Configuring event forwarding using AEN

You can configure the Tivoli Netcool/OMNIbus ObjectServer to send events to a Message Bus gateway running in IBM Operations Analytics - Log Analysis (LA) mode by using the Accelerated Event Notification (AEN) system. The AEN system is generally used to accelerate events that could present a risk in the managed environment through ObjectServers in a tiered deployment or to the AEN pop-up client.

Overview

When running the gateway in LA mode, the AEN system is used to send each individual event that is received by the ObjectServer to IBM Operations Analytics - Log Analysis. In effect, this prevents the roll-up of multiple events into a single instance, which occurs as part of the normal IDUC system. For the purpose of analytics, IBM Operations Analytics - Log Analysis must see all event instances that occur in the environment. Although it is not required that you configure event forwarding using AEN when running in LA mode, it is recommended that you do so if you want to track changes in the log analysis tool.

For details about creating an AEN channel within Tivoli Netcool/OMNIbus, see the IBM Tivoli Netcool/OMNIbus Knowledge Center: https://www.ibm.com/support/knowledgecenter/SSSHTQ_int/omnibus/common/kc_welcome-444.html?lang=en

When running the gateway in LA mode, the gateway is configured for the acceptance of event inserts from either IDUC or AEN.

The steps that you follow to configure event forwarding using AEN depend on the following:

Which version of OMNIbus Insight Pack you are running with the gateway.
Which version of the ObjectServer (and, by extension, the version of Tivoli Netcool/OMNIbus) you are using.
Which version of Network Manager Insight Pack you are using.

Note: These versions only apply if you are running the gateway in LA mode and you are configuring event forwarding using AEN.

Table 1 provides a matrix to help you determine which steps to follow to configure event forwarding using AEN.

Table 1. Configuring event forwarding matrix
OMNIbus Insight Pack Version	ObjectServer Version	Network Manager Insight Pack Version	For configuration steps, see
Version 1.3.0, 1.3.0.0, 1.3.0.1	Version 8.1 (specifically, Tivoli Netcool/OMNIbus Version 8.1 Fix Pack 2)	Version 1.3.0, 1.3.0.0, 1.3.0.1	Configuring event forwarding - OMNIbus Insight Pack Versions 1.3.0, 1.3.0.0, and 1.3.0.1
Version 1.3.0.2	Version 8.1 (specifically, Tivoli Netcool/OMNIbus Version 8.1 Fix Pack 5 and higher)	Version 1.3.0.0	Configuring event forwarding - OMNIbus Insight Pack Version 1.3.0.2 and higher

Note: If the Network Manager Insight Pack is installed into your IBM Operations Analytics - Log Analysis and you are running Network Manager IP Edition, apply the $NCHOME/omnibus/extensions/scala_itnm_configuration.sql file to the ObjectServer. Note that the correct version of the scala_itnm_configuration.sql file is installed with the ObjectServer fix pack as listed in Table 1. The purpose of installing these fix packs is to defer sending events to IBM Operations Analytics - Log Analysis until these events have been enriched by Network Manager IP Edition.

Specifically, the Tivoli Netcool/OMNIbus fix packs identified in Table 1 provide updates to the AEN triggers, which delay sending an event to the ObjectServer until Network Manager can enrich these events. It is recommended that you install the ObjectServer fix pack as listed in Table 1 if the Network Manager Insight Pack is installed into your IBM Operations Analytics - Log Analysis. Thus, you will be able to use the end to end search functionality that the Network Manager Insight Pack provides to ensure that events in IBM Operations Analytics - Log Analysis have the required information to search on. You install the updates to the AEN triggers by running the following SQL file:

/space/mahes/IBM/tivoli/netcool/omnibus/extensions/
scala/scala_itnm_configuration.sql

For more information, see the http://www-01.ibm.com/support/knowledgecenter/SSTPTP_1.3.0/com.ibm.netcool_ops.doc_1.3.0/soc/topo_search/task/soc_ts_configuretoposearch.html.

Configuring event forwarding - OMNIbus Insight Pack Versions 1.3.0, 1.3.0.0, and 1.3.0.1

To configure the gateway for event forwarding using AEN, use the following steps:

Edit the G_SCALA.props file and add the property definition shown below:
Gate.Reader.Description : 'SCALA Gateway Reader'

This ensures that the gateway reader will now identify itself to the ObjectServer specifically as a Gateway Reader interfacing with IBM Operations Analytics - Log Analysis.
Edit the gateway table replication definition file:
$OMNIHOME/gates/xml/scala/xml.reader.tblref.def
Change the alerts.status replication line to:
```
	REPLICATE FT_INSERT FROM TABLE 'alerts.status'
		USING MAP 'StatusMap';
```
Create an AEN channel called scala using the Tivoli Netcool/OMNIbus Administration console.
1. On the Columns tab, add just the Serial column as the selected column list for the alerts.status table only.
2. On the Recipients tab, add a channel recipient that sets the Application Description to SCALA Gateway Reader. Leave all other elements blank.
Note: This step is not required if you are running Tivoli Netcool/OMNIbus version 8.1. By default, the triggers are installed into the ObjectServer in Tivoli Netcool/OMNIbus version 8.1 and are no longer in the $OMNIHOME/extensions/ directory.

Create and install the triggers in the ObjectServer. It is best to create a new trigger group called scala_triggers, so that triggers specific to the gateway running with IBM Operations Analytics - Log Analysis can be placed in this group and disabled and enabled as required.
The following code shows the two basic triggers that are needed to send all new inserts using the event fast track notifications to the gateway. You can create these using either nco_sql or the Netcool/OMNIbus Administration GUI.
```
create or replace trigger group scala_triggers;

create or replace trigger scala_insert
group scala_triggers
priority 2
comment 'Fast Track an event insert for alerts.status to SCALA Gateway'
after insert on alerts.status
for each row
begin
	iduc evtft 'scala', insert, new
end;

create or replace trigger scala_reinsert
group scala_triggers
priority 2
comment 'Fast Track an event insert for alerts.status to SCALA Gateway'
after reinsert on alerts.status
for each row
begin
	iduc evtft 'scala', insert, new

end;
```

The event can now be forwarded using an AEN channel.

Note: As an alternative, Steps 3 and 4 can be achieved by running the following SQL file:

$OMNIHOME/extensions/scala/scala_configuration.sql

Configuring event forwarding - OMNIbus Insight Pack Version 1.3.0.2 and higher

The Version 1.3.0.2 OMNIbus Insight Pack contains a new field PubType, which allows you to differentiate between inserts and updates. For this feature to work correctly, the scala_reinsert AEN trigger needs to be configured to send an update event rather than an insert event. The SCALA triggers have been updated in Tivoli Netcool/OMNIbus Version 8.1 Fix Pack 5 to work with OMNIbus Insight Pack Version 1.3.0.2. If you have an existing ObjectServer instance and are installing OMNIbus Insight Pack Version 1.3.0.2, you will need to run upgrade scripts provided in Tivoli Netcool/OMNIbus Version 8.1 Fix Pack 5 to modify the existing triggers where indicated in the instructions. If you are creating a new ObjectServer instance and have installed Tivoli Netcool/OMNIbus, it is recommended that you install OMNIbus Insight Pack Version 1.3.0.2.

Specifically, Tivoli Netcool/OMNIbus 8.1 Fix Pack 2 and above provide updates to the AEN triggers, which delay sending an event to the ObjectServer until Network Manager IP Edition can enrich these events. The triggers in Tivoli Netcool/OMNIbus 8.1 Fix Pack 2 and above are compatible with OMNIbus Insight Pack Version 1.3.0.0 and Version 1.3.0.2. The triggers in Tivoli Netcool/OMNIbus 8.1 Fix Pack 5 are compatible with OMNIbus Insight Pack Version 1.3.0.2.

It is recommended that you install the relevant Tivoli Netcool/OMNIbus Version 8.1 Fix Pack if the Network Manager Insight Pack is installed into your IBM Operations Analytics - Log Analysis. Thus, you will be able to use the end to end search functionality that the Network Manager Insight Pack provides to ensure that events in IBM Operations Analytics - Log Analysis have the required information to search on.

You install the updates to the AEN triggers by running the following SQL file:

$OMNIHOME/extensions/scala/scala_itnm_configuration.sql

To configure the gateway for event forwarding using AEN, use the following steps:

Edit the gateway table replication definition file:
$OMNIHOME/gates/xml/scala/xml.reader.tblref.def
Change the alerts.status replication line to:
```
REPLICATE FT_INSERT,FT_UPDATE FROM TABLE ’alerts.status’
		USING MAP 'StatusMap';
```
If you are not using the Network Manager Insight Pack, enable the scala_insert and scala_reinsert triggers in the scala_triggers group, which are provided by default.
Note: If your ObjectServer instance was created before the Tivoli Netcool/OMNIbus Version 8.1 Fix Pack 5 was applied, you will need to run the update scripts provided in $OMNIHOME/etc/ to update the default triggers to the latest level.
If you are using the Network Manager Insight Pack, install the updates to the AEN triggers by running the following SQL file:
```
$OMNIHOME/extensions/scala/scala_itnm_configuration.sql
```

Specify the following triggers using either nco_sql or the Netcool/OMNIbus Administration GUI:

create or replace trigger scala_reinsert group scala_triggers
priority 2 comment ’Fast Track an event insert for alerts.status to
SCALA Gateway’ after reinsert on alerts.status for each row begin
iduc evtft ’scala’, update, new end;

Changing the StatusMap in the xml1300.map file

When using AEN to send de-duplicated events you should modify the first field in the StatusMap defined in the xml.map, xml1300.map, or xml1302.map definition file. These map definition files reside in the following directory:

$OMNIHOME/gates/xml/scala

Note: You use the xml.map file if your gateway is running with Network Manager Insight Pack Version 1.3.0 and higher deployed against IBM Operations Analytics - Log Analysis. You use the xml1300.map file if your gateway is running with OMNIbus Insight Pack Version 1.3.0.0 and Version 1.3.0.1 and higher and Network Manager Insight Pack Version 1.3.0.0 and higher deployed against IBM Operations Analytics - Log Analysis. You use the xml1302.map file if your gateway is running with OMNIbus Insight Pack Version 1.3.0.2 and higher and Network Manager Insight Pack Version 1.3.0.0 and higher deployed against IBM Operations Analytics - Log Analysis.

Replace FirstOccurrence to LastOccurrence, as in the following example:

CREATE MAPPING StatusMap('FirstOccurrence'  =  '@FirstOccurrence',
                         'Summary'          =    '@Summary',
.
.
.

CREATE MAPPING StatusMap('LastOccurrence'  =  '@LastOccurrence',
                         'Summary'          =    '@Summary',
.
.
.

This change in field name means that IBM Operations Analytics - Log Analysis records the timestamp of each event that it receives as the time that event occurred, rather than when the first instance of that event occurred. This change in field name also ensures that deduplicated events have unique timestamps.