IBM Tivoli Enterprise Console 3.8 GA

Transcription

1 IBM Tivoli Enterprise Console 3.8 GA

2

3 IBM Tivoli Enterprise Console 3.8 GA

4 !, 437. ( ) IBM Tivoli Enterprise Console( 5698-TEC) 3 8. Copyright International Business Machines Corporation All rights reserved.

5 ix ix ix IBM Tivoli Enterprise Console.. ix x x xi xii xii xii xiii xiii xiii BAROC BAROC UNIX... 38, exec_program exec_program_local exec_task exec_task_local UTF (facet) root.baroc tec.baroc BAROC BAROC BAROC Copyright IBM Corp iii

6 timer_info timer_duration BAROC add_to_repeat_count all_clear_targets all_duplicates all_instances any_clear_target any_clearing_event attr_condition attr_exception attr_sequence bo_add_at_slotval_begin bo_add_at_slotval_end bo_get_class_of bo_get_class_slots bo_get_enum_options bo_get_slotval bo_is_defined_for_class bo_is_direct_super_of bo_is_super_of bo_remove_from_slotval bo_reset_default_slotval bo_set_slotval cancel_all_timers cancel_timer change_event_administrator change_event_severity change_event_status check_all_thresholds check_and_increment_count check_event_criteria check_threshold iv IBM Tivoli Enterprise Console:

7 clear_closed_events clears commit_action commit_rule commit_set convert_ascii_time convert_gm_time convert_local_time create_cache_search_criteria create_clearing_event create_event_criteria create_event_sequence create_threshold decrement_slot drop_change_request drop_received_event erase_globals exec_program exec_program_local exec_task exec_task_local first_causal_event first_duplicate first_effect_event first_instance first_related_event forward_event generate_event get_attributes get_config_param get_global_grp get_global_var get_globals get_gm_time get_local_time get_time global_exists increment_slot init_count init_event_activity ip_node_unreachable is_clearing_event link_effect_to_cause load_globals log_error place_change_request print_cache print_class_tree print_event_activity re_after_match re_before_match re_create re_mark_as_modified re_match re_search_string re_send_event_conf re_split_event_id re_substitute re_substitute_global redo_analysis remove_bslashes reset_event_activity reset_global_grp resolve_time save_globals search_cache set_detailed_debugging set_event_administrator set_event_message set_event_severity set_event_status set_global_var set_log_error_source set_timer trace_it unlink_from_cause update_event_activity v

8 process_problem_events process_clearing_event , tec_agent_demo 263 tec_agent_demo tec_agent_demo SendEvents Netview TCP/IP NetView NetView NetView TEC_ITS_SA_Status NetView IBM Tivoli Switch Analyzer, Record Prolog policy UNIX Distributed Monitoring Distributed Monitoring vi IBM Tivoli Enterprise Console:

9 Prolog Prolog BAROC Prolog 333 Tivoli Enterprise Console Prolog Prolog I/O ( ) ( ) ( ) () * / // \== ( ) < = =:= =? =\= =< == > >= abolish append ascii assert atom atomic atomlength atompart atomconcat atomtolist compile consult delete disjoint empty_list fclose flisting fopen ground int_to_hex integer intersect inttoatom is is_list length lowertoupper member name nmember nmembers not number pointer pointeroffset pointertoatom vii

10 pointertoint printf read readln real( ) real( ) realtoatom reconsult remove_dups retract round rremove sort sprintf strip subset substring subtract term_type union write Tivoli Enterprise Console assert TEC_Start 435 Prolog Prolog viii IBM Tivoli Enterprise Console:

11 IBM Tivoli Enterprise Console IBM Tivoli Enterprise Console. Tivoli Enterprise Console.,. Tivoli Enterprise Console Tivoli Availability Intermediate Manager Tivoli Enterprise Console.. v UNIX Windows NT v Shell v Tivoli Enterprise Console IBM Tivoli Enterprise Console. Tivoli, Tivoli Tivoli. IBM Tivoli Enterprise Console Tivoli Enterprise Console. v IBM Tivoli Enterprise Console, GA v IBM Tivoli Integration Facility, GA v IBM Tivoli Enterprise Console, GA IBM Tivoli Enterprise Console,. v IBM Tivoli Enterprise Console, GA Copyright IBM Corp ix

12 IBM Tivoli Enterprise Console IBM Tivoli Enterprise Console,,.. v IBM Tivoli Enterprise Console, GA , IBM Tivoli Enterprise Console,. Tivoli Enterprise Console. v Tivoli Management Framework 3.6 v Tivoli Management Framework, 3.6 v Tivoli Management Framework, 3.6,,, policy region,,,. v IBM Tivoli Enterprise Console Tivoli Enterprise Console.. IBM Tivoli Enterprise Console., IBM. v Programming Rules for the Tivoli Enterprise Console IBM Tivoli Enterprise Console.,,,. Tivoli, v EMMD(Event Management and Monitoring Design Methodology) EMMD IBM. Tivoli Tivoli. EMMD Distributed Monitoring., x IBM Tivoli Enterprise Console:

13 IBM,,. IBM. v, BAROC $BINDIR/TME/TEC/ samples/correlation. v TEC Rule Writing by Example,. Orb Data Limited Giles McGarry PDF. v Clause and Effect: Prolog Programming for the Working Programmer, W.F. Clocksin, ISBN v Programming in Prolog, 4th Ed., W. F. Clocksin and C. S. Mellish, ISBN v Prolog Programming in Depth, M. A. Covington, D. Nute, and A. Vellino, ISBN X. Tivoli Glossary Tivoli. Tivoli Glossary. CD PDF HTML. CD infocenter.html. IBM Tivoli Information Center. Tivoli Tivoli Information Center. Tivoli Information Center PDF HTML.. : Letter PDF Adobe Acrobat ( --> ) Letter. xi

14 Tivoli,.. v : tivoli@kr.ibm.com. v : ( :, ). IBM Tivoli Enterprise Console. Tivoli, Tivoli. Tivoli Customer Support Handbook. Tivoli. v v v xii IBM Tivoli Enterprise Console:

15 ..,,,, URL.,... pk:dl:,. UNIX. Windows NT $variable %variable%, (/) (\). : Windows NT bash UNIX. (\).. xiii

16 xiv IBM Tivoli Enterprise Console:

17 1.. Tivoli Enterprise Console.., Tivoli Distributed Monitoring.. Tivoli Enterprise Console. ( ),,., IBM Tivoli Enterprise Console.,.,.. v :. v :. v :,. v :, ( ),., (UPS), Tivoli Enterprise Console. Copyright IBM Corp

18 ., Tivoli Inventory. 2. Tivoli Enterprise Console., MIB,. 3.. v, Tivoli Enterprise Console. v, Tivoli Availability Intermediate Manager Tivoli Enterprise Console. : Tivoli Availability Intermediate Manager Tivoli Enterprise Console Tivoli Availability Intermediate Manager Tivoli Enterprise Console Tivoli. Tivoli Availability Intermediate Manager. v. 4. Tivoli Enterprise Console Tivoli Availability Intermediate Manager,,,,,,. 5..,... 6., IBM Tivoli Enterprise Console:

19 , IBM Global Services. Distributed Monitoring. x. IBM Tivoli Enterprise Console......, =...,..,,. IBM Tivoli Enterprise Console., Event Integration Facility(EIF). IBM Tivoli Enterprise Console IBM Tivoli Enterprise Console. IBM Tivoli Enterprise Console Event Integration Facility..,.,.., BAROC(Basic Recorder of Objects 1 3

20 in C). BAROC IBM Tivoli Enterprise Console. 6. Windows NT Windows NT. Windows NT Windows NT., Tivoli ( wtdumprl ).. 1. Windows NT Windows NT. 2., Tivoli ( wtdumprl ). 4 IBM Tivoli Enterprise Console:

21 3.. ( : IBM Tivoli Distributed Monitoring, Netview TCP/IP, ) IBM Tivoli Enterprise Console. wpostemsg postemsg.. IBM Tivoli Enterprise Console. : TEC_Start TEC_Stop...,. 1 5

22 ,.. v.. Cabletron,,,. Shiva. NetWare,,,. Cisco. v ASCII,. v Windows NT Windows, (PreFilter ). Windows, (WINEVENTLOGS ). v, ( ). v Tivoli Event Integration Facility Tivoli Enterprise Console.,,. v Tivoli Availability Intermediate Manager Tivoli Enterprise Console. Tivoli Enterprise Console. v Tivoli Enterprise Console. Ctrl+A Ctrl+B. \001 \ IBM Tivoli Enterprise Console:

23 acl. manager. cause_date_reception date_reception.. cause_event_handle. cause_event_handle event_handle.. cause_date_reception. credibility. TME Tivoli Management Framework 1. TME, 0. date_reception , epoch.. date_reception event_handle server_handle. duration attribute, ( ). 0. : set_event_status,. 0. event_handle. date_reception event_handle server_handle. num_actions ( ). 1 7

24 server_handle. date_reception event_handle server_handle. server_path. ID. ID. re_split_event_id. 218 re_split_event_id. status. OPEN.. ACK. CLOSED. CLOSED CLOSED.. CLOSED. custom_status STATUS. STATUS root.baroc.,,,. OPEN,. RESPONSE... RAM wsetesvrcfg. 8 IBM Tivoli Enterprise Console:

25 ID,. event_handle 1, 1.,. server_handle TMR(Tivoli Management Region) 1. date_reception epoch. ID. Tivoli Enterprise Console.. Prolog., Prolog Prolog., Prolog,. Prolog 1 9

26 , 329 Prolog Prolog. Prolog x.... Prolog....,,.. v., OPEN CLOSED. v ( : place_change_request ) v CLOSED Prolog set_timer.,.., Prolog. 10 IBM Tivoli Enterprise Console:

27 .. 83.,..,, Prolog.,.,..,. status.,,...,. 66. rule_type: rule_name: ( ). description event_filter action1 action

28 v.. v.,. v.,. v Tivoli. v. v,. 12 IBM Tivoli Enterprise Console:

29 ,,. IBM Tivoli Enterprise Console..,. 14.,., Tivoli Availability Intermediate Manager Tivoli Availability Intermediate Manager IBM Tivoli Enterprise Console Tivoli Availability Intermediate Manager.,.,., IBM Tivoli Enterprise Console. (Tivoli Availability Intermediate Manager ) IBM Tivoli Enterprise Console. : Tivoli Availability Intermediate Manager Tivoli Availability Intermediate Manager., IBM Tivoli Enterprise Console IBM Tivoli Enterprise Console, wrb. Tivoli.. wrb. : IBM Tivoli Enterprise Console IBM Tivoli Enterprise Console

30 . Tivoli. IBM Tivoli Enterprise Console wrbupgrade., 3.7. (3.7 ),.. 2. (,,, ), IBM Tivoli Enterprise Console:

31 IBM Tivoli Enterprise Console, rule_base_directory/.rbtargets/target_name (rbtarget ). IBM Tivoli Enterprise Console EventServer. EventServer. (, Tivoli Availability Intermediate Manager ). target_name., IBM Tivoli Enterprise Console..,. wrb.. v -crttarget -import.. v -imptgtrule.., - detailed -lsrbtarget.., (re_send_event_conf ) Prolog. wrb -imptgtdata. wrb IBM Tivoli Enterprise Console wrb.,. 1 15

32 ,.. :.. Tivoli. Tivoli Availability Intermediate Manager, ,., IBM Tivoli Enterprise Console. IBM Tivoli Enterprise Console. wrb.,. v -cprb -rulesets -rulepacks.. v -crtrp -import.. v -imprprule.. v -imprbrule.., -lsrbpack -detailed., -lsrbrule. 16 IBM Tivoli Enterprise Console:

33 . wrb IBM Tivoli Enterprise Console : Production IBM Tivoli Enterprise Console. wrb. $. $ wrb -lsrbrule Production Rule Set files ov_default.rls log_default.rls from_sem.rls tecad_snaevent.rls tecad_nv390fwd.rls tecad_nv390msg.rls 1 17

34 ,,, EventServer. Production Support, Mail Development, wrb -imprbrule,, wrb -imprprule.,.. 1. Production defaultrules. $ wrb -crtrp defaultrules Production 2. Production. $ wrb -lsrbpack Production Rule Pack Files defaultrules 3.. $ wrb -imprprule ov_default defaultrules Production $ wrb -imprprule log_default defaultrules \ Production $ wrb -imprprule from_sem defaultrules Production. $ wrb -crtrp defaultrules -import ov_default \ log_default from_sem Production 4.. $ wrb -imptgtrule defaultrules Support Production $ wrb -imptgtrule defaultrules Mail Production $ wrb -imptgtrule defaultrules Development Production Production, defaultrules,., Marketing defaultrules. $ wrb -crttarget Marketing -import defaultrules Production Production, defaultrules. :. wrb. wrb 18 IBM Tivoli Enterprise Console:

35 wrb -delrbrule rule_set rule_base 3.. wrb -imprbrule rule_set.rls rule_base 4... wrb -comprules rule_base..,., PARSING_FAILED., wrb IBM Tivoli Enterprise Console BAROC.,. : 1. BAROC.. 2. root.baroc tec.baroc. BAROC, 24, wrb IBM Tivoli Enterprise Console. BAROC 43 2., Tivoli IBM Tivoli Enterprise Console 1 19

36 ., Prolog. Prolog 329 Prolog. wrb. wrb. wrb, IBM Tivoli Enterprise Console. 24. IBM Tivoli Enterprise Console Tivoli Availability Intermediate Manager. Tivoli Availability Intermediate Manager, IBM Tivoli Enterprise Console.,. :. v Operations... v /tec_rule/operations. v Operations, Operations. EventServer: IBM Tivoli Enterprise Console.. aimpersonnel: Tivoli Availability Intermediate Manager. aimaccounting: Tivoli Availability Intermediate Manager. :. v Tivoli. BAROC Windows NT 20 IBM Tivoli Enterprise Console:

37 tecad_nt.baroc. $BINDIR/TME/TEC/default_rb. BAROC TEC_CLASSES. v. /tec_rule_dev/rls. tec_server.rls: IBM Tivoli Enterprise Console. IBM Tivoli Enterprise Console Tivoli Availability Intermediate Manager. aim_ops_perf.rls: Tivoli Availability Intermediate Manager.. aim_ops_sec.rls: Tivoli Availability Intermediate Manager.. aim_pers.rls: Tivoli Availability Intermediate Manager. aim_acct.rls: Tivoli Availability Intermediate Manager. v aimops. aim_ops_perf.rls aim_ops_sec.rls. Tivoli Availability Intermediate Manager

38 IBM Tivoli Enterprise Console Operations. :. 1.. Operations wrb -crtrb -path /tec_rule/operations Operations 2.. wrb -imprbclass /data/tme/tec/default_rb/ \ TEC_CLASSES/tecad_nt.baroc Operations 3.. wrb -imprbrule c:/tec_rule_dev/rls/tec_server.rls \ Operations wrb -imprbrule c:/tec_rule_dev/rls/ \ aim_ops_perf.rls Operations wrb -imprbrule c:/tec_rule_dev/rls/aim_ops_sec.rls \ Operations 22 IBM Tivoli Enterprise Console:

39 wrb -imprbrule c:/tec_rule_dev/rls/aim_pers.rls \ Operations wrb -imprbrule c:/tec_rule_dev/rls/aim_acct.rls \ Operations 4.. $. $ wrb -lsrbrule Operations Rule Set files tec_server.rls aim_ops_perf.rls aim_ops_sec.rls aim_pers.rls aim_acct.rls 5.. wrb -crtrp aimops -import aim_ops_perf aim_ops_sec Operations 6. EventServer (EventServer ). wrb -imptgtrule tec_server EventServer Operations 7. aimpersonnel. wrb -crttarget aimpersonnel -import aimops \ aim_pers Operations 8. aimaccounting. wrb -crttarget aimaccounting -import aimops \ aim_acct Operations 9.. wrb -comprules Operations 10.. wrb -loadrb -use Operations 11. Operations. IBM Tivoli Enterprise Console EventServer,. 12. Tivoli Availability Intermediate Manager aimpersonnel /tec_rule/operations/.rbtargets/aimpersonnel. Tivoli Availability Intermediate Manager. 13. Tivoli Availability Intermediate Manager aimaccounting 1 23

40 /tec_rule/operations/.rbtargets/aimaccounting. Tivoli Availability Intermediate Manager. Tivoli. IBM Tivoli Enterprise Console wrb. : 1.,. 2. wrb -crtrb EventServer. wrb -imptgtrule EventServer upgrade_gui.sh ,,. upgrade_gui.sh IBM Tivoli Enterprise Console.. v v v v v BAROC v v v v BAROC v v 24 IBM Tivoli Enterprise Console:

41 : Default. Tivoli.,. :,. 28. Tivoli. Tivoli senior

42 4..,. 5.,... :.,.., :.. Tivoli. Tivoli user, IBM Tivoli Enterprise Console:

43 :.. Tivoli. Tivoli user,... BAROC : BAROC. Tivoli. Tivoli user BAROC 1 27

44 BAROC BAROC. 2.. :,. : 1.., IBM Tivoli Enterprise Console:

45 .,.,,. Tivoli. Tivoli senior. 1., ,.. 4.,. 1 29

46 5.,. 6.,. 7.,. 8.,.,. : Tivoli.. :. Tivoli. Tivoli senior :,. 30 IBM Tivoli Enterprise Console:

47 Tivoli. Tivoli senior

48 2., ,.. :,.. 5.,.. 6.,.,. 32 IBM Tivoli Enterprise Console:

49 BAROC : BAROC, BAROC,. BAROC. Tivoli. Tivoli BAROC senior BAROC. 1.,. 1 33

50 BAROC., BAROC.. 5. BAROC,. :.. 6. BAROC,,,. 34 IBM Tivoli Enterprise Console:

51 :.. :,. Tivoli. Tivoli user. 1.,. 2.,

52 :.,. 37. Tivoli. Tivoli senior : BAROC,,.. 36 IBM Tivoli Enterprise Console:

53 1.,. 2.,.. 3.,. ----, v Default. New ( 1 37

54 ). New Default., New.. v Default. New. New. BAROC,. BAROC.,., BAROC,.,.,.. UNIX UNIX, 755. TEC_UMASK. 1. Tivoli. odadmin environ get > temp_file. TEC_UMASK. 7.., 750,. TEC_UMASK= Tivoli. odadmin environ set < temp_file 3. tec_config tec_config IBM Tivoli Enterprise Console:

55 , IBM Tivoli Enterprise Console,.,.,.,,.... v ( ) v v ( ) v 263 6,.. 54 BAROC 290.,, UTF-8. UTF-8. wiconv UTF-8. wiconv Tivoli Management Framework, 3.6. v STRING UTF-8. v UTF-8. v UTF-8. v. UTF-8,. 1 39

56 Tivoli Enterprise Console UTF-8., UTF-8, tec_exectask_dbcs. $BINDIR/TME/TEC/.tec_config tec_exectask_dbcs. false.,. tec_exectask_dbcs=true.tec_config tec_exectask_dbcs=true,. Windows, UNIX Windows Perl, tec_exectask_dbcs true. UTF-8 Windows Perl. UTF Perl. Perl UTF-8, UTF-8 Perl 5.6. exec_program exec_program_local : UNIX, exec_program exec_program_local Perl. tec_exectask_dbcs true. : UNIX UTF-8 tec_exectask_dbcs true false. Windows tec_exectask_dbcs true. exec_task exec_task_local : exec_task exec_task_local UTF-8, tec_exectask_dbcs true. UTF-8, exec_task exec_task_local exec_program exec_program_local. Windows,. UTF-8 : tec_exectask_dbcs Tivoli Enterprise Console TEC-004 Tivoli Enterprise Console IBM Tivoli Enterprise Console:

57 UTF-8. UTF-8 UNIX Windows UNIX Windows exec_program 1 exec_program_local Perl 5.5.x Perl 5.6 exec_task exec_task_local Perl 5.5.x Perl : 1. UTF-8 Solaris. 2. Windows

58 42 IBM Tivoli Enterprise Console:

59 2 BAROC(Basic Recorder of Objects in C)..,.,., PARSING_FAILED. IBM Tivoli Enterprise Console BAROC. BAROC ( BAROC ). BAROC.., BAROC,.,. Mar 10 08:51:42 aspen su: su root failed for jsmith on /dev/ttyp0,, Tivoli. Su_Failure:source=LOGFILE;origin=aspen; date="mar 10 08:51:42";host=aspen;sub_source=SYSLOG; from_user=jsmith;msg= su:su root failed for jsmith on /dev/ttyp0 ;to_user=root;end IBM Tivoli Enterprise Console...,. facet Copyright IBM Corp

60 .. 2. BAROC. ( : Temp_Warning, Temp_Critical Temp_Normal). Temp_Event facet. facet ( ) ,, ( : Gwyna_Events) BAROC...., Cisco Cat 5000 Cisco_Cat5000_Event. cisco_cat5000.baroc cat5000_auto.baroc Cisco ( ). Cisco_Cat5000_Event Cisco_Event. cat5000, Cisco_Cat5000_Env_Event Cisco_Cat5000_Event cat5000_env.baroc. Cisco_Cat5000_Env_Temp Cisco_Cat5000_Env_Volatage Cisco_Cat5000_Env_Envent BAROC cat5000_env.baroc. 44 IBM Tivoli Enterprise Console:

61 TEC_CLASS: class_name ISA super_class_name DEFINES { attribute_definitions; }; END : BAROC.,,.. EVENT. tecad_logfile.baroc BAROC Su_Success Su_Failure. Logfile_Su, Logfile_Base. Logfile_Base EVENT ( ). ISA. 49. TEC_CLASS: Logfile_Base ISA EVENT DEFINES { source: default= "LOGFILE"; sub_source: default= "LOGFILE"; sub_origin: default= "N/A"; adapter_host: default= "N/A"; msg_catalog: default= "none"; msg_index: default= 0; repeat_count: default= 0; pid: STRING, default="n/a"; severity: default = WARNING; }; END TEC_CLASS: Logfile_Su ISA Logfile_Base DEFINES { from_user: STRING, dup_detect = yes; to_user: STRING, dup_detect = yes; 2 45

62 END }; on_tty: STRING, dup_detect = yes; severity: default = WARNING; TEC_CLASS: Su_Success ISA Logfile_Su; END TEC_CLASS: Su_Failure ISA Logfile_Su; END..,,. 6. IBM Tivoli Enterprise Console..,., EVENT BAROC WARNING,., Su_Failure CRITICAL.,,. attribute_name: type, facet1,...;. Person name, address, employer hobbies. TEC_CLASS: Person ISA EVENT DEFINES { name: STRING, dup_detect=yes; 46 IBM Tivoli Enterprise Console:

63 address: STRING, dup_detect=yes; employer: STRING; hobbies: STRING; }; : object... v INTEGER, REAL, STRING, INT32, ENUM. ENUM(). 52. v LIST_OF.... [complex_type] simple_type. complex_type., SINGLE.. LIST_OF... acl: LIST_OF STRING, default=[admin]; SINGLE. simple_type... ENUM. INT INTEGER

64 REAL. STRING 255. (facet) Facet. facet... facet.. default=value default. WARNING. 52. severity: SEVERITY, default = WARNING;.. YES.. parse=value. no yes.. parse=no, PARSING_FAILED., parse=no. date_reception. date_reception: INT32, parse = no INT32, 408 pointeroffset. 48 IBM Tivoli Enterprise Console:

65 dup_detect,. : dup_detect facet.. dup_detect facet yes.,. TEC_CLASS: Person ISA EVENT DEFINES { name: STRING, dup_detect=yes; city: STRING, dup_detect=yes; employer: STRING; hobbies: STRING; }; ( ). <"Joe", "Lafayette", "ABC Widgets", "Computers"> <"Joe", "Lafayette", "XYZ Widgets", "Ham Radio">, dup_detect no. ISA.. IBM Tivoli Enterprise Console... facet,

66 v fire_on_non_leaf ( 84 ). v. :,. event: _event of_class _class event: _event of_class _, (fire_on_non_leaf )... BAROC, BAROC. BAROC, BAROC, 24 wrb IBM Tivoli Enterprise Console., EVENT.... TEC_CLASS: EVENT DEFINES { 50 IBM Tivoli Enterprise Console: server_handle: date_reception: event_handle: INTEGER, parse = no; INT32, parse = no; INTEGER, parse = no;

67 END source: sub_source: origin: sub_origin: hostname: adapter_host: date: status: administrator: acl: credibility: severity: msg: msg_catalog: msg_index: duration: num_actions: repeat_count: cause_date_reception: cause_event_handle: server_path: }; STRING; STRING; STRING; STRING; STRING; STRING; STRING; STATUS, default=open; STRING, parse = no; LIST_OF STRING, default = [admin], parse = no; INTEGER, default =1, parse = no; SEVERITY, default = WARNING; STRING; STRING; INTEGER; INTEGER, parse = no; INTEGER, parse = no; INTEGER; INT32, parse = no; INTEGER, parse = no; LIST_OF STRING; UNIX tecad_logfile.baroc.. EVENT Logfile_Base Logfile_Su Logfile_Su_Success Logfile_Su_Failure ********************************************************** TEC_CLASS: Logfile_Base ISA EVENT DEFINES { source: default= "LOGFILE"; sub_source: default= "LOGFILE"; sub_origin: default= "N/A"; adapter_host: default= "N/A"; msg_catalog: default= "none"; msg_index: default= 0; 2 51

68 END }; repeat_count: default= 0; pid: STRING, default="n/a"; severity: default = WARNING; TEC_CLASS: Logfile_Su ISA Logfile_Base DEFINES { from_user: STRING, dup_detect = yes; to_user: STRING, dup_detect = yes; on_tty: STRING, dup_detect = yes; severity: default = WARNING; }; END TEC_CLASS: Su_Success ISA Logfile_Su; END TEC_CLASS: Su_Failure ISA Logfile_Su; END (enummeration).. SEVERITY. ENUMERATION SEVERITY 10 UNKNOWN 20 HARMLESS 30 WARNING 40 MINOR 50 CRITICAL 60 FATAL END BAROC.. root.baroc tec.baroc. CLOSED, (CLOSED). CLOSED, (CLOSED),. 52 IBM Tivoli Enterprise Console:

69 .., ENUMERATION. ENUMERATION.,.., 6000 SNMP. SNMP_Error_xxxx, xxxx ( ). ENUMERATION ( : 6000 ID SNMP_ERROR_ENUM)., SNMP_ERROR_ENUM error_type SNMP_Error. root.baroc tec.baroc root.baroc tec.baroc BAROC. root.baroc tec.baroc.. :. BAROC. BAROC BNF(Backus Naur Form) BAROC HTML.. $BINDIR/../generic_unix/TME/TEC/BOOKS/HTML/barocp.html CD. /BOOKS/HTML/barocp.html BAROC. 2 53

70 BAROC, BAROC. wrb. wrb wrb -delrbclass filename rule_base 3.. -before -after.. wrb -imprbclass filename.baroc rule_base 4... wrb -comprules rule_base BAROC, BAROC UTF-8. BAROC UTF-8. wiconv BAROC UTF-8. wiconv Tivoli Management Framework, 3.6. v STRING, UTF-8. v,. UTF-8,,,. UTF IBM Tivoli Enterprise Console:

71 3.,,.,...,.,..,. TEC_Notice : 5%.. :. IBM Tivoli Enterprise Console. TEC_Notice. IBM Tivoli Enterprise Console wsetesvrcfg. Tivoli.,.,.,.., commit_action, commit_rule commit_set predicate. Copyright IBM Corp

72 ,.. 1. :,, wpostemsg postemsg. 2. :, generate_event.. FIFO.. 3. : change_event_administrator, change_event_severity change_event_status. FIFO. 4. :, redo_analysis., FIFO.. 5. :.,,, FIFO.,.. 56 IBM Tivoli Enterprise Console:

73 set_timer.,., Su_Success, Su_Success.,..,.. v commit_action, commit_rule, commit_set

74 v,,.. v where. 58 IBM Tivoli Enterprise Console:

75 4... BAROC.,. (_), a-z() 0-9.,.. (_), a-z() filename.rls.,.rls.,. filename.rpk...., (_).,..,.., (_).,. 60. Copyright IBM Corp

76 (_),.,,... :,.., _no_value, _origin _no_value. where [origin:_origin equals _no_value].,.,. read write Prolog. 413 read 433 write.,., Level_1 'Level_1'.,. TEC_Start, TEC_Start. 60 IBM Tivoli Enterprise Console:

77 rule: unquoted_single_class1: ( event: _event of_class _class % The name of the event class is stored in variable % _class. where [ msg: equals unquoted event filter 1 ], action: ( set_event_message(_event, msg changed to %s, [_class]) ) ). rule: unquoted_single_class2: ( event: _event of_class TEC_Start % The name of the event class is stored in variable % TEC_Start. To filter on event class TEC_Start only, % specify TEC_Start (within quotes) where [ msg: equals unquoted class filter 2 ], action: ( set_event_message(_event, msg changed to %s, [TEC_Start]) ) )... v.. v.. where. rule: maintenance_started: (event: _event of_class Maintenance_start where [origin: _origin]) 4 61

78 ,. (, ).,.,......, origin sub_origin 2. atomconcat set_global_var. atomconcat([_origin, _sub_origin], _key), set_global_var( My group key, _key, My value ),,., ([ ]).,. set_global_var( My group key, _key, [ a, b, c ]), % Assign global variable values. get_global_var( My group key, _key, [_var1, _var2, _var3], [,, ]) % Retrieve global variable values into regular values % The default initialization values ( ) are null. 62 IBM Tivoli Enterprise Console:., [i] [o],. _into., _init _into. get_global_var(_groupkey[i], _key[i], _into[o], _init[i]) _to. _groupkey _key.

79 set_global_var(_groupkey[i], _key[i], _to[i]) _to. reset_global_grp(_groupkey[i], _to[i]) _key _into. _groupkey.. _key set_global_var. get_global_grp(_groupkey[i], _key[o], _into[o]), (, ). Maintenance_start, Maintenance_end..,. 4 63

80 /*********************************************************************/ /**************************** RULES ***************************/ /*********************************************************************/ /*************************** Reception Rules *************************/ /* */ The followingrule will be fired whenever the TEC restarts and will set the maintenance mode for any systems with open Maintenance_start events. rule: maintenance_start: ( event: _event of_class TEC_Start where [ ], reception_action: ( all_instances(event: _maintenance_ev of_class Maintenance_start where [ status: outside [ CLOSED ], origin: _origin ] ), set_global_var( Maintenance, _origin, on ) ) ). /* The followingrule will turn maintenance mode on. Note that the commit rule is necessary so that the check maintenance mode won t drop this event. */ rule: maintenance_started: ( event: _event of_class Maintenance_start where [ origin: _origin ], reception_action: ( set_global_var( Maintenance, _origin, on ), commit_rule ) ). 64 IBM Tivoli Enterprise Console:

81 /* */ The followingrule will turn maintenance mode off. rule: maintenance_stopped: ( event: _event of_class Maintenance_stop where [ origin: _origin ], reception_action: ( set_global_var( Maintenance, _origin, off ), drop_received_event, all_instances(event: _maint_start of_class Maintenance_start where [ origin: within [ _origin ], status: outside [ CLOSED ] ] ), set_event_status( _maint_start, CLOSED ), commit_rule ) ). /* */ The followingrule will be fired whenever a new event is received to filter out hosts that are in maintenance mode. rule: check_maint_mode: ( event: _event of_class _event_class where [ origin: _origin ], reception_action: ( get_global_var( Maintenance, _origin, _maint_mode, off ), _maint_mode == on, drop_received_event, commit_rule ) ). /* End of maintenance rules */., 'WARNING', 'TEC_Error' 'on'. 4 65

82 ., 9,5.4 0xFF /* */.. (%)... % /* */,. BAROC (#).,,. 10. v v v v v BNF(Backus Naur Form) HTML. $BINDIR/../generic_unix/TME/TEC/BOOKS/HTML/rulep.html CD. /BOOKS/HTML/rulep.htm.. rule: rule_name: ( description: description_text, directive: directives, event: event_filter 66 IBM Tivoli Enterprise Console:

83 where [ attribute_conditions ], action: action_name: ( action_body ) ). v Printer_Error_Cleared. rule: print_reset :( event: _event of_class Printer_Error_Cleared where [ status: equals OPEN, hostname: _hostname ], ) ). reception_action: ( all_instances(event: _prt_ev of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open ] where [hostname: equals _hostname, status: outside [ CLOSED ] ], _event ), change_event_status( _prt_ev, CLOSED ), drop_received_event , (69 1 ). rule: print_assist : ( event: _event of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, 4 67

84 ] Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open where [ status: _status equals OPEN, hostname: _hostname, msg: _msg ], reception_action: ( set_timer(_event, 90, ) ) ).. change_rule: rule_name: ( description: description_text, directive: directives, event: event_filter, where [ attribute_conditions ], sender: sender_filter, attribute: attribute_change_filter, action: action_name: ( action_body ) ). v. v. v 75. v 79. tec_print. (num_actions 1 ). 68 IBM Tivoli Enterprise Console:

85 change_rule: print_chg_assist : ( event: _event of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Error_Cleared, Printer_Door_Open ] where [ hostname: _hostname, status: _status outside [ CLOSED ], num_actions: equals 1, msg: _msg ], attribute: status set_to _new_status within [ CLOSED ], action: ( exec_program(_event, scripts/tec_send_mail.sh, "TEC - %s: %s" tec_print "The followingcondition for printer \ %s has been fixed:\n\t%s", [_new_status, _msg, _hostname, _msg], YES ) ) ).. timer_rule: rule_name: ( description: description_text, directive: directives, event: event_filter, where [ attribute_conditions ], timer_duration: timer_duration_filter, timer_info: timer_info_filter, action: action_name: ( action_body ) ). 4 69

86 v,. v 75. v 81. v 241 set_timer v TEC_Tick.,.,. 1. tec_print timer_rule: timer_print_assist : ( event: _event of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open ] where [ status: _status equals OPEN, hostname: _hostname, msg: _msg ], action: ( exec_program(_event, scripts/tec_send_mail.sh, "T/EC - %s: %s" tec_print "The printer %s has the \ followingcondition:\n\t%s", [_status, _msg, _hostname, _msg], YES ) ) ) FATAL IBM Tivoli Enterprise Console:

87 timer_rule: upgrade_level1 : ( event: _event of_class universal_host where [ status: outside [ CLOSED, ACK ] ], timer_info: equals Level 1, action: raise_sev: ( set_event_severity(_event, FATAL ), set_timer(_event, 90, Level 2 ) ) ).. simple_rule: rule_name: description: description_text directive: directives event: event_filter where [ attribute_conditions ] when: event_conditions: event_actions v _event _class.. v.,. n minutes_after_event_reception(n ) event_acknowledged event_closed event_received n frequency_exceeds m(m n ) severity_downgraded severity_upgraded v.,,. 4 71

88 change_event_severity change_event_status drop_duplicate_event exec_program exec_task forward_event set_event_message.,,,,. : change_event_severity(new_severity). OPEN, RESPONSE, ACK CLOSED. : change_event_status(new_status) CLOSED ( )., repeat_count. : drop_duplicate_event(time_window),. $BINDIR/TME/TEC.,. 160 exec_program. exec_program. : exec_program, _arg_list. _arg_list exec_progrma. : exec_program(prog_name, _format_string, _arg_list, watch_status)., exec_task. exec_task. : exec_task, _arg_list. _arg_list exec_task. : exec_task(task_name, format_string, _arg_list, watch_status). TEC_RULES tec_forward.conf ServerLocation. tec_forward.conf 183 forward_event. : forward_event() msg set_event_message. set_event_message. : set_event_message, _value. _value set_event_message. : set_event_message(_format, [_value]) v,. v IBM Tivoli Enterprise Console:

89 5 su (switch user) Su_Failure FATAL. simple_rule: escalate_su_failure: description: Escalate more than 3 su root failures in 5 minutes. event: Su_Failure where [ to_user: equals root ] when: frequency_exceeds 3 within 5 minutes: change_event_severity(fatal).. correlation_rule: rule_name: description: description_text directive: directives event_relation: event_class1 operator event_class2 within: integer minutes when: [ event_class1.attribute1 equals event_class2.attribute2 ] v event_relation. cancelled by cancelled by. cancels cancels. caused by caused by ( ) ( ). date_reception event_handle cause_date_reception cause_event_handle... causes ( ) ( ). date_reception event_handle 4 73

90 cause_date_reception cause_event_handle.. v when event_class_name. attribute., attribute event_class_name. v equals. v,.. correlation_rule: fan_fail_causes_temp_warn: description: This rule links a fan failure event and a temperature warningevent on the same computer. event_relation: Fan_Failure_Notification causes Temperature_Warning within: 10 minutes when: [ Fan_Failure_Notification.hostname equals Temperature_Warning.hostname ] correlation_rule: temp_warning_causes_temp_shutdown: description: This rule links a temperature warningevent and a temperature shutdown event on the same computer. event_relation: Temperature_Warningcauses Temperature_Shutdown within: 15 minutes when: [ Temperature_Warning.hostname equals Temperature_Shutdown.hostname ]., IBM Tivoli Enterprise Console:

91 v v v,.,.., ,, _event... of_class _event.. of_class... ( ),... event: _event of_class class _class. _class. 4 75

92 event: _event of_class _class class_name. Printer_Error_Cleared. event: _event of_class Printer_Error_Cleared : class_name class_name. fire_on_non_leaf, class_name ( ). _class within [class_name1,...].,.. fire_on_non_leaf,..,.. event: _event of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open ] : _class.,., _class. event: _event of_class _class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, 76 IBM Tivoli Enterprise Console:

93 ] Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open LIST_OF. ;class file TEC_CLASS: Logfile_Base ISA EVENT DEFINES { alist: LIST_OF STRING, default=[ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline ]; }; END ;rule file print_reset: ( event: _event of_class Printer_Error_Cleared where [ status: equals OPEN, alist: _aclasslist ], reception_action: ( first_instance( event: _prt_ev of_class within _aclasslist where [ status: outside [ CLOSED ] ], _event ), change_event_status(_prt_ev, CLOSED ) ) ). _class outside [class_name1,...]..,.. fire_on_non_leaf,.. event: _event of_class outside [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open ] : _class _class. 4 77

94 :. where... _class,..,.. where where,. where., where. v.. comparison_operator.. equals greater_than greater_or_equals smaller_than smaller_or_equals OPEN. OPEN. where [status: equals OPEN ], outside. CLOSED. where [status: outside [ CLOSED ]] within. OPEN ACK _status. where [status: _status within [ OPEN, ACK ]], :. v. _status.. 78 IBM Tivoli Enterprise Console:

95 where [status: _status], v. critical., _hostname. where [ status: _status outside [ CLOSED ], severity: equals CRITICAL, hostname: _hostname ],. v v :.. agent engine.. operator().. equals.. sender: equals engine, outside.. sender: outside [agent,engine], within.,, _sender. sender: _sender within [operator( root@orange ), operator( root@red ), operator( root@blue ) ],,. 4 79

96 sender: _sender, :. set_to. set_to. set_to. set_to.,.. v equals v greater_than v greater_or_equals v smaller_than v smaller_or_equals. outside. within. :.. v CLOSED. attribute: status set_to CLOSED, : IBM Tivoli Enterprise Console..,. v. _newstatus. attribute: status set_to _newstatus, v ACK CLOSED. _newstatus. attribute: status set_to _newstatus within [ ACK, CLOSED ], v repeat_count 6. _newrepeatcount. 80 IBM Tivoli Enterprise Console:

97 attribute: repeat_count set_to _newrepeatcount greater_than 5, v fred, wilma betty. _newadministrator. attribute: administrator set_to _newadministrator within [ fred, wilma, betty ],. v timer_info v timer_duration timer_info : timer_info set_timer timer_info. set_timer. set_timer timer_info, ( ). timer_info. v equals v greater_than v greater_or_equals v smaller_than v smaller_or_equals timer_info. outside. within. :. timer_info. v timer_info 1. timer_info: equals Level 1, v timer_info 1 2. _timerinfo. timer_info: _timerinfo within [ Level 1, Level 2 ], v timer_info _timerinfo. timer_info: _timerinfo, 4 81

98 timer_duration : timer_duration set_timer timer_duration. set_timer. set_timer timer_duration. timer_duration. v equals v greater_than v greater_or_equals v smaller_than v smaller_or_equals timer_duration. outside. within. :. timer_duration. v timer_duration 60. timer_duration: equals 60, v timer_duration _timerduration. timer_duration: _timerduration within [ 60, 90 ], v timer_duration _timerduration. timer_duration: _timerduration, :, ,. 82 IBM Tivoli Enterprise Console:

99 ...,. v action v reception_action v redo_action,.., action_1, action_2., commit_action,. (, Prolog ). Prolog,.... reception_action.. reception_action. : generate_event, reception_actions. redo_action. 4 83

100 . redo_analysis. redo_action.. v oserv_script reception_action universal_oserv WARNING. reception_action. v link_host.,. redo_action, redo_analysis. rule: link_oserv_to_host: ( description: Link the universal_oserv to universal_host if they are related, event: _event of_class universal_oserv where [probe_arg: _probe_arg, severity: equals WARNING ], reception_action: oserv_script : ( exec_program(_event, oserv_beep.sh, %s,[_probe_arg], YES ) ), action: link_host : ( first_instance( event: _host_ev of_class universal_host where [severity: within [ CRITICAL, FATAL ], probe_arg: equals _probe_arg, status: outside [ CLOSED ] ]), set_event_status(_event, ACK ), ) ). link_effect_to_cause(_event, _host_ev). directive:.,, directive: fire_on_non_leaf, profile.. 84 IBM Tivoli Enterprise Console:

101 fire_on_non_leaf,.,... EVENT.. rule: test_rls: ( directive: fire_on_non_leaf, event: _evt of_class within [ EVENT ] where [ ], ). reception_action: action0: ( drop_received_event ) profile trace.. profile. wrb -comprules -profile trace. wrb -comprules -trace Prolog, Tivoli Prolog. Tivoli

102 HTML IBM Tivoli Enterprise Console, $BINDIR/../generic_unix/TME/ TEC/BOOKS/HTML/reference.html. CD /BOOKS/HTML/reference.html... add_to_repeat_count.,,, all_clear_targets any_clear_target any_clearing_event attr_condition attr_exception attr_sequence clears create_clearing_event create_event_sequence first_causal_event first_effect_event IBM Tivoli Enterprise Console:

103 first_related_event is_clearing_event link_effect_to_cause unlink_from_cause. create_clearing_event create_event_sequence...,... v. v. v. v. v. v.,. v v v v v v v. all_duplicates all_instances create_cache_search_criteria

104 first_duplicate first_instance print_cache search_cache... create_cache_search_criteria. : v,,. v,,., 0.,. v redo_analysis,,. :. v dup_detect facet YES v dup_detect facet YES,. :. 78.,,. first_duplicate all_duplicates.,.,,.,,. 88 IBM Tivoli Enterprise Console:

105 . commit_action commit_rule commit_set... BAROC BAROC.. bo_add_at_slotval_begin bo_add_at_slotval_end bo_get_class_of bo_get_class_slots bo_get_enum_options bo_get_slotval bo_is_defined_for_class bo_is_direct_super_of bo_is_super_of bo_remove_from_slotval bo_reset_default_slotval bo_set_slotval print_class_tree create_event_criteria. check_event_criteria,... check_event_criteria create_event_criteria.. check_event_criteria. 4 89

106 .. init_event_activity print_event_activity reset_event_activity update_event_activity. init_event_activity. 0. print_event_activity_report.... check_all_thresholds check_threshold create_threshold.... Perl Tivoli Management Framework. log_error TEC_Error.. re_after_match re_before_match re_create IBM Tivoli Enterprise Console:

107 re_match re_search_string re_substitute re_substitute_global..,., erase_globals get_global_grp get_global_var get_globals global_exists load_globals reset_global_grp save_globals set_global_var

108 convert_ascii_time convert_gm_time convert_local_time get_gm_time get_local_time get_time resolve_time. epoch. epoch... epoch... exec_program exec_program_local exec_task exec_task_local..... add_to_repeat_count change_event_administrator change_event_severity change_event_status decrement_slot get_attributes increment_slot place_change_request re_split_event_id set_event_administrator set_event_message set_event_severity set_event_status repeat_count server_path.. msg IBM Tivoli Enterprise Console:

109 . check_and_increment_count clear_closed_events drop_change_request drop_received_event forward_event generate_event get_config_param init_count re_mark_as_modified re_send_event_conf redo_analysis remove_bslashes set_timer init_count log_error set_detailed_debugging set_log_error_source trace_it.. log_error ID

110 add_to_repeat_count repeat_count. : add_to_repeat_count(_event, number) :. repeat_count. : _event repeat_count. number repeat_count. : repeat_count 1,,.,. rule: printer_problem:( event: _event of_class within [ Printer_Paper_Out, Printer_Toner_Low, Printer_Offline, Printer_Output_Full, Printer_Paper_Jam, Printer_Door_Open ], reception_action: ( first_duplicate( _event, event: _printer_ev where [ status: outside [ CLOSED ] ], _event ), commit_rule, add_to_repeat_count(_printer_ev, 1), drop_received_event ) ). : first_duplicate 94 IBM Tivoli Enterprise Console:

111 all_clear_targets. : all_clear_targets(_clear_event, _target_event ) ---- all_clear_targets(_clear_event, _target_event, time_before, time_after) : _clear_event. _target_event. time_before time_after, 2 (1, 1 ).. : _clear_event. _target_event _clear_event.. time_after _clear_event.. time_before _clear_event.. :..,. rule: clear_target_events :( event: _clr_ev of_class EVENT, action: search_for_target :( all_clear_targets( clr_ev, _tgt, 3600, 0), set_event_status(_tgt, CLOSED ) ) ). : any_clear_target, create_clearing_event, create_event_sequence 4 95

112 all_duplicates. : all_duplicates(_event, event: _duplicate where attribute_conditions) ---- all_duplicates(_event, event: _duplicate where attribute_conditions, _referenceevent -time_before -time_after) :., all_duplicates. all_duplicates, : _event. _referenceevent. event:_duplicate where attribute_conditions. _duplicate time_after. -time_before. :. 1. OV_NODE_DOWN rule: dup_nfs_not_resp:( event: _event of_class OV_NODE_DOWN where [severity: _severity], 96 IBM Tivoli Enterprise Console:

113 action: dup_event_severity:( all_duplicates(_event, event: _dup_ov_ev where [status: outside [ CLOSED ] ], _event ), ) ). set_event_severity(_dup_ov_ev, _severity) : first_duplicate 4 97

114 all_instances,. : all_instances(event:_event of_class class where attribute_conditions) ---- all_instances(event:_event of_class class where attribute_conditions, _referenceevent -time_before -time_after) :., all_instances. all_instances,. : _event. _referenceevent. event: _event of_class class where attribute_conditions. _event time_after. -time_before. : Pascal NFS_SERVER_NOT_RESPONDING. action: ( all_instances(event: _nfs_ev of_class NFS_SERVER_NOT_RESPONDING where [server: equals Pascal ]), ) set_event_status (nfs_ev, CLOSED ) : first_instance 98 IBM Tivoli Enterprise Console:

115 any_clear_target. : any_clear_target(_clear_event, _target_event) ---- any_clear_target(_clear_event, _target_event, time_before, time_after) : _clear_event. _target_event. time_before time_after, 2 (1, 1 ).. : _clear_event. _target_event _clear_event.. time_after _clear_event.. time_before _clear_event.. :.. rule: clear_target_event :( event: _clr_ev of_class EVENT, action: search_for_target :( any_clear_target(_clr_ev, _tgt, 3600, 0), set_event_status(_tgt, CLOSED ) ) ). : all_clear_targets, create_clearing_event, create_event_sequence 4 99

116 any_clearing_event. : any_clearing_event(_event, _clear_event) ---- any_clearing_event(_event, _clear_event, time_before, time_after) : _event. time_before time_after, 2 (1, 1 ).. : _clear_event _event.. _event. time_after _event.. time_before _event.. :..,. rule: check_for_clear :( event: _ev of_class EVENT, action: search_for_clear :( any_clearing_event(_ev, _clr, 3600, 0), set_event_status(_ev, CLOSED ), commit_set ) ). : create_clearing_event, create_event_sequence 100 IBM Tivoli Enterprise Console:

117 attr_condition. : attr_condition([classes], [attribute_conditions]) :. create_event_sequence event_details (create_event_sequence attribute_conditions ). clears. : classes,., [ upsonbattery, lowbattery, upsdischarged ]. attribute_conditions classes..., [severity,equals, HARMLESS ].,, [[severity,equals, HARMLESS ], [hostname,equals,orange]]., 146 create_event_criteria attribute_conditions. :, American Power Conversion(APC) UPS Distributed Monitoring. APC UPS hostname. Distributed Monitoring universal_host probe_arg. attr_condition universal_host ( FATAL ). attr_exception. create_event_sequence( [ upsonbattery, lowbattery, upsdischarged, universal_host ], [ hostname, [ status, outside,[ CLOSED ]] 4 101

118 [ clears( powerrestored,[ ], [ upsonbattery ],[ ]), clears( returnfromlowbattery,[ ], [ lowbattery ],[ ]), clears( dischargecleared,[ ],[ upsdischarged ],[ ]), clears( universal_host, [ [ severity, equals, HARMLESS ] ] [ universal_host ], [ ]), attr_condition( universal_host, [ severity,equals, FATAL ]), attr_exception( hostname, universal_host, probe_arg ) ] ), : attr_exception, create_clearing_event, create_event_sequence 102 IBM Tivoli Enterprise Console:

119 attr_exception. : attr_exception(attribute, [classes], exception_attribute) :. create_event_sequence event_details., hostname. probe_arg., attr_exception. attr_exception. : attribute. create_event_sequence attribute_conditions. classes attribute. exception_attribute attribute. : APC UPS Distributed Monitoring. APC UPS hostname. Distributed Monitoring universal_host probe_arg. attr_exception. create_event_sequence([ upsonbattery, lowbattery, upsdischarged, universal_host ], [ hostname, [ status, outside, [ CLOSED ]], ) : create_event_sequence [attr_exception( hostname, universal_host, probe_arg )] 4 103

120 attr_sequence. : attr_sequence(class, attribute=[value_sequence]) :. create_event_sequence event_details.. :. : attribute. class. value_sequence,.. : Compaq. (cpqtape3phdrvstatuschange). cpqtapephydrvcondition OK., ( ) attr_sequence. ) create_event_sequence( [ cpqtape3phydrvstatuschange ], [ hostname, [ status, outside,[ CLOSED ]]] [attr_sequence( cpqtape3phydrvstatuschange, cpqtapephydrvcondition =[ Degraded, Failed ]) ] : create_event_sequence 104 IBM Tivoli Enterprise Console:

121 bo_add_at_slotval_begin. : bo_add_at_slotval_begin(_event, _attribute, _value) : _value _event _attribute. _attribute. : _attribute _event. _event. _value. : acl. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( % Before the call, the acl attribute contains % [admin]. bo_add_at_slotval_begin(_event, acl, user ) ) ). % Now the acl attribute contains [user,admin]. :

122 bo_add_at_slotval_end. : bo_add_at_slotval_end(_event, _attribute, _value) : _value _event _attribute. _attribute. : _attribute _event. _event. _value. : acl. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( % Before the call, the acl attribute contains % [admin]. bo_add_at_slotval_end(_event, acl, senior ) ) ). % Now the acl attribute contains [admin,senior]. :. 106 IBM Tivoli Enterprise Console:

123 bo_get_class_of. : bo_get_class_of(_event, _classname) : _classname _event. _classname,. : _classname _event. _event. :. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_get_class_of(_event, _classname) % _classname is unified with Su_Success. ) ). :

124 bo_get_class_slots. : bo_get_class_slots(_classname, _attributes) : _attributes _classname.,,,. : _attributes parse facet 5. dup_detect facet. slot(attribute_name,complex_type, element_type,parse_setting,dup_detect_setting, ) _classname. :. Su_Success. rule: baroc_example: ( 108 IBM Tivoli Enterprise Console: event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_get_class_slots(_class, _slots) ) ). _attributes., Tivoli. [slot(server_handle,single,integer,no,no, ), slot(date_reception,single,int32,no,no, ), slot(event_handle,single,integer,no,no, ), slot(source,single,string,yes,no, ), slot(sub_source,single,string,yes,no, ),

125 slot(origin,single,string,yes,no, ), slot(sub_origin,single,string,yes,no, ), slot(hostname,single,string,yes,no, ), slot(adapter_host,single,string,yes,no, ), slot(date,single,string,yes,no, ), slot(status,single,status,yes,no, ), slot(administrator,single,string,no,no, ), slot(acl,list_of,string,no,no, ), slot(credibility,single,integer,no,no, ), slot(severity,single,severity,yes,no, ), slot(msg,single,string,yes,no, ), slot(msg_catalog,single,string,yes,no, ), slot(msg_index,single,integer,yes,no, ), slot(duration,single,integer,no,no, ), slot(num_actions,single,integer,no,no, ), slot(repeat_count,single,integer,yes,no, ), slot(cause_date_reception,single,int32,no,no, ), slot(cause_event_handle,single,integer,no,no, ), slot(pid,single,string,yes,no, ), slot(from_user,single,string,yes,yes, ), slot(to_user,single,string,yes,yes, ), slot(on_tty,single,string,yes,yes, )]. :

126 bo_get_enum_options. : :. o_get_enum_options(_enumname, _options) _enumname _options : _enumname. _options. : SEVERITY. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_get_enum_options( SEVERITY, _options) % _options is unified with [UNKNOWN, % HARMLESS,WARNING,MINOR,CRITICAL,FATAL] ) ). :. 110 IBM Tivoli Enterprise Console:

127 bo_get_slotval. : bo_get_slotval(_event, _attribute, _value) : _event _attribute. _value. _value _attribute. : _attribute. _event. _value _attribute. : sub_source. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_get_slotval(_event, sub_source,_sub_source) % _sub_source is unified with su. ) ). : bo_set_slotval 4 111

128 bo_is_defined_for_class. : :. bo_is_defined_for_class(_attribute, _classname) _attribute _classname : _attribute. _classname. : pid. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_is_defined_for_class( pid, _class) % Succeeds. ) ). :. 112 IBM Tivoli Enterprise Console:

129 bo_is_direct_super_of. : : bo_is_direct_super_of(_super_classname, _classname) _super_classname _classname. : _classname _super_classname. _super_classname _classname. : Logfile_Su. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_is_direct_super_of( Logfile_Su, _class) % This predicate succeeds because % Logfile_Su is a % direct superclass of Su_Success. ) ). :

130 bo_is_super_of. : bo_is_super_of(_super_classname, _classname) : _super_classname _classname. : _classname _super_classname. _super_classname _classname. : Logfile_Base. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( bo_is_super_of( Logfile_Base, _class) % _class was instantiated to Su_Success % in event filter. % This predicate succeeds because % Logfile_Base is a superclass % of Su_Success. ) ). :. 114 IBM Tivoli Enterprise Console:

131 bo_remove_from_slotval. : bo_remove_from_slotval(_event, _attribute, _value) : _value _event _attribute. _attribute. : _attribute _event. _event. _value _attribute. : acl. Su_Success. rule: baroc_example: ( event: _event of_class _class, % _class is unified with Su_Success. action: ( % Before the call, the acl attribute contains [admin]. bo_add_at_slotval_end(_event, acl, senior ), % Now the acl attribute contains [admin,senior]. bo_add_at_slotval_begin(_event, acl, user ), % Now the acl attribute contains [user,admin,senior]. bo_remove_from_slotval(_event, acl, admin ) ) ). % Now the acl attribute contains [user,senior]. :

132 bo_reset_default_slotval. : bo_reset_default_slotval(_event, _attribute ) : _event _attribute. : _attribute _event.. _event. :. Su_Success. rule: baroc_example: ( event: _event of_class _class, action: ( bo_reset_default_slotval(_event, sub_source ) % The slot sub_source for the event % under analysis is set back to su. ) ). :. 116 IBM Tivoli Enterprise Console:

133 bo_set_slotval. : : bo_set_slotval( _event, _attribute, _value) _attribute _event _value. place_change_request,., place_change_request, bo_set_slotval.., bo_set_slotval,., re_mark_as_modified. : _attribute. _event. _value. : hostname myhost. bo_set_slotval(_event, hostname, myhost) : bo_get_slotval, place_change_request, re_mark_as_modified 4 117

134 cancel_all_timers. : : cancel_all_timers(_event). : _event. :.. rule: cancel_timers:( event: _ev of_class EVENT, action: cancel_timers:( first_effect_event(_ev, _effect, 300, 300), link_effect_to_cause(_effect, _ev), cancel_all_timers(_effect) ) ). : cancel_timer 118 IBM Tivoli Enterprise Console:

135 cancel_timer. : cancel_timer(_event, _timer_duration, _timer_info) :., _event. Prolog ( ).. : _event. _timer_duration ( ) set_timer. _timer_info set_timer. : 5. 5., 5 ( create_event_sequence ).,. 5 ( ). 5,,,. create_trouble_ticket. scripts/create_trouble_ticket.sh. rule: set_timer_delay:( event: _ev of_class EVENT, 4 119

136 action: perform_correlation:( first_related_event(_ev, _related, _type, 300, 300), ( _type == c, link_effect_to_cause(_ev, _related), commit_set ; cancel_timer(_related, 300, _info), link_effect_to_cause(_related, _ev) ) ), action: set_timer:( set_timer(_ev, 300, 0), commit_set ) ). timer_rule: create_trouble_ticket:( event: _ev of_class EVENT, timer_duration: equals 300, action: create_ticket:( exec_program(_ev, scripts/create_trouble_ticket.sh, %ld, [_ev], no) ) ). : cancel_all_timers 120 IBM Tivoli Enterprise Console:

137 change_event_administrator. : change_event_administrator(_event, new_administrator ) : administrator.. : _event. new_administrator. :. administrator bjones change_event_administrator(_event, bjones) : set_event_administrator 4 121

138 change_event_severity. : change_event_severity( _event, new_severity) : severity.. : _event. new_severity. :. severity CRITICAL change_event_severity(_event, CRITICAL ) : set_event_severity 122 IBM Tivoli Enterprise Console:

139 change_event_status. : change_event_status( _event, new_status ) : status.. : _event. new_status. : new_status ACK OPEN. : status ACK. change_event_status(_event, ACK ) : set_event_status 4 123

140 check_all_thresholds. : check_all_thresholds(_referenceevent, _name, _count) :.. _name _count. : _count.. _name. create_threshold. _referenceevent.. : NT_Performance_Alert. check_all_thresholds( NT_Performance_Alert, _name, _count) : check_threshold, create_threshold 124 IBM Tivoli Enterprise Console:

141 check_and_increment_count. : check_and_increment_count(_key1, _key2, _max_count, _cur_count) : _max_count. _max_count, _cur_count. _max_count, _cur_count. : init_count, check_and_increment_count. check_and_increment_count, _key1 _key2.,. v, event_class,hostname., perf_alert,orange. v, failure,component., paper_jam,flr4rm23.,. : _cur_count.. _key1 _key _max_count.,.. : Printer_Jam. failure,component. Printer_Jam hostname

142 check_and_increment_count.. 5, init_count 0. check_and_increment_count Prolog ELSE. rule: printer_jam: ( ) ). event : _ev of_class Printer_Jam where [hostname: _hn within [ flr4rm23, flr3rm12, flr1rm11, flr6rm9 ], action: check_count: ( (check_and_increment_count(printer_jam,_hn,5,_count) ; % ELSE clause follows exec_program(_ev, scripts/notify.sh, Printer failure on %s, [_hn], no), init_count(paper_jam,_hn,0) ) : init_count 126 IBM Tivoli Enterprise Console:

143 check_event_criteria. : check_event_criteria(criteria_name, event ) ---- check_event_criteria(criteria_names_list, operator, event) : create_event_criteria... : criteria_name. create_event_criteria. criteria_names_list,. create_event_criteria., [criteria1, criteria2]. event. operator.. all any., criteria1 criteria2.., criteria2. : 1.. create_event_criteria harmless_heartbeat harmless_maintenance.,. rule: filter_event: ( event: _event of_class _class where [ ], 4 127

144 ) ). reception_action: check_criteria: ( check_event_criteria([harmless_heartbeat, harmless_maintenance ], any, _event ), drop_received_event, commit_rule 2. create_event_criteria check_event_criteria( db_critical, _ev) : create_event_criteria 128 IBM Tivoli Enterprise Console:

145 check_threshold. : check_threshold(threshold_criteria_name, _referenceevent, _count) : create_threshold _max_report_freq. 2., create_threshold.,.. a. (create_cache_search_criteria ). b. (create_threshold _window ). c. (create_threshold _count ). 3. check_threshold _check_count. not. : _count.. _referenceevent.. threshold_criteria_name. create_threshold. : create_threshold.. v db_critical_threshold. : create_threshold TEC_Start

146 v create_cache_search_criteria db_critical_search. v 600. v 3. v _event 10 db_critical_search check_hold 5. create_threshold( db_critical_threshold, db_critical_search, 600, 3, 300) % Define the threshold criteria. check_threshold( db_critical_threshold, _event, _count) % Apply the threshold criteria to received event. : check_all_thresholds, create_cache_search_criteria, create_threshold 130 IBM Tivoli Enterprise Console:

147 clear_closed_events. : : : clear_closed_events.. :. print_cache( /tmp/before ), clear_closed_events, print_cache( /tmp/after ) :

148 clears. : clears( class, [attribute_conditions ], [target_events ], [target_attribute_conditions ]) ---- clears(class, [attribute_conditions], [target_events], [target_attribute_conditions], [attribute_exceptions]) ---- clears( class, [attribute_conditions ], [target_events ], [target_attribute_conditions ], create_reverse_lookup) ---- clears(class, [attribute_conditions], [target_events], [target_attribute_conditions], [attribute_exceptions], create_reverse_lookup) :. create_event_sequence event_details. create_event_sequence attribute_conditions, target_attribute_conditions. :. create_clearing_event. : attribute_conditions..., HARMLESS [severity,equals, HARMLESS ]. :. 132 IBM Tivoli Enterprise Console:

149 , 146 create_event_criteria attribute_conditions..., [hostname]. class. create_reverse_lookup. ( ). yes no. no. target_attribute_conditions target_events. create_event_sequence attribute_conditions. target_events class. : Compaq. (cpqtape3phdrvstatuschange). cpqtapephydrvcondition OK. clears OK cpqtapephydrvcondition cpqtape3phydrvstatuschange. [ ] ), create_event_sequence( [ cpqtape3phydrvstatuschange ], [ hostname, [ status, outside,[ CLOSED ]]] attr_sequence( cpqtape3phydrvstatuschange, cpqtapephydrvcondition =[ Degraded, Failed ]), clears( cpqtape3phydrvstatuschange, [ [ cpqtapephydrvcondition,equals, OK ] ], [ cpqtape3phydrvstatuschange ], []) 4 133

150 : create_clearing_event, create_event_sequence, is_clearing_event 134 IBM Tivoli Enterprise Console:

151 commit_action. : commit_action :. :. : all_instances..,. reception_action: action1: ( all_instances( _event, event: _dup_down_ev where [ status: outside [ CLOSED ] ], _event ), commit_action, add_to_repeat_count(_dup_down_ev, 1), drop_received_event ), :

152 commit_rule. : commit_rule :.,. :. : all_instances.,.,. reception_action: ( all_instances( _event, event: _dup_toner_ev where [ status: outside [ CLOSED ] ], _event ), commit_rule, add_to_repeat_count(_dup_toner_ev, 1), drop_received_event ), :. 136 IBM Tivoli Enterprise Console:

153 commit_set. : commit_set :. v v v v :. : all_instances.,. reception_action: ( all_instances( _event, event: _dupper where [ status: outside [ CLOSED ] ]), drop_received_event, commit_set, add_to_repeat_count(_dupper, 1) ), :

154 convert_ascii_time. : convert_ascii_time(_time_structure, _time_string ) :. _time_structure convert_ascii_time. _time_string. : _time_string _time_structure. _time_structure. _time_epoch epoch get_time. :,, time_string. get_local_time(_time_local_struct), convert_ascii_time(_time_local_struct, _time_string), bo_set_slotval(_event, time_string, _time_string) : bo_set_slotval, get_local_time 138 IBM Tivoli Enterprise Console:

155 convert_gm_time epoch (GMT). : convert_gm_time( _time_epoch, _time_gm_struct ) : epoch GMT. _time_epoch convert_gm_time. _time_gm_struct. : _time_epoch epoch. _time_local_struct epoch get_local_time. _time_gm_struct GMT. _time_epoch epoch get_time. :. 1. epoch. 2. time_epoch. 3. epoch GMT. 4. GMT. 5. time_string. time_epoch time_string. get_time(_time_epoch), bo_set_slotval(_event, time_epoch, _time_epoch), convert_gm_time(_time_epoch, _time_gm_struct), convert_ascii_time(_time_gm_struct, _time_string), bo_set_slotval(_event, time_string, _time_string) : bo_set_slotval, convert_ascii_time, get_time 4 139

156 convert_local_time epoch. : convert_local_time( _time_epoch, _time_local_struct ) : epoch. _time_epoch convert_local_time. _time_local_struct. : _time_epoch epoch. _time_local_struct epoch get_local_time. _time_local_struct. _time_epoch epoch get_time. :. 1. epoch. 2. time_epoch. 3. epoch time_string. time_epoch time_string. get_time(_time_epoch), bo_set_slotval(_event, time_epoch, _time_epoch), convert_local_time(_time_epoch, _time_local_struct), convert_ascii_time(_time_local_struct, _time_string), bo_set_slotval(_event, time_string, _time_string) : bo_set_slotval, convert_ascii_time, get_time 140 IBM Tivoli Enterprise Console:

157 create_cache_search_criteria. : create_cache_search_criteria(search_name, criteria_name, attributes, dup_detect) ---- create_cache_search_criteria(search_name, criteria_name, attributes, dup_detect, returnorder) :.. v search_cache v create_event_criteria., [A,B,C,D,E],., C, E,., A B.. TEC_Start.. : attributes,., [hostname,severity]. criteria_name. create_event_criteria. dup_detect.. no yes

158 return_order., random.. order. random. search_name. search_cache. : db_critical db_critical_search. db_critical hostname. return_order random. create_cache_search_criteria( db_critical_search, db_critical, [ hostname ], yes ) : create_event_criteria, search_cache 142 IBM Tivoli Enterprise Console:

159 create_clearing_event. : create_clearing_event(class, [attribute_conditions], [target_events], [target_attribute_conditions]) ---- create_clearing_event(class, [attribute_conditions], [target_events], [target_attribute_conditions], [attribute_exceptions]) ---- create_clearing_event(class, [attribute_conditions], [target_events], [target_attribute_conditions], create_reverse_lookup) ---- create_clearing_event(class, [attribute_conditions], [target_events], [target_attribute_conditions], [attribute_exceptions], create_reverse_lookup) :.. : attribute_conditions...,, [severity,equals, HARMLESS ]... :

160 , 146 create_event_criteria attribute_conditions.., [hostname].. attribute_exceptions.., Tivoli Distributed Monitoring probe_arg.. attribute_exceptions. attr_exception attribute_exceptions. 103 attr_exception. class. create_reverse_lookup. ( ). yes no. no. target_attribute_conditions target_events.,. target_events class. : 144 IBM Tivoli Enterprise Console:

161 1. origin CiscoLinkDown. CiscoLinkUp CiscoLinkDown. create_clearing_event( CiscoLinkUp, [], [ CiscoLinkDown ], [ origin ], no) 2. cpqda3phydrvstatuschange. cpqdaphydrvstatus hostname, Fail OK. target_events. create_clearing_event( cpqda3phydrvstatuschange, [ [ cpqdaphydrvstatus,equals, OK ] ], [ cpqda3phydrvstatuschange ], [ hostname, [ cpqdaphydrvstatus,not_equals, OK ] ], no), : clears, create_event_sequence, is_clearing_event 4 145

162 create_event_criteria. : create_event_criteria(criteria_name, class, fire_on_non_leaf, attribute_conditions) :. create_event_criteria, check_event_criteria,. TEC_Start log_error. v. v. : attribute_conditions.. attribute_conditions.,. [[ attribute, operator, value ], [ attribute, operator, value ]] : 1.., greater_than STRING.. 2. SINGLE. 3. matches Tivoli Management Framework Perl. 4. ENUM. 5. LIST_OF. SIMPLE.., IBM Tivoli Enterprise Console:

163 ENUM, INTEGER, REAL STRING equals greater_than greater_than_equal less_than less_than_equal not_equals outside within equals not_equals matches outside within class., [ NT_SNMP, NT_Server_Start ]. create_cache_search_criteria return_order. 141 create_cache_search_criteria. criteria_name criteria. fire_on_non_leaf.. no yes.. : 1.. example_criteria. create_cache_search_criteria. TEC_DB. :.. create_event_criteria(example_criteria, TEC_DB, no, [[ hostname, equals, chair ], [ hostname, not_equals, chair1 ], [ hostname, matches, ch.*r ], [ repeat_count, within, [5]], [ repeat_count, outside, [10,15]], [ repeat_count, equals, 5], [ repeat_count, not_equals, 6], [ repeat_count, greater_than, 4], [ repeat_count, greater_than_equal, 5], [ repeat_count, less_than, 6], [ repeat_count, less_than_equal, 5], 4 147

164 [ severity, within, [ MINOR ]], [ severity, outside, [ FATAL, HARMLESS ]], [ severity, equals, MINOR ], [ severity, not_equals, FATAL ], [ severity, greater_than, HARMLESS ], [ severity, greater_than_equal, MINOR ], [ severity, less_than, CRITICAL ], [ severity, less_than_equal, CRITICAL ] ] ), 2. db_critical. TEC_DB CRITICAL. severity 60 ENUM. DB_SRV. create_event_criteria( db_critical, TEC_DB yes, [[ hostname,matches, DB_SRV* ], ) [ severity, greater_than_equal, CRITICAL ] ] 3. ups_problem. homer upsonbattery, upsbatterylow upsbatterydischarged. create_event_criteria( ups_problem, [ upsonbattery, upsbatterylow, upsbatterydischarged ], yes, [[ hostname,equals, homer ]] ) : check_event_criteria, create_cache_search_criteria 148 IBM Tivoli Enterprise Console:

165 create_event_sequence. : create_event_sequence([event_sequence], [attribute_conditions]) ---- create_event_sequence([event_sequence], [attribute_conditions], [event_details]) :,.. TEC_Start. : attribute_conditions ( )..., [severity,equals, HARMLESS ] attr_condition., 146 create_event_criteria attribute_conditions..., [hostname]. attr_exception. attr_exception 103. event_details

166 attr_condition attr_exception attr_sequence clears.... event_sequence,., [ upsonbattery, lowbattery, upsdischarged ]. : 1.. APC UPS Distributed Monitoring. UPS 248.,, upsonbattery. (universal_host) Distributed Monitoring. clears. UPS hostname. Distributed Monitoring universal_host probe_arg (UPS hostname ). probe_arg UPS hostname. create_event_sequence event_details attr_exception. universal_host FATAL. HARMLESS.. universal_host FATAL UPS create_event_sequence event_details attr_condition., universal_host HARMLESS. clears attribute_conditions. hostname hostname create_event_sequence attribute_conditions. 150 IBM Tivoli Enterprise Console:

167 clears attribute_conditions universal_host. create_event_sequence event_details create_event_sequence attr_exception attribute_conditions hostname. create_event_sequence( [ upsonbattery, lowbattery, upsdischarged, universal_host ], [ hostname, [ status, outside,[ CLOSED ]] [ clears( powerrestored,[ ], [ upsonbattery ],[ ]), clears( returnfromlowbattery,[ ],[ lowbattery ], [ ]), clears( dischargecleared,[ ],[ upsdischarged ], [ ]), clears( universal_host, [ [ severity, equals, HARMLESS ] ] [ universal_host ], [ ]), attr_condition( universal_host, [ severity,equals, FATAL ]), attr_exception( hostname, universal_host, probe_arg ) ] ), 2.. Compaq Insight Manager cpqtapephydrvcondition. OK., ( ) create_event_sequence event_details attr_sequence. event_sequence. cpqtapephydrvcondition. clears target_attribute_conditions attr_sequence. [ create_event_sequence( [ cpqtape3phydrvstatuschange ], [ hostname, [ status, outside,[ CLOSED ]]] attr_sequence( cpqtape3phydrvstatuschange, cpqtapephydrvcondition =[ Degraded, Failed ]), 4 151

168 ] ), clears( cpqtape3phydrvstatuschange, [ [ cpqtapephydrvcondition,equals, OK ] ], [ cpqtape3phydrvstatuschange ], []) cpqhe3thermalsystemfan cpqhe3thermalcpufan cpqhe3thermaltemp. Compaq Insight Manager. darkest shade, next lightest lightest. cpqhe3thermalsystemfandegraded cpqhe3thermalsystemfanfailed cpqhe3thermaltempdegraded cpqhe3thermaltempfailed cpqhe3thermalsystemfanok cpqhe3thermalcpufanfailed cpqhe3thermaltempok cpqhe3thermalconfirmation cpqhe3thermalcpufanok create_event_sequence IBM Tivoli Enterprise Console:

169 create_event_sequence. cpqhe3thermaltempdegraded cpqhe3thermalcpufanfailed. create_event_sequence( [ cpqhe3thermalsystemfandegraded, cpqhe3thermalsystemfanfailed cpqhe3thermaltempdegraded, cpqhe3thermaltempfailed ], [hostname, [ status, equals, OPEN ]], [ clears( cpqhe3thermalsystemfanok, [], [ cpqhe3thermalsystemfandegraded], [ ]), clears( cpqhe3thermaltempok, [], [ cpqhe3thermaltempdegraded], [ ]), clears( cpqhe3thermalconfirmation, [], [ cpqhe3thermaltempfailed], []) ] ), create_event_sequence( [ cpqhe3thermalcpufanfailed, cpqhe3thermaltempdegraded ], [hostname, [ status, equals, OPEN ]], : [ ] ), clears( cpqhe3thermalcpufanok, [], [ cpqhe3thermalsystemfanfailed], [])

170 create_threshold. : create_threshold(threshold_criteria_name, cache_search_criteria_name, _window, _count, _max_report_frequency) :. check_threshold. TEC_Start.. : _count., 5. _max_report_frequency. _window..., 600 (10 ) 5 5. cache_search_criteria_name. create_cache_search_criteria. create_threshold. threshold_criteria_name. check_threshold. :.. v db_critical_threshold. v create_cache_search_criteria db_critical_search. v 600. v 3. v IBM Tivoli Enterprise Console:

171 create_threshold( db_critical_threshold, db_critical_search, 600, 3, 300) : check_threshold, create_cache_search_criteria 4 155

172 decrement_slot. : : decrement_slot(_event, _attribute_name, _by_value, _trigger). :. : _attribute_name. _by_value. _event. _trigger. YES, yes, NO no. :. decrement_slot(_event,host_down,1,no) : increment_slot 156 IBM Tivoli Enterprise Console:

173 drop_change_request. : : : drop_change_request.. : ACK CLOSED,, msg.. change_rule: deny_state_change_of_tts:( event: _event of_class _class, sender: equals operator(_operator), slot: status set_to _new_status within [ ACK, CLOSED ], action: ( _operator \= Administrator, bo_set_slotval(_event, msg, modification denied! ), drop_change_request ) ). :

174 drop_received_event. : :. : drop_received_event. : NFS_NOT_RESPONDING. repeat_count. rule: dup_nfs_not_resp:( event: _event of_class NFS_NOT_RESPONDING, action: dup_and_drop_event:( first_duplicate(_event,event: _dup_nfs_ev where [status: outside [ CLOSED ] ] ), add_to_repeat_count (_dup_nfs_ev, 1), ) ). drop_received_event :. 158 IBM Tivoli Enterprise Console:

175 erase_globals. : :. erase_globals(_group) : _group. : Maintenance. erase_globals( Maintenance ) :

176 exec_program. : :. exec_program(_event, file_name, _format_string, _arg_list, watch_status). : exec_program Null., exec_program. : _arg_list [1, 2, 3] ( ). trigger. msg $msg. IBM Tivoli Enterprise Console..., [] _event.. IBM Tivoli Enterprise Console. _format_string. %s(string), %d(integer) %ld(int32). file_name. $BINDIR/TME/TEC. watch_status. watch_status YES NO.. YES,. 160 IBM Tivoli Enterprise Console:

177 :. exec_program(_event, % Pass in the event pointer for access to % its environment variables. scripts/send_notice, % Program path/name. -m "%s" -s %s, % Format string. [_msg, _severity], % Argument list. ) YES ) % Watch status. _format_string %s msg severity. send_notice. send_notice -m "Su to root failed for Joe" -s CRITICAL msg send_notice. : exec_program_local, exec_task, exec_task_local 4 161

178 exec_program_local. : exec_program_local(_name, _event, file_name, format_string, _arg_list, watch_status) : ( ). watch_status YES, TASK_COMPLETE.. TASK_COMPLETE tec.baroc.. command. end_time. execution_message exit_status. start_time. task_name. _name. task_number ID. ID 1 1. task_status. trigger_event_id exec_program_local ID.... : _arg_list [1, 2, 3] ( ). trigger 162 IBM Tivoli Enterprise Console:

179 . msg $msg. IBM Tivoli Enterprise Console... %, [] _event.. Tivoli Management Framework, 3.6. _format_string. %s(string), %d(integer) %ld(int32)., _format_string ( ). 160 exec_program. _name. TASK_COMPLETE. file_name. $BINDIR/TME/TEC. watch_status TASK_COMPLETE.. NO TASK_COMPLETE.. YES TASK_COMPLETE.. :. 1. program_start, ls(list) TEC_DB.. v list_tmpdir

180 v. v TASK_COMPLETE. 2. program_result list_tmpdir task_name TASK_COMPLETE. 3. program_result process_program_result. a. TASK_COMPLETE execution_msg _results.. b. _results OK. c. OK ok., not_ok. rule: program_start: ( event: _event of_class where [ ], TEC_DB reception_action: start_it: ( exec_program_local( lst_tmpdir,_event, ls /tmp,,[ ], YES ) ) ). rule: program_result: ( event: _event of_class TASK_COMPLETE where [task_name: _task_name equals lst_tmpdir, % Test for program name. If passed, assign % value to variable. ], task_number: _task_num % Assign task_number attribute value to % variable. reception_action: process_program_result: ( bo_get_slotval(_event,execution_msg,_results), % Get value of execution_msgattribute and assign to % variable. Attribute is a list type. member(_result_line,_results), (_result_line = OK -> % Test each element for OK value. ok % OK value found in list. Run ok predicate. ; % Else. do_not_ok_thing 164 IBM Tivoli Enterprise Console:

181 ) ). : % OK value not found in list. Run not_ok % predicate.) exec_program, exec_task, exec_task_local 4 165

182 exec_task. : exec_task(_event, task_name, format_string, _arg_list, watch_status) :.. Tivoli Enterprise Console IBM Tivoli Enterprise Console. : exec_task Null., exec_task. : _arg_list [1, 2, 3] ( ). trigger. msg $msg. IBM Tivoli Enterprise Console..., [] _event.. Tivoli Management Framework, 3.6. _format_string. %s(string), %d(integer) %ld(int32).,. -l tasklibname -h hostname -a arg1 -a arg exec_program. 166 IBM Tivoli Enterprise Console:

183 : 1. -l, -h -a Tivoli Management Framework wruntask. Tivoli Management Framework, (-t TaskName) -E wruntask exec_task. task_name. watch_status. watch_status YES NO.. YES,. : 1. T/EC Send_ stumpy.,.. wruntask. exec_task(_event, Send_ , -l "T/EC Tasks" -h "stumpy" -a "%s" -a "%s", [ joe@company.com, joe@company.com ], NO ) wruntask -t Send_ -l "T/EC Tasks" -h "stumpy" -E -a "joe@company" -a "joe@company" 2. MS SQL Distributed Monitoring. CRITICAL MSSQLDatabase_LogSpacePercentUsedDB. collection. exec_task. rule: plain_rule1_42: ( description: ADSM incremental backup task, event: _ev1 of_class within [ MSSQLDatabase_LogSpacePercentUsedDB ] where [severity: _ev1_severity collection: _ev1_collection, hostname: _ev1_hostname ], reception_action: action0:( (exec_task(_ev1, 4 167

184 ) ). ) YES ADSMIncBackup, -l MSSQLManagerTasks -h [_ev1_collection,_ev1_hostname], ) exec_task MSSQLDatabase master@holon@holon. wruntask -t ADSMIncBackup -l MSSQLManagerTasks \ -E : exec_program, exec_program_local, exec_task_local 168 IBM Tivoli Enterprise Console:

185 exec_task_local. : exec_task_local(_name, _event, file_name, format_string, _arg_list, watch_status) : ( ). Tivoli Enterprise Console IBM Tivoli Enterprise Console. :. watch_status YES, TASK_COMPLETE.. TASK_COMPLETE root.baroc.. command. end_time. execution_message exit_status. start_time. task_name. _name. task_number ID. ID 1 1. task_status. RUNNING, SUCCESS, FAILURE UNKNOWN root.baroc. trigger_event_id exec_task_local ID

186 : _arg_list [1, 2, 3] ( ). trigger., msg $msg. IBM Tivoli Enterprise Console..., [] _event.. Tivoli Management Framework, 3.6. _format_string. %s(string), %d(integer) %ld(int32)., _format_string ( ).,. -l tasklibname -h hostname -a arg1 -a arg exec_program. : 1. -l, -h -a Tivoli Management Framework wruntask. Tivoli Management Framework, (-t TaskName) -E wruntask exec_task_local. _name. TASK_COMPLETE. file_name. $BINDIR/TME/TEC. 170 IBM Tivoli Enterprise Console:

187 watch_status TASK_COMPLETE.. NO TASK_COMPLETE.. YES TASK_COMPLETE.. :. 1. task_start, send_dbadmin TEC_DB.. v send_dbadmin. v. v TASK_COMPLETE. 2. task_result send_dbadmin task_name TASK_COMPLETE. 3. task_result process_task_result. a. TASK_COMPLETE execution_msg _results.. b. _results OK. c. OK ok., not_ok. rule: task_start: ( event: _event of_class where [ ], TEC_DB reception_action: start_it: ( exec_task_local( send_dbadmin, _event, Send_ , -l "T/EC Tasks" -h "stumpy" -a "%s" -a "%s", [ joe@company.com, joe@company.com ], YES ) ) ). rule: task_result: ( event: _event of_class TASK_COMPLETE where [task_name: _task_name equals send_dbadmin, % Test task name. Assign task_name value to 4 171

188 % variable if passed. ], task_number: _task_num % Assign task_number attribute value to % variable. reception_action: process_task_result: ( bo_get_slotval(_event,execution_msg,_results), % Get value of execution_msgattribute and assign to % variable. Attribute is a list type. member(_result_line,_results), (_result_line = OK -> % Test each element for OK value. ok % OK value found in list. Run ok predicate. ; % Else. ) ). : do_not_ok_thing % OK value not found in list. Run not_ok % predicate.) exec_program, exec_program_local, exec_task 172 IBM Tivoli Enterprise Console:

189 first_causal_event. : (causal) (cause). : first_causal_event(_effect_event, _cause_event) ---- first_causal_event(_effect_event, _cause_event, time_before, time_after) : create_event_sequence. create_event_sequence., A, B, C D, D,, A, B C,. time_before time_after, 2 ( 1 1 ).. : _cause_event.. _effect_event.. time_after.. time_before.. :

190 rule: link_effect_to_cause :( event: _effect of_class EVENT, action: search_for_cause :( first_causal_event(_effect, _cause, 3600, 0), set_event_status(_effect, ACK ), link_effect_to_cause(_effect, _cause) ) ). : create_event_sequence, first_effect_event, first_related_event 174 IBM Tivoli Enterprise Console:

191 first_duplicate ( ). : first_duplicate(_event, event: _duplicate where attribute_conditions) ---- first_duplicate(_event, event:_duplicate where attribute_conditions, _referenceevent -time_before -time_after) : time_before -time_after, 2 (1, 1 ).. : _event. _referenceevent. event:_duplicate where attribute_conditions. _duplicate time_after. -time_before. : NFS_NOT_RESPONDING. repeat_count. 2 (1, 1 ).. rule: dup_nfs_not_resp:( event: _event of_class NFS_NOT_RESPONDING, 4 175

192 action: dup_and_drop_event:( first_duplicate(_event,event: _dup_nfs_ev where [status: outside [ CLOSED ] ] ), add_to_repeat_count (_dup_nfs_ev, 1), ) ). drop_received_event : all_duplicates 176 IBM Tivoli Enterprise Console:

193 first_effect_event. : first_effect_event(_cause_event, _effect_event) ---- first_effect_event(_cause_event, _effect_event, time_before, time_after) : create_event_sequence. time_before time_after, 2 (1, 1 ).. : _cause_event.. _effect_event.. time_after.. time_before.. :.... rule: link_cause_to_effect :( event: _cause of_class EVENT, action: search_for_effect :( first_effect_event(_cause, _effect, 3600, 0), 4 177

194 ) ). set_event_status(_effect, ACK ), link_effect_to_cause(_effect, _cause) : create_event_sequence, first_causal_event, first_related_event 178 IBM Tivoli Enterprise Console:

195 first_instance, ( ). : first_instance(event: _event of_class class where attribute_conditions) ---- first_instance(event: _event of_class class where attribute_conditions, _referenceevent -time_before -time_after) :,. : _referenceevent. event:_event of_class class where attribute_conditions time_after. -time_before. :. 1. universal_host event. v CLOSED. v probe_arg NFS_No_Response server. v CRITICAL. v FATAL. rule: escalate: ( description: escalate host down events when causingnfs problems, event: _event of_class NFS_No_Response where [ server: _server], 4 179

196 action: increase_sev : ( first_instance(event: _down_ev of_class universal_host where [status: outside [ CLOSED ], probe_arg: equals _server, severity: equals CRITICAL ], _event ), ) ). set_event_severity(_down_ev, FATAL ) : any_clear_target 180 IBM Tivoli Enterprise Console:

197 first_related_event. : first_related_event(_referenceevent, _related_event, _relation) ---- first_related_event(_referenceevent, _related_event, _relation, time_before, time_after) :.. _relation c. _relation e., A, B, C D create_event_sequence first_related_event C, A c _relation, B c _relation, D e _relation,.,., first_effect_event first_causal_event. time_before time_after, 2 (1, 1 ).. : _referenceevent. _related_event.. _relation... c

198 e. time_after.. time_before.. :. relation... rule: link_effect_to_cause :( event: _ev of_class EVENT, action: search_for_cause_or_effect :( first_related_event(_ev, _related,_relation, 3600,0), ( _relation = = c, set_event_status(_ev, ACK ), link_effect_to_cause(_ev, _related) ; set_event_status(_related, ACK ), link_effect_to_cause(_related, _ev) ) ) ). : create_event_sequence, first_causal_event, first_effect_event 182 IBM Tivoli Enterprise Console:

199 forward_event. : : forward_event(_event). tec_forward.conf (rule_base_dir /TEC_RULES ). tec_forward.conf ServerLocation. tec_forward.conf TestMode yes.., TestMode tec_forward.conf. : _event. : CRITICAL FATAL tec_forward.conf. rule: escalate: ( event: _evt of_class within [ EVENT ] where [severity: within [ CRITICAL, FATAL ], reception_action: action0:( forward_event(_evt) ) ). :

200 generate_event. : generate_event(event_class, list_of_event_attributes) :,,. : event_class. list_of_event_attributes.. [attribute1=value1, attribute2=value2,...] : 4 TradingDBDown. action: ( generate_event( TradingDBDown, [source= SNMP, origin=_origin, hostname=_host, msg= Trading DB host is down ] ) ) :. 184 IBM Tivoli Enterprise Console:

201 get_attributes. : get_attributes(_event, [attribute_name=_attribute_value,...] ) :.. : _attribute_value. _event.. attribute_name. : hostname, severity status, _hostname, _severity _status. get_attributes(_event,[hostname=_hostname, severity=_severity, status=_status ] ) :

202 get_config_param. : get_config_param(_name, _variable, default) : $BINDIR/TME/TEC/.tec_config. _name, default _variable. : _name. _variable. default _name _variable. : _tec_rule_host chair. tec_rule_host, not set..tec_config. #.tec_configsettings #tec_rule_cache_size=10000 #tec_rule_cache_full_history=86400 #tec_rule_cache_non_closed_history= #tec_rule_cache_clean_freq=3600 tec_rule_trace=yes tec_rule_trace_file=/tmp/rules.trace tec_rule_host=chair tec_server_handle=5 get_config_param(tec_rule_host,_tec_rule_host, not set ) :. 186 IBM Tivoli Enterprise Console:

203 get_global_grp. : get_global_grp(_group, _key,_value) :.,, _value. _value _key. : _group _key... _value.. : Maintenance. get_global_grp( Maintenance, _key, _value), : get_globals, get_global_var 4 187

204 get_global_var. : get_global_var(_group, _key,_value,_default) : _value., _default _default _value. _value. : _default. _group _key.. _value.. :. 1. Maintenance origin., off ,. rule: check_maint_mode: ( event: _event of_class _event_class where [ origin: _origin ], reception_action: ( get_global_var( Maintenance, _origin, _maint_mode, off ), _maint_mode == on, drop_received_event, commit_rule ) ). : get_globals, get_global_grp 188 IBM Tivoli Enterprise Console:

205 get_globals. : get_globals(_group, _key,_value) :,... : _group _key.. _value. :. get_globals(_group,_key,_value) : get_global_grp, get_global_var 4 189

206 get_gm_time (GMT). : get_gm_time(_time_gm_struct) : GMT. _time_gm_struct. : _time_gm_struct GMT. _time_epoch epoch get_time. : GMT,, time_string. get_gm_time(_time_gm_struct), convert_ascii_time(_time_gm_struct, _time_string), bo_set_slotval(_event, time_string, _time_string) : bo_set_slotval, convert_ascii_time, get_time, resolve_time 190 IBM Tivoli Enterprise Console:

207 get_local_time. : get_local_time(_time_local_struct) :. _time_local_struct. : _time_local_struct. _time_epoch epoch get_time. :,, time_string. get_local_time(_time_local_struct), convert_ascii_time(_time_local_struct, _time_string), bo_set_slotval(_event, time_string, _time_string) : bo_set_slotval, convert_ascii_time, get_time, resolve_time 4 191

208 get_time :00:00 (GMT) epoch. : get_time(_time_epoch) : epoch. _time_epoch. : _time_epoch epoch. _time_local_struct epoch get_local_time. : epoch time_epoch. get_time(_time_epoch), bo_set_slotval(_event, time_epoch, _time_epoch) : bo_set_slotval 192 IBM Tivoli Enterprise Console:

209 global_exists. : global_exists(_group, _key) : _key _group.. : _group _key.. : origin Maintenance. global_exists( Maintenance,_origin) :

210 increment_slot. : : increment_slot(_event, _attribute_name, _by_value, _trigger). :. : _attribute_name. _by_value. _event. _trigger. YES, yes, NO no. :. increment_slot(_event,host_down,1,no) : decrement_slot 194 IBM Tivoli Enterprise Console:

211 init_count. : init_count(_key1, _key2, _value) : _key1 _key2. _value. 0., check_and_increment_count. : 1. init_count, check_and_increment_count _key1 _key2.,. v, event_class, hostname., perf_alert,orange. v failure, component., paper_jam,flr4rm23.,. : _key1 _key _value.. : Printer_Jam. failure,component. Printer_Jam hostname

212 check_and_increment_count , init_count 0. check_and_increment_count Prolog ELSE. rule: printer_jam: ( ) ). event : _ev of_class Printer_Jam where [hostname: _hn within [ flr4rm23, flr3rm12, flr1rm11, flr6rm9 ], action: check_count: ( (check_and_increment_count(printer_jam,_hn,5,_count) ; % ELSE clause follows exec_program(_ev, scripts/notify.sh, Printer failure on %s, [_hn], no), init_count(paper_jam,_hn,0) ) : check_and_increment_count 196 IBM Tivoli Enterprise Console:

213 init_event_activity. : init_event_activity(_file, _event_ exclusions, _attribute_criteria, _threshold) :..,,. TEC_Start.. : _attribute_criteria., [source, hostname, severity].., [hostname, severity]., [hostname, severity],. class., [class, hostname]. _event_exclusions., [ TEC_Heartbeat, TEC_Maintenance ]. _file. _threshold _attribute_criteria. : 1.. _rep_freq is 20, init_event_activity( /tmp/event_activity, % Report file [ TEC_Heartbeat, TEC_Maintenance ], [source, % Do not report these events % Single attribute reporting 4 197

214 hostname, severity, status, [hostname,severity], % Multiple attribute reporting [class,hostname] % Class reporting ], 5 % Do not report counts less %than this ), 2. TEC_Tick.. rule: configure_event_activity: ( event: _event of_class TEC_Tick where [msg: _msg equals Event Activity Report, duration: _reporting_frequency], reception_action: start_timer: ( set_timer(_event,_reporting_frequency,_msg), commit_rule ) ) IBM Tivoli Enterprise Console:

215 From: Thu Mar 02 14:14: To : Thu Mar 02 14:14: ReportingFrequency: 0 Minutes. Total Events: 3332 ReportingThreshold: 5 Event Activity For Server tkennedy ============================================================= Event Class Summary ============================================================= Count Class Name TEC_Tick 848 TEC_DB 822 TEC_Notice 812 TEC_Error ============================================================= Slot Summary ============================================================= Count Slot Criteria status=open 590 severity=minor 574 severity=warning 564 severity=critical 550 severity=unknown 544 severity=harmless 510 severity=fatal 12 hostname=midnight.austin.lab.tivoli.com 12 source= hostname=dhcp austin.lab.tivoli.com 11 source= hostname=stingray.austin.lab.tivoli.com 11 source= hostname=austin.lab.tivoli.com 10 source= : print_event_activity 4 199

216 ip_node_unreachable. : ip_node_unreachable(_ipaddress, _event) : IP IP. _ipaddress,, _event TEC_ITS_SUBNET_STATUS., link_effect_to_cause TEC_ITS_SUBNET. ground(_event) _event.,. NetView TCP/IP netview.rls. : _ipaddress IP. _event, IP TEC_ITS_SUBNET_STATUS.,. 200 IBM Tivoli Enterprise Console:

217 : TEC_ITS_UNREACHABLE TEC_IT_SUBNET_STATUS. rule: unreachable_correlate_subnet: ( event: _event of_class TEC_ITS_UNREACHABLE where [ ip_unreachable: _ip_unreachable ], reception_action: unreachable_correlate_subnet: ( ip_node_unreachable(_ip_unreachable, _subnet_event), ( ( ground(_subnet_event) -> ( printf( ***> event correlated: unreachable_correlate_subnet\n, []), printf( ***> unreachable ip is: %s\n, [_ip_unreachable]), bo_get_slotval(_subnet_event, subnetaddr, _subnetaddr), printf( ***> unreachable subnet is: %s\n, [_subnetaddr]), set_event_administrator(_event, unreachable_correlate_subnet ), set_event_severity(_event, HARMLESS ), link_effect_to_cause(_event, _subnet_event), change_event_status(_event, CLOSED ) ; true ) ) ) ) ). : link_effect_to_cause 4 201

218 is_clearing_event create_clearing_event create_event_sequence. : is_clearing_event(_event) :. create_clearing_event create_event_sequence, is_clearing_event. : _event. :..,. rule: process_clearing_events :( event: _ev of_class EVENT, reception_action: check_for_clear :( is_clearing_event(_ev),... : create_clearing_event, create_event_sequence 202 IBM Tivoli Enterprise Console:

219 link_effect_to_cause. : link_effect_to_cause(_effect_event, _cause_event) : cause_date_reception cause_event_handle. date_reception cause_date_reception, event_handle cause_event_handle. : _cause_event. _effect_event. : probe_arg,, universal_oserv universal_host., universal_oserv status ACK. rule: link_oserv_to_host: ( ) ). event: _event of_class universal_oserv where [probe_arg: _probe_arg, severity: equals WARNING ], action: link_host : ( first_instance(event: _host_ev of_class universal_host where [severity: within [ CRITICAL, FATAL ], probe_arg: equals _probe_arg, status: outside [ CLOSED ] ]), set_event_status(_event, ACK ), link_effect_to_cause(_event, _host_ev) : unlink_from_cause 4 203

220 load_globals. : : load_globals(_file). : _file. :. load_globals( /tmp/globalvars.txt ) : save_globals 204 IBM Tivoli Enterprise Console:

221 log_error. : log_error(format_string, variable_list, severity) :. Tivoli.. v v TEC_Error log_error. v tell_err Prolog.. TEC_Start,. tell_err. tell_err( filename ) v,. 240 set_log_error_source. : _format.. %c. %d. %e. %f. %g ( ). %o 0 8. %s. %u. %x 0x 16. %

222 n n.m, n., n m. severity TEC_Error. variable_list.. : check_data (_data) my_predicate. check_data.. 1. my_predicate. set_log_error_source. 2. check_data trace_it., set_detailed_debugging. trace_it. 3. check_data, log_error Bad Data my_predicate ID. tell_err. check_data, TEC_Error CRITICAL, Bad Data my_predicate ID. ID msg. my_predicate(_data):- set_log_error_source(my_predicate), ( trace_it(check_data), process_data(_data) ; ) log_error( Bad Data %s,[_data], CRITICAL ) : set_log_error_source 206 IBM Tivoli Enterprise Console:

223 place_change_request. : place_change_request(_event, _attributename, _newattributevalue) :., bo_set_slotval. : _attributename. _event. _newattributevalue. : hostname myhost. place_change_request(_event, hostname, myhost) : bo_set_slotval, re_mark_as_modified 4 207

224 print_cache. : print_cache(file_name) ---- print_cache(file_name, event:_event of_class class where attribute_conditions) :.. v v : event:_event of_class class where attribute_conditions., _event. file_name. : 1. /tmp/cache. print_cache( /tmp/cache/ ) 2. TEC_Start /tmp/cache. rule: print_cache: ( event: _event of_class _class, reception_action: ( print_cache( /tmp/cache, event: _cached_event of_class TEC_Start ) ) ). 3. CLOSED /tmp/cache. rule: print_cache: ( event: _event of_class _class, reception_action: ( print_cache( /tmp/cache, event: _cached_event of_class _cached_class where [status: equals CLOSED ]) ) ). :. 208 IBM Tivoli Enterprise Console:

225 print_class_tree. : print_class_tree(_file, _class) :.. : _class _file.. : ( EVENT ) /tmp/class_tree. print_class_tree( /tmp/class_tree, EVENT ) :

226 print_event_activity init_event_activity. : print_event_activity : init_event_activity.. set_timer _duration. :. : 1. TEC_Tick.. rule: configure_event_activity: ( event: _event of_class TEC_Tick where [msg: _msg equals Event Activity Report, duration: _rep_freq], reception_action: start_timer: ( set_timer(_event,_rep_freq,_msg), commit_rule ) ). 2. print_activity_report. 197 init_event_activity. timer_rule: print_and_reset_event_activity: ( event: _event of_class _class where [ ], timer_info: equals Event Activity Report, timer_duration: _rep_freq, action: print_and_reset_event_activity: ( print_event_activity, reset_event_activity, set_timer(_event,_rep_freq, Event Activity Report ) ) ). : init_event_activity 210 IBM Tivoli Enterprise Console:

227 re_after_match. : re_after_match(_name, _string, _result) : re_create _string.. _result. Perl. : _name re_create. _result _string :... re_create(test, a.*i ) % Create regular expression test. re_after_match(test, chair,_result) % Search chair usingregular expression test. % Return the substringafter the match in _result. % Succeeds, r returned in _result. : re_before_match, re_create 4 211

228 re_before_match. : re_before_match(_name, _string, _result) : re_create _string.. _result. Perl. : _name re_create. _result _string :... re_create(test, a.*r ) % Create regular expression test. re_before_match(test, chair,_result) % Search chair usingregular expression test. % Return the substringbefore the match in _result. % Succeeds, ch returned in _result. : re_after_match, re_create 212 IBM Tivoli Enterprise Console:

229 re_create. : re_create(_name, _pattern) :.. TEC_Start.. Perl. : _name. _pattern. :. re_create(test, h.*i ) % Create regular expression test. re_search_string(test, chair ) % Compare chair to regular expression test. % Succeeds, matches hai. :

230 re_mark_as_modified. : re_mark_as_modified(_event, _) : bo_set_slotval. : _ Prolog. anonymous. _event. bo_set_slotval _event. : _oldevent. re_mark_as_modified(_oldevent, _) : bo_set_slotval, place_change_request 214 IBM Tivoli Enterprise Console:

231 re_match. : re_match(_name, _string, _index, _result) : re_create _string.. _result. _index. Perl. : _index _result. 0, 1, 2. _name re_create. _result _string : _index... re_create(test, a.*r ) % Create regular expression test. re_match(test, chair,0,_result) % Search chair usingregular expression test. % Return the entire result in _result. % Succeeds, air returned in _result. : re_create 4 215

232 re_search_string. : re_search_string(_name, _string) : re_create _string.. Perl. : _name re_create. _string :.. re_create(test, h.*i ) % Create regular expression test. re_search_string(test, chair ) % Search chair usingregular expression test. % Succeeds, matches hai. : re_create 216 IBM Tivoli Enterprise Console:

233 re_send_event_conf. : re_send_event_conf(_conf_file, _event) :. TEC_RULES..conf,., host.conf, _conf_file host , ConnectionMode connection_oriented..,, (, BufEvtPath=/etc/tivoli/orange.cache ). re_send_event_conf. IBM Tivoli Enterprise Console. ServerLocation=orange.tivoli.com TestMode=no BufEvtPath=/etc/Tivoli/orange.cache # ConnectionMode=connection_oriented :,. wrb -imptgtdata. wrb IBM Tivoli Enterprise Console :. _conf_file. _event. : host.conf. re_send_event_conf( host,_event) : forward_event 4 217

234 re_split_event_id server_path. : re_split_event_id(_path_element, _host, _server_handle, _date_reception, _event_handle) :, server_path, (). server_path.. 8 ID. server_path IBM Tivoli Enterprise Console. : _date_reception. date_reception. _event_handle. event_handle. _host hostname. $BINDIR/TME/TEC/.tec_config tec_rule_host. _path_element server_path.. _server_handle. $BINDIR/TME/TEC/.tec_config tec_server_handle. : server_path. bo_get_slotval(_event,server_path,_server_path), % Get the list for the server_path attribute. member(_item,_server_path), % Get an element of the list. % Because _item is free, the list will be traversed % and each element will be returned in succession. 218 IBM Tivoli Enterprise Console:

235 re_split_event_id(_item,_host,_server_handle, _date_reception,_event_handle) % Parse each element into variables. : bo_get_slotval, member 4 219

236 re_substitute,. : re_substitute(_name, _string, _substitute, _result) : re_create _string.. _substitute _result. Perl. : _name re_create. _result _string.. _substitute. :. re_create(test, a.*w ) % Create regular expression test. re_substitute(test, hawk, oo,_result) % Search hawk usingregular expression test. % Return the new stringin _result. % Succeeds, hook returned in _result. : re_create, re_substitute_global 220 IBM Tivoli Enterprise Console:

237 re_substitute_global,. : re_substitute_global(_name, _string, _substitute, _result) : re_create _string.. _substitute _result. Perl. : _name re_create. _result _string.. _substitute. :. re_create(test, a.*w ) % Create regular expression test. re_substitute_global(test, hawkhawkhawk, oo,_result) % Search hawk usingregular expression test. % Return the new stringin _result. % Succeeds, hookhookhook returned in _result. : re_create, re_substitute 4 221

238 redo_analysis. : redo_analysis(_event) :,.. : redo_analysis. A B,. : _event. : INSTALLATION_FAILED. rule: disk_full_check_install_failed: ( description: look for installationfailed events for this host, event: _event of_class DISK_FULL where [status: equals OPEN, hostname: _hostname ], action: ( all_instances(event: _install_ev of_class INSTALLATION_FAILED ) ). where [target_host: equals _hostname], _event ), redo_analysis(_install_ev) :. 222 IBM Tivoli Enterprise Console:

239 remove_bslashes.. : remove_bslashes(_path1, _path2) : _path1 _path2. : _path1 _path2 :... % Assign value. _path="\\tivoli\\data\\repository, % Convert back slashes. % _new_path is unified with /tivoli/data/repository. remove_bslashes(_path,_new_path) :

240 reset_event_activity 0. : reset_event_activity : 0. print_event_activity. : :.. timer_rule: reset_event_activity: ( event: _event of_class _class where [ ], ) ). timer_info: equals Event Activity Report, timer_duration: _rep_freq, action: reset_activity: ( % recorded(event_activity,active), % Line above used with im.rls (intermediate mgr. rules) print_event_activity, reset_event_activity, set_timer(_event,_rep_freq, Event Activity Report ) : print_event_activity 224 IBM Tivoli Enterprise Console:

241 reset_global_grp. : reset_global_grp(_group, _value) :.,, _value. : _group. _value. : Maintenance off. reset_global_grp( Maintenance, off ), : set_global_var 4 225

242 resolve_time. : resolve_time(_time_structure, _seconds, _minutes, _hours, _day_of_month, _month, _year, _day_of_week, _day_of_year, _daylight_saving) : _time_structure. _time_structure resolve_time.. (GMT). : _day_of_month _day_of_week 0-6. _day_of_year _daylight_saving DST_ <sys/time.h>... Solaris. #define DST_NONE 0 /* not on dst */ #define DST_USA 1 /* USA style dst */ #define DST_AUST 2 /* Australian style dst */ #define DST_WET 3 /* Western European dst */ #define DST_MET 4 /* Middle European dst */ #define DST_EET 5 /* Eastern European dst */ #define DST_CAN 6 /* Canada */ #define DST_GB 7 /* Great Britain and Eire */ #define DST_RUM 8 /* Rumania */ #define DST_TUR 9 /* Turkey */ #define DST_AUSTALT 10 /* Australian style with shift in 1986 */ _hours _minutes _month IBM Tivoli Enterprise Console:

243 _seconds _time_structure. _time_epoch epoch get_time. _year :,, month _month. get_local_time(_time_local_struct), resolve_time(_time_local_struct, _seconds, _minutes, _hours, _day_of_month, _month, _year, _day_of_week, _day_of_year, _daylight_savings), bo_set_slotval(_event, month, _month) : bo_set_slotval, get_local_time 4 227

244 save_globals. : : save_globals(_file, _group). : _file _group.. : Maintenance. save_globals( /tmp/globalvars.txt, Maintenance ) : load_globals 228 IBM Tivoli Enterprise Console:

245 search_cache create_cache_search_criteria. : search_cache(search_name, _referenceevent, _maxevents, _foundevent) ---- search_cache(search_name, _referenceevent, _timebefore, _timeafter, _maxevents, _foundevent) :. create_cache_search_criteria. _timebefore _timeafter.. get_attributes. : _foundevent. _maxevents. _referenceevent. search_name. create_cache_search_criteria. -timeafter. -timebefore. : db_critical_search

246 search_cache( db_critical_search, _refevent, 600, 600, 5, _found_event) : create_cache_search_criteria 230 IBM Tivoli Enterprise Console:

247 set_detailed_debugging. : set_detailed_debugging(on) ---- set_detailed_debugging(off) : trace_it. set_detailed_debugging. : off on.. : check_data (_data) my_predicate. check_data.. 1. set_detailed_debugging. 2. my_predicate. set_log_error_source. 3. check_data trace_it. 4. check_data, log_error Bad Data my_predicate ID. tell_err. check_data, TEC_Error CRITICAL, Bad Data my_predicate ID. ID msg.. set_detailed_debugging(on), my_predicate(_data):- set_log_error_source(my_predicate), ( trace_it(check_data), process_data(_data) ; ) log_error( Bad Data %s,[_data], CRITICAL ) 4 231

248 :. 232 IBM Tivoli Enterprise Console:

249 set_event_administrator. : : set_event_administrator(_event, new_administrator) administrator. :., set_event_administrator place_change_request. : _event. new_administrator. :. set_event_administrator(_event, bjones) : change_event_administrator, place_change_request 4 233

250 set_event_message msg. : : set_event_message(_event, _format, [_value]) C sprintf(). :., set_event_message place_change_request. : _event msg. _format msg.. %c. %d. %e. %f. %g ( ). %o 0 8. %s. %u. %x 0x 16. % n n.m, n., n m. _value msg.. :. _integer is 123, _real is 12.3, _string= Hello, World, 234 IBM Tivoli Enterprise Console:

251 % Assign values. set_event_message(_event, %s, [_string]), % msgattribute assigned Hello, World. set_event_message(_event, %20s, [_string]), % msgattribute assigned Hello, World. set_event_message(_event, %-20s, [_string]), % msgattribute assigned Hello, World. set_event_message(_event, Integer in decimal notation: %d, [_integer]), % msg attribute assigned Integer in decimal % notation: 123. set_event_message(_event, Integer in decimal notation with field width: %10d, [_integer]), % msg attribute assigned Integer in decimal % notation with field width: 123 set_event_message(_event, Integer in decimal notation with leadingzeros: %010d, [_integer]), % msg attribute assigned Integer in decimal % notation with leadingzeros: set_event_message(_event, Integer in octal notation: %o, [_integer]), % msg attribute assigned Integer in octal % notation: 173. set_event_message(_event, Integer in hexadecimal notation: %x, [_integer]), % msg attribute assigned Integer in hexadecimal % notation: 7b set_event_message(_event, Real in decimal notation: %f, [_real]), % msgattribute assigned Real in decimal % notation: set_event_message(_event, Real in decimal notation with field width: %3.2f, [_real]), % msgattribute assigned Real in decimal % notation with field width: set_event_message(_event, Real in real notation: %f, [_real]), % msgattribute assigned Real in real notation: % set_event_message(_event, Real in exponential notation: %e, [_real]), % msgattribute assigned Real in exponential % notation: e

252 set_event_message(_event, Real in its shortest form: %g, [_real]) % msgattribute assigned Real in its shortest form: : place_change_request 236 IBM Tivoli Enterprise Console:

253 set_event_severity. : : set_event_severity(_event, new_severity). :., set_event_severity place_change_request. : _event. new_severity. :. set_event_severity(_event, CRITICAL ) : change_event_severity, place_change_request 4 237

254 set_event_status. : : set_event_status(_event, new_status). : 1.., set_event_status place_change_request. 2. status CLOSED, duration : _event. new_status status. status 8. : 1. CLOSED. 2. new_status ACK OPEN. : status ACK. set_event_status(_event, ACK ) : change_event_status, place_change_request 238 IBM Tivoli Enterprise Console:

255 set_global_var. : set_global_var(_group, _key,_value) :., []. : _group _key.. _value. :. set_global_var( My group key, _key, My value ) set_global_var( My group key, _key, [ a, b, c ]) set_global_var( Maintenance, _origin, on ) : reset_global_grp 4 239

256 set_log_error_source log_error ID. : set_log_error_source( source_location ) :. ID(, ). : source_location. : check_data (_data) my_predicate. check_data.. 1. my_predicate. set_log_error_source. 2. check_data trace_it., set_detailed_debugging. trace_it. 3. check_data, log_error Bad Data my_predicate ID. tell_err. check_data, TEC_Error CRITICAL, Bad Data my_predicate ID. ID msg. my_predicate(_data):- set_log_error_source(my_predicate), ( trace_it(check_data), process_data(_data) ; ) log_error( Bad Data %s,[_data], CRITICAL ) ) : log_error 240 IBM Tivoli Enterprise Console:

257 set_timer. : set_timer(_event, timer_duration, timer_info) :.., TEC_Tick.,.,. : _event. timer_duration ( ).. timer_info.,.. :..,,. rule: ( event: _event of_class TEC_Start where [ ], reception_action: ( first_instance(event:_ev of_class TEC_Tick where []), set_timer(_event, 600, Event Activity Report ) ) ). timer_rule: reset_print_activity: ( event: _event of_class _class where [ ], timer_info: equals Event Activity Report, timer_duration: _rep_freq, action: reset_print_activity: ( print_event_activity, 4 241

258 ) ). reset_event_activity, set_timer(_event,_rep_freq, Event Activity Report :. 242 IBM Tivoli Enterprise Console:

259 trace_it. : : trace_it(predicate_name). :. : predicate_name. : check_data (_data) my_predicate. check_data.. 1. my_predicate. set_log_error_source. 2. check_data trace_it., set_detailed_debugging. trace_it. 3. check_data, log_error Bad Data my_predicate ID. tell_err. check_data, TEC_Error CRITICAL, Bad Data my_predicate ID. ID msg. my_predicate(_data):- set_log_error_source(my_predicate), ( trace_it(check_data), process_data(_data) ; ) log_error( Bad Data %s,[_data], CRITICAL ) ) : set_detailed_debugging 4 243

260 unlink_from_cause. : unlink_from_cause(_effect_event) :, cause_date_reception cause_event_handle 0. : _effect_event. :. unlink_from_cause(_oserv_down_event) : link_effect_to_cause 244 IBM Tivoli Enterprise Console:

261 update_event_activity print_event_activity_report. : update_event_activity(_event) :.. : _event. :. rule: update_event_activity: ( event: _event of_class _class where [ ], reception_action: update_activity: ( % recorded(event_activity,active), % Line above used with im.rls (intermediate mgr. rules) ) ). update_event_activity(_event) : print_event_activity 4 245

262 246 IBM Tivoli Enterprise Console:

263 5 IBM Tivoli Enterprise Console , BAROC $BINDIR/TME/TEC/samples/correlation..,,,.., APC UPS(uninterruptible power supply). Copyright IBM Corp

264 upsonbattery lowbattery upsdischarged powerrestored returnfromlowbattery dischargecleared UPS upsonbattery. upsonbattery., lowbattery UPS. upsdischarged. upsdischarged UPS. :..., A B, B C, C D,. A D,. A B, A C, A D, B C, B D.. powerrestored, returnfromlowbattery dischargecleared..., powerrestored upsonbattery.. IBM Tivoli Enterprise Console, IBM Tivoli Enterprise Console:

265 .. v. v.. Compaq Insight Manager cpqtape3phydrvstatuschange. cpqtapephydrvcondition Degraded, Failed OK. OK. Distributed Monitoring SNMP. cpqtape3phydrvstatuschange ( cpqtapephydrvcondtion=degraded) cpqtape3phydrvstatuschange (cpqtapephydrvcondtion=failed) cpqtape3phydrvstatuschange (cpqtapephydrvcondtion=ok)., 248.,., A B, C D. Cisco ( ). Compaq Insight ( ) cpqda3phydrvstatus

266 CiscoLinkDown cpqda3phydrvstatuschange (cpqda3phydrvstatus=failed) CiscoLinkUp cpqda3phydrvstatuschange (cpqda3phydrvstatus=ok)..,,. ( : ),.,.,. 248 upsbatteryon lowbattery upsdischarged. upsonbattery lowbattery upsdischarged. upsbatteryon upsdischarged lowbattery upsonbattery. 250 IBM Tivoli Enterprise Console:

267 .,.. ( : ),.,,.,. 248 UPS, upsdischarged upsonbattery. upsonbattery lowbattery., upsdischarged ( ) powerrestored upsonbattery, returnfromlowbattery lowbattery.,,..,.. ( ),.,.,

268 , ( ).. v v v. 1. :,,.,. 2. :,.. :,.,. 3. :,. ( ),. 4. :,.,,.. 1. : : :.,., ( ). 252 IBM Tivoli Enterprise Console:

269 4. :, ( ).. ( ). 5. : :...,. IBM Tivoli Enterprise Console 3.7. v,.,.... v....,.,,.., ( )

270 . 1.. TEC_Start, v create_event_sequence create_clearing_event. v., Compaq Insight Managersms. v., v TEC_Start. 149 create_event_sequence 143 create_clearing_event.... (, first_causal_event ),..,.,. 254 IBM Tivoli Enterprise Console:

271 . (create_event_sequence ),. create_clearing_event ( create_event_sequence ),. any_clear_target all_clear_targets.,..,,. any_clearing_event,..,... v create_event_sequence create_clearing_event. v., 2 (1, 1 ).. v TEC_Start.. all_clear_targets

272 any_clear_target any_clearing_event first_causal_event first_effect_event first_related_event is_clearing_event..... create_clearing_event create_event_sequence TEC_Start ( ). TEC_Start.. rule: create_event_sequences : ( event: ev of_class TEC_Start, reception_action: create_sequences :( create_event_sequence( [ upsonbattery, lowbattery, upsdischarged, universal_host ], [ hostname, [ status, outside,[ CLOSED ]] [ clears( powerrestored,[ ], [ upsonbattery ],[ ]), clears( returnfromlowbattery,[ ], [ lowbattery ],[ ]), clears( dischargecleared,[ ],[ upsdischarged ],[ ]), clears( universal_host, [ [ severity, equals, HARMLESS ] ] [ universal_host ], [ ]), attr_condition( universal_host, [ severity,equals, FATAL ]), attr_exception( hostname, universal_host, probe_arg ) ] 256 IBM Tivoli Enterprise Console:

273 ), create_event_sequence( [ cpqtape3phydrvstatuschange ], [ hostname, [ status, outside,[ CLOSED ]]] [ attr_sequence( cpqtape3phydrvstatuschange, cpqtapephydrvcondition =[ Degraded, Failed ]), clears( cpqtape3phydrvstatuschange, [ [ cpqtapephydrvcondition,equals, OK ] ], [ cpqtape3phydrvstatuschange ], []) ] ), create_clearing_event( CiscoLinkUp, [ ], [ CiscoLinkDown ],[ origin ],no), create_clearing_event( cpqda3phydrvstatuschange, [ [ cpqdaphydrvstatus,equals, OK ] ], [ cpqda3phydrvstatuschange ], [ hostname, [ cpqdaphydrvstatus,not_equals, OK ] ], no), ) ). commit_set 256,. process_problem_events : process_problem_events ( ). ( ).. 1. check_for_clear..,.,,. :

274 2. duplicate_detect. repeat_count,,. 3. check_for_prior_cause.,.. 4. check_for_effect (, ).,,,. 5. open_trouble_ticket.,.,. scripts/create_trouble_ticket.sh.. v check_for_prior_cause check_for_effect,.,. v,... : process_problem_events. rule: process_problem_events :( event: _ev of_class EVENT, 258 IBM Tivoli Enterprise Console: reception_action: check_for_clear :( ( is_clearing_event(_ev), commit_action ; ( any_clearing_event(_ev, _clr, 3600, 0), set_event_status(_ev, CLOSED ), change_event_administrator( _ev,

275 ) ), Event ProcessingRule ) ; commit_set ) reception_action: duplicate_detect ( first_duplicate( _ev,event: _dup_ev where [ status: outside [ CLOSED ]], _ev ), add_to_repeat_count(_dup_ev, 1), drop_received_event, commit_set ), reception_action: check_for_prior_cause :( prior_causal_event(_ev, _cause, 3600, 0), link_effect_to_cause(_ev, _cause), set_event_severity(_ev, ACK ), exec_program(_ev, scripts/update_trouble_ticket.sh, %ld, [_cause], no), commit_set ), reception_action: check_for_effect :( first_effect_event(_ev, _effect, 3600, 0), link_effect_to_cause(_effect, _ev), set_event_severity(_effect, ACK ), exec_program(_ev, scripts/update_trouble_ticket.sh, %ld, [_effect], no), commit_set ), reception_action: open_trouble_ticket :( exec_program(_ev, scripts/create_trouble_ticket.sh, %ld, [_ev], no), exec_program(_ev, scripts/notify_admin.sh, admin_group, [], no), commit_set ) ). process_clearing_event : process_clearing_event., process_problem_events. (, ), process_problem_events commit_set process_clearing_event

276 , process_problem_events check_for_clear.. ( ).. CLOSED. rule: process_clearing_event : ( event: _clr_ev of_class EVENT, reception_action: clear_all_targets ( all_clear_targets(_clr_ev, _target, 3600, 0), set_event_status(_target, CLOSED ), change_event_administrator(_target, ClearingEvent Rule )), reception_action: exit ( commit_set ) ). :... process_clearing_event. 259 process_clearing_event.,. process_problem_events process_clearing_event. 257 process_problem_events. first_causal_event first_effect_event first_related_event.. :. rule: process_clearing_event : ( event: _clr_ev of_class EVENT, reception_action: clear_all_targets ( is_clearing_event(_ev), 260 IBM Tivoli Enterprise Console:

277 ) ). ( ; ) all_clear_targets(_clr_ev, _target, 3600, 0), set_event_status(_target, CLOSED ), change_event_administrator(_target, ClearingEvent Rule ) commit_set rule: process_problem_events :( event: _ev of_class EVENT, reception_action: duplicate_detect ( first_duplicate(_ev, event: _dup_ev where [status:outside [ CLOSED ]], _ev ), add_to_repeat_count(_dup_ev, 1), drop_received_event, commit_set ), reception_action: check_for_related :( first_related_event(_ev, _related, _type, 3600, 0), ( _type == c, set_event_status(_ev, ACK ), link_effect_to_cause(_ev, _related) ; set_event_status(_related, ACK ), link_effect_to_cause(_related, _ev) ), exec_program(_ev, scripts/update_trouble_ticket.sh, %ld, [_related], no), commit_set ), reception_action: open_trouble_ticket :( exec_program(_ev, scripts/create_trouble_ticket.sh,, [], no), exec_program(_ev, scripts/notify_admin.sh, admin_group, [], no), commit_set ) )

278 262 IBM Tivoli Enterprise Console:

279 6, IBM Tivoli Enterprise Console,. v v. v wpostemsg postemsg v tec_agent_demo v SendEvents wpostemsg postemsg.. wpostemsg TME Tivoli Management Framework. postemsg TME Tivoli Management Framework. Tivoli Enterprise Console. tec_agent_demo tec_agent_demo..... tec_agent_demo tec_agent_demo. events_list.. Copyright IBM Corp

280 TEC_Start NT_NAV_start NT_NAV_stop NT_Perf_Alert TEC_Stop..,,, /test/tec_start. 264 NT_Perf_Alert... v.. v (;). v. v (#). v END. NT_Performance_Alert; hostname=mfoster; origin= ; category=0; eventtype=information;sid=n/a;sub_source=perfmon; id=2000; msg= \\MFOSTER ; Object: Processor ; Counter: % Processor Time ; Instance: 0 ; Parent: ; Value: ; Trigger: > ; date= Apr 29 14:36: ; sub_origin=mfoster;computer=\\mfoster; END 265. tec_agent_demo. 1. bash UNIX Tivoli (, setup_env.sh ),. export TEC_BIN_DIR=$BINDIR/TME/TEC 2.. $TEC_BIN_DIR/tec_agent_demo -data /control_file_dir control_file_dir. events_list IBM Tivoli Enterprise Console:

281 3. Enter.. Ctrl+c. SendEvents SendEvents... v x. v. SendEvents 266 events_list time_list... SendEvents.. 1. Tivoli (, setup_env.sh ). 2. bash UNIX.. $BINDIR/TME/TEC/contrib/SendEvents.pl \ -d directory -t time -d directory, events_list time_list.. -t time..,. tec_agent_demo SendEvents... 6, 265

282 1. Tivoli (, setup_env.sh ). 2. bash UNIX. directory ( ), events_list time_list. wtdumprl $BINDIR/TME/TEC/contrib/ParseEvents.pl \ -d directory. -d /test3.., event0001 event0001. ParseEvents.pl,., event0001 event0002., tec_agent_demo,. SendEvents. 266 IBM Tivoli Enterprise Console:

283 ,. wrb -comprules -trace,.,..... /tmp/rules.trace. tail -f. :.. wrb -comprules -trace.....,... directive: trace % Start trace. rule: rule1: (... ). % End rule1. rule: rule2: (... ). % End rule2. 6, 267

284 rule: rule3: (... ). % End rule3. % End rule set. % End trace.,... rule: test_rule: ( directive: trace, event: _evt of_class within [ NT_NAV ] where [ ], reception_action: action0:( drop_received_event ) )......,. Prolog Prolog. Prolog. Prolog. 268 IBM Tivoli Enterprise Console:

285 . my_first_set. rule: my_first_rule: ( description: Simplerule, event: _ev of_class HIGH_CPU_USAGE where [usage: _usage, hostname: equals my_server ], action: auto_ack: ( set_event_status(_ev, ACK ), set_event_administrator(_ev, john ) ), ) ). action: page_administrator: ( exec_program(_ev, send_cpu_usage_to_pager, john my_server %d, _usage], NO ) my_first_set. [117]=> rule set my_first_set :. my_first_rule. [118] -> rule my_first_rule event : 0x2c0b88 of_class HIGH_CPU_USAGE :... [119] call condition [120] call usage: _125 [121] exit usage: 95 [122] call hostname: _126 [123] exit hostname: my_server [124] call hostname: my_server equals my_server [125] exit hostname: my_server equals my_server [126] exit condition 6, 269

286 (usage hostname), hostname (my_server).. (_).,. HIGH_CPU_USAGE my_server (another_host).. [119] call condition [120] call usage: _125 [121] exit usage: 95 [122] call hostname: _126 [123] exit hostname: another_host [124] call hostname: another_host equals my_server [125] fail hostname: another_host equals my_server [126] fail condition,,. :.,.,.. v. v. (auto_ack page_administrator). auto_ack (set_event_status set_event_administrator). page_administrator exec_program. [127] call action auto_ack [128] call set_event_status(0x2c0b88, ACK) [129] exit set_event_status(0x2c0b88, ACK) [130] call set_event_administrator(0x2c0b88, john) [131] exit set_event_administrator(0x2c0b88, john) [132] exit action auto_ack [133] call action page_administrator [134] call exec_program(0x2c0b88, send_cpu_usage_to_pager, 270 IBM Tivoli Enterprise Console:

287 john my_server %d,[95],no) [135] exit exec_program(0x2c0b88, send_cpu_usage_to_pager, john my_server %d,[95],no) [136] exit action page_administrator : send_cpu_usage_to_pager. exec_program,.,. (_126 my_server 134 ).,.,.,.,.,,,.. action: ( all_instances(event: _nfs_ev of_class NFS_SERVER_NOT_RESPONDING where [server: equals Pascal ]), ) set_event_status (nfs_ev, CLOSED ) Pascal NFS_SERVER_NOT_RESPONDING all_instances. [139] call reception_action action_1 [140] call all_instances(event : _366 of_class NFS_SERVER_NOT_RESPONDING where [server:equals Pascal],0x2c0b ) [141] exit all_instances(event : 0x2c0ae0 of_class NFS_SERVER_NOT_RESPONDING where [server:equals 6, 271

288 Pascal],0x2c0b ) [142] call set_event_status(0x2c0ae0, CLOSED) [143] exit set_event_status(0x2c0ae0, CLOSED) [144] exit reception_action action_ all_instances. [145] redo reception_action action_1 [146] redo all_instances [147] exit all_instances(event : 0x2eabf0 of_class NFS_SERVER_NOT_RESPONDING where [server:equals \ Pascal],0x2c0b ) [148] call set_event_status(0x2c0ae0, CLOSED) [149] exit set_event_status(0x2cae0, CLOSED) [150] exit reception_action action_ all_instances. [151] redo reception_action action_1 [152] redo all_instances [153] fail all_instances(event : _366 of_class NFS_SERVER_NOT_RESPONDING where [server:equals Pascal],0x2c0b ) [154] fail reception_action action_1.,.. v ( ) v v ( ) v :. 272 IBM Tivoli Enterprise Console:

289 . ============================================ TimingSummary test_rls: Time for last Event: e-02 Event Count: 2 Total Time: e-01 Events per second: e ============================================,. wrb -comprules -profile.. $DBDIR/tec/profile.,,.. wrb -comprules -profile.,,.,.,.. directive: profile % Start profiling. rule: rule1: (... ). % End rule1. rule: rule2: (... 6, 273

290 ). % End rule2. rule: rule3: (... ). % End rule3. % End rule set. % End profiling.,,., profile_off.. rule: test_rule: ( directive: profile, event: _evt of_class within [ NT_NAV ] where [ ], reception_action: action0:( drop_received_event ) ). 274 IBM Tivoli Enterprise Console:

291 7 Netview TCP/IP NetView TCP/IP ( NetView ) IBM Tivoli Enterprise Console., NetView. IBM Tivoli Enterprise Console NetView netview.rls. NetView IBM Tivoli Switch Analyzer. IBM Tivoli Switch Analyzer. NetView., NetView. NetView.. netview.rls. NetView NetView NetView.., wcrtnvgroups NetView. IBM Tivoli Enterprise Console wcreatnvgroups. NetView TCP/IP NetView NetView. TEC_ITS_INTERFACE_STATUS TEC_ITS_ISDN_STATUS. UP, DOWN, ADMIN_DOWN UNREACHABLE. ISDN. ACTIVE DORMANT. Copyright IBM Corp

292 TEC_ITS_L2_STATUS TEC_ITS_NODE_STATUS TEC_ITS_ROUTER_STATUS TEC_ITS_SA_STATUS TEC_ITS_SNMPCOLLECT_THRESHOLD TEC_ITS_SUBNET_CONNECTIVITY TEC_ITS_SA_STATUS NetView. UP, DOWN MARGINAL.. UP, DOWN MARGINAL.. UP, DOWN MARGINAL. IBM Tivoli Switch Analyzer. ifdown, nodedown, nodemarginal, ifup, ifunmanaged, ifdeleted, nodeup, nodeunmanaged, noderesolved nodedeleted. NetView SNMP (rearm ). THRESHOLD_EXCEEDED REARMED.. UNREACHABLE REACHABLEAGAIN. NetView NetView IBM Tivoli Enterprise Console NetView., NetView., NetView.. v TEC_ITS_INTERFACE_STATUS v TEC_ITS_NODE_STATUS v TEC_ITS_ROUTER_STATUS NetView, NetView SNMP. NetView. NetView. v TEC_ITS_INTERFACE_STATUS 276 IBM Tivoli Enterprise Console:

293 v TEC_ITS_NODE_STATUS v TEC_ITS_ROUTER_STATUS NetView,., DOWN TEC_ITS_NODE_STATUS.,. NetView.. NetView NetView IBM Tivoli Enterprise Console,.., NetView DOWN TEC_ITS_ROUTER_STATUS. NetView TEC_ITS_ROUTER_STATUS UP. TEC_ITS_ROUTER_STATUS.. v TEC_ITS_INTERFACE_STATUS v TEC_ITS_ISDN_STATUS v TEC_ITS_SNMPCOLLECT_THRESHOLD_STATUS v TEC_ITS_NODE_STATUS v TEC_ITS_ROUTER_STATUS v TEC_ITS_SUBNET_CONNECTIVITY v TEC_ITS_L2_STATUS v TEC_ITS_SA_STATUS TEC_ITS_SA_Status TEC_ITS_SA_STATUS. 7 Netview TCP/IP 277

294 .,... ifdown, nodedown, nodemarginal ifup, nodeup, noderesolved ifunmanaged, ifdeleted, nodeunmanaged, nodedeleted HARMLESS, ifdown TEC_ITS_SA_STATUS. ifdown TEC_ITS_SA_STATUS. TEC_ITS_SA_STATUS. NetView NetView ,. DOWN ADMIN_DOWN TEC_INTERFACE_STATUS. v DOWN MARGINAL TEC_ITS_NODE_STATUS v DOWN MARGINAL TEC_ITS_ROUTER_STATUS, NetView DOWN TEC_ITS_INTERFACE_STATUS.., NetView TEC_ITS_ROUTER_STATUS DOWN. 278 IBM Tivoli Enterprise Console:

295 router-down, TEC_ITS_INTERFACE_STATUS, TEC_ITS_INTERFACE_STATUS TEC_ITS_ROUTER_STATUS., TEC_ITS_ROUTER_EVENT..,.,. DOWN MARGINAL TEC_ITS_ROUTER_STATUS UNREACHABLE TEC_ITS_SUBNET_CONNECTIVITY. NetView NetView DOWN MARGINAL TEC_ITS_ROUTER_STATUS., NetView., NetView TEC_ITS_ROUTER_STATUS. UNREACHABLE. NetView TEC_ITS_SUBNET_CONNECTIVITY UNREACHABLE. TEC_ITS_SUBNET_CONNECTIVITY. IBM Tivoli Switch Analyzer, IBM Tivoli Switch Analyzer ( : ). IBM Tivoli Switch Analyzer, NetView TEC_ITS_SA_STATUS., NetView,. TEC_ITS_SA_STATUS., IBM Tivoli Switch Analyzer NetView TEC_ITS_SA_STATUS 7 Netview TCP/IP 279

296 . NetView TEC_ITS_ROUTER_STATUS. DOWN TEC_ITS_SA_STATUS. IBM Tivoli Enterprise Console TEC_ITS_SA_STATUS. netview.rls NetView. NetView,., IBM Tivoli. Heartbeat_Unreachable IBM Tivoli., NetView TEC_ITS_SUBNET_CONNECTIVITY UNREACHABLE. IP, IP Heartbeat_Unreachable TEC_ITS_SUBNET_CONNECTIVITY. TEC_ITS_SUBNET_CONNECTIVITY TEC_ITS_UNREACHABLE ip_unreachable IP., IBM Tivoli 5.1. IBM Tivoli Distributed Monitoring NetView. 280 IBM Tivoli Enterprise Console:

297 8..,. IBM Tivoli Enterprise Console.,..,... startup.rls. startup.rls.., TEC_Start...,.. startup.rls event_activity.rls event_filtering.rls heartbeat.rls maintenance_mode.rls event_thresholds.rls correlation.rls forwarding.rls shutdown.rls :.. Copyright IBM Corp

298 .,.... Record Prolog record.,. record, Prolog. Record.. Record record rerecord recorded erase.. v Prolog v v v Prolog. tell_err Prolog stderr. tell Prolog stdout. 282 IBM Tivoli Enterprise Console:

299 tell_err( /tmp/prolog.err ), % Route stderr to file tell( /tmp/out ), % Route stdout to a file (on)., (off). Tivoli Enterprise Console ( )..... set_detailed_debugging(on),. drop_internal_error_event TEC_Error.., TEC_Error ( : ).., drop_internal_error_event., drop_internal_error_event, TEC_Error., netview.rls.,. restore_event_cache., Prolog.. get_execution_mode(_mode), ( _mode \== tec_server_mode -> restore_event_cache; true ) % Restores the cache if runningon % a TEC event server 8 283

300 .. v v v v v,, init_event_activity create_event_criteria. record.., harmless_maintenance harmless_heartbeat,. record(event_filter_criteria, [harmless_maintenance, harmless_heartbeat]).. create_cache_search_criteria 141 create_event_criteria 146 create_threshold 154 create_threshold create_cache_search_criteria. create_cache_search_criteria create_event_criteria.., create_event_criteria. 284 IBM Tivoli Enterprise Console:

301 create_event_criteria(all_critical, EVENT, yes, [[ severity, equals, CRITICAL ]] ), % Name of criteria % Class % Fire on non-leaf % Attribute conditions.. create_cache_search_criteria(critical_severity_search, % Name of the search all_critical, % Event criteria to use [hostname], % These attribute values must % match the received/cached events no % Compare duplicate detect slots ), create_threshold(critical_threshold, % Name of threshold critical_severity_search, % Cache search to use 60, % Reception period (in seconds) 5, % Event threshold count 300 % Maximum reportingfrequency ), TEC_Heartbeat. TEC_Heartbeat. TEC_Heartbeat. TEC_Heartbeat. ENUMERATION tec.baroc. ONE, TWO, THREE, FOUR FIVE. FIVE., tec.baroc.., TEC_Heartbeat.. record(heartbeat, ONE,[60, FATAL ]), % Level ONE, check pulse every 60 seconds, FATAL severity % if pulse missed

302 record(heartbeat, TWO,[300, CRITICAL ]), % Level TWO, check pulse every 300 seconds, CRITICAL % severity if pulse missed. record(heartbeat, THREE,[600, MINOR ]), % Level THREE, check pulse every 600 seconds, MINOR % severity if pulse missed. record(heartbeat, FOUR,[1800, WARNING ]) % Level FOUR, check pulse every 1800 seconds, WARNING % severity if pulse missed. record(heartbeat, FIVE,[3600, HARMLESS ]), % Level FIVE, check pulse every 3600 seconds, HARMLESS % severity if pulse missed.,, /.. TEC_Maintenance. mode_status TEC_Maintenance., TEC_Maintenance. TEC_Maintenance ON current_mode. TEC_Maintenance OFF current_mode. :, current_mode OFF TEC_Maintenance. mode_status Timeout TEC_Maintenance., max_time. record(maintenance_mode,max_time,2600), % Set maintenance mode to 1 hour. 286 IBM Tivoli Enterprise Console:

303 TEC_Maintenance, severity. record(maintenance_mode,severity, WARNING ), % Set severity for event generated when a host has been in % maintenance mode past max_time.. APC,.. : APC..../TEC/samples/correlation/apc_ups/apc.baroc create_event_sequence create_clearing_event, % commlost % % This defines a clearingrelationship between the communicationlost % event and the communicationsestablished event create_clearing_event( communicationestablished, %clearing event [ ], %clearingconditions [ communicationlost ], %cleared event [hostname]), %cleared attribute conditions % upssupplyingpower % % This defines a cause-effect correlation sequence between the upsonbattery, % lowbattery, and upsdischarged events. %cause chain of events create_event_sequence([ upsonbattery, lowbattery, upsdischarged ], %attribute conditions for the cause chain of events [hostname, [ status, not_equals, CLOSED ]], [ %clearingrelationships in the cause chain of events clears( powerrestored, [ ], [ upsonbattery ], [ ]), clears( returnfromlowbattery,[ ], [ lowbattery ],[ ]), clears( dischargecleared, [ ], [ upsdischarged ], [ ]), ]),. S ( TEC_Start, TEC_Maintenance TEC_Stop ) tec_forward.conf. forward_event. tec_forward.conf 183 forward_event

304 TEC_Stop.,,. 288 IBM Tivoli Enterprise Console:

305 9 IBM Tivoli Enterprise Console Prolog. IBM Tivoli Enterprise Console, Prolog GUI. : 1.,. 2. wrb -crtrb EventServer. wrb -imptgtrule EventServer upgrade_gui.sh ,,. upgrade_gui.sh IBM Tivoli Enterprise Console. Prolog.. GUI.. Prolog.., 60.,,. Copyright IBM Corp

306 GUI UTF-8, UTF-8.,., so-v UTF-8. wiconv Tivoli Management Framework, 3.6. BAROC UTF BAROC., IBM Tivoli Enterprise Console:

307 A B 9 291

308 C D E F G H I J , ,,. BAROC,. :,,.,. Tivoli Tivoli Management Framework, Tivoli, Tivoli...,. ( ) IBM Tivoli Enterprise Console:

309 ,...,

310 1. T/EC, -> new_set T/EC. 2. new_set. 3. Enter. new_set. :. 294 IBM Tivoli Enterprise Console:

311 ., TEC ->..,..,., login su. Logfile_Login, Logfile_Su, Logfile_Passwd.,. ( Logfile_Login Logfile_Su ), fire_on_non_leaf ( 85 fire_on_non_leaf ). :, ( ).. v v v 9 295

312 v. 1., -> -> : New Simple Rule a IBM Tivoli Enterprise Console:

313 b.. v. v,,., su,,. su, su. Logfile_Su, Root_Login_Success, Su_Success, Root_Login_Success_From Su_Failure.. c.,. d

314 , Host_Down hostname, Host_Down. BAROC. a.. b.. c.. in list. none. not in list. d.. Enter.. e.,.., 298 IBM Tivoli Enterprise Console:

315 . f.,.. g.,... h.,

316 a..... :. 300 IBM Tivoli Enterprise Console:

317 b..,... N., Change_Severity., Change_Severity.,. N.,.. c.,.. d...,,.,

318 e....,,,,.. OPEN, RESPONSE, ACK CLOSED. msg... TEC_RULES tec_forward.conf ServerLocation. tec_forward.conf 183 forward_event. CLOSED., repeat_count...,.,,.., IBM Tivoli Enterprise Console:

319 ..,. $BINDIR/TME/TEC.. f.,

320 g.,. h.. ( : msg ).,. wruntask.. wruntask Tivoli Management Framework, 3.6. : (, ), -h event_server_hostname -l TaskLibraryName.,. 304 IBM Tivoli Enterprise Console:

321 i... j.... ( )., Host_Down NFS, NFS_Server_No_Response.,

322 :, ( ).. v v v. 1. -> -> : New Compund Rule IBM Tivoli Enterprise Console:

323 a..,. b.,.. c.,.. d

324 ,. is-caused-by is-canceled-by., causes cancels.., NFS_No_Response Host_Unreachable. Host_Unreachable Host_Up. Host_Up, NFS_No_Response Host_Unreachable CLOSED.,., cancels(is canceled by). Distributed Monitoring. a.,. 308 IBM Tivoli Enterprise Console:

325 b. Correlation Type. causes is caused by cancels is canceled by. ( Host_Unreachable ), date_reception event_handle (, NFS_No_Response ) cause_date_reception cause_event_handle. ( ),.., date_reception event_handle cause_date_reception cause_event_handle..... c. 5., Enter.. :,., Host_Unreachable Host_Up. Host_Up. d... e... f

326 g.. h. e, f g. i... j IBM Tivoli Enterprise Console:

327 . 1., -> TEC. 2. ->.,. 3. ->

328 ,.. 1., IBM Tivoli Enterprise Console:

329

330 4., BAROC.. 1. Tivoli. 2., Tivoli. 314 IBM Tivoli Enterprise Console:

331 policy. policy SAP R/3 15., 2.. R/3 Tivoli AMS Module for R/3. policy. R/3 (SAP instance=prd), 15 2, 2. :. (, IP $origin, $hostname ). IBM Tivoli Enterprise Console Tivoli.,,.. $EVENT_CLASS. $SLOTS.,. $EVENT_CLASS=Sentry2_0_diskusedpct $SLOTS=origin sub_origin source sub_source

332 :. Policy. R/3 (SAP instance = PRD), R/3. v IP v AMS Module for R/3 ID sub_source Distributed Monitoring R/3. Distributed Monitoring Sentry2_0_Base R/3 SAP_Alert IBM Tivoli Enterprise Console:

333 .. Policy policy. Event Class: [Sentry2_0_Base, SAP_Alert] Conditions: sub_source in [PRD] status not in [CLOSED] 9 317

334 severity in [CRITICAL, FATAL] Actions: 15 minutes after event is received send , CLOSED. Policy.... 1, 2. Event Class: [Sentry2_0_Base, SAP_Alert] Conditions: status outside [CLOSED] severity in [WARNING] Actions: 60 minutes after event is received administrator 318 IBM Tivoli Enterprise Console:

335 Escalation_policy. UNIX UNIX. su. ID.,., 10 5,. policy

336 Su_Failure. 10.,,,. : UNIX, /usr/adm/sulog., ID WARNING Su_Failure., Su_Failure., TEC_CLASSES tecad_logfile.baroc WARNING HARMLESS. BAROC, (dup_detect facet YES ).. : WARNING HARMLESS, policy. policy. Su_Failure. policy. Event Class: [Su_Failure] Conditions: Actions: When event is received Set Status to [CLOSED] CLOSED. CLOSED,. Policy ,.... Policy,. 320 IBM Tivoli Enterprise Console:

337 Event Class: [Su_Failure] Conditions: Actions: When event is... received Set Status to [CLOSED] When event occurs 5 times within 10 minutes Set Severity to [WARNING] dup_detect 10 WARNING., ID, ID ID.,. Policy.. policy. OPEN.. Event Class: [Su_Failure] Conditions: Actions: 9 321

338 When event is received Set Status to [CLOSED] When event occurs 5 times within 10 minutes Set Severity to [WARNING] When severity is upgraded Set Status to [OPEN] administrator policy. policy., ID,. Event Class: [Su_Failure] Conditions: hostname in [dataserv1, dataserv2] to_user in [root] Actions: When event is received Set Status to [CLOSED] When event occurs 5 times within 10 minutes Set Severity to [WARNING] When severity is upgraded Set Status to [OPEN] administrator 322 IBM Tivoli Enterprise Console:

339 Distributed Monitoring Distributed Monitoring..,.,. Distributed Monitoring policy. Distrbuted Monitoring.,. Distributed Monitoring, 5. Distributed Monitoring : policy.,. policy

340 10MB 20MB 30MB 324 IBM Tivoli Enterprise Console:. IBM Tivoli Enterprise Console. : Distributed Monitoring policy. Policy. Distrbuted Monitoring.,..,. ( : host_down host_up ). Distributed Monitoring, Distributed Monitoring. Sentry2_0_Base.,.,... [Sentry2_0_Base] is canceled by [Sentry2_0_Base] within a 1440 minute period if: [Sentry2_0_Base].status equals [Sentry2_0_Base].status 24,.,.,,., (open)... Distributed Monitoring.

341 origin sub_origin source sub_source collection monitor probe_arg IP SENTRY Distributed Monitoring Policy region Distributed Monitoring., causes is-caused-by is-cancelled-by.,

342 ,. Distributed Monitoring, 24.. Policy. Distributed Monitoring, (Sentry2_0_Base) IBM Tivoli Enterprise Console:

343 Distributed Monitoring policy., HP OpenView.,

344 policy..,..... [OV_Node_Down] causes [OV_IF_Down] within a 10 minute period if: [OV_Node_Down].status equals[ov_if_down].status [OV_Node_Down].origin equals [OV_IF_Down].origin 10.. HP OpenView OV_Node_Down CLOSED. OV_Node_Down. OV_IF_Down. 328 IBM Tivoli Enterprise Console:

345 . Prolog Tivoli Enterprise Console Prolog, Prolog. Prolog. Prolog, Prolog, Tivoli Enterprise Console Prolog. Prolog x. Prolog Prolog HTML IBM Tivoli Enterprise Console. $BINDIR/../generic_unix/TME/TEC/BOOKS/HTML/reference.html CD. /BOOKS/HTML/reference.html Prolog. Prolog,. (term),,..,.... (_),. Tivoli Enterprise Console... Copyright IBM Corp

346 (functor).... functor(arg1,...).. (arity)., in_state 2. Austin Texas (, Austin Texas ). in_state( Austin, Texas ), 0.. [ Austin, Dallas, Houston ] (null). [] Prolog (fact).,., Austin. city( Austin ) Austin Texas. in_state( Austin, Texas ) Texas USA. in_country( Texas, USA ) Prolog (rule) (Prolog Tivoli Enterprise Console ). ( ). :- ( if ). head. body,,,., USA USA,. 330 IBM Tivoli Enterprise Console:

347 in_usa(_city) :- city(_city), in_state(_city, _state), in_country(_state, USA ). in_usa,., city (in_usa _city )., city.,, in_state state., USA, in_country.,.,,.,. AND.,... (Knowledge base). Prolog. assert.,. city( Austin ) in_state( Austin, Texas ) assert(city( Austin ) ) assert( in_state( Austin, Texas ) ) :-. in_usa(_city). assert( ((in_usa(_city) :- city(_city), in_state(_city, _state), in_country(_state, USA ) )) Prolog.. Austin Texas,. city( Austin ) city Austin.,.. Prolog 331

348 ,.,. Austin USA,. in_usa( Austin ) in_usa( Austin ). city(_city) in_state(_city, _state) in_country(_state, USA ), in_usa( Austin ).. Austin. in_state( Austin, Texas ), Texas _state. in_state( Austin, _state) Prolog Tivoli Enterprise Console. /*( ) */( ).. %( )... % /* */,. Prolog., BAROC STRING 255.,, ( ). 10, , , B 123 2, IBM Tivoli Enterprise Console:

349 16.., 1.23e (heap).. Tivoli Enterprise Console, (, date_reception cause_date_reception ) BAROC INT x e ± e-308 ± e+308. BAROC Prolog Tivoli Enterprise Console BAROC. Prolog Tivoli Enterprise Console, BAROC Prolog.. BAROC ENUM INTEGER INT32 REAL STRING LIST Prolog. Prolog 333

350 Tivoli Enterprise Console Prolog Prolog Tivoli Enterprise Console. Tivoli Enterprise Console Prolog Tivoli Enterprise Console. 335 Tivoli Enterprise Console.,...,. ground..,.,. in_state( Houston, _state) _state Texas. _state. = ( ). 334 IBM Tivoli Enterprise Console:

351 rule: assert_rules: ( event: _event of_class _class, action: make_assertions: ( assert( city( Austin ) ), assert( city( Dallas ) ), assert( city( Houston ) ), % Define what cities exist in the knowledge base. assert( in_state( Austin, Texas ) ), assert( in_state( Dallas, Texas ) ), assert( in_state( Houston, Texas ) ), % Define which cities are in which states. assert( in_country( Texas, USA ) ), % Define which states are in which countries. assert(( in_usa(_city) :- % Define a rule about which cities are in the USA. )) ), city(_city), % Is _city a fact in the knowledge base? If so, then continue. in_state(_city, _state), % Is there a rule which places _city in _state? If so, then % unify _state with the atom representingthe state and continue. in_country(_state, USA ) % Is there a rule which places _state in the USA? If so, then % exit the in_usa predicate with success. action: test_assertions: ( city( Austin ), in_state( Austin, Texas ), in_country( Texas, USA ), in_usa( Austin ), in_usa( Dallas ), city( Houston ), in_state( Houston, _state), in_country(_state, USA ), % Succeeds. Austin is a city. % Succeeds. Austin is in Texas. % Succeeds. Texas is in the USA. % Succeeds. Austin is in the USA. % Succeeds. Dallas is in the USA. % Succeeds. Houston is a city. % Succeeds. _state is unified with % Texas. % Succeeds. Texas is in the USA. in_usa( San Antonio ) % Fails. In the knowledge base, San Antonio is not in the USA. % In fact, it s not even a valid city. The in_usa predicate failed at the % line city(_city), so the entire predicate fails. ) ).. Prolog 335

352 Prolog....,.,. =., ==.. / \== = =? == not Test.. atom atomic ground integer is_list number pointer real( ) term_type IBM Tivoli Enterprise Console:

353 Conversion.. ascii inttoatom pointertoatom pointertoint real( ) realtoatom ASCII ASCII Prolog. Prolog. atom. Prolog (, [a,t,o,m]) ASCII (, [97,116,111,109]). atom ( : ), ASCII ([115, 116, 114, 105, 110, 103]). (, ( ),.,. v. v. v. v. v.,.,.. Prolog 337

354 @>= =? =.. int_to_hex strip substring 16.. atomlength atomconcat atompart lowertoupper sprintf.. append atomtolist delete disjoint empty_list 338 IBM Tivoli Enterprise Console:

355 intersect length member name nmember nmembers remove_dups rremove sort subset subtract union... is... < =:= =\= =< > >=.. Prolog 339

356 . + -( ) 1 -() * / // Tivoli Enterprise Console. v 32 v ( ) BAROC INT32 Tivoli Enterprise Console. Pointer arithmetic.. / -( ). -( ). +( ). pointeroffset... round. Prolog ( ) IBM Tivoli Enterprise Console:

357 . abolish assert compile consult flisting reconsult retract.. Prolog. Prolog.. Prolog.. I/O.. I/O.. fclose fopen printf read readln write... Prolog Prolog..... Prolog 341

358 +. _number1 + _number2.,. _number1.. _number2... _integer1 is 100, ]_integer2 is 30, _real1 is 2.1, % Assign values. _sum1 is _integer1 + _integer2, % _sum1 is unified with 130. _sum2 is _real1 + _integer2 % _sum2 is unified with e IBM Tivoli Enterprise Console:

359 -( ). _pointer - _integer,., =?. _pointer. _integer. Tivoli Enterprise Console. 1. pointer_offset _offset _offset2. 3. _offset2. 4.,.. Prolog 343

360 rule: pointer_offset: ( event: _event of_class _class where [ date_reception: _date_reception % _date_reception unified with 0x37695cd4. ], action: ( first_duplicate(_event, event: _dup_event where [ status: outside [ CLOSED ], date_reception: _dup_date_reception % _dup_date_reception unified with 0x376958d4. ] ), pointeroffset(_dup_date_reception, _offset1, _date_reception), % 1. _offset1 is unified with 1024 (0x37695cd4 % - 0x376958d4). _offset2 is _date_reception - _dup_date_reception, % 2. _offset2 unified with 1024 (0x37695cd4 - % 0x376958d4). _originaldate =? _dup_date_reception + _offset2, %3. _originaldate unifies with 0x37695cd4 % (0x376958d ). ) ). =? _originaldupdate =? _date_reception - _Offset1 % 4. _originaldupdate unifies with 0x376958d4 % (0x37695cd4-1024). 344 IBM Tivoli Enterprise Console:

361 -( ). _pointer1 - _pointer2., is. _pointer1. _pointer2. Tivoli Enterprise Console. 1. pointer_offset _offset _offset2.. Prolog 345

362 rule: pointer_offset: ( event: _event of_class _class where [ date_reception: _date_reception % _date_reception unified with 0x37695cd4. ], action: ( first_duplicate(_event, event: _dup_event where [ status: outside [ CLOSED ], date_reception: _dup_date_reception % _dup_date_reception unified with 0x376958d4. ] ), is pointeroffset(_dup_date_reception, _offset1, _date_reception), % 1. _offset1 is unified with 1024 (0x37695cd4 % - 0x376958d4). _offset2 is _date_reception - _dup_date_reception, % 2. _offset2 unified with 1024 (0x37695cd4 % - 0x376958d4). 346 IBM Tivoli Enterprise Console:

363 -( ) 1. -_number _number. _number... _real1 is 2.1, _integer1 is 100, % Assign values. _neg1 is -_integer1, % _neg1 is unified with _neg2 is -_real1 % _neg2 is unified with e+00. _neg3 is -_neg1, % _neg3 is unified with 100. _neg4 is -_neg2 % _neg4 is unified with e Prolog 347

364 -(). _number1 - _number2.,. _number1.. _number2... _integer1 is 100, ]_integer2 is 30, _integer3 is 10, _real1 is 2.1, % Assign values. _diff1 is _integer - _integer2, % _diff1 is unified with 70. _diff2 is _integer3 - _real1 % _diff2 is unified with e IBM Tivoli Enterprise Console:

365 *. _number1 * _number2.,. _number1.. _number2... _integer1 is 100, ]_integer2 is 30, _real1 is 2.1,% % Assign values. _product1 is _integer1 * _integer2, %_product1 is unified with _product2 is _integer1 * _real1 % _product 2 is unified with e Prolog 349

366 /. _number1 / _number2.,. _number1.. _number2... _integer1 is 100, ]_integer2 is 30, _real1 is 2.1, _real2 is 10.5, % Assign values. _quotient1 is _real2 / _real1, % _quotient1 is unified with e+00. _quotient2 is _integer1 / _integer2 % _quotient2 is unified with IBM Tivoli Enterprise Console:

367 //. _integer1 // _integer2. _integer1.. _integer2... _integer1 is 100, ]_integer2 is 30, _integer3 is 10, % Assign values. _quotient1 is _integer1 // _integer3, % _quotient1 is unified with 10. _quotient2 is _integer1 // _integer2 % _quotient2 is unified with 3... Prolog 351

368 @<. _term2 _term1 _term2 ( ). _term1 _term2 Prolog. Prolog.. b, % Succeeds. a, % Succeeds. 23.2, % Succeeds. 12 % Succeeds IBM Tivoli Enterprise Console:

369 @=<. _term2 _term1 _term2. _term1 _term2 Prolog. Prolog.. 12, % Succeeds. Administrator % Succeeds. pointertoint(_pointer1, 100), % _pointer1 unified with 0x64. pointertoint(_pointer2, 200), % _pointer2 unified with 0xc8. 200, % Succeeds. _pointer2, % Succeeds. _pointer2, % Succeeds. 200 % Fails... Prolog 353

370 @>. _term2 _term1 _term2. _term1 _term2 Prolog. Prolog.. ADMINISTRATOR, % Succeeds. aaa, % Succeeds % Succeeds IBM Tivoli Enterprise Console:

371 @>=. _term2 _term1 _term2. _term1 _term2 Prolog. Prolog.. atom1, % Succeeds. atom1 % Fails... Prolog 355

372 \==. _term1 \== _term2 ==. _term1 _term2 Prolog. Prolog. _hostname _dup_hostname _hostname. _hostname = tec.tivoli.com, _dup_hostname = tec.tivoli.com, % Assign values. _hostname \== arrakis.tivoli.com % Succeeds. _hostname \== _dup_hostname % Fails. =, == 356 IBM Tivoli Enterprise Console:

373 +( ). _pointer + _integer., =?. _pointer. _integer. Tivoli Enterprise Console. 1. pointer_offset _offset _offset2. 3. _offset2.. Prolog 357

374 rule: pointer_offset: ( event: _event of_class _class where [ date_reception: _date_reception % _date_reception unified with 0x37695cd4. ], action: ( first_duplicate(_event, event: _dup_event where [ status: outside [ CLOSED ], date_reception: _dup_date_reception % _dup_date_reception unified with 0x376958d4. ] ), pointeroffset(_dup_date_reception, _offset1, _date_reception), % 1. _offset1 is unified with 1024 (0x37695cd4 % - 0x376958d4). =? _offset2 is _date_reception - _dup_date_reception, % 2. _offset2 unified with 1024 (0x37695cd4 - % 0x376958d4). _originaldate =? _dup_date_reception + _offset2, % 3. _originaldate unifies with 0x37695cd4 % (0x376958d ). 358 IBM Tivoli Enterprise Console:

375 <,. _arithexp1 < _arithexp2 _arithexp1 _arithexp2. _arithexp1.. _arithexp2... _integer1 is 100, ]_integer2 is 30, _integer3 is 10, _real1 is 2.1, % Assign values. _integer3 < _integer2, % Succeeds. int(_real1) < _real1, % Succeeds. _integer1 < _integer3 % Fails... Prolog 359

376 =. _term1 = _term2 Prolog. _term1 _term2. =, ==. _term1 _term2 Prolog. Prolog. tec.tivoli.com _hostname. _hostname = tec.tivoli.com ==, =?, is 360 IBM Tivoli Enterprise Console:

377 =:=,. _arithexp1 =:= _arithexp2 _arithexp1 _arithexp2. _arithexpr1.. _arithexpr2.. _integer1 is 100, % Assign value. _integer1 =:= _integer2 + 70, % Succeeds, _integer2 is unified with 30. _integer1 =:= real(_integer1), % Succeeds. _integer1 =:= - _integer1 % Fails... Prolog 361

378 =?. _result =? _function _function _result. _function 338,. _function. _result Prolog. substring _msg. _msg =? substring(_msg, _start, _length) is 362 IBM Tivoli Enterprise Console:

379 =\=,. _arithexp1 =\= _arithexp2 _arithexp1 _arithexp2. _arithexpr1.. _arithexpr2.... _integer1 is 100, % Assign value. _integer1 =\= _integer1 + 1, % Succeeds. -_integer1 =\= -100 % Fails... Prolog 363

380 =<,. _arithexp1 =< _arithexp2 _arithexp1 _arithexp2. _arithexpr1.. _arithexpr2... _integer1 is 100, _real1 is 2.1, % Assign values. _integer1 =< _integer1 + 1, % Succeeds. _real1 =< _integer1 % Succeeds IBM Tivoli Enterprise Console:

381 ==. _term1 == _term2 Prolog._term1 _term2.. ==, =. _term1 _term2 Prolog. Prolog. _hostname _dup_hostname _hostname. _hostname = tec.tivoli.com, _dup_hostname = tec.tivoli.com, % Assign values. _hostname == _dup_hostname, % Succeeds. _hostname == arrakis.tivoli.com % Fails. =, \==. Prolog 365

382 >,. _arithexp1 > _arithexp2 _arithexp1 _arithexp2. _arithexpr1.. _arithexpr2... _integer1 is 100, ]_integer2 is 30, % Assign values. _integer1 > _integer2, % Succeeds. _integer2 *2>_integer1, % Succeeds. _integer1 // 10 > _integer2 % Fails IBM Tivoli Enterprise Console:

383 >=,. _arithexp1 >= _arithexp2 _arithexp1 _arithexp2. _arithexpr1.. _arithexpr2... _integer1 is 100, ]_integer2 is 30, _integer3 is 10, % Assign values. _integer1 >= _integer3 + 90, % Succeeds. _integer2 >= _integer1 - _integer1, % Succeeds. _integer3 >= _integer2 % Fails... Prolog 367

384 abolish. abolish(_name, _arity) _arity _name. _arity _name.. _name Prolog ( )... assert( unix_hosts(arrakis, support) ), % Assert the fact into the knowledge base. unix_hosts(arrakis, support), % Succeeds. abolish(unix_hosts, 2), % Removes all facts named unix_hosts % with an arity of 2 from the knowledge base. unix_hosts(arrakis, support) % Fails, because this fact no longer exists % in the knowledge base. assert, retract 368 IBM Tivoli Enterprise Console:

385 append. append(_list1, _list2, _list3) _list2 _list1, _list3. _list3 _list1 _list2. _list3., _list3 _list1 _list2. _list1 _list2 _list3,.,.,.. _unixhosts = [ arrakis, rooster, dune, perro ], _nthosts = [ charon, scary, mach5, callisto ], % Assign values. append(_unixhosts, _ntthosts, _allhosts), % _allhosts is unified with the list % [arrakis,rooster,dune,perro,charon,scary,mach5,callisto]. append(_unixhosts, _morehosts, _allhosts) % _morehosts is unified with [charon,scary,mach5,callisto]... Prolog 369

386 ascii ASCII ASCII. ascii(_char, _asciicode) _char ASCII, ASCII _asciicode. _asciicode ASCII, ASCII _char. _char _asciicode, ASCII.. _asciicode 0-255,. _char,. ASCII. ascii(a, _code1), % Succeeds and _code1 is unified with 97. ascii( \n, _code2), % Succeeds and _code2 is unified with 10. ascii(_char1, 65), % Succeeds and _char1 is unified with A. ascii(_char2, 13) % Succeeds and _char2 is unified with \r IBM Tivoli Enterprise Console:

387 assert. assert(_clause) _clause.,,., Prolog. 434 Tivoli Enterprise Console. _clause Prolog. 1.. assert( unix_hosts(arrakis, support) ), assert( unix_hosts(io, manufacturing) ), assert( unix_hosts(tycho, development) ), assert( unix_hosts(acme, training) ), % Assert the facts named unix_hosts into % the knowledge base. % Now look up the followingfacts. unix_hosts(arrakis, support), % Succeeds. unix_hosts(tycho, _tycho_area), % Succeeds and unifies _tycho_area with development. unix_hosts(cerberus, _cerberus_area) % Fails because a fact named unix_hosts for % cerberus does not exist in the knowledge base. 2. Prolog Tivoli Enterprise Console. Tivoli TEC_Start.. a. my_string_match Tivoli Enterprise Console.. Prolog 371

388 b. Prolog. 435 Prolog. c. Tivoli Enterprise Console. rule: boot_string_match: (event: _start of_class within [ TEC_Start ] where [ ], ) ). reception_action: action0:( assert((my_string_match(_string, _substring, _left, _right) :- % my_string_match takes _string and _substring % as input and binds _left and _right such that % _left + _substring+ _right = _string atomlength(_substring, _sublen), atompart(_string, _substring, _startsub,_len), _lenl is _startsub - 1, atompart(_string, _left, 1, _lenl), _startr is _lenl + _sublen + 1, atompart(_string, _right, _startr, _lenr),!, true)) my_string_match Prolog. my_string_match ( )..?- my_string_match( foobarmoo,bar,l,r). L = foo R = moo Yes?- my_string_match( Interface xyz is Up,, L,R), my_string_match(r,, _interface, R1). L = Interface R = xyz is Up _interface = xyz R1=isUp Yes nterface name is Up, Tivoli Enterprise Console,. rule: plain_rule1: (event: _ev of_class within [ Some_Class ] where [ msg: _msg ], reception_action: action0:( my_string_match(_msg,, L,R), 372 IBM Tivoli Enterprise Console:

389 ) ). compile my_string_match(r,, _interface, R1), % Isolate interface name.. Prolog 373

390 atom. atom(_term) _term. _term,. atom. _atom = An atom, % Assign value. atom(_atom), % Succeeds. _atom = 10 % Assign value. atom(_atom) % Fails because the variable is an integer IBM Tivoli Enterprise Console:

391 atomic. atomic(_term) _term,,. _term,. atomic. _integer = 200, _real = 2.345, _atom = An atom, _list = [element1, element2, element3], % Assign values. atomic(_integer), % Succeeds. atomic(_real), % Succeeds. atomic(_atom), % Succeeds. atomic(_list) % Fails... Prolog 375

392 atomlength. atomlength(_atom, _length) _atom _length. _atom _length, _atom _length. _atom.. _length _atom... atomlength( This is an atom, _length), % _length is unified with 15. atomlength( atom, 4) % Succeeds IBM Tivoli Enterprise Console:

393 atompart. atompart(_atom, _atompart, _startpos, _length) _atompart _atom, _length _atom _startpos. 1. _atompart, _startpos _length _atom. _startpos _length, 1 _atom. _atompart _startpos, _startpos _atom _atompart. _atom.. _atompart _atom.. _length _atompart.. _startpos _atom _atompart ( ) _msg (, _msg ). atompart(_msg,, _startofspace, _lenofspace), % If an event were received where the msg % attribute contained the string pikes-peak is down, % then _startofspace is unified with 11, % and _lenofspace is unified with 1. _lenofhost is _startofspace - 1, % _lenofhost is unified with 10. atompart(_msg, _host, 1, _lenofhost) % _host is unified with pikes-peak.. Prolog 377

394 substring 378 IBM Tivoli Enterprise Console:

395 atomconcat. atomconcat(_listofatomics, _concatatom) æ æ atomconcat(_atom1, _atom2, _concatatom) _concatatom _listofatomics _atom1 _atom2. _listofatomics, _atom1 _atom2,,.,... _atom1 _atom2,,. _atom2 _atom1,,. _concatatom.. _listofatomics,,. 1. atomconcat. _hostname = shinai, _repeat_count is 5, % Assign values. atomconcat([ Host, _hostname, unavailable, _repeat_count, times. ], _new_msg) % The variable _new_msgis unified with the % atom Host shinai unavailable 5 times. 2. atomconcat.. Prolog 379

396 . _hostname = shinai, % Assign value. atomconcat(_hostname, is down., _down_msg), % _down_msgis unified with shinai is down.. _msg= shinai is back up., % Assign value. atomconcat(_up_hostname, is back up., _msg) % _up_hostname is unified with shinai. 380 IBM Tivoli Enterprise Console:

397 atomtolist. atomtolist(_atomic, _listofchar) _atomic, _listofchar. _listofchar, _atomic..,.. v, 0x v, _listofchar 0-9 v, v, _atomic,. _listofchar,.. atomtolist(_hexnumber, [ 0, x, 1, 3, 2 ]), % Unifies _hexnumber with 0x132. atomtolist(_integer, [ 2, 3, 4, 5 ]), % Instantiates _integer to atomtolist(_realnumber, [ 1, 0,., 3, 2 ]), % Instantiates _realnumber to e+01. atomtolist(prolog, _list), % Instantiates _list to [p,r,o,l,o,g]. atomtolist(_atom, _list) % Instantiates _atom to prolog... Prolog 381

398 compile Prolog. compile(_filename) _filename Prolog consult reconsult Prolog. Prolog (filename.pro) filename.wic Prolog. Prolog Prolog. assert.. compile, BIM_PROLOG_DIR $BINDIR/TME/TEC Tivoli Enterprise Console.. 1. odadmin environ get.. odadmin environ get > /tmp/oserv.env 2. BIM_PROLOG_DIR $BINDIR/TME/TEC., $BINDIR $BINDIR. 3. ( /tmp/oserv.env).. odadmin environ set < /tmp/oserv.env odadmin Tivoli Management Framework, 3.6., Prolog Prolog. compile assert. 434 Tivoli Enterprise Console. 382 IBM Tivoli Enterprise Console:

399 _filename Prolog... /var/prolog unix_hosts.pro Prolog. unix_hosts.wic. consult Prolog. unix_hosts(arrakis, support). unix_hosts(odin, support). % /var/prolog/unix_hosts.pro compile( /var/prolog/unix_hosts ) % Creates /var/prolog/unix_hosts.wic. consult, reconsult. Prolog 383

400 consult Prolog. consult(_filename) Prolog _filename. compile, TECpcomp, Prolog. Prolog Prolog. : Prolog.,., reconsult. _filename Prolog. wic... unix_hosts(arrakis, support). unix_hosts(odin, support). % Contents of /var/prolog/tec_r.unix_hosts.pro compile( /var/prolog/tec_r.unix_hosts ) % Creates /var/prolog/unix_hosts.wic. consult( /var/prolog/unix_hosts ), % Load and assert the clauses in the compiled % unix_hosts.wic file. unix_hosts(arrakis, support), % Query of the knowledge base succeeds, this clause exists. unix_hosts(cerberus, development) % Query of the knowledge base fails, this clause % does not exist. assert, compile, reconsult 384 IBM Tivoli Enterprise Console:

401 delete. delete(_list, _element, _residue) _residue _element _list. _list _residue, _element _residue _list. _element,. _list.. _residue,.. _unixhosts = [ arrakis, rooster, dune, perro ], _nthosts = [ charon, scary, mach5, callisto ], % Assign values. append(_unixhosts, _nthosts, _allhosts), % _allhosts is unified with the list % [arrakis, rooster, dune, perro, charon, % scary, mach5, callisto]. delete(_allhosts, arrakis, _residue), % _residue is unified with the list % [rooster, dune, perro, charon, scary, mach5, callisto]. delete(_allhosts, _host, _residue) % _host is unified with arrakis... Prolog 385

402 disjoint. disjoint(_list1, _list2) _list1 _list2. _list1 _list2... _unixhosts = [ arrakis, rooster, dune, perro ], _nthosts = [ charon, scary, mach5, callisto ], % Assign values. disjoint(_unixhosts, _nthosts) % Succeeds. intersect 386 IBM Tivoli Enterprise Console:

403 empty_list. empty_list(_list) _list., not. _list,. 1. _emptylist,., _list. _list = [element1, element2, element3], _emptylist = [], % Assign values. empty_list(_emptylist), % Succeeds. empty_list(_list) % Fails 2. not. _list, not. not not empty_list(_list) % Succeeds. List contains no elements, % but the result is reversed.. Prolog 387

404 fclose. fclose(_file) _file. _file fopen. Tivoli Enterprise Console Prolog. fclose open_file close_file. action: open_file: ( fopen(_fp, /var/prolog/nt_hosts, r ), action: close_file: ( fclose(_fp) ) fopen 388 IBM Tivoli Enterprise Console:

405 flisting. flisting(_file, _predname) _predname., compile. _file fopen. _predname. Tivoli Enterprise Console unix_hosts /tmp/maint_mode.pro. action: write_predicates: ( fopen(_fp, maint_mode.pro,w), flisting(_fp, unix_hosts ) fclose(_fp) ), fclose, fopen. Prolog 389

406 fopen. fopen( _file, _physfilename, _mode) _mode, _physfilename. _physfilename _file. I/O., fopen. _file.. _mode.. a r w... _physfilename.. Tivoli Enterprise Console Prolog. action: open_and_read: ( fopen(_fp, /var/prolog/nt_hosts, r ), ), fclose 390 IBM Tivoli Enterprise Console:

407 ground. ground(_term) _term., not. _term,. 1. _somevariable some_string. ground. variable _someothervariable,. _somevariable = some_string, % Succeeds. ground(_somevariable), % Succeeds. Variable is instantiated to some_string. ground(_someothervariable) % Fails. Variable is not instantiated. 2. not. _someothervariable, not. not not ground(_someothervariable) % Succeeds. Variable is not instantiated, but the % result is reversed.. Prolog 391

408 int_to_hex 16. int_to_hex(_integer) int_to_hex(_integer, _width) _integer 16. _width. _atom 0. _integer,. _width. _atom. 16. % Converts an integer to hexadecimal. _hexstring1 =? int_to_hex(100) % _hexstring1 is unified with 64. % Converts an integer to hexadecimal with a % specific field width. _hexstring2 =? int_to_hex(100, 8) % _hexstring2 is unified with IBM Tivoli Enterprise Console:

409 integer. integer(_term) _term. _term,. integer. _integer = 200, % Assign value. integer(_integer), % Succeeds. _integer = 1.234, integer(_integer) % Fails because the variable is a real number... Prolog 393

410 intersect. intersect(_list1, _list2) intersect(_list1, _list2, _intersection) _list1 _list2., _intersection _list1 _list2. _intersection _list1 _list2.. _list1 _list ( ). _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. intersect(_unixhosts, [ perro, dune ]) % Succeeds. 2. ( ).. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. intersect(_unixhosts, [ perro, dune, odin ], _intersection) % _intersection is unified with [ dune, perro ]. 394 IBM Tivoli Enterprise Console:

411 inttoatom. inttoatom(_integer, _atom) _integer, _atom. _atom, _integer.. _atom,. _integer,.. inttoatom(100, _atom1), % Succeeds and _atom1 is unified with 100. inttoatom(_int1, 123 ) % Succeeds and _int1 is unified with Prolog 395

412 is. _result is _arithexpr _arithexpr ( ) _result. _arithexpr,. _arithexpr. _result.. _integer is 10 % _integer is unified with 10. _result is _integer + 90 % _result is unified with 100. =? 396 IBM Tivoli Enterprise Console:

413 is_list. is_list(_list) _list. _list. _list Prolog.. list. _list = [element1, element2, element3], _emptylist = [], % Assign values. is_list(_list), % Succeeds is_list(_emptylist) % Succeeds.. Prolog 397

414 length. length(_list, _length) _list _length. _length _list.. _list.. _unixhosts. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. length(_unixhosts, _listlength) % Unifies _listlength with IBM Tivoli Enterprise Console:

415 lowertoupper. lowertoupper(_lowercase, _uppercase) _lowercase, _uppercase. _uppercase, _lowercase.. _lowercase... _uppercase.... _user = Administrator, %Assign value. lowertoupper(_user, _uppercase), % _uppercase is unified with ADMINISTRATOR. lowertoupper(_lowercase, _uppercase) % _lowercase is unified with administrator... Prolog 399

416 member. member(_element, _list). _element _list., not. _element,. _element.. _list. 1. arrakis _unixhosts. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. member( arrakis, _unixhosts) % Succeeds. member( odin, _unixhosts) % Fails. 2. not,. odin _unixhosts. not _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. not member( odin, _unixhosts) % Succeeds. List does not contain the % element, but the result is reversed. 400 IBM Tivoli Enterprise Console:

417 name. name(_atomic, _listofasciicodes) _atomic, ASCII codes _listofasciicodes. listofasciicodes, _atomic..,.. v, 0x ASCII v, _listofasciicodes 0-9 ASCII v, ASCII v, _atomic,. _listofasciicodes.. name(0x132, _hexlist), % Instantiates _hexlist to [48,120,49,51,50]. name(_hexnumber, _hexlist), % Instantiates _hexnumber to 0x132. name(2345, _integerlist), % Instantiates _integerlist to [50,51,52,53]. name(_integer, _integerlist), % Instantiates _integer to name(10.32, _reallist), % Instantiates _reallist to % [49,46,48,51,50,48,48,48,101,43,48,49]. name(_realnumber, _reallist), % Instantiates _realnumber to % e+01.. Prolog 401

418 name(prolog, _list), % Instantiates _list to % [112,114,111,108,111,103]. name(_atom, _list) % Instantiates _atom to prolog IBM Tivoli Enterprise Console:

419 nmember. nmember(_element, _list, _index) _element _list _index. 1. _element _list, _element _index. _list _index, _element _index _list. _element,. _index,. _list,.. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. nmember( rooster, _unixhosts, _index), % _index is unified with 2. nmember(_element, _unixhosts, 3) % _element is unified with dune. nmembers. Prolog 403

420 nmembers. nmembers(_indexes, _list, _listofelements), nmember. _indexes _listofelements.,. _indexes,. _list,. _listofelements,.. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. nmembers(_indexes, _unixhosts, [ arrakis, dune ]), % _indexes is unified with the list [1,3]. nmembers([2, 4], _unixhosts, _listofelements) % _listofelements is unified with the list % [rooster, perro]. nmember 404 IBM Tivoli Enterprise Console:

421 not. not _term _term, _term. _term Prolog. integer. not. integer(100), % Succeeds. integer(1.234) % Fails because this is a real number, not an integer. not integer(1.234), % Succeeds, because integer(1.234) would fail... Prolog 405

422 number. number(_term) _term. _term,. number. _integer = 200, _real = 2.345, % Assign values. number(_integer), % Succeeds. number(_real) % Succeeds IBM Tivoli Enterprise Console:

423 pointer. pointer(_term) _term. _term,. Tivoli Enterprise Console date_reception. rule: pointer:( event: _event of_class _class where [ date_reception: _date_reception ], reception_action: ( pointer(_date_reception) % Succeeds ) )... Prolog 407

424 pointeroffset. pointeroffset(_pointer1, _offset, _pointer2) _offset, _pointer1 _pointer2... _offset.,. _offset _pointer1 _pointer2.. _pointer1. _pointer2. Tivoli Enterprise Console _offset1. rule: pointer_offset: ( event: _event of_class _class where [ date_reception: _date_reception % _date_reception unified with 0x37695cd4. ], action: ( first_duplicate(_event, event: _dup_event where [ status: outside [ CLOSED ], date_reception: _dup_date_reception % _dup_date_reception unified with 0x376958d4. ] ), pointeroffset(_dup_date_reception, _offset1, _date_reception), % _offset1 is unified with 1024 (0x37695cd4 - % 0x376958d4) IBM Tivoli Enterprise Console:

425 pointertoatom. pointertoatom(_pointer, _atom) _pointer, _atom. _atom, _pointer.. _atom,. _pointer,. Tivoli Enterprise Console. rule: pointertoatom: ( event: _event of_class _class where [ date_reception: _date_reception ], reception_action: ( pointertoatom(_date_reception, _atom), % _Atom is unified with 0x3745d5ed. ). ) pointertoatom(_pointer, 0x1234 ) % _Pointer is unified with the % hexadecimal number 0x Prolog 409

426 pointertoint. pointertoint(_pointer, _integer) _pointer, _integer. _integer, _pointer. _pointer,.. _integer,. _pointer,. Tivoli Enterprise Console. rule: pointertoint: ( event: _event of_class _class where [ date_reception: _date_reception ], reception_action: ( pointertoint(_date_reception, _int_reception), % If the date_reception slot were to % contain the value 0x3745d5ed, % this line would unify the variable % _int_reception with The % actual integer value of 0x3745d5ed % is in decimal. However, % this is larger than the maximum % value of (2 28-1) that an % integer type can hold. So this % number is the result of overflow. ). ) pointertoint(_pointer, 2000) % (_pointer is unified with 0x7d IBM Tivoli Enterprise Console:

427 printf. printf(_file, _format, _value) _file _format. C fprintf(). _file fopen. _format.. %c. %d. %e. %f. %g ( ). %o 0 8. %s. %u. %x 0x 16. % n n.m, n., n m. _value.. Prolog 411

428 Tivoli Enterprise Console /tmp/eventdata.txt. action: write_data: ( fopen(_fp, /tmp/eventdata.txt, a), printf(_fp, Event of class %s was closed by %s, [_class, _administrator]) ), action: close_file: ( fclose(_fp) ). 412 IBM Tivoli Enterprise Console:

429 read Prolog Prolog. read(_file, _term) _term _file. (EOF ). Prolog. 414 readln. _file _term fopen. Prolog. Tivoli Enterprise Console Prolog Prolog. /var/prolog/tec_r.nt_hosts. nt_hosts( hmckinne ). nt_hosts( scary ).. action: open_and_read: ( fopen(_fp, /var/prolog/tec_r.nt_hosts, r ), read(_fp, _term) % _term is unified with nt_hosts(hmckinne). ), action: close_file: ( fclose(_fp) ) readln. Prolog 413

430 readln. readln(_file, _line) _file _line. EOF( ).. _file _line fopen... Tivoli Enterprise Console /etc/hosts localhost arrakis. loghostaction: open_hosts: ( fopen(_fp, /etc/hosts, r ), readln(_fp, _hostsentry) % _hostsentry is unified with % \tlocalhost\t. ), action: close_hosts: ( fclose(_fp) ) read 414 IBM Tivoli Enterprise Console:

431 real( ). real(_integer) _integer. _integer.. _real is real(1) % _real is unified with e Prolog 415

432 real( ). real(_term) _term. _term,. real. _real = 2.345, % Assign value. real(_real), % Succeeds. _real = 123, real(_real) % Fails because the variable is an integer IBM Tivoli Enterprise Console:

433 realtoatom. realtoatom(_real, _atom) _real, _atom. _atom, _real.. _atom _real,.,.. realtoatom(2.345, _atom1), % Succeeds. _atom1 is unified with e+00. realtoatom(_real1, ) % Succeeds. _real1 is unified with e Prolog 417

434 reconsult Prolog. reconsult(_filename) _filename Prolog., _filename. compile, TECpcomp Prolog. Prolog Prolog. _filename Prolog. wic... unix_hosts(arrakis, support). unix_hosts(odin, support). unix_hosts(orange, support). % Contents of /var/prolog/tec_r.unix_hosts.pro compile( /var/prolog/tec_r.unix_hosts ) % Creates /var/prolog/unix_hosts.wic. reconsult( /var/prolog/unix_hosts ), % Reload and assert the clauses in the compiled % new version of the unix_hosts.wic file. unix_hosts(orange, support), % Query of the knowledge base succeeds, this % clause exists. unix_hosts(cerberus, development) % Query of the knowledge base fails, this clause % does not exist. compile, consult 418 IBM Tivoli Enterprise Console:

435 remove_dups. remove_dups(_list, _pruned) _list. _pruned. _list.. _pruned,,.. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. append(_unixhosts, [ odin, perro, arrakis ], _duphosts), % _unixhosts is unified with the list % [arrakis, rooster, dune, perro, odin, perro, arrakis]. remove_dups(_duphosts, _nodups) % _nodups is unified with the list % [arrakis, dune, odin, perro, rooster]... Prolog 419

436 retract. retract(_clause) _clause. _clause Prolog.. assert( unix_hosts(arrakis, support) ), % Assert the fact unix_hosts(arrakis, % support) into the knowledge base. assert(unix_hosts(odin, support)), % Assert the fact unix_hosts(odin, support) % into the knowledge base. unix_hosts(arrakis, support), % Succeeds because the fact unix_hosts(arrakis, % support) has been asserted into the % knowledge base. retract( unix_hosts(arrakis, support) ), % Remove the fact unix_hosts(arrakis, support) % from the knowledge base. unix_hosts(odin, support), % Succeeds because the fact unix_hosts(odin, % support) has been asserted into the % knowledge base. unix_hosts(arrakis, _area) % Fails because the only fact about arrakis % has been retracted. abolish 420 IBM Tivoli Enterprise Console:

437 round. round(_real) Prolog. round(_number) = sign(_real) * trunc(abs(_real ) + 0.5). _real.. _float1 is 12.49, _float2 is , _float3 is 12.51, _float4 is , % Assign values. _int1 is round(_float1), % _int1 is unified with 12. _int2 is round(_float2), % _int2 is unified with -12. _int3 is round(_float3), % _int3 is unified with 13. _int4 is round(_float4) % _int4 is unified with Prolog 421

438 rremove. rremove(_element, _list, _tail) _element, _element _list _tail. _element, _element _tail. _element,.,.. _list _tail.. _unixhosts _tail. _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. rremove(_firstelement, _unixhosts, _tail) % Unifies _tail with [rooster,dune,perro]. rremove( rooster, _unixhosts, _tail2) % Unifies _tail with [arrakis,dune,perro] IBM Tivoli Enterprise Console:

439 sort. sort(_list, _sorted) _list. _sorted. _list. _sorted _list. _nthosts. _nthosts = [ charon, scary, mach5, callisto ], % Assign value. sort(_nthosts, _sorted) % _sorted is unified with [ callisto, charon, mach5, scary ]... Prolog 423

440 sprintf. sprintf(_atom, _format, _value) _atom _format _value. C sprintf(). _atom.. _format _atom.. %c. %d. %e. %f. %g ( ). %o 0 8. %s. %u. %x 0x 16. % n n.m, n., n m. _value IBM Tivoli Enterprise Console:

441 _integer is 123, _real is 12.3, _string= Hello, World, % Assign values. sprintf(_string1, %s, _string), % _string1 is unified with Hello, World. sprintf(_string2, %20s, _string), % _string2 is unified with Hello, World. sprintf(_string3, %-20s, _string), % _string3 is unified with Hello, World. sprintf(_atom1, Integer in decimal notation: %d, _integer), % _atom1 is unified with Integer in decimal % notation: 123. sprintf(_atom2, Integer in decimal notation with field width: %10d, _integer), % _atom2 is unified with Integer in decimal % notation with field width: 123 sprintf(_atom3, Integer in decimal notation with leadingzeros: %010d, _integer), % _atom3 is unified with Integer in decimal % notation with leadingzeros: sprintf(_atom4, Integer in octal notation: %o, _integer), % _atom4 is unified with Integer in octal % notation: 173. sprintf(_atom5, Integer in hexadecimal notation: %x, _integer), % _atom5 is unified with Integer in hexadecimal % notation: 7b sprintf(_atom6, Real in decimal notation: %f, _real), % _atom6 is unified with Real in decimal % notation: sprintf(_atom7, Real in decimal notation with field width: %3.2f, _real), % _atom7 is unified with Real in decimal % notation with field width: sprintf(_atom8, Real in real notation: %f, _real), % _atom8 is unified with Real in real notation: % sprintf(_atom9, Real in exponential notation: %e, _real), % _atom9 is unified with Real in exponential % notation: e+01. sprintf(_atom10, Real in its shortest form: %g, _real) % _atom10 is unified with Real in its shortest form: Prolog 425

442 strip. strip(_atom, _position) strip(_atom, _position, _chars) (_chars ) _atom. (_chars ) _char _atom. _position. _atom.. _chars _atom.. _position _atom _atom ( 2) _atom ( 1) _atom ( 0) _position IBM Tivoli Enterprise Console:

443 1. strip ( ). _string=? string( atom with spaces ), % instantiate _stringwith an atom. _newstring1 =? strip(_string, 4), % _newstring1 is unified with atom with % spaces. Characters stripped at beginning. _newstring2 =? strip(_string, 2), % _newstring2 is unified with atomwithspaces. % Characters stripped at middle. _newstring3 =? strip(_string, 1), % _newstring3 is unified with atom with % spaces. Characters stripped at end. _newstring4 =? strip(_string, 7) % _newstring4 is unified with atomwithspaces. % Characters stripped from entire atom. 2. strip ( ). Tivoli Enterprise Console msg. _msg. _newmsg.. _msg= The followingfile has changed: "C:\CONFIG.SYS", % Assign message text to variable. _newmsg=? strip(_msg, 7, " ) % _newmsgis unified with The followingfile % has changed: C:\CONFIG.SYS. Double quotes % stripped from entire atom.. Prolog 427

444 subset. subset(_list1, list2) _list1 _list2. _list1 _list2. _list1.. _nthosts = [ charon, scary, mach5, callisto ], % Assign value. subset([ mach5, callisto ], _nthosts) % Succeeds IBM Tivoli Enterprise Console:

445 substring. substring(_atom, _start, _length) _start _length _atom. 0. atompart atompart. _atom.. _length _atom.. _start _atom _substr. 0. _substr =? substring( atom with spaces, 12, 6) % _substr is unified with spaces. atompart. Prolog 429

446 subtract. subtract(_list1, _list2, _difference) _difference, _difference _list2 _list1. _difference, _difference _list2 _list1. _difference _list1 _list2.. _list1 _list2... _nthosts = [ charon, scary, mach5, callisto ], % Assign value. subtract(_nthosts, [ charon, scary ], [ mach5, callisto ]), % Succeeds. subtract(_nthosts, [ mach5, callisto ], _difference) % Instantiates _difference with [ charon, scary ] IBM Tivoli Enterprise Console:

447 term_type. term_type(_term, _type) _term _type. _type. var functor _term,. _type,,.. _atom = Another atom, _integer = 100, _real = 1.234, _list = [element1, element2, element3], % Assign values. term_type(_integer, _type1), % Succeeds and _type1 is unified with integer. term_type(_real, _type2), % Succeeds and _type2 is unified with real. term_type(_atom, _type3), % Succeeds and _type3 is unified with atom. term_type(_var, _type4), % Succeeds and _type4 is unified with var. term_type(_list, _type5) % Succeeds and _type5 is unified with functor... Prolog 431

448 union. union(_list1, _list2, _union) _list2 _list1 _union, _list2. _list1 _list2 _union.. _list1 _list2... _unixhosts = [ arrakis, rooster, dune, perro ], % Assign value. union(_unixhosts, [ perro, dune, odin ], _union) % instantiates _union with [ arrakis, rooster, perro, dune, odin ] IBM Tivoli Enterprise Console:

449 write. write(_file, _term) _term _file.. _file _term fopen. Prolog. Tivoli Enterprise Console /tmp/event.txt.. rule: write: ( event: _event of_class _class, action: write_assertions: ( fopen(_fp, /tmp/event.txt, w ), write(_fp, Event of class ), write(_fp, _class), write(_fp,, ), write(_fp, _source), write(_fp, received.\n ) ), action: close: ( fclose(_fp) ) ). Su_Success LOGFILE, /tmp/event.txt. Event of class Su_Success, LOGFILE received... Prolog 433

450 Tivoli Enterprise Console Prolog Tivoli Enterprise Console.. v Prolog user_predicates... v TEC_Start assert. 435 assert TEC_Start. v Tivoli Enterprise Console compile, consult/reconsult. 382 compile, 384 consult 418 reconsult. Prolog. 1. Prolog. 2. TEC_TEMPLATES Prolog. 3. TEC_TEMPLATES, user_predicates. 4. Prolog, user_predicates. re_user_predicates( filename ). 5.. user_predicates Prolog, user_predicates IBM Tivoli Enterprise Console:

451 assert TEC_Start Tivoli Enterprise Console assert. TEC_Start. my_string_match TEC_Start. 371 assert. rule: boot_string_match: (event: _start of_class within [ TEC_Start ] where [ ], reception_action: action0:( assert((my_string_match(_string, _substring, _left, _right) :- atomlength(_substring, _sublen), atompart(_string, _substring, _startsub, _len), _lenl is _startsub - 1, atompart(_string, _left, 1, _lenl), _startr is _lenl + _sublen + 1, atompart(_string, _right, _startr, _lenr),!, true)) ) ). Prolog Prolog Tivoli Enterprise Console... consult. consult., consult. consult, Prolog., consult Prolog., Tivoli Enterprise Console.. 1. $BINDIR/TME/TEC/interpreter.tar. 2. bash UNIX... Prolog 435

452 export BIM_PROLOG_DIR=.. 3. BIMprolog.exe, $BIM_PROLOG_DIR/bin.?-. 4. halt. ( ). Prolog /prolog/source/connected.pro. connected(nodea,nodeb). connected(nodeb,nodec). is_connected(_first,_last):- ; (connected(_first,_last) ->!,true connected(_first,_next), is_connected(_next,_last) ).,,. consult.?- consult( connected.pro ). compiling-c+ connected.pro loaded connected.pro Yes..?- is_connected(nodea,nodeb). Yes?- is_connected(nodea,nodec). Yes?- is_connected(nodea,noded). No 436 IBM Tivoli Enterprise Console:

453 . IBM,. IBM. IBM, IBM,. IBM,,. IBM,. IBM ,.. : (DBCS) IBM. IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan. IBM, (, )...,. IBM () (). Copyright IBM Corp

454 IBM,. IBM. IBM. (1) ( ) (2) ,.. (, ). IBM IBM, IBM (IPLA)..,..,.. IBM,. IBM IBM,,. IBM. IBM..,,,.,. 438 IBM Tivoli Enterprise Console:

455 ,. IBM API(application programming interface),,,.. IBM,. IBM IBM API (application programming interfaces),,,.,. IBM Corporation. DB2 IBMLink Tivoli IBM NetView Tivoli Enterprise Console IBM Tivoli TME Java Java Sun Microsystems, Inc.. Microsoft Windows NT Microsoft Corporation. Java Java Sun Microsystems, Inc..,,. 439