Designing and Managing Behavior Models
-
Using Other Data Sources - HP OpenView IT/Operations -
The section Integration with Network Management Platforms on page 24 explained that Hewlett Packard OpenView IT/Operations can be integrated with NerveCenter. Using these two products together, you can detect, correlate, and respond to network-, system-, and application-related problems in distributed multi-vendor environments.
Here's how you integrate the two products. On the IT/Operations (IT/O) side, you install IT/O agents on the devices you want to monitor using IT/O. You also push to these devices a set of templates describing the conditions that you want IT/O to detect. If you're using IT/O with NerveCenter, generally you should modify each condition in a template to indicate that IT/O should divert messages concerning that condition to NerveCenter instead of handling the messages itself. If you make this change, messages concerning the conditions in question will not appear in IT/O's message browser.
On the NerveCenter side, you must specify the system on which the IT/O server is running as your OpC host. Then, you can set up OpC message masks to capture IT/O messages that are forwarded to NerveCenter and meet certain criteria. These OpC message masks are similar to trap masks and can fire triggers that cause alarm transitions.
After NerveCenter has correlated a set of events reported by IT/O, the NerveCenter alarm that correlated the events can take corrective actions, as usual. Also, the alarm can send a message to IT/O describing the problem it has detected. To send this message the alarm uses the Inform OpC action. This action is discussed fully in the section Inform OpC on page 276.
Perhaps a simple example will make this interaction clearer. Suppose that you are monitoring a Solaris workstation and that you want to detect three unsuccessful attempts to switch users (su) within a minute. IT/O's Su template enables you detect an unsuccessful su and to take some action; however, IT/O can't correlate a series of unsuccessful su's. Therefore, you might divert messages about unsuccessful su's to NerveCenter and have a NerveCenter behavior model detect the condition you're looking for. This behavior model would consist primarily of an OpC mask and an alarm. The mask would look for IT/O messages containing "/bin/su(1) Switch User" in the Application field and "Security" in the Message Group field (or something similar to this). When it saw a message with this content, the mask would fire a trigger and cause a transition in the alarm that was monitoring unsuccessful su's. If this alarm detected three unsuccessful su's within a minute, it would use the Inform OpC alarm action to notify IT/Operations of the condition.
For further information about receiving messages from IT/Operations, see the following sections:
| An Example Trigger Function | Listing OpC Masks |
| 29 July 2003 |