__ 3. Click New Search or Add Search.

__ 4. Define the search as in the previous exercise.

__ a. Select DB2DIAG as the data source.

__ b. Select Last Year for the time.

__ 5. Click Search.



V11.2

EXemp


tyYou defined a search of only DB2DIAG records for the previous calendar year. After a short time, the results show in the window.

The previous calendar year has more than 1600 DB2 diagnostic log records. All these records are contained in the log file sample that you copied in the previous exercise. The values that are listed under Search Patterns represent the text in the log file that is unique to the DB2 diagnostic log file. The numbers in parentheses represent the number of unique text values that matched the corresponding pattern.

Dashboard pages contain charts that show log data. You can create charts and dashboards from any log file. In this example, you use a DB2 log file.

6. Create a dashboard page with two charts that show data from the DB2 log.

__ a. Configure the first chart to show the number of messages by process name. Click the Grid View icon.



V11.2

EXemp


ty__ b. Scroll to the right and locate the processName column. Click the column title to select the

column, and click the plot icon.

__ c. Select Generate Counts and click Plot Chart (Current Page Data).

__ d. Edit the chart by clicking the Settings icon at the upper-right portion of the chart.



V11.2

EXemp


ty__ e. Enter Messages by process name for the title, select Simple Bar Chart, and click Render.

__ f. Click the Create New Dashboard icon at the top of the chart.

__ g. Enter DB2_Dashboard for the dashboard name and click OK.

__ h. Click the X to close the chart page. After you close the chart page, you return to the search results.



V11.2

EXemp


ty__ i. Create the second chart. Scroll in the search results and select these two column titles:

databaseName and diagnosticLevel. Use the Ctrl key to select multiple columns. Click the Plot Column icon.

Note

If you click the databaseName column first, it is used as the x-axis of the chart.

__ j. Select Generate Counts and click Plot Chart (All Data).

__ k. Edit the chart by clicking the Settings icon at the upper-right portion of the chart.



V11.2

EXemp


ty__ l. Change the title to Diagnostic level by database. Change the chart type to Stacked Bar

Chart. Click Render.

__ m. Click the Add Chart icon at the top of the chart.

__ n. Select /Dashboards/DB2_Dashboard and click OK.

Note

If you want to use a fixed time period, you can select the check box. If the check box is not selected, the chart uses the relative time period of when the search is done, for example, last week.



V11.2

EXemp


ty__ o. Click the X to close the chart page.

__ 7. Test the dashboard:

__ a. Click the icon to open Search Dashboards. Expand Dashboards and double-click DB2_Dashboard.

__ b. Verify that both charts are on the dashboard page.

__ 8. Click the X to close the dashboard page.



V11.2

EXemp


ty__ 9. Use the DB2 Troubleshooting search dashboard to show a predefined dashboard based on the

db2diag log. This custom application is available with the product.

__ a. Click the icon to open Search Dashboards. Expand DB2AppInsightPack and double-click DB2 Troubleshooting.

The dashboard results open.

Important

This custom application is modified to show data for the previous year, instead of the previous day. This modification is made so that you can use static log files in this lab environment. In a production environment, you use a rotating copy of the most recent log file instead of a static one-time-use file.

__ b. Close the DB2 Troubleshooting tab.

__ c. Close the DB2 Dashboard tab.

__ d. Close the DB2_Diag tab.



V11.2

EXemp


tyTask 3 Analyzing web server access logs

Operations Analytics Log Analysis can analyze web server access log files, including logs from Apache/IBM HTTP Server, Tomcat, and JBoss. The product captures data for client IP, response time, response code, URI, bytes received, and other data. You can search through this data in the user interface.

In this exercise, you use a sample file from an IBM HTTP Server log file.

Analyzing web server access log data

The following steps demonstrate how to use the prebuilt features of IBM Operations Analytics Log Analysis to evaluate the contents of a web server access log file.

__ 1. Copy the sample web server log file to the target directory by using the supplied script.

/software/log_samples/scripts/Web_Logs.sh

Important

The sample log file data is taken from production systems. The date and time stamps in the log records do not reflect the current date and time. In a production environment, you typically search data by using a current time reference such as last hour or last day. To use the sample data, you must use a much older time reference.

__ 2. Click Add Search.

__ 3. Define the search as in previous exercises.

__ a. Select IHS_Access as the data source.

__ b. Select Last Year for the time.



V11.2

EXemp


ty__ 4. Click Search. You defined a search of only web server records for the previous calendar year.

After a short time, the results show in the window.

The previous calendar year has over 5000 web server records. All these records are contained in the log file sample that you copied in the previous exercise. The values that are listed under Search Patterns represent the text in the log file that matched preconfigured patterns. These patterns are unique to the web server log file. The numbers in parentheses represent the number of unique text values that were found for the corresponding pattern.

__ 5. Filter the log file to show only a single client IP:

__ a. Expand clientIP and click 10.10.151.173 to add the value to the search criteria.

__ b. Click Search.



V11.2

EXemp


tyYou quickly filtered the log to show only messages that contain a single IP address.

__ 6. Examine the response time values.

__ a. Click the Grid View icon.

__ b. Scroll to the right and locate the responseTime column.



V11.2

EXemp


ty__ c. Click the arrow to sort the contents in ascending sequence.

__ d. Click the arrow again to sort the contents in descending sequence.

Each value in the list is a unique response time. By scrolling through the list, you can quickly determine the high and low values for response times.

__ 7. Log out of Operations Analytics Log Analysis.


Summary

In this lab exercise, you learned how to use Operations Analytics Log Analysis to do the following tasks:

• Analyze WebSphere logs

• Analyze DB2 logs

• Analyze web server access logs

• Do custom searches

• Create custom charts

• Create custom dashboards

• Use the supplied troubleshooting features



Unit 18.Seasonal events

Event Analytics provides users with the ability to identify seasonal patterns within their monitored environment. Event Analytics uses statistical analysis of Netcool/OMNIbus historical event data to determine the seasonality of events, such as when and how frequently events occur. The results are presented in report and graphic format.

Event Analytics users can use the data that is presented in the event seasonality reports to identify seasonal event patterns within their infrastructure. For example, an event that periodically occurs at an unscheduled specific time is highlighted. Using the information that is provided by the seasonality reports, network, device, or suppression rules can be formed to reduce the number of events that occur.

Task 1 Verifying configuration objects


__ 2. Log in to Dashboard Application Services Hub as user ncoadmin with password object00.

Review the Seasonal events configuration objects in Impact.

__ 3. Click the icon to open the Netcool/Impact console.

__ 4. Select the Global project and select the Data Model tab.



V11.2

EXemp

Unit 18. Seasonal events

ty

Note

The Seasonal event feature uses the same data model and data type for the event archive as the related events feature. If you already verified access to the archive in the previous unit, you can skip these steps.

__ 5. Click ObjectServerHistoryDB2ForNOI to select it, and click the pencil icon to open the entry for edit.

__ 6. Examine the database user ID and password values.

__ 7. Scroll down and examine the host name and port number. Click Test Connection to verify connection to the historical event repository.



V11.2

EXemp


ty__ 8. Verify that the connection is successful and close the window.

__ 9. Click the X to close the data source edit page.

Important

The Related Events and Seasonality features use the same Impact data source for access to the event archive database.

__ 10. Select the Seasonality project.

__ 11. Click OK to continue.



V11.2

EXemp


ty__ 12. Select the Services tab.

Seven services are required for seasonality. Six of the services must be running for the feature to work. The green check marks indicate that the services are running. The StartSeasonalityProcessing service should be red.

Hint

If any required service is not running, right-click the service and select Start.

__ 13. Click the X to close the Impact console page.

Task 2 Working with seasonal events

The first step is to do an analysis of the event history database to identify potential seasonal events.



V11.2

EXemp


ty

Note

You use the same process to evaluate the event archive for related events. If you want, you can configure one analysis to evaluate the event archive for both features at the same time.

__ 1. Click the icon and select Configure Analytics.

The Configure Analytics window opens.

__ 2. Click the icon to create a new analysis.

__ 3. Configure the rule settings.

__ a. Enter SE_Workshop for the name.

__ b. Select 60 Months for the date range.

__ c. Enter Severity >= 3 and AlertGroup like '%ITM%' for the filter.

__ d. Select Seasonal event analytics.

__ e. Verify that Related event analytics is not selected.



V11.2

EXemp


ty__ f. Click Save and Run.

The workshop image contains a collection of historical event records. These records are taken from a lab environment and are old. In a production environment, you typically do this type of analysis based on more recent data.

You select events where Severity >= 3 because you want events that constitute an issue. You limit the events based on the AlertGroup column to only IBM Tivoli Monitoring events.

Impact schedules the associated policies to process the rule and sets the phases to Waiting to run.



V11.2

EXemp


tyAfter a short time, you see the phase change to indicate that the analysis is started.

Important

The archive database contains over 1 million records. The analysis runs for several minutes.

The Seasonal analysis is complete.

__ 4. Click the icon and select View Seasonal Events.

The results of the event analysis open in a new page.



V11.2

EXemp


ty__ 5. Examine the results.

The Configuration section lists the configurations that detected seasonal events. The information includes the number of events that are designated as seasonal.

The right side of the page lists every unique event that is considered seasonal.

Important

An event is determined to be unique based on the value of the Identifier field. The Identifier column is the default configuration, and you can change it.



V11.2

EXemp


ty__ 6. Right-click any event record and select Show Seasonal Event Graphs.

The results open in a new tab.

The results are presented in four graphs:

• Minute of the hour

• Hour of the day

• Day of the week

• Day of the month

The results are color-coded based on the statistical confidence that the event is considered seasonal. In the example that is shown here, the graphs for Minute of the Hour and Hour of the Day are labeled in red. The color red is an indication of a high statistical confidence that this event repeats consistently based on minute and hour. The Day of the Week graph is labeled in yellow. The yellow color is an indication that the event most likely repeats consistently on Sundays. The



V11.2

EXemp


tyDay of the Month graph is labeled green. The green is an indication that the event does not appear to repeat consistently on any day of the month.

Users can use the output in these graphs for several purposes.

• Validate expected behavior.

In most production environments, some events occur in a pattern. For example, server instrumentation might indicate excessive disk I/O activity at the same time every night. Disk backups are the cause of this known condition. You can use seasonal reports to verify that the activity occurs as expected.

• Identify unexpected behavior.

Given the same scenario that was presented previously, a seasonal report can identify those periods where excessive disk I/O occurs during times that are outside normal backup windows.

The seasonality feature provides a number of tools that can be used to investigate the event records.

__ 7. Click the bar for hour 9 to select it. Click the arrow next to Actions and select Show Historical Events for Selected Bars.

The results open in a new tab.



V11.2

EXemp


ty__ 8. Examine the values for FirstOccurrence.

The events occurred on different days, but always at 9:00 AM.

__ 9. Click the X to close the HistoricalEvents tab.

__ 10. Click the X to close the SeasonalEventGraph tab.

After evaluating the event results, the administrator can decide to do some automated action for one or more identified events.

Task 3 Creating a seasonal event rule

You can use seasonal event rules to apply an action to specific events. You can apply actions to a selected seasonal event, or to a seasonal event and some or all of its related events. You can use seasonal event rules to apply actions to suppress and unsuppress an event, to modify or enrich an event, or to create an event if the selected event does not occur when expected.

In this exercise, you create a rule that generates an event when the seasonal event does not occur at the designated time. The seasonal event in this example is expected to occur on Sunday, at 9:00 AM. In a production environment, you use those parameters to create the rule. However, in the



V11.2

EXemp


tyworkshop environment you cannot use Sunday, or possibly even 9:00 AM. You must use a day and time that is close to the current day and time to observe the expected result.

__ 1. Open a Terminal window, and enter the date command to determine the current date and time.

In the example that is shown here, the current day of the week is Wednesday, and the current time is 19:55, or 7:55 PM. In the following steps, you create a rule that generates an artificial event if a seasonal event does not occur on Wednesday, at 20:05. You must allow some time to create and activate the rule.

__ 2. Right-click an event and select Create Rule.

__ 3. Enter SE_Workshop_Rule for the name.

__ 4. Click the arrow and select Day of Week.

__ 5. Click the arrow and select Is.

__ 6. Click the arrow and select Wednesday.

Important

You select the appropriate day of the week based on your local date and time.



V11.2

EXemp


ty__ 7. Click the green plus sign to add another rule.

__ 8. Click the arrow and select Hour of Day.


__ 10. Click the arrow and select 20.

Important

You select the appropriate hour of the day based on your local date and time.

__ 11. Click the green plus sign to add another rule.

__ 12. Click the arrow and select Minute of Hour.


__ 14. Click the arrow and select 5.



V11.2

EXemp


ty

Important

You select the appropriate minute based on your local date and time. Make sure to select a value that is several minutes in the future. You need time to complete the rule configuration.

__ 15. Scroll down in the window and locate the section for Actions When Event Does Not Occur.

__ 16. Select the option to create an event. Click Create Event.

__ 17. Enter SE_Auto for AlertGroup and Manager. Click OK.



V11.2

EXemp


tyYou use this window to configure how the artificial event is constructed. You can adjust the values for Summary, Severity, AlertGroup, and Manager. If you select Set additional fields, you can also set the values for more columns in the event record.

__ 18. Return to the Terminal window and repeat the date command.

Important

Make sure that the current time is not beyond the time that is configured in your rule.

__ 19. Click Deploy to activate the rule.

__ 20. Verify that the event shows that a rule exists.

__ 21. Click the icon and select Seasonal Event Rules.



V11.2

EXemp


ty__ 22. Verify that there is one Active rule.

__ 23. Return to the Terminal window, and repeat the date command until the current time exceeds the configured time in your rule.


__ 25. Click the blue arrows to refresh the view.

__ 26. Scroll to the right and verify that the rule generated an event.



V11.2

EXemp


ty__ 27. Click the icon and select Event Viewer.

__ 28. Click the icon to select only events with Severity of Major.

The artificial event that was created by the seasonality rule is displayed.

In this exercise, you created a rule to test for the absence of an event at a predetermined time. The process is the same to create a rule to suppress an event that occurs at a predetermined time.

If time allows, you can examine some of the other seasonal events.



Summary

In this lab exercise you learned how to do the following tasks:

• Verify Netcool/Impact connectivity to the event archive database

• Define and run a seasonality report

• Use the graphs to identify nonstandard behavior

• Create a rule to generate an event when a seasonal event does not occur as expected



Unit 19.Related events

You can use this feature to find events that tend to occur in groups or clusters so that, when identified, these groups can be consolidated as child events underneath a synthetic parent event. You can then use this additional information to enable operations to run more efficiently. For example, instead of opening individual tickets for child events, you can instead open just one ticket for the synthetically generated parent event, substantially reducing the number of tickets that need to be worked on.

Task 1 Verifying configuration objects


__ 2. Log in to Dashboard Application Services Hub as user ncoadmin with password object00.

Review the Related Events configuration objects in Impact.

__ 3. Click the icon to open the Netcool/Impact console.

__ 4. Select the Global project and select the Data Model tab.



V11.2

EXemp

Unit 19. Related events

ty__ 5. Click ObjectServerHistoryDB2ForNOI to select it, and click the pencil icon to open the

entry for edit.

__ 6. Examine the database user ID and password values.

__ 7. Scroll down and examine the host name and port number. Click Test Connection to verify connection to the historical event repository.



V11.2

EXemp


ty__ 8. Verify that the connection is successful and close the window.

__ 9. Click the X to close the data source edit page.

Important

The Related Events and Seasonality features use the same Impact data source for access to the event archive database.

__ 10. Select the Related Events project.

__ 11. Click OK to confirm the switch.



V11.2

EXemp


ty__ 12. Select the Services tab.

These two services must be running for the related events feature to work. The green check mark indicates that the service is running.

Hint

If either service is not running, right-click the service and select Start.

__ 13. Click the X to close the Impact console page.

Task 2 Working with related events

The first step is to do an analysis of the event history database to identify potential groups.

__ 1. Click the icon and select Configure Analytics.

The Configure Analytics window opens.



V11.2

EXemp


ty__ 2. Click the icon to create a new analysis.

__ 3. Configure the rule settings.

__ a. Enter RE_Workshop for the name.

__ b. Select 60 Months for the date range.

__ c. Enter Severity >= 3 and AlertGroup like '%ITM%' for the filter.

__ d. Verify that Seasonal event analytics is not selected.

__ e. Select Related event analytics.

__ f. Click Save and Run.



V11.2

EXemp


tyThe workshop image contains a collection of historical event records. The records are taken from a lab environment, and are old. In a production environment, you typically do the analysis based on more recent data.

You select events where Severity >= 3 because you want events that constitute an issue. You limit the events based on the AlertGroup column to only IBM Tivoli Monitoring events.

Impact schedules the associated policies to process the rule and sets the Phase to Waiting to run.

After a short time, you see the phase change to indicate that the analysis is started.

Important

The archive database contains over 1 million records. The analysis runs for several minutes.

The Related Event analysis is complete.



V11.2

EXemp


ty__ 4. Click the icon and select View Related Events.

The results of the event analysis open in a new page.

__ 5. Examine the results.

An event group is identified in one of five categories:

• New: Initial state when Impact identifies related event groups.

• Watched: The event group watches for new correlated events in the ObjectServer and collects statistics.

• Active: The event group watches for new correlated events in the ObjectServer, does correlation under a parent synthetic event, and collects statistics.

• Expired: Deployed event groups expire every 6 months by default, but remain active.

• Archived: An administrator moves a group to the archived state when the group is no longer needed.

The window has four major sections. The toolbar at the top shows the number of related event groups in each category. In the example that is shown here, all groups appear as new.



V11.2

EXemp


tyThe Configuration section lists the analysis results that contain related events. The information includes the number of event groups and how many events make up the event groups.

The Group Name section lists the different groups that are found for the rule that is selected in the Configuration section.

Selecting any event group displays the specific events that are part of that group in the right half of the screen.

In the example that is shown here, the group consists of seven events.

__ 6. Review the different event groups and the events that make up each group.



V11.2

EXemp


tyFor each event group, an administrator can take one of several actions. To see the options, right-click any event group name. If you choose the Mark as reviewed option, other product users or administrators know that someone reviewed the group rule.

You can choose to automatically deploy event grouping policies for the event groups that are detected. However, you typically review the groups to determine whether they should be deployed and set the event to use when creating the synthetic parent event for the group.

__ 7. Scroll down in the list of groups, and locate the group with 157 events.

Important

The event groups are not created the same for multiple runs. The results are the same, but the events that are related to a specific group name might not be the same. You need to select the group that contains the 157 events as shown on the following screen capture. When the workshop was created, the events were in RE_Workshop:4. In your workshop, the group might have a different name. You need the group that contains events for chianti.tivlab.raleigh.ibm.com.

You see on the right side of the screen the events that are grouped if this group is deployed.



V11.2

EXemp


ty__ 8. Right-click the group that is named RE_Workshop:4 and select Show Details.

The Related Event Details are shown. This view has two tabs, one named Events and one named Correlation Rule.

On the left side, the Events view lists all of the times that the analysis determined that this event group occurred. The analysis uses a window of time, and looks for events that occur within the window. The window is called an instance. You can see that this event group occurred six times, when it occurred, and how many events it had each time. The same events occurred in every time window. On the right side, the pivot event is highlighted. The pivot event is the event that the analytics determined to occur at a relative time of zero with respect to the group. The other events occur before or after this event. The pivot event is also used as the basis for the synthetic parent event that is created when the group is deployed. You can select a date and time instance on the left side, and the event listing information on the right is updated for that instance. The pivot event is the same for each group instance, but its place in the list and the associated zero-time changes as you select different group instances.

__ 9. Click the first date and time entry to select it.



V11.2

EXemp


tyThe events on the right side are limited to just the selected date and time period.

Important

Make a note of the group name. For this example, the group name is RE_Workshop:4. You use the name of your group that contains 157 events.

__ 10. Examine the event records.

Scroll down in the list, and locate the event that is outlined in red. This event is called the pivot event, and is considered the most likely cause for the other events in the group. The pivot event is used as the synthetic parent event that is inserted in the ObjectServer when the group is deployed.

__ 11. Right-click any event and observe the options.

You can change the event that is used as the basis for the synthetic parent event. If you think an event should not be automatically grouped with the others, you can also remove



V11.2

EXemp


tythat event from the group. Both of these actions can be taken by selecting an event, right-clicking, and selecting the related menu item.

__ 12. Close the Related Event Details tab by clicking the X on the tab.

__ 13. On the View Related Events tab, right-click RE_Workshop:4 and select Deploy.

Selecting Deploy causes Impact to provision the group and update its policies so that when these events occur, they are grouped as children of a synthetic parent event.

When the action is run, you see a green notice that pops up in the lower-right portion of the screen.

After the group is deployed, the group is removed from the New view and placed into the Active view.



V11.2

EXemp


ty__ 14. Click Active in the toolbar to see the deployed group.

The Active view shows how many times the event group rule fired, how many times it fired in the last month, and the last time it fired. These statistics are useful for determining the value of the event grouping rule. If the rule is not firing often, you might want to disable it.

__ 15. Close the View Related Events and Configure Analytics tabs by clicking the X on each tab.

Task 3 Viewing grouped events

After a related event group is deployed, Netcool/Impact processes events that arrive in the ObjectServer. Based on the deployed groups, Netcool/Impact creates a synthetic parent event for each event group. In addition, Netcool/Impact modifies related events and adds data to the event records. The additional data is used to group the event records under the synthetic parent event. The grouping is enabled by configuring an event view with a relationship. The relationship is a Web GUI object that is used by the Event Viewer to identify events that are related. The relationship is supplied with the Netcool Operations Insight solution.

To generate events that are grouped, you use a supplied script. When you run the script, you supply the group name. In the example that is used in this exercise, the group name is RE_Workshop:4.

__ 1. Open a Terminal window, and enter the following command:

/software/omnibus/events/gen_related_events RE_Workshop:4



V11.2

EXemp


ty

Important

Use the name of your group in this command.


__ 3. Click the icon and select Event Viewer.

__ 4. Click the arrow and select RelatedEvents for the filter. Click the arrow and select RelatedEvents for the view.

The Event Viewer has one event. The event is preceded with a plus sign (+), which indicates that the events are grouped. The event is the synthetic parent event that Netcool/Impact creates when the event group is deployed.



V11.2

EXemp


ty__ 5. Click the plus sign to expand the event group.

The events below each parent event are real ObjectServer events. In this example, the script generates the events.

Observe the values for ParentIdentifier. The same values are listed in each child event. The ParentIdentifier value is added to the events by Netcool/Impact, and is used to group the events under the synthetic parent event.

Observe the probable cause for the group.

The event analytics calls out the probable cause of the event group in the Summary of the synthetic parent event.

__ 6. Click the icon and select View Related Events.



V11.2

EXemp


ty__ 7. Click Active to view the statistics for the active group.

The statistics capture how many times the Impact correlation policy is activated for this group, and what percentage of events are processed. In this example, the correlation policy ran one time. The policy ran when the artificial events were generated. The percentage of events is nearly 100% because the supplied script generated every possible event in the group. In a production environment, the administrator examines these values to determine whether new events belong to a deployed group, and what percentage of the events in the group occurred.



The typical work flow when using the related events feature is as follows:

• An administrator creates an event grouping rule by using the Configure Analytics page. The rule runs periodically and Netcool/Impact evaluates the recent history of events in the archive database. Based on this analysis, one or more event groups are created.

• An administrator reviews each event group and determines whether the group is valid. The administrator deploys one or more groups.

• When a group is deployed, Netcool/Impact creates a synthetic parent event for the group and sends the event to the ObjectServer. Netcool/Impact also implements a policy that evaluates new ObjectServer events and determines whether the events are associated with a deployed group. If the events are associated with a deployed group, Netcool/Impact enriches the events with relationship information and collects statistics.

• A Netcool/OMNIbus user monitors events with the Event Viewer. The Event Viewer is configured to group events based on a defined relationship. The user sees events that are grouped based on the Netcool/Impact analysis and enrichment.



V11.2

EXemp


ty • An administrator periodically reviews the statistics for deployed groups, and evaluates whether

the groups are effective or not. Based on the analysis, the administrator might archive a group, which deactivates the Netcool/Impact processing.

• Netcool/Impact does new analysis of the event history periodically, and the entire process repeats.

When you establish confidence with the rules and generated groups, you might want all the generated groups to be automatically deployed in the future.

Summary

In this lab exercise, you learned how to do the following tasks:

• Create a related events configuration and run the configuration

• Review the results of the event analysis

• Deploy a related events group

• Create an event view with the IBM Related Events relationship configured

• Use the Event Viewer to view grouped events

If time allows, you can examine other event groups. You can repeat these steps to deploy more groups. You can run the supplied script to generate artificial events for each deployed group and observe the results in the event viewer.




© Copyright IBM Corp. 2017

Unit 20.Optical transport and Radio Access Networks


®

© Copyright International Business Machines Corporation 2017.

V11.0

backpg

Documents

Course Guide · Your new filter is listed in the list of the filters. Important Never put a space character in the filter name. The database interprets a space as a delimiter character