Page tree

Unsupported content


This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

Skip to end of metadata
Go to start of metadata

This topic presents the benefits of using BMC PATROL Agent event integration:

No adapter is required to push PATROL events to cells

The BMC PATROL Agent connects directly to the BMC ProactiveNet Cell, without the need of an adapter. The agent uses an embedded communication protocol to communicate directly with the BMC ProactiveNet Cell. The BMC PATROL Agent makes a TCP connection to the BMC ProactiveNet Cell on the port (default 1828) the cell listens to. The PATROL Agent can push events directly to the cell in Basic Recorder of Objects in C (BAROC) format.

Event integration is automatically available across most supported platforms of the BMC PATROL Agent. The following platforms do_not_ support the BMC PATROL Agent:

  • OpenVMS
  • AS/400
  • Linux zSeries
  • HP-UX IA64

Better use of the cell high-availability feature

BMC PATROL Agent versions 3.9.x and earlier can push events to the BMC ProactiveNet Cell using BMC Impact Integration for BMC PATROL Adapters (better known as bii4p and mcxp in the field). While the adapters can support high availability (HA) for the cell, the adapters do not work in HA mode. In a high-availability BMC ProactiveNet Cell architecture, cell adapters can become a bottleneck with regards to high availability.

BMC PATROL Agent 9.0 makes better use of the cell high-availability feature because it directly connects to the cell. In the HA setup of the BMC ProactiveNet Cell, if the primary cell goes down, the BMC PATROL Agent establishes a TCP connection with the cell and pushes events to the secondary cell. The connection migration from primary to secondary is seamless and transparent, and the HA failover is automatically available, without manual intervention.

Better authentication management

With the event integration feature embedded into the PATROL Agent, no password management is required to authenticate PATROL Event Adapters on the PATROL Agent.

Out-of-the-box setup for BMC ProactiveNet Cell configuration

Through the BMC PATROL Agent installation utility, you can configure the PATROL Agent to forward events to BMC ProactiveNet Cells that are functioning in standalone mode or high-availability mode. In standalone mode, you only need to provide the name of the primary BMC ProactiveNet Cell.

When you enter the BMC ProactiveNet Cell configuration details, you must enter the encryption key. The encryption key is used between BMC PATROL Agent and the BMC ProactiveNet Cell while communicating BMC PATROL events.

If you do not know the BMC ProactiveNet Cell during the time of installation, you can configure the BMC PATROL Agent later by using the pconfig interface to identify the cell name or names.


/EventSetup/Configuration/EventCells = {REPLACE = “bemcellHost1/1828,bemcellHost2/1828”}
/EventSetup/Configuration/Key = {REPLACE = “mc”}

Ensure that you do not insert a space between the comma that separates the cell and name in the /EventSetup/Configuration/EventCells value.

Event caching for continuous event collection

BMC PATROL Agent with event integration ensures the delivery of events to a cell, which is a great benefit over the BMC PATROL Event Adapter-based implementation. If the connection between the BMC PATROL Agent and the cell or cell setup is interrupted, the agent caches the BAROC-formatted event blocks to a persistent cache. When the connection is resumed, the agent pushes the buffered events with the new events generated by the agent.

The default length of time that the agent caches events is 60 minutes. You can adjust the time through the pconfig interface, by modifying the the /AgentSetup/bemBufferKeepWait value. Values can range from 15 minutes to 1440 minutes (one day).

For example, the following command sets the event buffer to 120 minutes.

"/AgentSetup/bemBufferKeepWait" = { REPLACE = "120" }

The event buffer is maintained on the BMC PATROL Agent computer at the following location: <installationDirectory>/log/bemclient/bemclient-<agentPort>/imgw-bemclient-<agentPort>.dat
The <agentPort> variable is the TCP port number to which the PATROL Agent listens.


If the event generation rate is high, BMC recommends that you keep the value of the event buffer time low. When the agent-cell connection is reestablished and the agent pushes the cached events to the cell, network activity can be substantially and adversely affected during the transaction.

Use the following statistics to help determine the buffer time:

  • The event cache should not exceed 10 MB of disk space.
  • The average event triggered by the BMC PATROL Agent is about 1 KB.
  • The average number of events in 10 MB is 10,000.

Configure the event buffer based on the rate of event generation in your environment.


To prevent event loss, do not manually delete the event cache file. If you delete the event cache file, all cached and unsent Events will be lost.

Support for event macros

BMC PATROL Agent event integration provides many event macros, which you can use to refine the enrichment at the PATROL Agent, resulting in better performance of the BMC ProactiveNet Cell. For a list of supported Agent macros, see BMC PATROL Agent Reference Manual.


  • IPADDRESS is an event macro. The value of the mc_host_address slot will be the value of the macro IPADDRESS.

    "/EventSetup/Format/BiiP3/slots/mc_host_address" = { REPLACE = "%{IPADDRESS}" }
  • PARAMETER_NAME is an event macro. The value of the mc_parameter slot will be the value of the macro PARAMETER_NAME.

    "/EventSetup/Format/BiiP3/slots/mc_parameter" = { REPLACE = "%{PARAMETER_NAME}" }
  • SAN-JOSE is a hard-coded string. The value of the mc_parameter slot will be SAN-JOSE.

    "/EventSetup/Format/BiiP3/slots/mc_location"= {REPLACE = "SAN-JOSE"}

All event macros are implemented with %{<marcoName>} so that the BMC PATROL Agent can identify the macro.

With event macros, the PATROL Agent can use generic rules for event management. With generic rules, many PATROL Agents can share the same configuration and centralize event management policies.

Simplified event configuration

A BMC PATROL Agent generates many types of events, each with a specific Event Class Type. The Event Class Type is a generic framework to trigger all possible events in the availability management domain. Not every environment requires every kind of event that is triggered by the BMC PATROL Agent. For example, you might have the following requirements:

  • Only threshold based events
  • No instance update events
  • All the PSL based events
  • Availability events

With event integration, you can filter events according to your environment's needs, from the agent side, so the events never reach the cell. Whether through your environment's requirements, or the requirements of a third-party integration, you might require specific information in specific event slots, in a predefined format. The BMC PATROL Agent comes with an event enrichment framework to implement your customized enrichment configuration.

For more details about event formats, see BMC PATROL Agent Reference Manual.

You can define a group of event filtering and enrichment rules as a format container. Define your own formats to get more meaning out of the events reaching the BMC ProactiveNet Cell. Only one format can be active at a time on one PATROL Agent.

BMC PATROL Agent has a pconfig branch to configure event filtering and enrichment policies on the PATROL Agent. When an event is generated, the PATROL Agent evaluates the pconfig rules to determine whether to push the event to the BMC ProactiveNet Cell. If the agent pushes the event to the cell, then the agent applies the enrichment configuration and creates the event message block in in Basic Recorder of Objects in C (BAROC) format, as expected by the cell.

The pconfig interface for event configuration is the same pconfig for the PATROL Agent, so the agent can push event configuration through the all supported pconfig clients, such as PATROL Configuration Manager, xpconfig, wpconfig, and pconfig command-line interface.
You can generate event configuration rules on the PATROL Configuration Manager server and push those rules from the BMC ProactiveNet Central Server.

Example: Filtering events from a custom event format

For example, to define a custom event format called Virtualization, and to use the Virtualization format to implement event forwarding and filtering rules, set the following values on the pconfig variable:

/EventSetup/Configuration/Format = Virtualization

To generate the event of the customized BAROC class, PATROL_VSM_EV, first ensure that the BAROC event class is available in the BMC ProactiveNet Cell Knowledge Base. The cell is compiled with this BAROC class and restarted after compilation:

"/EventSetup/Format/Virtualization/class" = { REPLACE = "PATROL_VSM_EV" }

Filter event types at one of the following levels:

  • Catalog is a group of event types or event classes. Catalogs can be a monitoring solution name, if the monitoring solution has implemented their own catalog. Catalog "0" or "STD" is the catalog name of all the provided event types that are generated by the PATROL Agent.
  • Type is a class of event-triggering on the PATROL Agent. For example, threshold-based events are type 11, and create-instance triggers events are type UpdInst.
  • Monitoring solution name (also call a knowledge module, or KM) is the name of the monitoring solution on behalf of which the PATROL Agent triggers events.

With the hierarchy of event filtering, you can implement generic filtering rules at catalog, event type, and more specifically, the monitoring solution name.

For example, change the following pconfig entry to disable event forwarding of all events generated from the STANDARD event catalog:

"/EventSetup/Format/Virtualization/catalogs/0/active" = { REPLACE = "0" }

Make the following changes to forward events from the VSM_VC event catalog:

"/EventSetup/Format/Virtualization/catalogs/VSM_VC/active" = { REPLACE = "1" }


By default, all events are pushed to the BMC ProactiveNet Cell. You must specifically set active to 0 for each kind of filter (catalog, type, and monitoring solution name).

You can enable the forwarding of event type 11 from the STANDARD event catalog, no matter how the event forwarding is set at the catalog level:

/EventSetup/Format/Virtualization/catalogs/0/types/11/active = { REPLACE = "1" }

Make the following changes to forward event type 11, but disable events that are generated only by the AS_EVENTSPRING monitoring solution:

/EventSetup/Format/Virtualization/catalogs/0/types/11/KM/AS_EVENTSPRING/active = { REPLACE = "0" }

Make the following changes to forward NOTIFY_EVENT events to the BMC ProactiveNet Cell:

/EventSetup/Format/Virtualization/catalogs/AS_EVENTSPRING/types/NOTIFY_EVENT/active = { REPLACE = "1" }

The following video demonstrates the event filtering criteria for PATROL event propagation in the BMC ProactiveNet Performance Management version 9.0:

Use player to increase quality or switch to full screen | YouTube:

To watch the video demonstrating the overall process of PATROL Agent event filtering criteria, see Recommendations for PATROL Agent event integration.

Event enrichment

Similar to event filtering, you can configure event enrichment on the cell at three levels from the PATROL Agent. Defining PATROL Agent event enrichment rules at the PATROL Agent level propagates to the more granular level:

  • Catalog
  • Type
  • Monitoring solution name (also call a knowledge module, or KM)

For example, enrich the mc_object slot of the forwarded event class with the value of the APPINSTANCE event macro of the source events:

"/EventSetup/Format/Virtualization/slots/mc_object" = { REPLACE = "%{APPINSTANCE}" }

To override the value of the mc_object specified at the PATROL Agent level (%{APPINSTANCE}), use the value of the event macro HOSTNAME for the StartStop event from the STANDARD event catalog:

"/EventSetup/Format/Virtualization/catalogs/0/types/StartStop/slots/mc_object" = { REPLACE = "%{HOSTNAME}" }

Event filtering and enrichment will follow the precedence from generic to specific. That is, event enrichment rules at the catalog level are overridden by rules at the types level, which are overridden by rules defined at monitoring solution level.

The following image from PATROL Configuration Manager shows basic configuration for event integration and three levels of event filtering configured:

  • Catalog 0 is filtered to disable event forward
  • Type 11, within catalog 0, is filtered to disable event forward
  • Monitoring solution (KM) NT_SERVICE, within type 11 of catalog 0, is configured to forward events, overriding the properties set at catalog and type levels

Event rewording

BMC PATROL Agent event integration, with the support of event macros, offers a rich interface to reword event messages, for PATROL Agent generated events, before forwarding events to the cell. The field length is not limited, so you have enough room to relay the message that you need.


Apply the following message enrichment rule to reword all messages of event class 11:

"/EventSetup/Format/Virtualization/catalogs/0/types/11/slots/msg" = { REPLACE = "The value of %{PARAMETER_NAME} is %{PARAMETER_VALUE} %{PARAMETER_UNIT}." }

The following message is an example of the message generated with the event:
The value of Disk_FreeSpacePercent is 7.000000 %.

In this example, the event macro rules are translated as follows:

  • %{PARAMETER_NAME} value is Disk_FreeSpacePercent
  • %{PARAMETER_VALUE} value is 7.000000
  • %{PARAMETER_UNIT} value is %

Easy migration from cell adapters to direct connection

The BMC PATROL Agent provides default configurations for event enrichment and filtering, which are compatible with the default configuration provided with the biip3 and bii4p BMC ProactiveNet Cell adapters.

  • If you did not customize event filtering or enrichment rules on PATROL Event Adapters, you can migrate to the PATROL Agent with direct connection to the cell.
  • If you customized PATROL Event Adapters for event filtering, you can migrate to the PATROL Agent with direct connection feature by implementing pconfig rules as described in Simplified event configuration.
  • No labels