Hitachi

JP1 Version 12 JP1/Integrated Management 2 - Manager Overview and System Design Guide


4.3.1 Correlation event issue

Correlation events are issued by the following JP1/IM - Manager processes:

The event generation service and event base service provide the correlation event generation function.

This function is positioned internally as shown below.

Figure 4‒19: Position of the correlation event generation function (when not using the integrated monitoring database)

[Figure]

Figure 4‒20: Position of the correlation event generation function in the event base service (when using the integrated monitoring database)

[Figure]

When you use the integrated monitoring database, the correlation event generation function is provided by the event base service. This means that event correlation processing can be synchronized with transfer of events to the event console service.

Organization of this subsection

(1) Processing at startup of the correlation event generation function

When JP1/IM - Manager starts, the correlation event generation function reads the correlation event generation definition in preparation for issuing correlation events.

If you are not using the integrated monitoring database, by default the event generation service does not start when JP1/IM - Manager starts. You must enter a setting using the jcoimdef command to start this service at JP1/IM - Manager startup. When you use the integrated monitoring database, the event base service starts automatically but the correlation event generation function is disabled by default. You must use the jcoimdef command to enable the function.

The following figure shows the processing at startup of the correlation event generation function.

Figure 4‒21: Processing at startup of the correlation event generation function

[Figure]

The flow of processing is described below, following the numbers in the figure:

  1. The correlation event generation function is started by the process management functionality.

    The correlation event generation function is started and stopped by the process management in the same way as other JP1/IM - Manager services.

    If you are not using the integrated monitoring database, by default the event generation service does not start when JP1/IM - Manager starts. You must enter a setting using the jcoimdef command to start this service at JP1/IM - Manager startup. When you use the integrated monitoring database, the event base service starts automatically but the correlation event generation function is disabled by default. You must use the jcoimdef command to enable the function.

  2. The correlation event generation function reads the correlation event generation definition held internally.

    The correlation event generation function behaves according to the internally recorded correlation event generation definition. For this reason, if you edit the correlation event generation definition file, you must apply the changes using the jcoegschange command; otherwise, the service operation will remain unchanged.

    The default definition does not issue correlation events. To issue correlation events, you must edit the correlation event generation definition file and execute the jcoegschange command to apply the settings.

Note

To change a correlation event generation definition, use the jcoegschange command.

You can update an issue definition while the correlation event generation function is active. If the service is stopped, you can update the definition to be used from the next run.

However, you cannot edit a correlation event generation definition while the function is in the process of starting or stopping.

(2) JP1 event acquisition after startup of the correlation event generation function

The processing of JP1 events after the correlation event generation function starts sometimes differs depending on whether you are using the integrated monitoring database. The following describes the flow of processing in each case.

(a) Correlation processing when not using the integrated monitoring database

Once started, the correlation event generation function associates the correlation event generation definitions with events acquired by the event generation service and issues correlation events.

You can select the location in the JP1/Base event database at which the event generation service begins event acquisition after startup. To set the location, select either cold or warm start mode. These are referred to collectively as start options. Using the start options, you can specify whether to resume correlation processing from the previous run. The start options are described in the table below.

Table 4‒8: Start options for correlation event issue

Start option

Description

cold start

Begins acquiring JP1 events that have been registered in the JP1/Base event database since the correlation event generation function started.

Stops the correlation processing that was being executed before JP1/IM - Manager stopped. When JP1/IM - Manager is restarted, the function's previous execution status no longer applies.

warm start

Begins acquiring JP1 events registered in the JP1/Base event database, starting from the JP1 event following the last one acquired when the function stopped at the previous run.

Records the correlation processing that was being executed before JP1/IM - Manager stopped. When JP1/IM - Manager is restarted, the function's previous execution status takes effect.

The default is warm start.

The following figure shows the differences between a cold start and warm start in commencing JP1 event acquisition.

Figure 4‒22: Differences in starting acquisition of JP1 events

[Figure]

If JP1 events up to event Z have been acquired when the correlation event generation function stops, acquisition will commence from event A (the next event registered after event Z) if the service is restarted in warm mode. If the service is restarted in cold mode, acquisition will commence from event C (the first event registered after the function restarts).

By default, the correlation event generation function starts in warm mode. This is appropriate in most circumstances, but if you do not need to correlate events issued while the function was stopped, switch to cold start mode.

We recommend that you use warm starts when running JP1/IM - Manager in a cluster system. If you use cold starts, the service will not acquire JP1 events issued while JP1/IM - Manager is being failed over.

Only those JP1 events selected by an event acquisition filter are acquired by the correlation event generation function. For details about event acquisition filters, see 4.2 Filtering of JP1 events.

■ Correlation processing examples (when not using the integrated monitoring database)

The following figure shows the processing to issue correlation event issue when a cold start is specified and when a warm start is specified.

Figure 4‒23: Correlation processing when the event generation service stops and after it restarts (when not using the integrated monitoring database)

[Figure]

The following describes how the correlation process behaves in the examples in Figure 4-23 Correlation processing when the event generation service stops and after it restarts (when not using the integrated monitoring database).

Example 1:

If the cold start option applies when the event generation service stops and when it is restarted, the correlation processing behaves as follows:

When the event generation service stops
  • Processing ends and information about all target JP1 events is discarded.

  • The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:
  • Acquisition starts from the JP1 events registered after restart.

  • The service reads the correlation event generation definition, and starts processing accordingly.

Example 2:

If the cold start option applies when the event generation service stops, and warm applies when it is restarted, the correlation processing behaves as follows:

When the event generation service stops
  • Processing ends and information about all target JP1 events is discarded.

  • The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:
  • Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

Example 3:

If the warm start option applies when the event generation service stops, and cold applies when it is restarted, the correlation processing behaves as follows:

When the event generation service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:
  • All information about JP1 events being correlated when the service stopped at the previous run is discarded.

  • Acquisition starts from the JP1 events registered after the restart.

  • The service reads the correlation event generation definition, and starts processing accordingly.

Example 4:

If the warm start option applies when the event generation service stops and when it is restarted, the correlation processing behaves as follows:

When the event generation service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event generation service restarts:
  • Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

  • The service references the internal log and resumes processing from the JP1 events being correlated, if any, when the previous run stopped.

    However, if you change the correlation event generation definition after the service stops and before it restarts, all information about JP1 events being correlated at the end of the previous run is discarded (same behavior as for a cold start).

Important

If the event generation service ends abnormally, information about the JP1 events being correlated cannot be recorded. Therefore, at the next run, the service will behave as for a cold start: Information about the JP1 events being correlated at the end of the previous run is discarded, and acquisition starts from the JP1 events registered after the service restarts.

The event generation service terminates abnormally when:

  • The event generation service process is forcibly terminated (kill)

  • The process is forcibly terminated by the jcogencore command.

  • The system is forcibly powered off.

(b) Correlation processing when using the integrated monitoring database

Once started, the correlation event generation function associates the correlation event generation definitions with events acquired by the event base service and issues correlation events.

You can select the location in the JP1/Base event database at which the event base service begins event acquisition after startup. Set the location by executing the jcoimdef command with the -b option specified.

The correlation processing behaves differently depending on the combination of acquisition start location and start option, as follows:

Table 4‒9: Correlation processing behavior

Start option

Value of the -b option

Correlation processing

warm

-1 (default)

The status of the JP1 events being correlated is inherited.

Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run. If no JP1 events had been acquired at the end of the previous run, acquisition starts from the oldest JP1 event registered in the event database.

0 to 144

Message KAJV2316-W is output and the status of JP1 events being correlated is not inherited.

cold

-1 to 144

All correlation processing stops and ends. The status of JP1 events being correlated is not inherited.

JP1 events already processed by the correlation event generation function are not subject to correlation processing a second time.

■ Correlation processing examples (when using the integrated monitoring database)

The following figure shows the processing to issue correlation event when a cold start is specified and when a warm start is specified.

Figure 4‒24: Correlation processing when the event base service stops (in cold start mode) and when it restarts

[Figure]

The following describes how the correlation processing behaves in the examples in Figure 4-24Correlation processing when the event base service stops (in cold start mode) and when it restarts.

Example 1:

If the cold or warm start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Processing ends and information about all target JP1 events is discarded.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.

  • The service reads the correlation event generation definition, and starts processing accordingly.

Example 2:

If the cold or warm start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Processing ends and information about all target JP1 events is discarded.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

Figure 4‒25: Correlation processing when the event base service stops (in warm start mode) and when it restarts

[Figure]

The following describes how the correlation processing behaves in the examples in Figure 4-25 Correlation processing when the event base service stops (in warm start mode) and when it restarts.

Example 3:

If the cold start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • All information about JP1 events being correlated when the service stopped at the previous run is discarded.

  • Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.

  • The service reads the correlation event generation definition, and starts processing accordingly.

Example 4:

If the warm start option applies when the event base service starts, and a value in the range 0 to 144 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • Acquisition starts at the number of hours specified in the jcoimdef command's -b option prior to the restart time.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

  • The service references the internal log and starts processing from the JP1 events that have not yet been correlated.

Example 5:

If the cold start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

Example 6:

If the warm start option applies when the event base service starts, and -1 is specified in the -b option of the jcoimdef command, the correlation processing behaves as follows:

When the event base service stops
  • Information about the JP1 events being correlated, the processing contents, and the information in the correlation event generation definition are output to an internal log to record the processing status.

  • The processing contents are logged to a correlation event generation history file.

After the event base service restarts:
  • Acquisition starts from the JP1 event following the last one acquired when the service stopped at the previous run.

  • The service re-reads the correlation event generation definition, and starts processing accordingly.

  • The service references the internal log and resumes processing from the JP1 events being correlated, if any, when the previous run stopped.

Important

If the event base service ends abnormally, information about the JP1 events being correlated cannot be recorded. Therefore, at the next run, the service will behave as for a cold start: Information about the JP1 events being correlated at the end of the previous run is discarded, and acquisition starts from the JP1 events registered after the service restarts.

The event base service terminates abnormally when:

  • The service process is forcibly terminated (killed)

  • The service process is forcibly terminated by the jcogencore command.

  • The system is forcibly powered off.

(3) Correlation event issue after JP1 event acquisition

The following figure shows the processing to issue correlation event after JP1 events have been acquired.

Figure 4‒26: Correlation event issue after JP1 event acquisition

[Figure]

When only one event condition is defined in a correlation event generation condition, the correlation processing is successful and terminates when a JP1 event matching that event condition is issued.

When multiple event conditions are defined in a correlation event generation condition, the correlation processing is successful and terminates when a JP1 event matching one of the event conditions is issued, and a JP1 event matching another event condition is issued subsequently. If the subsequent match does not occur within the timeout period,# the correlation processing fails and terminates. If you have defined correlation event generation definitions that issue correlation approval events and correlation failure events, both types of correlation events will be issued.

#: A basic attribute of JP1 events. Based on the arrival time.

Note

When you define multiple event conditions, you can select one of three event correlation types: sequence, combination, or threshold.

  • sequence starts correlation processing based on the order in which the JP1 events are issued. If sequence had been set as the event correlation type in generation condition 2 in the above figure, processing of event condition 2 would not start until event condition 1 had been satisfied.

  • combination is the event correlation type specified in generation condition 2 in the above figure. combination starts correlation processing regardless of the order in which event conditions 1 and 2 are satisfied.

  • threshold issues a correlation event when the number of issued JP1 events matching the defined event condition reaches a threshold.

The processing performed in correlation event issue is output and saved to a correlation event generation history file, and can be referenced as required. For details about this file, see 4.3.4 Contents of a correlation event generation history file.

(4) Correlation processing when activating or deactivating the integrated monitoring database

The following table describes the event acquisition start location when correlation processing resumes after the integrated monitoring database is activated or deactivated.

Table 4‒10: JP1 event acquisition location of the correlation processing when activating or deactivating the integrated monitoring database

Direction of change

Start option at restart

JP1 event acquisition location when correlation processing resumes

Stop using the integrated monitoring database

cold

The point at which the event base service starts

warm

The point at which the event base service stopped at the previous run

Start using the integrated monitoring database

cold

According to the value set in the -b option of the jcoimdef command

warm

(5) Processing when restriction of viewing and operating business groups is set

When viewing and operating of business groups are restricted, JP1 users cannot define correlation events across the different business groups. Only the system administrator can define correlation events. JP1 users must request the system administrator to set correlation events.

Figure 4‒27: Correlation event across different business groups

[Figure]

If JP1 events generated in different business groups are defined as correlation events, the background colors of those correlation source events are displayed in gray in the Related Events window.

When you define correlation events, define filtering conditions so that only the JP1 events issued in the business system will be displayed as the related events for the correlation events. Also, define variables so that only the JP1 events in the business system will be displayed as issued correlation events.

[gyoumuA]

TARGET=E.JP1_SOURCEHOST==/Business system A ...............1

CON=CID:1, E.SEVERITY==Error, E.PRODUCT_NAME>=HITACHI/JP1/AJS2

CON=CID:2, E.SEVERITY==Error, E.PRODUCT_NAME>=HITACHI/JP1/Base

SUCCESS_EVENT=E.SEVERITY:Alert,E.JP1_SOURCEHOST:$EV1_E.JP1_SOURCEHOST ..........2

Description
  1. Using a filtering condition (TARGET), filter the events so that only the names of the hosts in the business group (Business system A) are displayed as the event source host names (E.JP1_SOURCEHOST) of the related events. To specify a business group or monitoring group, specify its path by adding a slash (/) before the name.

  2. Use a variable ($EV1_E.SOURCEHOST) and let the event source host name (E.JP1_SOURCEHOST) for the correlation event (SUCCESS_EVENT) inherit the name of the event source host whose related event conditions match the event conditions for CID:1.