Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Postemsg and wpostemsg (TME) commands

Event instances can be sent from the command line, or from a script, using the postemsg (non-TME) or wpostemsg (TME) command.

Both commands have the same form. Here is the wpostemsg.

 wpostemsg [-S server][-f configuration_file][-m message][-r severity][attribute=value...] class source

For example,

  wpostemsg -m 'from us' disk=C: NT_Diskfull NT 

These commands are extremely helpful for testing.

The UNIX logfile and the Windows event adapters can be reconfigured to read from a log file and create events from that input. This provides an easy way to generate events in TEC.

Recall that adapters detect, format, and send event instances to the server. By reconfiguring the logfile adapter, a separate application detects an occurrence of interest and writes an entry into a logfile. The detection is not done by the logfile adapter. But once that entry has been made, the logfile adapter can be configured to read from it, format it with the guidance of a format file, and send it into TEC.

If there is need to monitor something for which an adapter does not exist, and writing to a logfile doesn't work for this application, then it is possible to write a custom adapter using the Event Integration Facility (EIF). The application programming interface consists of function calls written in the programming language C. Writing custom adapters is beyond the scope of this course.

The main functions of an event adapter are to detect, format, and send event instances to the server. The detection of events is application-specific. The formatting of events is done consistently with the BAROC definition. Sending events is controlled by configuration parameters. It is also possible to suppress events not deemed relevant to a given site.

Tivoli provides several event adapters with TEC. Other vendors also have created adapters for their products. In addition to event adapters, there are several other sources of event instances such as Tivoli Plus Partners, the CLI, IBM Tivoli Monitoring, extended logfile adapters, and custom adapters.

The wpostemsg command  posts an event to the event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway or non-Tivoli communication directly to the event server. It sends an event to an event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway.  communication is on I use a port 5580. You can do it with the scripts too. See for example discussion about postemsg on mainframes:

I use a REXX script from the "dawns of time" that just opens up a socket connection to the TEC server on port 5580 and sends the event.

This command requires the installation of a Tivoli endpoint on the same system where you are running the command.

If you have distributed an adapter to the endpoint, this command can be found in the $LCF_BINDIR/../bin directory.

wpostemsg [-S server | -f configuration_file] [-m message] [-r severity] [attribute=value...] class source

Notes:

• Because cache files cannot be shared by applications, you should not use a configuration file for this command that is being used by another program (such as an adapter).

• This command is dependent upon the endpoint environment variables, which can be set using the lcf_env.sh or lcf_env.csh scripts that are included in the endpoint installation.

If you are using wpostemsg on a system that is configured both as an endpoint and as a managed node, you might want to create a shell alias for the endpoint version of the command. The following examples show how you might do this:

• alias wpostemsgep="$LCF_BINDIR/../bin/wpostemsg"

Make sure your PATH does not include both versions of the command.

Options

attribute=value

Assigns a value to any valid attribute. The attribute should be one defined for the event class. Separate multiple attribute=value expressions with spaces.

class

Specifies the class of the event. It must match a class that is configured at the server. Classes are defined by the adapter and are listed in the adapter BAROC file. If any blank spaces are in the class name, enclose the class name in double quotation marks.

source

Specifies the source of the event. If any blank spaces are in the source name, enclose the source name in double quotation marks.
 

-f configuration_file
 

Specifies the name of the configuration file. To send directly to the event server, specify SOCKET transport in your configuration file. See the IBM Tivoli Enterprise Console Event Integration Facility Reference for more information about configuration files.
 

-m message

The text of the event, in double quotation marks.
 

-r severity

Specifies a severity. The severity must be one defined for the event class.
 

-S server

Specifies the DNS name of the event server. Enter @EventServer to have events submitted to the locally named event server of the Tivoli Enterprise Console gateway. To indicate a remote server, specify @EventServertmr, where tmr is the name of a Tivoli region. If you do not specify the -S or -f option, the event is sent to the event server defined by the Tivoli Enterprise Console gateway.

If portmapper is running on the event server, you can specify a TCP/IP host name or IP address instead. This results in non-Tivoli communication between the Tivoli Enterprise Console gateway and the event server.

Examples

wpostemsg -r WARNING -m "su login failure." Su_Failure LOGFILE

See Also

Typical Errors

 Error creating a connection to the Event Server

Making connections to the event server

The following scenarios can occur when there are problems connecting to the event server:

• I received a connection error when I use wpostemsg or postzmsg. Or, I received a file path error for the BufEvtPath keyword when using TECAgent.

  Cause: The error indicates that you might be using a user ID other than Administrator or root. Thus, your ID does not have the correct permissions to create and write the file specified by the BufEvtPath keyword.

  Remedy: Ensure that you have the correct permissions for creating the file specified by the BufEvtPath keyword.
   

• My new TME adapter cannot contact the event server.

  Cause: There are Tivoli authorization issues.

  Remedy: Verify the TransportList or ServerLocation keywords in the configuration file.

IBM - postzmsg and postemsg "error creating a connection to the Event Server" errors

postzmsg gets "error creating a connection to the Event Server"
and postemsg sometimes gets tec_put_event failed errno 38
Neither postemsg or postzmsg is using -f for config file.

Cause

permissions

Solution

The default location for a cache file will be /etc/Tivoli/tec on unix and %systemroot%\system32\drivers\etc\Tivoli on Windows.

Error 38 is returned by the EIF code when an event can't be sent to TEC and it also can't be cached for some reason.

The postzmsg error is also because the event is unable to be written to the cache file. Normally, the reason is permissions on the cache directory or cache file. In order for the event to be cached, the file does not have to exist but the directory path to it does. EIF will not create directories. The user should try opening permissions wide open on the cache directory location and the file.

Under normal circumstances using postemsg no cache file is used. But if the connection to the server is down, then the 'e' commands have the same problem.  The 'z' commands have the problem in normal circumstances due to the way the EEIF handles caching.

With the EEIF, events are always written to the cache and a separate thread is used to send the events to the server.  The advantage of this is that when the EEIF is used in a long running adapter, the cache can be automatically emptied when connection to the server is restored without requiring an additional event.
   

Last modified: March 15, 2008