Softpanorama May the source be with you, but remember the KISS principle ;-)	Home	Switchboard	Unix Administration	Red Hat	TCP/IP Networks	Neoliberalism	Toxic Managers
	(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and bastardization of classic Unix

Sending events to TEC from scripts

News	Recommended Links	Reference	Arguments	Examples
Typical Errors	"Error creating a connection to the Event Server"	Tips	Humor	Etc

Sending a Tivoli event from a script involves several steps:

Finding a suitable existing or defining a new event class.
Creating a suitable invocation of wpostzmsg or postzmsg utilities (message adapters). There are also two older versions of the same utilities wpostemsg and postemsg. You can use them too, I do not see much difference. To invoke message adapter at minimum you need:
- Specify the text of the message
- Specify class of the message. Every TEC event must have an class name that identifies it and this class name should be used in invocation of wpostzmsg or postzmsg utilities which are usually used for sending events from script. The wpostzmsg used on the servers on which there is an Tivoli endpoint installed and command postzmsg that is used when there is no endpoint.
- Specify source of event. It should be a valid value. The source is defined by the adapter type or it can be set to a default source in the event adapter configuration file. For example LOGFILE.

Optionally you can do a lot of thing and populate any slot of the message. For example:

Specify the severity of the message
Specify hostname
Close of change status of existing message.

Once an event is sent to the TEC, it will remain until it is removed. Events can be removed manually from the TEC console display, or by two automatic methods. Either a closing event can be sent, or a timer can be set on the event so that it will be closed after a specified period of time. To use a “closing” event, send a message with the same hostname and class, but with an attribute status=CLOSED. To close events based on a timer, you need to set a timer for a specific class, and specify the duration for the timer.

Diagnostic can be called either non existent or very bad as both wpostzmsg and postzmsg do minimal job to validate input. Also they cannot check the existence of the class of messages you are sending so it is wrong it will be discarded. That means that typing class of the message is a bad idea: it is safer to copy it verbatim from some source.

The wpostzmsg command posts an event to the event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway or, optionally (if -S argument is specified) non-Tivoli communication directly to the event server. It sends an event to an event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway. It requires the installation of a Tivoli endpoint on the same system where you are running the command.
The postzmsg command posts an event directly to the event server bypassing the path used for other events (stream that uses gateways). It sends an event directly to an event server. It does not requires the installation of a Tivoli endpoint on the same system where you are running the command.

Both commands have similar syntax. In both cases you need to create the correct environment before executing the command by sourcing lcf_env.sh. Commands should be run as root or as Tivoli user. Running under other IDs produces error "error creating a connection to the Event Server". It is possible to change endpoint configuration so that other IDs can post messages.

If you have distributed an adapter to the endpoint, both commands can be found in the $LCF_BINDIR/../bin directory.

Here is the syntax for wpostzmsg (the syntax for postzmsg is identical):

wpostzmsg [-S server | -f configuration_file] [-m message] [-r severity] [attribute=value...] class source

Typically to use it in Perl script you need first to switch to root or Tivoli user (if you are not already in this role), then create environment and only then invoke a command:

`sudo /export/home/alerts/bin/postalert.sh "The alert to be send" CRITICAL Logfile_Sendmail "hostname=[email protected]" `

where postalert should be a shell scripts that contains the necessary environment initialization and invocation of wpostzmsg:

. $LCF_PATH/lcf_env.sh && $LCF_BINDIR/../bin/wpostzmsg -m "$1" -r $2 $4 $3 LOGFILE`;

Arguments

attribute=value Assigns a value to any valid attribute. The attribute should be one defined for the event class. Separate multiple attribute=value expressions with spaces. Among attributes the most often used are
hostname DNS name of the host for which the event is to be reported.
probe_argument is any qualifier associated with the event, such as the disk, network interface, etc. to which the event applies. Use this to distinguish different events of the same class coming from the same host
response_level is an optional argument. If it is specified as "reset", then an open event with the same hostname, class and probe_arg values will be closed.
class Specifies the class of the event. It must match one of classes in BAROC class definitions that is active in the current rulebase used by the server. Classes are defined by the adapter and are listed in the adapter BAROC file. If any blank spaces are in the class name, enclose the class name in double quotation marks.
source Specifies the source of the event. Arbitrary string that help to locate the source of event. If any blank spaces are in the source name, enclose the source name in double quotation marks.
-f configuration_file Specifies the name of the configuration file. To send directly to the event server, specify SOCKET transport in your configuration file. See the IBM Tivoli Enterprise Console Event Integration Facility Reference for more information about configuration files.
-m message The text of the event, in double quotation marks. Message is an arbitrary text message explaining the meaning of the event.
-r severity Specifies a severity. One of FATAL, CRITICAL, MINOR, HARMLESS, or WARNING
-S server Specifies the DNS name of the event server. Enter @EventServer to have events submitted to the locally named event server of the Tivoli Enterprise Console gateway. To indicate a remote server, specify @EventServertmr, where tmr is the name of a Tivoli region. If you do not specify the -S or -f option, the event is sent to the event server defined by the Tivoli Enterprise Console gateway.
If portmapper is running on the event server, you can specify a TCP/IP host name or IP address instead. This results in non-Tivoli communication between the Tivoli Enterprise Console gateway and the event server.

Notes:

Because cache files cannot be shared by applications, you should not use a configuration file for this command that is being used by another program (such as an adapter).

This command is dependent upon the endpoint environment variables, which can be set using the lcf_env.sh scripts that are included in the endpoint installation.

If you are using wpostzmsg on a system that is configured both as an endpoint and as a managed node, you might want to create a shell alias for the endpoint version of the command. The following examples show how you might do this:

alias wpostz="$LCF_BINDIR/../bin/wpostzmsg"

Make sure your PATH does not include both versions of the command.

Examples

The following example for UNIX environments sends a test message that displays an Su_Failure event of severity WARNING on the event consoles (we assume that lcf_env.sh is in PATH):

. lcf_env.sh  && $LCF_BINDIR/../bin/wpostzmsg -r WARNING -m "su login failure." Su_Failure LOGFILE

. lcf_env.sh && $LCF_BINDIR/../bin/wpostzmsg -m 'Percent disk' -r WARNING hostname=isserver1 value=98 probe_arg='/tmp space' unix_dfwarn unix

. lcf_env.sh && $LCF_BINDIR/../bin/wpostzmsg -m 'Percent inodes' -r WARNING hostname=isserver1 value=98 probe_arg='/tmp inodes' unix_dfwarn unix

wpostemsg (endpoint version)

This is older version of wpostzmsg Posts an event to the event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway.

wpostzmsg -r WARNING -m "WARNING: /pci@8,700000/lpfc@2/sd@f,0 (sd44
):" SCSI_Error LOGFILE

Syntax

wpostemsg [-S server | -f configuration_file] [-m message] [-r severity ] [ attribute=value... ] class source

Description

The wpostemsg command sends an event to an event server using Tivoli endpoint communication to a Tivoli Enterprise Console gateway.

Notes:

Although this command is still supported, the wpostzmsg command is preferred for sending events using Tivoli communication.
Because cache files cannot be shared by applications, you should not use a configuration file for this command that is being used by another program (such as an adapter).

This command requires the installation of a Tivoli endpoint on the same system where you are running the command. If you have distributed an adapter to the endpoint, this command can be found in the $LCF_BINDIR/../bin directory.

This command is dependent upon the endpoint environment variables, which can be set using the lcf_env.sh or lcf_env.csh scripts that are included in the endpoint installation.

If you are using wpostemsg on a system that is configured both as an endpoint and as a managed node, you might want to create a shell alias for the endpoint version of the command. The following examples show how you might do this:

C shell: alias wpostemsgep "$LCF_BINDIR/../bin/wpostemsg"
Korn shell: alias wpostemsgep="$LCF_BINDIR/../bin/wpostemsg"
Bash shell (on Windows systems): alias wpostemsgep="/Program\ Files/Tivoli/lcf/bin/w32-ix86/bin/wpostemsg.exe

Make sure your PATH does not include both versions of the command.

Authorization

user

Options

attribute=value...: Assigns a value to any valid attribute. The attribute should be one defined for the event class. Separate multiple attribute=value expressions with spaces.
class: Specifies the class of the event. It must match a class that is configured at the server. Classes are defined by the event adapter and are listed in the adapter BAROC file. If any blank spaces are in the class name, enclose the class name in double quotation marks.
source: Specifies the source of the event. The source is defined by the adapter type or it can be set to a default source in the event adapter configuration file. If any blank spaces are in the source name, enclose the source name in double quotation marks.
-f configuration_file: Specifies the name of the configuration file. See the IBM Tivoli Enterprise Console Event Integration Facility Reference for more information about configuration files.
-m message: The text of the event, in double quotation marks.
-r severity: Specifies a severity. The severity must be one defined for the event class.
-S server: Specifies the name of the event server in name registry format. Specify @EventServer to have events submitted to the locally named event server of the Tivoli Enterprise Console gateway. To indicate a remote server, specify @EventServer#tmr, where tmr is the name of a Tivoli region. If you do not specify the -S or -f option, the event is sent to the event server defined by the Tivoli Enterprise Console gateway.
If portmapper is running on the event server, you can specify a TCP/IP host name or IP address instead. This results in non-Tivoli communication between the Tivoli Enterprise Console gateway and the event server.

Examples

The following example sends a test message that displays an Su_Failure event of severity WARNING on the event consoles:

wpostemsg -r WARNING -m "su failure" Su_Failure LOGFILE

NEWS CONTENTS

190313 : Sending events to Tivoli ( Sending events to Tivoli, )

Old News ;-)

[DOC] Sending events to Tivoli

Sending a Tivoli event from a Unix script involves the following steps:

- Define an event class

- Generate events

- Choose a method for closing events

Defining an event class

Every event must have an class name that identifies it to the Tivoli Enterprise Console (TEC). By convention, we will use unix_<program name> for the events sent by programs or scripts on the Unix systems, and nt_<program name> for Window NT/2000. The ESM staff will set up the event classes as requested. Put a request in the ESM-Incoming queue in TPM or send e-mail to [email protected].

Generating events

Issue a wpostemsg command to send an event to the Tivoli Enterprise Console (TEC), which is the event correlation engine. The format of the command is as follows:

wpostemsg [-m message] [-r severity] [hostname=<host>] [value=<value>] [probe_arg=<probe-argument>] [response_level=reset] class source

The wpostemsg command requires that the proper environment be set up. The easiest way to do this is with the "tiv" script in /var/local/Tivoli/Princeton/bin. To issue a single command, just give the tiv command followed by the command. The tiv command with no arguments will start a shell with the environment set up.

Arguments:

message is a arbitrary text message explaining the meaning of the event.

severity is one of FATAL, CRITICAL, MINOR, HARMLESS, or WARNING

class is the class defined for this event.

source is "unix" or "windows_nt"

<host> is the unqualified name of the host for which the event is to be reported.

<value> is the value (if any) associated with this event.

<probe_argument> is any qualifier associated with the event, such as the disk, network interface, etc. to which the event applies. Use this to distinguish different events of the same class coming from the same host

<response_level> is an optional argument. If it is specified as "reset", then an open event with the same hostname, class and probe_arg values will be closed.

Examples:

/var/local/Tivoli/Princeton/bin/tiv wpostemsg -m 'Percent disk' -r WARNING hostname=isserver1 value=98 probe_arg='/tmp space' unix_dfwarn unix

/var/local/Tivoli/Princeton/bin/tiv wpostemsg -m 'Percent inodes' -r WARNING hostname=isserver1 value=98 probe_arg='/tmp inodes' unix_dfwarn unix

Closing events

Once an event is sent to the TEC, it will remain until it is removed. Events can be removed manually from the TEC console display, or by two automatic methods. Either a closing event can be sent, or a timer can be set on the event so that it will be closed after a specified period of time. To use a "closing" event, send a message with the same hostname and class, but with "status=CLOSED". To close events based on a timer, notify ESM that you want to set a timer for a specific class, and specify the duration for the timer.

Typical Errors

Error creating a connection to the Event Server

Making connections to the event server

The following scenarios can occur when there are problems connecting to the event server:

I received a connection error when I use wpostzmsg or postzmsg. Or, I received a file path error for the BufEvtPath keyword when using TECAgent.
Cause: The error indicates that you might be using a user ID other than Administrator or root. Thus, your ID does not have the correct permissions to create and write the file specified by the BufEvtPath keyword.

Remedy: Ensure that you have the correct permissions for creating the file specified by the BufEvtPath keyword.
My new TME adapter cannot contact the event server.
Cause: There are Tivoli authorization issues.

Remedy: Verify the TransportList or ServerLocation keywords in the configuration file.

IBM - postzmsg and postemsg "error creating a connection to the Event Server" errors

postzmsg gets "error creating a connection to the Event Server"
and postemsg sometimes gets tec_put_event failed errno 38
Neither postemsg or postzmsg is using -f for config file.

Cause

permissions

Solution

The default location for a cache file will be /etc/Tivoli/tec on unix and %systemroot%\system32\drivers\etc\Tivoli on Windows.

Error 38 is returned by the EIF code when an event can't be sent to TEC and it also can't be cached for some reason.

The postzmsg error is also because the event is unable to be written to the cache file. Normally, the reason is permissions on the cache directory or cache file. In order for the event to be cached, the file does not have to exist but the directory path to it does. EIF will not create directories. The user should try opening permissions wide open on the cache directory location and the file.

Under normal circumstances using postemsg no cache file is used. But if the connection to the server is down, then the 'e' commands have the same problem. The 'z' commands have the problem in normal circumstances due to the way the EEIF handles caching.

With the EEIF, events are always written to the cache and a separate thread is used to send the events to the server. The advantage of this is that when the EEIF is used in a long running adapter, the cache can be automatically emptied when connection to the server is restored without requiring an additional event.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers : Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda : SE quotes : Language Design and Programming Quotes : Random IT-related quotes : Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce : Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 : Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds : Larry Wall : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS : Programming Languages History : PL/1 : Simula 67 : C : History of GCC development : Scripting Languages : Perl history : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month : How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019

Sending events to TEC from scripts

Arguments

Examples

wpostemsg (endpoint version)

Syntax

Description

Authorization

Options

Examples

See Also

NEWS CONTENTS

Old News ;-)

[DOC] Sending events to Tivoli

Recommended Links

Google matched content

Softpanorama Recommended

Top articles

Sites

Typical Errors

Error creating a connection to the Event Server

Etc