114
Making Client/Server Work TM Tivoli/Plus for BoKS User’s Guide March 22, 1996

Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

  • Upload
    others

  • View
    4

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Making Client/Server WorkTM

Tivoli/Plus for BoKS User’s Guide

March 22, 1996

Page 2: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this
Page 3: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide (March 1996)Copyright NoticeCopyright © 1991–1996 by Tivoli Systems Inc., including this documentation and all software. All rightsreserved. May only be used pursuant to a Tivoli Systems Incorporated Software License Agreement. Nopart of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, ortranslated into any computer language, in any form or by any means, electronic, mechanical, magnetic,optical, chemical, manual, or otherwise, without prior written permission of Tivoli Systems Inc. Thisdocument was prepared by Tivoli Systems Inc., and was printed in the United States of America.

All software has been developed at private expense and is commercially available at published prices.Federal Acquisition Regulation (FAR) or Defense Federal Acquisition Regulation Supplement (DFARS)RESTRICTED RIGHTS APPLY TO U.S. GOVERNMENT USE, as applicable:

Restricted Rights Notice

SOFTWARE supplied to any unit or agency of the United States Government otherthan the DOD shall be governed by clause 52.227-19(o) of the FAR (or any successorregulations) or, in the case of NASA, in clause 45 CFR 1827.405(a) (or any successorregulations) and, in any such case, the United States Government acquires only“restricted rights” in such SOFTWARE.

Restricted Rights Legend

SOFTWARE supplied to the Department of Defense (“DOD”) is classified as “Com-mercial Software”, and the United States Government acquires only “restricted rights”in SOFTWARE, as such rights are defined in clause 252.227.7013(c)(1)(ii) of theDFARS (or any successor regulations).

Tivoli Systems Inc., 9442 Capital of Texas Hwy North, Arboretum Plaza One, Suite 500, Austin, TX78759

Associated Copyrights

Portions copyright © 1989 by the Eric C. Cooper, Carnegie Mellon University. All rights reserved.Portions copyright © 1990, 1991 by the University of Utah and the Center for Software Science (CSS).All rights reserved.Portions copyright © 1989 by Digital Equipment Corporation. All rights reserved.Portions copyright © 1989, 1990, 1991 by Massachusetts Institute of Technology. All rights reserved.Portions copyright © 1986 by University of Toronto. All rights reserved.Portions copyright © 1989, 1990, 1991 by Larry Wall. All rights reserved.Portions copyright © 1990 by Alfalfa Software Incorporated.All rights reserved.Portions copyright © 1992 by Free Software Foundation, Inc. All rights reserved.Portions copyright © 1982, 1986, 1991 by Regents of the University of California. All rights reserved.Portions copyright © 1988, 1989, 1991 by Jef Poskanzer. All rights reserved.Portions copyright © 1991, 1992 by RSA Data Security, Inc. All rights reserved.Portions copyright © 1982, 1988, 1989 by Walter Tichy. All rights reserved.Portions copyright © 1990, 1991 by Paul Eggert. All rights reserved.Portions copyright © 1990, 1992 by Hewlett-Packard Company. All rights reserved.Portions copyright © 1989, 1993 by Jim Frost. All rights reserved.Portions copyright © 1990 by GROUPE BULL. All rights reserved.

Page 4: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Trademarks

Tivoli Management Environment, Tivoli Management Platform, Tivoli Management Framework, TivoliApplication Service, Tivoli/ADE, Tivoli/Admin, Tivoli/AEF, Tivoli/Courier, Tivoli/EIF, Tivoli/EnterpriseConsole, Tivoli/FSM, Tivoli/Plus, Tivoli/Print, Tivoli/Sentry, Tivoli/Workload, and TME are trademarksof Tivoli Systems Inc.

Product and company names mentioned in this document are trademarks or registered trademarks of theirrespective manufacturers.

Patent pending.

Page 5: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide i

Tivoli/Plus for BoKS User’s GuideTable of Contents

Preface ............................................................................................................................ v

Who Should Read This Guide ............................................................................... v

Prerequisite and Related Documents .................................................................... vi

What This Guide Contains.................................................................................... vi

Typeface Conventions ......................................................................................... vii

Platform-Specific Information ............................................................................. vii

Contacting Customer Support............................................................................... ix

Chapter 1—Getting Started with Tivoli/Plus for BoKS

Installation Requirements ............................................................................................ 1-2

License Key ........................................................................................................ 1-2

Software Requirements....................................................................................... 1-2

Hardware Requirements...................................................................................... 1-3

Installing from the Desktop ......................................................................................... 1-4

Installing from the Command Line ........................................................................... 1-11

Tivoli/Plus Icons........................................................................................................ 1-11

Tivoli/Plus Unique Features ...................................................................................... 1-12

Starting a Tivoli/Plus Module.................................................................................... 1-13

Launching the BoKS Administration Application .................................................... 1-15

Chapter 2—Software Distribution and Installation for BoKS

BoKS Installation Requirements ................................................................................. 2-2

Installing the BoKS Application.................................................................................. 2-4

Distributing and Installing BoKS with Tivoli/Courier ....................................... 2-5

Configuring Tivoli/Courier File Packages ................................................. 2-5

Distributing and Installing BoKS............................................................. 2-14

Installing BoKS on All Platforms ................................................... 2-15

Installing BoKS on a Single Platform ............................................. 2-16

Page 6: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

ii Version 1.0

Installing BoKS with the Install BoKS Task .................................................... 2-18

Post Installation Tasks ............................................................................................... 2-22

Chapter 3—Resource Monitoring

Using Tivoli/Plus for BoKS Monitors......................................................................... 3-2

Viewing the Status of Monitored Resources ............................................................... 3-5

Monitored Resources................................................................................................... 3-6

Host Status .......................................................................................................... 3-7

boks_master Daemon Status ............................................................................... 3-8

boks_servc Daemon Status ................................................................................. 3-9

boks_servm Daemon Status.............................................................................. 3-10

boks_clntd Daemon Status................................................................................ 3-11

boks_drainmast Daemon Status........................................................................ 3-12

BoKS Directory Free Space.............................................................................. 3-13

BoKS Node Licenses ........................................................................................ 3-14

BoKS User Licenses ......................................................................................... 3-15

Integrity Check Warnings ................................................................................. 3-16

Network Bandwidth .......................................................................................... 3-17

Chapter 4—Enterprise Event Management

Configuration Activity................................................................................................. 4-2

Setting Up the Tivoli/Enterprise Console.................................................................... 4-3

Creating A New Rule Base ................................................................................. 4-4

Adding To An Existing Rule Base...................................................................... 4-5

Setting Up the Tivoli Logfile Adapter......................................................................... 4-6

Events and Rules ......................................................................................................... 4-6

BoKS Events....................................................................................................... 4-6

Sentry Events .................................................................................................... 4-16

Automated Actions From Event Correlation Rules .......................................... 4-23

Page 7: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide iii

Chapter 5—Tasks and Jobs for BoKS

Tivoli/Plus for BoKS Jobs........................................................................................... 5-2

Running a BoKS Job ................................................................................................... 5-6

Modifying a BoKS Job ................................................................................................ 5-9

Page 8: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

iv Version 1.0

Page 9: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

Tivoli/Plus for BoKS User’s Guide v

PrefaceTheTivoli/Plus for BoKS User’s Guide describes specific features andprocedures for using the Tivoli/PlusTM for BoKS module. This modulewas jointly developed by Tivoli Systems Inc. and Securix Inc. andprovides an integration of the BoKS security product with the TivoliManagement EnvironmentTM (TME). Through this integration, theTivoli/Plus for BoKS module delivers the system managementcapabilities of TME for specific use with BoKS. Using Tivoli/Plus forBoKS, the BoKS application can be managed across a multi-platformnetwork.

Tivoli/Plus provides different modules for integrating differentproduction control applications with the Tivoli ManagementEnvironment. Since all Tivoli/Plus modules have a common interface,a system administrator can implement the system managementcapabilities of the TME with various production control applicationswhile enjoying the simplicity of a common interface. The addition ofTivoli/CourierTM, Tivoli/SentryTM, and the Tivoli/EnterpriseConsoleTM provides additional management capabilities in the areas ofclient installation, resource monitoring, and event correlation.

Who Should Read This GuideThis guide is for system administrators who use the Tivoli/Plus forBoKS module to manage the operation of the BoKS security product.Readers of this guide should be familiar with the Tivoli ManagementEnvironment, the BoKS application, and concepts such as directories,files, and symbolic links. Readers of this guide should also be familiarwith the operating systems running on the machines on which they willbe using the Tivoli/Plus module, TME, and the BoKS application.

Note: All references to “Sentry” in this guide refer tothe Tivoli/Sentry product or its components.

Page 10: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

vi Version 1.0

Prerequisite and Related DocumentsThe information in theTivoli/Plus for BoKS User’s Guidecomplements information presented in theTivoli ManagementPlatform User’s Guideand the Tivoli/Plus User’s Guide. You must befamiliar with Tivoli/Plus before you can effectively use a specificTivoli/Plus module. You should also be familiar with thedocumentation for the BoKS application.

You should be familiar with these guides before attempting to use theinformation in theTivoli/Plus for BoKS User’s Guide.

What This Guide ContainsTheTivoli/Plus for BoKS User’s Guidecontains the followingchapters:

■ Chapter 1, "Getting Started with Tivoli/Plus for BoKS"Contains the installation requirements and procedures forinstalling Tivoli/Plus for BoKS. This chapter also containsinformation about Tivoli/Plus icons, features unique toTivoli/Plus, and launching the BoKS application.

■ Chapter 2, "Software Distribution and Installation for BoKS"Describes how to set up the pre-written Tivoli/Courier filepackages to be used with Tivoli/Plus for BoKS for distributingand installing the BoKS application across a network.

■ Chapter 3, "Resource Monitoring"Describes how Tivoli/Sentry may be used with Tivoli/Plus forBoKS to monitor BoKS resources in order to detect and preventsystem problems.

■ Chapter 4, "Enterprise Event Management"Describes how to set up the Tivoli/Enterprise Console to be usedwith Tivoli/Plus for BoKS to provide event management. Thischapter also contains a description of the events and rules specificto Tivoli/Plus for BoKS.

■ Chapter 5, "Tasks and Jobs for BoKS"Describes how to customize and run BoKS jobs and reports withTivoli/Plus for BoKS.

Page 11: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

Tivoli/Plus for BoKS User’s Guide vii

Typeface ConventionsThis guide uses several typeface conventions for special terms andactions. These conventions have the following meaning:

Bold Commands, keywords, file names, or otherinformation that you must use literally appear inbold.Names of windows, dialogs, and other controls alsoappear inbold.

Italics Variables and values that you must provide appear initalics.

Bold Italics New terms appear in bold italics the first time they areused.

Monospace Code examples appear in amonospace font.

This guide may include icons in the left margin. These icons providecontext for the discussion in the text or for performing a step within aprocedure. For example, if you start a procedure by double-clicking ona task icon, that icon appears in the left margin next to the first step. Ifthe fourth step of the procedure instructs you to open another icon, thaticon appears in the left margin next to the fourth step.

Platform-Specific InformationThe following markers are used to identify platform-specificinformation or procedures:

Icon Supported Platform

IBM RS/6000 series running AIX 3.2.5

IBM RS/6000 series running AIX 4.1

AT&T 3000 series running AT&T UNIX SVR4 MP-RASRelease 2.02 and 2.03

Data General AViiON series running DG/UX version5.4R3.00

IBM-compatible PCs 486 or higher running MS-DOS orPC-DOS 3.1 through 6.22

AIX 3.2.5

AIX 4.1

AT&T

DG/UX

DOS

Page 12: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

viii Version 1.0

HP9000/700 and 800 series running HP-UX 9.00,HP/UX 9.01, HP/UX 9.03, and HP-UX 9.05

HP9000/700 and 800 series running HP-UX 10.0

Motorola 88K series running SVR4 version R40V4.2

IBM-compatible PCs 486 or higher running NovellNetWare 3.11, 3.12, or 4.0

IBM-compatible PCs 486 or higher running NEXTSTEPrelease 3.2

IBM-compatible PCs 486 or higher running MicrosoftWindows NT version 3.1, 3.5, or 3.5.1

IBM-compatible PCs 486 or higher running IBM OS/2version 2.0, 2.1, or Warp

DEC Alpha Generation system running DEC OSF/1 3.0or 3.2

Sun SPARC series running Solaris 2.3 or 2.4

Sun SPARC series running SunOS 4.1.2 or 4.1.3

All SVR4-based platforms, to include: AT&T UNIXSVR4, DG/UX version 5.4R3.00, Motorola, Solaris, andUnixWare 2.0

IBM-compatible PC 486 or higher running NovellUnixWare 2.0

IBM-compatible PC 486 or higher running MicrosoftWindows 3.1, 3.11, or 3.11 for WorkGroups

Icon Supported Platform

HP 9.x

HP 10.0

Motorola

NetWare

NEXT

NT

OS/2

OSF/1

Solaris

SunOS

SVR4

UnixWare

Windows

Page 13: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

Tivoli/Plus for BoKS User’s Guide ix

Contacting Customer SupportWe are very interested in hearing from you about your experience withthe products in the Tivoli Management Environment. We welcomeyour suggestions for improvements.

If you encounter difficulties with any TME product or book, pleasecontact your customer support representative. To assist you, thissection includes the TME Problem Report form. You can use this formto fax problem information to your support provider. Tivoli alsoincludes thewsupport command. This command prompts you forproblem information, which can be e-mailed to your support provideror saved to a text file. You can then print the saved file, and fax theresulting TME Problem Report form to your support provider.

Page 14: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Preface

x Version 1.0

TME Problem Report

Name:

E-mail:

Company:

System Type:Operating System Rel:

Tivoli Product:

Problem On:

Priority:

3. Minor

Short Description (10 - 12 words):

Attempted Solutions:

Description / Error Messages:

Phone #:

Fax #:

TMR #:

Version:

Tivoli Server Tivoli Client

2. Major1. Critical

4. No Impact

Previous Call Tracking #:

Page 15: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide 1–1

Getting S

tarted with

Tivoli/Plus for B

oKS

Getting Started with Tivoli/Plusfor BoKS

The Tivoli/Plus for BoKS module provides an integration of the TivoliManagement Environment with the BoKS security product. Thisintegration allows centralized distribution and management of theBoKS application across a multi-platform network. This moduleprovides the following features for managing the BoKS application:

■ Icons for launching the BoKS application

■ Subscription lists for clients and servers

■ Tivoli/Courier file packages

■ Tivoli/Sentry monitors

■ Tivoli/Enterprise Console events and rule sets customized forBoKS

■ BoKS-specific tasks and jobs

Note: The Tivoli/Courier and Tivoli/Sentry applications must beinstalled and configured before their correspondingTivoli/Plus feature is operational.

1

Page 16: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installation Requirements

1–2 Version 1.0

Installation RequirementsBefore attempting to install Tivoli/Plus for BoKS into the TivoliManagement Environment, make certain you review the requirementsin this section.

The following table provides the context and authorization rolerequired to install Tivoli/Plus for BoKS.

The Tivoli/Plus for BoKS module must be installed on the Tivoliserver. In order to have full functionality, the Tivoli/Plus for BoKSmodule must also be installed on the following machines. Thesemachines must be Tivoli managed nodes.

■ The Tivoli/Enterprise Console server (if there is one).

■ The BoKS master server.

■ Any BoKS slave servers and clients.

License KeyYou must obtain a license key to use the Tivoli/Plus for BoKS module.You must complete and return the license request form that came withthis software. Tivoli Customer Support will then provide you with alicense key for your module.

Software RequirementsYou must have a TME 2.0.2 installation up and running. Additionally,BoKS 4.2.2 should be installed before the Tivoli/Plus for BoKSmodule is installed. Tivoli/Plus for BoKS has also been verified tofunction properly with the TME 2.5 and BoKS 4.2.3 releases.

Tivoli/Plus for BoKS has features that use Tivoli/Courier,Tivoli/Sentry and the Tivoli/Enterprise Console. If these applicationsare not installed, then the specific feature requiring these applications

Activity Context Required Role

Installing Tivoli/Plus forBoKS

TME install_product

Page 17: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installation Requirements

Tivoli/Plus for BoKS User’s Guide 1–3

Getting S

tarted with

Tivoli/Plus for B

oKS

will not work. However, Tivoli/Plus for BoKS installation allows youto incrementally re-install those features if you buy the missingproducts at a later date.

Hardware RequirementsThe following table provides the client and server disk spacerequirements for Tivoli/Plus for BoKS. This space is in addition to thespace requirements for the management platform, the Tivoliapplication, and the BoKS security product.

Tivoli/Plus for BoKS is installed on the TME server, theTivoli/Enterprise Console server (if you have the Tivoli/EnterpriseConsole), and the BoKS nodes. The space requirements are the samefor all of these machines. The Tivoli/Plus for BoKS module usesplatform-independent shell and Perl scripts, which is why themodule’s requirements do not differ from platform to platform.

Platform Libraries Binaries Database Man PagesMessageCatalogs

0 MB 500 KB † 0 0 MB 50 KB

0 MB 500 KB † 0 0 MB 50 KB

0 MB 500 KB † 0 0 MB 50 KB

0 MB 500 KB † 0 0 MB 50 KB

AIX

HP-UX

SVR4

SunOS

Page 18: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

1–4 Version 1.0

Installing from the DesktopUse the following steps to install Tivoli/Plus for BoKS from the Tivolidesktop:

1. Select theInstall -> Install Product... option from theDesktopmenu

to display theInstall Product dialog.

Page 19: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

Tivoli/Plus for BoKS User’s Guide 1–5

Getting S

tarted with

Tivoli/Plus for B

oKS

If the Tivoli/Plus for BoKS module is listed in theSelect Productto Install scrolling list, skip to step 3. If it is not listed, proceedto step 2.

2. Press theSelect Media... button to display theFile Browserdialog.

Page 20: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

1–6 Version 1.0

TheFile Browser dialog enables you to identify or specify thepath to the installation media.

If you already know the path to the CD-ROM image

a. Enter the full path in thePath Name field.

b. Press theSet Path button to change to the specified directory.

c. Press theSet Media & Close button to save the new mediapath and return to theInstall Product dialog. The dialog nowcontains a list of products that are available for installation.

Page 21: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

Tivoli/Plus for BoKS User’s Guide 1–7

Getting S

tarted with

Tivoli/Plus for B

oKS

If you do not know the exact path to the CD-ROM image

a. From theHosts scrolling list, choose the host on which theinstall media is mounted. Choosing a host updates theDirectories scrolling list to show the directories of the hostyou chose.

a. From theDirectories scrolling list, choose the directorycontaining the install media.

a. Press theSet Media & Close button to save the new mediapath and return to theInstall Product dialog. The dialog nowcontains a list of products that are available for installation.

3. Select the Tivoli/Plus for BoKS module from theSelect Productto Install list.

Page 22: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

1–8 Version 1.0

4. To specify the clients on which the module will be installed, usethe arrow keys to move machine names between theClients toInstall On scrolling list and theAvailable Clients scrolling list.

By default, all machines in the current Tivoli Managed Region(TMR) are listed in theClients to Install On scrolling list. Tomove a machine name to theAvailable Clients list, choose oneor more clients from theClients to Install On scrolling list andpress the button. The chosen clients are moved from theClients to Install On scrolling list to theAvailable Clientsscrolling list.

5. Enter your license key for the Tivoli/Plus for BoKS module in theLicense Key field.

6. Press theInstall & Close button to install the module and closethe Install Product dialog.

— OR —

Press theInstall button to install the module and keep theInstallProduct dialog open. You can then install Tivoli/Plus for BoKSon another set of clients or you can install another product.

Page 23: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

Tivoli/Plus for BoKS User’s Guide 1–9

Getting S

tarted with

Tivoli/Plus for B

oKS

The installation process prompts you with aProduct Installdialog similar to the following:

This dialog provides the list of operations that take place wheninstalling the software. This dialog also warns you of anyproblems that you may want to correct before you install theTivoli/Plus for BoKS module.

Page 24: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Desktop

1–10 Version 1.0

7. Press theContinue Install button to begin the installationprocess.

—OR—

Press theCancelbutton to abort the installation process.

When the installation is complete, theProduct Install dialogdisplays a completion message similar to the following.

8. Press theClosebutton when theProduct Install dialog indicatesthat the installation is complete.

Completionmessage

Page 25: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing from the Command Line

Tivoli/Plus for BoKS User’s Guide 1–11

Getting S

tarted with

Tivoli/Plus for B

oKS

Installing from the Command LineUse thewinstall command to install the Tivoli/Plus for BoKS module.The following example is the syntax for thewinstall command and itsparameters:

winstall -c cdrom_path -s installation_server \-i index_file -l license_key

where:

-c cdrom_pathSpecifies the path to the CD-ROM image.

-s installation serverSpecifies the server on which the product is to beinstalled.

-i index_file Specifies the index file from which the product is to beinstalled.

-l license_key Specifies the license key for the product. Thisparameter is optional for installations following thefirst one.

See thewinstall command in theTivoli Management PlatformReference Manualfor more information.

Tivoli/Plus IconsAlthough the Tivoli/Plus icons look like (traditional) TME icons, theirfunctionality has been altered slightly to provide a faster, moreintuitive approach to navigating and deploying the module’s features.In some cases, like a Tivoli/Courier file package profile, menu itemshave been removed from the icon’s pop-up menu to create a more“point and click” environment.

The Tivoli/Plus icons can be activated in either of two ways:

■ Opening or executing the icon by double-clicking on it with theleft mouse button. In many cases, double-clicking executes anactivity (such as a task) without opening another dialog layer.

■ Displaying the icon’s pop-up menu by pressing and holding theright mouse button

Page 26: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus Unique Features

1–12 Version 1.0

Generally, either method may be used to access a particular function.There are cases, however, where a particular function can only beaccessed by one of these methods.

The following icon represents the Tivoli/Plus for BoKS resources:

To prevent confusion between traditional TME and Tivoli/Plus forBoKS functionality, each Tivoli/Plus icon has been overlaid with theTivoli/Plus symbol to highlight its special functionality.

Tivoli/Plus Unique FeaturesTivoli/Plus modules use the termprofile manager in a somewhatdifferent way than do the other Tivoli products. In a Tivoli/Plusmodule, a profile manager’s primary function is as asubscription list.A subscription list identifies the machines that tasks and jobs run onwhen executed. Subscription lists can contain machine names or otherprofile managers. Adding a profile manager to a subscription list issimply a way of subscribing several machines at a time rather thanadding each one individually.

TheTivoli/Plus User’s Guide describes the function of profilemanagers in the Tivoli/Plus modules in more detail. For moreinformation, see the section on subscribers and targets in theTivoli/Plus User’s Guide.

Page 27: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Starting a Tivoli/Plus Module

Tivoli/Plus for BoKS User’s Guide 1–13

Getting S

tarted with

Tivoli/Plus for B

oKS

Starting a Tivoli/Plus ModuleAll Tivoli/Plus modules are kept in a collection under theTivoliPlusicon on the TME desktop. The module’s icon is added to this collectionafter installation. The following icon represents the Tivoli/Pluscollection:

Use the following steps to see the modules included in your Tivoli/Pluscollection:

1. From the main TME desktop, double-click on theTivoliPlus iconor select theOpen... option from theTivoliPlus icon’s pop-upmenu.

to display theTivoliPlus window.

Page 28: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Starting a Tivoli/Plus Module

1–14 Version 1.0

TheTivoliPlus window displays an icon for each Tivoli/Plusmodule installed. In the case above, only the Tivoli/Plus forBoKS module has been installed.

Note: In some cases, icons in theTivoliPlus window may beplaceholders for future modules. In the interim, they areused for informational purposes.

2. Double-click on theTivoliPlus for BoKS icon to open the module

—OR—

SelectOpen from theTivoliPlus for BoKS icon’s pop-up menu

to display the icons representing the tasks and other tools formanaging the BoKS product.

Page 29: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Launching the BoKS Administration Application

Tivoli/Plus for BoKS User’s Guide 1–15

Getting S

tarted with

Tivoli/Plus for B

oKS

Launching the BoKS Administration ApplicationWhen Tivoli/Plus for BoKS is installed on a BoKS master server, theinstallation process identifies the location of the BoKS application anddata directories and creates an icon for launching theboksadmapplication from within the TME.

Each BoKS master server has its own BoKS icon for launching theboksadm application from that server site. For example, for a masterserver named “boston,” the following icon appears:

Page 30: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Launching the BoKS Administration Application

1–16 Version 1.0

Theboksadm application is pre-configured and appears on the pop-upmenu for each BoKS icon.

Note: Although theboksadm launch icon appears on a TivoliAdministrator’s desktop, the user id associated with theAdministrator must be authorized within the BoKS product asa BoKS administrator or sub-administrator. Otherwise,boksadm will fail to launch. In addition, the BoKSsub-administrators must be configured with no password.Refer to the BoKS administration guide for more details aboutsetting up sub-administrators.

Page 31: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Launching the BoKS Administration Application

Tivoli/Plus for BoKS User’s Guide 1–17

Getting S

tarted with

Tivoli/Plus for B

oKS

Selecting theStart boksadmoption from the menu or bydouble-clicking on the launch icon displays the BoKS xmenuett.

Page 32: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Launching the BoKS Administration Application

1–18 Version 1.0

Page 33: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide 2–1

Softw

are Distribution and

Installation for BoK

S

Software Distribution andInstallation for BoKS

Tivoli/Plus for BoKS provides two methods for installing the BoKSsoftware across a UNIX network from a central location. The firstmethod is to distribute and then install the BoKS clients and slaveservers with Tivoli/Courier. To use this method, you first run theSetupBoKS Installation task to configure the pre-written, hierarchicalTivoli/Courier file package provided by the Tivoli/Plus for BoKSmodule. You then distribute the file package and install the BoKSsoftware by running theDistribute/Install BoKS task. Because theTivoli/Courier file package is pre-written, much of the configurationactivity normally associated with a Tivoli/Courier file package hasbeen done for you.

The following icons represent theSetup BoKS Installation andDistribute/Install BoKS tasks.

The second installation method is to run theInstall BoKS task. Thistask does not require Tivoli/Courier. You can use this task if the BoKSapplication is already available to the target machines so that you onlyneed to install and not distribute the BoKS software. This situation

2

Page 34: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

BoKS Installation Requirements

2–2 Version 1.0

might exist, for example, if the BoKS software is available through anNFS-mounted remote file system.

The following icon represents theInstall BoKS task.

BoKS Installation RequirementsTivoli/Plus for BoKS performs several pre-installation checks beforeinstalling the BoKS application. Most of these requirements applywhether or not you are installing with theDistribute/Install BoKS taskor theInstall BoKS task.

If any of the pre-installation checks fail when running theDistribute/Install BoKS task, Tivoli/Plus for BoKS adds an errormessage to the installation log on the source host. This error messageindicates on which target host the installation failed. By default, aninstallation failure on one target host does not prevent the file packagefrom being distributed and installed on the other hosts in the targetsubscription list.

The Install BoKS task displays an output window that confirms theBoKS installation on each target host or provides the reason for a failedinstallation. A failed installation on one host does not preventinstallation on the other hosts in theInstall BoKS task’s subscriptionlist.

Although the current release of Tivoli/Plus for BoKS supports onlyBoKS Version 4.2.2, this requirement is not enforced for flexibility. Forexample, the BoKS 4.2.3 release has been verified to work with thisrelease of Tivoli/Plus for BoKS. Future BoKS releases may not becompatible.

The following table describes the installation requirements. Consultthe BoKS installation guide for complete details.

Page 35: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

BoKS Installation Requirements

Tivoli/Plus for BoKS User’s Guide 2–3

Softw

are Distribution and

Installation for BoK

S

BoKS Installation Requirement

Task to which theRequirement Applies

Sufficient Disk Space

For BoKS client installations, the file system containingthe specified BoKS installation directory (APPLPATH)requires 20MB available disk space. The specified BoKSdata directory requires 5MB available disk space.

For BoKS slave server installations, the installationdirectory requires 30MB and the data directory requires10MB available disk space.

Correct Target Platform

Tivoli/Courier file packages configured for a specifiedplatform are not installed on subscribed target nodes witha different platform. This feature allows for a simplesubscription process, since a single subscription list canbe used for all platforms.

Tivoli/Plus for BoKS, however, does not verify theactual BoKS software. For example, if you create aSolaris file package with a path to an HP-UX BoKS tarfile, an incorrect version of the BoKS software will beinstalled on all Solaris targets.

Host Key Provided

A separate host key must be provided for each targethost. No host key format/content checks are made.

When using theSetup BoKS Installation task, the filecontaining the host keys must reside on the Tivoli server.When using theInstall BoKS task, the file containingthe host key must reside on each node on which BoKS isbeing installed.

✓ ✓

Page 36: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–4 Version 1.0

Installing the BoKS ApplicationTo set up the BoKS installation, you will run theSetup BoKSInstallation or the Install BoKS task depending on whether or not youneed to distribute the BoKS software before the installation. Both ofthese tasks allow you to run the BoKS installation process on variousmachines from a central location. TheSetup BoKS Installation task,however, configures the Tivoli/Courier file packages required fordistributing the BoKS software.

Pre-existing BoKS Installation

Installation is cancelled for any target node whichalready has BoKS installed and running.

✓ ✓

License Branding

Unlicensed versions of the BoKS software will not beinstalled. Sites that have received “unbranded” BoKSsoftware will need to extract and brand the software withthe required license information before attempting todistribute and install the corresponding file package.Consult the BoKS documentation or a BoKS technicalsupport person for more details.

✓ ✓

BoKS Host Key / Install Patch

Some older BoKS 4.2 versions don’t support unattendedinstallations; they always prompt for input of host keys.These older versions must be upgraded with an availableBoKS patch that allows for special, automatedinstallations. Contact BoKS support to obtain this patch,if needed.

✓ ✓

BoKS Installation Requirement

Task to which theRequirement Applies

Page 37: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–5

Softw

are Distribution and

Installation for BoK

S

If you are using an NFS (Network File System) setup where the BoKSsoftware is installed on a single machine and NFS-mounted to all othertarget machines, then using Tivoli/Courier to distribute and installBoKS may not be appropriate. In this case, use theInstall BoKS task.The procedure for using this task is described under “Installing BoKSwith the Install BoKS Task” on page 2-18.

Distributing and Installing BoKS with Tivoli/CourierInstalling BoKS with Tivoli/Courier is a two-stage process. First, youset up the BoKS installation by configuring a Tivoli/Courier filepackage for each type of platform on which you are installing BoKS.For example, if you are installing BoKS on both a Solaris and a Sunplatform, you need to configure a Tivoli/Courier file package twice,once for each platform.

Second, you distribute and install the configured file packages byrunning theDistribute / Install BoKS Clients task. This taskdistributes and then installs BoKS on the selected subscribers for eachplatform for which you have configured a Tivoli/Courier file package.

Configuring Tivoli/Courier File Packages

When configuring a Tivoli/Courier file package to be used withTivoli/Plus for BoKS, you need to establish the location of the BoKSinstallation binaries and specify how these binaries are to bedistributed.

Use theSetup BoKS Installation icon to configure a Tivoli/Courierfile package. Double-clicking on this icon displays theSetup BoKSInstallation window. This window allows you to configure the clientinstallation parameters for a UNIX platform. You need to complete theSetup BoKS Installation window for each platform on which you willbe installing the BoKS product.

Page 38: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–6 Version 1.0

Use the following steps to set up Tivoli/Courier to install BoKS on aUNIX platform. Online help is available.

1. Select theRun job... option from theSetup BoKS Installationicon’s pop-up menu to display theSetup BoKS Installationwindow.

Page 39: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–7

Softw

are Distribution and

Installation for BoK

S

2. In theDistribution Options block, specify how the systemshould respond if it finds an existing BoKS application duringinstallation by clicking on one of the following buttons:

• Skip installation on that node. If this option is selected, theinstallation is skipped for each machine on which an existingBoKS application is found.

• Remove pre-existing software and continue installation. Ifthis option is selected, an existing BoKS application isremoved and installation of the new BoKS applicationcontinues.

Note: If the distribution task detects that BoKS is alreadyinstalled and running on a target node, thedistribution will be skipped on that node, regardlessof this selection.

Page 40: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–8 Version 1.0

3. In the Distribution Options block, click on theTivoli Interpreterbutton to display a scrolling list of platforms currently supportedby Tivoli. Choose one of these platforms.

Page 41: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–9

Softw

are Distribution and

Installation for BoK

S

If the platform you need is not in the scrolling list, then click ontheOther button and enter the platform name in theOtherInterpreter field.

4. In theBoKS Source Information block, select whether BoKSsource files should be taken from an existing BoKS directory (theExisting Installation button) or from a tape device or tar file (theTape or Tar File button). Clicking on either button displaysadditional fields.

Page 42: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–10 Version 1.0

5. In theManaged Node Name field, enter the name of the TMEserver or the managed node where the BoKS source binaries arelocated.

6. If you are installing from an existing installation, enter the nameof the source directory where BoKS has been installed in theExisting BoKS Installation Directory field. Continue with step8.

7. If you are installing from a tar file or device, enter the full pathname where the BoKS tar file can be found in theFull Path toTape Device or Tar Filefield.

If you are installing from a tar file or device, the system needs adirectory in which to unpack these files before distribution. Enterthe path to the directory that you choose for this purpose in the

Page 43: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–11

Softw

are Distribution and

Installation for BoK

S

20Mb Temp Directory field. The directory will be created on thenode specified in theManaged Node Name field.

Note: After you have installed BoKS from a device or tar file,you can use the temporary directory as the source of theBoKS software for subsequent installations. To do this,select theExisting Installation button and then enter thepath to the temporary directory in theExisting BoKSInstallation Directory field. When you install BoKS forthe first time, the system creates subdirectories in thedirectory that you specified for the BoKS binaries. Thesesubdirectories are named with the following format:

interpreter_type/boks

where interpreter type refers to the platform to whichBoKS was distributed.

On subsequent installations, be sure to specify the fullpath name including the additional directories. Forexample, if the original path was:

/usr/tivoli_plus/staging

and you specified a Solaris2 platform, you wouldspecify:

/usr/tivoli_plus/staging/solaris2/boks

8. In theBoKS Host Keys File Path on Tivoli Server field, enterthe path to a file on the Tivoli Server which contains the BoKShost keys for each target host being installed. The format of thisfile is space-separatedHostName HostKey pairs, one pair perline, as follows (any additional fields on each line are ignored:

Hosta HostKeya

Hostb HostKeyb

Hostc HostKeyc

Note: TheRegister New Hosts task (see “Post InstallationTasks” on page 2-22) requires that this file be copied tothe master server host. In order to register the new BoKSmachines, this file may optionally contain the IP address

Page 44: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–12 Version 1.0

for each machine. Although the IP address field is notrequired to install BoKS, you might consider adding it asyou create the host key file in order to avoid rework later.In this case, the format for each entry of the host key fileis:

Host HostKey IPAddress

This file should not be world-readable for securityreasons. You must create this file at the location you havespecified and edit the file to contain the proper entries.This file must be available on the Tivoli server at the timethat you run theDistribute/Install BoKS task.

9. In theBoKS Target Configuration window, select one of thefollowing.

• Install with specified settings. Use this option to specify afull configuration. After the BoKS application is distributed,it is automatically installed with the settings you specify.Clicking on this button displays theBoKS TargetConfiguration fields. These fields are directly related to thestandard BoKS Install/Setup parameters. For furtherinformation on these parameters, consult the BoKSinstallation documentation. Complete these fields using theBoKS documentation as your guide.

• Install with a pre-existing configuration. Use this option tospecify that an installation be propagated from a previouslyconfigured and/or installed node to a set of target nodes.Clicking on this button displays theBoKS ConfigurationFile field and theBoKS Installation Directory field.Complete these fields. After the BoKS application isdistributed, it is automatically installed with the settingscontained in the configuration file you specify.

Note: This option is disabled unless theExistingInstallation option is selected in theBoKS SourceInformation block.

Page 45: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–13

Softw

are Distribution and

Installation for BoK

S

10. Press theSet and Close button to set all of the information youhave entered.

Page 46: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–14 Version 1.0

Distributing and Installing BoKS

After you have configured a Tivoli/Courier file package for eachplatform on which you wish to install BoKS, you are ready to installBoKS on these platforms. You can distribute to all platforms for whichyou have configured a Tivoli/Courier file package or to a singleplatform. Output for each platform is sent to the source machine in thefollowing file:

/tmp/boks_install_log. platform_name

whereplatform_name refers to the operating system on which BoKSwas installed. Consult this file on the source machine after distributinga file package to see the results of the BoKS installation on each targetnode.

You will use theDistribute/Install BoKS icon to install BoKS. If youwish to view the Tivoli/Courier file packages that you have created,select theOpen... option from theDistribute/Install BoKS icon’spop-up menu.

Note: The installation requirements discussed under “BoKSInstallation Requirements” on page 2-2 must be met beforeyou run theDistribute/Install BoKS task. The host key filethat you specified in step 8. of the “Distributing and InstallingBoKS with Tivoli/Courier” procedure must exist before yourun theDistribute/Install BoKS task.

After you have installed the BoKS software, refer to “Post InstallationTasks” on page 2-22 for information on registering the new BoKSclients and slave servers with the associated BoKS master server host.

Page 47: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–15

Softw

are Distribution and

Installation for BoK

S

Installing BoKS on All Platforms

Use the following steps to install BoKS on all platforms for which youhave configured a Tivoli/Courier file package:

1. Select theSubscribers... option from theDistribute/InstallBoKS icon’s pop-up menu.

2. Specify the subscription lists to which you want to install BoKSby using the and buttons to move the desired lists intotheCurrent Subscribers field. When finished, press theSetSubscriptions & Close button.

3. Select theDistribute option from theDistribute/Install BoKSicon’s pop-up menu. Selecting this option installs BoKS onto theclient machines listed on the subscription lists that you chose.

Page 48: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–16 Version 1.0

Installing BoKS on a Single Platform

If you want to install BoKS on only one type of platform, you candistribute only the Tivoli/Courier file package that applies to thatplatform.

Use the following steps to install BoKS on a single platform.

1. Select theOpen... option from theDistribute/Install BoKS icon’spop-up menu.

2. In theDistribute/Install BoKS window, select theSubscribers...option from the pop-up menu of the icon representing the filepackage for the platform on which you wish to install BoKS.

3. Specify the subscription lists to which you want to install BoKSon a single platform by using the and buttons to move the

Page 49: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–17

Softw

are Distribution and

Installation for BoK

S

desired lists into theCurrent Subscribers field. When finished,press theSet Subscriptions & Close button.

4. Select theDistribute option from the icon’s pop-up menu.Selecting this option installs BoKS onto the client machineslisted on the subscription lists that you chose.

Page 50: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–18 Version 1.0

Installing BoKS with the Install BoKS TaskUse this procedure if the BoKS software already exists on the nodes(through NFS or other means) on which you want BoKS installed.

After you have completed this task and installed BoKS, refer to “PostInstallation Tasks” on page 2-22 for information on registering the newBoKS clients and slave servers with the associated BoKS master serverhost.

1. Select theRun job... option from theInstall BoKS icon’s pop-upmenu to display theInstall BoKS window.

Page 51: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–19

Softw

are Distribution and

Installation for BoK

S

2. In theBoKS Host Keys File Path on Target Systemfield, enterthe path to the file on the target machines that contains the BoKShost key. The path you enter will be the same for all targetmachines. The format for the host key entry in this file is:

HostName HostKey

TheHostName andHostKey entries are on the same line andseparated by a single space.

Note: TheRegister New Hosts task (see “Post InstallationTasks” on page 2-22) requires that the entries from thehost key file for all target machines be present in a singlefile on the master server host. You might consider puttingall entries into a single file to begin with, and thendispersing the appropriate entries to individual files oneach target machine. The host keys file on the masterserver host may optionally contain the IP address foreach machine. In this case, the format for each entry is:

Host HostKey IPAddress

If you add the IP address field to the host key file on thetarget machines, this field is ignored during installation.

This file should not be world-readable for securityreasons. You must create this file at the location you havespecified and edit the file to contain the proper entries.This file must be available on each target machine at thetime of installation.

Page 52: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

2–20 Version 1.0

3. In theBoKS Target Configuration window, select one of thefollowing.

• Install with specified settings. Use this option to specify afull configuration. After the BoKS application is distributed,it is automatically installed with the settings you specify.Clicking on this button displays theBoKS TargetConfiguration fields. These fields are directly related to thestandard BoKS Install/Setup parameters. For furtherinformation on these parameters, consult the BoKSinstallation documentation. Complete these fields using theBoKS documentation as your guide.

• Install with a pre-existing configuration. Use this option tospecify that an installation be propagated from a previouslyconfigured and/or installed node to a set of target nodes.Clicking on this button displays theBoKS ConfigurationFile field and theBoKS Installation Directory field.Complete these fields. After the BoKS application isdistributed, it is automatically installed with the settingscontained in the configuration file you specify.

Page 53: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Installing the BoKS Application

Tivoli/Plus for BoKS User’s Guide 2–21

Softw

are Distribution and

Installation for BoK

S

4. Press theSet and Close button to set all of the information youhave entered.

Note: The host key file that you specified in step 2. of thisprocedure must exist on each target machine before youcontinue with the next step.

Page 54: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Post Installation Tasks

2–22 Version 1.0

5. When you are ready to install BoKS, select theRun on selectedsubscribers... option from the Install BoKS icon’s pop-up menu.(For information on modifying a task, including its executiontargets, refer to “Modifying a BoKS Job” on page 5-9.)

Post Installation TasksAfter you have installed the BoKS application, you need to “register”or identify the new BoKS clients and slave servers to the associatedBoKS master server host. This requirement applies whether or not youinstalled using theSetup BoKS Installation task or theInstall BoKStask. Tivoli/Plus for BoKS provides a special task,Register NewHosts, to simplify this step.

To register the new BoKS clients and slave servers with the BoKSmaster server host:

1. Create a host keys file on the master server host. This file containsthe host name, host key, and optionally an IP address for each ofthe BoKS machines. Each BoKS machine has a single-line,space-separated entry in this file as follows:

Hosta HostKeya IPAddressa

Hostb HostKeyb IPAddressb

Hostc HostKeyc IPAddressc

Note: You may have already created a host keys file containingentries for the BoKS machines when you completed theSetup BoKS Installation or Install BoKS task. In thiscase, simply copy the host keys file to the master serverhost.

Page 55: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Post Installation Tasks

Tivoli/Plus for BoKS User’s Guide 2–23

Softw

are Distribution and

Installation for BoK

S

2. Double-click on theRegister New Hosts icon to display theRegister New Hosts window.

3. Enter the path to the host keys file on the master server host in theBoKS Host Keys File Path on Master Server field.

Page 56: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Post Installation Tasks

2–24 Version 1.0

Page 57: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide 3–1

Resource M

onitoring

Resource Monitoring

Tivoli/Plus for BoKS provides the ability to monitor critical resourceswith Tivoli/Sentry. The Sentry monitors are predefined to enable youto manage aspects of the operating system and other resources, such asprocesses, free space, bandwidth, or the BoKS daemons, that arecrucial to the continued availability of the BoKS application. Thesemonitors allow you to quickly identify and respond to potentialproblems so that system down time is avoided.

3

Page 58: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Using Tivoli/Plus for BoKS Monitors

3–2 Version 1.0

Using Tivoli/Plus for BoKS MonitorsTivoli/Plus for BoKS comes with four types of monitors: master server,slave server, client, and node connectivity.

Before the Tivoli/Plus for BoKS monitors are operational, they must bedistributed to their subscription lists. To distribute a monitor, simplyselect theDistribute... option from the monitor’s pop-up menu andthen click on theDistribute Now button.

Function Icon

These monitors check the status ofBoKS daemons, BoKS directoryfree space, licenses, networkcollisions/packet and so forth on theBoKS master server machines.

These monitors check the status ofBoKS daemons, BoKS directoryfree space, networkcollisions/packet and so forth on theBoKS slave server machines.

These monitors check the status ofBoKS daemons and networkcollisions/packet on the BoKSclient machines.

These monitors check the status ofthe BoKS host from the Tivoliserver.

Page 59: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Using Tivoli/Plus for BoKS Monitors

Tivoli/Plus for BoKS User’s Guide 3–3

Resource M

onitoring

The monitors are ready to be distributed after installation. TheNodeConnectivity Monitors are distributed to the Tivoli server. TheBoKSMaster Server Monitors are distributed to theBoKS Master ServerList. TheBoKS Slave Server Monitors are distributed to theBoKSSlave Server List. TheBoKS Client Monitors are distributed to theBoKS Client List.

The default subscription list can be viewed or changed by using theSubscribers... option from the monitor’s pop-up menu.

Although the Tivoli/Plus for BoKS monitors come already defined tomonitor resources specific to BoKS, you can add monitors from theTivoli/Sentry collection or delete monitors as you wish. You can alsoedit existing monitors to perform actions under different conditions.

Page 60: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Using Tivoli/Plus for BoKS Monitors

3–4 Version 1.0

Selecting the options on a BoKS monitor’s pop-up menu displays theusual Tivoli/Sentry windows. Refer to the Tivoli/Sentry documentationfor more detailed information on using these windows.

Displays the Sentry Profile Propertieswindow, which includes functions foradding, deleting, and editing monitors.

Displays the Distribute Profiles window fordistributing monitors to those managednodes (machines) and profiles included onthe monitor’s subscription list.

Displays the Subscribers window forspecifying to which subscription list themonitor is distributed.

Page 61: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Viewing the Status of Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–5

Resource M

onitoring

Viewing the Status of Monitored ResourcesUse theBoKS Sentry Indicators icon to view the status of themonitored resources.

The thermometer on theBoKS Sentry Indicators icon rises as thestatus of a monitored resource becomes more urgent. In the example,theBoKS Client Monitors has received a “critical” status from one ofits monitored resources.

Open one of the BoKS monitors icons to view the status of theassociated set of BoKS nodes. For each monitored resource, themonitor only reports the most urgent status received within a recenttime frame. The monitor reports are organized so that the most urgentstatus level appears at the top of the report.

For more information on viewing the status of a monitored resourceand on the Tivoli/Sentry indicator collection, refer to the Tivoli/Sentrydocumentation.

Page 62: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–6 Version 1.0

Monitored ResourcesThe following table indicates the network resources that Tivoli/Plus forBoKS monitors.

Monitored ResourceDescribedon Page

Monitor Icon

Host Status 3-7

boks_master Daemon 3-8

boks_servc Daemon 3-9

boks_clntd Daemon 3-11

boks_drainmastDaemon 3-12

BoKS Directory Free Space 3-13

BoKS Node Licenses 3-14

BoKS User Licenses 3-15

Integrity Check Warnings 3-16

Network Bandwidth 3-17

boks_servm Daemon 3-10

boks_servc Daemon 3-9

boks_clntdDaemon 3-11

BoKS Directory Free Space 3-13

Network Bandwidth 3-17

boks_clntdDaemon 3-11

Network Bandwidth 3-17

Page 63: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–7

Resource M

onitoring

Host StatusTheHost Status monitoring source monitors whether the status of ahost is up or down. This monitor checks the status of any host or otherresource on the network that can respond to aping request. Thismonitor checks specifically to see whether the targeted hosts are up ordown. This monitor checks the host status every 15 minutes.

The following table lists the pre-configured actions for this monitoringsource:

Monitors that are defined with this monitoring source use statusoperators to evaluate data. Refer to the Tivoli/Sentry documentationfor information on using theEdit Sentry Monitor window to displaya list of the available operators.

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Severe Never None

Warning Never None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 64: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–8 Version 1.0

boks_master Daemon StatusTheboks_master Daemon Status monitoring source monitorswhether theboks_masterdaemon is up and running. This monitor runsevery minute.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A None

Warning N/A None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 65: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–9

Resource M

onitoring

boks_servc Daemon StatusTheboks_servc Daemon Status monitoring source monitors whethertheboks_servcdaemon is up and running. This monitor runs everyminute.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A None

Warning N/A None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 66: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–10 Version 1.0

boks_servm Daemon StatusTheboks_servm Daemon Status monitoring source monitors whethertheboks_servmdaemon is up and running. This monitor runs everyminute.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A None

Warning N/A None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 67: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–11

Resource M

onitoring

boks_clntd Daemon StatusThe boks_clntd Daemon Status monitoring source monitors whethertheboks_clntddaemon is up and running. This monitor runs everyminute.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Warning N/A None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 68: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–12 Version 1.0

boks_drainmast Daemon StatusThe boks_drainmast Daemon Status monitoring source monitorswhether theboks_drainmastdaemon is up and running. This monitorruns every minute.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Becomes unavailable Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A None

Warning N/A None

Reset Becomes available Send event.

Normal N/A None

Always N/A None

Page 69: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–13

Resource M

onitoring

BoKS Directory Free SpaceTheBoKS Directory Free Space monitoring source monitors theamount of free disk space in the file system containing the BoKS datafiles (BOKS_DIR). This monitor runs every 15 minutes.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Less than 2MB Send event to theTivoli/Enterprise Console.

Change icon.

Severe Less than 4MB Send event. Change icon.

Warning Less than 6MB Send event. Change icon.

Reset Greater than 6MB Send event.

Normal N/A N/A

Always N/A N/A

Page 70: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–14 Version 1.0

BoKS Node LicensesTheBoKS Node Licenses monitoring source monitors the number ofavailable BokS node (or client) licenses. This monitor runs once a day.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Less than 2 licensesremaining

Send event to theTivoli/Enterprise Console.

Change icon. Send mail.

Severe N/A N/A

Warning Less than 10 licensesremaining

Send event. Change icon.

Reset Greater than 10licenses

Send event.

Normal N/A N/A

Always N/A N/A

Page 71: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–15

Resource M

onitoring

BoKS User LicensesTheBoKS User Licenses monitoring source monitors the number ofavailable BokS user licenses. This monitor runs once a day.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Less than 2 licensesremaining

Send event to theTivoli/Enterprise Console.

Change icon. Send mail.

Severe N/A N/A

Warning Less than 10 licensesremaining

Send event. Change icon.

Reset Greater than 10licenses

Send event.

Normal N/A N/A

Always N/A N/A

Page 72: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–16 Version 1.0

Integrity Check WarningsThe Integrity Check Warnings monitoring source monitors newintegrity check warnings from COPS generated reports. The defaultsettings specify to monitor all host reports for new level 0 warnings.The monitor arguments may be changed, however, to specify a subsetof hosts or a larger set of warning levels. This monitor runs every 12hours.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Increase by 1 warning Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A N/A

Warning N/A N/A

Reset Equals 0 warnings Send event.

Normal N/A N/A

Always N/A N/A

Page 73: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

Tivoli/Plus for BoKS User’s Guide 3–17

Resource M

onitoring

Network BandwidthThe Network Bandwidth monitoring source monitors the number ofnetwork collisions per packet on a machine. This monitor runs every15 minutes.

The following table lists the pre-configured actions for this monitoringsource:

Severity Trigger When Default Actions

Critical Increases above 85% Send event to theTivoli/Enterprise Console.

Change icon.

Severe N/A N/A

Warning N/A N/A

Reset Decreases below 85% Send event.

Normal N/A N/A

Always N/A N/A

Page 74: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Monitored Resources

3–18 Version 1.0

Page 75: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide 4–1

Enterprise E

ventM

anagement

Enterprise Event Management

With the Tivoli/Enterprise Console, Tivoli/Plus for BoKS provides aset of filters for identifying events and a set of predefined correlationrules to automate the task of responding to specific events. An event isany significant change in the state of system resources or anapplication. In the case of Tivoli/Plus for BoKS, an event is a changein a monitored resource that affects BoKS or the system on whichBoKS is running. Examples of events are the starting and stopping ofa process, failed login attempts, or a host becoming unavailable.

Event management provides a predefined or automated response tospecific events, so that potential problems are identified and respondedto before causing system down time. For example, if a process fails,the Tivoli/Enterprise Console can automatically rerun the process. TheTivoli/Enterprise Console can also notify the system administrator ofrepeated process failures that may indicate a more severe problem withan application or the network. For some events, there is no automatedresponse except to be displayed in the Tivoli/Enterprise Console.

4

Page 76: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Configuration Activity

4–2 Version 1.0

Configuration ActivityThe following describes the configuration activity that occurs whensetting up the Tivoli/Enterprise Console to be used with Tivoli/Plus forBoKS. This activity takes place on the Tivoli/Enterprise Console andon the BoKS master servers. Tivoli/Plus for BoKS performs most ofthe setup activity for you.

■ Tivoli/Enterprise Console Server.Using theSetup EventServer for BoKS task, theTivoli/Enterprise Console is set up to

• Recognize and accept BoKS events.

• Respond to BoKS events according to the predefined rules.

• Notify the system administrator of the events received and theaction taken.

■ BoKS Master Server(s).Using theConfigure BoKS LogFile Adapter task accomplishesthe following configuration activity:

• BoKS is configured to send BoKS events to theTivoli/Enterprise Console.

• The log file adapter is configured to recognize and forwardBoKS events to the Tivoli/Enterprise Console.

Page 77: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Setting Up the Tivoli/Enterprise Console

Tivoli/Plus for BoKS User’s Guide 4–3

Enterprise E

ventM

anagement

Setting Up the Tivoli/Enterprise ConsoleUse the procedures in this section to set up the Tivoli/EnterpriseConsole to receive Tivoli/Plus for BoKS events. After completing thesetup procedure for the Tivoli/Enterprise Console, you need tocomplete the procedure under “Setting Up the Tivoli Logfile Adapter”on page 4-6.

To set up the Tivoli/Enterprise Console, select theRun job... option oftheSetup EventServer for BoKSicon’s pop-up menu. This actiondisplays theSetup EventServer for BoKSwindow.

Once you have displayed theSetup EventServer for BoKSwindow,there are two options for setting up the Tivoli/Enterprise Console:creating a new rule base or adding the Tivoli/Plus for BoKS specificrules to an existing rule base.

Page 78: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Setting Up the Tivoli/Enterprise Console

4–4 Version 1.0

Creating A New Rule Base1. Click on theCreate New Rule Base button. This action displays

additional fields.

2. Enter the name of the rule base you want to create in theNewRule Base name field.

Note: It is not advisable to modify theDefault rule base; so donot enterDefault.

3. New rule bases are created by copying (cloning) and modifyingan existing rule base. Enter the name of the rule base to be copiedin theRule Base to clonefield.

4. Specify the path name to the directory on the Tivoli/EnterpriseConsole server in which you want to create the new rule base inthePath for new Rule Basefield.

Note: The user id associated with the TME administrator musthave write access to the specified path.

5. (Optional) Use the optionalName of Event Console to configurefield to display BoKS related events on a particular systemadministrator’s event console. To make this assignment, enter the

Page 79: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Setting Up the Tivoli/Enterprise Console

Tivoli/Plus for BoKS User’s Guide 4–5

Enterprise E

ventM

anagement

name that appears under the desired system administrator’s eventconsole icon.

6. Press theSet and Close button when finished.

Adding To An Existing Rule Base1. Click on theAdd to Existing Rule Base button. This action

displays theExisting Rule Base name field.

2. Enter the name of an existing rule base that you want to modifyto contain the BoKS event classes and rules in theExisting RuleBase namefield.

3. (Optional) Use the optionalName of Event Console toconfigurefield to display BoKS related events on a particularsystem administrator’s event console. To make this assignment,enter the name that appears under the desired systemadministrator’s event console icon.

4. Press theSet and Close button when finished.

Page 80: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Setting Up the Tivoli Logfile Adapter

4–6 Version 1.0

Setting Up the Tivoli Logfile AdapterTheConfigure BoKS LogFile Adapter task configures the logfileadapter on the BoKS master servers and stops and restarts the logfileadapter daemon. This task also sets up BoKS to restart the logfileadapter daemon whenever a new BoKS log is started. Once configured,subsequent job executions simply stop and restart the logfile adapterdaemon.

To run this task, simply select theRun Job... option from theConfigure BoKS Logfile Adapter icon’s pop-up menu.

Events and RulesTivoli/Plus for BoKS configures the Tivoli/Enterprise Console toreceive events from BoKS and Tivoli/Sentry. The Tivoli/EnterpriseConsole classifies the events and then matches them against the rulebase to see if the event has a predefined rule (automated response).

BoKS EventsThe following table describes the Tivoli/Plus for BoKS events andrules. The table is organized according to the message that theTivoli/Enterprise Console sends to the system administrator for eachBoKS event. The percent sign (%s) in the messages indicates avariable. The definition for each variable follows the message.

Note: TheNotify Administrator action checks if a deliverableaddress calledBoKSAdminexists and sends mail to thataddress. If the address is not deliverable, the default action isto send mail toroot.

Page 81: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–7

Enterprise E

ventM

anagement

.

BoKS Log File Event Messages

User Access (login, etc.)

“Failed login attempt (rlogin) from %s@%s to %s@%s” (from_user,from_host, username, hostname)

Event Description:

Event Class:

Event Severity:

Failed rlogin attempt.

BoKS_rlogin_failed

WARNING

“Failed login attempt (%s) from %s to %s@%s” (access_method,from_host, username, hostname)

Event Description:

Event Class:

Event Severity:

Failed telnet login attempt.

BoKS_netlogin_failed

WARNING

“Failed login attempt (local) to %s@%s” (username, hostname)

Event Description:

Event Class:

Event Severity:

Failed local login attempt.

BoKS_login_failed

WARNING

“Bad login”

Event Description:

Event Class:

Event Severity:

Failed login attempt.

BoKS_login_bad

WARNING

“Too many failed login retries”

Event Description:

Event Class:

Event Severity:

Too many failed login retries.

BoKS_exceeded

MINOR

Page 82: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–8 Version 1.0

“Failed XDM Login attempt (user: %s)” (username)

Event Description:

Event Class:

Event Severity:

Failed XDM Login attempt.

BoKS_xdm_bad

WARNING

“Failed FTP Login attempt (user: %s)” (username)

Event Description:

Event Class:

Event Severity:

Failed FTP Login attempt.

BoKS_ftp_bad

WARNING

“Failed FTP Login attempt to %s from host %s” (username, from_host)

Event Description:

Event Class:

Event Severity:

Failed FTP Login attempt.

BoKS_ftp_bad2

WARNING

“Anonymous FTP Login: ‘%s’” (from_user)

Event Description:

Event Class:

Event Severity:

Anonymous FTP Login.

BoKS_ftp_guest

WARNING

“Anonymous FTP Login from %s: ‘%s’” (from_host, from_user)

Event Description:

Event Class:

Event Severity:

Anonymous FTP Login.

BoKS_ftp_guest2

WARNING

“Too many retries by %s on %s” (user, loc)

Event Description:

Event Class:

Event Severity:

Too many failed XDL login attempts.

BoKS_xdl_wait

MINOR

BoKS Log File Event Messages

Page 83: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–9

Enterprise E

ventM

anagement

“Login %s@%s on %s” (username, hostname, tty)

Event Description:

Event Class:

Event Severity:

Successful login.

BoKS_login_ok

HARMLESS

“Unsuccessful su from %s to %s” (from_user, to_user)

Event Description:

Event Class:

Event Severity:

Unsuccessful su.

BoKS_su_bad

MINOR

“Successful su on BoKS Master from %s to %s” (from_user, to_user)

Event Description:

Event Class:

Event Severity:

Successful su on BoKS Master.

BoKS_Master_su

WARNING

“Successful su to root on NIS Master from %s” (from_user)

Event Description:

Event Class:

Event Severity:

Successful su on NIS Master.

BoKS_NIS_Master_root_su

WARNING

User Modifications

“Added access path: ‘%s’ for user %s” (access, user)

Event Description:

Event Class:

Event Severity:

Added access path.

BoKS_added_acc_path

WARNING

“Policy change using ‘*’ in access route for user %s: %s*%s” (to_user,ar1, ar2)

Event Description:

Event Class:

Event Severity:

Policy change using ‘*’ in access route.

BoKS_Acc_Route_Wildcard

MINOR

BoKS Log File Event Messages

Page 84: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–10 Version 1.0

“Policy change opening SU access route for user %s: SU:%s” (to_user,ar)

Event Description:

Event Class:

Event Severity:

Policy change opening SU access route.

BoKS_Acc_Route_SU

WARNING

“User %s created” (user)

Event Description:

Event Class:

Event Severity:

User created.

BoKS_created_user

WARNING

“Added terminal access: %s for user %s” (access, user)

Event Description:

Event Class:

Event Severity:

Added terminal access.

BoKS_added_term

WARNING

Password Changes/Auth.

“System password changed”

Event Description:

Event Class:

Event Severity:

System password changed.

BoKS_changed_syspsw

MINOR

“Password changed”

Event Description:

Event Class:

Event Severity:

Password changed.

BoKS_chpsw_own

WARNING

“Password changed for user %s” (user)

Event Description:

Event Class:

Event Severity:

Password changed for user.

BoKS_chpsw_other

WARNING

BoKS Log File Event Messages

Page 85: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–11

Enterprise E

ventM

anagement

“Forcing password change for user %s” (user)

Event Description:

Event Class:

Event Severity:

Forcing password change.

BoKS_chpsw_force

MINOR

“Failed authentication! %s,%s (%s)” (arg1, arg2, arg3)

Event Description:

Event Class:

Event Severity:

Failed authentication.

BoKS_auth_fail

MINOR

Shared Memory

“Low on shared memory. Performing garbage collection”

Event Description:

Event Class:

Event Severity:

Low on shared memory.

BoKS_shm_low

WARNING

“FATAL ERROR: Out of shared memory”

Event Description:

Event Class:

Event Severity:

FATAL ERROR: Out of shared memory.

BoKS_shm_outof

CRITICAL

“Shared memory low: %s percent remaining” (shm_remain)

Event Description:

Event Class:

Event Severity:

Shared memory low.

BoKS_shm_warn

MINOR

BoKS Log File Event Messages

Page 86: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–12 Version 1.0

COPS

“COPS integrity checker has detected a change: %s new securitywarnings” (new_warnings)

Event Description:

Event Class:

Event Severity:

COPS has reported new security warnings.

BoKS_cops_diff

WARNING

“Starting cops”

Event Description:

Event Class:

Event Severity:

Starting cops.

BoKS_cops_running

HARMLESS

“Finishing cops”

Event Description:

Event Class:

Event Severity:

Finishing cops.

BoKS_cops_finish

HARMLESS

File Monitoring

“chdir() to %s failed” (dir)

Event Description:

Event Class:

Event Severity:

chdir() failed.

BoKS_filmon_badchdir

MINOR

“File %s has been removed” (file)

Event Description:

Event Class:

Event Severity:

Monitored file has been removed.

BoKS_filmon_deleted

MINOR

BoKS Log File Event Messages

Page 87: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–13

Enterprise E

ventM

anagement

“File %s is missing” (file)

Event Description:

Event Class:

Event Severity:

Monitored file is missing.

BoKS_filmon_missing

MINOR

“Found new file %s” (file)

Event Description:

Event Class:

Event Severity:

Found new file.

BoKS_filmon_newfile

MINOR

“File %s has been changed” (file)

Event Description:

Event Class:

Event Severity:

Monitored file has been changed.

BoKS_filmon_checksum

MINOR

“Owner has changed on file %s (%s->%s)” (file, olduid, newuid)

Event Description:

Event Class:

Event Severity:

Owner has changed on monitored file.

BoKS_filmon_newowner

MINOR

“File mode has changed for file %s (%s->%s)” (file, oldmode, newmode)

Event Description:

Event Class:

Event Severity:

File mode has changed for monitored file.

BoKS_filmon_newmode

MINOR

“File group has changed for file %s (%s->%s)” (file, oldgid, newgid)

Event Description:

Event Class:

Event Severity:

File group has changed for monitored file.

BoKS_filmon_newgroup

MINOR

BoKS Log File Event Messages

Page 88: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–14 Version 1.0

“Inode-number has changed for file: %s (%s->%s)” (file, oldinum,newinum)

Event Description:

Event Class:

Event Severity:

Inode-number has changed for monitored file.

BoKS_filmon_newino

MINOR

“ACL-permissions have changed for file: %s” (file)

Event Description:

Event Class:

Event Severity:

ACL-perms have changed for monitored file.

BoKS_filmon_newacl

MINOR

Log Failures

“Write to logfile %s failed, filesystem probably full (errno %s)” (logfile,errno)

Event Description:

Event Class:

Event Severity:

Write to logfile failed.

BoKS_log_full

MINOR

“Log critical size exceeded, and cannot move log to backup area. Loggingturned off.”

Event Description:

Event Class:

Event Severity:

Log critical size exceeded, and backup failed.

BoKS_log_crit

MINOR

“Log size exceeded, and cannot move log to backup area”

Event Description:

Event Class:

Event Severity:

Log size exceeded, and backup failed.

BoKS_log_size

CRITICAL

BoKS Log File Event Messages

Page 89: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–15

Enterprise E

ventM

anagement

“Log messages lost: %s (%s alarms, %s others)” (lost, alarms, others)

Event Description:

Event Class:

Event Severity:

Log messages lost.

BoKS_log_lost

CRITICAL

“A logfile with bad format existed and was moved to %s” (file)

Event Description:

Event Class:

Event Severity:

Logfile with bad format existed and was moved.

BoKS_log_oldbad

CRITICAL

“Could not open log %s, using %s” (log, alt)

Event Description:

Event Class:

Event Severity:

Could not open log, using alternate.

BoKS_log_alt

CRITICAL

BoKS Log File Event Messages

Page 90: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–16 Version 1.0

Sentry EventsThe following table describes the events and rules that Tivoli/Sentrymay use when monitoring BoKS resources. The table is organizedaccording to the Tivoli/Sentry monitor that sends the event to theTivoli/Enterprise Console.

Since Tivoli/Sentry messages follow a standard format, these regularmessages are not reproduced in the table. The following is an exampleof a Tivoli/Sentry message:

Sentry Maestro Remote Monitors/Daemon status on host noonanMon Oct 02 08:00:00 1995

Status: >>> critical <<<

Daemon status (jobman) Changes to down(Previous: up Current: down Effective: down)Daemon: jobman

However, a number of the Tivoli/Sentry event messages are actuallyreplaced with more straightforward messages by Tivoli/Plus for BoKSevent rules. These are indicated with quoted strings in the table below.

Tivoli/Sentry Event Messages

Host Status

Host Status

Event Description:

Event Class:

Event Severity:

BoKS host becomes unavailable.

Sentry2_0_host

CRITICAL

Host Status

Event Description:

Event Class:

Event Severity:

Correlation Activity:

BoKS host becomes available.

Sentry2_0_host

HARMLESS

Close related Sentry2_0_host down events andauto-acknowledge this event.

Page 91: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–17

Enterprise E

ventM

anagement

Daemon Status

“BoKS boks_master daemon process is down”

Event Description:

Event Class:

Event Severity:

boks_master becomes unavailable.

Sentry2_0_daemon.

CRITICAL.

“BoKS boks_master daemon process is up”

Event Description:

Event Class:

Event Severity:

Correlation Activity:

boks_master becomes available.

Sentry2_0_daemon.

HARMLESS.

Close related Sentry2_0_daemon down eventsand auto-acknowledge this event.

“BoKS boks_servm daemon process is down”

Event Description:

Event Class:

Event Severity:

boks_servm becomes unavailable.

Sentry2_0_daemon.

CRITICAL.

“BoKS boks_servm daemon process is up”

Event Description:

Event Class:

Event Severity:

Correlation Activity:

boks_servm becomes available.

Sentry2_0_daemon.

HARMLESS.

Close related Sentry2_0_daemon down eventsand auto-acknowledge this event.

“BoKS boks_servc daemon process is down”

Event Description:

Event Class:

Event Severity:

boks_servc becomes unavailable.

Sentry2_0_daemon.

CRITICAL.

Tivoli/Sentry Event Messages

Page 92: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–18 Version 1.0

“BoKS boks_servc daemon process is up”

Event Description:

Event Class:

Event Severity:

Correlation Activity:

boks_servc becomes available.

Sentry2_0_daemon.

HARMLESS.

Close related Sentry2_0_daemon down eventsand auto-acknowledge this event.

“BoKS boks_clntd daemon process is down”

Event Description:

Event Class:

Event Severity:

boks_clntd becomes unavailable.

Sentry2_0_daemon.

CRITICAL.

“BoKS boks_clntd daemon process is up”

Event Description:

Event Class:

Event Severity:

Correlation Activity:

boks_clntd becomes available.

Sentry2_0_daemon.

HARMLESS.

Close related Sentry2_0_daemon down eventsand auto-acknowledge this event.

“BoKS boks_drainmast daemon process is down”

Event Description:

Event Class:

Event Severity:

boks_drainmast becomes unavailable.

Sentry2_0_daemon.

CRITICAL.

“BoKS boks_drainmast daemon process is up”

Event Description:

Event Class:

Event Severity:

Correlation Activity:

boks_drainmast becomes available.

Sentry2_0_daemon.

HARMLESS.

Close related Sentry2_0_daemon down eventsand auto-acknowledge this event.

Tivoli/Sentry Event Messages

Page 93: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–19

Enterprise E

ventM

anagement

BoKS Directory FreeSpace

“BoKS directory avail.space is %s MBytes” (BoKS_data_filesystem_size)

Event Description:

Event Class:

Event Severity:

Available space in the file system where theBoKS data directory resides decreases below 2MBytes on a host.

BoKS_LogFilesystemSize

CRITICAL

“BoKS directory avail.space is %s MBytes” (BoKS_data_filesystem_size)

Event Description:

Event Class:

Event Severity:

Available space in the file system where theBoKS data directory resides decreases below 4MBytes on a host.

BoKS_LogFilesystemSize

SEVERE

“BoKS directory avail.space is %s MBytes” (BoKS_data_filesystem_size)

Event Description:

Event Class:

Event Severity:

Available space in the file system where theBoKS data directory resides decreases below 6MBytes on a host.

BoKS_LogFilesystemSize

WARNING

“BoKS directory avail.space is %s MBytes” (BoKS_data_filesystem_size)

Event Description:

Event Class:

Event Severity:

Correlation Activity:

Available space in the file system where theBoKS data directory resides increases beyond 6MBytes on a host

BoKS_LogFilesystemSize

HARMLESS

Close related BoKS_LogFilesystemSize eventsand auto-acknowledge this event.

Tivoli/Sentry Event Messages

Page 94: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–20 Version 1.0

BoKS Licenses

“Remaining BoKS node licenses: %s” (BoKS_node_license_cnt)

Event Description:

Event Class:

Event Severity:

Number of available BoKS node licensesdecreases below 2.

BoKS_Licenses

CRITICAL

“Remaining BoKS node licenses: %s” (BoKS_node_license_cnt)

Event Description:

Event Class:

Event Severity:

Number of available BoKS node licensesdecreases below 10.

BoKS_Licenses

WARNING

“Remaining BoKS node licenses: %s” (BoKS_node_license_cnt)

Event Description:

Event Class:

Event Severity:

Correlation Activity:

Number of available BoKS node licensesincreases above 10.

BoKS_Licenses

HARMLESS

Close related BoKS_Licenses events andauto-acknowledge this event.

“Remaining BoKS user licenses: %s” (BoKS_user_license_cnt)

Event Description:

Event Class:

Event Severity:

Number of available BoKS user licensesdecreases below 2.

BoKS_Licenses

CRITICAL

“Remaining BoKS user licenses: %s” (BoKS_user_license_cnt)

Event Description:

Event Class:

Event Severity:

Number of available BoKS user licensesdecreases below 10.

BoKS_Licenses

WARNING

Tivoli/Sentry Event Messages

Page 95: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–21

Enterprise E

ventM

anagement

“Remaining BoKS user licenses: %s” (BoKS_user_license_cnt)

Event Description:

Event Class:

Event Severity:

Correlation Activity:

Number of available BoKS user licensesincreases above 10.

BoKS_Licenses

HARMLESS

Close related BoKS_Licenses events andauto-acknowledge this event.

COPS Warnings

“BoKS integrity check report warning cnt: %s” (COPS_warning_cnt)

Event Description:

Event Class:

Event Severity:

Number of new COPS-reported level 0 (default)warnings increases by 1 warning.

BoKS_CopsWarnings

CRITICAL

“BoKS integrity check report warning cnt: %s” (COPS_warning_cnt)

Event Description:

Event Class:

Event Severity:

Correlation Activity:

Number of new COPS-reported level 0 (default)warnings drops to 0 warnings.

BoKS_CopsWarnings

HARMLESS

Close related BoKS_CopsWarnings events andauto-acknowledge this event.

Network Bandwidth

Network Collisions/Packet

Event Description:

Event Class:

Event Severity:

Network collisions/packet increases above 85%on a host.

Sentry2_0_netcollpct

CRITICAL

Tivoli/Sentry Event Messages

Page 96: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–22 Version 1.0

Network Collisions/Packet

Event Description:

Event Class:

Event Severity:

Correlation Activity:

Network collisions/packet decreases below85% on a host.

Sentry2_0_netcollpct

HARMLESS

Close related Sentry2_0_netcollpct events andauto-acknowledge this event.

Tivoli/Sentry Event Messages

Page 97: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

Tivoli/Plus for BoKS User’s Guide 4–23

Enterprise E

ventM

anagement

Automated Actions From Event Correlation RulesTivoli/Plus for BoKS provides event correlation for multiple events ofthe same type or for events of different types. The Tivoli/EnterpriseConsole uses event correlation rules to determine if a number ofseparate events are related to each other. The event correlation rulesdetermine how the Tivoli/Enterprise Console responds to a specificcombination of events and what information the Tivoli/EnterpriseConsole displays on the event consoles.

The following table describes the event correlation rules andcorresponding actions provided by Tivoli/Plus for BoKS.

Tivoli/Plus for BoKS Event Correlation Rules

Condition 1 Condition 2 AutomatedActions

A user becomesblocked due toexcessive passwordfailures.

This event occurstwice in any 24 hourperiod.

SendMax loginfailures mail alert toBoKSAdmin.

Any failed userattempt to getrootaccess.

This event occurstwice in any 24 hourperiod.

SendRoot break-inattempt mail alert toBoKSAdmin.

A user has an activelocal login session onone system.

The same user has anactive local loginsession on anothersystem.

SendMultiple activeuser login sessionsmail alert toBoKSAdmin.

Network bandwidth islow on a system(netcolls/packet isgreater than 85%).

COPS is running onsame system.

SendCOPS runningwhile networkbandwidth is low mailalert to BoKSAdmin.

Low shared memorywarning (< 10%).

This event occurs atleast once per 24 hourperiod consecutivelyfor 5 days.

SendShared memorylow mail alert toBoKSAdmin.

Page 98: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Events and Rules

4–24 Version 1.0

Out of shared memory. This event occurs atleast once per 24 hourperiod consecutivelyfor 5 days.

SendOut of sharedmemorymail alert toBoKSAdmin.

Write to logfile failure. This event occurs atleast once per 24 hourperiod consecutivelyfor 5 days.

SendLogfile writeerror mail alertto BoKSAdmin.

Log size exceededand unable to move tobackup area.

This event occurs atleast once per 24 hourperiod consecutivelyfor 2 days.

SendLog sizeexceededmail alertto BoKSAdmin.

Log messages lost. This event occurs atleast once per 24 hourperiod consecutivelyfor 2 days.

SendLog messageslost mail alertto BoKSAdmin.

Bad format found inlogfile.

This event occurs atleast once per 24 hourperiod consecutivelyfor 2 days.

SendBad format inlogfile mail alertto BoKSAdmin.

Could not open logfile. This event occurs atleast once per 24 hourperiod consecutivelyfor 2 days.

SendCould not openlogfile mail alertto BoKSAdmin.

Tivoli/Plus for BoKS Event Correlation Rules

Condition 1 Condition 2 AutomatedActions

Page 99: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide 5–1

Tasks and Jobs for BoK

S

Tasks and Jobs for BoKS

Tivoli/Plus for BoKS provides a number of tasks that allow you to runBoKS jobs on multiple machines and operating systems. These tasksare ready to be executed as soon as you have installed your Tivoli/Plusfor BoKS module. Simply double-click on the task icon to execute theBoKS job. You can modify the default execution characteristics of aparticular job, such as where the output of a job is displayed and onwhich machines the job will run. You may also specify whether a jobruns serially on each machine, in parallel on all machines, or staged ingroups of machines.

5

Page 100: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS Jobs

5–2 Version 1.0

Tivoli/Plus for BoKS JobsThe majority of jobs are pre-configured to run on the correctsubscription list. The job’s subscription list can be modified byselecting theRun on selected subscribers... or Modify job... option ofthe task icon’s pop-up menu. Refer to “Modifying a BoKS Job” onpage 5-9 for information on modifying a job.

The following table lists the BoKS jobs and reports that can becustomized and executed with Tivoli/Plus for BoKS. Double-click onthe task icon to run the BoKS job. For specific information on usingthese jobs, refer to the BoKS documentation.

Tivoli/Plus for BoKS Jobs

Job Description Icon

Configures the Tivoli logfile adapter to monitorthe BoKS logfile and to generate related BoKSevents. This job also stops and restarts the Tivolilogfile adapter, as well as sets up BoKS torestart the Logfile Adapter daemonwhenever a new BoKS log is started.

Refer to Chapter 4, "Enterprise EventManagement" for more details.

Distributes the BoKS broadcast address file to thespecified hosts (or to allUNIXBOXHOSTmachines in the BoKS-domain, if unspecified).

Refer to the BoKS administration guide for moreinformation about the setup and use of abroadcast address file.

Page 101: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS Jobs

Tivoli/Plus for BoKS User’s Guide 5–3

Tasks and Jobs for BoK

S

Configures and installs BoKS on a set of nodeswhich already contain the BoKS software (eitherthrough NFS mounts or some other means). Bydefault, the subscription list for this job is empty.Until you specify the subscribers, running thisjob has no effect. A job’s subscription list can bemodified by selecting theRun on selectedsubscribers... orModify job... option of the taskicon’s pop-up menu. Refer to “Modifying aBoKS Job” on page 5-9 for information onmodifying a job.

For detailed information on running theInstallBoKS job, refer to “Installing BoKS with theInstall BoKS Task” on page 2-18.

After theInstall BoKS job completes, run theRegister New Hosts job. This job is describedunder “Post Installation Tasks” on page 2-22.

Queries BoKS logs using a specified set ofcriteria. Refer to the online help for a descriptionof each parameter.

Registers hosts and host keys for newly installednodes with the master server. The host key fileyou specify can be the same one used wheninstalling BoKS.

Run this job after completing BoKS installationwith theInstall BoKS job or theDistribute/Install BoKS job.

For detailed information on running theRegisterNew Hosts job, refer to “Post Installation Tasks”on page 2-22.

Tivoli/Plus for BoKS Jobs

Page 102: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS Jobs

5–4 Version 1.0

Runs the BoKS Added Access Routes report.This report displays the set of access routes thathave been added for the users of the specifiedhost or host group. All added access routes aredisplayed if no host name is specified.

Runs the BoKS Failed Logins report. This reportdisplays the list of failed login attempts recordedin the BoKS logs in the past day.

Runs the BokS Full User Data report. By default,this report displays various attributes for everyuser in the BoKS database. The amount ofinformation may be limited by specifying a validuser name in the optionalUser field.

Runs the BoKS Global Warnings report. Thisreport displays a summary of the results of allpreviously run System Integrity Checks (COPSreports).

Runs the BoKS System Information report. Thisreport displays general information about theBoKS node.

Runs the BoKS System Integrity (COPS) report.This report displays the results obtained from themost recent COPS run for the specified host (orall hosts if no host name is specified).

Tivoli/Plus for BoKS Jobs

Page 103: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS Jobs

Tivoli/Plus for BoKS User’s Guide 5–5

Tasks and Jobs for BoK

S

Runs the BoKS User Information report. Thisreport displays general user information about theusers in the specified host or host group.Information on all users is displayed if no hostname is specified.

Runs the BoKS Logged In Users report. Thisreport displays information about the currentlogin sessions for the users on the specified hostor host group. Information on all hosts isdisplayed if no host name is specified.

Directs BoKS to restart its logs. The logfileadapter is also restarted if it has been previouslyconfigured.

Starts the BoKS System Integrity Check (COPS).This utility runs in the background on thespecified host(s) and produces a report file whichcan later be displayed or summarized.

Uninstalls BoKS. The BoKS software isnotremoved. In order to uninstallandremove theBoKS software, use the file removal option forthe Tivoli/Courier file package. (Refer to theTivoli/Courier documentation for moreinformation.) By default, the subscription list forthis job is empty. Until you specify thesubscribers, running this job has no effect. Ajob’s subscription list can be modified byselecting theRun on selected subscribers... orModify job... option of the task icon’s pop-upmenu. Refer to “Modifying a BoKS Job” onpage 5-9 for information on modifying a job.

Tivoli/Plus for BoKS Jobs

Page 104: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Running a BoKS Job

5–6 Version 1.0

Running a BoKS JobAll Tivoli/Plus for BoKS jobs can be run immediately afterinstallation. You can run these jobs from the desktop only.

To run a BoKS job with the default execution characteristics

If Tivoli/Plus for BoKS requires further information to execute the job,a pop-up window appears prompting you for the information. Onlinehelp is available to assist you in completing these dialogs.

—OR—Double-click onthe icon.

SelectRun job... from theicon’s pop-up menu.

Page 105: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Running a BoKS Job

Tivoli/Plus for BoKS User’s Guide 5–7

Tasks and Jobs for BoK

S

For example:

Where appropriate, apop-up window assists youin supplying additional in-formation.

Output is displayed in anoutput window.

Page 106: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Running a BoKS Job

5–8 Version 1.0

The job’s output is displayed in an output window. To save the job’soutput to a file:

1. Select theSave to File... button to display theSave Job Outputdialog box.

2. Enter the name of the machine on which to save the output file intheOn Host field.

3. Enter the name of the output file that will contain the job’s outputin theOutput File field.

4. Select theSave & Close button to save the output of the job to thefile you specified.

You can also use theModify job... option of the job icon’s pop-upmenu to specify that the output be sent to a file.

Page 107: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Modifying a BoKS Job

Tivoli/Plus for BoKS User’s Guide 5–9

Tasks and Jobs for BoK

S

Modifying a BoKS JobYou can modify the execution characteristics of a job for each time thejob is run or for one particular job only.

Use the following steps to modify a job for each time it is run:

1. Select theModify job... option from the task icon’s pop-up menu.

Be sure to specifyon which man-aged nodes andprofile managersthe job will run.

Page 108: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Modifying a BoKS Job

5–10 Version 1.0

2. Make the necessary changes in theEdit Job window. Online helpis available to assist you.

Note: Be sure to specify on which managed nodes and profilemanagers the job will run.

3. Click on theChange & Close button when finished.

Use the following steps to modify a job for only a single execution ofthe job. The next time you run the same job, it will return to the defaultexecution characteristics.

1. Select theRun on selected subscribers... option from the taskicon’s pop-up menu.

Be sure to specifyon which managednodes and profilemanagers the jobwill be run thistime.

Page 109: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Modifying a BoKS Job

Tivoli/Plus for BoKS User’s Guide 5–11

Tasks and Jobs for BoK

S

2. Make the necessary changes in theExecute Task window. Onlinehelp is available to assist you.

3. Click on theExecute button when finished.

Page 110: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Modifying a BoKS Job

5–12 Version 1.0

Page 111: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide Index –1

Index

BBoKS

application launch 1-15directory free space monitor 3-13events 4-6jobs 5-2modifying jobs 5-9node licenses monitor 3-14running jobs 5-6user licenses monitor 3-15

boks_clntd daemon monitor 3-11boks_drainmast daemon monitor 3-12boks_master daemon monitor 3-8boks_servc daemon monitor 3-9boks_servm daemon monitor 3-10

Ccommand line installation 1-11configuring file packages 2-5COPS events 4-12Courier.See Tivoli/Courier

Ddesktop installation 1-4distributing software 2-1

Eevent management 4-1events 4-6

BoKS 4-6COPS 4-12file monitoring 4-12log failures 4-14password changes/auth. 4-10shared memory 4-11user access 4-7user modifications 4-9

Sentry 4-16

Ffile monitoring events 4-12file packages, configuring for Tivoli/Courier

2-5

Ggetting started 1-1

Hhost status monitor 3-7

Iicons

activating 1-11BoKS application 1-15for BoKS jobs 5-2monitors 3-2tasks 5-2Tivoli/Plus 1-11

installation requirements 1-2hardware 1-3license key 1-2software 1-2

Page 112: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Index –2 Version 1.0

installingBoKS 2-1Tivoli/Plus for BoKS

from the command line 1-11from the desktop 1-4requirements for 1-2

integrity check warnings monitor 3-16

Jjobs

introduction to 5-1list of 5-2modifying 5-9running 5-6saving output 5-8

Llaunching BoKS 1-15license key 1-2log failure events 4-14

Mmanaging events 4-1modifying BoKS jobs 5-9monitored resources

See also Tivoli/Sentry, monitoredresources 3-6

viewing 3-5monitoring resources 3-1monitors

BoKS directory free space 3-13BoKS node licenses 3-14BoKS user licenses 3-15boks_clntd daemon 3-11boks_drainmast daemon 3-12

boks_master daemon 3-8boks_servc daemon 3-9boks_servm daemon 3-10host status 3-7integrity check warnings 3-16network bandwidth 3-17

monitors, using 3-2

Nnetwork bandwidth monitor 3-17

Ppassword changes/auth. events 4-10problem report, TME xprocedures

configuring file packages 2-6configuring Tivoli/Courier file packages

2-5installing BoKS

on a single platform 2-16on all platforms 2-15

installing Tivoli/Plus for BoKScommand line 1-11desktop 1-4

modifying BoKS jobs 5-9registering new hosts 2-22running BoKS jobs 5-6saving ouput 5-8setting up the Tivoli/Enterprise Console

4-2starting a module 1-13starting BoKS 1-15viewing monitored resources 3-5

profile managers, in Tivoli/Plus 1-12

Page 113: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Tivoli/Plus for BoKS User’s Guide Index –3

Rrequirements

installing BoKS 2-2installing Tivoli/Plus for BoKS 1-2

resource monitoring 3-1rules 4-6running BoKS jobs 5-6

Ssaving output 5-8Sentry.SeeTivoli/Sentrysetting up

BoKS installation 2-1Tivoli/Courier file packages 2-1Tivoli/Enterprise Console 4-2

shared memory events 4-11software distribution 2-1software requirements 1-2starting

BoKS 1-15module 1-13

subscription list 1-12

Ttask 5-1Tivoli/Courier, configuring file packages

2-5Tivoli/Enterprise Console

setup 4-2Tivoli/Plus for BoKS

installation 1-1license key 1-2task library 5-1unique features 1-12

Tivoli/Plus modulesicons 1-11

overview 1-11starting 1-13

Tivoli/Sentry 3-1events 4-16list of monitored resources 3-6resource monitoring 3-1using monitors 3-2viewing monitored resources 3-5

Tivoli/SentrySee also monitorsTME problem report x

Uuser access events 4-7user modifications events 4-9using monitors 3-2

Page 114: Tivoli/Plus for BoKS User’s Guidepublib.boulder.ibm.com/tividd/td/BKS/BoKS/en_US/PDF/BoKS.pdf · BoKS module to manage the operation of the BoKS security product. Readers of this

Index –4 Version 1.0