8.2.8 Selection of agent configuration or remote monitoring configuration

Using IM Configuration Management, you can use JP1/Base to monitor hosts in agent configuration, or remotely monitor hosts in a remote monitoring configuration.

In remote monitoring, a communication failure related to functional errors might cause log monitoring to stop or events to be lost. If the system cannot tolerate temporary stoppage of log monitoring, install JP1/Base and use it for log monitoring.

In both the agent configuration and remote monitoring configuration, multiple manager hosts cannot monitor one host.

Use the following table to help decide whether to use monitoring using JP1/Base or remote monitoring.

Table 8‒16: Guidelines for selecting a monitoring method
Item	Monitoring using JP1/Base	Remote monitoring
You perform monitoring that exceeds the restrictions for remote monitoring.	Y	N
The stoppage of log monitoring and loss of events is undesirable in the system.^#1	Y	N
Log monitoring is required even while JP1/IM - Manager is stopped.	Y	Y^#2
Monitored hosts are frequently stopped.	Y	N
WMI/NetBIOS (NetBIOS over TCP/IP) or SSH cannot be used on the system.^#3	Y	N
Multiplexed monitoring.^#4	Y	N
Other than above.	Y	Y

Legend:

Y: Monitoring is performed.

N: Monitoring is not performed.

#1: When monitoring using JP1/Base, if a network failure occurs, JP1/Base acquires logs during the network failure. With remote monitoring, the monitoring stops if the failure cannot be recovered by retrying the operation.

#2: Not trapped if the event that occurred during the stop period exceeds the maximum size that can be collected by remote monitoring.

#3: With remote monitoring, settings for remote communication must be configured on the host on which JP1/IM - Manager has been installed and on the monitored hosts. The communication method depends on the OS of the monitored host. WMI/NetBIOS (NetBIOS over TCP/IP) must be configured if the monitored host is a Windows host, or SSH must be configured if the monitored host is a UNIX host.

#4: Multiplexed monitoring indicates that JP1 events are monitored by managers in both the primary and secondary systems. This is done by transferring JP1 events that occurred in a monitored host to the manager hosts in both the primary and secondary systems.

For details about remote monitoring, see 8.6 Managing remotely monitored hosts.

Some limitations apply to remote monitoring. For the limit values, see the following table.

Table 8‒17: Limit values for remote monitoring
Item	Limit
Maximum number of remote monitoring units^#1	1,024
Maximum size of the log files that can be remotely monitored	64 MB
Maximum amount of log data that can be collected per monitoring interval (Windows)^#2	10 KB^#4
Maximum amount of log data that can be collected per monitoring interval (UNIX)^#2	10 KB^#4
Maximum amount of event log data that can be collected per monitoring interval^#3	10 KB^#4
Maximum amount of log data that can be collected by one JP1/IM - Manager	10 MB

#1: Total value of the number of log files monitored by remote log file trapping and the number of servers monitored by remote event-log trapping

#2: Total size of log data collected.

#3: Total size of Windows event log data collected.

#4: Default value. This limit value can be changed in the remote log trap environment definition file (jp1cf_remote_logtrap.conf). For details about the remote log trap environment definition file (jp1cf_remote_logtrap.conf), see Remote log trap environment definition file (jp1cf_remote_logtrap.conf) (Chapter 2. Definition Files) in the manual JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.

Organization of this subsection

(1) Functional differences between the agent configuration and the remote monitoring configuration

(1) Functional differences between the agent configuration and the remote monitoring configuration

Table 8‒18: Functional differences between the agent configuration and the remote monitoring configuration
Item	Agent configuration	Remote monitoring configuration
Use	Monitoring of mission-critical applications (monitoring accuracy has priority) Monitoring of JP1 products	When reducing load in the construction of an environment and for other operations has priority over monitoring accuracy^#1
Monitored logs and file formats	Syslog User log Event log (Windows version only) Log file formats - Sequential file (SEQ) - Sequential file (SEQ2) - Sequential file (SEQ3) - Wrap-around file (WRAP1) - Wrap-around file (WRAP2) - JP1 integrated trace log (HTRACE) - UPD-type log file (UPD)	Syslog User log Event log (Windows version only) Log file formats - Sequential file (SEQ) - Sequential file (SEQ2) - Wrap-around file (WRAP2)
Scale	Log file monitoring^#2 In Windows, the maximum number of log files that can be monitored is determined by the following formula: (`a` + `m`) + (`b` + `n`) ≤ 508 Legend: `a`: Total number of log files that are monitored (identical files are counted as separate files) `b`: Total number of log files that are monitored by JP1/AJS log file monitoring jobs (identical files are counted as separate files) `m`: Number of `jevlogstart` commands that are executed `n`: Number of JP1/AJS log file monitoring jobs that are executed In UNIX, the maximum number of files that can be monitored by one log file trap is 100. Therefore, the maximum number of files that can be monitored in a UNIX system depends on a kernel parameter setting (number of files that can be opened).	Maximum total of log files and event logs monitored for each JP1/IM - Manager 1,024
Event issued	Log file monitoring User-specified event ID Event log monitoring Event ID specified in the filter in the event log trap action-definition file. If the event ID is not specified, `00003A71` is assumed.	Log file monitoring User-specified event ID Event log monitoring Event ID specified in the filter in the event log trap action-definition file. If the event ID is not specified, `00003A71` is assumed.
Size of log files that can be monitored	2 gigabytes or less	64 megabytes or less
Size of log data that can be collected during a monitoring interval	Unlimited	In Windows: 200 kilobytes or less In UNIX: 50 kilobytes or less
Maximum size of event log that can be collected per monitoring interval	Unlimited	200 kilobytes or less
Log file trap start option	Monitoring interval 1 to 86,400 seconds	Monitoring interval 60 to 86,400 seconds An interval of 5 minutes is recommended when the maximum configuration is used.
	Number of log files that can be monitored per monitoring (number of log file names that can be specified) In Windows: 1 to 32 In UNIX: 1 to 100	Number of log files that can be monitored per monitoring (number of log file names that can be specified): 1 to 32
	Read from the start of log files Can be specified.	Read from the start of log files Cannot be specified.
	Display command name Can be specified.	Display command name Cannot be specified.
	Destination server name Can be specified.	Destination server name Cannot be specified.
	Monitored host name Cannot be specified.	Monitored host name Can be specified.
	Logical host name Cannot be specified.	Logical host name Can be specified.
	In Windows, Unicode can be specified.	Various character encodings that can be specified for the OS.
	Log data output source host name Can be specified.	Log data output source host name Cannot be specified.
	Regular expression type Cannot be specified (common definition information is specified).	Regular expression type Extended regular expressions can be specified.
Log file trap action definition	Retry interval 1 to 600 seconds	Retry interval 3 to 600 seconds
	Number of held JP1 events 0 to 1,000	Number of held JP1 events 0 to 100
	Record format of log files Variable-length record format: `\n`, a line termination character, or a line termination symbol can be specified. Fixed-length record format: Record length can be specified as the line delimiter.	Record format of log files `\n` in the variable-length record format.
	Threshold value of retry count Can be specified.	Threshold value of retry count Cannot be specified.
	File type One of `SEQ`, `SEQ2`, `SEQ3`,^#3 `WRAP1`, `WRAP2`, `HTRACE`, or `UPD`^#3 can be specified.	File type One of `SEQ`, `SEQ2`, or `WRAP1` can be specified.
	Header size Can be specified.	Header size Cannot be specified.
	JP1 event for the UPD type Can be specified.^#4	JP1 event for the UPD type Cannot be specified.
Event log trap action definition	Destination event server Can be specified.	Destination event server For a physical host, the physical host is connected. For a logical host, the logical host is connected.
	Monitoring interval 1 to 180 seconds	Monitoring interval 60 to 86,400 seconds An interval of 5 minutes is recommended when the maximum configuration is used.
	Number of retries Cannot be specified.	Number of retries 1 to 3,600
	Retry interval Cannot be specified.	Retry interval 3 to 600 seconds
	Extended attribute name Can be specified.	Extended attribute name Cannot be specified.
Operation when manager stops	If the manager host stops or a network failure occurs between the manager host and a monitored host, an agent host can convert the event into a JP1 event, and retry transfer of the generated JP1 event to the manager host.	The log files and Windows event logs generated while JP1/IM - Manager is stopped are trapped the next time remote monitoring is started.
Operation when network fails		If network operation is restored after a failure before the maximum number of retries is reached and monitoring stops, the manager host will be notified of the log data collected during the failure period. Notification will be done only when none of the following restrictive conditions exist: The difference in the size of the log data exceeds 10 kilobytes.^#1 The size of the monitored log exceeds 64 megabytes. When the file format is WRAP2, the log was wrapped around and log data was deleted during the failure period.
Host name	A host name registered in the `hosts` file or DNS or a host name defined in `jp1hosts` or `jp1hosts2` is specified for a host name.	A host name registered in the `hosts` file or DNS is specified for a host name. The settings of `jp1hosts` and `jp1hosts2` are not referenced.

#1: If the amount of log data output during the monitoring interval exceeds this limit value in UTF-8, JP1 events cannot be displayed in JP1/IM - View. If this is a possibility, consider using log monitoring in an agent configuration. For details about the limit values, see Table 8-17 Limit values for remote monitoring.

#2: When IM Configuration Management is used, the maximum number of log file traps that can be managed is 100 for each agent host.

#3: Can be specified only if the agent's JP1/Base version is 10-00 or later.

#4: The default value is 10 kilobytes. This limit value can be changed in the remote log trap environment definition file (jp1cf_remote_logtrap.conf). For details about the remote log trap environment definition file (jp1cf_remote_logtrap.conf), see Remote log trap environment definition file (jp1cf_remote_logtrap.conf) (Chapter 2. Definition Files) in the manual JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.

For details about each function in an agent configuration, see the documentation for the JP1/Base version that is installed on the monitoring target.

To Page Top