|
|
|
An event detector defines the network and systems events that you want to monitor, and what to do when the event occurs.
You can define an alert to raise, and you can define the wording of the alert. You can also define an automatic action to run.
Sample event detector definitions are supplied. Each type of event is represented in the samples. Use these definitions as examples when you create your own event detectors.
The following types of event detectors are available:
Monitors Cisco channel card TN3270 log messages.
Monitors connections.
Monitors the status of TCP connections.
Monitors system console messages.
Monitors custom events.
Monitors IP packet fragmentation.
Monitors FTP failures.
Monitors ICMP messages.
Monitors listening ports.
Monitors connection attempt failures due to a listener port not being active.
Monitors RTP pipe congestion.
Monitors Secure Sockets Layer (SSL) handshake failures.
Monitors TCP connections that a server resets.
Monitors the end of TCP connections by reason codes.
Monitors the start of TCP connections.
Note: The CONNECT and LISTENER detectors operate by polling, as determined by the IPTIMING parameter group.
To specify the type of event that you want to monitor, define an event detector.
Follow these steps:
The Event Detectors Controls List appears.
The Valid Value List appears.
The corresponding detector definition panel appears.
Briefly describes the event detector. This description appears on the Event Detector Controls List. Use this description in your own documentation.
Specifies whether this rule detects events. Making a detector inactive means that you can keep a definition, but not have it checked.
The new detector is added.
Event criteria define the conditions that trigger the alert, the actions, or both.
Follow these steps:
The corresponding criteria panel appears.
Note: For more information about the fields, press F1 (Help).
The event criteria are saved.
After you define the conditions that cause the alert, define the actual alert, for example, the type and severity. If you do not want to raise an alert, specify 0 for severity.
Follow these steps:
The Alert Definition panel appears.
Note: For some detector types, this panel contains only the Description and Severity fields.
Note: For more information about the fields, press F1 (Help).
The alert details are saved.
After you define the alert criteria and the alert, you can define an action that happens automatically when the event criteria is satisfied.
Follow these steps:
The Available Actions panel appears.
An action-specific details panel appears.
Note: For more information about the fields, press F1 (Help).
The selected action is added.
The details are saved.
You can set up event detectors to poll connection information at defined intervals and to create alerts according to the criteria that you define.
Use IP connection event detectors to detect long-running problems, such as connections that have been idle or in a wait state for a long time.
Note: IP connection detectors do not detect every connection in real time. They run a NETSTAT command at regular intervals and scan the output for connections that match your criteria. Because this uses a polling mechanism, connections may start and end between each polling interval; therefore, some connections are not found.
You can use combinations of any of the following as criteria for a connection detector to create an alert:
To define an IP connection detector, you perform the steps to define an event detector and select CONNECT as the Alert Detector Type.
Note: Before you set up an event detector for connections, use the TCP/IP : Connections Menu to find the connection that you want to monitor, and note the values displayed in the various columns.
Example: Define an IP Connection Detector
This example shows how to define an event detector that drops FTP data connections that have been idle for more than 10 minutes.
To define the IP connection detector
The Event Detectors Controls List appears.
The CAS : Valid Value List appears.
The Connection Detector panel appears.
Briefly describes the event detector.
Note: This description appears on the Event Detector Controls List. Use this in your own documentation.
Specifies whether this rule detects events.
The TCP/IP : Connection Criteria panel appears.
PROD--------------------- TCP/IP : Connection Criteria ------------------------ Command ===> Short Description Drop FTP Data Connections Status ACTIVE Task Name ........ FTPSRV TCP Status ....... Bytes In+Out Over Foreign Host ..... Foreign Port ..... Local Host ....... Local Port ....... 21 Idle Time Over ... 00:10 (hh:mm) Note: Generic values may be used. Field values are as shown on connection list F1=Help F2=Split F3=OK F9=Swap F12=Cancel
The TCP/IP : Connection Detector panel appears.
The Available Actions panel appears.
The Run Command Details panel appears.
PROD---------------- Alert Monitor : Run Command Details ---------------------- Command ===> Short Description ...... Drop FTP Data Connections Command & Parameters ... NETSTAT DROP &$IPCONNID Command Parameters ..... F1=Help F2=Split F3=File F9=Swap F12=Cancel
The Alert Automated Actions panel appears, with RUN-COMMAND added to the list of actions.
The TCP/IP : Connection Detector panel appears.
The IP connection detector is saved.
FTP failures detected by the FTP logging function can be declared as alerts. An FTP is considered to have failed if there is a response code of other than 0 or 250 in the FTP client or server event.
You can detect FTP failures that match the following conditions:
To define an FTP failure detector, you perform the steps to define an event detector and select FTPFAIL as the Alert Detector Type.
Example: Define an FTP Failure Detector
This example shows how to create an alert if the receipt of a production data set fails.
To define an FTP Failure detector
The Event Detectors Controls List appears.
The CAS : Valid Value List appears.
The FTP Failure Detector panel appears.
Briefly describes the event detector.
Note: This description appears on the Event Detector Controls List. Use this in your own documentation.
Specifies whether this rule detects events.
The FTP Failure Criteria panel appears.
PROD------------------- TCP/IP : FTP Failure Criteria ------------------------- Command ===> Short Description ..... FTP Failure Status ACTIVE FTP Command ........... STOR (*, Retr, Stor, Appe, Delete, Rename) Remote IP Address ..... Dataset Name(Member) .. PROD.ERROR.LOG Server Job Name ....... F1=Help F2=Split F3=OK F9=Swap F12=Cancel
The FTP Failure Detector panel appears.
The Alert Definition panel appears.
The FTP Failure Detector panel appears.
The details are saved.
CA NetMaster NM for TCP/IP can detect z/OS console messages issued by a specific job name, generic job name, or the TCP/IP stack. You can specify extended message text matching, not only the message number.
You can update or replace alerts, as well as raising a new alert each time a message is received.
Note: For an example of how to clear an alert when a corresponding OK message is detected, see the SAMPLE: SYSVIEW... console detectors.
To define a console message detector, you perform the steps to define an event detector and select CONSOLE as the Alert Detector Type.
Example: Define a Console Message Detector
This example shows how to create a severity 4 alert when message M123 PROCESSING COMMAND occurs for commands VARY and STATUS, for jobname TCPIP1.
To define a console message detector
The Event Detectors Controls List appears.
The CAS : Valid Value List appears.
The Console Message Detector panel appears.
Briefly describes the event detector.
Note: This description appears on the Event Detector Controls List. Use this in your own documentation.
The Console Message Criteria panel appears.
PROD----------------- TCP/IP : Console Message Criteria ----------------------- Command ===> Short Description ..... PROCESSING COMMAND______________ Status ACTIVE__ Console Message Details Text... M123 PROCESSING COMMAND:______________________________________________ Jobname TCPIP1__ (Enter * for TCPIP Started Task) Extended Message Filtering Strt Word Scan Pos Num Opr Text 1 1__ 4__ EQ_ VARY_________________________________________________________ 2 15_ 5__ EQ_ STATUS_______________________________________________________ 3 ___ ___ ___ _____________________________________________________________ 4 ___ ___ ___ _____________________________________________________________ 5 ___ ___ ___ _____________________________________________________________ Expression ..... _____________________________________ e.g. 1 and (2 or 3) F1=Help F2=Split F3=OK F9=Swap F12=Cancel
The Console Message Detector panel appears.
The Alert Definition panel appears.
The Console Message Detector panel appears.
The console message detector is saved.
| Copyright © 2012 CA. All rights reserved. |
|