Context

Tool mentors explain how a tool can perform tasks, which are part of ITUP processes and activities. The tasks are listed as Related Elements in the Relationships section.

You can see the details of how processes and activities are supported by this tool mentor, by clicking the links next to the icons:

•   Problem Management
  •   Detect and Log Problem
  •   Investigate and Diagnose Problem
  •   Categorize and Prioritize Problem

Details

The IBM® Tivoli® Enterprise Console® product receives alert data from the environment and either directly due to a specific alert or a correlation of related alerts, will generate an event in Tivoli Enterprise Console that either appears on the console for an operator to take action on or opens an incident through automation.

An important point to note in the root cause analysis activity is that an event can be generated by a causal association. Therefore when an administrator examines the events, they should be aware if the event was generated at the Tivoli Enterprise Console server based on other received events or by reception of a single event.

IBM Tivoli Enterprise Console has both a Java™-based and a Web-based console for viewing events. When the administrators for a problem is investigating and diagnosing, it is common for them to pull up their (Web or Java) Tivoli Enterprise Console to obtain the entire event history. The information available at the Tivoli Enterprise Console can lead in the investigation of the issue as other possibly related events in the environment can also be observed at the Tivoli Enterprise Console. There are also many command line functions that can be used to retrieve information about events from the Tivoli Enterprise Console database.

The following passage from the Tivoli Enterprise Console 3.9 User Guide explains how to view the event details. All current manuals are located on the IBM Web site in the Tivoli Information Center at http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?toc=/com.ibm.itec.doc_3.9/toc.xml.

To view the details:

Details about events are called properties. To display event properties, choose one of these methods:

• Select the appropriate event in the event viewer and click Properties on the tool bar.
• Click on the severity in the Severity column of the event viewer for the appropriate event.

An event properties notebook is displayed that contains the following pages:

General

Displays general information about the selected event, such as status and date received. If a rule has automatically responded to the event (the event status is RESPONSE), you can view the rule engine output. To do this, click View Rule Engine Output on this page. The results are shown in a new window of your Web browser.

Cause Events

Displays the cause events of the selected event when you click Show Cause Events. The cause events are listed in a table. To manage one or more cause events, select the events and then select Manage Events from the table menu. An event viewer is opened for the selected events.

Effect Events

Displays the effect events of the selected event when you click Show Effect Events. To manage one or more effect events, select the events and then select Manage Events from the table menu. An event viewer is opened for the selected events.

Attributes

Displays the attributes of the selected event. If you want to print the event properties, click Format a Print Version on any page of the event properties notebook. The formatted version of the event properties is shown in a new window of your Web browser. Use the print option of your Web browser to print the event properties.

The information available in a specific Tivoli Enterprise Console event includes the following types of information:

Figure 1: Event information

You can determine the event reception time, the alerting mechanism (source) where the event came from, specific alert message strings from the vendor (or programmers), the host, and also some indication as to the criticality that the organization is placing on the event.

The information obtained by viewing the events and their attributes can be critical information in root cause analysis. When the root cause analysis is complete, any resulting causality information can be put into the logic of the Tivoli Enterprise Console rules so that the Tivoli Enterprise Console server can be more predictive. As an example, it might be determined that there was an alert that preceded an event where the temperature rose above a normal threshold (not yet reaching critical) because the fan in a server was spinning slowly but not below the threshold to alert to the fan failure. In that case, it might make sense to adjust the alerting and make the appropriate monitoring and event analysis changes to trigger an event for the rise in temperature.

A simple example of what might happen as to the results of the root cause analysis is as follows: The severity of the event might be changed as the business impact is determined to be greater than previously believed. This action might result in necessary changes to the trouble-ticket or to the script that the Tivoli Enterprise Console operator uses to act upon the received events.

For More Information

For more information about this tool, click on the link for this tool at the top of this page.