How do I forward events and incidents from Entuity to the BMC TrueSight Operations Management Events integration?

 

To set up event forwarding

To set up incident forwarding

To forward events and incidents to multiple servers

To check forwarding performance

To configure the incident forwarding callback URL

To access event and incident details on the originating Entuity server

To amend Entuity server URL details

To deploy the event draft project

To merge the event draft project with an existing project

 

 

Events are forwarded to BMC TrueSight Operations Management via the Entuity Event Management System (EMS). By default, the event URL will include the details of the Entuity server that originally raised the event.

 

 

To set up event forwarding:

You can forward events to the BMC TrueSight Operations Management Events integration by setting up an Event Rule:

1. In the Entuity UI , click Main Menu and then click Administration.
2. Click Event Administration. Click the Rules tab.
3. Ensure the Post Storage option is selected in the left pane. Click Add Rule... at the bottom of the browser. This will open the Add Rule window.
4. Ensure the Type field is set to Generic, and that the enabled box is ticked.
5. Enter appropriate name and description in the Name and Description fields.
6. Leave the Condition field as None.
7. In Action Steps, click Add and set the Type to Send to BMC Event Manager. Select the cname parameter and click Set, followed by OK.
8. Click OK again to save and add the rule. The rule will forward all events to the TrueSight Operations Management server and cell defined through configure. You can Edit the rule filter to control the events forwarded and specify alternative receiving TrueSight Operations Management servers in the section described in Step 7 above. To do so, enter the connection name within the single quote marks as they are defined in bem-connections.cfg. Please see this article for further help and information on configuring additional servers and cells for incident and event forwarding.

 

 

To set up incident forwarding:

You can forward incidents to the BMC TrueSight Operations Management Events integration by setting up an Event Trigger. You can configure a global trigger so all incidents are forwarded to the server, or triggers against individual incidents to forward only those incidents.

1. In the Entuity UI , click Main Menu and then click Administration.
2. Click Event Administration. Click the Incidents tab.
3. Click Edit Global Triggers at the bottom of the browser. This will open the Edit Global Triggers window. Click Add... to open the Create Trigger window.
4. Enter name and description in the Name and Description fields.
5. To ensure all incidents raised against the same source are sent to TrueSight, ensure the On Transition To field is set to "Any Change".
6. In the Condition dropdown field, select "All tests must succeed".
7. Click Add to add a conditional test. Set Type to "Incident Severity Test". Set Expression to the severity level you wish to forward, and click OK.
8. In Action Steps, click Add and set Type to "Send to BMC Event Manager". Select the cname parameter and click Set, followed by OK.
9. Click OK again to save and add the trigger. The rule will forward all incidents to the TrueSight Operations Management server and cell defined through configure. You can Edit the trigger to control the incidents forwarded and specify alternative receiving TrueSight Operations Management servers in the section described in Step 8 above. To do so, enter the connection name within the single quote marks as they are defined in bem-connections.cfg. Please see this article for further help and information on configuring additional servers and cells for incident and event forwarding.

 

 

To forward events and incidents to multiple servers:

By default, Entuity forwards events and incidents to the TrueSight Infrastructure Management Server and cell defined through configure. You can specify additional TrueSight Infrastructure Management Servers and cells through entuity_home\etc\bem-connections.cfg. You can then refer to these definitions when setting up triggers and rules to respectively forward incidents and events.

When forwarding incidents and events to multiple BMC event managers, you must still define a target TrueSight Infrastructure Management Server and cell through configure. If you do not, then Entuity ignores any additional servers and cells defined through bem-connections.cfg, and does not forward any incidents and events to TrueSight Infrastructure Management Servers.

Please see below the specifications for the following example:

• forwards all incidents of severity level Severe or higher to TrueSight Infrastructure Management Server bppm by using a Global Trigger with the Send to BMC Event Manager action.
• forwards events to TrueSight Infrastucture Management Server bppm2 by using a rule with the Send to BMC Event Manager action.
• through entuity_home\etc\bem-connections.cfg, defines the target TrueSight Infrastructure Management Servers and cells. Entuity includes a template file, entuity_home\etc\bem-connections-example.cfg, which you can copy and rename to bem-connections.cfg.
• requires a target TrueSight Infrastructure Management Server.

Entuity Support recommends developing forwarding rules that rely on incidents raised by Entuity. Alternatively, you could setup event forwarding, but you are forfeiting the benefits of the incident handling mechanism. What you should avoid is forwarding a combination of events and incidents to the same TrueSight Infrastructure Management Server cell.

To forward incidents and events to multiple servers:

1. Through entuity_home\etc\bem-connections.cfg, define the two target TrueSight Infrastructure Management Servers and cells:
   

   [connection BEM1]
   cellname=pncell_bppm
   webServerHostName=bppm
   webServerPortNumber=9080
   webServiceName=ImpactManager
   [connection BEM2]
   cellname=pncell_bppm
   webServerHostName=bppm2
   webServerPortNumber=9080
   webServiceName=ImpactManager

   It is the connection names, BEM1 and BEM2, that are used when configuring the Send to BMC Event Manager action.
   Changes to bem-connections.cfg are only discovered by Entuity after a restart (you do not have to run configure unless you want to amend the default TrueSight Infrastructure Management Server settings that are set through configure).
2. Access the Event Management System to define incident and event forwarding.
   Click Main Menu > Administration > Event Administration.
3. Define the forwarding of incidents with a severity level of Severe or higher to server bppm.
   Click Incidents tab and then Edit Global Triggers and click Add.
4. Enter the trigger name and description, set Conditions to All tests must succeed and then click Add to define the condition test.
5. Set Type to Incident Severity Test, Expression to Severe or higher, and click OK.
6. In Action Steps, click Add and set Type to Send to BMC Event Manager.
   Select the cname parameter, click Set and enter the connection name as defined in bem-connections.cfg within the single quote marks:
   ’BEM1’
   If you do not enter a value in cname, leave it with its default single quotes, then Entuity uses the TrueSight Infrastructure Management Server details entered through configure.
7. Close and save your changes by clicking OK to the open dialogs.
8. To define event forwarding click the Rules tab, select Post Storage and click Add Rule. Enter the rule name and description.
9. In Action Steps click Add and set Type to Send to BMC Event Manager. Select the cname parameter, click Set and enter within the single quote marks the connection name as defined in bem-connections.cfg:
   ’BEM2’
   If you do not enter a value in cname, leave it with its default single quotes, then Entuity uses the TrueSight Infrastructure Management Server details entered through configure.
10. Close and save your changes by clicking OK to the open Event Management System dialogs.
11. Your changes are not applied to the Event Management System until you save and deploy the project.
    Click the Save and Deploy icon, enter a meaningful description of your updates, and click OK.

 

 

To check forwarding performance:

Entuity includes log files through which you can monitor and troubleshoot incident and event forwarding. The three log files are available from entuity_home\log.

BemEventEngine.log

BemEventEngine.log identifies the configuration file used and the set TrueSight Infrastructure Management Servers and cells. The following example identifies the connections file used and connection details of the two TrueSight Infrastructure Management Servers and cells:

07/15/2014 16:24:07 INFO com.entuity.bem.eventsengine.ConfigFactory
- Found bem-connections.cfg file. Will use it.
07/15/2014 16:24:20 INFO com.entuity.bem.eventsengine.BemConnection
- Looking for cell: pncell_bppm-2. Get CellInfo from iiws on server:
bppm-2. Total cell entries: 1
cell pncell_bppm-2 mc bppm-2
07/15/2014 16:24:20 INFO com.entuity.bem.eventsengine.BemConnection
- Looking for cell: pncell_bppm-9-5. Get CellInfo from iiws on server:
bppm-9-5. Total cell entries: 1
cell pncell_bppm-9-5 mc bppm-9-5

The following example identifies a failed connection which may be through a BEM server and cell not being defined in configure:

WARN com.entuity.events.engine.util.bemsender.MisconfiguredBemSender - BEM could not be configured or the Integration module for BMC ProactiveNet Performance Management is not enabled.

BemEventEngineSent.log

BemEventEngineSent.log lists the incidents and events that Entuity forwarded, including the details sent for the TrueSight Infrastructure Management Server to handle, for example:

07/16/2014 14:47:32 INFO com.entuity.bem.eventsengine.BemEventEngineSentLog - The event has been sent to BEM (connection = 'BEM1'):
{mc_ueid=EYE.ENTLONPPVM01.MyNetwork.i133.4728, mc_long_msg=Device
Average Memory Usage High on bottom3550 - 46.047935%, critical
threshold 30%, msg=Device Average Memory Usage High on bottom3550,
severity=CRITICAL, mc_tool_sev=10, mc_tool=Eye of the Storm,
mc_tool_id=ENTLONPPVM01, mc_tool_address=10.44.2.58, mc_tool_-
class=Windows 7, mc_parameter=Device Average Memory Usage High, mc_parameter_value=1, mc_parameter_unit=i133, mc_incident_time=1405518450,
mc_object=bottom3550, mc_object_class=Device, mc_tool_key=133, mc_object_uri=http://ENTLONPPVM01/webUI/main.do?url=/webUI/objectSummary.do%3Fserver%3D205fbb05-9890-4bd3-bd62-
b359c35b3a83%26id%3D1268, mc_host=bottom3550, mc_host_address=10.44.1.12, eye_userId=admin, eye_impact_descr=, eye_stormworks_id=1268, eye_comp_id=4.6.0.0, eye_event_group=1,
eye_event_id=i655416, eye_view=All Objects}

BemEventEngineFailedSent.log

BemEventEngineFailedSent.log lists the incidents and events that Entuity failed to send.

 

 

To configure the incident forwarding callback URL:

1. You will need to change the callback URL to allow users to display event source component details in the Presentation Server, rather than the standard Entuity user interface. To do this, add the following parameters to the [bem] section of entuity_home\etc\entuity.cfg:
   

   ps_server_name=truesight_presentation_server_name
   ps_server_web_port=443
   incident_redirect
   event_ps_redirect_enabled

   • ps_server_name is the name of the TrueSight Operations Management Presentation Server where the Entuity Network Component is installed.
   • ps_server_web_port is the port number of the TrueSight server.
   • incident_redirect controls where incidents redirect to. The three potential options are:
     • ps_summary - the presentation server object summary.
     • ent_summary - the Entuity object summary.
     • incident_details - the new incident details dashboard. This is the default.
   • event_ps_redirect_enabled controls where events redirect to. 'true' means a redirect to the object summary on the Presentation server, 'false' means a redirect to the object summary on the Entuity server. The default is a redirect to the TSOM server.
2. After the parameters have been added to the entuity.cfg file, stop the Entuity server: entuity_home\bin\stopeye (entuity_home is the installation directory of Entuity)
3. Run entuity_home\install\configure.exe
4. After the configuration process has finished, start the Entuity server: entuity_home\bin\starteye

 

To access event and incident details on the originating Entuity server:

From the TrueSight Operations Management server, you can access event and incident details on the originating Entuity server through the object URL. To do this, the original URL supplied by the Entuity server must include the user credentials that would allow you access.

To set up user credentials, navigate to the bem section of entuity_home\etc\entuity.cfg:

[bem]
connection_username=admin
connection_view=All Objects

Where:

• connection_username is the Entuity user account used to access the Entuity server from the associated event or incident URL.
• connection_view is the Entuity View used to access the Entuity server from the associated event or incident URL available.

The conditions added to rules and triggers determine which events and incidents are forwarded to the TrueSight Operations Management server. For the associated URL to succeed, the connection_username and connection_view settings must allow access to the data associated with those events and incidents.

 

 

 

To amend Entuity server URL details:

By default, the event/incident URL provided by the Entuity server that forwards the event will include the details of the Entuity server that originally raised and forwarded it. However, you can amend the Entuity server URL details so that you can view the raised even through the Entuity consolidation server instead of the originating Entuity server.

To amend the Entuity server URL details, navigate to the bem section of entuity_home\etc\entuity.cfg:

[bem]
consolidation_server_name=entlonppvm01
consolidation_server_web_port=81

Where:

• consolidation_server_name is the resolved name of the Entuity consolidation server that you want to use to access the event or incident data. This replaces the name of the Entuity server that originally raised and forwarded the event/incident.
• consolidation_server_web_port is the port number of the Entuity consolidation server that you want to use to access the event or incident data. By default, it is port 80.

If the Entuity server that is forwarding events/incidents is using a non-default web port, you can also use consolidation_server_name and consolidation_server_web_port to amend the URL to use the non-default port. You must set both parameters even when the Entuity server remains the same.

 

After installing the patch, a new event project will be created as a draft in EMS. You will need to deploy the draft project or merge it with an existing project.

 

 

To deploy the event draft project:

1. In the Entuity UI, click Main Menu. Click Administration.
2. Click Event Administration. This opens the Event Administration page.
3. Click View all projects at the top of the page. This opens the Project History page.
4. Navigate to and select the draft project that you want to deploy, and click Deploy in the bottom right of the page. A confirmation window will then open, click Yes to deploy, otherwise click No.

 

 

To merge the event draft project with an existing project:

1. Navigate to the Project History page, as described above.
2. Navigate to and select both the draft project and the other project you want to merge together, using Ctrl and click.
3. Click Merge in the bottom right of the page. The Merge Project window will open.
4. Select a project to use as a base and click OK.
5. The merge utility compares both projects, and will highlight the changes. If there are any conflicts, the utility will ask you to select the required version of each conflict.
6. When you have resolved the conflicts, click the Save and deploy button in the top right of the page. This will open the Save and deploy window.
7. Enter a name for the merged project, and click OK.