Event Management and Best Practices

338 Event Management and Best Practices

Best practices customization

To meet best practices, modify the supplied maintenance rule so that events

received from devices in maintenance mode are placed in an acknowledged or

user status, rather than closed or dropped. When the device comes out of

maintenance, either by posting an event or by the duration expiring, reprocess

the events and report any outstanding events as problems.

6.9 Automation

As discussed in 2.11.2, “Automation implementation considerations” on page 80,

you must keep in mind several things when selecting the best tool for executing

an automated action. This section describes the features of various Tivoli

products that help to perform automation. It also provides guidelines on when

and how to use these products.

6.9.1 Using NetView for automation

NetView is an SNMP-based application used to manage IP networks and

devices. It can issue SNMP commands to track the status of network devices and

to perform actions upon them. By integrating with IBM Tivoli Switch Analyzer and

Generate the maintenance mode

stop event

Knowledge base update and

previous host name in

maintenance mode taken out

Knowledge base was updated

and host name was taken out

Send an event from the same host

name after the maintenance mode

stop event

Event would appear in open

status as normal

Event appeared as normal

Generate the maintenance mode

start event for five minutes in the

future

Update to knowledge base Knowledge base updated

Send an event before the five

minutes specified

Event would appear in open

status as normal

Event appeared as normal

Send an event after the five minutes

specified

Event to be in closed status Event appeared in a closed

status

Generate a maintenance start event

for a five minute duration

Update to knowledge base Knowledge base was updated

Send an event after the five minute

duration

Event would appear in open

status as normal

Event appeared as normal

Test Expected Actual

Chapter 6. Event management products and best practices 339

third-party management applications, NetView extends its management

capabilities to layer 2 devices. It enhances its automation functionality with the

commands supplied by third-party software.

NetView is an ideal tool to use to perform automation on networking devices by

using SNMP commands and those supplied by integrated management

applications. It can also be used to trigger the automated actions in response to

an event or trap.

At this point, we must differentiate between executing automated actions and

triggering them.

Executing automated actions implies running a command or

series of commands.

Triggering automated actions responds to an event and

sets off a course of actions that culminates in the execution of the automated

action. The machine that triggers the action may not be the one to execute it. For

example, NetView may send a trap to the Tivoli Enterprise Console as an event.

IBM Tivoli Enterprise Console may perform some correlation and determine an

action that is required for the event. IBM Tivoli Enterprise Console may run a

Tivoli Framework task against the NetView machine, causing it to perform an

SNMP set command on a networking device. In this case, IBM Tivoli Enterprise

Console triggers the automated action in response to the event, but the NetView

machine actually performs it.

In general, you execute the required commands as close as possible to the

device requiring action. Keeping the path between the management station and

the device short minimizes the likelihood that the command, or its response, will

be lost or that the communications path will be unavailable. For most networking

devices, the NetView management server is the point closest to the device at

which automated actions may be executed.

Also, trigger the action from the closest point at which all necessary events are

available for correlation. This ensures that an accurate decision can be made

concerning the need to take action for the events. If the determination to

automate can be made at NetView, trigger the actions from NetView. Otherwise,

initiate them from IBM Tivoli Enterprise Console or another event processor at

which all relevant events are received.

There are several ways to use NetView to execute and trigger automation. These

are covered in the following section.

Executing commands from trapd.conf

If an action is desired every time a trap is received, NetView can be configured to

respond by placing the command in the /usr/OV/conf/C/trapd.conf file. This

approach is often used to execute commands that run quickly and scripts that

issue user defined SNMP traps. For example, sometimes business impact

managers rely on additional information that is not present in the original traps