Technote (FAQ)
Question
For designing CMS Correlation rules you may need the ability to see the current tally in a state table. The button named as "View/Edit State Table" available in the State Table Definition Window has been greyed out in TSOM 4.1 and TSOM 4.1.1.
Answer
There is a button named as "View/Edit State Table" available in the State Table Definition Window which has been greyed out in TSOM 4.1 and TSOM 4.1.1 since this functionality is not present in the present version of TSOM.
The work around is to set the Rule Processor to output the state table information to TSOM log file. However, if the size of the state table is large, substantial performance degradation can occur.
Two Configuration changes must be made to the TSOM CMS in order to view the state tables in tsom_server.log file. Before making the changes, the CMS has to be stopped by executing "./tsom_server.sh stop" from the directory {TSOM Directory}/bin/
The following changes need to be done to the CMS:
- Edit the GenericStageStarter.config file present in the directory {TSOM Directory}/conf/ . Go to the Filter definition for the Rule Processor, uncomment the '-a' Filter Argument, and add a space and a value after '-a'. The value after 'a' is the interval to report the state table. For example, if you want the Rule Processor to print out state tables every 5 minutes, use <FilterArgument>-a 300</FilterArgument>
- Add the following lines to the bottom of the file 'log4j.properties': log4j.logger.com.micromuse.ns.rule.processor.MaintenanceTask=debug
After making the changes, start the CMS by executing "./tsom_server.sh start" from the directory {TSOM Directory}/bin/ and you will get the state table status in the tsom_server.log file which will be present in the directory {TSOM Directory}/logs/ .
Product Alias/Synonym
TSOM 4.1
TSOM 4.1.1
IBM Tivoli Security Operations Manager 4.1
IBM Tivoli Security Operations Manager 4.1.1
Tivoli Security Operations Manager 4.1
Tivoli Security Operations Manager 4.1.1
Rate this page:
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.