Job Management Partner 1/Integrated Management - Manager Overview and System Design Guide

3.3.1 Correlation event issue

Correlation events are issued by the following JP1/IM - Manager processes:

• When not using the integrated monitoring database: Event issue service
• When using the integrated monitoring database: Event base service

The event generation service and event base service provide the correlation event generation function.

This function is positioned internally as shown below.

Figure 3-13 Position of the correlation event generation function (when not using the integrated monitoring database)

Figure 3-14 Position of the correlation event generation function in the event base service (when using the integrated monitoring database)

When you use the integrated monitoring database, the correlation event generation function is provided by the event base service. This means that event correlation processing can be synchronized with transfer of events to the event console service.

Organization of this subsection

(1) Processing at startup of the correlation event generation function

(2) JP1 event acquisition after startup of the correlation event generation function

(3) Correlation event issue after JP1 event acquisition

(4) Correlation processing when activating or deactivating the integrated monitoring database

(1) Processing at startup of the correlation event generation function

When JP1/IM - Manager starts, the correlation event generation function reads the correlation event generation definition in preparation for issuing correlation events.

If you are not using the integrated monitoring database, by default the event generation service does not start when JP1/IM - Manager starts. You must enter a setting using the jcoimdef command to start this service at JP1/IM - Manager startup. When you use the integrated monitoring database, the event base service starts automatically but the correlation event generation function is disabled by default. You must use the jcoimdef command to enable the function.

The following figure shows the processing at startup of the correlation event generation function.

Figure 3-15 Processing at startup of the correlation event generation function

The flow of processing is described below, following the numbers in the figure:

1. The correlation event generation function is started by the process management functionality.
   The correlation event generation function is started and stopped by the process management in the same way as other JP1/IM - Manager services.
   If you are not using the integrated monitoring database, by default the event generation service does not start when JP1/IM - Manager starts. You must enter a setting using the jcoimdef command to start this service at JP1/IM - Manager startup. When you use the integrated monitoring database, the event base service starts automatically but the correlation event generation function is disabled by default. You must use the jcoimdef command to enable the function.
   
2. The correlation event generation function reads the correlation event generation definition held internally.
   The correlation event generation function behaves according to the internally recorded correlation event generation definition. For this reason, if you edit the correlation event generation definition file, you must apply the changes using the jcoegschange command; otherwise, the service operation will remain unchanged.
   The default definition does not issue correlation events. To issue correlation events, you must edit the correlation event generation definition file and execute the jcoegschange command to apply the settings.
   

Reference note

To change a correlation event generation definition, use the jcoegschange command.

You can update an issue definition while the correlation event generation function is active. If the service is stopped, you can update the definition to be used from the next run.

However, you cannot edit a correlation event generation definition while the function is in the process of starting or stopping.

(2) JP1 event acquisition after startup of the correlation event generation function

The processing of JP1 events after the correlation event generation function starts sometimes differs depending on whether you are using the integrated monitoring database. The following describes the flow of processing in each case.

(a) Correlation processing when not using the integrated monitoring database

Once started, the correlation event generation function associates the correlation event generation definitions with events acquired by the event generation service and issues correlation events.

You can select the location in the JP1/Base event database at which the event generation service begins event acquisition after startup. To set the location, select either cold or warm start mode. These are referred to collectively as start options. Using the start options, you can specify whether to resume correlation processing from the previous run. The start options are described in the table below.

Table 3-3 Start options for correlation event issue

Start option	Description
cold start	Begins acquiring JP1 events that have been registered in the JP1/Base event database since the correlation event generation function started. Stops the correlation processing that was being executed before JP1/IM - Manager stopped. When JP1/IM - Manager is restarted, the function's previous execution status no longer applies.
warm start	Begins acquiring JP1 events registered in the JP1/Base event database, starting from the JP1 event following the last one acquired when the function stopped at the previous run. Records the correlation processing that was being executed before JP1/IM - Manager stopped. When JP1/IM - Manager is restarted, the function's previous execution status takes effect. The default is warm start.

The following figure shows the differences between a cold start and warm start in commencing JP1 event acquisition.

Figure 3-16 Differences in starting acquisition of JP1 events

If JP1 events up to event Z have been acquired when the correlation event generation function stops, acquisition will commence from event A (the next event registered after event Z) if the service is restarted in warm mode. If the service is restarted in cold mode, acquisition will commence from event C (the first event registered after the function restarts).

By default, the correlation event generation function starts in warm mode. This is appropriate in most circumstances, but if you do not need to correlate events issued while the function was stopped, switch to cold start mode.

We recommend that you use warm starts when running JP1/IM - Manager in a cluster system. If you use cold starts, the service will not acquire JP1 events issued while JP1/IM - Manager is being failed over.

Only those JP1 events selected by an event acquisition filter are acquired by the correlation event generation function. For details about event acquisition filters, see 3.2 Filtering of JP1 events.

n Correlation processing examples (when not using the integrated monitoring database)

The following figure shows the processing to issue correlation event issue when a cold start is specified and when a warm start is specified.

Figure 3-17 Correlation processing when the event generation service stops and after it restarts (when not using the integrated monitoring database)

The following describes how the correlation process behaves in the examples in Figure 3-17.

Example 1:

If the cold start option applies when the event generation service stops and when it is restarted, the correlation processing behaves as follows:

When the event generation service stops

• Processing ends and information about all target JP1 events is discarded.
• The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:

• Acquisition starts from the JP1 events registered after restart.
• The service reads the correlation event generation definition, and starts processing accordingly.

Example 2:

If the cold start option applies when the event generation service stops, and warm applies when it is restarted, the correlation processing behaves as follows:

When the event generation service stops

• Processing ends and information about all target JP1 events is discarded.
• The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:

• Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.
• The service re-reads the correlation event generation definition, and starts processing accordingly.

Example 3:

If the warm start option applies when the event generation service stops, and cold applies when it is restarted, the correlation processing behaves as follows:

When the event generation service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:

• All information about JP1 events being correlated when the service stopped at the previous run is discarded.
• Acquisition starts from the JP1 events registered after the restart.
• The service reads the correlation event generation definition, and starts processing accordingly.

Example 4:

If the warm start option applies when the event generation service stops and when it is restarted, the correlation processing behaves as follows:

When the event generation service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:

• Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.
• The service re-reads the correlation event generation definition, and starts processing accordingly.
• The service references the internal log and resumes processing from the JP1 events being correlated, if any, when the previous run stopped.
  However, if you change the correlation event generation definition after the service stops and before it restarts, all information about JP1 events being correlated at the end of the previous run is discarded (same behavior as for a cold start).
  

Note

If the event generation service ends abnormally, information about the JP1 events being correlated cannot be recorded. Therefore, at the next run, the service will behave as for a cold start: Information about the JP1 events being correlated at the end of the previous run is discarded, and acquisition starts from the JP1 events registered after the service restarts.

The event generation service terminates abnormally when:

• The service process is forcibly terminated (killed).
• The system is forcibly powered off.

(b) Correlation processing when using the integrated monitoring database

Once started, the correlation event generation function associates the correlation event generation definitions with events acquired by the event base service and issues correlation events.

You can select the location in the JP1/Base event database at which the event base service begins event acquisition after startup. Set the location by executing the jcoimdef command with the -b option specified.

The correlation processing behaves differently depending on the combination of acquisition start location and start option, as follows:

Table 3-4 Correlation processing behavior

Start option	Value of the -b option	Correlation processing
warm	-1 (default)	The status of the JP1 events being correlated is inherited. Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run. If no JP1 events had been acquired at the end of the previous run, acquisition starts from the oldest JP1 event registered in the event database.
	0 to 144	Message KAVB2316-W is output and the status of JP1 events being correlated is not inherited.
cold	-1 to 144	All correlation processing stops and ends. The status of JP1 events being correlated is not inherited.

JP1 events already processed by the correlation event generation function are not subject to correlation processing a second time.

n Correlation processing examples (when using the integrated monitoring database)

The following figure shows the processing to issue correlation event when a cold start is specified and when a warm start is specified.

Figure 3-18 Correlation processing when the event base service stops (in cold start mode) and when it restarts

The following describes how the correlation processing behaves in the examples in Figure 3-18.

Example 1:

If the cold or warm start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Processing ends and information about all target JP1 events is discarded.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.
• The service reads the correlation event generation definition, and starts processing accordingly.

Example 2:

If the cold or warm start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Processing ends and information about all target JP1 events is discarded.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.
• The service re-reads the correlation event generation definition, and starts processing accordingly.

Figure 3-19 Correlation processing when the event base service stops (in warm start mode) and when it restarts

The following describes how the correlation processing behaves in the examples in Figure 3-19.

Example 3:

If the cold start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• All information about JP1 events being correlated when the service stopped at the previous run is discarded.
• Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.
• The service reads the correlation event generation definition, and starts processing accordingly.

Example 4:

If the warm start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.
• The service re-reads the correlation event generation definition, and starts processing accordingly.
• The service references the internal log and starts processing from the JP1 events that have not yet been correlated.

Example 5:

If the cold start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.
• The service re-reads the correlation event generation definition, and starts processing accordingly.

Example 6:

If the warm start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops

• Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.
• The processing contents are logged to a correlation event generation history file.

After the event base service restarts:

• Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.
• The service re-reads the correlation event generation definition, and starts processing accordingly.
• The service references the internal log and resumes processing from the JP1 events being correlated, if any, when the previous run stopped.

Note

If the event base service ends abnormally, information about the JP1 events being correlated cannot be recorded. Therefore, at the next run, the service will behave as for a cold start: Information about the JP1 events being correlated at the end of the previous run is discarded, and acquisition starts from the JP1 events registered after the service restarts.

The event base service terminates abnormally when:

• The service process is forcibly terminated (killed)
• The service process is forcibly terminated by the jcogencore command.
• The system is forcibly powered off.

(3) Correlation event issue after JP1 event acquisition

The following figure shows the processing to issue correlation event after JP1 events have been acquired.

Figure 3-20 Correlation event issue after JP1 event acquisition

When only one event condition is defined in a correlation event generation condition, the correlation processing is successful and terminates when a JP1 event matching that event condition is issued.

When multiple event conditions are defined in a correlation event generation condition, the correlation processing is successful and terminates when a JP1 event matching one of the event conditions is issued, and a JP1 event matching another event condition is issued subsequently. If the subsequent match does not occur within the timeout period,^# the correlation processing fails and terminates. If you have defined correlation event generation definitions that issue correlation approval events and correlation failure events, both types of correlation events will be issued.

#: A basic attribute of JP1 events. Based on the arrival time.

Reference note

When you define multiple event conditions, you can select one of three event correlation types: sequence, combination, or threshold.

• sequence starts correlation processing based on the order in which the JP1 events are issued. If sequence had been set as the event correlation type in generation condition 2 in the above figure, processing of event condition 2 would not start until event condition 1 had been satisfied.
• combination is the event correlation type specified in generation condition 2 in the above figure. combination starts correlation processing regardless of the order in which event conditions 1 and 2 are satisfied.
• threshold issues a correlation event when the number of issued JP1 events matching the defined event condition reaches a threshold.

The processing performed in correlation event issue is output and saved to a correlation event generation history file, and can be referenced as required. For details about this file, see 3.3.4 Contents of a correlation event generation history file.

(4) Correlation processing when activating or deactivating the integrated monitoring database

The following table describes the event acquisition start location when correlation processing resumes after the integrated monitoring database is activated or deactivated.

Table 3-5 JP1 event acquisition location of the correlation processing when activating or deactivating the integrated monitoring database

Direction of change	Start option at restart	JP1 event acquisition location when correlation processing resumes
Stop using the integrated monitoring database	cold	The point at which the event base service starts
	warm	The point at which the event base service stopped at the previous run
Start using the integrated monitoring database	cold	According to the value set in the -b option of the jcoimdef command
	warm

[Contents][Back][Next]

All Rights Reserved. Copyright (C) 2009, Hitachi, Ltd.