InCharge Application Services Manager User's [email protected]. 5. Products derived from this Apache software may not be calle d "Apache," nor may "Apache" appear in their

Application Services Manager User’s Guide

Version 5.0.1

SMARTS

Cisco Part Number: OL-6054-01

Copyright ©1996-2002 by System Management ARTS Incorporated. All rights reserved.The Software and all intellectual property rights related thereto constitute trade secrets and proprietary data of SMARTS and any third party from whom SMARTS has received marketing rights, and nothing herein shall be construed to convey any title or ownership rights to you. Your right to copy the software and this documentation is limited by law. Making unauthorized copies, adaptations, or compilation works is prohibited and constitutes a punishable violation of the law. Use of the software is governed by its accompanying license agreement. The documentation is provided “as is” without warranty of any kind. In no event shall System Management ARTS Incorporated (“SMARTS”) be liable for any loss of profits, loss of business, loss of use of data, interruption of business, or for indirect, special, incidental, or consequential damages of any kind, arising from any error in this documentation.The InCharge products mentioned in this document are covered by pending patent applications and one or more of the following U.S. patents: 5,528,516 and 5,661,668 and 6,249,755.“InCharge,” the InCharge logo, “SMARTS,” the SMARTS logo, “Graphical Visualization,” “Authentic Problem,” “Codebook Correlation Technology,” and “Instant Results Technology” are trademarks or registered trademarks of System Management ARTS Incorporated. All other brand or product names are trademarks or registered trademarks of their respective companies or organizations.

Third-Party Software. The Software may include software of third parties from whom SMARTS has received marketing rights and is subject to some or all of the following additional terms and conditions:

Bundled SoftwareSun Microsystems, Inc., Java(TM) Interface Classes, Java API for XML Parsing, Version 1.1. "Java" and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. SMARTS is independent of Sun Microsystems, Inc.

W3C IPR SoftwareCopyright © 2001-2002 World Wide Web Consortium (http://www.w3.org), (Massachusetts Institute of Technology (http://www.lcs.mit.edu), Institut National de Recherche en Informatique et en Automatique (http://www.inria.fr), Keio University (http://www.keio.ac.jp)). All rights reserved (http://www.w3.org/Consortium/Legal/). Note: The original version of the W3C Software Copyright Notice and License can be found at http://www.w3.org/Consortium/Legal/copyright-software-19980720.

The Apache Software License, Version 1.1Copyright ©1999-2002 The Apache Software Foundation. All rights reserved. Redistribution and use of Apache source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of Apache source code must retain the above copyright notice, this list of conditions and the Apache disclaimer as written below.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the Apache disclaimer as written below in the documentation and/or other materials provided with the distribution.

3. The end-user documentation included with the redistribution, if any, must include the following acknowledgment: "This product includes software developed by the Apache Software Foundation (http://www.apache.org/)."Alternately, this acknowledgment may appear in the software itself, if and wherever such third-party acknowledgments normally appear.

4. The names “The Jakarta Project”, “Tomcat”, "Xalan" and "Apache Software Foundation" must not be used to endorse or promote products derived from Apache software without prior written permission. For written permission, please contact [email protected].

5. Products derived from this Apache software may not be called "Apache," nor may "Apache" appear in their name, without prior written permission of the Apache Software Foundation.

APACHE DISCLAIMER: THIS APACHE SOFTWARE FOUNDATION SOFTWARE IS PROVIDED "AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.This Apache software consists of voluntary contributions made by many individuals on behalf of the Apache Software Foundation and was originally based on software copyright © 1999, Lotus Development Corporation., http://www.lotus.com. For information on the Apache Software Foundation, please see http://www.apache.org.

FLEXlm Software© 1994 - 2002, GLOBEtrotter Software Inc. All rights reserved. "GLOBEtrotter" and "FLEXlm" are registered trademarks of GLOBEtrotter Software Inc. For product and legal information, see http://www.globetrotter.com/manual.htm.

ptmalloc Software© 1997 - 2002 Wolfram Gloger. All rights reserved. PERMITTED USES. Permission to use, copy, modify, distribute, and sell the ptmalloc software and its documentation for any purpose is hereby granted without fee, provided that (i) the above copyright notice and this permission notice appear in all copies of the Software and related documentation, and (ii) the name of Wolfram Gloger may not be used in any advertising or publicity relating to the Software.LIMITATION OF LIABILITY. THE PTMALLOC SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL WOLFRAM GLOGER BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE SMARTS SOFTWARE.

JfreeChart – Java library for GIF generationThe Software is a “work that uses the library” as defined in GNU Lesser General Public License Version 2.1, February 1999 Copyright © 1991, 1999 Free Software Foundation, Inc., and is provided “AS IS” WITHOUT WARRANTY OF ANY KIND EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED IN THE ABOVE-REFERENCED LICENSE BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARITES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. JfreeChart library (included herein as .jar files) is provided in accordance with, and its use is covered by the GNU Lesser General Public License Version 2.1, which is set forth at http://www.object-refinery.com/lgpl.html/.

BMC – product libraryThe Software contains technology (product library or libraries) owned by BMC Software, Inc. (“BMC Technology”). BMC Software, Inc., its affiliates and licensors (including SMARTS) hereby disclaim all representations, warranties and liability for the BMC Technology.

Crystal Decisions ProductsThe Software may contain certain software and related user documentation (e.g., Crystal Enterprise Professional, Crystal Reports Professional and/or Crystal Analysis Professional) that are owned by Crystal Decisions, Inc., 895 Emerson Street, Palo Alto, CA 94301 (“Crystal Decisions”). All such software products are the technology of Crystal Decisions. The use of all Crystal Decisions software products is subject to a separate license agreement included with the Software electronically, in written materials, or both. YOU MAY NOT USE THE CRYSTAL DECISIONS SOFTWARE UNLESS AND UNTIL YOU READ, ACKNOWLEDGE AND ACCEPT THE TERMS AND CONDITIONS OF THE CRYSTAL DECISIONS’ SOFTWARE LICENSE AGREEMENT. IF YOU DO NOT ACCEPT THE TERMS AND CONDITIONS OF THE CRYSTAL DECISIONS’ SOFTWARE LICENSE, YOU MAY RETURN, WITHIN THIRTY (30) DAYS OF PURCHASE, THE MEDIA PACKAGE AND ALL ACCOMPANYING ITEMS (INCLUDING WRITTEN MATERIALS AND BINDERS OR OTHER CONTAINERS) RELATED TO THE CRYSTAL DECISIONS’ TECHNOLOGY, TO SMARTS FOR A FULL REFUND; OR YOU MAY WRITE, CRYSTAL WARRANTIES, P.O. BOX 67427, SCOTTS VALLEY, CA 95067, U.S.A.

GNU Cygwin utilities Cygwin utilities are used by the Software’s install and uninstall programs. The Cygwin utilities are resident on the CD on which the Software was delivered to you, and are installed to the host machine. The Cygwin utilities software program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License (GPL) as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. The full text of the applicable GNU GPL is available for viewing at http://www.cygwin.com/COPYING. You may also request a copy of the GPL from the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. The Cygwin utilities program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. For a period of three years from the date of your license for the Software, you are entitled to receive under the terms of Sections 1 and 2 of the GPL, for a charge no more than SMARTS’ cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code for the GNU Cygwin utilities provided to you hereunder by requesting such code from SMARTS in writing: Attn: Customer Support, SMARTS, 44 South Broadway, White Plains, New York 10601.

GNU eTeks PJA Toolkit Copyright © 2000-2001 Emmanuel PUYBARET/eTeks [email protected]. All Rights Reserved.The eTeks PJA Toolkit is resident on the CD on which the Software was delivered to you. Additional information is available at eTEks’ web site: http://www.eteks.com. The eTeks PJA Toolkit program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License (GPL) as published by the Free Software Foundation; version 2 of the License. The full text of the applicable GNU GPL is available for viewing at http://www.gnu.org/copyleft/gpl.txt. You may also request a copy of the GPL from the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. The eTeks PJA Toolkit program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Last Update: 12/20/02

For a period of three years from the date of your license for the Software, you are entitled to receive under the terms of Sections 1 and 2 of the GPL, for a charge no more than SMARTS’ cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code for the GNU eTeks PJA Toolkit provided to you hereunder by requesting such code from SMARTS in writing: Attn: Customer Support, SMARTS, 44 South Broadway, White Plains, New York 10601.

IBM Runtime for AIX The Software contains the IBM Runtime Environment for AIX(R), Java™ 2 Technology Edition Runtime Modules © Copyright IBM Corporation 1999, 2000 All Rights Reserved.

HP-UX Runtime Environment for the Java™ 2 PlatformThe Software contains the HP-UX Runtime for the Java™ 2 Platform, distributed pursuant to and governed by Hewlett-Packard Co. ("HP") software license terms set forth in detail at: http://www.hp.com. Please check the Software to determine the version of Java runtime distributed to you.

DataDirect TechnologiesPortions of this software are copyrighted by DataDirect Technologies, 1991-2002.

InCharge Application Services Manager User’s Guide v

Contents

Preface vii

Intended Audience viiPrerequisites viiDocument Organization viiiDocumentation Conventions ixModifying InCharge Files xAdditional Resources xi

InCharge Commands xiDocumentation xi

Technical Support xii

1 Introduction 1

Application Services 2Application Services Manager Architecture 3

Cross-Domain Management 5Identifying Authentic Problems and Impacts 5

Utilizing Business Impact Analysis 6

2 Managed Elements 7

Application Services 7Applications 7Application Clusters 8Management Services 9

Service Connections 10Systems 11

3 Application Events Diagnosed 13

Symptomatic Events 14

Contents

vi InCharge Application Services Manager User’s Guide

Root Cause Events 16Impact Events 18

4 Investigating Failures 21

Application Event Sources 21Notification Log 23

Identifying Related Notifications 24Investigating Failures Using Maps 26

Applications Map 26Services Map 28Multiple Root Causes 29

Identifying Service-Affecting Failures 31Symptoms and Root Causes 32Aggregated Events 32

5 Event Scenarios 33

Application Events 33Application Down 33Application Impacted 34InCharge Service Notifications 35

Application Cluster Events 36Application Cluster Degraded 36Application Cluster AtRisk 37Application Cluster All Components Down 38

Service Connection Events 39Transaction Slow 40Transaction Timed Out 40

6 Working with Groups and Settings 43

How Groups and Settings Work 44How Managed Elements are Assigned to Groups 44

Default Polling and Threshold Groups Description 45Default Polling Groups 45Default Threshold Groups 45

InCharge Application Services Manager User’s Guide vii

Group and Setting Descriptions 46Modifying the Properties of a Group 49

Method for Adding or Removing Settings 49Method for Setting the Priority of Groups 50Method for Editing Matching Criteria 50Modifying the Parameters of a Setting 52

Creating New Groups 53Method for Copying an Existing Group 53Method for Creating a New Group 54

Wildcard Patterns 55

Index 59

Contents

viii InCharge Application Services Manager User’s Guide

InCharge Application Services Manager User’s Guide vii

Preface

This guide provides detailed information about InCharge Application Services Manager (Application Services Manager). Application Services Manager automatically diagnoses service delivery problems in complex, distributed application services. Service delivery problems may stem from failures of hardware or software in managed network systems, operating systems and applications.

Intended AudienceThis guide is intended to be read by IT managers seeking to better understand the value of Application Services Manager and by operators receiving and acting upon notifications.

PrerequisitesIt is assumed that Application Services Manager, Service Assurance Manager and one or more InCharge consoles are installed. For information on installing any of these products, refer to your installation guide.

Preface

viii InCharge Application Services Manager User’s Guide

Document OrganizationThis guide consists of the following.

Table 1: Document Organization

1. INTRODUCTION Presents a functional overview of Application Services Manager and its architectural components.

2. MANAGED ELEMENTS Describes the application and connection elements managed by Application Services Manager.

3. APPLICATION EVENTS DIAGNOSED Describes the failures diagnosed by Application Services Manager.

4. INVESTIGATING FAILURES Provides information about the source of problems and how to locate related problems and symptoms using the notification log and maps.

5. EVENT SCENARIOS Provides information on some typical Application Services Manager events.

6. WORKING WITH GROUPS AND

SETTINGS

Provides information about setting parameters and thresholds.

InCharge Application Services Manager User’s Guide ix

D o c um e n t a t i o n C o n v en t i o n s

Documentation ConventionsSeveral conventions may be used in this document as shown in Table 2.

Table 2: Documentation Conventions

In this document, the term BASEDIR represents the location where InCharge software is installed. The term BASEDIR represents the /opt/InCharge<n> directory for UNIX, the C:\InCharge<n> directory for Windows (where <n> represents the InCharge software version number), or your specified path. The InCharge software resides in the BASEDIR/smarts subdirectory.

Directory path names are shown with forward slashes (/). Users of the Windows operating systems should substitute back slashes (\) for forward slashes.

Also, if there are figures illustrating consoles in this document, they represent the consoles as they appear in Windows. Under UNIX, the consoles appear with slight differences. For example, in views that display items in a tree hierarchy such as the Topology Browser, a plus sign displays for Windows and an open circle displays for UNIX.

CONVENTION EXPLANATION

sample code Indicates code fragments and examples in Courier font

keyword Indicates commands, keywords, literals, and operators in bold

% Indicates C shell prompt

# Indicates C shell superuser prompt

<parameter> Indicates a user-supplied value or a list of non-terminal items in angle brackets

[option] Indicates optional terms in brackets

/InCharge Indicates directory path names in italics

yourDomain Indicates a user-specific or user-supplied value in bold, italics

File > Open Indicates a menu path in italics

▲ ▼ Indicates a command that is formatted so that it wraps over one or more lines. The command must be typed as one line.

Preface

x InCharge Application Services Manager User’s Guide

Modifying InCharge FilesAs part of the InCharge deployment and configuration process, you will need to modify certain files. User modifiable files include InCharge startup scripts, tool scripts, configuration files, rule set files, and templates. Original versions of these files are installed into appropriate subdirectories under the BASEDIR/smarts/ hierarchy. For example, original versions of Global Manager configuration files are installed to BASEDIR/smarts/conf/ics.

To edit a user modifiable file, create a local copy of the file in BASEDIR/smarts/local or one of its subdirectories. For example, a modified ics.conf file should be saved to BASEDIR/smarts/local/conf/ics. InCharge software is designed to first search for user modifiable files in BASEDIR/smarts/local or one of its subdirectories. If a modified version of a file is not found in the local area, InCharge software then searches appropriate nonlocal directories.

Note: Original versions of files may be changed or updated as part of an InCharge software upgrade. However, files located in BASEDIR/smarts/local are always retained during an upgrade.

To facilitate proper file editing, SMARTS provides the sm_edit utility. When used to modify an original version of a file, this utility automatically creates a local copy of the file and places it in the appropriate location under BASEDIR/smarts/local. This ensures that the original version of the file remains unchanged. In both UNIX and Windows environments, you can invoke sm_edit from the command line. Optionally, you can configure Windows so that sm_edit is automatically invoked when user-modifiable files are double-clicked in Windows Explorer.

To invoke the sm_edit utility from the command line, specify the path and the name of the file you want to edit under BASEDIR/smarts. For example, to edit the configuration file for the Global Manager, you invoke the sm_edit utility as follows:

% BASEDIR/smarts/bin>sm_edit conf/ics/ics.conf

The sm_edit utility automatically creates a local copy of the ics.conf file in the BASEDIR/smarts/local/conf/ics directory, if necessary, and opens the file in a text editor. If a local version of the file already exists, the sm_edit utility opens the local version in a text editor. In addition, sm_edit creates any necessary directories.

InCharge Application Services Manager User’s Guide xi

A d d i t i o n a l R e s o u r c e s

For more information about how to properly edit user modifiable InCharge files and how to use the sm_edit utility, refer to the InCharge System Administration Guide.

Additional ResourcesIn addition to this manual, SMARTS provides the following resources.

InCharge CommandsDescriptions of InCharge commands are available as HTML pages. The index.html file, which provides an index to the various commands, is located in the BASEDIR/smarts/doc/html/usage directory.

Documentat ionReaders of this manual may find other SMARTS documentation (also available in the BASEDIR/smarts/doc/pdf directory) helpful.

I n C h a r g e Do c u me n t a t i o n

The following SMARTS documents are product independent and thus relevant to users of all InCharge products:

• InCharge Release Notes

• InCharge Documentation Roadmap

• InCharge Installation Guide

• InCharge System Admininistration Guide

• InCharge Notification Adapters User’s Guide

I n C h a r g e S e r v i c e A s s u r a n c e M a n a g e r D o c u m en t a t i o n

The following SMARTS documents are relevant to users of InCharge Service Assurance Manager:

• An Introduction to InCharge Service Assurance Manager

• InCharge Service Assurance Manager Operator’s Guide

• InCharge Service Assurance Manager Configuration Guide

• InCharge Service Assurance Manager Open Integration Configuration Guide

Preface

xii InCharge Application Services Manager User’s Guide

• InCharge Service Assurance Manager Failover System User’s Guide

• InCharge Service Assurance Manager User’s Guide for Business Impact Manager

• InCharge Service Assurance Manager User’s Guide for Report Manager

• InCharge Service Assurance Manager Web Portal Operator’s Guide

• InCharge Service Assurance Manager Web Portal Configuration Guide

I n C h a r g e A p p l i c a t i o n S e r v i c e s M a n ag e r Do c u me n t a t i o n

The following SMARTS documents are relevant to users of InCharge Application Services Manager:

• InCharge Application Services Manager Deployment Guide

• InCharge Application Services Manager User’s Guide

• InCharge Application Services Manager SMART Adapters User’s Guide

Technical SupportSMARTS provides technical support by e-mail or phone during normal business hours (9:00 A.M. - 6:00 P.M. U.S. Eastern Time).

You may also contact us at:

SMARTS44 South BroadwayWhite Plains, New York 10601 U.S.A

TECHNICAL SUPPORT: [email protected]

SALES: [email protected]

WORLD WIDE WEB: http://www.smarts.com

TELEPHONE: +1.914.948.6200

FAX: +1.914.948.6270

InCharge Application Services Manager User’s Guide 1

1

Introduction

Application Services Manager expands the infrastructure view you already have with Service Assurance Manager and Availability Manager to allow for end-to-end application management. When deployed in conjunction with Service Assurance Manager, Availability Manager and the InCharge SMART Adapters, the product gives you insight across and between:

• Applications running on your network

• Operating system elements such as processes, disks, and memory

• Network devices such as servers and switches

The root cause of dysfunctional and degraded application performance can now be pinpointed to the specific host, application, operating system or transaction that failed. Application servers that process the business logic of an application, database servers that feed data to the application server, firewalls, and virtual private network processors can all contribute to application degradation. Application Services Manager allows you to pinpoint and manage failures of crucial applications as well as the network and operating system elements that support them.

Application service management is complex for critical applications because many of these architectural components are replicated for fail-over protection or load-balancing requirements. Application Services Manager can monitor application clusters that are set up to support this type of fail-over or load-balancing situation.

Introduction

2 InCharge Application Services Manager User’s Guide

Application Services Manager correlates application performance with the health of the underlying networks, systems and application resources, including transactions and sessions. When a service is malfunctioning or disrupted, Application Services Manager automatically pinpoints the precise cause - be it a failed network card, an overloaded server or a timed-out transaction - delivering the information required for sustaining service delivery.

Application Services Manager provides network visibility on an end-to-end basis. Instead of just viewing the network from the limited viewpoint of certain devices, your view is expanded to include the actual communication that occurs among devices and among the applications that depend on them.

Application ServicesAn application service is a collection of software processes that cooperate to support a business function. Application Services Manager manages application services in the context of your network and your business needs. Examples of application services include financial trading, online shopping, travel reservations and manufacturing. Each application service must perform optimally both individually and in cooperation with one another in order to assure a desirable level of service for your customers. For example, Application Services Manager monitors availability and performance of components in multi-step web based transactions consisting of forms, catalogues, and user profiles to ensure actual service delivery to end users.

Figure 1 illustrates a typical application service. This example shows a web browser with an open transaction pointing towards a web site. The web site is set up to direct traffic to one of three web servers that comprise it (via a load-balancing tool). As the user makes requests from the browser, a transaction to the web site is initiated, which causes another transaction to connect the web servers to the database that holds the information needed by that user.


A p p l i c a t i o n S e r v i c e s M an a g e r A r c h i t e c t u r e

Figure 1: Typical Application Services Architecture

Application Services Manager ArchitectureApplication Services Manager measures service performance of distributed applications by leveraging third-party tools (such as system agents and transaction monitors) and importing relevant events and data from other InCharge applications (such as InCharge Availability Manager). Application Services Manager manages events across and between application services, sessions, transactions and system elements.

Database

Host

WebServer1

Host

WebServer2

Host

WebServer3

Host

Web Site

Web Browser

Host

Transaction Transaction Transaction

Application Cluster WebSite [Load Balancing]

Transaction

ApplicationWeb Browser

Applications: 3 Web Servers

ApplicationDatabase

Introduction


Typically, InCharge SMART Adapters collect topology and events regarding the applications, operating systems, and servers from third-party software products. At the same time, the InCharge IP Availability Manager manages topology and events about the network elements. The information gathered from both of these sources is forwarded to InCharge Service Assurance Manager. Application Services Manager then takes the topology and event information about related network elements, systems and applications and correlates the symptoms to determine the root cause and impact on other application elements. The results of this correlation are returned to the Service Assurance Manager as authentic problems. Operators can attach to Service Assurance Manager with the Global Console to view the results of the analysis.

Figure 2: InCharge Application Service Manager Architecture

For more information on the InCharge SMART Adapters, please refer to the InCharge Application Services Manager SMART Adapters User’s Guide.

InCharge Service Assurance Manager

InCharge IPAvailability Manager

InCharge ApplicationServices Manager

InCharge SMARTAdapters

System and ApplicationTopology and Events

NetworkTopology and Events

ApplicationAuthentic Problems

and Impacts

Global Consoles

System and ApplicationTopology and Events


I d e n t i f y i n g A u th e n t i c P r o b l em s a n d I mp a c t s

Cross-Domain ManagementIn conjunction with Service Assurance Manager, Application Services Manager has the ability to integrate network, applications, and system management from a single console. This helps you to diagnose problems involving complex interactions between these domains. While the first visible symptom may be a timed out transaction, Application Services Manager determines that the symptom is due to a remote failure on a switch card.

Application Services Manager leverages other products in the InCharge suite. It works with Service Assurance Manager to provide a source of events in the context of their topology. InCharge IP Availability Manager is used for network discovery and fault information. The Business Impact Manager extends impact analysis to business services and their subscribing customers.

This cross-domain management allows you to isolate the faults affecting complex applications. With Application Services Manager you are eliminating the silos of networks, systems and applications.

Identifying Authentic Problems and ImpactsService Assurance Manager with Application Services Manager uses root cause and impact analysis to identify the reported events that are actually having an effect on the end-to-end service. A distinction is made between the events that are having an effect on the applications and those that are not by comparing and analyzing all of the system and application events and determining which are relevant to your service provision. The irrelevant events that do not display an impact on your application services can be filtered out, leaving you with only the events that require action to be taken.

Application Services Manager analyzes several types of service problems including:

• Down: a failure of the application.

• Degraded: services are being delivered but performance may be below expectations.

• At Risk: services may be delivered but additional failures may disrupt the service.

Introduction


Application Services Manager uses the InCharge Information Model (ICIM) to represent application service topology and the Codebook Correlation Technology to automatically identify the authentic network, server or application software problems. Application Services Manager determines the impact a problem has on the other elements required for application service delivery, enabling you to better prioritize the handling of concurrent problems and providing a more accurate view of the overall health of the service.

Uti l iz ing Business Impact Analysis Transactions and other application service events are most relevant when viewed as part of a business process and the critical information lies in the business impact of application service problems. The aim is to make business processes efficient and reliable to customers of the service, not just manage the technical operations of servers, disks, routers, and so forth. Utilizing the InCharge Business Impact Manager, a Service Assurance Manager add-on module, helps you to understand how device, system and application failures affect performance.

Additionally, InCharge Service Assurance Manager provides business context, using a facility that imports customer and service information from provisioning systems and other sources. Service Assurance Manager uses this data to automatically calculate the customer and service impact for the consolidated events.

When utilizing the Business Impact Manager in conjunction with Application Services Manager the system and application problems and impacts are associated with the service offerings and customers that they support in the business group.


2

Managed Elements

This section describes the application elements managed by Application Services Manager. Elements are categorized into the two classes: Application Services and Service Connections.

Note: The following network element descriptions are based on concepts and element classifications as defined by the InCharge Common Information Model (ICIM). ICIM is an implementation of the Common Information Model (CIM) developed by the Distributed Management Task Force, Inc. (DMTF). See the InCharge Information Model Wall Chart for a graphical representation of the ICIM elements.

Application ServicesThe following lists describe the sub-classes that are associated with the Applications, Application Cluster, and Management Service classes.

Applicat ionsAn application is any program designed to perform a specific function for the user or for another application program. Examples of application programs include word processors, database programs, Web browsers, FTP and communication programs. Applications create an infrastructure of programs that rely upon one another so that the user may complete a specific task.

Managed Elements


Applications use the services of the computer's operating system and other supporting programs to accomplish their tasks. The following is a list of application sub-classes. Any managed application that is not listed here is categorized as an Application.

• HTTP Service - This class represents a HyperText Transfer Protocol Service which is most often used to transfer information (text, graphic, multimedia, etc.) from World Wide Web servers to browsers.

• SQL Service - This class represents a Structured Query Language Service which is used to create, maintain, and query relational databases.

• FTP Service - This class represents a File Transfer Protocol Service for exchanging files with a host computer.

• NNTP Service - This class represents a Network News Transfer Protocol Service which is an internet protocol for connecting, retrieving and posting messages to Usenet newsgroups.

• SMTP Service - This class represents a Simple Mail Transfer Protocol Service which is the internet standard for transferring mail (including attachments).

• URL Service - This class represents a Uniform Resource Locator Service which is the internet standard for the server and path information used to specify the location of a document. This also represents the application that responds to the URL requests (such as a servlet or a cgi script).

Applicat ion ClustersAn application cluster represents a set of applications that are grouped together to provide failover or load balancing.

• Failover: In a business network, a fail-over cluster is typically composed of two applications: a primary and a backup. Normally, the primary application handles all connections. Should the primary application fail, the backup is activated and continues handling the connections. This configuration is typically automated and users are not even aware of the change in the connection.


A p p l i c a t i o n S e r v i c e s

• Load balancing: A load-balancing cluster is often used in web-hosting environments where a single web site must handle a large volume of requests. A particular hardware device called a load balancer accepts all users requests and dispatches each request to one of a number of real web servers. In this manner the user knows of a single URL and the load balancer farms out each incoming request to the back-end web servers.

Management ServicesManagement services are used to help manage your mission-critical business infrastructure, monitoring and measuring activity across local and remote links, through switches and virtual private networks (VPNs), to the destination server and back again. The results offer visibility into application performance and availability. By correlating their findings, Application Services Manager delivers information that lets you pinpoint network and application delays, and confirm the service levels you provide for your users.

• Mgmt Service - A management service is a type of application service that is responsible for monitoring and managing the network, systems, and application infrastructure.

The following are particular management services represented in Application Services Manager. Note that with Application Services Manager, the InCharge Broker and InCharge Service classes have been added to the list of managed elements. This means that you can manage connections of InCharge application services from Service Assurance Manager.

• InCharge Broker - An InCharge Broker represents a particular management service. The InCharge Broker maintains a registry of active InCharge Domain Managers and Service Assurance Global Managers. The Broker tracks the startup, shutdown, and status of the domain/global managers.

• InCharge Service - An InCharge Service represents a particular management service. The domain/global manager, which includes a repository of the managed topology and a correlation model, that monitors network elements, uses correlation technology to pinpoint the root cause of failures, and diagnoses the effects of the failures on related elements. InCharge applications such as Availability Manager and Performance Manager are examples of InCharge Services.

Managed Elements


• Mgmt Agent - A management agent represents a particular management service. The agent is typically a lightweight application that runs "on or near" the entities being monitored.

• SNMP Agent - An SNMP agent represents a management agent that supports the SNMP protocol. It is used to monitor devices on a network, such as routers and switches. Data from an SNMP agent, contained in a management information base (MIB), shows whether all devices are operating properly.

Service ConnectionsApplications interact via service connections. The service connections in an application service are transactions and sessions that allow one application to access another application. For example, a person can use a web browser on a host to log in to a specific web site. Logging in to the web site opens up a session, allowing the user to access information contained within the site.

A service connection is a directional link between two applications. The connection allows for one application (the consumer) to access services provided by another application (the producer). Applications that depend on another communicate through directional service connections. Application Services Manager has two types of service connections: transaction and session.

• Transaction - A transaction is an action (user-initiated or automated) that starts and completes a distributed processing function. A transaction begins when a user initiates a request for service (such as pushing a "submit" button) and ends when the work is completed (information is provided or a confirmation is delivered).

• Session - A session represents a sustained connection between multiple applications, usually involving the exchange of information between the user's computer and the application server. A session is typically implemented as a layer in a network protocol (e.g. HTTP or FTP).

Transactions differ from sessions in that they are not persistent connections. Transactions allow an application to access another application in order to perform a specific task and then automatically disconnect when the task is completed. For example, querying a database from a web site requires only that you stay connected long enough to return the requested information.


S y s t e m s

It is possible for a transaction to depend on a session. For example, a database session may need to be established via a user login before a specific query or lookup transaction can be made. Conversely, a session may depend on a transaction. For example, a web session depends on the successful DNS lookup of the host name of the URL.

SystemsA system is a group of elements that provide services to users or other systems (such as a desktop, server, or other type of single node computer system). Application Services Manager interprets availability and connectivity alarms from system elements for their impact on the applications that are dependent on them. The state of devices such as bridges and hosts can be the cause of application errors or can be related to errors seen elsewhere within an application service. The managed system elements are subclasses of the UnitaryComputerSystem class. Hosts, Routers and Switches are examples of UnitaryComputerSystems.

For more information on UnitaryComputerSystems, refer to the InCharge User’s Guide for Availability Manager.

Managed Elements



3

Application Events

Diagnosed

The InCharge analysis domains analyze the cause-effect relationships among events in complex systems in order to determine the actual problem. Based on this analysis, Service Assurance Manager and Application Services Manager generate three types of event notifications to be displayed in the InCharge Global Console: symptoms, root causes, and impacts. When viewing the results of the Application Services Manager diagnosis, it is important to remember the differences between symptoms, root causes, and impacts.

S y m p t o m a t i c E ve n t s

A symptom is an indication of an abnormal condition, a problem, or a failure. Symptoms commonly propagate to managed elements from a root-cause source. Application Services Manager uses symptoms to diagnose root causes. Symptoms are determined by the SMART Adapters and are forwarded to Applications Services Manager to be correlated for root-cause analysis.

R o o t C a u s e E v e n t s

A root cause is the result of InCharge’s correlation analysis. It pinpoints the exact cause of a failure and identifies the managed element where the failure occurred. A problem can cause symptoms in the element where it occurs, as well as in related elements. Multiple problem notifications indicate independent points of failures. Root causes are identified by the Application Services Manager domain.

Application Events Diagnosed


I mp a c t E v en t s

As with root causes, impact events are determined by the Application Services Manager domain. As symptoms are correlated to determine the root cause, the root cause is assessed to determine what other elements are impacted.

Symptomatic EventsTable 3 summarizes the observable symptoms that are passed to the Applications Services Manager by the agent or monitor that monitors the element. Symptoms are considered to be direct evidence of the status of the application’s components, the systems that support it, and its interconnections.

MANAGED ELEMENT SYMPTOMATIC EVENT DESCRIPTION

UnitaryComputerSystems

HostBridgeHubSwitchMSFCRouterRSFCRSMProbeTerminal ServerNode

DegradedSymptom Indicates that the system is experiencing problems that may affect applications hosted on the system.Examples of system degradations are: high CPU utilization, low memory, swap space, or read/write errors. The InCharge SMART adapters detect and inform Application Services Manager of the degraded event.

Unresponsive Indicates that the system is unreachable from the network.

Table 3: Application Services Manager Symptomatic Event Summary


S ym p t o m a t i c E v e n t s

Service Connection

Session Disconnected Indicates that a connection between application components is no longer established.

Transaction TimedOut Indicates that a transaction request did not receive a response within the maximum allowed time period. This differs from the Transaction Down in that Transaction TimedOut is the result of another problem.

Slow Indicates that a transaction request received a response but it took longer than expected.

Errors Indicates that the transaction request received a response containing incorrect or unexpected information.

Application Service

ApplicationHTTP ServiceSQL ServiceFTP ServiceNNTP ServiceSMTP ServiceURL ServiceManagement ServiceManagement AgentSNMP AgentInCharge BrokerInCharge Service

DownSymptom Indicates that the application is not functioning.An application is considered down when the host it resides on is up but the application itself cannot be accessed. Direct evidence of the failure may be provided by the InCharge SMART Adapter.

DegradedSymptom Indicates that the application is not performing as expected, but is not completely down.An application is considered degraded when it is not functioning correctly but the host it resides on is up or the service connections are partially functioning. Application degradation can be caused by internal errors or a lack of sufficient resources.





Root Cause EventsTable 4 summarizes the root causes that are produced by Application Services Manager and forwarded to Service Assurance Manager. From the detected symptoms listed in Table 3, Application Services Manager determines the root cause of the event.

ApplicationService(continued)

Application Cluster DownSymptom Indicates that the application cluster is not functioning. This is typically due to a problem with the fail-over or load-balancing mechanism.

DegradedSymptom Indicates that the application cluster is not functioning as expected but is not completely down.

AtRisk Indicates that the cluster is being impacted because some of the components are down or impacted. This event is caused by other failures in the application service. The At Risk event is a threshold-controlled, early warning for an All Components Down event.

AllComponentsDown Impact event indicating that all of the applications that are part of the cluster are unavailable because they are directly or indirectly impacted by another event.




R o o t C a u s e E v e n t s

MANAGED ELEMENT ROOT CAUSE EVENT DESCRIPTION

UnitaryComputerSystems

HostBridgeHubSwitchMSFCRouterRSFCRSMProbeTerminal ServerNode

Unresponsive Indicates that the system is not reachable over the network. This event is used to explain session and transaction problems.

Degraded Indicates that the system is experiencing problems that may affect applications hosted on the system.

Service Connection

Session Down Indicates that a session disconnect has occurred and there are no other detected symptoms that could cause the disconnect.

Transaction Degraded Indicates that the transaction is slow or is returning erroneous information.A transaction is considered degraded when a transaction is disrupted and there are no other events that could cause the disruption.

Down Indicates that the transaction or session between applications has timed out. This differs from the Timed Out symptom in that there are no other detected problems to explain the failure.A transaction is considered down when a transaction is disrupted and there are no other events that could cause the disruption.

Table 4: Application Services Manager Root Cause Event Summary



Impact EventsImpact events are non-root cause events generated by Application Services Manager. Impact notifications indicate that an element is not able to use its full potential as a result of another problem in the application infrastructure.

Application Service


Down Indicates that the application is not functioning.An application is considered down when the host it resides on is up but the application itself cannot be accessed. Direct evidence of the failure may be provided by the InCharge SMART Adapter.

Degraded Indicates that the application is not performing as expected, but is not completely down.An application is considered degraded when it is not functioning correctly but the host it resides on is up or the service connections are functioning. Application degradation can be caused by internal errors or a lack of sufficient resources.

Application Service (Continued)

Application Cluster Down Indicates that the application cluster is not functioning. This is typically due to a problem with the fail-over or load-balancing mechanism. A cluster is considered down when none of the transactions to that cluster are successful and there are no other events that could cause the failure.

Degraded Indicates that the application cluster is not functioning as expected but is not completely down. A cluster is considered degraded when only some of the transaction requests are successful.

MANAGED ELEMENT ROOT CAUSE EVENT DESCRIPTION

Table 4: Application Services Manager Root Cause Event Summary


I m pa c t E v e n t s

MANAGED ELEMENT IMPACT EVENT DESCRIPTION

Application Service


Impacted Indicates that an application is impacted because a host or another application it depends upon is unresponsive or down.This event could also indicate that a critical transaction or session for this application has failed.

Application Service (Continued)

Application Cluster At Risk Indicates that the cluster is in danger of not fulfilling expectations because some of the components are down or impacted. This symptomatic event is caused by other failures in the application service.The At Risk event is a threshold-controlled, early warning for an All Components Down event.

All Components Down Indicates that all of the applications that are part of the cluster are unavailable because they are being impacted by another event.

Impacted Indicates that the application cluster is not functioning.

Table 5: Application Services Manager Impact Event Summary




4

Investigating Failures

This section describes how to utilize Service Assurance Manager notifications to learn more about the source, impact and causes of application events.

Application Event SourcesFor Application Services Manager, SMART Adapters gather symptomatic events and topology information from agents or monitors that are directly monitoring the managed elements. Information sent to the InCharge SMART Adapters from the agents or monitors is referred to as instrumentation. If there are multiple sources, all of the sources are displayed in a comma-separated list in the Source field of the Notification Log.

Note: The actual names of the event sources vary according to the names of your underlying domains and agents.

Types of sources for events submitted to Service Assurance Manager are:

• System Agent: An agent that directly monitors hardware components and operating system resources on the computer system. Events and information received from this system agent are mapped to instances of the UnitaryComputerSystem class (hub, router, host, etc.). Notifications from system agents may be considered direct evidence of a root-cause problem. Concord SystemEdge, BMC Patrol Agent, and Dirig Agent are examples of system agents.



• Application Agent: An application agent monitors the internal components of an application. Application agents should obtain events and information directly and not depend on accessing the application over the network. Events and information received from application agents are mapped to instances of the Application class. Notifications from application agents may be considered direct evidence of a root-cause problem.

• Transaction monitor: A transaction monitor reports events and information regarding the transactions between application components. Transaction monitors may be embedded within the application itself or may function as external agents that invoke transactions to test application components. Events and information received from transaction monitors are mapped to instances of the Transaction class. Notifications from a transaction monitor indicate an apparent problem from a particular point in the distributed system.

• Session monitor: A session monitor detects the loss of a connection between application components. The loss of a connection can be indicated directly by the underlying protocol, for example a disconnected TCP session, by regularly establishing a connection between components (heartbeat). Events and information received from session monitors are mapped to instances of the Session class by the adapter. Notifications from a session monitor indicate an apparent problem from a particular point in the distributed system. For example, the InCharge Adapter for BMC Patrol monitors the session to the BMC Patrol Agent.

• ASM [Your Application Services Manager Domain Name]: If your Application Services Manager domain is the only source, then ASM inferred the problem, processed and generated the event notification. Typically, only root causes display Application Services Manager as a Source.

Note: Some of the agents mentioned above can monitor both applications and systems.


N o t i f i c a t i o n L o g

Notification LogThe Notification Log of the Global Console displays the Application Services Manager events. There are some fields in the Notification Log that are particularly useful when investigating application service events.

• Source: The name of the underlying domain that is determining this event. Typically, the Application Services Manager produces the root cause events while the SMART Adapters or Availability Manager produce the symptomatic events. For information on notification sources, refer to Application Event Sources on page 21.

• Impact: The sum of the weights for all affected elements listed in the Impact tab of the Notification Properties dialog box. The default weight for each affected element is 1 so an event with an Impact value of 4 indicates that there are four elements effected by the event.

Figure 3: Example Notification Log



Ident i fying Related Noti f icat ionsTo identify the cause and impact of events, you can drill down into the notification by opening the Notification Properties dialog box. To do this, you can double-click on a notification or corresponding map icon. From the Notification Properties, you can access all of the available information about the event:

• Impact Tab: Displays a list of events simultaneously being effected by the same root-cause event. The class, instance name, and event name of each event is listed and can be selected to drill down for more information.

Figure 4: Notification Properties Impact Tab


N o t i f i c a t i o n L o g

• Caused By Tab: Displays the root-cause event(s) of the selected notification. The class, instance name, and event name are listed for each root cause and can be selected to drill down for more information.

Figure 5: Notification Properties Caused By Tab



Investigating Failures Using MapsThe graphical visualization capabilities of Service Assurance Manager can represent your managed domain in a map layout. You can display maps based on a selected application, cluster, service connection or system element. One way to access a map is to right-click on a notification in the log and choose Show Map from the menu. Application-related information can be viewed through two types of maps in Service Assurance Manager:

• Applications Map

• Services Map

Applicat ions MapAccessing a map from an application, cluster, or service connection displays the Applications Map. The map shows you the domain from the point of view of the application and service connection down to the infrastructure elements that support it. For example, Figure 6 illustrates an applications map displayed from an Application::BankingWeb/3 Impacted notification.

Note: In Applications Maps, transactions and sessions are displayed as map edges (directional arrows). The0 edges change color to reflect the status of the connections.

From the map, you can investigate the situation further. Right-click the map icon and choose Notification Properties from the menu. This allows you to see the cause of the related event. In this case, ApplicationCluster::Estate_Planning AllComponentsDown is caused by:

• Card::CARD-wrcaswsjc4/4 is Down

• Application::BankingApp/1 is Down


I n v e s t i g a t i n g F a i l u r e s U s i n g M a p s

Figure 6: Example of an Applications Map

Right-click the notification, choose Show Map from the menu.

View the related topological elements and associated events.

Right-click on a map icon, select Notification Properties and view the cause and impacts of the related events.



Services MapIf you have also installed the Business Impact Manager, you can investigate your application events through the Services Map. The Services Map shows the relationship between service subscribers, service offerings and the applications that support them.

Note: In Services Maps, edges (directional arrows) are always black. Service connections have unique icons that changed color upon failures.

To investigate how service offerings and their subscribers are impacted by application events from the services map, begin at the Map Console. From the Topology Browser, choose the failing or degraded application component, right-click and choose Services. The services map for that element displays and if there are any service offerings or subscribers associated with the application, they are displayed in the map. For example, Figure 7 illustrates a services map displayed from the Payments_and_Invoice application cluster. From the map and the Notification Properties of the effected elements, you can see:

• ApplicationCluster::Payments_and_Invoicing is AtRisk

• Application::SysEDGE/3 is Healthy

• Session::Payments_and_Invoicing ---> SysEDGE/3 is Disconnected

While viewing the map, you can see that the service offering, Private_Banking, and its subscriber, AcmeGrocers, are associated with the application cluster and their service levels are potentially at risk.

For more information on classes and events associated with the Business Impact Module, refer to the InCharge Service Assurance Manager User’s Guide for Business Impact Manager.


I n v e s t i g a t i n g F a i l u r e s U s i n g M a p s

Figure 7: Example of a Services Map

Mult ip le Root CausesIt is possible to have more than one root cause to explain a failure within an application service. For example, Figure 8 illustrates a scenario in which two transactions are timed out. The Transaction_A and Transaction_B are being accessed by an application cluster composed of two applications residing on separate hosts. By drilling down into the TimedOut notifications you can determine the root causes of the failures.

The first root cause is that Switch_B has gone Down. Host_B is dependent on Switch_B and is rendered Unresponsive. As a result, Application_B is inaccessible and an Impacted notification is generated for it.



The second root cause is occurring simultaneously. Application_A is Down (due to a stopped process, for example). The host that Application _A resides on is healthy and running. The SMART Adapter determines that there is a problem with the application and generates a DownSymptom notification. Since there are no other symptoms to explain the failure, Application Services Manager analyzes that symptom and determines that the root cause of the problem is that same application and generates a Down root cause notification.

Figure 8: Multiple Root Causes Scenario

Root Cause: Down

Root Cause: Down

Symptom : Unresponsive

Symptom : Impacted

Symptom: TimedOut

Symptom: TimedOut

Transaction_BTransaction_A

ApplicationCluster

Host : :Host_BSwitch::

Switch_B

Application: :Application_B

Application : :Application_A

Application : :Application_C

Application : :Application_D

Host : :Host_A

Symptom: DownSymptom


I d e n t i f y i n g S e r v i c e - A f f e c t i n g F a i l u r e s

Identifying Service-Affecting FailuresThe Business Impact Manager extends the impact analysis of applications, clusters and system elements to your business services and their subscribing customers. The impact analysis of service offerings and subscribers and their network components is determined by Service Assurance Manager. The results of that analysis are correlated with analysis from Application Services Manager to determine causality and impact. The Notification Properties display the impacts of each of the elements.

Figure 9 illustrates a service offering called PrivateBank with one subscriber called Banker. The service offering is associated with an application cluster called BankApp, composed of two applications called TradingDB and Annuities. In this scenario, TradingDB is down, putting the cluster at risk for failure. This causes the transactions to that cluster to return erroneous information. The Private Bank service offering and Banker the service subscriber are directly impacted by the application down event.

Utilizing the Business Impact Manager with Application Services Manager allows you to see how your customers are affected by failures and impacts occurring on your managed elements.

Figure 9: Application Service and Business Impact Cross-Correlation

Symptom : Impacted

Symptom : Impacted

Symptom : Errors

Symptom : AtRisk

ServiceOffering : :PrivateBank

ApplicationCluster : :BankApp

ServiceSubscriber::Banker

Root Cause : Down

Application::BankApp1

Application::BankApp2

Transaction::PrivateBank --> BankApp



Symptoms and Root CausesNote that root causes and symptoms can have the same name and be displayed identically in the Service Assurance Manager Global Console. This is because Application Services Manager treats these symptoms as direct evidence of a root cause. For example, Application Down can be root cause on your system. But, correlation is still required to identify other reported symptoms that are caused by this problem. Let’s say that the host on which the application resides is impacted because the switch that manages it is down. Then, Application Down is actually a symptom of the Switch Down problem. Direct evidence is NOT required for Application Services Manager to reach a conclusion.

Aggregated EventsEvents displayed in the Notification Log may be representing multiple events. A SMART Adapter can aggregate one or more detailed events into one of the symptoms defined in Application Events Diagnosed on page 13. Aggregates indicate that one or more related faults are occurring in a particular application, service connection or resource. This compresses multiple events into a single event and organizes a potentially unlimited set of events from an agent into meaningful categories. For example, the events Processor HighUtilization and SwapArea Full may be aggregated into a single Host Degraded event. The original event details can still be found by Drilling down into an aggregate to view the instrumentation passed on to Application Services Manager.

The aggregated events are defined in the configuration files for InCharge SMART Adapters. You can determine if an event is an aggregate by double clicking the notification. For events that are aggregated, the Notification Properties dialog box displays an Aggregates tab that identifies the class, name and description of the original events.


5

Event Scenarios

This section contains some examples of events that may be presented to you while using Application Services Manager.

Application EventsApplication services include Applications (HTTP Service, SQL Service, etc.) as well as Application Clusters and Management Services (for example, InCharge Broker, Management Agents, SNMP Agents).

Applicat ion DownAn application is considered down when the host it resides on is up but the application itself cannot be accessed.

Figure 10 illustrates an Application Down event that has caused the transaction that accesses it to time out. In this case the Down event is the authentic problem of the Transaction symptom.

Event Scenarios


Figure 10: Application Down Scenario

Applicat ion ImpactedAn Impacted notification indicates that an application may be affected because of any of the following situations:

• The host it depends upon is unresponsive

• A transaction from the application has timed out

• A session from the application has disconnected

Figure 11 illustrates a common architecture showing two applications residing on separate hosts. Those hosts are supported by a single switch. The Application Impacted notifications are generated because the switch goes down leaving the hosts unresponsive. The applications that depend on those hosts are Impacted by the fact that the hosts they reside on are unresponsive.

Application Services Manager determines that the applications are impacted based on their topological relationship to the hosts.

Application : :FTP_Client1

Application : :FTP_Client2

Root Cause : Down

Symptom : TimeOut

Host: :FTP_Host

Application::FTP_Server


A p p l i c a t i o n E v e n t s

Figure 11: Application Impacted Scenario

InCharge Service Not i f icat ionsWith Application Services Manager, the InCharge Broker and InCharge Service classes have been added to the list of managed elements. This means that you can manage connections of InCharge application services from Service Assurance Manager.

For example, Figure 12 illustrates a session disconnection between InCharge Service Assurance Manager and its underlying domain called EastRegion. The session Disconnected is a symptom of EastRegion being down, which is the root cause problem. The Disconnected symptom is determined by comparing symptoms from related applications or network devices. If the Session Disconnect were the only event detected, Application Services Manager would determine that as the root cause. But, the presence of an application DownSymptom is correlated with a session Disconnected symptom to determine the cause and impact of the events.

Impact : Impacted

Root Cause : Down

Symptom : Unresponsive

Host : :WebServer2

Application: :WebServerApp2

Application : :WebServerApp1

Host : :WebServer1

Switch::Switch1

Event Scenarios


Figure 12: Example of InCharge Service Management

Application Cluster EventsApplication cluster events that display without any other symptomatic events are usually related to the clustering mechanism that enables it. For example, if a load balancer is being monitored then performance issues can be identified on the cluster. There could be an excessive load, high CPU utilization or the load balancing mechanism itself may be performing poorly.

Applicat ion Cluster DegradedA Degraded notification is an authentic problem that indicates the cluster is not functioning properly. Transactions to the cluster may time out, be slow or may disconnect. This notification indicates that the application cluster is suffering from a performance problem; it is not functioning normally but is not completely down. For example, if all of the components set up to communicate with the cluster are performing poorly, it is likely that the cluster itself is degraded.

A Degraded notification indicates that the application cluster is suffering from a performance problem. This can be deduced from a number of symptoms related to the cluster components and can indicate a problem with the cluster. If multiple transactions from the cluster are slow but all of the system elements that support the cluster are healthy, it can be deduced that the cluster is degraded.

When an application cluster is degraded, it should be considered a warning that the cluster is at risk for failure.

InChargeService: :EastRegion

InChargeService: :InCharge-SA

Host : :Host_B

Session : :InCharge SA East Region

Host : :Host_A

Symptom : Disconnected

Root Cause : Down

Symptom: DownSymptom


A p p l i c a t i o n C l u s t e r E v e n t s

Applicat ion Cluster AtRiskAn AtRisk notification indicates that the cluster is in danger of not fulfilling expectations because most (but not all) of the components in the cluster are down or impacted. This notification is generated when the percentage of failing components meets or exceeds the AtRisk threshold attribute (defined by an InCharge administrator). You can verify the AtRisk threshold attribute from the Notification Properties dialog box.

Figure 13, illustrates an Application Cluster AtRisk event. The cluster is designed to balance load and since two of the components of the cluster have gone down, transaction performance is slow. From this scenario, the following events would display in the Notification Log:

• ApplicationCluster::WebServerFarm -> At Risk

• Application::WebServerApp_1-> DownSymptomApplication::WebServerApp_1-> Down

• Application::WebServerApp_2-> DownSymptomApplication::WebServerApp_2-> Down

• Transaction::WebServerApp -> WebClient_1 SlowTransaction::WebServerApp -> WebClient_2 Slow

Figure 13: Application Cluster AtRisk Scenario

Symptom : At Risk

Root Cause:Down

Symptom : Transaction Slow

Symptom : Transaction Slow

Symptom:DownSymptom

Host : :WebServer_2

Application: :WebServerApp_2

Application : :WebServerApp_3

Application : :WebClient_2

Application : :WebClient_1

Host : :WebServer_3

Application : :WebServerApp_1

Host : :WebServer_1

ApplicationCluster: :WebServerFarm

Event Scenarios


Applicat ion Cluster Al l Components DownAn All Components Down notification indicates that all component applications in the cluster have failed because the hosts they reside upon are unreachable.

A p p l i c a t i o n C lu s t e r A l l C o mp o n en t s D o w n S c e n a r i o

Figure 14 illustrates an application cluster composed of four web-based applications residing on individual hosts. All of the hosts are supported by an underlying switch, called Switch1. End users attempting to use the web-based applications are suffering because their transactions are timing out. The root cause problem of these transaction issues is that Switch 1 has gone down, rendering the dependent hosts Unresponsive. The applications are Impacted by the problems with their hosts making the WebServerFarm cluster AllComponentsDown. Because the cluster is unreachable, any transactions that have attempted to connect to it are TimedOut. From this scenario, the following notifications would display in the Notification Log:

• Transaction::App1 -> WebServerFarm TimedOutTransaction::App2 -> WebServerFarm TimedOut

• ApplicationCluster::WebServerFarm ApplicationCluster -> AllComponentsDown

• Application::WebServerApp1-> ImpactedApplication::WebServerApp2-> ImpactedApplication::WebServerApp3-> ImpactedApplication::WebServerApp4-> Impacted

• Host::WebServer1-> UnresponsiveHost::WebServer2-> UnresponsiveHost::WebServer3-> UnresponsiveHost::WebServer4-> Unresponsive

• Switch::Switch1-> Down (Root Cause)


S e r v i c e C o n n e c t i o n E v e n t s

Figure 14: Application Cluster All Components Down Scenario

Service Connection EventsThe connection allows for one application (the consumer) to access services provided by another application (the producer). Service Connections include transactions and sessions. Notifications submitted for a session failure include Down and Disconnected. Notifications submitted for a transaction failure include Down, Timed Out, Slow and Errors.

Host : :WebServer1

Symptom : AllComponentsDown

Symptom : TimedOut

Symptom : TimedOut

Impact: Impacted

Root Cause : Down

Symptom : Unresponsive Symptom : Unresponsive

Impact: Impacted


Host : :WebServer3

Host : :WebServer2



Transaction: :App1> WebServerFarm

Transaction: :App2> WebServerFarm

Host : :WebServer


Switch : :Switch1

ApplicationCluster : :WebServerFarm

Event Scenarios


Transact ion S lowA Transaction Slow notification is a symptom that indicates a transaction can no longer connect to its producer and consumer applications. This could indicate that there is a problem with the application that is connected by the transaction or the host of the application.

Figure 15 illustrates an FTPServer and FTPClient. The FTPServer is hosted by FTPServerHost. A High CPU Utilization problem exists with the FTPServerHost which is detected by the SMART Adapter and produces the DegradedSymptom notification. Transaction requests made to the FTPServer by the FTPClient are slow. Application Services Manager determines that the root cause is the degradation of the Host. From this scenario, the following notifications would be displayed in the Notification Log:

• Application::FTPClient -> Impacted

• Transaction::FTPClient -> FTPServer Slow

• Host::FTPServerHost -> DegradedHost::FTPServerHost -> DegradedSymptom

Figure 15: Transaction Slow Scenario

Transact ion Timed OutA Timed Out notification is a symptom that indicates the transaction between consumer and producer applications took longer than the maximum time allowed. A number of situations can cause a transaction to time out. For example, a time out event can occur if a session has expired, if a user has book marked a page other than the login page, or if a web server the user is trying to access is currently down or impacted.

Impact: Impacted

Symptom : Slow

Root Cause : Degraded

Transaction: :FTPClient> FTPServer

Application : :FTPServer

Application : :FTPClient

Host: :FTPServerHost

Symptom: Degraded Symptom


S e r v i c e C o n n e c t i o n E v e n t s

T r an s a c t i o n T i m ed Ou t S c e n a r i o

Figure 16 illustrates a web-based trading application called TradingApp that produces a transaction to a supporting database application called TradingDB. TradingDB is hosted by the DataBaseServer. In this scenario, the Transaction between TradingApp and TradingDB cannot be completed. Correlation analysis determines that the transaction problem is the result of the TradingDB going down because the DataBaseServer that hosts it is Unresponsive. From this scenario, the following notifications would be generated:

• Transaction::TradingApp > TradingDB TimedOut

• Application::TradingDB> ImpactedApplication::TradingApp> Impacted

• Host::DataBaseServer> Unresponsive

Figure 16: Transaction TimedOut Scenario

Application : :TradingApp

Application : :TradingDB

Host : :DataBaseServer

Transaction: :TradingApp TradingDB

Host : :WebServer

Symptom : TimedOut

Root Cause : Unresponsive

Impact: ImpactedImpact: Impacted

Event Scenarios



6

Working with Groups and

Settings

The management policies for InCharge applications are controlled through Groups and Settings. Topics in this chapter include:

• Describing how groups and settings work

• Describing the default Polling and Threshold Groups

• Modifying groups and the parameters of settings

• Creating new groups

The Polling and Thresholds Console is used for displaying and editing Polling Groups and Threshold Groups. To reach the Polling and Threshold Console from the Global Console:

1 Click the Configure menu and choose IC Domains Admin Console. The InCharge Server Login screen displays.

2 Type the appropriate Broker location

3 Choose the Application Services Manager domain for which you want to set up polling groups and threshold groups.

4 Type an administrator-level User Name and Password. The InCharge analysis domains Administration Console displays.

5 From the Edit menu, choose Polling and Thresholds.

Working with Groups and Settings


How Groups and Settings WorkAn InCharge application uses components called Groups to associate management policies with managed elements. There are two types of groups: Polling Groups and Threshold Groups.

• Polling Groups determine the diagnostic features enabled for each managed device and the frequency with which data is collected through polling.

• Threshold Groups determine the values for adjustable parameters used in the correlation analysis such as performance or error thresholds. Thresholds are usually percent-based (e.g., percentage of packets in error). As a result, threshold values are easy to configure and are uniform across different media types.

A group contains zero or more settings and is associated with zero or more members. A setting is a collection of thresholds or polling parameters associated with a particular diagnostic category. For example, the Processor and Memory setting defines thresholds for monitoring processor and memory utilization.

InCharge associates managed elements with the appropriate group during discovery. Each element that is a member of a group is configured according to the parameters defined by the group’s settings. For example, the polling group Switches contains the following settings: Connectivity Polling, Environment Polling, Performance Polling - Ports and Interfaces, and Performance Polling - Processor and Memory. When a switch is added to the Switches polling group, the polling parameters for monitoring its connectivity and performance are updated to reflect the settings of this group.

How Managed Elements are Assigned to GroupsWhen InCharge discovers devices in the network, it automatically assigns managed elements to the appropriate group based on the group’s matching criteria and priority. Matching criteria are defined over the attributes of the managed element. A group is defined by four items.

• The group name

• The settings associated with the group

• The matching criteria associated with the group

• The element type (e.g., router or switch) is the primary attribute used in matching criteria


D e f au l t P o l l i n g a n d Th r e s ho ld G r o u p s D e s c r i p t i o n

• Additional matching criteria are used to determine the complete extent of membership in the group (e.g., interface speed or media type)

The additional matching criteria are attributes defined in the ICIM model for that managed element type. For example, a group for switches can use as matching criteria the attributes that are defined in the Switch class, such as IP address, location, and system contact.

• The priority of the group, which determines membership when a device meets the matching criteria for more than one group

Default Polling and Threshold Groups DescriptionAll InCharge applications contain the same default groups. Whether a group has settings or members associated with it depends upon the particular InCharge applications that are installed and the managed topology. It may also be the case that a group contains members but not all of a group’s settings are active. For example, if the Availability Manager application is installed, the Switch Polling Group is likely to contain members. The performance polling settings, however, are not used for diagnosing connectivity errors.

Default Pol l ing GroupsInCharge Application Services Manager uses SMART Adapters as a source of Instrumentation. For optional results you can specify advanced instrumentation details using polling groups:

There are three default polling groups pertaining to Application Services:

• Computer Systems Monitoring Status

• Application Monitoring Status

• Service Connections Monitoring Status

Default Threshold GroupsA threshold is an adjustable parameter that is used by the Application Services Manager in its correlation analysis. Thresholds that are applicable to the same element type are combined into settings.



The threshold groups are divided into three categories:

• ApplicationCluster Groups

• ICIM_ManagedElement Groups

• ServiceConnection Groups

Group and Sett ing Descr ipt ions

S e r v i c e C o n n e c t i o n G r o u p s

The settings for the service connection groups are used to configure thresholds for risk analysis. Application cluster groups have two settings associated with them:

SETTING DESCRIPTION VALUE

Criticality Threshold setting that rates the degree of importance for sessions and transactions that are dependent on each other. When one transaction is required in order to perform another transaction, then loss of use of the first transaction leads to loss of use of the second. The purpose of the criticality rating is to enforce this dependency between applications.

The default value for most transactions is 0.5 (50%).

Service Connections Monitoring Status

Polling setting that determines whether or not Application Services Manager considers a specific transaction or session to be monitored by an agent or monitor.

FALSE (default)- indicates the status of a transaction or session is Unknown until a notification is reported directly from the agent or monitor.

TRUE - indicates the status of the transaction or session is healthy until some event occurs.

Correlation Probability Setting

This is not a user-modifiable setting.

Table 6: Service Connection Group Settings


D e f au l t P o l l i n g a n d Th r e s ho ld G r o u p s D e s c r i p t i o n

For example, Figure 17 illustrates a web-based banking application that is accessed by a web browser and relies on a legacy banking system at the back end. The legacy banking system must be accessed for all transactions coming in from the browser, therefore it is essential for the connection between BankingWebApp and LegacyBankApp to be healthy. The Criticality of the transaction between BankingWebApp and LegacyBankApp is set at 100% to indicate its importance. While it is important for the transaction between BankingWebApp and LegacyBankApp to be healthy, it is less essential for the transaction between the Browser and BankingWebApp to be healthy. Therefore it receives a lesser criticality rating.

Figure 17: Criticality Setting Example

A p p l i c a t i o n C lu s t e r G r o u ps

The settings for the application cluster groups are used to configure thresholds for risk analysis. Application cluster groups have two settings associated with them:

Application::Browser

Application::BankingWebApp

Host

TransactionConsumes

ConsumedBy

Consumes

ConsumedBy

Produces

ProducedBy

Produces

ProducedBy

HostedBy

Transaction Application:LegacyBankApp

Mainframe

HostedBy

Criticality: 100%Criticality: 50%



C o m p u t e r S y s t e m s M o n i t o r i n g S t a t u s

The polling setting for the computer system elements is used to configure the polling trends. There is one setting associated with the computer systems:


AtRiskPercent An Application Cluster can report an AtRisk notification when some but not all of the components in the cluster have failed. The percent of failed components required to trigger the notification is controlled by the AtRiskPercent threshold. The event becomes active when the percentage of failing instrumented components meets or exceeds the AtRiskPercent.

The AtRiskPercent is a value from 0 to 100%. The default value is 50%. If your cluster has an odd number of components, the number of failed components must meet or exceed 50% for the event to become active (for example, 2 out of 3 components in the cluster must fail).

Application Monitoring Status

Polling setting that determines whether or not Application Services Manager considers a specific application or application cluster to be monitored by an agent or monitor.

FALSE (default) - indicates the status of an application or cluster is Unknown until a notification is reported directly from the agent or monitor.

TRUE - indicates the status of the application or cluster is healthy until some event occurs.

Correlation Probability Setting

This is not a user-modifiable setting.

Table 7: Application Cluster Group Settings


Computer Systems Monitoring Status

Polling setting that determines whether or not Application Services Manager considers a specific computer systems element to be monitored by an agent or monitor.

FALSE (default) - indicates the status of an element is Unknown until a notification is reported directly from the agent or monitor.

TRUE - indicates the status of the element is healthy until some event occurs.

Table 8: Application Cluster Group Settings


M o d i f y i n g t h e P r o p e r t i e s o f a G r o u p

I C I M _ M an ag e d E l e m en t G r o u p s

Settings associated with this group should not be modified.

Modifying the Properties of a GroupAlthough groups are divided into two categories, Polling and Thresholds, all groups are configured similarly. A group is composed of settings and members. A settings is composed of either polling or threshold parameters. The matching criteria specified for the group and the group’s priority determine which managed elements are members of the group.

When a group is selected, the right panel of the Polling and Thresholds Console displays four tabs.

• Settings

• Priorities

• Matching Criteria

• Description

Modifying the properties under these tabs changes the configuration of the group. When you finish editing the properties of a group, click the Apply button to save the changes and then select Reconfigure from the Group menu.

Method for Adding or Removing SettingsThe settings for a group determine the polling parameters or thresholds that are applied to members of the group. For example, the settings under the Switches Polling Group include Connectivity Polling, Environment Polling, Performance Polling - Processor and Memory, and Performance Polling - Ports and Interfaces.

The Settings tab is divided into two sections: Current Settings and Available Settings. Current Settings lists the settings that are applied to the group. Available Settings lists the settings that are not currently applied to the group.

To add or remove a setting:

1 Select a setting from the Current Settings list or from the Available Settings list.



2 Click Add to make an available setting active, click Remove to make a current setting inactive.

3 Click Apply.

4 Select Reconfigure from the Group menu.

Method for Setting the Priority of GroupsTogether, the Priority and Matching Criteria parameters determine which managed elements are members of a group. Priority determines what group a managed element belongs to when it matches the criteria for two or more groups. When this occurs, the managed element becomes a member of the group with the higher priority.

The Priority tab displays the priority of groups relative to other groups of the same type, Polling or Threshold.

To change the priority of a group:

1 Select the group.

2 Click on the up or down arrow to change its position

3 Click Apply.


Method for Editing Matching CriteriaMatching criteria, with priority, determine which managed elements are members of a group. The domain manager associates managed elements with the appropriate group during discovery. A managed element can be a member of only one Polling Group and one Threshold Group.

The matching criteria consist of a set of attributes that managed elements must meet to become a member of the group. For example, if a matching criterion uses the attribute Location with a value of “*NY*”, all members of the group must contain the string “NY” in their system location MIB variable. Additional examples of device-level matching criteria include: SNMP address, vendor name, and class name.

Active matching criteria, which appear in the top of the Matching Criteria tab, have three fields: Name, Description, and Value.

• Name identifies the attribute that is used as a matching criterion. The attributes of a managed element can be viewed in the Administration Console.


M o d i f y i n g t h e P r o p e r t i e s o f a G r o u p

• Description is taken from the description of the attribute.

• Value is the string that is matched against the value of the attribute in the managed element. The value field can contain any combination of text, integers, and wildcards. For information regarding wildcards, see "Wildcard Patterns" on page 55.

Note: The value of an attribute is case-sensitive. Your matching criteria may need to account for this possibility.

H o w to A d d o r Re m o v e M a t c h i n g C r i t e r i a

To add or remove a matching criterion:

1 Select a matching criterion from the bottom panel.

2 Click Enable to make the criterion active, moving it to the top of the Matching Criteria tab. Change the value of the criteria.

Use Disable to deactivate the criterion, moving it to the bottom of the Matching Criteria tab.

3 Click Apply.


C h an g i n g t h e V a l u e o f a M a t c h i n g C r i t e r i o n

To edit the Value field of an active criterion:

1 Select the text in the Value field or double-click the Value field to highlight the current value.

2 Type the text, integers, or wildcard to match against the attribute.

3 Press Enter and click Apply.


The domain manager processes matching criteria in the following manner. First, managed elements are compared against the matching criteria of the group with the highest priority. If an element matches all of the criteria, it is added as a member of the group. If an element does not match all criteria, it is compared against the matching criteria of the group with the next highest priority, and so on.



Note: When no matching criteria are active (or appear in the top of the Matching Criteria dialog box), the group matches all managed elements of the group’s type. Whether it contains members is determined by priority.

Modifying the Parameters of a SettingThe parameters of a setting, whether they define polling parameters or set a threshold, are adjusted in a similar manner. A setting may include a drop-down menu that provides a list of items or sliders that provide ranges of values.

To change the parameters of a setting:

1 Select the setting in the left panel of the Polling and Thresholds Console.

2 The parameters of a setting are listed in the right panel of the console.

To change the value of a drop-down menu, click on the menu and select another parameter.

To change the value of a threshold, use one of the following methods:

• Type a new number into the Value field and press Enter.

• Select the slider and drag it with the mouse or select the slider and use the arrow keys to incrementally change the value.

3 Click Apply to save the changes.


Re s t o r i n g t h e D e f au l t P a r am e t e r Va l ue s o f a S e t t i n g

The Restore Defaults button, which is visible when a setting is selected in the left panel of the Polling and Thresholds Console, restores the default values of all the parameters for the selected setting.

To the restore the default parameters to a setting:

1 Select the setting.

2 Click Restore Defaults.



C r ea t i n g N e w G r o u p s

Creating New GroupsCreating new groups provides a method for customizing an InCharge application when the default groups and settings are not sufficient. Building a new group is similar to adjusting the settings and thresholds of existing groups. The new group requires settings and members to be effective.

There are two methods for creating a new group:

• Copy an existing group. The new group will contain all of the same settings and thresholds of the original group except for the matching criteria.

• Create an empty group. The new group will not contain any settings or members. You must add settings and matching criteria, and set the priority of the new group.

The resulting group, regardless of the method you use, is assigned the lowest priority. You must assign the new group a higher priority than the Other Systems group for it to contain members.

For information regarding settings, see "Modifying the Parameters of a Setting" on page 52 and for information regarding groups, see "Modifying the Properties of a Group" on page 49.

Method for Copying an Existing Group1 Right-click on the Polling or Threshold group that you want to copy.

The type of group that you copy determines both its type and the settings it will contain. For example, you might copy the 10/100 Mb Ethernet Interface Group under the Thresholds tab. The new group will also be a threshold group and contain the same settings as the 10/100 Mb Ethernet Interface Group.

2 Select Copy from the pop-up menu. This displays the Copy Group dialog box.

3 Type a name and a description (optional) for the new group and click OK.

4 Edit the settings, matching criteria, or priority for the new group. Change the value of any thresholds or parameters.




Method for Creating a New Group1 In the left panel of the Polling and Threshold Console, right-click on the

group type for which you want a new group.

Groups under the Polling tab include Polling Groups. Groups under the Thresholds tab include Interface Groups, Port Groups - Access Ports, Port Groups - Trunk Ports, and System Resource Groups.

2 Select New Group from the pop-up menu. This displays the New Group dialog box.

3 Type a name and a description (optional) for the new group and click OK.

4 Add settings and matching criteria, and set the priority of the new group. Change the values of any thresholds or parameters.



Wi ld c a r d P a t t e r n s

Wildcard PatternsA wildcard pattern is a series of characters that are matched against incoming character strings. You can use these patterns when you define pattern matching criteria.

Matching is done strictly from left to right, one character or basic wildcard pattern at a time. Basic wildcard patterns are defined in Table 9. Characters that are not part of match constructs match themselves. The pattern and the incoming string must match completely. For example, the pattern abcd does not match the input abcde or abc.

A compound wildcard pattern consists of one or more basic wildcard patterns separated by ampersand (&) or tilde (~) characters. A compound wildcard pattern is matched by attempting to match each of its component basic wildcard patterns against the entire input string. For compound wildcard patterns, see Table 10.

If the first character of a compound wildcard pattern is an ampersand (&) or tilde (~) character, the compound is interpreted as if an asterisk (*) appeared at the beginning of the pattern. For example, the pattern ~*[0-9]* matches any string not containing any digits. A trailing instance of an ampersand character (&) can only match the empty string. A trailing instance of a tilde character (~) can be read as “except for the empty string.”

Note: Spaces are interpreted as characters and are subject to matching even if they are adjacent to operators like "&".

CHARACTER DESCRIPTION

Note: Spaces specified before or after wildcard operators are interpreted as characters and are subject to matching.

? Matches any single character. For example, server?.smarts.com matches server3.smarts.com and serverB.smarts.com, but not server10.smarts.com.

* Matches an arbitrary string of characters. The string can be empty. For example, server*.smarts.com matches server-ny.smarts.com and server.smarts.com (an empty match).



Table 9: Basic Wildcard Patterns

Special characters for compound wildcard patterns are summarized below.

[set] Matches any single character that appears within [set]; or, if the first character of [set] is (^), any single character that is not in the set. A hyphen (-) within [set] indicates a range, so that [a-d] is equivalent to [abcd]. The character before the hyphen (-) must precede the character after it or the range will be empty. The character (^) in any position except the first, or a hyphen (-) at the first or last position, has no special meaning. For example, server[789-].smarts.com matches server7.smarts.com through server9.smarts.com, but not server6.smarts.com. It also matches server-.smarts.com.Example: server[^12].smarts.com does not match server1.smarts.com or server2.smarts.com, but will match server8.smarts.com.

<n1-n2> Matches numbers in a given range. Both n1 and n2 must be strings of digits, which represent non-negative integer values. The matching characters are a non-empty string of digits whose value, as a non-negative integer, is greater than or equal to n1 and less than or equal to n2. If either end of the range is omitted, no limitation is placed on the accepted number.For example, 98.49.<1-100>.10 matches a range of IP addresses from 98.49.1.10 through 98.49.100.10. Example of an omitted high end of the range: <50-> matches any string of digits with a value greater than or equal to 50. Example of an omitted low end of the range: <-150> matches any value between zero and 150.A more subtle example: The pattern <1-10>* matches 1, 2, up through 10, with * matching no characters. Similarly, it matches strings like 9x, with * matching the trailing x. However, it does not match 11, because <1-10> always extracts the longest possible string of digits (11) and then matches only if the number it represents is in range.

| Matches alternatives. For example,”ab|bc|cd” without spaces matches exactly the three following strings: “ab”, “bc”, and “cd”. A | as the first or last character of a pattern accepts an empty string as a match.Example with spaces “ab | bc” matches the strings “ab “ and “ bc”.

\ Removes the special status, if any, of the following character. Backslash (\) has no special meaning within a set ([set]) or range (<n1-n2>) construct.


Wi ld c a r d P a t t e r n s

Table 10: Compound Wildcard Patterns

& “And Also” for a compound wildcard pattern. If a component basic wildcard pattern is preceded by & (or is the first basic wildcard pattern in the compound wildcard pattern), it must successfully match. Example: *NY*&*Router* matches all strings which contain NY and also contain Router. Example: <1-100>&*[02468] matches even numbers between 1 and 100 inclusive. The <1-100> component only passes numbers in the correct range and the *[02468] component only passes numbers that end in an even digit. Example: *A*|*B*&*C* matches strings that contain either an A or a B, and also contain a C.

~ “Except” for a compound wildcard pattern (opposite function of &).If a component basic wildcard pattern is preceded by ~, it must not match. Example: 10.20.30.*~10.20.30.50 matches all devices on network 10.20.30 except 10.20.30.50.Example: *Router*~*Cisco*&*10.20.30.*~10.20.30.<10-20>* matches a Router, except a Cisco router, with an address on network 10.20.30, except not 10.20.30.10 through 10.20.30.20.




Index

AAll Components Down

Application Cluster notification 16, 19Application

Definition 7FTP Service 8HTTP Service 8NNTP Service 8SMTP Service 8SQL Service 8URL Service 8

Application Agent 22Application Cluster

AtRiskPercent Threshold setting 48Application cluster

Definition 8Failover 8Load balancing 9

Application Cluster All Components Down 16, 19Application Cluster At Risk 16, 19Application Cluster Degraded 17, 18Application Cluster DegradedSymptom 16Application Cluster Down 18Application Cluster DownSymptom 16Application Cluster Impacted 19Application Service 2Application Service Degraded 18Application Service DegradedSymptom 15Application Service Down 18Application Service DownSymptom 15Application Service Impacted 19Application Services Manager

Architecture 3Architecture 3At Risk

Application Cluster notification 16, 19AtRiskPercent

Application Cluster setting 48Availability Manager 1, 3, 4, 9

BBASEDIR ixBMC Patrol Agent 21, 22

Business Impact AnalysisService offerings 6

Business Impact Manager 5, 6

CCodebook Correlation Technology 6Concord SystemEDGE Agent 21Console

Global 4Polling and Thresholds 43

CriticalityService Connection setting 46

DDefault Polling and Threshold Groups 45Degraded

Application Cluster notification 16, 17, 18Application Service notification 18Transaction Notification 17

DegradedSymptomApplication Service notification 15

Dirig Agent 21Disconnected

Session notification 15Down

Application Cluster notification 18Application Service notification 18Session notification 17Transaction notification 17

DownSymptomApplication Cluster notification 16Application Service notification 15

EErrors

Transaction notification 15Event Source

Investigating 23Event source

Application agent 22Application Services Manager 22Heartbeat monitor 22

Index


Session monitor 22System agent 21Transaction monitor 22

Example 2

FFTP Service 8

GGroups

Copying an existing group 53Creating a new group 54Default polling 45Matching criteria 44, 50

Adding or removing 51Description 51Name 50Value 51

Members 44New 53Polling groups 44, 45Priority 44

Modifying 50Settings 44

Adding or removing 49Modifying 52Restoring default value 52

Threshold groups 44

HHeartbeat monitor 22HTTP Service 8

IICIM 6, 7Impact 23Impact Event

Application Cluster All Components Down 19Application Cluster At Risk 19

ImpactedApplication Cluster notification 19Application Service notification 19

InCharge Availability Manager 1, 3, 4, 9InCharge Broker 9InCharge Common Information Model 6, 7InCharge Performance Manager 9InCharge Service 9InCharge SMART Adapters 1, 4

MManaged Elements

Table of 14, 17, 19Management agent 10Management service

InCharge Broker 9InCharge Service 9Management agent 10SNMP Agent 10

Management servicesDefinition 9

MatchingPattern 55

Matching criteriasee Groups

Mercury SiteScope 22Monitoring Status

Application setting 48Computer Systems Polling setting 48Service Connection polling setting 46

NNNTP Service 8Notification

Application Cluster All Components Down 16, 19Application Cluster At Risk 16, 19Application Cluster Degraded 17, 18Application Cluster DegradedSymptom 16Application Cluster Down 18Application Cluster DownSymptom 16Application Cluster Impacted 19Application Service Degraded 18Application Service DegradedSymptom 15Application Service Down 18Application Service DownSymptom 15Application Service Impacted 19Session Disconnected 15Session Down 17Transaction Degraded 17Transaction Down 17Transaction Errors 15Transaction Slow 15Transaction Timed Out 15UnitaryComputerSystem Degraded 14UnitaryComputerSystem Unresponsive 17

OOperator

Wildcard 55


PPattern 55Pattern matching 55Performance Manager 9Polling

Computer Systems Monitoring Status 48Polling and Thresholds Console

Accessing 43Adding or removing matching criteria 51Adding or removing settings 49Changing group priority 50Modifying settings 52Restoring setting to default 52

Polling Group SettingApplication Monitoring Status 48

Polling GroupsApplications 45Computer Systems 45Service Connections 45

Polling groupssee Groups

Prioritysee Groups

RRoot Cause

Definition 13Root cause

Multiple root causes 29Root Cause Event

Application Cluster Degraded 17, 18Application Cluster Down 18Application Service Degraded 18Application Service Down 18Session Down 17Transaction Degraded 17Transaction Down 17UnitaryComputerSystem Unresponsive 17

RootCause EventUnitaryComputerSystem Degraded 14

SService Assurance Manager

In Architecture 4Service Connection

Criticality setting 46Definition 10Monitoring Status 46Session 10

Transaction 10Session

Definition 10Session Degraded 15Session Down 17Session monitor 22Settings 44

Restoring default parameters 52Slow

Transaction notification 15SMART Adapters 1, 4SMTP Service 8SNMP Agent 10SQL Service 8Symptomatic Event

Application Cluster DegradedSymptom 16Application Cluster DownSymptom 16Application Service Down 15Application Service DownSymptom 15Definition 13Session Disconnected 15Transaction Errors 15Transaction Slow 15Transaction Timed Out 15UnitaryComputerSystem Degraded 14

System Agent 21

TTechnical Support xiiThreshold Groups

Application Clusters 46Managed Elements 46Service Connections 46

Threshold groupssee Groups

Timed OutTransaction notification 15

TransactionDefinition 10

Transaction Degraded 17Transaction Down 17Transaction Errors 15Transaction Monitor 22Transaction Slow 15Transaction Timed Out 15

UUnitary Computer System 11, 14, 17UnitaryComputerSystem Degraded 14

Index


UnitaryComputerSystem Unresponsive 17URL Service 8

WWildcard 51, 55

Chart of operators 55

Documents

InCharge Application Services Manager User's [email protected]. 5. Products derived from this Apache software may not be calle d "Apache," nor may "Apache" appear in their