Page tree

Unsupported content

 

This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

Skip to end of metadata
Go to start of metadata

This topic presents recommendations for BMC PATROL Agent event integration in the following areas:

PATROL Agents and the cell on the same network

In BMC ProactiveNet architecture, hundreds of PATROL Agents push events to a single cell setup, whether in a stand-alone environment or in a high-availability environment. As the number of generated events rise, and their frequency increases, the network bandwidth usage increases between the cell and the PATROL Agent hosts. To identify network congestion, look for delays or loss between the event generation on the PATROL Agent and the event reaching the BMC ProactiveNet Cell.

To avoid network congestion on the cell, implement site-specific cells (that is, cells on the same network) and propagate events from the propagator cells to the BMC ProactiveNet Central Server.

If data collection and event integration are going to the BMC ProactiveNet Server, you can use the same host for event and data forwarding (from a remote cell and Integration Service) to the BMC ProactiveNet Server.

Cell selection for load balancing in remote monitoring and notification servers

A BMC PATROL Agent with remote monitoring solutions triggers more events than physical monitoring, and the number of events is directly proportional to number of instances discovered by the BMC PATROL Agent.

Example

With BMC Performance Manager for Virtual Servers Knowledge Modules, you can monitor thousands of VMs with a single instance of a PATROL Agent. This large number of VM monitoring can trigger events at significantly large frequencies. Configure a dedicated cell to receive events from the BMC PATROL Agent to control both the event processing and the network usage on the BMC ProactiveNet Cells.

To control the network usage, you can have both the BMC PATROL Agent and the cell on the same host. The installed cell on the BMC PATROL Agent can process event management for the local agent, and then propagate to the central cell.

Be judicial while selecting the cells for the PATROL Agent to forward the events in case of all remote monitoring solutions like, UNIX, Windows, or while configuring the cell for Notification Servers.

Configure a remote cell for first-level forwarding

Configure BMC PATROL Agent to push events to a remote cell, and then propagate to the BMC ProactiveNet Server Cell. BMC does not recommend configuring agents to send events directly to the server cell. In this way, event processing rules run on the remote cells and the BMC ProactiveNet Server receives events that have already been filtered or processed on the remote cells.

Scalability guidelines for BMC PATROL Agent event integration

A single BMC ProactiveNet Cell environment (for standalone or for HA) can accept connections from 500 BMC PATROL Agents and 350 events per minute. These values can vary with the number of processing rules executed against the PATROL Agent events that hit on the BMC ProactiveNet Cell. Implement multiple instances of of the cell if you expect a higher event load from the PATROL Agent.

The scalability figures are based on the number of events per minute that the BMC PATROL Agent forwards to the cell, and on the number of event source clients are connected to the cell.

Scalability for event integration is not a consideration from the BMC PATROL Agent side, however you should consider the event processing scalability matrix of the cell. For details about cell scalability, see BMC Impact Manager Solutions Guide.

The BMC PATROL Agent registers with the BMC ProactiveNet Cell with program prefix bemclient-. To see a list of PATROL Agents successfully connected to a secondary cell after failover, use the following command on the cell host:

$mgetinfo  –n  Cellname connect –v  | grep "bemclient"

Note

The BMC PATROL Agent will not try to connect to a recovery cell unless the agent has at least one event message in the event cache to push to the cell during or after failover. If you see that some of the connections do not appear in the recovery cell, trigger a custom (manual) event to force the BMC PATROL Agent to send a connection request to the BMC ProactiveNet Cell. This feature safeguards against flooding the cell with hundreds of connection requests immediately after failover.

Firewall considerations

If a firewall stands between the BMC PATROL Agent and the BMC ProactiveNet Cell, add the cell listening port number (1828, by default) for the primary and secondary servers to the firewall exclusion list. To test the connection across the firewall, from the agent to the cell, telnet on the port number from the agent host to the cell host. Use the following syntax:

telnet <cellHost> <portNumber>
  • <cellHost> represents the the host name or IP address of the BMC ProactiveNet Cell.
  • <portNumber> represents the cell listening port number (1828, by default).

Write a custom event format to drive more meaning out of the events pushed to the BMC ProactiveNet Cell.

Event filtering at the PATROL Agent

Filter events triggered by the BMC PATROL Agent at the source, that is, at the BMC PATROL Agent, so that only the event class types that you require are pushed to the cell. By controlling the event flood on the cell, you can control the network load and the event-processing load on the cell.

For information about BMC PATROL Agent event filtering criteria, see the following videos.

BMC PATROL Agent event filtering criteria - Part 1

The following video demonstrates the event filtering concepts and overall process of PATROL Agent event filtering criteria:

Use player to increase quality or switch to full screen | YouTube: http://www.youtube.com/watch?v=P1u7mbA6VC4

BMC PATROL Agent event filtering criteria - Part 2

To watch the video demonstrating event filtering criteria for PATROL event propagation in the BMC ProactiveNet Performance Management version 9.0, see Benefits of adopting the BMC PATROL Agent event integration

BMC PATROL Agent event filtering criteria - Part 3

The following video demonstrates how to determine event filter criteria in the BMC PATROL Agent for Windows Event Log entries from the Windows Operating System Event Log.

Use player to increase quality or switch to full screen | YouTube: http://www.youtube.com/watch?v=5av1-M0Qd88

Video contents

0:55

Key concepts and analysis steps

1:28

Analysis of filter definitions with examples

2:30

Event management cell in BMC ProactiveNet Operations Console

2:50

Configuring Windows Operating System KM

3:32

Creating filters

6:12

Configuring event forwarding

7:02

Generating an event in the Windows Event Log

7:32Viewing Event Manager in PATROL Console
9:35Verifying the event in the BMC ProactiveNet Operations Console

Event enrichment at the PATROL Agent

Similar to event filtering, enrich PATROL Agent event generation at the source, so that event enrichment rules are decentralized. By controlling the event triggers with event enrichment rules, you can ease the load on the BMC ProactiveNet Cell.

For more information about configuring PATROL Agent event propogation, see the following video:

Use player to increase quality or switch to full screen | YouTube: http://www.youtube.com/watch?v=syEFESikcBk

Propagation to multiple cells

Your environment or requirements might use multiple cells, each with a distinct operation, such as one for reporting and one for ticket generation. To push events to multiple cells, configure the PATROL Agent to push events to the first level cell, and configure that cell to propagate events to additional cells:

For cell high-availability configuration, see BMC ProactiveNet Knowledge Base Development Reference Guide.

Event integration and Event Management Monitoring Solution

You can implement BMC PATROL Agent event integration with the BMC Event Management Monitoring Solution, from the Notification Server or from the Remote Agent.

Event Management Monitoring Solution on the Notification Server triggers the following events:

  • REMOTE_NOTIFY_EVENT for events triggered on a PATROL Remote Agent
  • NOTIFY_EVENT for events triggered on a local agent

The filters applied to the Notification Server and the Remote Server on the Event Management Monitoring Solution are given precedence.

After upgrade, you can configuration the Notification Servers to forward all the REMOTE_NOTIFY_EVENT events directly to the cell, which removes the middleware adapter.

If you want to push only the Event Management Monitoring Solution catalog to the BMC ProactiveNet Cell, then use the following rule to filter the event generated from the STANDARD event catalog:

"/EventSetup/Format/Virtualization/catalogs/0/active" = { REPLACE = "0" }


To enable NOTIFY_EVENT forwarding to the cell, you must enable the AS_EVENTSPRING catalog for event forwarding:

"/EventSetup/Format/Virtualization/catalogs/AS_EVENTSPRING/active" = { REPLACE = "0" }


This will push the REMOTE_NOTIFY_EVENT to the cell with the following default message slot:

"REMOTE_NOTIFY_EVENT Message: icalbro-JK4BVQ1 NT_SERVICES.SERVICES_wscsvc.ServiceStatus ALARM:value=3 at 05/28/2012 13:19:35

Remote Event Details:

icalbro-JK4BVQ1,137.72.224.11,3256,3256,NT_SERVICES,SERVICES_wscsvc,Security Center,/NT_SERVICES_CONTAINER/NT_SERVICES_CONTAINER,ServiceStatus,ALARM,3,05/28/2012,13:19:35,India Standard Time,3.00 ,3.00,1338191374,0.00,1406,,NT 5.1 Service Pack 3, v.6165,3,3,,,V9.0.00i,D:\PROGRA~1\BMCSOF~1\PATROL3\,0,11,OPEN,4"

To forward events directly to the BMC ProactiveNet Cell, BMC recommends migrating from the Event Management Monitoring Solution to the BMC PATROL Agent event integration feature. BMC PATROL Agent event integration enhances performance by managing events directly through the BMC PATROL Agent native code, and not through the PATROL Script Language (PSL) processing of the Event Management Monitoring Solution.