Softpanorama
(slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Google   

TEC troubleshooting

News TEC Recommended Links Selected Docs Installation
Troubleshooting Tivoli Framework wtdumprl command Gateway Troubleshooting Sending events to TEC from scripts Event Adapters
wpostemsg wtdbclear wtdumprl wtdbspace RIM layer

The event server architecture consists of five processes:

Process Name Description Log File  
tec_server The master process /tmp/tec_master  
tec_reception The reception engine process /tmp/tec_reception  
tec_rule The rule engine process /tmp/tec_rule  
tec_dispatch The dispatch engine process /tmp/tec_dispatch  
tec_task The task engine process /tmp/tec_task  

An additional process, the UI server process, plays an integral part in the overall Tivoli Enterprise Console architecture. The UI server is not a part of the event server, although it communicates with the event server. Each process has its own log file.

The first check is to see all those process are present and healthy (consume CPU time), for example there are couple of strange things in the following listing:  

    root 1560692 1839236   0 18:15:20      -  1:40 tec_reception -config /opt/TMF/bin/aix4-r1/TME/TEC/.tec_config
    root 1699860 1839236   0 18:15:20      -  4:59 tec_dispatch -config /opt/TMF/bin/aix4-r1/TME/TEC/.tec_config
    root 1839236 1777810   0 18:14:59      -  0:00 tec_server
    root 1855638 1777810   0 18:15:19      -  0:00 tec_gateway

If the tec_server event server process is no longer responding, restart TEC server using the wstopesvr && wstartesvr command. To check the status of the event server, use the wstatesvr command.

# wstatesvr
The Tivoli Enterprise Console Server is running.

When the event server is restarted, event consoles that were connected to it are automatically reconnected. For details about using the wstartesvr or wstatesvr commands, refer to the IBM Tivoli Enterprise Console Command and Task Reference.

root@nti2171/etc/Tivoli # wstatesvr
The Tivoli Enterprise Console Server is running.

You can also waive dead chicken and restart the TEC server just in case. That does not hurt and might even help...

# wstopesvr

# wstartesvr
The Tivoli Enterprise Console Server is initializing...
The Tivoli Enterprise Console Server is running.

If the problem persist you need to try to send messages to the TEC server and see is they are processed.

Do it first from TMR using wpostemsg and and then with endpoint using both wpostemsg and postemsg and see if they are received:

wpostemgs -m "Test2171" EVENT EVENT

wtdumprl -o DESC | more

### EVENT ###
EVENT;source=EVENT;severity=HARMLESS;msg='test2171';origin=10.201.13.227;END

It might be that you run out of space in your database. This is a typical Sunday problem when most messages are not closed.  To check this try:

# wtdbspace

You can clean event database with the command:

 # wtdbclear -left 0

There is also a useful command

wtdbmaint reorg  | stat
 

Old News

msg00495

-----Original Message-----
From: owner-tme10-XtjxT7Vmt5b1ENwx4SLHqw@xxxxxxxxxxxxxxxx [mailto:owner-tme10-XtjxT7Vmt5b1ENwx4SLHqw@xxxxxxxxxxxxxxxx]On Behalf Of Jeff.Richards-K67OQRCp/lRBDgjK7y7TUQ@xxxxxxxxxxxxxxxx
Sent: Friday, January 28, 2005 9:47 AM
To: tme10-XtjxT7Vmt5b1ENwx4SLHqw@xxxxxxxxxxxxxxxx
Subject: [tme10] TEC Reception Cache Full


I guess this is a configuration/performance issue.


Here's what I saw in an event dump:

1~3183448~65537~1106906597(Jan 28 05:03:17 2005)
### EVENT ###
TEC_Notice;source=TEC;msg="Reception Cache Full: NON-TME Events: Reception Log E
nabled. Events saved in WAITING state";severity=CRITICAL;END
.
### END EVENT ###
PROCESSED

1~3184146~65537~1106909724(Jan 28 05:55:24 2005)
### EVENT ###
TEC_Notice;source=TEC;msg="Reception Cache Full: NON-TME Events: Reception Log E
nabled. Events saved in WAITING state";severity=CRITICAL;END
.
### END EVENT ###
PROCESSED


Here's what I saw in /tmp/tec_rule

Jan 28 05:55:22.348559 tec_rule[48154] ERR tec_msg.c:45: No message type: 1, T
Jan 28 05:55:22.354526 tec_rule[48154] ERR tec_pool.c:406: Could not receive msg
: msg does not contain msgtype

Jan 28 06:19:31.097860 tec_rule[48154] ERR tec_msg.c:45: No message type: 1, T
Jan 28 06:19:31.098340 tec_rule[48154] ERR tec_pool.c:406: Could not receive msg
: msg does not contain msgtype


Any help would be appreciated.

Thanks.

developerWorks Tivoli PACO - Performance, Availability, Configuration, and Operations Windows Log file adapter ...

Windows Log file adapter
Posted: Apr 30, 2004 11:24:49 AM 		 
  Click to reply to this thread Reply
I've been struggling for the past couble of days trying to get my newly created events to show up in TEC and was hoping someone out there could lend a hand.

Here's the situation, I found the location of my current rule base using the following:

wrb -lscrurrb ===> returns "Default"
wrb -lsrb -path Default ===> returns "70w2ks:C:/PROGRA~1/Tivoli/bin/w32-ix86/TME/TEC/default_rb"

I go to 70w2ks:C:/PROGRA~1/Tivoli/bin/w32-ix86/TME/TEC/default_rb/TEC_CLASSES and add
a file called xpoint.baroc containing the following:

TEC_CLASS :
RREBackupStart ISA NT_Base
DEFINES {
message: STRING;
clientName: STRING;
};
END

I add xpoint.baroc to .load_classes after tecad_nt.baroc. Recompile my rule base using the following:

wrb -comprules Default
wrb -loadrb Default

Recycle my TEC server using wstopesvr and wstartesvr.

Next I created an ACP profile and used ACF to create the tecad_win adapter, including the log file format editor.
The format of my event in tecad_win.fmt file looks like the following:

FORMAT RREBackupStart FOLLOWS NT_Base
%t %s %s %s %s %s %s RRE: Backup Starting on client: %s
clientName $8
message PRINTF("RRE: Backup Starting on client: %s", clientName)
END

I push the profile to my endpoint using the distribute menu option, start tecad_win -d, and append the following statement to
my log file:

Mar 7 13:06:19 2004 0 HARMLESS N/A LogFile 8000 RRE: Backup Starting on client: DELL-1100-01

The following is printed by tecad_win:

matched RREBackupStart
$1 is `Mar 7 13:06:19'
$2 is `2004'
$3 is `0'
$4 is `HARMLESS'
$5 is `N/A'
$6 is `LogFile'
$7 is `8000'
$8 is `DELL-1100-01'

All looks good. I now stop tecad_win and start the service using "net start TECWinAdapter" and add the exact same line to my log file.

I now go to the TEC server and use "wtdumprl -o DESC -m 5" to view the reception log. Nothing prints. To verify that events are
flowing to TEC from the logfile I create an event in proper format for a NT_Audit_Policy_Change event. This event is displayed properly
by both tecad_win and by wtdumprl, thus verifying that the log file adapter is configured and working fine. What is not working is
my newly created events.

I have the following questions:
(a) Are there some other tools or log files I can monitor to determine whether the event is being sent from endpoint and received by the TEC server?
(b) According to my interpretation of the documentation, the tecad_win should still forward the events from the endpoint to the TEC server.
But this does not appear to be the case based on my personal observation. Do I have something setup wrong, is it broken, or am I misreading
the documentation?
(c) Did I miss a step somewhere?

Thanks in advance,

Ken

 


 

Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

Standard disclaimer: The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: March 15, 2008