IBM Tivoli Monitoring: Resource Model Reference Guide

Tivoli® IBM Tivoli Monitoring

Resource Model Reference Guide

Version 5.1.2

SH19-4570-04

��

Note

Before using this information and the product it supports, be sure to read the general information under “Notices”

on page 265.

Fifth Edition (July 2005)

This edition applies to version 5 release 1 modification level 2 of IBM Tivoli Monitoring and to all subsequent

releases and modifications until otherwise indicated in new editions.

This edition replaces SH19-4570-03.

© Copyright International Business Machines Corporation 1999, 2005. All rights reserved.

US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract

with IBM Corp.

Contents

About this guide . . . . . . . . . . vii

Who should read this guide . . . . . . . . . vii

What this reference contains . . . . . . . . . vii

Publications . . . . . . . . . . . . . . viii

IBM Tivoli Monitoring library . . . . . . . viii

Prerequisite publications . . . . . . . . . ix

Related publications . . . . . . . . . . ix

Accessing publications online . . . . . . . . x

Ordering publications . . . . . . . . . . x

Accessibility . . . . . . . . . . . . . . x

Tivoli technical training . . . . . . . . . . . x

Support information . . . . . . . . . . . xi

Conventions used in this guide . . . . . . . . xi

Typeface conventions . . . . . . . . . . xi

Operating system-dependent variables and paths xi

Tivoli command syntax . . . . . . . . . xii

Chapter 1. Introduction . . . . . . . . 1

Prerequisite software for resource models . . . . . 1

Running Tivoli commands . . . . . . . . . . 2

Running Tivoli commands on UNIX operating

systems . . . . . . . . . . . . . . . 3

Running Tivoli commands on Windows operating

systems . . . . . . . . . . . . . . . 3

Where to find additional information about shells 4

Establishing the Tivoli environment within a shell 4

Establishing the Tivoli environment on an

endpoint . . . . . . . . . . . . . . . 5

Common parameters . . . . . . . . . . . 5

Chapter 2. Windows resource models . . 7

Collect Configuration resource model . . . . . . 7

Description . . . . . . . . . . . . . . 7

Logging . . . . . . . . . . . . . . . 7

Event Log resource model . . . . . . . . . . 8

Description . . . . . . . . . . . . . . 8

About the Windows Event Log resource model . . 8

Indications and events . . . . . . . . . . 9

Thresholds . . . . . . . . . . . . . 13

Built-in actions . . . . . . . . . . . . 13

Logical Disk resource model . . . . . . . . . 14

Description . . . . . . . . . . . . . 14

Prerequisites . . . . . . . . . . . . . 15


Thresholds . . . . . . . . . . . . . 21

Logging . . . . . . . . . . . . . . 21

Memory resource model . . . . . . . . . . 22

Description . . . . . . . . . . . . . 22


Thresholds . . . . . . . . . . . . . 39

Logging . . . . . . . . . . . . . . 39

Network Interface Card resource model . . . . . 41

Description . . . . . . . . . . . . . 41

Prerequisites . . . . . . . . . . . . . 42


Thresholds . . . . . . . . . . . . . 56

Built-in actions . . . . . . . . . . . . 57

Logging . . . . . . . . . . . . . . 57

Parametric Event Log resource model . . . . . 59

Description . . . . . . . . . . . . . 59


Parameters . . . . . . . . . . . . . 61

Parametric Services resource model . . . . . . 62

Description . . . . . . . . . . . . . 62


Parameters . . . . . . . . . . . . . 65

Built-in actions . . . . . . . . . . . . 65

Logging . . . . . . . . . . . . . . 65

Parametric TCP/IP Ports resource model . . . . 65

Description . . . . . . . . . . . . . 65

Prerequisites . . . . . . . . . . . . . 66


Parameters . . . . . . . . . . . . . 67

Logging . . . . . . . . . . . . . . 67

Physical Disk resource model . . . . . . . . 67

Description . . . . . . . . . . . . . 67


Thresholds . . . . . . . . . . . . . 73

Logging . . . . . . . . . . . . . . 74

Printer resource model . . . . . . . . . . 74

Description . . . . . . . . . . . . . 74


Thresholds . . . . . . . . . . . . . 80

Logging . . . . . . . . . . . . . . 80

Process resource model . . . . . . . . . . 81

Description . . . . . . . . . . . . . 81


Thresholds . . . . . . . . . . . . . 83

Logging . . . . . . . . . . . . . . 83

Processor resource model . . . . . . . . . . 84

Description . . . . . . . . . . . . . 84


Thresholds . . . . . . . . . . . . . 91

Logging . . . . . . . . . . . . . . 91

Server Performance Prediction resource model . . . 92

Description . . . . . . . . . . . . . 92

Prerequisites . . . . . . . . . . . . . 93

Parameters . . . . . . . . . . . . . 94

Logging . . . . . . . . . . . . . . 94

Services resource model . . . . . . . . . . 96

Description . . . . . . . . . . . . . 96


Thresholds . . . . . . . . . . . . . 98

Built-in actions . . . . . . . . . . . . 100

TCP/IP resource model . . . . . . . . . . 100

Description . . . . . . . . . . . . . 100

Prerequisites . . . . . . . . . . . . . 101

Indications and events . . . . . . . . . 101

Thresholds . . . . . . . . . . . . . 103

Logging . . . . . . . . . . . . . . 104

© Copyright IBM Corp. 1999, 2005 iii

Chapter 3. UNIX and Linux resource

models . . . . . . . . . . . . . . 107

CPU resource model . . . . . . . . . . . 107

Description . . . . . . . . . . . . . 107

Prerequisites . . . . . . . . . . . . . 107


Thresholds . . . . . . . . . . . . . 109

Logging . . . . . . . . . . . . . . 109

Description of the MOF file properties . . . . 110

File resource model . . . . . . . . . . . 111

Description . . . . . . . . . . . . . 111


Parameters . . . . . . . . . . . . . 113

Logging . . . . . . . . . . . . . . 113


File System resource model . . . . . . . . . 113

Description . . . . . . . . . . . . . 113


Thresholds . . . . . . . . . . . . . 117

Parameters . . . . . . . . . . . . . 117

Logging . . . . . . . . . . . . . . 119


Memory resource model . . . . . . . . . . 120

Description . . . . . . . . . . . . . 120


Thresholds . . . . . . . . . . . . . 123

Logging . . . . . . . . . . . . . . 123


Network Interface resource model . . . . . . 124

Description . . . . . . . . . . . . . 124

Prerequisites . . . . . . . . . . . . . 125


Thresholds . . . . . . . . . . . . . 129

Parameters . . . . . . . . . . . . . 130

Logging . . . . . . . . . . . . . . 130


Network RPC-NFS resource model . . . . . . 131

Description . . . . . . . . . . . . . 131


Thresholds . . . . . . . . . . . . . 139

Logging . . . . . . . . . . . . . . 140


Physical Disk resource model . . . . . . . . 142

Description . . . . . . . . . . . . . 142

Prerequisites . . . . . . . . . . . . . 143

Special considerations . . . . . . . . . 143


Thresholds . . . . . . . . . . . . . 148

Logging . . . . . . . . . . . . . . 148

Process resource model . . . . . . . . . . 148

Description . . . . . . . . . . . . . 148


Thresholds . . . . . . . . . . . . . 151

Parameters . . . . . . . . . . . . . 152

Logging . . . . . . . . . . . . . . 154


Security resource model . . . . . . . . . . 155

Description . . . . . . . . . . . . . 155


Parameters . . . . . . . . . . . . . 160

Logging . . . . . . . . . . . . . . 160


Server Performance Prediction resource model . . 161

Description . . . . . . . . . . . . . 161

Prerequisites . . . . . . . . . . . . . 162

Parameters . . . . . . . . . . . . . 162

Logging . . . . . . . . . . . . . . 163


Chapter 4. OS/400 resource models 167

ASP Disk Mirroring resource model . . . . . . 167

Description . . . . . . . . . . . . . 167


Parameters . . . . . . . . . . . . . 169

ASP Utilization resource model . . . . . . . 170

Description . . . . . . . . . . . . . 170


Parameters . . . . . . . . . . . . . 173

Logging . . . . . . . . . . . . . . 173

Basic Average CPU Utilization resource model . . 174

Description . . . . . . . . . . . . . 174


Logging . . . . . . . . . . . . . . 178

Basic Interactive CPU Utilization resource model 179

Description . . . . . . . . . . . . . 179


Logging . . . . . . . . . . . . . . 183

Configuration Objects resource model . . . . . 185

Description . . . . . . . . . . . . . 185


Parameters . . . . . . . . . . . . . 186

Database CPU Utilization resource model . . . . 187

Description . . . . . . . . . . . . . 187


Logging . . . . . . . . . . . . . . 188

Distribution Queues resource model . . . . . . 189

Description . . . . . . . . . . . . . 189


Parameters . . . . . . . . . . . . . 190

History Log resource model . . . . . . . . 191

Description . . . . . . . . . . . . . 191


Parameters . . . . . . . . . . . . . 192

History Log with Format Configuration resource

model . . . . . . . . . . . . . . . . 192

Description . . . . . . . . . . . . . 192


Parameters . . . . . . . . . . . . . 194

Interactive Feature CPU Utilization resource model 196

Description . . . . . . . . . . . . . 196


Logging . . . . . . . . . . . . . . 197

Job Log resource model . . . . . . . . . . 198

Description . . . . . . . . . . . . . 198


Parameters . . . . . . . . . . . . . 199

Job Queue resource model . . . . . . . . . 201

Description . . . . . . . . . . . . . 201


Parameters . . . . . . . . . . . . . 203

Job Status Events resource model . . . . . . . 204

Description . . . . . . . . . . . . . 204

iv IBM Tivoli Monitoring: Resource Model Reference Guide

||||||||||||||

| | | | | | | | |


Parameters . . . . . . . . . . . . . 205

Management Central Events resource model . . . 206

Description . . . . . . . . . . . . . 206


Network Attributes resource model . . . . . . 209

Description . . . . . . . . . . . . . 209


Parameters . . . . . . . . . . . . . 210

Output Queues resource model . . . . . . . 211

Description . . . . . . . . . . . . . 211


Parameters . . . . . . . . . . . . . 212

Parametric Object and Files resource model . . . 213

Description . . . . . . . . . . . . . 213


Parameters . . . . . . . . . . . . . 215

Storage Pools resource model . . . . . . . . 216

Description . . . . . . . . . . . . . 216

Parameters . . . . . . . . . . . . . 216

Logging . . . . . . . . . . . . . . 216

Subsystem Status resource model . . . . . . . 218

Description . . . . . . . . . . . . . 218


Parameters . . . . . . . . . . . . . 219

System Disk Resources resource model . . . . . 220

Description . . . . . . . . . . . . . 220


Logging . . . . . . . . . . . . . . 222

System Value resource model . . . . . . . . 223

Description . . . . . . . . . . . . . 223


Parameters . . . . . . . . . . . . . 224

TCP Interface resource model . . . . . . . . 225

Description . . . . . . . . . . . . . 225


Parameters . . . . . . . . . . . . . 226

TCP Service resource model . . . . . . . . 227

Description . . . . . . . . . . . . . 227


Parameters . . . . . . . . . . . . . 228

Chapter 5. Generic resource models 229

Generic Script resource model . . . . . . . . 229

Description . . . . . . . . . . . . . 229

TEC event . . . . . . . . . . . . . 229

Parameters . . . . . . . . . . . . . 230

Logging . . . . . . . . . . . . . . 232

Error states . . . . . . . . . . . . . 233

Appendix A. Windows correlated

events . . . . . . . . . . . . . . 235

Busy drive from high paging . . . . . . . . 236

Busy drive from low avail . . . . . . . . . 237

Congested TCP network . . . . . . . . . . 238

Critically low disk space . . . . . . . . . 239

Critical memory leak . . . . . . . . . . . 240

Faulty disk subsystem . . . . . . . . . . 241

High disk read bytes per second . . . . . . . 242

High disk write bytes per second . . . . . . . 243

High drive transfer rate . . . . . . . . . . 244

High percent disk time . . . . . . . . . . 245

Possible disk fragmentation . . . . . . . . 246

Process hogging CPU . . . . . . . . . . . 247

Slow hard drive . . . . . . . . . . . . 248

Appendix B. Windows return codes

for built-in actions . . . . . . . . . 249

All built-in actions . . . . . . . . . . . . 249

Built-in actions of the event log resource model 250

Enlarge IRP stack size action . . . . . . . 250

Delete registry action . . . . . . . . . . 250

Raise session time out action . . . . . . . 250

Built-in actions of the Network Interface Card

resource model . . . . . . . . . . . . . 251

Adjust initial work items action . . . . . . 251

Adjust maximum work items action . . . . . 251

Built-in actions of the Service resource model . . . 252

Restart service action . . . . . . . . . . 252

Appendix C. MOF file properties . . . 253

DMXCpu.mof . . . . . . . . . . . . . 253

DMXFile.mof . . . . . . . . . . . . . 253

DMXFileSystem.mof . . . . . . . . . . . 254

DMXMemory.mof . . . . . . . . . . . . 254

DMXNetworkInterface.mof . . . . . . . . . 255

DMXNetworkRPCNFS.mof . . . . . . . . . 255

DMXPhysicalDisk.mof . . . . . . . . . . 256

DMXProcess.mof . . . . . . . . . . . . 257

DMXSecurity.mof . . . . . . . . . . . . 257

DMXSystem.mof . . . . . . . . . . . . 258

HistoryDMXLogCfgFmt.mof . . . . . . . . 258

Appendix D. Support information . . . 261

Searching knowledge bases . . . . . . . . . 261

Searching the information center . . . . . . 261

Searching the Internet . . . . . . . . . 261

Obtaining fixes . . . . . . . . . . . . . 261

Receiving weekly support updates . . . . . . 262

Contacting IBM Software Support . . . . . . 263

Determining the business impact . . . . . . 263

Describing problems and gathering information 264

Submitting problems . . . . . . . . . . 264

Notices . . . . . . . . . . . . . . 265

Trademarks . . . . . . . . . . . . . . 267

Glossary . . . . . . . . . . . . . 269

Index . . . . . . . . . . . . . . . 273

Contents v

||||||||||||

| |

| |

| | | | | | | | | | | | | | | | | | | |

vi IBM Tivoli Monitoring: Resource Model Reference Guide

About this guide

The IBM® Tivoli® Monitoring product enables you to monitor the availability and

performance status of your system resources to identify bottlenecks and potential

resource problems. The IBM Tivoli Monitoring: Resource Model Reference Guide

provides key information about the resource models included in this product.

Note: The IBM Tivoli Monitoring product was formerly known as Tivoli

Distributed Monitoring (Advanced Edition).

Who should read this guide

The target audience for this guide is system administrators responsible for the

installation of Tivoli products and patches, system managers, and database

administrators who use Tivoli products to manage resources.

Users of this guide should be familiar with the following topics:

v Tivoli management software

v System administration on systems where you plan to install Tivoli Monitoring

components, and systems that you plan to monitor using the product

v UNIX® and Linux® operating systems

v Windows® operating systems

v OS/400® operating systems

v Tivoli Enterprise™ Data Warehouse

v IBM Tivoli Enterprise Console®

v IBM Tivoli Business Systems Manager (optional)

What this reference contains

This reference contains the following chapters and appendixes:

v Chapter 1, “Introduction,” on page 1 provides an introduction to using IBM

Tivoli Monitoring resource models, resource model prerequisites, and

instructions on setting up the Tivoli environment.

v Chapter 2, “Windows resource models,” on page 7 provides an alphabetical

listing of each Windows resource model with a detailed description of the

resource model.

v Chapter 3, “UNIX and Linux resource models,” on page 107 provides an

alphabetical listing of each UNIX and Linux resource model with a detailed

description of the resource model.

v Chapter 4, “OS/400 resource models,” on page 167 provides an alphabetical

listing of each OS/400 resource model with a detailed description of the resource

model.

v Chapter 5, “Generic resource models,” on page 229, provides information about

the Generic Script resource mode, whichl enables you to use your own scripts to

monitor resources.

v Appendix A, “Windows correlated events,” on page 235 describes all correlated

events and the indications from which each one is generated.

© Copyright IBM Corp. 1999, 2005 vii

v Appendix B, “Windows return codes for built-in actions,” on page 249 describes

the return codes for built-in actions for resource models running on

Windows-based operating systems.

v Appendix C, “MOF file properties,” on page 253 describes the MOF files used by

the resource models and the CIM classes and properties which they define.

v Appendix D, “Support information,” on page 261 describes possible options for

obtaining support for IBM software products.

Publications

This section lists publications in the IBM Tivoli Monitoring library and other

related documents. It also describes how to access Tivoli publications online, and

how to order Tivoli publications.

IBM Tivoli Monitoring library

The following documents are available in the IBM Tivoli Monitoring library:

v IBM Tivoli Monitoring: User’s Guide, SH19-4569

Describes how to install, customize, and use IBM Tivoli Monitoring to manage

system and application resources.

v IBM Tivoli Monitoring: Resource Model Builder User’s Guide, SH32-1391

Describes how to use the IBM Tivoli Monitoring Resource Model Rule Builder

(formerly known as Workbench) to create new resource models or to modify

existing ones.

v IBM Tivoli Monitoring: Problem Determination Guide, SH19-8520

Provides information and messages to assist users with troubleshooting

problems with the software.

v IBM Tivoli Monitoring: Resource Model Builder Problem Determination Guide,

SC32-1392

Describes the tools and troubleshooting techniques for doing problem

determination for the Resource Model Builder.

v IBM Tivoli Monitoring: Resource Model Reference Guide, SH19-4570

Provides information about using and customizing resource models that can be

used with IBM Tivoli Monitoring.

v IBM Tivoli Monitoring: Release Notes, GI10-5797

Provides the most current information about IBM Tivoli Monitoring.

v IBM Tivoli Monitoring: Deployment Supplement, SC23-4799

Describes how to use the deployment wizard for a custom installation.

v IBM Tivoli Monitoring: Road Map for a Typical Installation, GI11-0938

Describes typical installation scenarios.

Versions of these documents in PDF and HTML formats can be found on the IBM

Tivoli Monitoring product CDs. They are stored in the Books directory, and can be

accessed by selecting the file Books/infocenter.html file with your Web browser.

This displays an HTML page from which all of the documents can be accessed in

either format.

Any updated versions of these documents are placed on the Tivoli Software

Information Center Web site. See “Accessing publications online” on page x for

additional information about updated documentation.

Introduction: What this reference contains

viii IBM Tivoli Monitoring: Resource Model Reference Guide

Prerequisite publications

To use the information in this guide effectively, you must have some prerequisite

knowledge, which you can get from the following guides:

v Tivoli Management Framework: Installation Guide

Provides information about installing and setting up the Tivoli® Management

Framework and Tivoli environment.

v Tivoli Management Framework: Planning for Deployment Guide

Provides information about the architecture provided by Tivoli Management

Framework and the choices to consider when planning the deployment of a

Tivoli environment.

v Tivoli Management Framework: User’s Guide

Provides the concepts and procedures for using Tivoli Management Framework

services.

v Tivoli Management Framework: Reference Manual

Provides detailed information about Tivoli Management Framework commands,

writing scripts that are later run as Tivoli tasks, and Tivoli-provided tasks.

Related publications

The following documents also provide useful information:

v Tivoli Distributed Monitoring (Classic Edition) Release Notes

Provides updated information about the Tivoli Distributed Monitoring (Classic

Edition) product (formerly known as Tivoli Distributed Monitoring).

v Tivoli Decision Support for Server Performance Prediction: Release Notes

Provides updated information about the integration of Tivoli Decision Support

for Server Performance Prediction with Tivoli Distributed Monitoring (Advanced

Edition).

v Tivoli Software Installation Service: User’s Guide

Provides task-oriented information on how to import, manage, and install Tivoli

Management Environment® software on selected machines and managed nodes

within your Tivoli management region.

v Tivoli Software Installation Service: Release Notes

Provides important information about using and installing the Tivoli Software

Installation Service (SIS).

v IBM Tivoli Enterprise Console: Rule Builder’s Guide

Provides information about using the IBM Tivoli Enterprise Console rule editor

and graphical rule builder to modify existing rules and create new rules to

match your specific event management needs.

v IBM Tivoli Enterprise Console: Release Notes, Version 3.7 or later

Provides the most current information about IBM Tivoli Enterprise Console.

v Tivoli Business Systems Management: Distributed User’s Guide, Version 1.5 (if you

intend to use Tivoli Business Systems Manager to monitor IBM Tivoli

Monitoring events)

Describes how to use the Tivoli Business Systems Manager product.

v Tivoli Business Systems Management: Console User’s Guide, Version 1.5 (if you

intend to use Tivoli Business Systems Manager to monitor IBM Tivoli

Monitoring events)

Describes how to use the Tivoli Business Systems Manager console.

About this guide: Publications

About this guide ix

The Tivoli Software Glossary includes definitions for many of the technical terms

related to Tivoli software. The Tivoli Software Glossary is available, in English only,

at the following Web site:

http://publib.boulder.ibm.com/tividd/glossary/termsmst04.htm

Accessing publications online

The documentation CD contains the publications that are in the product library.

The format of the publications is PDF, HTML, or both. Refer to the readme file on

the CD for instructions on how to access the documentation. IBM posts

publications for this and all other Tivoli products, as they become available and

whenever they are updated, to the Tivoli software information center Web site.

Access the Tivoli software information center by first going to the Tivoli software

library at the following Web address:

http://www.ibm.com/software/tivoli/library

Scroll down and click the Product manuals link. In the Tivoli Technical Product

Documents Alphabetical Listing window, click the Tivoli Monitoring link to access

the product library at the Tivoli software information center.

Note: If you print PDF documents on other than letter-sized paper, set the option

in the File —> Print window that allows Adobe Reader to print letter-sized

pages on your local paper.

Ordering publications

You can order many Tivoli publications online at the following Web site:

http://www.elink.ibmlink.ibm.com/public/applications/publications/

cgibin/pbi.cgi

You can also order by telephone by calling one of these numbers:

v In the United States: 800-879-2755

v In Canada: 800-426-4968

In other countries, contact your software account representative to order Tivoli

publications.

Accessibility

Accessibility features help users with a physical disability, such as restricted

mobility or limited vision, to use software products successfully. With this product,

you can use assistive technologies to hear and navigate the interface. You can also

use the keyboard instead of the mouse to operate most features of the graphical

user interface.

For additional information, see the Accessibility Appendix in the user’s guide for

this product.

Tivoli technical training

For Tivoli technical training information, refer to the following IBM Tivoli

Education Web site:

http://www.ibm.com/software/tivoli/education

About this guide: Publications

x IBM Tivoli Monitoring: Resource Model Reference Guide

http://publib.boulder.ibm.com/tividd/glossary/termsmst04.htm

http://www.ibm.com/software/tivoli/library

http://www.ibm.com/shop/publications/order

http://www.ibm.com/shop/publications/order

http://www.ibm.com/software/tivoli/education

Support information

If you have a problem with your IBM software, you want to resolve it quickly. IBM

provides the following ways for you to obtain the support you need:

v Searching knowledge bases: You can search across a large collection of known

problems and workarounds, Technotes, and other information.

v Obtaining fixes: You can locate the latest fixes that are already available for your

product.

v Contacting IBM Software Support: If you still cannot solve your problem, and

you need to work with someone from IBM, you can use a variety of ways to

contact IBM Software Support.

For more information about these three ways of resolving problems, see

Appendix D, “Support information,” on page 261.

Conventions used in this guide

This guide uses several conventions for special terms and actions, and operating

system-dependent commands and paths.

Typeface conventions

This guide uses the following typeface conventions:

Bold

v Lowercase commands and mixed case commands that are

otherwise difficult to distinguish from surrounding text

v Interface controls (check boxes, push buttons, radio buttons, spin

buttons, fields, folders, icons, list boxes, items inside list boxes,

multicolumn lists, containers, menu choices, menu names, tabs,

property sheets) and labels (such as Tip:, and Operating system

considerations:)

v Keywords and parameters in text

Italic

v Words defined in text

v Emphasis of words (words as words)

v New terms in text (except in a definition list)

v Variables and values you must provide

Monospace

v Examples and code examples

v File names, programming keywords, and other elements that are

difficult to distinguish from surrounding text

v Message text and prompts addressed to the user

v Text that the user must type

v Values for arguments or command options

Operating system-dependent variables and paths

The publications in this library use the UNIX convention for specifying

environment variables and for directory notation.

About this guide: Accessibility

About this guide xi

When using the Windows command line, replace $variable with %variable% for

environment variables and replace each forward slash (/) with a backslash (\) in

directory paths. The names of environment variables are not always the same in

Windows and UNIX.

Note: If you are using the bash shell on a Windows system, you can use the UNIX

conventions.

Tivoli command syntax

The following special characters define Tivoli command syntax:

[ ] Identifies elements that are optional. Required elements do not have

brackets around them.

... Indicates that you can specify multiple values for the previous element.

Separate multiple values by a space, unless otherwise directed by

command information.

If the ellipsis for an element follows a closing bracket, use the syntax

within the brackets to specify multiple values. For example, to specify two

administrators for the option [–a admin]..., use –a admin1 –a admin2.

If the ellipsis for an element is within the brackets, use the syntax of the

last element to specify multiple values. For example, to specify two hosts

for the option [–h host...], use –h host1 host2.

| Indicates mutually exclusive information. You can use the element on

either the left or right of the vertical bar.

{ } Delimits a set of mutually exclusive elements when a command requires

one of them. Brackets ([ ]) are around elements that are optional.

In addition to the special characters, Tivoli command syntax uses the typeface

conventions described in the Preface of this document.

The following examples illustrate the typeface conventions used in Tivoli

command syntax:

v wcrtpr [–a admin]... [–s region] [–m resource]... name

The name argument is the only required element for the wcrtpr command. The

brackets around the options indicate they are optional. The ellipsis after the –a

admin resource option means that you can specify multiple administrators

multiple times. The ellipsis after the –m resource option means that you can

specify multiple resources multiple times.v wchkdb [–o outfile] [–u] [–x] {–f infile | –i | object...}

The –f, –i, and object elements are mutually exclusive. Braces that surround

elements indicate that you are including a required element. If you specify the

object argument, you can specify more than one object.

About this guide: Conventions used in this guide

xii IBM Tivoli Monitoring: Resource Model Reference Guide

Chapter 1. Introduction

This book is a reference guide designed for use with the procedures described in

the IBM Tivoli Monitoring: User’s Guide. It provides alphabetical listings and

detailed descriptions of the following software functions:

v Resource models

v Tasks

v Server commands

Prerequisite software for resource models

Information about prerequisite software required to run IBM Tivoli Monitoring

resource models is provided in the individual sections for each resource model.

The following tables list all resource models, by operating system, that require

additional steps or software to run the resource model.

The following table lists the resource models for Windows operating systems and

where to locate prerequisite information required to run the resource model.

Table 1. Prerequisites for Windows resource models

Windows resource model name Location of prerequisite information

Collect Configuration None required.

Event Log None required.

Logical Disk “Prerequisites” on page 15.

Memory None required.

Network Interface Card “Prerequisites” on page 42.

Parametric Event Log None required.

Parametric Services None required.

Parametric TCP/IP Ports “Prerequisites” on page 66.

Physical Disk None required.

Printer None required.

Process None required.

Processor None required.

Server Performance Prediction “Prerequisites” on page 93.

Services None required.

TCP/IP “Prerequisites” on page 101.

The following table lists the resource models for UNIX and Linux operating

systems and where to locate prerequisite information required to run the resource

model.

Table 2. Prerequisites for UNIX and Linux resource models

UNIX and Linux resource model name Location of prerequisite information

CPU “Prerequisites” on page 107.

File None required.

© Copyright IBM Corp. 1999, 2005 1

Table 2. Prerequisites for UNIX and Linux resource models (continued)

UNIX and Linux resource model name Location of prerequisite information

File System None required.

Memory None required.

Network Interface “Prerequisites” on page 125.

Network RPC-NFS None required.

Process None required.

Security None required.

Server Performance Prediction “Prerequisites” on page 162.

The following table lists the resource models for OS/400 operating systems and

where to locate prerequisite information required to run the resource model.

Table 3. Prerequisites for OS/400 resource models

OS/400 resource model name Location of prerequisite information

ASP Disk Mirroring None required.

ASP Utilization None required.

Basic Average CPU Utilization None required.

Basic Interactive CPU Utilization None required.

Configuration Objects None required.

Database CPU Utilization None required.

Distribution Queues None required.

History Log None required.

Interactive Feature CPU Utilization None required.

Job Log None required.

Job Queue None required.

Job Status Events None required.

Management Central Events None required.

Network Attributes None required.

Output Queues None required.

Parametric Object and Files None required.

Storage Pools None required.

Subsystem Status None required.

System Disk Resources None required.

System Value None required.

TCP Interface None required.

TCP Service None required.

Running Tivoli commands

You can perform system operations from a UNIX or Windows command-line

interface (CLI) in addition to using the Tivoli desktop. Operations that you run

from the command line are referred to as CLI commands.

Introduction: Prerequisites for resource models

2 IBM Tivoli Monitoring: Resource Model Reference Guide

Consider using the command-line interface rather than the graphical user interface

to invoke a Tivoli management application operation in the following

circumstances:

v You do not have access to a graphical user interface, such as when you dial in

over a modem.

v You want to group a number of operations together inside a shell script.

v You want to use accessibility tools that require text-based input of commands.

Most Tivoli CLI commands begin with the letter w to identify them as Tivoli

commands. Command names use a w+verb+object syntax. Example: Use the

wdmrm command to add or remove a resource model.

Most Tivoli commands run within a bash shell on a managed node or on a Tivoli

management region server. A shell is a command interpreter that enables the

operating system to process commands. You can run commands from a shell

command line or include them in shell scripts on UNIX or Windows operating

systems. A Tivoli management region server is a Tivoli server and the set of clients

that it serves. A Tivoli management region addresses the physical connectivity of

resources whereas a policy region addresses the logical organization of resources.

Before running Tivoli commands, you must set the Tivoli environment variables for

the shell. The managed node or Tivoli management region server installation

process supplies the scripts to set the Tivoli environment variables. The following

sections of this guide contain descriptions of the procedures to run these scripts:

“Setting the Tivoli environment on UNIX operating systems” on page 4 and

“Setting the Tivoli environment on Windows operating systems” on page 4.

You must also have the appropriate Tivoli authorization role for running each

command. Refer to the reference information for each command to see the required

authorization role.

Note: Some Tivoli commands can run on an endpoint. To set the Tivoli

environment variables on an endpoint, see “Establishing the Tivoli

environment on an endpoint” on page 5.

Running Tivoli commands on UNIX operating systems

The UNIX operating systems contain shells. Tivoli commands can run in the

Bourne, Korn, C, and bash shells. The Bourne shell is the standard UNIX shell.

Every UNIX system includes the Bourne shell. The Korn shell supports the features

of the Bourne shell and contains extensions applicable only to the Korn shell. The

C shell name comes from the C programming language syntax. The bash shell

supports many features of the UNIX shells. Both UNIX and Windows systems use

the bash shell.

Running Tivoli commands on Windows operating systems

When you install a Windows managed node or Windows Tivoli management

region server, the installation process copies the bash shell executable file to the

machine. The bash shell supports many UNIX commands and UNIX command

syntax. An example is the forward slash (/) for the directory separator. The bash

shell supports the features of the Bourne shell, as well as contains extensions

applicable only to the bash shell.

Note: You can use the Windows MS-DOS shell instead of the bash shell to run

most Tivoli commands (after you set the Tivoli environment variables with

Introduction: Running Tivoli commands

Chapter 1. Introduction 3

the %SystemRoot%\system32\drivers\etc\Tivoli\setup_env command).

However, some commands and Tivoli tasks require a bash shell to run

successfully. All examples of Tivoli commands in Tivoli publications use

bash shell syntax.

Where to find additional information about shells

The following lists include resources where you can find additional information

about the various shells. These resources were available at the time the lists were

created. The lists do not show all of the material that is available, and Tivoli does

not provide opinions or recommendations about any of these resources.

UNIX shells:

v UNIX in a Nutshell: A Desktop Quick Reference for System V Release 4 and Solaris 7

(O’Reilly Nutshell handbook) by Arnold Robbins. ISBN: 1-56592-427-4.

v Portable Shell Programming: An Extensive Collection of Bourne Shell Examples by

Bruce Blinn. ISBN: 0-13-451494-7.

v Learning the Korn Shell (O’Reilly Nutshell handbook) by Bill Rosenblatt and Mike

Loukides. ISBN: 1-56592-054-6.

v UNIX C Shell Desk Reference by Martin Arick. ISBN: 0-47-155680-7.

Bash shell:

v Learning the bash Shell (O’Reilly Nutshell handbook) by Cameron Newham and

Bill Rosenblatt. ISBN: 1-56592-347-2.

v A Brief Introduction to the bash Shell by Jane Anna Langley.

http://www.cs.ups.edu/acl/unix_talk/bash.html

v Bash FAQ (GNU documentation). http://www.delorie.com/gnu/docs/bash/FAQ

v Bash Reference Manual (GNU documentation).

http://www.gnu.org/manual/bash/index.html

v bash command reference information (GNU documentation).

http://www.delorie.com/gnu/docs/bash/bash.1.html

Establishing the Tivoli environment within a shell

When you install a managed node or Tivoli management region server, the

installation process supplies shell setup scripts. You use these scripts to set the

environment variables needed for running Tivoli commands.

Setting the Tivoli environment on UNIX operating systems

The following steps describe how to set the Tivoli environment within a UNIX

shell:

1. Log in to a UNIX managed node or Tivoli management region server.

2. Run the appropriate setup script for the shell.

For the Bourne, Korn, or bash shell, run the following command:

. /etc/Tivoli/setup_env.sh

For the C shell, run the following command:

source /etc/Tivoli/setup_env.csh

Setting the Tivoli environment on Windows operating systems

The following steps describe how to set the Tivoli environment and start a bash

shell on Windows.

1. Log in to a Windows managed node or Tivoli management region server.

2. Open a command window.



3. Run the following command in the command window to set Tivoli

environment variables:

%SystemRoot%\system32\drivers\etc\Tivoli\setup_env.cmd

4. Run one of the following commands in the command window to start the bash

shell:

sh

—OR—

bash

Establishing the Tivoli environment on an endpoint

When you install an endpoint, the installation process supplies setup scripts. Use

these scripts to set the environment variables required for running Tivoli

commands on an endpoint.

The following steps describe how to set the Tivoli environment on an endpoint:

1. Log in to an endpoint.

2. Open a command window.

3. Run the appropriate setup script in the command window. The following table

contains setup scripts for the different endpoint operating systems.

Table 4. Setup scripts for endpoint operating systems

Operating

System Setup Script Location Setup Script Name

AIX, Solaris /etc/Tivoli/lcf/endpoint_label lcf_env.sh (for Bourne, Korn, and

bash shells)

—OR—

lcf_env.csh (for C shell)

Windows %SystemRoot%\Tivoli\lcf\

endpoint_label

lcf_env.cmd (for MS-DOS) or

lcf_env.sh (for bash shell)

Common parameters

This section describes the names used to refer to Tivoli endpoints and hosts. For

detailed information about IBM Tivoli Monitoring, see the IBM Tivoli Monitoring

User’s Guide.

Endpoint Name

The Tivoli Management Framework product assigns the endpoint label

when creating the endpoint within the Tivoli environment. Some IBM

Tivoli Monitoring commands use this label, but an IBM Tivoli Monitoring

command cannot assign or modify the label. This label is usually a string,

such as Endpoint1. The variable for this label is EndpointName.

Host Name

The host name is the name that is assigned to the server within the

network. Some IBM Tivoli Monitoring commands use this name, but an

IBM Tivoli Monitoring command cannot assign or modify the name. The

network determines the format of this name. The name can be a string,

such as acme.sp.dynamite.com, or an IP address, such as 123.123.123.1. The

variable for this label is HostName. Type hostname at the command line to

determine the host name.


Chapter 1. Introduction 5

Note: Some attributes are denoted as key attributes. Key attributes to allow you to

distinguish one attribute from another when there is more than one instance

of an indication.

Introduction: Common parameters


Chapter 2. Windows resource models

This chapter describes resource models for computers that run on Windows®-based

operating systems.

Collect Configuration resource model

Description

Resource model distribution

Distribute this resource model to Windows-based operating systems.

The Collect Configuration resource model gathers system configuration

information that does not change, or changes infrequently. As a result, it should

have a very large cycle time. (The default value is one day.) This resource model

does not generate any events.

The following table shows the key characteristics of this resource model:

Resource model at a glance

Built-in actions No

Category Windows

Clearing events No

Default cycle time 86,400 seconds

Internal name TMW_Configuration

Parameters No

Thresholds No

Logging

The following table shows the resource, context, and properties for which data can

be logged:

Resource Context Properties

Memory Configuration

Memory

″Total″

TotalVisiblePhysicalMemory

The total amount of physical

memory available to the operating

system, in megabytes. This value

does not necessarily indicate the true

amount of physical memory, but

what is reported to the operating

system as available to it.


Event Log resource model

Description



The Event Log resource model examines the Windows System Event Log for

events that normally require immediate attention, or can be rectified with a simple

registry edit. The Event Log resource model highlights the following areas:

v Client connectivity problems

Busy networks can cause clients to time out. This indication can be trapped.

When it is, the registry value that determines the time out period can be

enlarged. After attempting to connect a few times without success, the problem

might be related to a faulty network card or drivers.

v Detection of malfunctioning devices

Events 9, 11, and 15 are the most common events that occur when a device or

driver is malfunctioning. Isolate and investigate the cause of the errors as soon

as possible.

v Server connectivity problems

Bad IRPStackSize and OEM installations of Windows are common situations that

prevent the server service from operating correctly. If the server service is not

functioning properly, clients cannot connect to the affected machine.



Built-in actions Yes

Category Windows

Clearing events No

Default cycle time 600 seconds

Internal name TMW_EventLog

Parameters No

Thresholds Yes

About the Windows Event Log resource model

The following information applies to the Windows Event Log resource model:

v Event ID 9 has multiple meanings. Event ID 9 commonly indicates a faulty

device or driver. For additional information, see the Microsoft Knowledge Base

article number 314093, How to Troubleshoot Error Messages About Event 9 and

Event 11, at the following web address:

http://support.microsoft.com/default.aspx?scid=kb;en-us;314093

v Event ID 11 has multiple meanings. Event ID 11 is commonly a device or

controller error. For additional information, see the Microsoft Knowledge Base

article number 154690, How to Troubleshoot Event 9 and Event 11 Error

Messages, at the following web address:


Windows resource models: Event Log


http://support.microsoft.com/default.aspx?scid=kb%3ben-us%3b314093


v Event ID 15 has multiple meanings. Event ID 15 commonly indicates that an

installed device is not ready to be accessed. For additional information, see the

Microsoft Knowledge Base article number 259237, Troubleshooting Event ID 9,

11, and 15 on Cluster Servers, at the following web address:


v Event ID 7023 has multiple meanings. Event ID 7023 commonly indicates that a

service has failed to start. For additional information, see the Microsoft

Knowledge Base article number 151427, Server Service May Fail After Installing

Network Card, at the following web address:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q151427

v Event ID 2011 has multiple meanings. Event ID 2011 commonly indicates that

the IRPStackSize is too small. For additional information, see the Microsoft

Knowledge Base article number 106167, Err Msg: Not Enough Server Storage is

Available, at the following web address:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q106167

Additional information regarding Event ID 2001 is available in the Microsoft

Knowledge Base article number 177078, Antivirus Software May Cause Event ID

2011, at the following web address:


Indications and events

The following table lists the events that can be generated by the Event Log

resource model, the name of the indication from which each event is generated, the

default severity of the event, and where you can find a detailed description of the

indication:

Event Indication Severity Page

TMW_EventID9 Event ID 9 Warning 9


TMWEvent_ID15 Event ID 15 Warning 10





Event ID 9

This indication is sent when a device or device driver times out. See “Indication

properties” on page 12 for information on the properties for this event.

No threshold is exceeded to generate this indication. If an event in the event log is

within the first set of events (determined by the threshold Maximum Number Of

Logs) and contains the event ID of 9, this indication is sent.

The following table shows the default settings for this indication:

Setting Default

Clearing Event No

Holes 0

Occurrences 1


Chapter 2. Windows resource models 9


http://support.microsoft.com/default.aspx?scid=kb%3ben-us%3bQ151427

http://support.microsoft.com/default.aspx?scid=kb%3ben-us%3bQ106167


Setting Default

Send indications to IBM Tivoli Business Systems

Manager

No

Send indications to IBM Tivoli Enterprise Console Yes

Severity Warning

Event ID 11

This indication is sent when an error is detected on a device or device controller.

See “Indication properties” on page 12 for information on the properties for this

event.


within the first set of events (determined by Maximum Number Of Logs) and

contains the event ID of 11, this indication is sent.


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Event ID 15

This indication is sent when a drive (typically removable media, for example, a

CD-ROM) is not ready for access or is not functioning properly. See “Indication



within the first set of events (determined by Maximum Number of Logs) and



Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning



Event ID 2011

This indication is sent when the IRPStackSize is too small. Event 7023 typically

occurs with this event. See “Indication properties” on page 12 for information on

the properties for this event.




For information about built-in actions, see “Built-in actions” on page 13.


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Event ID 2511

This indication is sent when a shared directory no longer exists. This condition is

only detected when the Windows operating system is started. See “Indication







Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No

Send indications to IBM Tivoli Enterprise Console No

Severity Warning

Event ID 3013

This indication is sent when the redirector, or workstation service, times out. See

“Indication properties” on page 12 for information on the properties for this event.


within the first set of events (determined by Maximum Number of Logs) with the

event ID of 3013, this indication is sent.





Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Event ID 7023

This indication is sent when there is not enough server storage space. When this

behavior occurs by itself, the problem is usually related to OEM installations of

either Windows or Windows service packs. Microsoft® Knowledge Base article

Q151427 details this event. The solution is usually to reinstall the latest service

pack. See “Indication properties” for information on the properties for this event.


within the first set of events (determined by Maximum Number of Logs) with the

event ID of 7023, this indication is sent.


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Indication properties

All the indications in the Event Log resource model have the following properties:

ComputerName

The name of the computer where the event occurred. ComputerName is a

key attribute.

EvtID Identifies the event by number. EvtID is a key attribute.

Logfile

The name of the log file in which the event was generated (for example,

system, security, or application)

Message

The message text of the event

RepeatCount

Number of Event ID events received in a cycle



SourceName

The source of the event. SourceName is a key attribute.

TimeGenerated

The time the event was generated

TimeWritten

The time the event was written to the event log

Note: Some attributes are denoted as key attributes. Key attributes allow you to

distinguish one attribute from another when there is more than one instance

of an indication.

Thresholds

The following table lists the thresholds that can be set for the Event Log resource

model. For each threshold, the table shows the name, a short description, and the

default value.

Threshold Description Default

Maximum Number of

Logs

(MostNumberOfLogs)

This threshold is the maximum number of newest

events in the event log that is examined.

100

Built-in actions

This resource model contains the following built-in actions:

Indication Built-in actions

Event ID 2011 1. Notifies the system administrator that the IRPStackSize is too small.

2. Edits the registry key Computer

Name\HKEY_LOCAL_MACHINE\SYSTEMS\CurrentControlSet\

Services\LanmanServer\Parameters\IRPStackSize.

3. Sets the value to 0xCh (decimal value 12).

Note: The system must be rebooted for this change to take effect.

For additional information, see “Event ID 2011” on page 11.

Event ID 2511 1. Notifies the system administrator that a shared directory no longer

exists.


Name\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\LanmanServer\Shares.

3. Deletes the key that represents the sharename.

Note: The system must be rebooted for this change to take effect.





Event ID 3013 1. Notifies the system administrator that the redirector, or workstation

service, is timing out.


Name\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\LanmanServer\Parameters\SessTimeOut to a higher value.

When the value is not present, the default value is 0x2Dh (decimal

value 45) seconds. Corrective actions consist of raising this value by

an increment of 0xAh (decimal value 10).

Note: The system must be rebooted for this change to take effect. After

three attempts, user intervention is required. The system administrator

can examine the network subsystem and reinstall or repair network

drivers or devices.


Logical Disk resource model

Description



The Logical Disk resource model detects bottlenecks associated with all logical

disks, such as C:, that are configured on your systems. The Logical Disk resource

model highlights the following areas:

v Excessive Disk Usage

Alter the percentage of disk usage when you discover bottlenecks while

monitoring file servers. File servers, print servers, and mail servers use a high

percentage of disk space. However, workstations typically use a high percentage

of disk space in short bursts. When disk usage is significantly increased,

performance in processor speed and general system response decline.

v High Transfer Rate

This indicates the raw amount of data that is transferred through the disk. The

maximum transfer rate that a disk subsystem can handle depends on the type of

hard drive, the type of controller, the drive configuration, and, in the case of

most IDE-based hard drives, the speed of the processor.

v Low Disk Space

Low disk space makes it impossible to reboot a Windows computer. The

threshold value is based on the percentage of free space on the disk. Keep

enough free disk space to allow the pagefile to reach its maximum size limit.



Built-in actions No

Category Windows

Clearing events Yes





Internal name TMW_LogicalDisk

Parameters No

Thresholds Yes

Note: This resource model uses the Windows performance counters, which are

normally enabled by the operating system. In the event the performance

counters are disabled, the resource model fails with a Missed Prereq status.

See the solution described in the ″Problems and their workarounds″ table of

the IBM Tivoli Monitoring Problem Determination Guide.

Prerequisites

The Logical Disk resource model requires disk counters to be enabled on

Windows-based operating systems.

To enable disk counters, perform the following steps on each Windows-based

operating system:

1. On Windows NT systems, run the diskperf –y command.

On systems running Windows 2000, Windows XP, and Windows Server 2003,

run the diskperf –yv command.

2. Reboot the system.


The following table lists the events that can be generated by the Logical Disk



indication:


TMW_HighLogicalDiskReadBytesSec High Read Bytes per Second Minor 16

TMW_HighLogicalDiskWriteBytesSec High Write Bytes per Second Minor 18

TMW_HighLogicalDiskXferRate High Transfer Rate Minor 17

TMW_HighLogicalPercentDiskTime High Percentage Disk Time Warning 15

TMW_LogicalPossibleFrag Logical Disk Possible Fragmentation Minor 19

TMW_LowLogicalDiskSpace Low Disk Space Warning 19

TMW_SlowLogicalDrive Slow Logical Drive Warning 20

High Percentage Disk Time

This indication is sent when the drive is spending too much time processing small

data segments. Possible causes are bad cluster size, fragmentation, or bad cache

settings.

The indication contains the following attributes:

LogicalDisk

The logical disk that is analyzed. LogicalDisk is a key attribute.

PercentDiskTime

The percentage of time that the logical drive is used

Windows resource models: Logical Disk


PercentReadTime

The percentage of time that the logical drive is used for read operations

PercentWriteTime

The percentage of time that the logical drive is used for write operations

PhysicalDisk

The physical disk on which the logical disk resides. PhysicalDisk is a key

attribute.

This indication is dependent on the following thresholds:


High Percent Usage

(HighPercentUsage)

The percentage of time that is busy servicing read

or write requests must exceed this threshold.

90

High Queue Length

(HighQLength)

The number of outstanding requests, including

those in progress on the disk, must exceed this

threshold.

3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

High Read Bytes per Second

This indication is sent when a logical disk is reading an excessive amount of data

per second.


DiskReadBytesSec

The number of bytes read per second on the logical disk

DiskReadSec

The number of transactions that are read per second on the logical disk

LogicalDisk


PercentDiskRead

The percentage of the logical drive used to read data

PhysicalDisk


attribute.





High Bytes per Second

(HighBytesSec)

The maximum number of bytes read per second

must exceed this threshold.

1 572 864

High Percent Usage

(HighPercentUsage)

The percentage of time that the selected disk is

busy servicing read or write requests must exceed

this threshold.

90


Setting Default

Clearing Events Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor

High Transfer Rate

This indication is sent when a logical disk is reading and writing an excessive

amount of data.


DiskReadsSec

The rate of bytes read per second on the logical disk

DiskWritesSec

The rate of bytes written per second on the logical disk

DiskXfersSec

The rate of bytes read or written per second on the logical disk

LogicalDisk


PercentDiskReadTime

The percentage of the logical drive used for read operations

PercentDiskWriteTime

The percentage of the logical drive used for write operations

PhysicalDisk


attribute.




(HighBytesSec)

Number of bytes read or written per second must

exceed this threshold.

1 572 864

High Percent Usage

(HighPercentUsage)


and write requests must exceed this threshold.

90




Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor

High Write Bytes per Second

This indication is sent when a logical disk is writing an excessive amount of data

per second.


DiskWriteBytesSec

The number of bytes written per second on the logical disk

DiskWriteSec

The number of transactions that are written per second on the logical disk

PercentDiskWrite

The percent of the logical drive used during write operations.

PhysicalDisk


attribute.

LogicalDisk





(HighBytesSec)

The maximum number of bytes written per second


1 572 864

High Percent Usage

(HighPercentUsage)

The percentage of time that is busy servicing write

requests must exceed this threshold.

90


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor



Logical Disk Possible Fragmentation

This indication is sent when a disk might be excessively fragmented. Excessive

fragmentation occurs when a high percentage of the logical disk is used, the queue

length is not long, and read and write transfer rates are not high.


DiskBytesSec

The number of bytes read or written per second.

LogicalDisk

The logical disk. LogicalDisk is a key attribute.

PercentDiskTime

The percentage of time that the logical drive is used

PhysicalDisk


attribute.




(HighBytesSec)

The number of bytes read or written per second

must not exceed this threshold.

1 572 864

High Percent Usage

(HighPercentUsage)


or write requests must exceed this threshold.

90

High Queue Length

(HighQLength)


those in progress on the disk, must not exceed this

threshold.

3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor

Low Disk Space

This indication is sent when a logical drive contains very little free space. It

indicates that disk space is dangerously low and action must be taken to free

space.


FreeMB

The actual size of free space on the logical drive in megabytes

LogicalDisk

The logical disk analyzed. LogicalDisk is a key attribute.



PercentFreeSpace

The percentage of free space on the logical drive

PhysicalDisk


attribute.

This indication is dependent on the following threshold:


Low Disk Space

(LowDiskSpace)

The percentage of free disk space must be less than

or equal to this threshold.

5


Setting Default

Clearing Event Yes

Holes 0

Occurrences 5


Manager

No


Severity Warning

Slow Logical Drive

This indication is sent when the logical disk is too slow to keep up with the work

it must perform.


AvgQLength

The average queue length

AvgReadQLength

The average queue length for read operations

AvgWriteQLength

The average queue length for write operations

CurrentDiskQLength

The number of jobs waiting to be processed by the logical disk

DiskReadBytesSec


DiskWriteBytesSec


LogicalDisk


PercentDiskTime

The percentage of time that the logical disk is used

PhysicalDisk


attribute.






(HighBytesSec)



1 572 864

High Queue Length

(HighQLength)


those in progress, on the disk must exceed this

threshold.

3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the Logical Disk resource


default value.



(HighBytesSec)

This threshold is the maximum amount of bytes

read or written per second. The default is based on

the average logical disk.

1 572 864

High Percent Usage

(HighPercentUsage)

This threshold is the maximum percentage of time

that the selected disk is busy servicing read or

write requests.

90

High Queue Length

(HighQLength)

This threshold is the maximum number of

outstanding requests for the disk. It includes those

in progress at the time of the snapshot. This is an

exact length, not an average over the time interval.

3

Low Disk Space

(LowDiskSpace)

This threshold is the minimum percentage of free

disk space allowed on a logical disk.

5

Logging


be logged:




LogicalDisk Bytes Transferred

DiskBytesSec

The number of bytes read or written

per second

LogicalDisk

The logical disk name

Queue Length

AvgQLength

The average queue length for jobs

LogicalDisk


Percent Space

LogicalDisk


PercentFreeSpace

The percentage of free space on the

logical disk

Percent Disk Usage

LogicalDisk


PercentDiskTime

The percentage of time that the

logical drive is used

LogicalDisk Storage

LogicalDisk


LogicalDiskFreeSpace

The unallocated space on the logical

disk, in megabytes.

LogicalDiskTotalSize

The size of the logical disk, in

megabytes.

Memory resource model

Description



This resource model detects bottlenecks specifically associated with RAM. Because

most devices in the system use RAM, many bottlenecks are associated with RAM

usage.

The Memory resource model highlights the following areas:

v Cache

When cache is used, four different areas are examined:

– Copy reads

– Data maps

– MDL reads



– Pin reads

The Hit Percentage Rate is examined for each area. This gives an idea of how

much data was supplied by the cache and how much was supplied from

another location. If cache is used, ideally it provides at least 70% of the data. A

lower percentage indicates data is lost in the cache or that the cache is not large

enough.

v Committed bytes

Committed bytes indicate the amount of virtual memory, in bytes, that have

been committed. The commit limit is the current limit of physical space (either

RAM or in the pagefile) that is available for the committed bytes.

If the committed bytes become larger than the commit limit, the pagefile must

be enlarged. A pagefile that is constantly in flux causes performance problems

because the system spends time extending or shrinking the pagefile. This process

also involves the slowest part of the system and is prone to becoming a

bottleneck.

The committed bytes has an upper limit. The value is dictated by a setting in the

system control applet. If the pagefile reaches its maximum limit, it is assumed

that available memory is extremely low. In this situation, a major performance

degradation can be expected.

If committed bytes continues to grow and there is not enough available physical

space to hold the committed memory, a core dump might occur.

The initial size of the pagefile is best determined by the amount of RAM in the

system. A good guideline is 150% of the amount of RAM.

v Low available memory

Available memory is checked continuously to ensure it does not drop below 10

MB. When available memory is low, performance declines slightly, but the

system still works correctly. Inform your system administrator that memory is

low and to consider monitoring.

As available memory drops, the Windows operating system attempts to keep the

available memory above 4 MB. At this point, memory is too low and the

operating system spends more time keeping memory available than processing

requests. Additionally, high paging begins to occur, and the pagefile reaches its

maximum size.

v Memory leaks

Analyze these three different areas of memory for a possible leak:

– Private bytes

– System code

– System drivers

The top five processes are examined in the Private Bytes. The total pools of

System Code and System Drivers are also examined for growth. This generally

indicates a memory leak in the affected area of memory.

v Paging and page faulting

Page Faults occur when Windows® moves a piece of data to another portion of

RAM or to the pagefile. Paging moves data to the hard drive, so it is

incorporated in the counters for Page Faults.

Page faults are considered high when they reach approximately 350 page faults

per second. Paging is considered high at approximately 60 pages per second.

Performance declines because the system moves data to and from the hard

drive, typically the slowest component of the system. The hard drive and

processor become busier and overall performance of the machine decreases.

Windows resource models: Memory




Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_MemoryModel

Parameters No

Thresholds Yes







The following table lists the events that can be generated by the Memory resource

model, the name of the indication from which each event is generated, the default

severity of the event, and where you can find a detailed description of the

indication:


TMW_HighPaging High Paging Warning 25

TMW_LowAvail Low Available Memory Warning 25

TMW_LowAvailCausingHardPaging Low Available Memory

Causing Hard Paging

Warning 27

TMW_LowAvailCausingManyProblems Low Available Memory

Causing Many Problems

Critical 28

TMW_LowAvailCausingSoftPagePagefileResize Low Available Memory

Causing Soft Paging and

Pagefile Resizing

Warning 26

TMW_LowAvailCausingSoftPaging Low Available Memory Is

Causing Excessive Soft Paging

Warning 26

TMW_LowAvailHighCache Low Available Memory with

High Cache

Warning 32

TMW_LowAvailHighWS Low Available Memory with

High Working Set

Warning 30

TMW_LowAvailWithSmallPageFile Low Available Memory with a

Small Pagefile

Warning 31

TMW_LowCopyReadHits Low Copy Read Hits Minor 32

TMW_LowDataMapHits Low Data Map Hits Minor 33

TMW_LowMDLReadHits Low MDL Read Hits Minor 34

TMW_LowPinReadHits Low Pin Read Hits Minor 35

TMW_MemoryLeakInPB Memory Leak in Private Bytes Critical 36

TMW_MemoryLeakInSC Memory Leak in System Code Critical 37




TMW_MemoryLeakInSD Memory Leak in System

Drivers

Critical 37

TMW_PageFileResizing Pagefile is Resizing Warning 38

High Paging

This indication is sent when there is an excessive number of pages read from or

written to disk to resolve hard page faults. Hard page faults occur when a process

requires code or data that is not in its working set or elsewhere in physical

memory and must be retrieved from disk. A high paging rate can cause

system-wide delays.


PagesSec

The number of pages swapped per second

TotalAvail

The total of available memory in bytes

TotalWorkingSet

The total working set size in bytes

TotalCache

The total cache size in bytes



Excessive Paging

(ExcessivePaging)

The number of pages per second must exceed this

threshold.

60


Setting Default

Clearing Event Yes

Holes 1

Occurrences 15


Manager

No


Severity Warning

Low Available Memory

This indication is sent when the available memory is low, but it is not clear in

which area of memory the problem is located.


PercentAvail

The percentage of available memory in comparison to the size of the

working set and the cache



PercentCache

The percentage of cache memory in comparison to the size of the working

set and the available memory

PercentWS

The percentage of working set memory in comparison to the size of

available memory and the cache

TotalAvail


TotalCache


TotalWorkingSet




Minimum Available

Bytes

(MinimumAvail)

Available memory must be lower than this

threshold.

10 485 760


Setting Default

Clearing Event Yes

Holes 2

Occurrences 6


Manager

No

Severity Warning


Low Available Memory Causing Excessive Soft Paging

This indication is sent when the available memory is low and is causing a large

number of page faults.


PageFaultsSec

The current value for page faults per second

TotalAvail




Excessive Page Faults

(ExcessivePageFaults)

The number of page faults per second must


350

Excessive Paging

(ExcessivePaging)

The paging rate must not exceed this threshold. 60




Minimum Available Bytes

(MinimumAvail)

Available memory must not exceed this

threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The amount of committed memory is not

approaching the commit limit. The difference

between the commit limit and the amount of

committed memory must be greater than this

threshold.

5 242 880


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

Low Available Memory Causing Hard Paging

This indication is sent when low available memory causes too much paging to the

pagefile.


PageFaultsSec

The current rate of page faults per second

PagesSec

The current rate of pages per second

TotalAvail








350

Excessive Paging

(ExcessivePaging)

The paging rate must exceed this threshold. 60


(MinimumAvail)


threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The difference between the current committed

bytes and the peak current bytes must not exceed

this threshold.

5 242 880




Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

Low Available Memory Causing Many Problems

This indication is sent when multiple problems are caused by lack of available

memory.


CommittedBytes

The current total of committed bytes

CommittedLimit

The upper limit of the committed bytes

PageFaultsSec


PagesSec

The current rate of pages per second

TotalAvail








350

Excessive Paging

(ExcessivePaging)

The paging rate must exceed this threshold. 60


(MinimumAvail)


threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The amount of committed memory is



committed memory must be less than this

threshold.

5 242 880


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No



Setting Default


Severity Critical

Low Available Memory Causing Soft Paging and Pagefile

Resizing

This indication is sent when excessive soft paging and pagefile resizing is caused

by low available memory.


CommittedBytes


CommittedLimit


PageFaultsSec


TotalAvail




Excessive Paging

(ExcessivePaging)

The paging rate must not exceed this threshold. 60

ExcessivePageFaults The number of page faults per second must


350


(MinimumAvail)

Available memory must lower than this

threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The amount of committed memory is not




threshold.

5 242 880


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning



Low Available Memory with a High Working Set

This indication is sent when available memory is low because a large amount of

memory is in use by the working set. This indication is sent when the size of the

working set is larger than both the cache and the available memory.


HighProcess

The string name of the process with the highest working set

HighProcessIDProcess

The numeric ID of the process with the highest working set

HighProcessPoolNPBytes

The pool non-paged bytes of the process with the highest working set

HighProcessPoolPPBytes

The pool paged bytes of the process with the highest working set

HighProcessPrivateBytes

The private bytes of the process with the highest working set

HighProcessVirtualBytes

The virtual bytes of the process with the highest working set

HighProcessWorkingSet

The working set of the process with the highest working set

PercentAvail



PercentCache



PercentWS



TotalAvail


TotalCache


TotalProcesses

The total number of processes

TotalWorkingSet




Minimum Available

Bytes

(MinimumAvail)

Available memory must not exceed this threshold. 10 485 760




Setting Default

Clearing Event Yes

Holes 2

Occurrences 6


Manager

No


Severity Warning

Low Available Memory with a Small Pagefile

This indication is sent when available memory is low and the pagefile is resized.


CommittedBytes


CommittedLimit


TotalAvail


TotalCache


TotalWorkingSet




Minimum Available

Bytes

(MinimumAvail)


threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The amount of committed memory is approaching

the commit limit. The difference between the

commit limit and the amount of committed

memory must be less than this threshold.

5 242 880


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning



Low Available Memory with High Cache

This indication is sent when available memory is low because a large amount of

memory used by the cache. This indication is sent when the size of the cache is

larger than both the working set and the available memory.


PercentAvail



PercentCache



PercentWS



TotalAvail


TotalCache


TotalWorkingSet




Minimum Available

Bytes

(MinimumAvail)


threshold.

10 485 760


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Low Copy Read Hits

This indication is sent when the percentage of copy read requests that hit the cache

is too low. A copy read is a file read operation that is satisfied by a memory copy

from a page in the cache to the program buffer. If a copy read request is not

satisfied by the cache, a disk read is required to provide access to the data.


AvrgCopyReadHitsPercent

The percentage average of copy read hits



PercentAvail



PercentCache



PercentWS



TotalAvail


TotalCache


TotalWorkingSet




Low Cache Hits Percent

(LowCacheHitsPercent)

The percentage of copy read hits must not exceed

this threshold.

70


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10



Manager

No

Severity Minor

Low Data Map Hits

This indication is sent when the percentage of data map hits from the file system

cache is too low. A data map that is not found in the file system cache requires a

disk read operation to retrieve the information.


AvrgDataMapHitsPercent

The percentage average of data map hits

PercentAvail



PercentCache





PercentWS



TotalAvail


TotalCache


TotalWorkingSet






The percentage of data map hits must not exceed

this threshold.

70


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10



Manager

No

Severity Minor

Low MDL Read Hits

This indication is sent when the percentage of Memory Descriptor List (MDL) hits

from the file system cache is too low. A Memory Descriptor List that is not found

in the file system cache requires a disk read operation to retrieve the information.

Continuous occurrence of this indication shows that there is not enough available

cache. Adding memory or adjusting the registry remedies the situation.


AvrgMDLReadHitsPercent

The percentage average of MDL read hits

PercentAvail



PercentCache



PercentWS



TotalAvail




TotalCache


TotalWorkingSet






The percentage of MDL read hits must not exceed

this threshold

70


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor

Low Pin Read Hits

This indication is sent when the percentage of pin read hits from the file system

cache is too low. While pinned, the physical address of a page in the file system

cache is not altered. A pin read that is not satisfied by the file system cache

requires a disk read operation to retrieve the information. Continuous occurrence

of this indication shows that there is not enough available cache. Adding memory

or adjusting the registry remedies this situation.


AvrgPinReadHitsPercent

The percentage average of pin read hits

PercentAvail



PercentCache



PercentWS



TotalAvail


TotalCache


TotalWorkingSet








The percentage of pin read hits must not exceed

this threshold.

70


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor

Memory Leak in Private Bytes

This indication is sent when there is a memory leak in the private bytes area of

memory. Private memory cannot be shared with other processes.


CurrentPoolNonPagedBytes

The current pool of non-paged bytes of the process

CurrentPoolPagedBytes

The current pool of paged bytes of the process

CurrentPrivateBytes

The current private bytes of the process

CurrentVirtualBytes

The current virtual bytes set of the process

CurrentWorkingSet

The current working set of the process

IDProcess

The numeric ID of the process with the memory leak. IDProcess is a key

attribute.

Process

The name of the process. Process is a key attribute.

No specific threshold causes this indication to be sent. The decision tree examines

the top five processes in this memory area and compares them with the top five

processes from the last cycle. It tries to find identical processes by matching the

process IDs and then comparing the amount of memory it is using for this pool of

memory. If the memory size has grown since the last cycle, this indication is sent.


Setting Default

Clearing Event Yes



Setting Default

Holes 1

Occurrences 40


Manager

No


Severity Critical

Memory Leak in System Code

This indication is sent when the system code memory size has grown since the

previous cycle. The system code is the area of pageable memory in ntoskrnl.exe,

hal.dll, and the boot drivers and file system drivers loaded by the ntldr and

osloader processes.


OrigSize

The original size of the system code memory in bytes.

SysCodeBytes

The current size of the system code memory in bytes.


the system code pool of memory and sends this indication if it finds that the

memory size has grown since the previous cycle.


Setting Default

Clearing Event Yes

Holes 10

Occurrences 40


Manager

No


Severity Critical

Memory Leak in System Drivers

This indication is sent when the system driver memory size has grown since the

previous cycle. The system driver area is the pageable memory used by the device

drivers.


OrigSize

The original size of the system driver memory in bytes.

SysDriverBytes

The current size of the system driver memory in bytes.


the system drivers pool of memory and sends this indication if it finds that the

memory size has grown since the previous cycle.




Setting Default

Clearing Event Yes

Holes 10

Occurrences 40


Manager

No


Severity Critical

Pagefile is Resizing

This indication is sent when the pagefile is resized, an operation which consumes

processor resources and can cause fragmentation in the pagefile.


CommittedBytes


CommittedLimit


TotalAvail


TotalCache


TotalWorkingSet





(MinimumAvail)


threshold.

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

The amount of committed memory is




threshold.

5 242 880


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning



Thresholds

The following table lists the thresholds that can be set for the Memory resource


default value.




This threshold is the maximum number of page

faults per second. A page fault occurs when a

process requires code or data that is not in its

working set (its space in physical memory). This

value includes both hard faults (those that require

disk access) and soft faults (where the faulted

page is found elsewhere in physical memory).

350

Excessive Paging

(ExcessivePaging)

This threshold is the maximum number of pages

read from or written to disk per second to resolve

hard page faults. Hard page faults occur when a

process requires code or data that is not in its

working set or elsewhere in physical memory, and

must be retrieved from disk.

60



This threshold is the minimum percentage of hits

that must occur when reading data from cache.

70

Minimum Available

Bytes

(MinimumAvail)

This threshold is the minimum amount of

available memory (in bytes).

10 485 760

Minimum Committed

Bytes

(MinimumCommitted)

This threshold is the minimum value for the

difference between the committed memory and

the commit limit (in bytes). Committed memory is

physical memory for which space has been

reserved on the disk paging files, in the event that

the memory must written to disk. The commit

limit is the amount of virtual memory that can be

committed without having to extend the paging

files. When the difference between the committed

memory and the committed limit is too small,

paging files must be increased in size.

5 242 880

Logging


be logged:




Memory Memory Usage

CommittedBytes

The physical memory for which

space has been reserved on the disk

paging files, in bytes

CommitLimit

The amount of virtual memory that

can be committed without having to

extend the paging file(s), in

megabytes.

Memory

″Total″

PercentCommittedBytesInUse

The percentage of committed bytes

in relation to the commit limit.

PercentMemoryUsage

The percentage of committed bytes

in relation to the total physical

memory (RAM) available to the

operating system. The percentage

value of PercentMemoryUsage can

exceed 100%.

TotalAvail

The total available memory, in bytes

TotalCache

The total cache memory, in bytes

Paging

PageFaultsSec

The number of page faults per

second

PagesSec

The number of pages per second

Memory

″Total″

TotalPageFileSize

The total amount of page file (swap)

space available on all logical disks,

in megabytes

Process Process Memory Usage

ID The process identifier

PrivateBytes

The number of private bytes used by

the process, in bytes

Process The process name

VirtualBytes

The size of the virtual address used

by the process, in bytes

WorkingSet

The working set, in bytes



||||||

Network Interface Card resource model

Description



The Network Interface Card resource model detects bottlenecks specifically

associated with all network interface cards installed on Windows-based operating

systems.

Note: The Network Interface Card resource model generates the subset of events

related to network segments only on Windows NT operating systems. For

Windows 2000, Windows XP, or Windows Server 2003, this resource model

does not generate the events or the metrics associated with network

segments.

For a list of events generated on Windows NT only, see “Indications and

events” on page 42.

The Network Interface Card resource model highlights the following areas:

v Broadcast frames

If too much of the network is broadcast frames for an extended period of time,

segment the network further or redesign the network to use fewer broadcast

frames.

v Network interface card

The core of the network subsystem is the network interface card. If a network

card is not fast enough to handle the number of requests from other nodes on

the network or from internal counterparts, all aspects of the network subsystem

are affected. Tests are made to determine if a network card is too slow, or if

there is too much data trying to be sent through the network.

v Percentage usage

To identify the network component overused, tests are performed on the

percentage of the network segment used, the server service, and the workstation

service (redirector). This reveals if the system is part of a busier network, is

servicing too many requests, or is requesting too much.

Determine whether to upgrade the server or workstation service, or to distribute

the workload differently.

v Server and workstation services

The server and workstation services are vital to the network operations of

Windows. Performance statistics for each service, such as data transfer rate in

and out, sessions with errors, or high requests to the services are examined.




Category Windows

Clearing events Yes


Windows resource models: Network Interface Card



Internal name TMW_NetworkIntCard

Parameters No

Thresholds Yes






Prerequisites

On Windows NT, the Network Monitoring Agent and SNMP Service must be

installed through the Network Services tab of the Network Neighborhood

Properties.

Note: The Network Monitoring Agent must be installed prior to installing TCP/IP.

After you have installed the Network Monitoring Agent, check the

Performance Monitor tool to ensure that the Network Interface object is

displayed. If these prerequisites are not installed, the resource model

displays a status of Error rather than Missed Prereq in response to the

wdmlseng command.

On systems running Windows 2000, Windows XP, or Windows Server 2003, the

prerequisites needed to run the Network Interface Card resource model are

installed as part of the base operating system.


The following table lists the events that can be generated by the Network Interface

Card resource model, the name of the indication from which each event is

generated, the default severity of the event, and where you can find a detailed

description of the indication:


TMW_AdjustWorkItems Adjust Work Items Warning 43

TMW_HighBroadcastFrames High Broadcast Frames

This indication is valid for

Windows NT only.

Warning 44

TMW_HighCurrentCommands High Current Commands Warning 45

TMW_HighErroredRatio High Errored Ratio Critical 46

TMW_NICOverworked Network Interface Card

Overworked

Warning 46

TMW_NICTooSlow Network Interface Card Too Slow Warning 47

TMW_RedirectorAffectingServer Redirector Affecting Server


Windows NT only.

Warning 48

TMW_RedirectorOverloaded Redirector Overloaded Warning 49




TMW_RedirectorOverloadedAffectingSegment Redirector Overloaded Affecting

Segment


Windows NT only.

Warning 50

TMW_SegmentAffectingRedirector Segment Affecting Redirector


Windows NT only.

Warning 51

TMW_SegmentAffectingServer Segment Affecting Server


Windows NT only.

Warning 52

TMW_ServerAffectingRedirector Server Affecting Redirector


Windows NT only.

Warning 53

TMW_ServerOverloaded Server Overloaded Warning 54

TMW_ServerOverloadedAffectingSegment Server Overloaded Affecting

Segment


Windows NT only.

Warning 55

Adjust work items

This indication is sent when there is an insufficient number of work items to

service incoming requests to the Windows server. Adjust the Windows registry to

improve performance. See “Built-in actions” on page 57 for information about

automatically adjusting the Windows registry.

The indication contains the following attribute:

WorkItemShortages

The number of times that work items cannot be allocated to service

incoming requests to the server



High Percent Bytes Per

Second

(HighPercentBytesSec)

The bandwidth of the network card is

multiplied by this value to determine the

maximum percentage of network card

bandwidth that can be used by the server

service. Server throughput must not exceed

this threshold.

9

High Percent Utilization

(HighPercentUtilization)

The utilization of the internal network

segment must not exceed this threshold.

On Windows NT systems, this threshold must

not be exceeded. On Windows 2000, Windows

XP, or Windows Server 2003 operating

systems, this threshold is ignored.

40

High Work Item Shortages

(HighWorkItemShortages)

The number of times that a work item can not

be allocated for an incoming request to the

server service must exceed this threshold.

10




Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

High Broadcast Frames

This indication is sent when the number of broadcast frames on the internal

segment is too high.

This indication is generated only on Windows NT systems.


NetworkSegment

The identity of the network segment analyzed. NetworkSegment is a key

attribute.

PercentBroadcastFrames

The percentage value of broadcast frames on the network segment

PercentNetworkUtil

The percentage value of network utilization on the segment



High Percent Broadcast

(HighPercentBroadcast)

The percentage of broadcast frames on the

internal network segment must exceed this

threshold.

90



The utilization on the internal network segment


40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning



High Current Commands

This indication is sent when the number of current commands on the redirector, or

workstation service, is too high. Because the redirector throughput is normal, it is

assumed a problem with the workstation service or a software component

connected to that service.


CurrentBandWidth

The bandwidth of the network interface card

CurrentCommands

The current commands that are queued for service on the redirector, or

workstation service

RedirectorBPS

The bytes per second transferred through the redirector, or workstation

service




Modifier

(HighCurrCmdsMod)

This value is multiplied by the number of

network cards installed on the system. If

the number of current commands rises

above this level, a bottleneck occurs. The

number of current commands must exceed

this threshold.

10

High Percent Bytes Per Second





bandwidth that can be used by the

redirector, or workstation service.

Redirector throughput must not exceed

this threshold.

9



The utilization on the internal network


On Windows NT systems, this threshold

must not be exceeded. On Windows 2000,

Windows XP, or Windows Server 2003

operating systems, this threshold is

ignored.

40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning



High Errored Ratio

This indication is sent when the ratio between the number of sessions errored out

and the sum of sessions errored out, forced off, and logged off is high. This

indicates how frequently network problems are causing dropped sessions on the

server service.


ServerTotalSessions

The total number of sessions on the server errored out, forced off, and

logged off

SessionsErroredOut

The number of sessions errored out on the server

SessionsErroredRatio

The percentage of sessions errored out to the sum of the sessions errored

out, forced off, and logged off

SessionsForcedOff

The number of sessions forced off the server

SessionsLoggedOff

The number of sessions logged off the server



High Errored Out Ratio

(HighErroredOutRatio)

This threshold is a percentage generated by

dividing the number of sessions errored out by the

sum of the sessions errored out, forced off, and

logged off. This threshold must be exceeded.

50


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Critical

Network Interface Card Overworked

This indication is sent when the data transfer rate through the network card is too

high and the outbound queue length is too large.


CurrentBandWidth


NetworkInterface

The identity of network interface card examined. NetworkInterface is a key

attribute.



NICBPS

The throughput of the network interface card

OutputQueueLength

The number of requests queued up to be sent out the network interface

card



High Output Queue Length

Modifier

(HighOutputQueueLengthMod)

The length of the network card output

queue must exceed the sum of the number

of network cards installed in the system

plus this value.

3






bandwidth that may be used by the

network card. Network card throughput


9


Setting Default

Clearing Event Yes

Holes 1

Occurrences 3


Manager

No


Severity Warning

Network Interface Card Too Slow

This indication is sent when the outbound queue length is high but the data

transfer rate through the network interface card is normal.


CurrentBandWidth


NetworkInterface

The identity of network interface card examined. NetworkInterface is a key

attribute.

NICBPS

The bytes per second transferred through the network interface card

OutputQueueLength

The number of requests queued up to be sent out the network interface

card






Modifier


The length of the network card output

queue must exceed the sum of the number

of network cards installed in the system

plus this value.

3







network card. Network card throughput


9


Setting Default

Clearing Event Yes

Holes 1

Occurrences 3


Manager

No


Severity Warning

Redirector Affecting Server

This indication is sent when there is a high work item shortage, the data transfer

rate on the redirector is high, and the data transfer rate on the server service is

normal.

This event is generated only on Windows NT systems.


CurrentBandWidth


NetworkSegment


attribute.

PercentNetworkUtil

The percentage of network utilization on the segment

RedirectorBPS

The number of bytes per second transferring through the redirector, or

workstation service

WorkItemShortages








Second





bandwidth that may be used by the server

service and the redirector. Redirector

throughput must exceed this threshold. Server

throughput must not exceed this threshold.

9





40



The number of times that a work item cannot

be allocated to process an incoming request to

the Windows server service must exceed this

threshold.

10


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Redirector Overloaded

This indication is sent when the redirector, or workstation service, is unable to

process the number of incoming requests. The number of current commands and

the data transfer rate on the redirector are high, but the network segment percent

utilization is normal.


CurrentBandWidth


CurrentCommands


workstation service

RedirectorBPS


workstation service






Modifier

(HighCurrCmdsMod)


network cards installed on the system. If the

number of current commands rises above this

level, a bottleneck occurs. The number of

current commands must exceed this threshold.

10






bandwidth that can be used by the redirector,

or workstation service. Redirector throughput


9







XP, or Windows Server 2003 operating

systems, this threshold is ignored.

40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Redirector Overloaded Affecting Segment

This indication is sent when the redirector, or workstation service, is overloaded

and is causing a bottleneck on the network segment. The current commands and

the data transfer rate on the redirector are exceeded.



CurrentBandWidth


CurrentCommands


workstation service

NetworkSegment

The network segment analyzed. NetworkSegment is a key attribute.

PercentNetworkUtil




RedirectorBPS


workstation service




Modifier

(HighCurrCmdsMod)



number of current commands rises above

this level, a bottleneck occurs. The number

of current commands must exceed this

threshold.

10




internal network segment must not exceed

this threshold.

90







redirector, or workstation service. Redirector

throughput must exceed this threshold.

9




segment must exceed this threshold.

40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Segment Affecting Redirector

This indication is sent when the network segment is overloaded and then affects

the redirector, or workstation service. The number of current commands is large,

but the data transfer rate on both the server and redirector are normal. Use of the

network segment is also high, and it is assumed that this is the reason for the large

current command count.



CurrentCommands


workstation service

NetworkSegment




PercentNetworkUtil





Modifier

(HighCurrCmdsMod)






10




internal network segment must not exceed this

threshold.

90


Second





bandwidth that can be used by the redirector, or

workstation service, and server service.

Redirector and server throughput must not


9





40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Segment Affecting Server

This indication is sent when the network segment is overloaded, affecting the

server service. There is a work item shortage, but the data transfer rate on both the

server and redirector, or workstation service, are normal. Utilization of the network

segment is also high, and it is assumed that this is the reason for the work item

shortage.



NetworkSegment


PercentNetworkUtil




WorkItemShortages









threshold.

90


Second


The bandwidth of the network card is multiplied

by this value to determine the maximum

percentage of network card bandwidth that can

be used by the redirector, or workstation service,

and server service. Redirector and server

throughput must not exceed this threshold.

9





40



The number of times that a work item cannot be

allocated to process an incoming request to the

Windows server service must exceed this

threshold.

10


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Server Affecting Redirector

This indication is sent when the network segment is overloaded as a result of the

large amount of data coming through the server service. Current commands and

server data transfer rate are high, but the data transfer rate on the redirector, or

workstation service, is normal. This causes utilization of the network segment to

rise.



CurrentBandWidth


CurrentCommands


workstation service

NetworkSegment




PercentNetworkUtil


ServerBPS

The bytes per second transferred through the server




Modifier

(HighCurrCmdsMod)






10





threshold.

90


Second (HighPercentBytesSec)




bandwidth that can be used by the redirector,

or workstation service, and server service.

Server throughput must exceed this threshold.

Redirector throughput must not exceed this

threshold.

9





40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Server Overloaded

This indication is sent when the workload on the server service is too high. This

occurs when there is a work item shortage, the data transfer rate on the server is

high, and the utilization of the network segment is normal.


CurrentBandWidth


ServerBPS


WorkItemShortages


incoming requests to the server. WorkItemShortages is a key attribute.






Second






service. Server throughput must exceed this

threshold.

9







XP, or Windows Server 2003 operating systems,

this threshold is ignored.

40






threshold.

10


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Server Overloaded Affecting Segment

This indication is sent when the server service is overloaded because a large

amount of data has been requested from the server. This occurs when there is a

work item shortage and a high data transfer rate through the server.



CurrentBandWidth


NetworkSegment


attribute.

PercentNetworkUtil

The percentage value of network utilization on the segment

ServerBPS




WorkItemShortages


incoming requests to the server. WorkItemShortages is a key attribute.







threshold.

90


Second






service. Server throughput must exceed this

threshold.

9





40






threshold.

10


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the Network Interface

Card resource model. For each threshold, the table shows the name, a short

description, and the default value.



Modifier

(HighCurrCmdsMod)

This threshold counts the number of requests

to the redirector, or workstation service, that

are currently queued for service. If this

number is much larger than the number of

network cards installed in the computer,

congestion can occur. This threshold is

calculated by multiplying the number of

network cards in the system by this value.

10

High Errored Out Ratio

(HighErroredOutRatio)

This threshold is a percentage generated by

dividing the number of sessions errored out

by the sum of the sessions errored out, forced

off, and logged off.

50





Modifier


This threshold adjusts the output queue length

for a network card. It is calculated by adding

the number of network cards in the system to

this value.

3





threshold.

HighPercentBroadcast is a Windows NT-only

property; therefore this threshold is only valid

when running the Network Interface Card

resource model on a Windows NT operating

system. For other Windows operating systems,


90



This threshold is the maximum percentage of

network card bandwidth that can be used by a

process, such as the server service or the

redirector, or workstation service. The

bandwidth of the network card is multiplied

by this value to determine the threshold,

which is then used to determine if the data

transfer rate is excessive.

9




network utilization of the internal segment.

HighPercentUtilization is a Windows NT-only

property; therefore this threshold is only valid

when running the Network Interface Card

resource model on a Windows NT operating

system. For other Windows operating systems,


40




times that no work item is available, or no

work item can be allocated to the server

service to process an incoming request.

10

Built-in actions

This resource model contains the following built-in actions associated with the

Adjust Work Items indication (TMW_AdjustWorkItems event):

v Adjust the InitWorkItems registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

LanManServer\Parameters\InitWorkItems to a value of 512.

v Adjust the MaxWorkItems registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

LanManServer\Parameters\MaxWorkItems. The maximum value for Windows

Workstations is 64 and 65 535 on Windows Servers.

Logging


be logged:




Network Interface

Card

Network Traffic

BytesReceivedSec

The total number of bytes received.

BytesSentSec

The total number of bytes sent.

BytesTotalSec

The rate at which the network is

processing data (bytes per second)

CurrentBandwidth

The network card bandwidth (bytes

per second)

NetworkInterfaceCard

The network interface card name

Output Queue Length

NetworkInterfaceCard

The network interface card name

OutputQueueLength

The length of output queue

Network Segment Percent Broadcast Data for the Network Segment resource is

logged on Windows NT systems only.

PercentBroadcastFrames

The percentage of broadcast frames

on the network segment

PercentNetworkUtil

The percentage of the network

utilization

Segment

The segment identifier

Redirector Bytes Rate

BytesTotalSec

The rate at which the redirector, or

workstation service, is processing

data (bytes per second)

Redirector

″Total″

Current Commands

CurrentCommands

The number of requests that are

currently queued for the redirector,

or workstation service.

Redirector

″Total″



||

||


Server Bytes Rate

BytesTotalSec

The rate at which the server is

processing data (bytes per second)

Server ″Total″

Server Activity

Server ″Total″

ServerTotalSession

The number of sessions on the

server

SessionsErroredOut

The number of sessions that ended

in error

SessionsForcedOff

The number of sessions forced

offline

SessionsLoggedOff

The number of sessions logged off

WorkItemShortages

The number of work item shortages

Parametric Event Log resource model

Description



This resource model examines the Windows event logs for events that are specified

by the user through the parameter configuration.



Built-in actions No

Category Windows

Clearing events No


Internal name TMW_ParamEventLog

Parameters Yes

Thresholds No




The following table lists the event that can be generated by the Parametric Event

Log resource model, the name of the indication from which each event is




TMW_NTEventLogOccurred Windows event logged Warning 60

Windows Event Logged

This indication is sent when the user-specified event occurs and is logged in the

Windows event log.


ComputerName

The name of the computer where the event occurred. ComputerName is a

key attribute.

EvtID Identifies the event EvtID is a key attribute.

Logfile

The name of the log file in which the event was generated (for example,

system, security, or application).

Message

The message text of the event

RepeatCount

The number of Event ID events received during a cycle

Severity

The severity of the event

SourceName

The variable-length null-terminated string specifying the name of the

source (application, service, driver, subsystem) that generates the entry. It,

together with the EventIdentifier, uniquely identifies an NT event type.

TimeGenerated

The time the event was generated

TimeWritten

The time the event was written to the event log


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Windows resource models: Parametric Event Log


Parameters

The following table lists the parameters that can be set for this resource model.

When no parameters are specified for any of the filters, the resource model

generates an event for each event that appears in any of the three event logs of the

system.

Parameter Description Default

Computers

(Computers)

This parameter is a list of the computers from

which the events were generated. Each value must

be the same as the Computer field of the event, as

shown in the Windows event log.

None

Event IDs

(Eids)

This parameter is a list of the event identifiers to

be monitored. Each value must be the same as the

Event ID field of the event, as shown in the

Windows event log.

None

Event Severity

(Severity)

This parameter is the set of event severities to be

monitored. You may select any of the following

severities:

v Error

v Information

v Security audit failure

v Security audit success

v Warning

These event severities correspond to the following

IBM Tivoli Enterprise Console severities:

Error Minor

Information

Harmless

Security audit failure

Minor

Security audit success

Harmless

Warning

Warning

For Windows NT operating systems, this filter is

not available for non-English systems due to a

limitation of the Windows operating system

Management Instrumentation (WMI). This

limitation was removed with Windows 2000

Service Pack 3. On Windows 2000 Service Pack 3

or greater, Windows XP, and Windows Server 2003

operating systems, this filter can be used with any

language.

None

Filter Type

(FilterType)

This parameter specifies the way in which the

other parameters are applied to the events in the

event log. The AND filter triggers an event only

when all of the conditions specified by the other

parameters are met. The OR filter triggers an event

when any of the conditions specified by the other

parameters is met.

AND




Log File Type

(LogType)

This parameter is the set of event logs to be

monitored. You may select any of the following

logs:

Application

Records events logged by applications.

Security

Records security events.

System Records events logged by the Windows

operating system components.

None

Source

(Source)

This parameter is a list of the software components

that logged the events. The source may be an

application or a system component, such as a

device driver. Each value must be the same as the

Source field of the event, as shown in the

Windows event log.

None

Windows 2000 Logs

(Win2kLogs)

This parameter is the set of Windows 2000 event

logs to be monitored. You may select any of the

following logs:

v Directory Service

v DNS Server

v File Replication Service

None

Parametric Services resource model

Description



The Parametric Services resource model checks that the services specified by the

user are running and functioning properly. Events are generated when:

v User-specified services are stopped.

v User-specified services are unstable.




Category Windows

Clearing events Yes


Internal name TMW_ParamServices

Parameters Yes

Thresholds No




The following table lists the event that can be generated by the Parametric Services



indication:


TMW_ParamServicesFailingService Services Failing Service Critical 63

TMW_ParamServicesStoppedService Services Stopped Service Critical 64

Services Failing Service

This indication is sent when one of the user-specified services is in an unstable

state.

The possible state values that Windows might assign to a service are:

v Continue Pending

v Pause Pending

v Paused

v Running

v Start Pending

v Stop Pending

v Stopped

v Unknown

The possible status values that Windows might assign to a service are:

v Degraded

v Error

v OK

v Pred Failure (predicting a failure)

v Service

v Starting

v Stopping

v Unknown

This event is sent if the service state is not Stopped and the status is other than

OK, Starting, or Stopping. Stop unstable services to prevent them from adversely

affecting the system.


Name

The name of the service examined. Name is a key attribute.

ServiceStatus

The current status of the service

StartMode

The start mode of the service

State The current state of the service


Windows resource models: Parametric Services


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Services Stopped Service

This indication is sent when one of the user-specified services is stopped. If a key

service is stopped, it must be restarted to ensure that the Windows operating

system is working properly.


Name The name of the service examined. Name is a key attribute.

ServiceStatus


StartMode



Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Critical



Parameters

The following table lists the parameter that can be set for this resource model.


Services (services) This parameter is a list of the services to be

monitored on Windows operating systems.

Specify the exact name of each service, as

defined in the Registry under the following

key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl

Set\Services

The following list

shows the exact

default name for each

service, as defined in

the Registry:

v Browser

v EventLog

v LanmanServer

v LanmanWorkstation

v lcfd

v Netlogon

v NtLmSsp

Built-in actions

This resource model contains the following built-in actions:


Services Failing

Service

If the service is in a started or paused state, this action stops the

service and then starts it again.

Services Stopped

Service



Logging


be logged:


Service Services Status

Service The service name

State The state of the service

Status The status of the service

For additional information about state values

and status values for Windows-based

operating systems, see “Services Failing

Service” on page 63.

Parametric TCP/IP Ports resource model

Description





The Parametric TCP/IP Ports resource model monitors the TCP and user datagram

protocol (UDP) ports that you specify. It sends an event when a monitored port is

found in one of the selected states.



Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_ParamPorts

Parameters Yes

Thresholds No






Prerequisites

The parametric TCP/IP ports resource model requires the TCP/IP protocol to be

installed.

Note: If you do not specify a port number, the resource model returns the

following error message:

Unable to Start (11)


The following table lists the event that can be generated by the Parametric TCP/IP

Ports resource model, the name of the indication from which each event is




TMW_ParamPortStatus State of the Defined Port Warning 66

State of the Defined Port

This indication is sent when a specified port is found to be in one of the selected

states. For example, if you enter a port number and select CLOSED in the check

box, an event is generated when the specified port connection is closed.


LocalPort

The port number. LocalPort is a key attribute.

LocalPortName

The name of the port monitored

State Indicates the state of the port monitored

Windows resource models: Parametric TCP/IP Ports



Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for this resource model.

Together, the parameters function as a filter.


Port Numbers

(ParamPortList)

This parameter is a list of the port numbers to be

monitored.

None

Possible State of a Port

(ParamPortStatusList)

This parameter is the set of port states that are

monitored. Ports can be monitored for one or more

of the following states:

v CLOSED

v LISTENING

CLOSED

Logging


be logged:


Port Port State

Port The port

State The state of the port

Physical Disk resource model

Description



The Physical Disk resource model detects bottlenecks associated with the physical

disks that are configured on the system. This resource model highlights the

following areas:

v Bytes transferred per second

Bytes transferred per second indicates the raw amount of data that is transferred

through the disk. The maximum transfer rate per second that a disk subsystem

can handle depends on the type of hard drive, the type of controller, the drive

Windows resource models: Parametric TCP/IP Ports


configuration, and, in the case of most IDE-based hard drives, the speed of the

processor. Data transfer rate can be a good indicator of whether too much data

is routed through the disk.

v Percentage usage

Another indicator that a disk is over worked or is causing a bottleneck is the

percentage usage of the disk. Alter the percentage of disk usage threshold when

you discover bottlenecks while monitoring file servers. File servers, print servers,

and mail servers can expect to use a high percentage of disk space. For

workstations, the high percentage of disk usage is typically experienced in short

bursts.

Workstations with high disk usage experience declining performance in

processor speed and general system response. In these situations, a high

percentage usage of the disk creates a bottleneck.



Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_PhysicalDiskModel

Parameters No

Thresholds Yes







The following table lists the events that can be generated by the Physical Disk



indication:


TMW_HighPhysicalDiskReadBytesSec High Read Bytes per Second Minor 69

TMW_HighPhysicalDiskWriteBytesSec High Write Bytes per Second Minor 71

TMW_HighPhysicalDiskXferRate High Transfer Rate Minor 70

TMW_HighPhysicalPercentDiskTime High Percent Disk Time Warning 68

TMW_PhysicalPossibleFrag Physical Disk Possible

Fragmentation

Minor 72

TMW_SlowPhysicalDrive Slow Physical Drive Warning 72

High Percent Disk Time

This indication is sent when the percentage of time that a physical disk is in use is

high. The drive cannot process requests fast enough and the disk queue grows.

Windows resource models: Physical Disk



PercentDiskTime

The percentage of time that the physical drive is used

PercentReadTime

The percentage of time that the physical drive is used for read operations

PercentWriteTime

The percentage of time that the physical drive is used for write operations

PhysicalDisk

The physical disk on which the physical disk resides. PhysicalDisk is a key

attribute.




(HighBytesSec)



1 572 864

High Percent Usage

(HighPercentUsage)



this threshold.

90

High Queue Length

(HighQLength)



threshold.

3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

High Read Bytes per Second

This indication is sent when a physical disk is reading an excessive amount of data

per second.


DiskReadBytesSec

The number of bytes read per second on the physical disk

DiskReadSec

The number of transactions that are read per second on the physical disk

PercentDiskRead

The percentage of the physical drive used to read data

PhysicalDisk

The physical disk monitored. PhysicalDisk is a key attribute.






(HighBytesSec)

The number of bytes read per second must exceed

this threshold.

1 572 864

High Percent Usage

(HighPercentUsage)



threshold.

90

High Queue Length

(HighQLength)


busy servicing read requests must not exceed this

threshold.

3


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor

High Transfer Rate

This indication is sent when a physical disk is reading and writing an excessive

amount of data per second.


DiskReadsSec

The rate of bytes read per second on the physical disk

DiskWritesSec

The rate of bytes written per second on the physical disk

DiskXfersSec

The rate of bytes read or written per second on the physical disk

PercentDiskReadTime

The percentage of the physical drive used for read operations


The percentage of the physical drive used for write operations

PhysicalDisk





(HighBytesSec)



1 572 864

High Percent Usage

(HighPercentUsage)



threshold.

90




High Queue Length

(HighQLength)


busy servicing read or written requests must not


3


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor


This indication is sent when a physical disk is writing an excessive amount of data

per second.


DiskWriteBytesSec

The number of bytes written per second on the physical disk

DiskWriteSec

The number of transactions written per second on the physical disk

PercentDiskWrite

The percent of the physical drive used during write operations

PhysicalDisk





(HighBytesSec)

The number of bytes written per second must


1 572 864

High Percent Usage

(HighPercentUsage)



threshold.

90

High Queue Length

(HighQLength)


busy servicing written requests must not exceed

this threshold.

3


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10



Setting Default


Manager

No


Severity Minor

Physical Disk Possible Fragmentation

This indication is sent when a disk might be excessively fragmented. This event

occurs when the percentage of disk usage is too high, the queue length is low, and

the transfer rates are low.


DiskBytesSec


PercentDiskTime


PhysicalDisk





(HighBytesSec)



1 572 864

High Percent Usage

(HighPercentUsage)



threshold.

90

High Queue Length

(HighQLength)


busy servicing read or written requests must not


3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor

Slow Physical Drive

This indication is sent when the physical disk is too slow to keep up with the

work it must perform. The data transfer rate and request queue length for the

drive are both high.




AvgQLength


AvgReadQLength

The average queue length for read operations

AvgWriteQLength

The average queue length for write operations

CurrentDiskQLength

The number of jobs waiting to be processed by the physical disk

DiskReadBytesSec


DiskWriteBytesSec


PercentDiskTime

The percentage of time that the physical disk is used

PhysicalDisk





(HighBytesSec)



1 572 864

High Queue Length

(HighQLength)


busy servicing read or written requests must


3


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the Physical Disk

resource model. For each threshold, the table shows the name, a short description,

and the default value.



(HighBytesSec)

This threshold is the maximum number of bytes


the average physical disk.

1 572 864




High Percent Usage

(HighPercentUsage)


that the selected disk drive spends servicing read

or write requests.

90

High Queue Length

(HighQLength)


outstanding requests for the disk. It includes

requests in progress at the time of the snapshot.

This is an exact length, not an average over the

time interval.

3

Logging


be logged:


PhysicalDisk Bytes Transferred

DiskBytesSec

The amount of data read or written

per second

PhysicalDisk

The physical disk identifier

Percent Disk Usage

PercentDiskTime


physical drive is in use

PhysicalDisk


Queue Length

AvgQLength


PhysicalDisk


Printer resource model

Description


Distribute this resource model to Windows 2000, Windows XP, or Windows

Server 2003-based operating systems. This resource model cannot be used

with Windows NT operating systems.

The Printer resource model determines if there are any problems in the Windows

printing engine. These checks include determining if a print queue is generating an

abnormally high number of errors, such as out-of-paper errors, or consuming too

much processor time.





Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_PrintModel

Parameters No

Thresholds Yes







The following table lists the events that can be generated by the Printer resource



indication:


TMW_HighCurrentPercentTime High Current Percentage Time Warning 75

TMW_HighJobErrors High Job Errors Warning 76

TMW_HighJobErrorsPerDay High Job Errors Per Day Harmless 77

TMW_HighNotReadyErrors High Not Ready Errors Warning 77

TMW_HighNotReadyErrorsPerDay High Not Ready Errors Per Day Harmless 78

TMW_HighOutOfPaperErrors High Out Of Paper Errors Minor 77

TMW_HighOutOfPaperErrorsPerDay High Out Of Paper Errors Per

Day

Harmless 79

High Current Percent Time

This indication is sent when a job is using a large amount of processor time on the

print server. If processor-intensive jobs are continually sent to the printer, the

administrator must decide if a processor upgrade is required or if larger jobs

should be off-loaded to a more powerful server.


CurrentPercentTime

The total percentage of processor usage

CurrentPercentTimeJob

The percentage of processor time used by the print job

JobObject

The identity of the print job. JobObject is a key attribute.

Windows resource models: Printer




Percent Processor

(PercentProcessor)

This percentage of the processor time used by a

print job must exceed this threshold.

80


Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Warning

High Job Errors

This indication is sent when the number of printer job errors is high. This behavior

is typical of corrupted or bad drivers installed on either the workstation sending

the print job or on the print server.


JobErrors

The total number of job errors

PrintQueue

The print queue, or printer name. PrintQueue is a key attribute.



Job Errors

(JobErrors)

The number of job errors must exceed this

threshold.

0


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning



High Job Errors per Day

This indication is sent when the number of printer job errors per day is high. This

behavior is typical of corrupted or bad drivers installed on either the workstation

sending the print job or on the print server.


JobErrorsPerDay

The total number of job errors per day

PrintQueue


SystemUpTimeDays

The time the system has been running, in days

TotalJobErrors

The total number of job errors since the last reboot



Job Errors Per Day

(JobErrorsPerDay)

The number of job errors per day must exceed this

threshold.

10


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Harmless

High Not Ready Errors

This indiction is sent when the number of printer not--ready errors is high. The

printer might be offline or experiencing a paper jam.


NotReadyErrors

The total number of not ready errors

PrintQueue




Not Ready Errors

(NotReadyErrors)

The number of not ready errors must exceed this

threshold.

0




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

High Not Ready Errors per Day

This indication is sent when the number of printer not-ready errors per day is

high. The printer might be offline or experiencing a paper jam.


NotReadyErrorsPerDay

The total number of not ready errors, calculated per day

PrintQueue


SystemUpTimeDays


TotalNotReadyErrors

The total number of not ready errors since the last reboot



Not Ready Errors Per

Day

(NotReadyErrorsPerDay)

The number of not ready errors per day must


8


Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Harmless

High Out of Paper Errors

This indication is sent when the number of printer out-of-paper errors is high. The

paper supply is insufficient for the print demand. Solutions to the problem include

additional or larger paper trays, or routing jobs to other, larger printers.




OOPErrors

The total number of out-of-paper errors

PrintQueue




Out Of Paper Errors

(OutOfPaperErrors)

The number of out-of-paper errors must exceed

this threshold.

0


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Minor

High Out of Paper Errors per Day

This indication is sent when the number of printer out-of-paper errors per day is

high. The paper supply is insufficient for the print demand. Solutions to the

problem include additional or larger paper trays, or routing jobs to other, larger

printers.


OOPErrorsPerDay

The total number of out-of-paper errors, calculated per day

PrintQueue


SystemUpTimeDays


TotalOOPErrors

The total number of out-of-paper errors since the last reboot



Out Of Paper Errors Per

Day

(OutOfPaperErrorsPerDay)

The number of out-of-paper errors must exceed

this threshold.

6




Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Harmless

Thresholds

The following table lists the thresholds that can be set for the Printer resource


default value.


Job Errors

(JobErrors)

This threshold is the maximum number of job

errors that can occur per monitoring cycle.

0

Job Errors Per Day

(JobErrorsPerDay)

This threshold is the maximum number of job

errors that can occur per day.

10

Maximum Print Jobs

(MostPrintJobs)

This threshold is the maximum number of print

jobs are examined when looking for problems

such as out-of-paper errors or high processor

utilization.

60

Maximum Print Queues

(MostPrintQueues)

This threshold is obsolete. None

Not Ready Errors

(NotReadyErrors)


not-ready errors that can occur per monitoring

cycle.

0

Not Ready Errors Per Day

(NotReadyErrorsPerDay)


not-ready errors that can occur per day.

8

Out Of Paper Errors

(OutOfPaperErrors)


out-of-paper errors that can occur per monitoring

cycle.

0

Out Of Paper Errors Per

Day

(OutOfPaperErrorsPerDay)


out-of-paper errors that can occur per day.

6

Percent Processor

(PercentProcessor)


processor time that a single job can consume.

80

Logging


be logged:




PrintQueue Errors

JobErrors

The number of jobs in error

NotReadyErrors

The number of not ready errors

OutOfPaperErrors

The out-of-paper errors

PrintQueue

The print queue name

Process resource model

Description



The Process resource model looks for bottlenecks that occur in running processes,

such as processes using excessive processor time.



Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_Process

Parameters No

Thresholds Yes







The following table lists the events that can be generated by the Process resource



indication:


TMW_ProcessHandleLeak Process Handle Leak Warning 82

TMW_ProcessHighCPU Process High CPU Critical 82



Process Handle Leak

This indication is sent when a process leaks handles. The resource model examines

the top n processes, where n is the value of the Maximum Processes threshold, that

are using more handles than the Maximum Handles threshold. These are compared

to the top n processes from the previous monitoring cycle. Process identifiers are

matched and, for each process that is present in both cycles, the number of handles

in use is compared. If the handle count has increased, this indication is sent.


CurrentHandleCount

The current number of handles allocated to the process

CurrentHanProcessID

The process identifier. CurrentHanProcessID is a key attribute.

Process

The process name. Process is a key attribute.


Maximum Handles

(MaxHandles)

The maximum number of handles the process is

using use must exceed this threshold.

300

Maximum Processes

(MaxProcesses)


processes that are compared. These processes are

ordered from the process with the highest handle

count to the lowest.

5


Setting Default

Clearing Event Yes

Holes 1

Occurrences 40


Manager

No


Severity Warning

Process High CPU

This indication is sent when a process uses too much processor time. An indication

is sent for each of the top n processes, where n is the value of the Maximum

Processes threshold, that are using a higher percentage of processor time than the

High CPU Usage threshold.


IDProcess

The process identifier. IDProcess is a key attribute.

PrcPercentPrivilegedTime

The percentage privileged time of the CPU used by the process

PrcPercentUserTime

The percentage usage of the CPU used by the process

Windows resource models: Process


PrcPriorityBase

The base priority of the process

Process

The process name. Process is a key attribute.


High CPU Usage

(HighCPUUse)

The maximum percentage of processor time that a

process is using must exceed this threshold.

60

Maximum Processes

(MaxProcesses)


processes that are compared. These processes are

ordered from the process with the highest CPU or

processor usage to the lowest.

5


Setting Default

Clearing Event Yes

Holes 3

Occurrences 20


Manager

No


Severity Critical

Thresholds

The following table lists the thresholds that can be set for the Process resource


default value.


High CPU Usage

(HighCPUUse)


processor time that a process can use.

60

Maximum Handles

(MaxHandles)

This threshold is the maximum number of handles

that a process can use.

300

Maximum Processes

(MaxProcesses)


processes that are compared. For the Process

Handle Leak indication, the processes are ordered

from the process with the highest handle count to

the lowest. For the Process High CPU indication,

the processes are ordered from the process with

the highest processor usage to the lowest.

5

Logging


be logged:




Process Handle Usage

HandleCount

The number of handles allocated to

the process


PercentProcessorTime

The percentage of processor time

used by the process

Process The name of the process

This resource model logs data only if the

Maximum Handles (MaxHandles) threshold

is exceeded. For additional information about

threshold values for the Process resource

model for Windows-based operating systems,

see “Process Handle Leak” on page 82.

CPU Usage


PercentPrivilegedTime

The percentage of privileged

processor time used by the process

PercentUserTime

The percentage usage of the CPU

used by the process

Process The name of the process

This resource model logs data only if the

High CPU Usage (HighCPUUse) threshold is

exceeded. For additional information about

threshold values for the Process resource

model for Windows-based operating systems,

see “Thresholds” on page 83.

Processor resource model

Description



The Processor resource model detects bottlenecks related to the central processing

unit (CPU). Events are generated when processor usage is high or when all

processors in a multi-processor system are not utilized at approximately the same

rate.

The Processor resource model detects bottlenecks happening within or from the

Central Processing Unit (CPU). The Processor resource model highlights the

following areas:

v High CPU usage



Because every process and every device on the system must interact with the

CPU, either directly or through a controller, it is imperative that the CPU is not

extensively used by a single process or device for an extended period of time.

There can be exceptions to this rule for certain application-based servers.

The system administrator needs ultimately to decide how much utilization one

process makes of the CPU for these situations. Tests to determine how busy a

CPU are include checking the percentage usage, the percentage interrupts, and

the queue length.

v Multiple CPU problems

With systems running with more than one processor, it is not always obvious

that a CPU is not working. A check is made to ensure that all CPUs are utilized

at approximately the same rate.

If there are problems with a CPU, the CPU activity is either abnormally high or

totally inactive, in either case this check detects the CPU that is faulty.



Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_Processor

Parameters No

Thresholds Yes







The following table lists the events that can be generated by the Processor resource



indication:


TMW_HighPercentUsageDelta High Percent Usage Delta Minor 88

TMW_BusyHardware Busy Hardware Warning 86

TMW_CPUCantKeepUpWithHW CPU Cannot Keep up with Hardware Critical 86

TMW_HighProcesses High Processes Critical 89

TMW_HWKeepingCPUBusy Hardware Keeping CPU Busy Warning 87

TMW_ProcessorBusy Processor Busy Critical 90

Windows resource models: Processor


Busy Hardware

This indication is sent when one or more devices installed in the system use an

excessive amount of processor time. The interrupt rate is high and the processor is

spending an excessive amount of time handling these interrupts.


InterruptsSec

The number of interrupts per second that are passed to the processor

PercentInterruptTime

The percentage usage of the processor as it handles interrupt requests


The percentage of usage of the processor

Processor

The processor identifier. Processor is a key attribute.



High CPU Usage

(HighCPUUsage)

The percentage of the total processor capacity that

is currently being used must exceed this

threshold.

80

High CPU Usage

Interrupt

(HighCPUUsageInterrupt)

The percentage of processor time used to service

interrupts must exceed this threshold.

20

High Interrupts per

Second

(HighInterruptsSec)

The number of interrupts per second (the rate at

which devices are accessing the processor) must


600


Setting Default

Clearing Event Yes

Holes 3

Occurrences 15


Manager

No


Severity Warning

CPU Cannot Keep Up with Hardware

This indication is sent when the number of hardware requests exceed the capacity

of the processor. Processor usage, time spent handling interrupts, and the number

of threads waiting in the processor queue are all high.


InterruptsSec








Processor




High CPU Usage

(HighCPUUsage)

The percentage of the total processor capacity

that is currently being used must exceed this

threshold.

80

High CPU Usage Interrupt




20

High Interrupts per Second

(HighInterruptsSec)



not exceed this threshold.

600

Total CPUs Modifier

(TotalCPUsMod)

This value is added to the number of processors

in the system. The number of threads waiting in

the processor queue must exceed this threshold.

10


Setting Default

Clearing Event Yes

Holes 3

Occurrences 15


Manager

No


Severity Critical

Hardware Keeping CPU Busy

This indication is sent when hardware devices are keeping the processor busy, but

it is able the workload. Processor usage and the time spent servicing interrupts are

high, but the number of threads waiting in the processor queue is normal.


InterruptsSec






Processor






High CPU Usage

(HighCPUUsage)



threshold.

80





20


(HighInterruptsSec)




600

Total CPUs Modifier

(TotalCPUsMod)

This value is added to the number of processors

in the system. The number of threads waiting in

the processor queue must not exceed this

threshold.

10


Setting Default

Clearing Event Yes

Holes 3

Occurrences 15


Manager

No


Severity Warning

High Percent Usage Delta

This indication is sent when a system has more than one processor and the

difference in the percentage of utilization between the most-used and least-used

processor is high.


IDProcess

The identifier of the process with the highest percentage of processor time

LowProcessor

The identifier of the least-used processor

PercentUsageFirst

The percentage of utilization of the most-used processor

PercentUsageLast

The percentage of utilization of the least-used processor

Process

The name of the process using the highest percentage of processor time

Processor

The identifier of the most-used processor. Processor is a key attribute.

ProcessPercentProcessorTime

The percentage of processor time that the process using the highest amount

of resources is using






(HighPercentUsageDelta)

The difference in percentage usage between the

most-used and least-used processor must exceed

this threshold.

5


Setting Default

Clearing Event Yes

Holes 3

Occurrences 10


Manager

No


Severity Minor

High Processes

This indication is sent when a process is using an excessive percentage of processor

time. Processor usage is high, but the percentage of time used to service interrupt

requests is normal.


HighProcesses

The total number of high-usage processes

IDProcess

The identifier of the process with the highest processor usage


The total percentage usage of the processor

Process

The name of the process with the highest processor usage that is active on

the CPU

Processor




High CPU Usage

(HighCPUUsage)



threshold.

80




interrupts must not exceed this threshold.

20

High CPU Usage Process

(HighCPUUsageProcess)

The percentage of processor utilization by a

single process must exceed this threshold.

40




Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Critical

Processor Busy

This indication is sent when processor usage is high, but no specific processes or

devices are responsible.





The percentage privileged time of the processor



PercentUserTime

The percentage user time of the processor

Processor




High CPU Usage

(HighCPUUsage)

The percentage of the total processor capacity that

is currently being used must exceed this

threshold.

80

High CPU Usage

Interrupt



interrupts must not exceed this threshold.

20



The percentage of processor utilization by a single

process must not exceed this threshold.

40


Setting Default

Clearing Event Yes

Holes 1

Occurrences 20


Manager

No


Severity Critical



Thresholds

The following table lists the thresholds that can be set for the Processor resource


default value.


High CPU Usage

(HighCPUUsage)


processor usage. Although processor usage

can reach 100 percent, it should not be

sustained for an extended period of time.

80




processor usage for interrupt requests,

generated by hardware devices.

20




processor utilization for a single process.

40

High CPU Usage User

Privilege

(HighCPUUsageUserPriv)

This threshold is obsolete. None


(HighInterruptsSec)


device interrupts to the processor per second.

600


(HighPercentUsageDelta)

This threshold is the maximum difference in

the percentage usage between the most-used

and least-used processors in the system. This

threshold is only used if more than one

processor is installed.

5

Total CPUs Modifier

(TotalCPUsMod)

This value is added to the total number of

processors in the system. The resulting value

is the maximum number of threads that can

be waiting in the processor queue.

10

Logging


be logged:




Processor Load Balance

Delta ″Delta_CPU″

HighestPercentUsage

The percentage utilization of the

most-used processor.

LowestPercentUsage

The percentage utilization of the

least-used processor.

Processor Queue

Length

Processor

The processor identifier

ProcessorQueueLength

The processor queue length

Interrupt Time

InterruptsSec

The number of processor interrupts

per second

Processor


CPU Usage


The percentage usage of the

processor for interrupt requests


The percentage privileged time of

the processor


The percentage usage of the

processor

PercentUserTime

The percentage user time of the

processor

Processor


RealSystem Availability

Name ″System″

SystemUpTime

The elapsed time that the computer

has been running since it was last

started, in seconds

Server Performance Prediction resource model

Description



The Server Performance Prediction resource model gathers data from

Windows-based operating systems for the Tivoli Decision Support Guide for Server



Performance Prediction (Advanced Edition). You must install version 5.1.2 of the

IBM Tivoli Monitoring component, Gathering Historical Data, to enable Tivoli

Monitoring to use Tivoli Decision Support for Server Performance Prediction

(Advanced Edition) and Tivoli Enterprise Data Warehouse.

For installing, configuring, and using the Gathering Historical Data component,

follow the procedures outlined for the TDS Configuration component in the Tivoli

Decision Support for Server Performance Prediction (Advanced Edition): Release Notes,

Version 2.1.

This resource model does not have thresholds, indications or events.



Built-in actions No

Category Windows

Clearing events No


Internal name TMW_Spp

Parameters Yes

Thresholds No






Prerequisites

The Server Performance Prediction Card resource model requires disk counters to

be enabled on Windows-based operating systems.

To enable disk counters, perform the following steps on each Windows-based

operating system:

1. On Windows NT systems, issue the diskperf –y command.

On systems running Windows 2000, Windows XP, and Windows Server 2003,

issue the diskperf –yv command.

2. Reboot the system.

On systems running Windows 2000, Windows XP, or Windows Server 2003, the

prerequisites needed to run the Server Performance Prediction resource model are

installed as part of the base operating system.

Note: Do not use custom profiles to distribute this resource model. Distribute the

Server Performance Prediction resource model using the SPR_NtProfile

profile.

For additional information about distributing profiles, see the IBM Tivoli

Monitoring: User’s Guide.

Windows resource models: Server Performance Prediction


Parameters

The following table lists the parameters that can be set for the Server Performance

Prediction resource model.


Available Disk Space Configuration

(DiskSpaceAvailableConf)

This parameter is the logical drive or

drives for which you want the available

disk space calculated. The SystemDrive

option is the logical drive on which the

Windows operating system is installed,

usually C:.

Values: System Drive, All, drives B: —

Z:

System

Drive

Physical Disk Configuration

(PhysicalDiskConf)

This parameter is the physical disk for

which you want disk transfer rates

calculated. The Windows operating

system assigns a number to each

physical disk installed in the system.

The physical disks are then partitioned

into logical disks, such as C:.

The Performance Monitoring tool,

perfmon, can be run from the command

line to show you the association

between your physical and logical disks.

Start the perfmon tool and then press

the CTRL and I keys simultaneously

(Ctrl+I), or click +. Select the

PhysicalDisk performance object. The

instances box displays the physical and

logical disks, as shown in the following

example.

_Total

0 C: D:

0

Logging


be logged:


LogicalDisk SPP Guide for NT

FreeMB

The free space on the disk, in

megabytes.

LogicalDisk





Memory SPP Guide for NT

Avail The available memory

Memory

″Total″

PageInputSec

The number of page inputs per

second

PageOutputSec

The number of page outputs per

second

NetworkInterface SPP Guide for NT

NetworkInterface

The network interface card

PacketsOutboundErrors

The number of errors sending

outbound packets

PacketsReceivedErrors

The number of errors for packets

received

PacketsReceivedSec

The number of packets received per

second

PacketsSentSec

The number of packets sent per

second

Objects SPP Guide for NT

NumberOfProcesses

The number of processes running

Objects

″Total″

PhysicalDisk SPP Guide for NT

DiskBytesSec

The number of bytes read or written

per second

DiskXfersSec

The rate of bytes read or written per

second on the physical disk

PhysicalDisk

The physical disk identifier.

System SPP Guide for NT

PrcTotCpuTime

The percentage of total CPU time

PrcTotPrivTime

The percentage privileged time of

the CPU used

PrcTotUserTime

The percentage of total user time

ProcessorQueueLength

The length of the processor queue

System ″Total″



Services resource model

Description



The Services resource model checks that the services selected by the user are

running and functioning properly.

The resource model monitors the following services:

v Browser

v EventLog

v LanmanServer

v LanmanWorkstation

v Netlogon

v NtLmSsp

v Tivoli endpoint

Note: It is not necessary to monitor the Netlogon service if the computer is a

member of a workgroup, and not a domain. The default behavior of

monitoring this service assumes that the computer is a member of a domain.

The resource model highlights the following areas:

v Key services

Some services are vital to the operation of Windows. The resource model checks

that key services are not stopped to ensure proper functioning of the system.

v Unstable services

Services, like any other installed software, can become corrupted or unstable.

The resource model checks that all installed services are stable. Unstable services

must be stopped to ensure they do not harm other functions of the system.




Category Windows

Clearing events Yes


Internal name TMW_Services

Parameters No

Thresholds Yes

Windows resource models: Services



The following table lists the events that can be generated by the Services resource



indication:


TMW_ServicesFailingService Services Failing Service Critical 97

TMW_ServicesStoppedService Services Stopped Service Critical 98

Services Failing Service

This indication is sent when one of the user-specified services is in an unstable

state.

The possible state values that Windows might assign to a service are:

v Continue Pending

v Pause Pending

v Paused

v Running

v Start Pending

v Stop Pending

v Stopped

v Unknown

The possible status values that Windows might assign to a service are:

v Degraded

v Error

v OK

v Pred Failure (predicting a failure)

v Service

v Starting

v Stopping

v Unknown

This event is sent if the service state is not Stopped and the status is other than

OK, Starting, or Stopping. Stop unstable services to prevent them from adversely

affecting the system.


Name

The name of the service examined. Name is a key attribute.

ServiceStatus


StartMode


State The current state of the service



Because the Service resource model determines primarily whether a service is

running correctly, there are no numeric thresholds to be measured or exceeded.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Services Stopped Service

This indication is sent when one of the user-specified services is stopped. If a key

service is stopped, it must be restarted to ensure that the Windows operating

system is working properly.


Name The name of the service examined. Name is a key attribute.

ServiceStatus


StartMode



running correctly, there are no numeric thresholds to be measured or exceeded.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Critical

Thresholds


running correctly, there are no numeric thresholds to be measured or exceeded. In

this resource model, the threshold values act as numerical flags where 0 is false

and any other number is true. With this, you can determine which services you

want to monitor.

For example, in the threshold section, LanmanServer (Server service) is set to 1

meaning the resource model checks if the Server service is running. Youcan decide



that the Server service does not need to run on certain systems. On those systems

you can change the profile to set the Server threshold value to 0 so that the

resource model does not check if the Server service is running.

The following table lists the thresholds that can be set for the Services resource


default value.


Browser (Browser) This threshold determines if the Browser service is

monitored. If the value is set to 0, the service is not

monitored.

The Browser service creates the list of computers

and networks in the network neighborhood. It is

also needed so that the local machine is present on

other network neighborhoods throughout the local

network.

1

EventLog

(EventLog)

This threshold determines if the EventLog service

is monitored. If the value is set to 0, the service is

not monitored.

This service logs information, including errors,

pertinent to the local machine. This data is useful

if you are trying to correct a malfunctioning

component of the Windows operating system.

1

LanmanServer

(LanmanServer)

This threshold determines if the LanmanServer

service is monitored. If the value is set to 0, the

service is not monitored.

This service, better known as the Server service,

manages shared directories that are accessible by

other workstations on the network. Without this

service, other computers cannot connect to the

local computer.

1

LanmanWorkstation

(LanmanWorkstation)

This threshold determines if the

LanManWorstation service is monitored. If the

value is set to 0, the service is not monitored.

This service is the counterpart of the

LanmanServer service. If it is not running, the local

machine cannot connect to other computers on the

network.

1

Netlogon (Netlogon) This threshold determines if the Netlogon service


not monitored.

The Netlogon service is used when logging onto

the local workstation as well as when processing

logon attempts from remote machines. If the

Netlogon service is not functioning properly,

system log on may fail.

Note: It is not necessary to monitor the Netlogon

service if the computer is a member of a

workgroup, and not a domain. The default

behavior of monitoring this service assumes that

the computer is a member of a domain.

1




NtLmSsp (NtLmSsp) This threshold determines if the NtLmSsp service


not monitored.

NtLmSsp is the Windows LAN Manager (LM)

Security Support Provider. It provides Windows

security to remote procedure call (RPC) programs

that use transports other than named pipes. It is

not necessary to run this service continuously, but

doing so is not harmful.

1

Tivoli Endpoint (lcfd) This threshold determines if the Tivoli Endpoint

service is monitored. If the value is set to 0, the

service is not monitored.

This service connects the computer to the Tivoli

Management Environment

1

Built-in actions

This resource model contains the following built-in action:

Table 5.


Services Failing

Service



Services Stopped

Service



TCP/IP resource model

Description



The TCP/IP resource model looks for problems in the TCP/IP protocol. Events are

generated when the network is congested, as seen with retransmitted TCP

segments and high ping rates, or if there are excessive fragmented datagrams.:

v Fragmented data

Fragmented datagrams are datagrams sent through the network that are

incomplete. Fragments wait at their destination point to be reassembled.

When datagrams have to be reassembled, it requires CPU time that might

otherwise be servicing current processes or interrupt request. Therefore,

excessive fragmented datagrams need to be minimized whenever possible.

v Network congestion

Congestion can be a problem on any type of network. One way of diagnosing

congestion is to look for retransmitted TCP segments and high ping rates.





Built-in actions No

Category Windows

Clearing events Yes


Internal name TMW_TCPIP

Parameters No

Thresholds Yes






Prerequisites

The TCP/IP resource model requires the TCP/IP protocol and the SNMP service to

be installed.


The following table lists the events that can be generated by the resource model,

the name of the indication from which each event is generated, the default severity

of the event, and where you can find a detailed description of the indication:


TMW_HighFragRatio High Fragment Ratio Warning 101

TMW_HighPing High Ping Warning 102

TMW_SegmentsReXmit Segments ReXmit Warning 103

High Fragment Ratio

This indication is sent when the percentage of fragmented datagrams received

compared to the total number of datagrams received is high. This percentage rises

as the local network grows more congested. Indications from the Network Interface

resource model can offer more insight into the reason for the congestion.


DGReceivedSec

The number of datagrams received per second

DGSec

The number of datagrams transmitted per second

DGSentSec

The number of datagrams sent per second

FragReassembledSec

The number of fragmented datagrams reassembled per second

FragReceivedSec

The number of fragmented datagrams received per second

Windows resource models: TCP/IP


FragsToDGRatio

The percentage of fragmented datagrams compared to the total datagrams



High Fragment Ratio

(HighFragRatio)

This percentage of fragmented datagrams received

compared to the total number of datagrams

received must exceed this threshold.

80


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

High Ping

This indication is sent when the rate at which datagrams are received is high in

comparison to the rate at which segments are received. This is common when a

system is receiving a large number of pings.


DGReceivedSec


DGSec


DGSentSec

The number of datagrams sent per second

SegmentsRcvdSec

The number of segments received per second

SegmentsSec

The number of segments transmitted per second

SegmentsSentSec

The number of segments sent per second



Low Segments

(LowSegments)

The number of segments received per second must


10

Moderate DG

(ModerateDG)



60




Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Segments Retransmit

This indication is sent when the rate at which TCP segments are retransmitted is

high. This indicates network congestion. Indications from the Network Interface

resource model can offer more insight into the reason for the congestion.


DGSec


FragsToDGRatio

The percentage of fragmented datagrams compared to total datagrams

SegmentsReXmitSec

The number of segments retransmitted per second

SegmentsSec

The number of segments transmitted per second



High Segment

Retransmitted

(HighSegmentReXmit)

The number of segments retransmitted per

second must exceed this threshold.

1


Setting Default

Clearing Event Yes

Holes 1

Occurrences 6


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the TCP/IP resource


default value.




High Fragment Ratio

(HighFragRatio)


fragmented datagrams received in comparison

to the total number of datagrams received.

80

High Segment

Retransmitted

(HighSegmenReXmit)

This threshold is the maximum number of TCP

segments that can be retransmitted per second.

1

Low Segments

(LowSegments)

This threshold is the maximum number of TCP

segments received per second. This rate must be

low to be a factor in determining if the system

is receiving a high number of pings.

10

Moderate DG

(ModerateDG)

This threshold is the number of datagrams

received per second. Unlike most resource

model thresholds, Moderate DG indicates when

the rate is considered to be moderate (above

normal), not high or low.

60

Logging


be logged:


IP Datagrams Traffic

DGReceivedSec

The number of datagrams received

per second

DGSec The number of datagrams sent or

received per second

DGSentSec

The number of datagrams sent per

second

IP ″Total″

Fragments Received

FragmentsReceivedSec

The number of fragments received

per second

IP ″Total″




TCP Segments

Retransmitted

SegmentsRetrasmitted

The number of retransmitted

segments.

TCP ″Total″

Segments Traffic

SegmentRcvdSec

The number of segments received

per second

SegmentsSec

The number of segments sent or

received per second

SegmentSentSec

The number of segments sent per

second

TCP ″Total″



Chapter 3. UNIX and Linux resource models

This chapter describes resource models for UNIX and Linux systems.

CPU resource model

Description


Distribute this resource model to UNIX or Linux systems.

The CPU resource model monitors the central processing unit, or processor, and

checks for bottlenecks and processor overloads. Events are generated when the

percentage of processor time used for system requests is high, or the percentage of

processor time spent in the idle state is low.



Built-in actions No

Category UNIX® and Linux

Clearing events Yes


Internal name DMXCpu

Parameters No

Thresholds Yes

Prerequisites

The following operating system maintenance updates are needed to run the CPU

resource model on AIX systems:

AIX Version Package Name Package Level

AIX, Version 4.3.3 bos.perf.diag_tool Level 4.3.3.75

bos.perf.libperfstat Level 4.3.3.0

bos.perf.perfstat Level 4.3.3.1

AIX, Version 5.1 bos.perf.diag_tool Level 5.1.0.25

bos.perf.libperfstat

bos.perf.perfstat



bos.perf.perfstat



The following table lists the events that can be generated by the CPU resource



indication:


High_SysCPUUsage High CPU Usage by System Warning 108

Low_IdleCPUUsage High CPU Overload Warning 108

High CPU Overload

This indication is sent when the percentage of processor time spent in the idle state

is low. A frequently low value indicates that the processor is overloaded.


name ″Total″

percidlecpu

The percentage of time that the processor is in the idle state.



Percentage of CPU in

Idle

(IdleCPUTimeThr)

The percentage of time that the processor spends

in the idle state must not exceed this threshold.

10


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Send indications to Tivoli Business Systems Manager No

Severity Warning

High CPU Usage by System

This indication is sent when a high percentage of processor time is used for system


name ″Total″

percsyscpuusage

The percentage processor time spent handling system requests.

UNIX and Linux resource models: CPU




Percentage of CPU Used by

System

(SysCPUTimeThr)

The percentage of processor time used

for system requests must exceed this

threshold.

80


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4



Severity Warning

Thresholds

The following table lists the thresholds that can be set for the CPU resource model.

For each threshold, the table shows the name, a short description, and the default

value.


Percentage of CPU in Idle

(IdleCPUTimeThr)

This threshold is the minimum percentage

of time that the processor should be idle

to maintain satisfactory system

performance. A frequently low value

indicates that the processor is overloaded.

10

Percentage of CPU Used by

System

(SysCPUTimeThr)

This threshold is the maximum

percentage of processor time that can be

used for system requests.

80

Logging


be logged:


Chapter 3. UNIX and Linux resource models 109


CPU Average Loading

loadAvg1

The number of running or runnable

processes averaged over the last one

minute.

loadAvg5


processes averaged over the last five

minutes.

loadAvg15


processes averaged over the last

fifteen minutes.

name ″Total″

Percent usage

name ″Total″

prcIdleTime


processor is idle.

prcSysTime


processor is in system mode.

prcUserTime


processor is in user mode.

RealSystem Availability

Name ″System″

SystemUpTime

The elapsed time that the computer

has been running since it was last

started, in seconds.

Note: On AIX, HP-UX, and Solaris systems, the sar command separates system

activity into user, system, wait I/O and idle values. For example:

Time %usr %sys %wio %idle

14:07:10 46 30 22 2

14:07:40 50 21 27 2

14:08:10 56 26 17 1

The CPU/Percent Usage logging context does not provide a separate value

for wait I/O. Instead, prcIdleTime includes the sum of the wait I/O and idle

values.

Description of the MOF file properties

The CPU resource model uses two MOF files:

v DMXCpu.mof

v DMXSystem.mof

See “DMXCpu.mof” on page 253 “DMXCpu.mof” on page 253 for a description of

the DMXCpu.mof CIM classes and properties associated with these files. See



“DMXFileSystem.mof” on page 254 for a description of the DMXSystem.mof CIM

classes and properties associated with these files.

File resource model

Description



The File resource model monitors files in the system. Events are generated when

file properties change and when files are removed from the system.



Built-in actions No

Category UNIX and Linux

Clearing events Yes


Internal name DMXFile

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the File resource



indication:


FileChanged File Changed Warning 112

FileNotPresent File not Present Warning 112

FilesAttributeChange File Attributes Changed Warning 111

File Attributes Changed

This indication is sent when the attributes of a file change, for example, through

the use of the chmod command.


pathname

The fully qualified path name of the monitored file. The pathname

attribute is a key attribute.




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

File Changed

This indication is sent when the checksum or the last modification time of a file

changes.


pathname




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1



Severity Warning

File Not Present

This indication is sent when a monitored file is no longer present on the computer.


pathname




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

UNIX and Linux resource models: File


Parameters

The following table lists the parameters that can be set for the File resource model.


Files To Be Checked

(FileList)

This parameter is a list of the files that you want

to monitor. The file name must include the full

path, as shown in the following example:

/etc/passwd

and not:

passwd

v /etc/passwd

v /etc/group

v /etc/hosts

Logging


be logged:


File File Checksum

checksum

The checksum of the file

fileName

The name of the file

size The size of the file, in bytes

File Times

changeTime

The time when the file attributes last

changed

modificationTime

The time when the file contents last

changed

pathname

The fully qualified path name of the

file


The File resource model uses one MOF file:

v DMXFile.mof

See “DMXFile.mof” on page 253 for a description of the DMXFile.mof CIM classes

and properties associated with this file.

File System resource model

Description



The File System resource model provides information about file system usage.

Events are generated when available space in the file system is low, the percentage

UNIX and Linux resource models: File


of available space in the file system is low, the file system is fragmented, or the

percentage of i-nodes in the file system is low.

This resource model supports only UFS or VxFS file systems



Built-in actions No


Clearing events Yes


Internal name DMXFileSystem

Parameters Yes

Thresholds Yes


The following table lists the events that can be generated by the File System



indication:


FragmentedFileSystem Fragmented File System Minor 114

LowKAvail Low Space Available Critical 115

LowPercInodesAvail Low Percentage of Available

i-nodes

Warning 116

LowPercSpcAvail Low Percent Space Available Critical 116

Fragmented File System

This indication is sent when the file system is fragmented. The percentage of

i-nodes in use is high and the percentage of used file system space is low. To

optimize the use of the available space, the percentage of i-nodes used should not

be too high in comparison to the space used by the file system.


mountname

The mount point on which the file system is mounted. The mountname


percinodeused

The percentage of used i-nodes in the file system

perckbused

The percentage of space used by the file system

UNIX and Linux resource models: File System


|



Percentage of File System Space

Used

(PrcUsedKspace)

The percentage of used space in the file

system must not exceed this threshold.

85

Percentage of I-nodes Used

(PrcUsedInodes)

The percentage of i-nodes in use in the

file system must exceed this threshold.

80


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Manager

No


Severity Minor

Low Space Available

This indication is sent when the available space in the specified file system is low.


kb_avail

The number of kilobytes available on the specified file system.

mountname

The directory on which the file system is mounted. The mountname




Available Space

(AvailableSpace)

The available space on the file system, in

Kilobytes, must not exceed this threshold.

7000


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Manager

No


Severity Critical



Low Percent Space Available

This indication is sent when the percentage of space available in the specified file

system is low.


mountname



PercSpcAvail

The percent space available.



Percent Available Space

(PrcAvailKspace)

The percentage of available space on the file

system must not exceed this threshold.

15


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Manager

No


Severity Critical

Low Percentage of Available I-nodes

This indication is sent when the percentage of available i-nodes is below the

threshold.

For VxFS file systems, Version 2.0 or greater, i-nodes are dynamically allocated

from a pool of free blocks and the number of i-nodes appears unlimited. However,

if you receive this indication, the internal i-node list file might be larger than the

maximum file size limit of 2 GB. You must then configure the VxFS file system for

large file support.

Confirm the following to ensure your VxFS file system configuration enables large

file support:

v Ensure that the VxFS file system is disk layout, Version 3.0 or greater.

v Ensure that your operating system version where the VxFS file system resides

provides large file support.

v Ensure that large file support is enabled on your VxFS file system.

If large file support is not enabled, set the largefiles flag on the file system

using the fsadm command.




mountname



percavailinodes

The percentage of available i-nodes



Percentage of Available

I-nodes

(PrcAvailInodes)

The percentage of available i-nodes must not


20


Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the File System resource


default value.


Available Space

(AvailableSpace)

This threshold is the minimum amount

of available space, in kilobytes, in a file

system.

7000

Percentage of Available I-nodes

(PrcAvailInodes)

This threshold is the minimum

percentage of available i-nodes in a file

system.

20

Percentage of Available Space

(PrcAvailKspace)


percentage of available space in a file

system.

15

Percentage of Used Space

(PrcUsedKspace)


percentage of used space in a file

system.

85

Percentage of Used I-nodes

(PrcUsedInodes)


percentage of used i-nodes in a file

system.

80

Parameters

The following table lists the parameters that can be set for the File System resource

model.




Monitored File Systems

(FileSystemsToMonitor

DiffThres)

This parameter is a list of the file systems

monitored, along with their threshold values.

If no values are specified with this parameter, the

default behavior of the resource model is to

monitor all file systems of the supported types

(UFS and VxFS) using the global threshold values.

You can use this parameter to override the

threshold values for specific file systems.

The correct syntax is as follows:

FS_name | a | b | c | d | e

where:

FS_name

is the file system name

a is the percentage of i-nodes used

b is the percentage of file system used space

c is the available space, in kilobytes

d is the percentage of available i-nodes

e is the percentage of file system available

space

The file system name may contain one or more

wildcard characters, which is an asterisk (’*’). The

wildcard ’*’ matches one or more characters in the

file system name. Some examples:

/tmp | 85 | 90 | 10000 | 20 | 35

/*ACCT* | - | 60 | 500 | - | 70

/usr | - | - | - | - | 50

A single dash (’-’) may be used to set a threshold

to its default value.

In the last example, the file system /usr is

monitored with default thresholds except for

Percentage of Available Space, which is set to 50

percent.

The error code 12 is returned if the syntax is

incorrect. You must edit the profile using the

correct syntax and distribute it again.

None



||||||


Ignored File Systems

(IgnoredFileSystems)

This parameter is a list of the file systems that are

not monitored. If this parameter is empty, then all

file systems are monitored.

The file system name may contain one or more

wildcard characters, which is an asterisk (’*’). The

wildcard ’*’ matches one or more characters in the

file system name.

For example, assume there are three file systems

named as follows:

My_FileSystem/in_ASIA

/My_FileSystem/in_America

/Your_FileSystem

Sample 1: Entering /My_FileSystem/in_America

causes only that specific file system to be ignored.

Sample 2: Entering /My* causes

/My_FileSystem/in_ASIA and

/My_FileSystem/in_America to be ignored.

Sample 3: Entering /*File*A causes

/MY_FileSystem/in_ASIA to be ignored.

Sample 4: Entering *File* causes

/MY_FileSystem/in_ASIA,

/MY_FileSystem/in_America and

/YOUR_FileSystem to be ignored.

File system names are case sensitive. If all file

systems ending a ’A’ or ’a’ are to be ignored, the

entries in this parameter list would be: *A *a

Note: *A is not the same as *A*; *A matches any

file system name that ends with ’A’; *A* matches

any file system name with the letter ’A’ embedded.

The file system name MyAccount matches *A*;

and does not match *A.

An entry consisting of a single wildcard character *

causes all file systems to be ignored.

None

Logging


be logged:




File System File System Availability

mountpoint

The directory on which the file

system is mounted.

percUsed

The percentage of file system space

used

percInodesUsed

The percentage of i-nodes used

percAvail

The percentage of file system space

available

Note: For VxFS file systems, the i-node properties reported are based on the

number of i-nodes currently allocated in your configuration. For VxFS,

Version 2.0 or greater, i-nodes are dynamically allocated from a pool of free

blocks. The i-node properties change as additional i-nodes are added.


The File System resource model uses one MOF file:

v DMXFileSystem.mof

See “DMXFileSystem.mof” on page 254 for a description of the

DMXFileSystem.mof CIM classes and properties associated with this file.

Memory resource model

Description



The Memory resource model provides information about memory usage. Events

are generated when available virtual storage is low, swap space is low, or the

system is thrashing.



Built-in actions No


Clearing events Yes


Internal name DMXMemory

Parameters No

Thresholds Yes




The following table lists the events that can be generated by the Memory resource



indication:


LowStorage Low Storage Space Critical 121

LowSwap Low Swap Space Critical 121

Thrashing System Thrashing Critical 122

Low Storage Space

This indication is sent when the percentage of available storage space in

comparison to the total virtual available storage space is low. If this percentage is

too low, it can adversely affect the performance of the computer.


name ″Total″

percavailstorage

The percentage of available storage space

totavailstorage

The available storage space in kilobytes



Percentage of Available Virtual Storage

(AvailVirtualStorage)

The percentage of available virtual

storage must not exceed this

threshold.

40


Setting Default

Clearing Event Yes

Holes 0

Occurrences 20


Manager

No


Severity Critical

Low Swap Space

This indication is sent when the percentage of available swap space is low. Swap

space is an area of the disk where memory pages are temporarily written. If this

percentage is too low, it can adversely affect the performance of the computer.


name ″Total″

UNIX and Linux resource models: Memory


percavailswap

The percentage of available swap space

totavailswap

The available swap space in kilobytes



Percentage of Available Swap

Space

(SwapSpacePrc)

The percentage of available swap space


30


Setting Default

Clearing Event Yes

Holes 0

Occurrences 4


Manager

No


Severity Critical

System Thrashing

This indication is sent when the memory page-in and page-out rates exceed their

thresholds. More memory might be required to maintain acceptable system

performance.


name ″Total″

pageins The page-in rate

pageouts The page-out rate



Memory Page-in Rate

(PageInRate)

The number of memory pages read in from disk

per second must exceed this threshold.

400

Memory Page-out Rate

(PageOutRate)

The number of memory pages read out to disk per

second must exceed this threshold.

400


Setting Default

Clearing Event Yes

Holes 0

Occurrences 6



Setting Default


Manager

No


Severity Critical

Thresholds

The following table lists the thresholds that can be set for the Memory resource


default value.


Memory Page-in Rate

(PageInRate)


number of pages read in from disk

per second, averaged over the cycle

time. When the page-in rate exceeds

the threshold, the system can thrash.

More memory might be required to

maintain acceptable system

performance.

400

Memory Page-out Rate

(PageOutRate)


number of pages written out to disk

per second, averaged over the cycle

time. When the page-out rate exceeds

the threshold, the system can thrash.

More memory might be required to

maintain acceptable system

performance.

400

Percentage of Available Swap Space

(SwapSpacePrc)


percentage of swap space that must

be available in the system.

30

Percentage of Available Virtual

Storage

(AvailVirtualStorage)


percentage of virtual storage that

must remain available for use.

40

Logging


be logged:




Memory Memory Availability

name ″Total″

PrcAvailSwap

The percentage of swap space that is

available

PrcAvailStorage

The percentage of storage space that

is available

Memory Paging

name ″Total″

pageInsRate

The page-in rate for the cycle.

pageOutsRate

The page-out rate for the cycle.


The Memory resource model uses one MOF file:

v DMXMemory.mof

See “DMXMemory.mof” on page 254 for a description of the DMXMemory.mof

CIM classes and properties associated with this file.

Network Interface resource model

Description



The Network Interface resource model detects problems with the installed network

interfaces.

Events are generated when the number of data packets in error or the number of

packet collisions is high and when the network interface is not operational.



Built-in actions No


Clearing events Yes


Internal name DMXNetworkInterface

Parameters Yes

Thresholds Yes



Prerequisites

For AIX and HP-UX environments, the SNMP service must be installed and

running on your system. After installing the SNMP service, set the value of the

SNMP Community Names parameter in the resource model to match the

community tag in the SNMP configuration file, /etc/snmpd.conf. The following

table shows the snmpd.conf community tag name for your environment type.

Environment snmpd.conf community tag

AIX community

HP-UX get-community-name

AIX 5.2

On AIX 5.2, SNMP Version 3 is enabled by default. The following command can be

used to check that this is the case:

# ls -la /usr/sbin/snmpd

lrwxrwxrwx 1 root system 9 Apr 15 2003 /usr/sbin/snmpd -> snmpdv3ne

The symbolic link to snmpdv3ne indicates that SNMP Version 3 is in use. In this

case, the file community name must be configured in /etc/snmpdv3.conf.

In addition, the management of certain parts of the SNMP MIB was moved from

the snmpd daemon. The interfaces portion of the MIB, which is used by the UNIX

Network Interface resource model, is now managed by the snmpmibd daemon.

If you select a community name other than the default public, you must configure

the SNMP subagents to use this community name. Edit the file/etc/rc.tcpip and

look for:

# Start up the hostmibd daemon

start /usr/sbin/hostmibd "$src_running"

# Start up the snmpmibd daemon

start /usr/sbin/snmpmibd "$src_running"

# Start up the aixmibd daemon

start /usr/sbin/aixmibd "$src_running"

Change this to:

# Start up the hostmibd daemon

start /usr/sbin/hostmibd "$src_running" "-c <community>"

# Start up the snmpmibd daemon

start /usr/sbin/snmpmibd "$src_running" "-c <community>"

# Start up the aixmibd daemon

start /usr/sbin/aixmibd "$src_running" "-c <community>"

where:

community

Is the community name of your choice.

For the change to take effect, reboot the machine. Alternately, you can use the

stopsrc and startsrc commands to restart snmpmibd with the new community

name:

stopsrc -s snmpmibd

startsrc -s snmpmibd -a "-c <community>"

UNIX and Linux resource models: Network Interface


|||

||

||

|||

|||

||||||||

|

||||||||

|

||

|||

||






HighInputErrPacks High Input Packets in Error Warning 126

HighOutErrorPacks High Output Packets in Error Warning 127

HighPacktsCollision High Percentage Packet Collisions Critical 127

InterfaceNotEnabled Interface Not Enabled Warning 128

InterfaceNotOperat Interface Not Operational Warning 128

IntStatUnknown Unknown Interface Status Critical 129

High Input Packets in Error

This indication is sent when the percentage of packets received with errors, such as

incorrect checksums, is high. There may be insufficient buffer space in the device

driver.


interfacename

The network interface. The interfacename attribute is a key attribute.

interfacetype

The network interface type

percinerrpacks

The percentage of input packets in error

totinpacks

The total number of input packets



Input Packets in Error

(PercInPacketErrThr)

The percentage of packets received with errors


20


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning



|

High Output Packets in Error

This indication is sent when the percentage of packets transmitted with errors is

high. The network might be saturated or there may be a bad physical connection

between the host and the network.


interfacename

The network interface. The intefacename attribute is a key attribute.

interfacetype

The network interface type

percouterrpacks

The percentage of output packets in error

totoutpacks

The total number of output packets



Output Packets in Error

(PercOutPacketErrThr)

The percentage of packets transmitted with errors


10


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High Percentage Packet Collisions

This indication is sent when the percentage of transmitted packet collisions is high.

The network may be overloaded or data packets may be corrupt. This indication is

generated only on Ethernet interfaces.


interfacename

The interface name. The interfacename attribute is a key attribute.

interfacetype

The interface card type

percPacktsCollision

The percentage of packets that are colliding

totoutpacks




This indication is generated only for Ethernet interfaces and is dependent on the

following threshold:


Packet Collision Percentage

(PercPacketCollisionThr)

The percentage of packet collisions that must


10


Setting Default

Clearing Event Yes

Holes 0

Occurrences 2


Manager

No


Severity Critical

Interface not Enabled

This indication is sent with the network interface is not enabled.


interfacename

The name of the network interface. The interfacename attribute is a key

attribute.

interfacetype

The type of the interface card


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Interface not Operational

This indication is sent when the interface is enabled, but not operational. The

interface driver might be installed incorrectly.


interfacename


attribute.



interfacetype

The type of interface card


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Unknown Interface Status

This indication is sent when the status of the monitored interface cannot be

determined.


interfacename


attribute.

interfacestatus

The status of the interface card

interfacetype

The type of interface card


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Thresholds

The following table lists the thresholds that can be set for the Network Interface




Input Packets in Error

(PercInPacketErrThr)


packets received with errors.

20

Output Packets in Error

(PercOutPacketErrThr)


packets transmitted with errors.

10




Packet Collision Percentage

(PercPacketCollisionThr)


packet collisions.

10

Parameters

The following table lists the parameter that can be set for the Network Interface

resource model. The name, a short description, and the default value is shown for

each parameter:


SNMP Community Names

(communityName)

This parameter is a list of SNMP community

names. To get a response from an SNMP

daemon, you must specify the correct

community name. The correct values can be

found in the file /etc/snmpd.conf on the

system to be monitored.

To allow a single profile containing this

resource model to be distributed to systems

with different SNMP community names, you

may add more than one community name to

the list. The resource model tries them, in

order, until the SNMP daemon responds.

This parameter is valid only for AIX and

HP-UX systems. On AIX, the community

name is specified using the ″community″

keyword in the file /etc/snmpd.conf. On

HP-UX, the keyword ″get-community-name″

is used.

public

Logging


be logged:




Network Interface Card

BytesReceivedSec

The total number of bytes received

BytesSentSec

The total number of bytes sent

Interfacename

The name of the interface card

InPacks

The total number of input packets

InPacksErr

The percentage of input packets in

error

OutPackErr

The percentage of output packets in

error

OutPackColl

The percentage of output packets

colliding

OutPacks



The Network Interface resource model uses one MOF file:

v DMXNetworkInterface.mof

See “DMXNetworkInterface.mof” on page 255 for a description of the

DMXNetworkInterface.mof CIM classes and properties associated with this file.

Network RPC-NFS resource model

Description


Distribute this resource model to Solaris systems.

The Network RPC-NFS resource model detects problems with and monitors the

performance of Remote Procedure Call (RPC) and Network File System (NFS)

servers and clients.



Built-in actions No

Category Solaris

Clearing events Yes


Internal name DMXNetworkRPCNFS



||

||


Parameters No

Thresholds Yes






HighNFSBufferSize High NFS Buffer Size Warning 133

HighNFSSrvGetattr High NFS Server Get-attribute Operations Warning 134

HighNFSSrvRead High NFS Server Read Operations Warning 134

HighNFSSrvReadLink High NFS Server Readlink Operations Warning 135

HighNFSSrvWrites High NFS Server Write Operations Warning 136

HighPercDupReqs High Duplicate RPC Server Calls Warning 132

HighPercRetrans High Retransmitted Calls Critical 137

HighPercRPCBadCalls High RPC Bad Calls Warning 137

HighTimeoutsAnd_Badxids High Timeouts and Badxids Warning 138

NetworkBusy High Network Traffic Warning 133

NetworkSlow Slow Network Warning 139

High Duplicate RPC Server Calls

This indication is sent when the percentage of duplicate RPC server calls is high.

This can be a result of transmission problems.


name ″spare″. The name attribute is a key attribute.

percrpcsrvdupreqs

The percentage of duplicate RPC server calls

totrpcsrvdupreqs

The total number of duplicate RPC server calls



Percentage of Server RPC Duplicate

Requests

(RPCSrvDupCallsThr)

The percentage of duplicate RPC

server calls must exceed this

threshold.

60


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3

UNIX and Linux resource models: Network RPC-NFS


Setting Default


Manager

No


Severity Warning

High Network Traffic

This indication is sent when the number of retransmitted RPC client calls is close

to the number of RPC client calls that time out. Specifically, this occurs when the

ratio of the two numbers is between 0.8 and 1.2. There might be heavy traffic on

the network or on the server that receives the requests.



numrpcretrans

The number of RPC client call retransmissions

numrpctimeouts

The number of RPC client calls that timed out


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High NFS Buffer Size

This indication is sent when the percentage of RPC client calls that are

retransmitted and time out is high and there are no duplicate acknowledgements.

The NFS buffer size is too large.



percrpcretrans

The percentage of retransmitted RPC client calls

percrpctimeouts

The percentage of RPC client calls that timed out

totrpccalls

The total number of RPC client calls





Percentage of RPC Client Calls in

Time-out

(RPCCLCallsToutPercThr)

The percentage of RPC client calls

that timed out must exceed this

threshold.

5

Percentage of RPC Client

Retransmissions

(RPCCLRetransPercThr)

The percentage of RPC client call

retransmissions must exceed this

threshold.

5


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High NFS Server Get-attribute Operations

This indication is sent when the percentage of NFS server calls to read the client

attribute cache is high. The size of the client attribute cache needs to be increased.



percnfssrvgetattr

The percentage of NFS server requests to read the client attribute cache

totnfssrvcalls

The total number of NFS server calls



Percentage of NFS Server Getattr

Operations

(NFSSrvGettatrThr)

The percentage of NFS server calls

to read the client attribute cache


40


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No




Setting Default

Severity Warning

High NFS Server Read Operations

This indication is sent when the percentage of NFS server calls for read operations

is high. Additional memory can improve performance.



percnfssrvread

The percentage of NFS server calls for read operations

totnfssrvcalls




Percentage of NFS Server Read

Operations

(NFSSrvReadThr)


for read operations must exceed

this threshold.

30


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High NFS Server Readlink Operations

This indication is sent when the percentage of NFS server calls for readlink

operations is high. Clients are using too many symbolic links on the file systems

exported by the server. Replace the symbolic links with directories.



percnfssrvreadlink

The percentage of NFS server calls for readlink operations

totnfssrvlookup

The total number of lookup calls on the NFS server





Percentage of NFS Server Readlink

Operations

(NFSSrvReadlinkThr)

The percentage of NFS server

calls to read symbolic links on

file systems exported by the

server must exceed this

threshold.

10


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High NFS Server Write Operations

This indication is sent when the percentage of NFS server calls for write operations

is high. Tune the disk for better performance.



percnfssrvwrites

The percentage of NFS server calls for write operations

totnfssrvcalls




Percentage of NFS Server Write

Operations

(NFSSrvWriteThr)


for write operations must exceed

this threshold.

15


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning



High Retransmitted Calls

This indication is sent when the percentage of retransmitted RPC client calls is

high. The server may not be receiving the requests properly.



percrpcretrans

The percentage of restransmitted RPC client calls

totrpccalls





Retransmissions

(RPCCLRetransPercThr)

The percentage of restransmitted

RPC client calls must exceed this

threshold.

5


Setting Default

Clearing Event Yes

Holes 0

Occurrences 5


Manager

No


Severity Warning

High RPC Bad Calls

This indication is sent when the percentage of rejected RPC server or client calls is

high. The network might be overloaded.



percrpcclbadcalls

The percentage of rejected RPC client calls

percrpcsrvbadcalls

The percentage of rejected RPC server calls

totrpcclcalls


totrpcsrvcalls

The total number of RPC server calls





Percentage of RPC Bad

Calls

(RPCBadCallsPercThr)

The percentage of rejected RPC server calls or

rejected RPC client calls must exceed this

threshold.

30


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

High Timeouts and Badxids

This indication is sent when the percentages of RPC client calls that time out and

of duplicate acknowledgements (bad XIDs) are high. The time parameter of the

NFS mount command might be set to a value that is too small.



percrpctimeouts

The percentage of RPC client calls that timed out

percrpcbadxids

The percentage of duplicate acknowledgments (badxids)

totrpccalls




Percentage of RPC Client Badxids

(RPCCLBAdXidsPercThr)

The percentage of duplicate

acknowledgments (badxids) must


5


Time-out


The percentage of RPC client calls

that time out must exceed this

threshold.

5


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3



Setting Default


Manager

No


Severity Warning

Slow Network

This indication is sent when the number of RPC client duplicate

acknowledgements (badxids) approaches the number of RPC client calls that time

out for a single NFS request. Specifically, this indication is sent when the ratio of

these two numbers is between 0.8 and 1.2.



numrpcbadcalls

The number of RPC client calls that timed out

numrpcdupacks

The number of RPC client duplicate acknowledgements (badxids) for a

single NFS request


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

Thresholds

The following table lists the thresholds that can be set for the Network resource


default value.


Percentage of NFS Server Getattr

Operations

(NFSSrvGettatrThr)


percentage of NFS server calls to

read the client attribute cache.

40

Percentage of NFS Server Read

Operations

(NFSSrvReadThr)


percentage of NFS read operations

allowed on file systems exported

by an NFS server.

30

Percentage of NFS Server Readlink

Operations

(NFSSrvReadlinkThr)


percentage of NFS read operations

using symbolic links allowed on

file systems exported by an NFS

server.

10




Percentage of NFS Server Write

Operations

(NFSSrvWriteThr)


percentage of NFS write operations

allowed on file systems exported

by an NFS server.

15

Percentage of RPC Bad Calls

(RPCBadCallsPercThr)


percentage of bad calls allowed by

both RPC clients and servers.

30

Percentage of RPC Client Badxids

(RPCCLBAdXidsPercThr)


percentage of badxids (duplicate

acknowledgements) allowed by an

RPC client.

5


Time-out



percentage of RPC client calls

allowed to time out.

5


Retransmissions (RPCCLRetransPercThr)


percentage of retransmissions

allowed by an RPC client.

5

Percentage of RPC Server Duplicate

Requests

(RPCSrvDupCallsThr)


percentage of duplicate requests

allowed on an RPC server.

60

Logging


be logged:




NFS Client

name ″spare″

NFScalls

The total number of NFS client calls

NFSbadcalls

The number of NFS client calls that

timed out

Server

name ″spare″

NFSbadcalls

The number of NFS server calls that

timed out

NFScalls


NFSgetattr

The number of NFS requests to read

the client attribute cache

NFSlookup

The number of lookup calls on the

NFS server

NFSread

The number of NFS read operations

NFSreadlink

The number of NFS server calls for

readlink operations

NFSwrite

The number of NFS write operations




RPC Client

name ″spare″

RPCbadcalls

The number of failed RPC client

calls

RPCbadxids

The number of badxids

RPCcalls


RPCretrans

The number of restransmitted RPC

client calls

RPCtimeouts

The number of RPC client calls that

timed out

Server

name ″spare″

RPCbadcalls

The number of RPC client calls that

timed out waiting for a response

from the RPC server

RPCcalls

The total number of RPC server calls

RPCDupchecks

The number of RPC server calls that

are looked up in the duplicate

request cache.

RPCDuprequests

The number of duplicate RPC server

calls


The Network RPC-NFS resource model uses one MOF file:

v DMXNetworkRPCNFS.mof

See “DMXNetworkRPCNFS.mof” on page 255 for a description of the

DMXNetworkRPCNFS.mof CIM classes and properties associated with this file.

Physical Disk resource model

Description



The Physical Disk resource model detects bottlenecks specifically associated with

all physical disks that are configured on the system. This model highlights the

following problems:

v Bytes transferred per second



|

|

|||||

|||

|

Bytes transferred per second indicates the amount of raw data that is transferred

through the disk. The maximum transfer rate per second that a disk subsystem

can handle depends on the type of hard drive, the type of controller, the drive

configuration, and the speed of the processor. Data transfer rate can be a good

indicator of whether too much data is routed through the disk.

v Percentage usage

Another indicator that a disk is overworked or is causing a bottleneck is the

percentage usage of the disk. Change the percentage of disk usage threshold

when you discover bottlenecks while monitoring file servers. File servers, print

servers, and mail servers can expect to use a high percentage of disk space. For

workstations, a high percentage of disk usage is typically experienced in short

bursts.

Workstations with high disk usage experience declining performance in

processor speed and general system response. In these situations, a high

percentage usage of the disk creates a bottleneck.



Built-in actions No

Category UNIX

Clearing events Yes


Internal name DMXPhysicalDisk

Parameters No

Thresholds Yes

Prerequisites

The following operating system maintenance updates are needed to run the

Physical Disk resource model on AIX systems:

AIX Version Package Name Package Level


bos.perf.libperfstat

bos.perf.perfstat



bos.perf.perfstat

Special considerations

Special considerations apply to the following operating systems:

v HP-UX systems do not measure DiskReadBytesSec or DiskWriteBytesSec

v Linux systems that do not have /proc/partitions (reporting wuse, ruse metrics)

or do not have /proc/diskstats, cannot measure PercentDiskTime,

PercentDiskReadTime, or PercentDiskWriteTime.

v AIX systems do not measure DiskReadsSec, DiskWritesSec,

PercentDiskReadTime, or PercentDiskWriteTime.



|||||

|

||||||

|||

|

||

||

||

||

||

||

||

|||

|

||

||||

|||

|

|

|||

||

||

|

|

|

|||

||

These metrics are reported and logged with a value of -1.


The following table lists the events that can be generated by the Physical Disk



indication:


HighPhysicalPercentDiskTime High Percent Disk Time Minor 144

HighPhysicalDiskReadBytes High Read Bytes per second Minor 145

HighPhysicalDiskXferRate High Transfer Rate Minor 146

HighPhysicalDiskWriteBytes High Write Bytes per second Minor 147

High Percent Disk Time

This indication is sent when the percentage of time that a physical disk is in use is

high. The drive cannot process requests fast enough and the disk queue grows.


PercentDiskTime



The percentage of time that the physical drive is used for write operations

PercentDiskReadTime

The percentage of time that the physical drive is used for read operations

PhysicalDisk

The physical disk on which the disk resides. PhysicalDisk is a key

attribute.

The indication is generated when the following thresholds are exceeded:


High Percent Usage

(HighPercentUsage)



this threshold.

90


Setting Default

Clearing event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor



|

|

||||

|||||

||||

||||

||||

|||||

|||

|

||

||

||

|||

|

||||

|||||

|

|

|

|||

||

||

||

|||

||

||||

High Read Bytes per second

This indication is sent when a physical disk is reading an excessive amount of data

per second.

The indication has the following attributes:

PercentDiskReadTime

The percentage of the physical drive used to read data

DiskReadBytesSec


DiskReadsSec

The number of transactions that are read per second on the physical disk

PhysicalDisk


The indication is generated when the following threshold is exceeded:


High Bytes per second

(HighDiskBytes)

The number of bytes read per second must exceed

this threshold.

1 572 864


Setting Default

Clearing event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor



|||

|

||

||

||

||

|

||||

|||||

|

|

|||

||

||

||

|||

||

||||

High Transfer Rate

This indication is sent when a physical disk is reading and writing an excessive

amount of data per second.


DiskXfersSec

The rate of bytes read or written per second on the physical disk

DiskReadsSec

The rate of bytes read per second on the physical disk

DiskWritesSec

The rate of bytes written per second on the physical disk

PercentDiskReadTime

The percentage of the physical drive used for read operations


The percentage of the physical drive used for write operations

PhysicalDisk



Setting Default

Clearing event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor



|||

|

||

||

||

||

||

||

|

|||

||

||

||

|||

||

||||


This indication is sent when a physical disk is writing an excessive amount of data

per second.


DiskWriteBytesSec


DiskWritesSec



The percent of the physical drive used during write operations

PhysicalDisk


The indication is generated when the following thresholds are exceeded:


High Bytes per second

(HighDiskBytes)

The number of bytes written per second must


1 572 864


Setting Default

Clearing event Yes

Holes 2

Occurrences 10


Manager

No


Severity Minor



|||

|

||

||

||

||

|

||||

|||||

|

|

|||

||

||

||

|||

||

||||

Thresholds

The following table lists the thresholds that can be set for the Physical Disk





(HighDiskBytes)

This threshold is the maximum number of bytes


average physical disk.

1 572 864

High Percent Usage

(HighPercentUsage)


that the selected disk drive spends servicing read

or write requests.

90

Logging

The following table shows the resource, context and properties for which data can

be logged:


PhysicalDisk Bytes Transferred

PhysicalDisk


DiskBytesSec

The amount of data read or written

per second

DiskReadBytesSec

The number of bytes read per

second

DiskWriteBytesSec

The number of bytes written per

second

Percent Disk Usage

PhysicalDisk


PercentDiskTime


physical drive is in use

Process resource model

Description



The Process resource model looks for problems in running processes. Events are

generated when:

v A process uses too much processor time.

v There are too many zombie processes are in the system.

v A process that is expected to be running is not running.



|

|||

||||

|||||

|

|||||

|

|

|

||

||||

||||

|||

|||

|||

|||

||||

|

The resource model scans all processes in search of zombies and those that are

using an excessive amount of processor time. The resource model then applies any

specified filters to look for stopped or non existent processes.



Built-in actions No


Clearing events Yes


Internal name DMXProcess

Parameters Yes

Thresholds Yes


The following table lists the events that can be generated by the Process resource



indication:


HighZombieProcesses High Number of Zombie Processes Warning 149

ProcessHighCPU Process Consuming High CPU Minor 150

ProcessKilledOrNotExisting Process Killed or Nonexistent Critical 150

ProcessStopped Process Stopped Critical 151

High Number of Zombie Processes

This indication is sent when the number of zombie processes is high. A process is a

zombie when it has terminated, but its results have not been gathered by the

parent process. An excessive number of zombie processes may indicate a failing

network daemon (such as rsh) or application.


name ″Total″. The name attribute is a key attribute.

numZombie

The number of zombie processes



Maximum Number of Zombie

Processes

(HighZombieProcess)

The number of zombie processes must


20


UNIX and Linux resource models: Process


Setting Default

Clearing Event Yes

Holes 0

Occurrences 3


Manager

No


Severity Warning

Process Consuming High CPU

This indication is sent when a process is using an excessive amount of processor

time.


IDProcess The ID of the process monitored. IDProcess is a key attribute.

PrcProcessorTime

The percentage of processor time used by the process.

Process The process name. Process is a key attribute.

state The status of the process



Percentage of CPU Used

(HighCPUUsed)

The percentage of processor time used by the

process must exceed this threshold.

60


Setting Default

Clearing Event Yes

Holes 1

Occurrences 10


Manager

No


Severity Minor

Process Killed or Nonexistent

This indication is sent when a monitored process is not found in the system. The

process may have been killed or may never have been started. Specify the list of

monitored processes through the Processes parameter.


name The process name. The name attribute is a key attribute.




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Process Stopped

This indication is sent when a monitored process is in the stopped state. The process

is present in the system and can be monitored using the ps command. Specify the

list of monitored processes through the Processes parameter.


name The process name. The name attribute is a key attribute.

ParentProcessID

The process identifier (PID) of the parent process.

ProcessID

The process identifier (PID). ProcessID is a key attribute.

ProcessStatus

The status of the process.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Thresholds

The following table lists the thresholds that can be set for the Process resource


default value.


Maximum Number of Zombie

Processes

(HighZombieProcess)


number of zombie processes.

20




Percentage of CPU Used

(HighCPUUsed)


percentage of processor time that can

be used by a single process. When a

process uses a high percentage of the

processor, it reduces the time

available to other processes.

60

Parameters

The following table describes the parameter that can be set for the Process resource

model.




Processes This parameter is a set of filters used when

searching for stopped or non existent processes.

The filters can vary in length and are composed

of key=value pairs.

The syntax of the filter parameter is as follows:

property1=value1&property2=value2

The following example looks for a process whose

executable file base name is lcfd and the group

name is system:

basename=lcfd&group=system&ppid=5422

where:

lcfd The base name of the executable file.

system The name of the group.

ppid The parent pid of the process.

and the following properties are valid filters:

arguments

The arguments of the process.

basename

The base name of the executable file.

This is generally equivalent to that

generated by the ps –e command.

However, some UNIX operating systems

might truncate the results. The ps –ef

command might display the base name

more accurately.

effectiveGroup

The effective group name of the process.

effectiveUser

The effective user name of the process.

group The group name of the process.

name The fully qualified path name of the

executable file, equivalent to that

generated by the ps –ef command.

ppid The parent pid of the process.

status The current status of the process.

terminal

The controlling terminal of the process.

user The local user of the process.

basename=lcfd

basename=syslogd



||||

|||||

|

|

|||

|

|

||

||

||

|

||

||||||||

||

||

||

||||

||

||

||

||

||


Notes:

1. The ampersand character (&) is used as a separator and functions as the logical AND.

Do not insert blanks around the ampersand character (&).

2. If the backslash (\), equal (=), or ampersand (&) characters are used with filters, they

must be preceded with a backslash (\) escape character, as follows:

\\

\=

\&

For example, for the basename ″cro&n″:

basename=cro\&n&user=foobar

If you start cron with the argument ″time=1300″:

basename=cron&arguments=time\=1300

3. In AIX, the length of the arguments value is limited to 4096 characters.

4. In Solaris, a process running without parameters returns a maximum of 80 characters,

including the fully qualified path name for the process. This might limit the basename

and name filters. This limitation does not apply to processes that contain arguments. In

Solaris, the basename parameter is the first 15 characters of the process name. The ps

-e command only displays the first 8 characters so you should determine any

applicable remaining characters from the ps -ef command.

Logging


be logged:


Process Processor Usage

PercentProcessUsage

The percentage of processor time

used by a process

PID The process identifier

Process The process name

Note: This resource model logs data only if the Percentage of CPU Used

(HighCPUUsed) threshold is exceeded. For additional information about

threshold values for the Process resource model for UNIX and Linux-based

operating systems, see “Thresholds” on page 151.


The Process resource model uses two MOF files:

v DMXProcess.mof

v DMXSecurity.mof

See “DMXProcess.mof” on page 257 for a description of the DMXProcess.mof CIM

classes and properties associated with this file. See “DMXSecurity.mof” on page

257 for a description of the DMXSecurity.mof CIM classes and properties

associated with this file.



|||

|

||

||

|

|

|

|

|

|

|

|

|||||||

Security resource model

Description



The Security resource model provides information about files and the users logged

into the system. It highlights the following items that can indicate security

breaches:

v Missing files.

v Changes in the properties, such as attributes, CRC, owner or group, for selected

files.

v The number of log on attempts to the system by the same user.

v A suspect superuser

v An invalid root account

v Duplicate user accounts



Built-in actions No


Clearing events Yes


Internal name DMXSecurity

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Security resource



indication:


DuplicatedAccount Duplicate Account Minor 156

FileNotExisting Nonexistent File Warning 158

HighLoggingNumber High Log-in Number for User Minor 156

IllegalGroup Illegal Group Critical 157

IllegalOwner Illegal Owner Critical 157

NotRegularRootAccount Account not Valid for Root Harmless 156

PasswdNull Null Password Critical 158

SuspectSuperGroup Suspect Supergroup Critical 158

SuspectSuperUser Suspect Superuser Critical 159

UNIX and Linux resource models: Security



WrongMode Wrong File Mode Critical 159

Account not Valid for Root

This indication is sent when the user ID associated with the root account is not

zero.


id The ID of the root account. The id attribute is a key attribute.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Harmless

Duplicate Account

This indication is sent when two users or groups have the same user or group ID.


id The duplicate ID. The id attribute is a key attribute.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 4


Manager

No


Severity Warning

High Log-in Number for User

This indication is sent when a specified user is connected to the system more times

than allowed in the Defined Users parameter.


numlogged The number of times the user logged in

username The name of the user. The username attribute is a key attribute.




Setting Default

Clearing Event Yes

Holes 1

Occurrences 4


Manager

No


Severity Minor

Illegal Group

This indication is sent when a security-sensitive file is not associated with a

superuser group.


fullname The fully qualified file path. The fullname attribute is a key

attribute.

group The file group


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Illegal Owner

This indication is sent when a security-sensitive file has an owner who is not the

one entered in the Defined Users parameter or is not listed in the Alternative

Owners parameter.


fullname The fully qualified file path name. The fullname attribute is a key

attribute.

owner The owner of the file


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No



Setting Default


Severity Critical

Nonexistent File

This indication is sent when a monitored file is not found on the computer.


pathname

The fully qualified pathname of the monitored file. The pathname attribute

is a key attribute.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Null Password

This indication is sent when a user or group has a null password.


id The ID of the user or group. The id attribute is a key attribute.

name The name of the user or group


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Suspect Supergroup

This indication is sent when a group is found with the following characteristics:

v Its name is not ″root″

v Its group ID is zero

v It is not listed in the Special Groups parameter




groupid The group identifier

groupname The group name


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Suspect Superuser

This indication is sent when a user is found with the following characteristics:

v Its name is not ″root″

v Its user ID is zero

v It is not listed in the Special Users parameter


id The user identifier

userName The user name. The userName attribute is a key attribute.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Wrong File Mode

This indication is sent when a security-sensitive file has a file mode that is different

than the one entered in the Files to Be Monitored parameter.


actualmode The type of access permission that the file actually contains on the

system.

filename The name of the file. The filename attribute is a key attribute.

rightmode The type of access permission that the file should have as defined

in the Files to Be Monitored parameter.




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Critical

Parameters

The following table lists the parameters that can be set for the Security resource

model.


Alternative Groups

(AlternativeGroup)

This parameter is a list of the groups

other than root that can own

security-sensitive files in the system.

sys

security

Alternative

Owners

(Alternative

Owners)

This parameter is a list of the users

that can own security-sensitive files

in the system.

root

Defined Users

(Users)


to be monitored. Enter the name of

the user and the login limit,

separated by the pipe character (|).

root | 10

Files to Be

Monitored

(FilesList)

This parameter is a list of the files to

monitor. Enter the file details in the

following format:

filename | string_mode

(as listed with the

ls –lacommand) | owner | group

If the owner or group name of

default files on your system is

different, remove the default

parameter and add your own, or add

the owner or group name to the

Alternative Owners or Alternative

Groups parameter.

/etc/passwd | -rw-r--r-- | root

| root

/etc/group | -rw-r--r-- | root

| root

Special Groups

(Supergroups)

This parameter is a list of the groups

that can be supergroups in the

system.

root

Special Users

(Superusers)


that can become superusers in the

system.

root

Logging


be logged:




File File Usage

fileName

The monitored file name

group The file group

mode The access permission to the file

owner The file owner

size The file size

User Logging

id The user identifier

numLogged

The number of times the user is

logged in

userName

The name of the userNote: This context is logged only if the user

is logged into the system a number of times

greater than the login limit specified in the

Defined Users parameter.


The Security resource model uses one MOF file:

v DMXSecurity.mof

See “DMXSecurity.mof” on page 257for a description of the DMXSecurity.mof CIM

classes and properties associated with this file.

Server Performance Prediction resource model

Description



The Server Performance Prediction resource model gathers data from UNIX-based

operating systems for the Tivoli Decision Support Guide for Server Performance

Prediction (Advanced Edition). You must install version 5.1.2 of the IBM Tivoli

Monitoring component, Gathering Historical Data, to enable Tivoli Monitoring to

use Tivoli Decision Support for Server Performance Prediction (Advanced Edition)

and Tivoli Enterprise Data Warehouse.

For installing, configuring, and using the Gathering Historical Data component,

follow the procedures outlined for the TDS Configuration component in the Tivoli

Decision Support for Server Performance Prediction (Advanced Edition): Release Notes,

Version 2.1.

This resource model does not have thresholds, indications or events.





Built-in actions No


Clearing events No


Internal name DMXSpp

Parameters Yes

Thresholds No

Prerequisites

For AIX and HP-UX environments, the SNMP service must be installed and

running on your system. After installing the SNMP service, set the value of the

SNMP Community Names parameter to match the community tag in the SNMP

configuration file, /etc/snmpd.conf. The following table shows the snmpd.conf

community tag name for your environment type.

Table 6.

Environment snmpd.conf community tag

AIX community

HP-UX get-community-name

Note: Do not use custom profiles to distribute this resource model. Distribute the

Server Performance Prediction resource model using the SPR_UnixProfile

profile.

For additional information about distributing profiles, see the IBM Tivoli

Monitoring: User’s Guide.

Parameters

The following table lists the parameters that can be set for the Server Performance

Prediction resource model.


Available File System Space Configuration

(FileSystemSpaceAvailableConf)

This parameter is a list of the file systems for

which you want the available space calculated.

v /

v /home

v /tmp

v /usr

v /var

UNIX and Linux resource models: Server Performance Prediction



SNMP Community Name

(SNMPCommunityName)

This parameter is a list of SNMP community

names. To get a response from an SNMP

daemon, you must specify the correct

community name. The correct values can be

found in the file

/etc/snmpd.conf

on the system to be monitored.

To allow a single profile containing this

resource model to be distributed to systems

with different SNMP community names, you

may add more than one community name to

the list. The resource model tries them, in

order, until the SNMP daemon responds.

This parameter is valid only for AIX and

HP-UX systems. On AIX, the community name

is specified using the community keyword in

the file

/etc/snmpd.conf.

On HP-UX, the keyword get-community-name is

used.

public

Logging


be logged:


Cpu SPP Guide for UNIX

idleTime

The idle processor time as a

percentage of total processor time

loadAvg1

The average number of processes

running in the most recent minute

sysTime

The processor time spent by the

system as a percentage of total

processor time

userTime

The processor time spent on user

applications as a percentage of total

processor time




FileSystem SPP Guide for UNIX

availKBytes

The amount of free in file system,

in kilobytes

mountPoint

The directory on which the file

system is mounted

prcInodeUsed

The percentage of i-nodes used in

the file system

Memory SPP Guide for UNIX

availSwapSpace

The available swap space, in

kilobytes

pageInsRate

The number of pages read in per

second

pageOutsRate

The number of pages read out per

second

pctusedVirtualStorage

The percentage of total memory

used, including cache memory and

swap space

NetworkInterface SPP Guide for UNIX

deltaCollisions

The number of packet collisions

since the last monitoring cycle

deltaInPackets

The number of packets received

since the last monitoring cycle

deltaInPacketsErr

The number of packets received

with errors since the last monitoring

cycle

deltaOutPackets

The number of packets sent, since

the last monitoring cycle

deltaOutPacketsErr

The number of packets sent with

errors since the last monitoring

cycle

networkInterface

The network interface card

identifier

Processes SPP Guide for UNIX

numberOfProcesses

The total number of processes

numberWaitProcesses

The number of processes waiting to

run




The Server Performance Prediction resource model resource model uses the

following MOF files:

v DMXCpu.mof

v DMXFileSystem.mof

v DMXMemory.mof

v DMXNetworkInterface.mof

v DMXProcess.mof

See “DMXCpu.mof” on page 253 for a description of the DMXCpu.mof CIM

classes and properties associated with this file. See “DMXFileSystem.mof” on page

254 for a description of the DMXFileSystem.mof CIM classes and properties

associated with this file. See “DMXNetworkInterface.mof” on page 255 for a

description of the DMXNetworkInterface.mof CIM classes and properties

associated with this file. See “DMXProcess.mof” on page 257 for a description of

the DMXProcess.mof CIM classes and properties associated with this file.



Chapter 4. OS/400 resource models

This chapter describes resource models for OS/400 systems.

ASP Disk Mirroring resource model

Description


Distribute this resource model to OS/400 endpoints.

The Auxiliary Storage Pool (ASP) Disk Mirroring resource model, given in input of

one or more ASP numbers, retrieves a list of disks for each ASP, checking the

mirroring status of each disk.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name ASPDiskMirroringStatus400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the ASP Disk

Mirroring resource model, the name of the indication from which each event is




MirroringNotActive MirroringNotActive Warning 168


Mirroring not Active

This indication is sent when a disk unit is part of a mirrored pair, but the

mirroring is currently not active. Investigate why the mirroring is not active. There

might be a hardware problem.


diskResourceName

The name of the disk monitored


Setting Default



Manager

No

Occurrences 2

Holes 0

Severity Warning

Clearing Event Yes

OS/400 resource models: ASP Disk Mirroring


Parameters

The following table lists the parameters that can be set for the ASP Disk Mirroring

resource model.

Parameter Description

Parameter

Type

ASPs to monitor for

Disk Mirroring Status

(ASPs)

The ASP numbers that you want to monitor.

During each cycle the mirroring status of each disk

is checked.

String list

OS/400 resource models: ASP Disk Mirroring


ASP Utilization resource model

Description



The Auxiliary Storage Pool (ASP) Utilization resource model monitors the ASP

Utilization for the specified ASPs and sends events if the ASP is approaching the

full state.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name ASPUtilization400

Parameters Yes

Thresholds Yes


The following table lists the events that can be generated by the ASP Utilization



indication:


ASPNearingCapacity ASP nearing capacity Warning 171

ASPOverflow ASP overflow Warning 172

OS/400 resource models: ASP Utilization


ASP Nearing Capacity

This indication is sent when the ASP is nearing capacity with the specified percent

value. The percent used remains above the threshold value for several hours.

Consider adding storage to the ASP, or archiving or removing objects that are no

longer needed.


ASPInstance

The instance monitored

Total available MBytes percentage

The percent value



Total Available MBytes

Percentage Threshold

(totalAvailableMBytes

PercentageThreshold)

This threshold indicates a percent value above

which the specified ASPInstance is nearing

capacity.

90


Setting Default

Clearing Event Yes

Holes 4

Occurrences 32


Manager

No


Severity Warning



ASP Overflow

This indication is sent when the ASP overflowed to the system ASP. Consider

adding storage to the ASP, or archiving or removing objects that are no longer

needed.


ASPInstance


overflowStorageMBytes

The amount of overflow


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning



Parameters

The following table lists the parameters that can be set for the ASP Utilization

resource model.


Parameter

Type

Auxiliary Storage Pools

(ASPs)

The ASP instances. You can enter one or more

numbers as enumeration parameters, or can enter

the string ’*ALL’ to enumerate all ASPs.

String list

Logging


be logged:


ASP Utilization

ASPInstance


overflowStorageMBytes

The amount of overflow

totalAvailableMBytesPercentage

The percent value above which the

specified ASP instance is nearing

capacity



Basic Average CPU Utilization resource model

Description



This resource model monitors the overall CPU utilization of the system.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name BasicCPU400

Parameters No

Thresholds Yes


The following table lists the events that can be generated by the Basic Average

CPU Utilization resource model, the name of the indication from which each event

is generated, the default severity of the event, and where you can find a detailed



BasicCPUUtilizationGuidelineExceeded Basic CPU Utilization Guideline

Exceeded

Warning 174

BasicCPUUtilizationGuidelineLongRunning

Exceeded

Basic CPU Utilization Guideline

Long Running Exceeded

Warning 175

BasicCPUUtilizationPeakExceeded Basic CPU Utilization Peak

Exceeded

Warning 176

BasicCPUUtilizationPeakLongRunning

Exceeded

Basic CPU Utilization Peak Long

Running Exceeded

Warning 177

Basic CPU Utilization Guideline Exceeded

This indication is sent when the overall CPU utilization is over its guideline value

for more than an hour. Investigate adding CPU resources or determining if jobs are

using more CPU than normally required. Having too high of a CPU utilization can

result in the inability to meet peak processing demands.


basicAverageCPUPct

The percent value.

OS/400 resource models: Basic Average CPU Utilization




Overall CPU Utilization

Guideline Double

Processor Threshold

(CPUUtilizationGuideline

DoubleProcessor

Threshold)

Overall CPU utilization threshold to verify

whether the CPU utilization is over the guideline

with a double processor system.

88


Guideline Multiple

Processor Threshold


MultipleProcessor

Threshold)



with a multiple processor system.

95


Guideline Single Processor

Threshold


SingleProcessorThreshold)



with a single processor system.

85


Guideline Triple Processor

Threshold


TripleProcessor

Threshold)



with a triple processor system.

91


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Warning

Basic CPU Utilization Guideline Long Running Exceeded

This indication is sent when the overall CPU utilization is over its guideline value

for several hours. Investigate adding CPU resources or determining if jobs are


result in the inability to meet peak processing demands.


basicAverageCPUPct

The percent value.






Guideline Double

Processor Long Running

Threshold


DoubleProcessorLong

RunningThreshold)




85


Guideline Multiple


Threshold


MultipleProcessorLong

RunningThreshold)




93


Guideline Single Processor

Long Running Threshold


SingleProcessorLong

RunningThreshold)




80


Guideline Triple Processor



TripleProcessorLong

RunningThreshold)




89


Setting Default

Clearing Event Yes

Holes 20

Occurrences 180


Manager

No


Severity Warning

Basic CPU Utilization Peak Exceeded

This indication is sent when the overall CPU utilization is over its threshold value

for more than an hour. Investigate adding CPU resources or determining if jobs are


result in the inability to meet processing demands.


basicAverageCPUPct

The percent value.






Peak Double Processor

Threshold

(CPUUtilizationPeak

DoubleProcessor

Threshold)


whether the CPU utilization is over the peak with

a double processor system.

96


Peak Multiple Processor

Threshold

(CPUUtilizationPeak

MultipleProcessor

Threshold)



a multiple processor system.

99


Peak Single Processor

Threshold

(CPUUtilizationPeakSingle

ProcessorThreshold)



a single processor system.

94


Peak Triple Processor

Threshold

(CPUUtilizationPeak

TripleProcessor

Threshold)



a triple processor system.

97


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Warning

Basic CPU Utilization Peak Long Running Exceeded

This indication is sent when the overall CPU utilization is over its threshold value

for several hours. Investigate adding CPU resources or determining if jobs are


result in the inability to meet processing demands.


basicAverageCPUPct

The percent value.






Peak Double Processor


(CPUUtilizationPeak

DoubleProcessorLong

RunningThreshold)




93


Peak Multiple Processor


(CPUUtilizationPeak


Running Threshold)




97


Peak Single Processor


(CPUUtilizationPeak

SingleProcessorLong

Running Threshold)




90


Peak Triple Processor


(CPUUtilizationPeak

TripleProcessorLong

Running Threshold)




95


Setting Default

Clearing Event Yes

Holes 20

Occurrences 180


Manager

No


Severity Warning

Logging


be logged:


BasicCPU Utilization

basicAverageCPUPct

The percent value

numOfProcessors

The number of processors

spare A key property



Basic Interactive CPU Utilization resource model

Description



This resource model monitors the basic interactive CPU utilization of the system.

Use this resource model should only be used on system models that support the

interactive CPU metric.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name BasicInteractiveCPU400

Parameters No

Thresholds Yes


The following table lists the events that can be generated by the Basic Interactive





BasicInteractiveCPUUtilizationGuideline

Exceeded

Basic Interactive CPU Utilization

Guideline Exceeded

Warning 179

BasicInteractiveCPUUtilizationGuidelineLong

RunningExceeded


Guideline Long Running

Exceeded

Warning 180

BasicInteractiveCPUUtilizationPeakExceeded Basic Interactive CPU Utilization

Peak Exceeded

Warning 181

BasicInteractiveCPUUtilizationPeakLong

RunningExceeded


Peak Long Running Exceeded

Warning 182

Basic Interactive CPU Utilization Guideline Exceeded

This indication is sent when the interactive CPU utilization is over its guideline

value for more than an hour. Investigate adding interactive CPU resources or

determining if interactive jobs are using more CPU than normally required. Having

too high of a CPU utilization can result in the inability to meet interactive

processing demands.


OS/400 resource models: Basic Interactive CPU Utilization


basicInteractiveCPUPct

The percent value.



Interactive CPU

Utilization Guideline

Double Processor

Threshold


DoubleProcessor

Threshold)

Interactive CPU utilization threshold to verify



71

Interactive CPU


Multiple Processor

Threshold


MultipleProcessor

Threshold)




86

Interactive CPU


Single Processor

Threshold


SingleProcessorThreshold)




56

Interactive CPU


Triple Processor Threshold


TripleProcessor

Threshold)




81


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Warning

Basic Interactive CPU Utilization Guideline Long Running

Exceeded

This indication is sent when the interactive CPU utilization is over its guideline

value for several hours. Investigate adding interactive CPU resources or


too high of an interactive CPU utilization can result in the inability to meet peak

interactive processing demands.





The percent value.



Interactive CPU


Double Processor Long

Running Threshold


DoubleProcessorLong

RunningThreshold)




60

Interactive CPU


Multiple Processor Long

Running Threshold



RunningThreshold)




75

Interactive CPU


Single Processor Long

Running Threshold


SingleProcessorLong

RunningThreshold)




45

Interactive CPU


Triple Processor Long

Running Threshold


TripleProcessorLong

RunningThreshold)




70


Setting Default

Clearing Event Yes

Holes 20

Occurrences 180


Manager

No


Severity Warning

Basic Interactive CPU Utilization Peak Exceeded

This indication is sent when the interactive CPU utilization is over its threshold

value for more than an hour. Investigate adding interactive CPU resources or


too high of a CPU utilization can result in the inability to meet interactive

processing demands.





The percent value.



Interactive CPU

Utilization Peak Double

Processor Threshold

(CPUUtilizationPeak

DoubleProcessor

Threshold)




83

Interactive CPU

Utilization Peak Multiple

Processor Threshold

(CPUUtilizationPeak

MultipleProcessor

Threshold)




94

Interactive CPU

Utilization Peak Single

Processor Threshold

(CPUUtilizationPeakSingle

ProcessorThreshold)




70

Interactive CPU

Utilization Peak Triple

Processor Threshold

(CPUUtilizationPeak

TripleProcessor

Threshold)




91


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Warning

Basic Interactive CPU Utilization Peak Long Running Exceeded

This indication is sent when the overall interactive CPU utilization is over its

threshold value for several hours. Investigate adding interactive CPU resources or


too high of an interactive CPU utilization can result in the inability to meet

interactive processing demands.



The percent value.





Interactive CPU

Utilization Peak Double


Threshold

(CPUUtilizationPeak

DoubleProcessorLong

RunningThreshold)




75

Interactive CPU

Utilization Peak Multiple


Threshold

(CPUUtilizationPeak


Running Threshold)




90

Interactive CPU

Utilization Peak Single


Threshold

(CPUUtilizationPeak

SingleProcessorLong

Running Threshold)




60

Interactive CPU

Utilization Peak Triple


Threshold

(CPUUtilizationPeak

TripleProcessorLong

Running Threshold)




85


Setting Default

Clearing Event Yes

Holes 20

Occurrences 180


Manager

No


Severity Warning

Logging


be logged:




InteractiveCPU Utilization


The percent value

numOfProcessors

The number of processors




Configuration Objects resource model

Description



This resource model monitors the status of configuration objects. The user can

enter one or more configuration object name and type pairs. During each cycle, the

resource model monitors the status of each object.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name ConfigurationObjects400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the configuration

objects resource model, the name of the indication from which each event is




ConfigurationObjectNotActive Configuration Object Not Active Warning 185

Configuration Object Not Active

This indication is sent when the configuration object is not active. Investigate

whether the this indication is intentionally varied off, or if there is a problem with

the indication, such as an associated configuration object. For example, a line might

not be active because its controller is not active.


cfgObjectName

The configuration object name


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1

OS/400 resource models: Configuration Objects


Setting Default


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Configuration

Objects resource model.


Parameter

Type

Configuration Objects

(ConfigurationObjects)

The configuration object name and type separated

by a comma. One or more parameter strings of

name,type are allowed.

where:

name Is the name consisting of a 10-character

maximum string. The text string can

contain the asterisk (*) or question mark

(?) wildcard characters.

type The following types are valid:

v CTL - Controller

v DEV - device

v LIN - line

v NWI - network interface

v NWS - network server

The following parameter string example of checks

all line configuration objects:

*,lin

String list

OS/400 resource models: Configuration Objects


Database CPU Utilization resource model

Description



The Database CPU Utilization resource model checks if the system is exceeding its

limit for database CPU utilization. This metric is supported only on specific models

hardware. If the Database CPU threshold is 100, there is no limit on the system.

These checks are for systems that have a database CPU threshold limit less than

100.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name DatabaseCPUUtilization400

Parameters No

Thresholds No


The following table lists the events that can be generated by the Database CPU

Utilization resource model, the name of the indication from which each event is




DatabaseCPUUtilizationExceeded Database CPU Utilization

Exceeded

Warning 187

Database CPU Utilization Exceeded

This indication is sent when Database CPU utilization is over its threshold value

for over an hour. Investigate adding database CPU resources or determining if jobs

are using more database CPU than normally required. Having a too high of a

database CPU utilization can result in the inability to meet processing demands.


databaseCapabilityCPUPct

The percent value


Setting Default

Clearing Event Yes

OS/400 resource models: Database CPU Utilization


Setting Default

Holes 2

Occurrences 10


Manager

No


Severity Warning

Logging


be logged:


DatabaseCPU Utilization

databaseCapabilityCPUPct

The percent value

databaseThresholdPct

The database CPU threshold limit


OS/400 resource models: Database CPU Utilization


Distribution Queues resource model

Description



The Distribution Queues resource model monitors the status of the high and

normal priority service levels for distribution queues.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name DistributionQueues400

Parameters Yes

Thresholds No

Note: This resource model should have a cycle time of at least several minutes.


The following table lists the events that can be generated by the Distribution

Queues resource model, the name of the indication from which each event is




HighPriorityDistributionQueueNotActive High Priority Service Level is not

Active

Warning 189

NormalPriorityDistributionQueueNotActive Normal Priority Distribution

Queue Not Active

Warning 190

High Priority Distribution Queue Not Active

This indication is sent when the high priority service level for the distribution

queue is not active.


distributionQueueName

The name of the distribution queue

statusHighPriority

The status of the high priority service level


OS/400 resource models: Distribution Queues


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Normal Priority Distribution Queue Not Active

This indication is sent when the normal priority service level for the distribution

queue is not active.


distributionQueueName

The name of the distribution queue

statusNormalPriority

The status of the normal priority service level


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Distribution Queues

resource model.


Parameter

Type

Distribution Queue

Names

(DistributionQueues)

The name of the distribution queues to monitor.

You can enter one or more name strings containing

a maximum of 10 characters each. The name

strings can contain the asterisk (*) or the question

mark (?) wildcard characters.

String list

OS/400 resource models: Distribution Queues


History Log resource model

Description



This resource model finds specific messages in the history log. The history log

contains many status and error messages from the system. To compare history log

entries, enter message numbers and text strings as parameters.



Built-in actions No

Category OS/400

Clearing events No


Internal name HistoryLog400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the History Log



indication:


ListOfJobsNotEmpty List Of Jobs Not Empty Warning 191

List Of Jobs Not Empty

This indication is sent when the list of jobs is not empty. One or more jobs have

written messages to the history log. The input message ID and test string match

one or more entries in the history log. The job names are included in the event.

Investigate why the jobs issued the messages.


ListOfJobs

The list of jobs


Setting Default

Clearing Event No

Holes 0

Occurrences 1

OS/400 resource models: History Log


Setting Default


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the History Log

resource model.


Parameter

Type

Message Match

Parameters

(MatchParms)

The message ID and text string pairs to match

against history log entries. The format for each

parameter is as follows:

message_ID,pattern_to_match

where:

message_ID

Message ID is a maximum of 7 characters.

The ID can contain the asterisk (*) or

question mark (?) wildcard characters.

pattern_to_match

The pattern to match is a maximum of

100 characters and can contain the asterisk

(*) or question mark (?) wildcard

characters.

The pattern matches when found

anywhere in the message text.Note: The message text in the history log records

on OS/400 systems appears in the primary

language of the system. The match parameter text

must also be in that language.

String list

History Log with Format Configuration resource model

Description



The HistoryLog with Format Configuration resource model finds specific messages

in the history log. The history log contains many status and error messages from

the system. To compare history log entries, enter message numbers and text strings

as parameters.

This resource model is similar to the History Log resource model but, in addition,

it provides a parameter that controls the format of the indications sent.



|

|

|||||

||||

||



Built-in actions No

Category OS/400

Clearing events No


Internal name HistoryLog400CfgFmt

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the History Log with

Format Configuration resource model, the name of the indication from which each

event is generated, the default severity of the event, and where you can find a

detailed description of the indication:


HistoryLogMessagesMatched History Log Messages Matched Warning 192



|

||

||

||

||

||

||

||

|||

|

||||

|||||

||||||

History Log Messages Matched

This indication is sent when a message ID and text string match one or more

entries in the history log. Depending on the indication format chosen, the job

names, message identifiers, and total number of matching messages are included

in the event. You should investigate why the jobs issued the messages.


NumberOfMessages

The number of messages written to the history log

ListOfJobs

The list of jobs

ListOfMessageIDs

The list of message identifiers


Setting Default

Clearing event No

Holes 1

Occurrences 10


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the History Log with

Format Configuration resource model.



|||||

|

||

||

||

|

|||

||

||

||

|||

||

|||

|

||

Parameter Description Parameter Type

Indication Format

(IndicationFormat)

The format of the indication. Options are:

1. An indication is sent for each job that sent

a message to the History Log that

matches any of the message match

parameters. The indication contains the

job name, a list of matching message IDs,

and the number of matching messages. At

most one indication is sent per job during

one cycle.

2. An indication is sent for each unique

job/message ID pair where the message

ID matches any of the message match


job name, the matching message ID, and

the number of matching messages.

3. An indication is sent for each message

that matches any of the message match


job name and the matching message ID.

The number of matching messages is set

to one.

4. An indication is sent if any message

matches any of the message match


list of all job names that had matching

messages.

Choice (1,2,3,4)

Message Match

Parameters

(MatchParms)

The message identifier and text string pairs to

match against history log entries. The format

of each parameter is as follows:


where:

message_ID

Message ID is a maximum of seven

characters. The ID can contain the

asterisk (*) or question mark (?)

wildcard characters.

patterns_to_match

The pattern to match is a maximum

of 100 characters and can contain the

asterisk (*) or question mark (?)

wildcard characters. The pattern

matches when found anywhere in

the message text.Note: The message text in the history log

records on OS/400 systems appears in the

primary language of the system. The match

parameter text must also be in that language.

String list



||||

|||

||||||||

||||||

||||||

|||||

|

|||

|||

|

|

|||||

|||||||||||

|

||

Interactive Feature CPU Utilization resource model

Description



This resource model checks if the system is exceeding its limit for Interactive

Feature CPU utilization. This is supported only on certain OS/400 systems. If the

Interactive Feature CPU threshold is 100, there is no limit on the system. These

checks are for systems that have an Interactive Feature CPU threshold limit less

than 100.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name InteractiveFeatureCPUUtilization400

Parameters No

Thresholds No


The following table lists the events that can be generated by the Interactive Feature





InteractiveFeatureCPUUtilizationExceeded Interactive Feature CPU

Utilization Exceeded

Warning 196

Interactive Feature CPU Utilization Exceeded

This indication is sent when the Interactive Feature CPU utilization is over its

threshold value for over an hour. Investigate adding Interactive Feature CPU

resources or determining if interactive jobs are using more CPU than normally

required. Having too high of an Interactive Feature CPU utilization can result in

the inability to meet processing demands.



The percent value


OS/400 resource models: Interactive Feature CPU Utilization


Setting Default

Clearing Event Yes

Holes 2

Occurrences 10


Manager

No


Severity Warning

Logging


be logged:


InteractiveFeature

CPU

Utilization


The percent value

interactiveThresholdPct

The threshold limit


OS/400 resource models: Interactive Feature CPU Utilization


Job Log resource model

Description



This resource model checks job logs for specific messages. The parameters contain

the message numbers and text strings to match.



Built-in actions No

Category OS/400

Clearing events No


Internal name JobLog400

Parameters Yes

Thresholds Yes


The following table lists the events that can be generated by the job log resource



indication:


JobLogWarningMessage Job Log Warning Message Warning 198

Job Log Warning Message

This indication is sent when a job issues warning messages to its job log. The input

message ID and test string matches one or more entries in the job’s log. The job

name is included in the event. Investigate why the job issued the message.


JobName

The name of the job.

MessageID

The message ID.

MessageText

The text of the message.

OS/400 resource models: Job Log




Number of matches

threshold

(numOfMatchesThreshold)

This threshold indicates the number of matches

above which the job log warning message is sent.

1


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Job Log resource

model.


Parameter

Type

Matching Parameters

(MatchParms)

The message ID and text string pairs to match. The

format for each parameter is as follows:


where:

message_ID

Message ID is a maximum of 7 characters.

The ID can contain the asterisk (*) or


pattern_to_match

The pattern to match is a maximum of

100 characters and can contain the asterisk

(*) or question mark (?) wildcard

characters.

The pattern matches when found

anywhere in the message text.

The pattern matches if it is found anywhere in the

message text.

Note: The message text in the job log entries on

OS/400 systems are displayed in the primary

language of the system. The match parameter text

must also be in that language.

String list




Parameter

Type

Job Names

(JobNames)

One or more OS/400 job names where jobs are

queried to search their logs. The parameter format,

with optional items in brackets, is as follows:

[subsystem_library/] subsystem_name,

job_name, job_user, [job_number]

where:

job_name

The job name. The job name can contain a

maximum of 10 characters, including the

asterisk (*) and question mark (?)


job_number

The job number. The default value is the

asterisk (*) wildcard character and returns

all valid job numbers. The job number can

contain a maximum of 6 characters,

including the asterisk (*) and question


job_user The job user. The job user can contain a




subsystem_library

The subsystem library name. The default

value is the QSYS library. The subsystem

library name can contain a maximum of

10 characters, including the asterisk (*)

and question mark (?) wildcard

characters.

subsystem_name

The subsystem name. The subsystem

name can contain a maximum of 10

characters, including the asterisk (*) and


String list



Job Queue resource model

Description



This resource model monitors that one or more job queues, which have jobs

queued to them, are assigned to a subsystem so that the jobs can be started.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name JobQueue400

Parameters Yes

Thresholds Yes


The following table lists the events that can be generated by the Job Queue



indication:


JobQueueNotActive Job Queue Not Active Warning 201

JobQueueNotAssigned Job Queue Not Assigned Warning 202

TooManyJobsQueued Too Many Jobs Queued Warning 202

Job Queue Not Active

This indication is sent when a job queue is not active. Investigate why the job

queue is not active, such as the job queue never started or was held.


jobQueueName

The name of the job queue.

jobQueueStatus

The status of the job queue.


Setting Default

Clearing Event Yes

OS/400 resource models: Job Queue


Setting Default

Holes 0

Occurrences 1


Manager

No


Severity Warning

Job Queue Not Assigned

This indication is sent when the job queue contains a number of jobs to run but is

not assigned to a subsystem. Investigate if the job queue should be assigned to a

subsystem so that the jobs can be started.


jobQueueName



Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Too Many Jobs Queued

This indication is sent when a job queue contains more than the threshold number

of jobs queued. Investigate if the job queue is running properly and confirm that

the overall system is running properly.


jobQueueName


numberOfJobs

The number of jobs.



Maximum number of

allowed queued jobs

(MaxAllowedQueuedJobs

Threshold)

This threshold indicates the maximum number of

allowed queued jobs in a job queue.

5




Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Job Queue resource

model.


Parameter

Type

Job queues to be

monitored

(JobQueues)

Job queues to be monitored. Enter the library and

name of the job queues to be monitored. The

format for this parameter is as follows:

library/name

library Is a maximum of 10 characters and can



name Is a maximum of 10 characters and can



The following example finds all job queues using

wildcard characters:

*/*

String list



Job Status Events resource model

Description



This resource model monitors job status. Given a list of job names, it sends an

event if any of the jobs are not active.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name JobStatus400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Job Status



indication:


JobNotActive Job Not Active Warning 204

Job Not Active

This indication is sent when a job is not active.


jobName

The name of the job.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


OS/400 resource models: Job Status Events


Setting Default

Severity Warning

Parameters

The following table lists the parameters that can be set for the Job Status resource

model.


Parameter

Type

Job Names

(Jobs)

The list of jobs to be monitored. The correct format

for Job Names is as follows:

[subsystem_library/] subsystem_name,

job_name, job_user, [job_number]

where:

job_name

The job name. The job name can contain a




job_number

The job number. The default value is the

asterisk (*) wildcard character and returns

all valid job numbers. The job number can

contain a maximum of 6 characters,

including the asterisk (*) and question


job_user The job user. The job user can contain a




subsystem_library

The subsystem library name. The default

value is the QSYS library. The subsystem

library name can contain a maximum of

10 characters, including the asterisk (*)

and question mark (?) wildcard

characters.

subsystem_name

The subsystem name. The subsystem

name can contain a maximum of 10

characters, including the asterisk (*) and


String list

OS/400 resource models: Job Status Events


Management Central Events resource model

Description



This resource model monitors all Management Central events and forwards them

to the IBM Tivoli Enterprise Console event console. Distribute this resource model

to each system that is used by Management Central to manage OS/400 endpoints.



Built-in actions No

Category OS/400

Clearing events No


Internal name ManagementCentralEvent400

Parameters No

Thresholds No


The following table lists the events that can be generated by the Management

Central Events resource model, the name of the indication from which each event




ManagementCentralCritical Management Central Critical Critical 206

ManagementCentralHarmless Management Central Harmless Harmless 207

ManagementCentralUnknown Management Central Unknown Minor 207

ManagementCentralWarning Management Central Warning Warning 207

Management Central Critical

This indication is sent when a management critical central event is detected.


event The event.


Setting Default

Clearing Event No

Holes 0

Occurrences 1

OS/400 resource models: Management Central Events


Setting Default


Manager

No


Severity Critical

Management Central Harmless

This indication is sent when a management harmless central event is detected.


event The event.


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Harmless

Management Central Unknown

This indication is sent when an unknown management central event is detected.


event The event.


Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Minor

Management Central Warning

This indication is sent when a Management Central Warning event is detected.


event The event.




Setting Default

Clearing Event No

Holes 0

Occurrences 1


Manager

No


Severity Warning



Network Attributes resource model

Description



This resource model monitors network attributes. The user provides one or more

network attribute names along with a corresponding value. During each cycle, the

resource model monitors that the network attribute value is equal to the desired

value.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name NetworkAttributes400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Network

Attributes resource model, the name of the indication from which each event is




NetworkAttributeMismatch Network Attribute Mismatch Warning 209

Network Attribute Mismatch

This indication is sent when the network attribute is not currently set as desired.

Investigate why the network attribute changed and if it should be changed back to

the desired value.


expectedValue

The value desired for the network attribute.

networkAttributeName

The name of the network attribute.

valueMetric

The actual value.


OS/400 resource models: Network Attributes


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Network Attributes

resource model.


Parameter

Type

Network Attribute

Names

(AttributeNames)

The list of network attribute names. The full name

of each attribute must be used with no wildcard

characters.

String list

Network Attribute

Values

(AttributeValues)

The list of network attribute values to be compared

against the monitored resource’s value. This

parameter value is associated with the respective

attribute name in its parameter list. For example,

the first value in this parameter list is compared

against the current value of the first attribute in

the name list.

String list

OS/400 resource models: Network Attributes


Output Queues resource model

Description



This resource model checks if the output queues and their writers are active.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name OutputQueues400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Output Queues



indication:


NoWritersStartedForOutputQueue No Writers Started For Output

Queue

Minor 211

OutputQueueNotActive Output Queue Not Active Minor 212

No Writers Started For Output Queue

This indication is sent when the output queue contains one or more jobs waiting,

but no writers are started to handle the jobs. Assign a writer or find out if the jobs

should be removed.


numberOfFiles

The number of files in the queue

numberStartedWriters

The number of writers handling the files

outputQueueName

The name of the output queue

writerJobStatus

The status of the writer

OS/400 resource models: Output Queues



Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Minor

Output Queue Not Active

This indication is sent when the output queue contains files queued but it is not

active. Verify the reason the queue is not active, or why it contains files queued.


currentStatus

The status of the output queue

outputQueueName

The name of the output queue


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Minor

Parameters

The following table lists the parameters that can be set for the Output Queues

resource model.


Parameter

Type

Output Queue Library

and Name

(OutputQueues)

The library and name for the output queues to

monitor. The format is as follows:

library/name







String list

OS/400 resource models: Output Queues


Parametric Object and Files resource model

Description



This resource model monitors native objects and files for owner, size, and change

date. The object or file can be in the QSYS native file system or Integrated File

System.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name ParametricObjectAndFile400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Parametric Object

and File resource model, the name of the indication from which each event is




LastChangedDateDifferent Last Changed Date Different Warning 213

ObjectOwnerDifferent Object Owner Different Warning 214

ObjectSizeExceeded Object Size Exceeded Warning 214

Last Changed Date Different

This indication is sent when the object changed since the input parameter date.

Investigate why the object changed.


lastChangedDate

The date of the last change.

objectName

The name of the object.


OS/400 resource models: Parametric Object and Files Utilization


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Object Owner Different

This indication is sent when the object owner does not match the input parameter.

Investigate why the object owner is not the desired owner.


objectName


objectOwner

The owner of the object.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Object Size Exceeded

This indication is sent when the object size is larger than the threshold value.

Investigate why the object is too large.


objectName


objectSize

The size of the object.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1



Setting Default


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the Parametric Object

and File resource model. You must specify one or more objects.


Parameter

Type

Last Changed Date

(LastChangedDate)

The date that the object was last changed, specified

by zero or one. The following example shows the

correct format for the date, such as 2003/10/17 for

October 17, 2003.

YYYY/MM/DD

where:

YYYY The four-digit year

MM The two-digit month

DD The two-digit day

The Last Date Changed parameter is optional and

wildcards are not allowed. The value of this

parameter is used to compare against the Object

Size parameter and the Object Owner parameter.

Numeric

Object Names

(Objects)

One or more fully qualified object or file path

names. For example, /mydir/myfile for Integrated

File System (IFS) files, or

/qsys.lib/mylib.lib/myfile.file for OS/400

QSYS objects.

The object name parameter must contain at least

one value and can contain multiple values by

using the asterisk (*) or question mark (?) wildcard

characters.

String list

Object Owner

(ObjectOwner)

The user profile name, specified by zero or one.

The Object Owner parameter is required and



Size parameter (if used).

Numeric

Object size

(ObjectSize)

The size of the object, specified by zero or one.

The Object Size parameter is optional and



Owner parameter.

Numeric

Note: If a file or object is not found, an Object Owner Different event is generated.



Storage Pools resource model

Description



This resource model monitors and logs the metrics for storage pools. This resource

model does not produce events.



Built-in actions No

Category OS/400

Clearing events No


Internal name StoragePools400

Parameters Yes

Thresholds No

Parameters

The following table lists the parameters that can be set for the Storage Pools

resource model.


Parameter

Type

Storage Pool Names

(StoragePools)

The names of the storage pools. The format for

storage pool names can be a maximum 10

characters and can contain the asterisk (*) or


The names are system-defined and include the

following:

v BASE

v INTERACT

v MACHINE

v SHRPOOL1 — SHRPOOL60

v SPOOL

String list

Logging


be logged:

OS/400 resource models: Storage Pools



StoragePool Performance

activeToIneligibleTransitions

The number of active to ineligible

transitions

activeToWaitTransitions

The number of active to wait

transitions

activityLevel

The activity level

databaseFaults

The number of database faults

databasePages

The number of database pages

nonDatabaseFaults

The number of non database faults

nonDatabasePages

The number of non database pages

storagePoolName

The name of the storage pool

totalSizeMBytes

The total size

waitToIneligibleTransitions

The number of seconds to wait to

ineligible transitions

OS/400 resource models: Storage Pools


Subsystem Status resource model

Description



This resource model checks the status of a list of subsystems and sends an event if

there is a subsystem that is not active.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name SubsystemStatus400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the Subsystem Status



indication:


SubsystemNotActive Subsystem Not Active Warning 218

Subsystem Not Active

This indication is sent when the subsystem is not active.


sbsName

The name of the subsystem.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


OS/400 resource models: Subsystem Status


Setting Default

Severity Warning

Parameters

The following table lists the parameters that can be set for the Subsystem Status

resource model.


Parameter

Type

Subsystem Names

(Subsystems)

The list of subsystems to be monitored. The

parameter format is as follows:

library/name







String list

OS/400 resource models: Subsystem Status


System Disk Resources resource model

Description



This resource model monitors system disk resources for system and ASP

utilization.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name SystemDiskResources400

Parameters No

Thresholds Yes


The following table lists the events that can be generated by the System Disk

Resources resource model, the name of the indication from which each event is




SystemASPUsedNearPeak System ASP Used Near Peak

Guidelines

Warning 220

TotalAuxiliaryStorageReachedCapacity

Guidelines

Total Auxiliary Storage Reached

Capacity Guidelines

Warning 221

TotalAuxiliaryStorageReachedPeakCapacity

Guidelines

Total Auxiliary Storage Reached

Peak Capacity Guidelines

Warning 222

System ASP Used Near Peak Guidelines

This indication is sent when the system ASP is nearing its peak capacity guidelines

for percent used. The percent used remains above the threshold value for several

hours. Consider adding storage to the system ASP, or archive or removie objects

that are no longer needed.


systemASPUsedPct

The percent value of used System ASP.

OS/400 resource models: System Disk Resources




System ASP Used Percent

Threshold

(SystemASPUsedPct

Threshold)

If this threshold is exceeded, the System is

nearing peak capacity guidelines.

90


Setting Default

Clearing Event Yes

Holes 0

Occurrences 4


Manager

No


Severity Warning

Total Auxiliary Storage Reached Capacity Guidelines

This indication is sent when the total auxiliary storage reaches capacity guidelines

for percent used. The percent used remains above the threshold value for several

hours. Consider adding auxiliary storage to the system, or archiving or removing

objects that are no longer needed.


TotalAuxiliaryStorageAvailablePercent

The percent value of total auxiliary storage.



Total Auxiliary Storage

Available Threshold

(TotalAuxiliaryStorage

AvailableThreshold)

If this threshold is exceeded, the total auxiliary

storage usage reaches capacity guidelines.

20


Setting Default

Clearing Event Yes

Holes 2

Occurrences 30


Manager

No


Severity Warning



Total Auxiliary Storage Reached Peak Capacity Guidelines

This indication is sent when the total auxiliary storage reaches peak capacity

guideline. The percent used remains above the threshold value for several hours.

Add auxiliary storage to the system, or archiving or removing files that are no

longer needed.


TotalAuxiliaryStorageAvailablePercent

The percent value of total auxiliary storage.



Total Auxiliary Storage

Available Peak Threshold

(TotalAuxiliaryStorage

AvailablePeakThreshold)

If this threshold is exceeded, the total auxiliary

storage usage reaches peak capacity guidelines.

10


Setting Default

Clearing Event Yes

Holes 0

Occurrences 8


Manager

No


Severity Warning

Logging


be logged:


Disk Utilization


systemASPusedPct

The percent value of used system

ASP

totalAuxiliaryStorageAvailablePercentage

The percent value of total

auxiliary storage



System Value resource model

Description



This resource model monitors system values, it sends an event when the value

changes from its desired state. This resource model checks to ensure the system

value is equal to the desired value in each cycle.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name SystemValue400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the System Value



indication:


SystemObjectMismatch System Object Mismatch Warning 223

System Object Mismatch

This indication is sent when the system value is not set as desired. Investigate why

the system value changed and whether it should be changed back to the desired

value.

This indication contains the following attributes:

expectedValue

The desired value.

systemValueName

The name of the system value.

valueMetric

The metric of the value.


OS/400 resource models: System Value


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


Severity Warning

Parameters

The following table lists the parameters that can be set for the System Value

resource model.


Parameter

Type

System Value Names

(SystemValues)

The System Value names to be monitored. The full

System Value name must be entered with no


String list

System Value Values

(SystemValueValues)

Values to be used to verify the contents of a

specific System Value. These entries must be in the

same order as their respective System Value name

parameters.

String list

OS/400 resource models: System Value


TCP Interface resource model

Description



This resource model monitors the status of one or more TCP interfaces.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name TCPInterface400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the TCP Interface



indication:


TCPInterfaceNotActive TCP Interface Not Active Warning 225

TCP Interface Not Active

This indication is sent when the TCP interface is not active. Investigate why the

interface did not start or why the interface ended.


interfaceName

The interface name.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No


OS/400 resource models: TCP Interface


Setting Default

Severity Warning

Parameters

The following table lists the parameters that can be set for the TCP Interface

resource model.


Parameter

Type

TCP IP Interfaces

(TCPIPInterfaces)

The list of TCP IP interfaces to be monitored. Each

address can be an IP address or host name, for

example, 9.5.1.2 or name.mycompany.com. Wildcard

characters are not allowed in this parameter.

Optionally enter the number of seconds to delay

waiting for the connection to respond separated by

a the comma character (,) from the TCP address. If

the number of seconds is not entered, the default

wait time is 3 seconds, as shown in the following

example:

127.0.0.1,3

String list



TCP Service resource model

Description



This resource model monitors the TCP service.



Built-in actions No

Category OS/400

Clearing events Yes


Internal name TCPService400

Parameters Yes

Thresholds No


The following table lists the events that can be generated by the TCP Service



indication:


TCPServiceNotActive TCP Service Not Active Warning 227

TCP Service Not Active

This indication is sent when the TCP Service is not active. Investigate why the

service did not start or why the interface ended.


serviceName

The service name.


Setting Default

Clearing Event Yes

Holes 0

Occurrences 1


Manager

No




Setting Default

Severity Warning

Parameters

The following table lists the parameters that can be set for the TCP Service

resource model.


Parameter

Type

TCP IP Services

(TCPIPServices)

One or more pairs of TCP addresses and service

names, separated by a comma. The TCP address

can be an IP address or host name. For example,

name.mycompany.com or 9.5.1.2. The service name

can be a number, such as a port number, or the full

service name. No wildcards are allowed in either

item.

String list



Chapter 5. Generic resource models

This chapter describes resource models that can run on all platforms.

Generic Script resource model

Description

You can use the Generic Script resource model to use your own scripts to monitor

resources. You can run a resource model based on your script, where you specify

the command to run, the resource to monitor, the operator to use, the threshold,

the severity of the event, and the message to send to the IBM Tivoli Enterprise

Console. Only simple scripts and simple monitoring algorithms are supported. If

you need to create complex algorithms and powerful scripts, you need to create a

new resource model with the Resource Model Builder.



Built-in actions No

Category Generic

Clearing events Yes


Internal name GenericScript

Parameters Yes

Thresholds No

Scripting language javascript

TEC event

The Generic Script resource model has a single TEC event. The following are the

details of the event:

Event Indication Severity

ITM_Generic_Script_Event Generic Script Event No default

ITM Generic Script Event

This indication is sent when the conditions specified by the command are satisfied.

The following table shows the indication attributes:

Attribute Description Value

Resource The resource you are monitoring. It can

be disk space on disk C or the size in

KB of a specific file. It is a key attribute.

No default

Description The message to be added to the TEC

event message.

No default


|

|

|||||||

|

||

||

||

||

||

||

||

||

|||

|

||

||||

||||

||

|

||||

||||

|

||||

Attribute Description Value

Severity The severity of the event. It is a key

attribute.

It can be any of the following TEC

event severities:

v HARMLESS

v WARNING

v MINOR

v CRITICAL

v FATAL

Value The value returned by the script. No default

Parameters

Only a single parameter is supported with the Generic Script resource model. The

parameter is: Monitoring Settings.

With this parameter you specify the settings that configure the command you want

to run with the resource model. The following table shows the settings that must

be specified:

Setting Description Value

Format The format of the parameter. The only

supported format is Command, which

includes all the commands that can be

launched from a bash shell (or from QSH,

for AS/400)

Command

Resource The resource you monitor. It must be

specified in detail. For example, you cannot

specify ″Disk space″, you must specify

″Space in disk C″. It must be unique in the

profile.

No default

Description The description of the event. This is

included in the event notification message.

Any descriptive text

Command The command you want to run. It returns a

value that is compared with the threshold

and, in case of event notification, is also

displayed in the event message. Only the

value included in the first line of the

returned output is considered; all

subsequent lines are ignored.

No default

Generic Resource Model


|||

|||||

|

|

|

|

|

||||

|

||

|||

||||

||||||

|

||||||

|

||||

||||||||

|

Setting Description Value

Operator The operator that compares the command

result with the threshold value and returns

a result. If an event is generated, this result

is included in the event notification

message.

gt Greater than

gte Greater than or equal

to

lt Lower than

lte Lower than or equal

to

eq Equal to. Only for

numeric values

mt For multiple

thresholds

ne Not equal to. Only

for numeric values

== Equal to. Only for

strings

!= Not equal to. Only

for strings

reg Regular expression

match in string

format, without slash

(/)

nreg Regular expression

mismatch

Threshold This works like the thresholds in resource

models. This setting is compared with the

value returned by the command, according

to what the operator specifies.

No default

Severity The severity of the event. It is included in

the event notification message.

v FATAL

v CRITICAL

v MINOR

v WARNING

v HARMLESS

v NORMAL (this value can be

used only in multiple

threshold commands to

specify that no event is

generated.)

Syntax and examples

Using this parameter, you can specify either a simple command (comprising a

single operator and threshold) or a multiple threshold command (comprising

several thresholds and their respective severities).

The correct syntax for a simple command is as follows:

<<Format>><<Resource>><<Description>><<Command>>

<<Operator>><<Threshold>><<Severity>>

For example, in a UNIX environment:



|||

||||||

||

|||

||

|||

|||

|||

|||

|||

|||

|||||

|||

|||||

|

||||

|

|

|

|

||||||

||||

|

||

|

<<Command>><<Number of cached events>><<The EIF library is

caching>><<wc -l < Tec/cache/EventServer#UCASELL1-

region_0.dat>><<gt>><<1>><<CRITICAL>>

where:

Number of cached events

The number of events stored in the cache.

The EIF....

Included in the event message to inform you that the EIF is storing events

in the cache.

wc -l < Tec/cache/EventServer#UCASELL1-region_0.dat

Reads the file to retrieve the number of events stored there.

gt The event is generated only if the value returned by the command is

greater than the threshold.

1 If more than one event is stored in the cache, an event is generated.

CRITICAL

Is the severity of the event.

If you want to use multiple thresholds (up to a maximum of 20), the syntax is

slightly different:

<<Format>><<Resource>><<Description>><<Command_to_run>>

<<Operator>><<Severity1>><<Threshold1>><<Severity2>><<Threshold2>>

[...]<<Severity N>>

For example:

<<Command>><<Number of cached events>><<The EIF library is

caching>><<wc -l < Tec/cache/EventServer#UCASELL1-

region_0.dat>><<mt>><<Normal>><<0>>

<<Warning>><<3>><<CRITICAL>>

which means that:

v If the number of files in the cache is not more than 3, the condition is

NORMAL and no event is generated.

v If the number of files in the cache is between 3 and 7, an event is generated,

with a WARNING severity.

v If the number of files in the cache is more than 7, an event is generated, with a

CRITICAL severity.

Logging

The following table shows the resources, contexts, and properties for which data

can be logged:


ITM_Generic_String_

Data

ITM_Generic_String_

DataContext

resource

The resource you monitor. It is a

key attribute.

value

The value returned by your

command. It can be either a string

or a numeric value.



|||

|

||

|||

||

|||

||

||

||

|||

|

||||

|

||

||

||

|

||

||||

|||||||

||||


ITM_Generic_Numeric_

Data

ITM_Generic_Numeric_

DataContext

resource

The resource you monitor. It is

a key attribute.

value The value returned by your

command. It can be either a

string or a numeric value.

Error states

The following are the possible error states and return codes of the Generic Script

resource model:

Unable to start (1)

Indicates a generic error in the syntax of the command, for example a

missing character, such as ’<’.

Unable to start (2)

Indicates that the specified operator does not exist, for example if the

specified operator is g, instead of gt.

Unable to start (5)

Indicates that the specified severity does not exist, for example if the

specified severity is CRITIC, instead of CRITICAL.

Failing (7)

Indicates an error in the provided script, or that the script returns an error.



|||

|||||||

|||||

|

||

|||

|||

|||

||

|

Appendix A. Windows correlated events

This appendix describes all correlated events and the indications from which each

one is generated. Correlated events are generated only for Windows resource

models.

The following table lists the correlated events:

Correlated Event See Page

Busy Drive from High Paging 236

Busy Drive from Low Avail 237

Congested TCP Network 238

Critically Low Disk Space 239

Critical Memory Leak 240

Faulty Disk Subsystem 241

High Disk Read Bytes per Second 242

High Disk Write Bytes per Second 243

High Drive Transfer Rate 244

High Percent Disk Time 245

Possible Disk Fragmentation 246

Process Hogging CPU 247

Slow Hard Drive 248


Busy drive from high paging

The TMW_BusyDriveFromPaging indication is generated from the following

indications:

v TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource

model

v TMW_HighPaging indication from the Memory resource model

This event is generated when it is determined that the local logical disk is busy,

which might be caused by excessive hard-page faulting.

TMW_BusyDriveFromPaging contains the following event properties:

Disk The logical disk analyzed

PercentDiskTime The percentage usage of the logical drive

PagesSec The number of pages per second

TotalAvail The total of available memory in bytes

TotalWorkingSet The total working set size in bytes

TotalCache The total cache size in bytes

Severity The default value is warning

Windows correlated events: Busy drive from high paging


Busy drive from low avail

The TMW_BusyDriveFromLowAvail indication is generated from the following

indications:

v TMW_LowAvailCausingManyProblems indication from the Memory resource

model


model

This event is a relatively serious event because it indicates not only that the local

disk is unusually busy, but also that memory is low, paging is high, and the page

file is changing. This combination ultimately causes a core dump if left unchecked.

TMW_BusyDriveFromLowAvail contains the following event properties:


PercentDiskTime The percentage usage of the logical drive


PageFaultsSec The current value for page faults per second

PagesSec The current value of pages per second

CommittedBytes The current total of committed bytes

CommittedLimit The upper limit of the committed bytes

Severity The default value is critical

Windows correlated events: Busy drive from low avail

Appendix A. Windows correlated events 237

Congested TCP network

The TMW_CongestedTCPNetwork indication is generated from the following

indications:

v TMW_NICOverworked indication from the Network Interface Card resource

model

v TMW_SegmentsReXmit indication from the TCP/IP resource model

This indicates that the TCP/IP network segment that the originating machine is on

might be congested. Congested TCP Network is generated when an indication of an

overworked Network Interface Card and a high amount of retransmitted segments

are sent.

TMW_CongestedTCPNetwork contains the following event properties:

NetworkInterface The identity of network interface card examined

SegmentsReXmitSec The number of segments retransmitted per second

DGSec The number of datagrams transmitted per second

SegmentsSentSec The number of segments sent per second

FragsToDGRatio Ratio of fragmented datagrams to total datagrams

OuputQueueLength The length of the output queue

NICBPS The bytes per second transferred through the

network interface card

CurrentBandWidth The bandwidth of the network interface card


Windows correlated events: Congested TCP network


Critically low disk space

The TMW_CriticallyLowDiskSpace indication is generated from the following

indications:

v TMW_LowAvailCausingSoftPagePagefileResize indication from the Memory

resource model

v TMW_LowLogicalDiskSpace indication from the Logical Disk resource model

This indicates that disk space is low, and it might soon come into demand. If the

system needs additional space to resize a pagefile, and the logical disk where the

pagefile resides is low on space, a core dump can occur.

TMW_CriticallyLowDiskSpace contains the following event properties:


PercentFreeSpace The percentage amount of free space on the logical

drive

FreeMB The actual size of free space on the logical drive in

Megabytes

CommittedBytes The current total of Committed Bytes

CommittedLimit The upper limit of the Committed Bytes


PageFaultsSec The current value for page faults per second


Windows correlated events: Critically low disk space


Critical memory leak

The TMW_CriticalMemoryLeakInWS indication is generated from the following

indications:

v TMW_MemoryLeakInPB indication from the Memory resource model

v TMW_LowAvailHighWS indication from the Memory resource model

A memory leak together with an indication of low available memory as a result of

high working set generates this event. This indicates that memory is low and will

soon run out.

TMW_CriticalMemoryLeakInWS contains the following event properties:

LeakyProcess The process with the memory leak

IDLeakyProcess The numeric ID of the process with the memory

leak

CurrentWorkingSet The current working set of the process

CurrentPrivateBytes The current private bytes of the process


TotalWorkingSet The total working set size in bytes

TotalCache The total cache size in bytes

PercentAvail The percentage of available memory in comparison

to the size of the working set and the cache

PercentWS The percentage of working set memory in

comparison to the size of available memory and

the cache

PercentCache The percentage of cache memory in comparison to

the size of the working set and the available

memory

IDHighWSProcess The numeric ID of the process with the highest

working set

NumProcesses The total number of processes

HighWSProcess The working set of the process with the highest

working set


Windows correlated events: Critical memory leak


Faulty disk subsystem

The TMW_FaultyDiskSubsystem indication is generated from the following

indications:

v TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource

model

v TMW_BusyHardware indication from the Processor resource model


model

A faulty disk subsystem event is generated when a disk is very busy both in terms

of just itself and how busy it is keeping the CPU. Sometimes, as in the case of

major file servers, this can be expected. However, for most machines, an extremely

busy drive over an extended period of time indicates a disk or controller is failing.

TMW_FaultyDiskSubsystem contains the following event properties:

LogicalDisk The logical disk analyzed

PhysicalDisk The physical disk analyzed

LogicalPercentDiskTime The percentage usage of the logical drive

PhysicalPercentDiskTime The percentage usage of the physical drive

Processor The identity of the CPU

PercentProcessorTime The current percentage use of the CPU

PercentInterruptTime The current percentage usage of the CPU as it

handles interrupt requests

InterruptsSec The number of interrupts per second that are

passed to the CPU


Windows correlated events: Faulty disk subsystem


High disk read bytes per second

The TMW_HighDiskReadBytesSec indication is generated from the following

indications:

v TMW_HighPhysicalDiskReadBytesSec indication from the Physical Disk resource

model

v TMW_HighLogicalDiskReadBytesSec indication from the Logical Disk resource

model

This correlation is generated when a high read bytes per second is indicated in

both the logical drive and the physical drive. This usually indicates that bytes per

second read from the physical drive is high.

TMW_HighDiskReadBytesSec contains the following event properties:


PhysicalDisk The physical disk on which the logical disk resides

LogicalDiskReadBytesSec The number of bytes read per second on the logical

disk

PhysicalDiskReadBytesSec The number of bytes read per second on the

physical disk

LogicalDiskReadSec The number of read transactions per second on the

logical disk

PhysicalDiskReadSec The number of read transactions per second on the

physical disk

LogicalPercentDiskRead The percentage usage of the logical drive during a

read operation

PhysicalPercentDiskRead The percentage usage of the physical drive during

a read operation


Windows correlated events: High disk read bytes per second


High disk write bytes per second

The TMW_HighDiskWriteBytesSec indication is generated from the following

indications:

v TMW_HighLogicalDiskWriteBytesSec indication from the Logical Disk resource

model

v TMW_HighPhysicalDiskWriteBytesSec indication from the Physical Disk resource

model

This correlation is generated when a high write bytes per second is indicated in

both the logical drive and physical drive. This usually indicates that bytes per

second written to the physical drive is high.

TMW_HighDiskWriteBytesSec contains the following event properties:



LogicalDiskWriteBytesSec The number of bytes read per second on the logical

disk

PhysicalDiskWriteBytesSec The number of bytes written per second on the

physical disk

LogicalDiskWriteSec The number of read transaction per second on the

logical disk

PhysicalDiskWriteSec The number of read transaction per second on the

physical disk

LogicalPercentDiskWrite The percentage usage of the logical drive during a

write operation

PhysicalPercentDiskWrite The percentage usage of the physical drive during

a write operation


Windows correlated events: High disk write bytes per second


High drive transfer rate

The TMW_HighDriveXferRate indication is generated from the following

indications:

v TMW_HighLogicalDiskXferRate indication from the Logical Disk resource model

v TMW_HighPhysicalDiskXferRate indication from the Physical Disk resource model

This correlation is generated when a high read and written bytes per second is

indicated in both the logical drive and physical drive. This usually indicates that

bytes per second transferred through the physical drive is high.

TMW_HighDriveXferRate contains the following event properties:

LogicalDisk The logical disk analyzed.

PhysicalDisk The physical disk on which the logical disk resides.

LogicalDiskXfersSec The rate of bytes transmitted (read or write) per

second on the logical disk.

PhysicalDiskXfersSec The rate of bytes transmitted (read or write) per

second on the physical disk.

LogicalPercentDiskReadTime The percentage usage of the logical drive during a

read operation.

PhysicalPercentDiskReadTime

The percentage usage of the physical drive during

a read operation.

Severity The default value is warning.

Windows correlated events: High drive transfer rate


High percent disk time

The TMW_HighPercentDiskTime indication is generated from the following

indications:

v TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource

model


model

This correlation is generated when a high percentage disk time is indicated in both

the logical drive and physical drive. A busy physical disk is the most likely cause.

TMW_HighPercentDiskTime contains the following event properties:

LogicalDisk The logical disk analyzed.

PhysicalDisk The physical disk on which the logical disk resides.

LogicalPercentDiskTime The percentage usage of the logical drive.

PhysicalPercentDiskTime The percentage usage of the physical drive.

LogicalPercentReadTime The percentage usage of the logical drive during a

read operation.

PhysicalPercentReadTime The percentage usage of the physical drive during

a read operation.

LogicalPercentWriteTime The percentage usage of the logical drive during a

write operation.

PhysicalPercentWriteTime The percentage usage of the physical drive during

a write operation.

Severity The default value is warning.

Windows correlated events: High percent disk time


Possible disk fragmentation

The TMW_PossibleFrag indication is generated from the following indications:

v TMW_LogicalPossibleFrag indication from the Logical Disk resource model

v TMW_PhysicalPossibleFrag indication from the Physical Disk resource model

This correlation is generated when a possible fragmentation is indicated in both the

logical drive and physical drive. It signifies that there might be fragmentation on

the physical drive.

TMW_PossibleFrag contains the following event properties:


PhysicalDisk The physical disk analyzed

LogicalPercentDiskTime The percentage usage of the logical disk

PhysicalPercentDiskTime The percentage usage of the physical disk

LogicalDiskBytesSec The transfer rate (both read and write) per second

of logical disk

PhysicalDiskBytesSec The transfer rate (both read and write) per second

of physical disk

Severity The default value is minor

Windows correlated events: Possible disk fragmentation


Process hogging CPU

The TMW_ProcessHoggingCPU indication is generated from the following

indications:

v TMW_HighProcesses indication from the Processor resource model

v TMW_ProcessHighCPU indication from the Process resource model

This indication is generated when the CPU contains a high percentage utilization

and one or more processes use an unusually high percentage of CPU.

TMW_ProcessHoggingCPU contains the following event properties:

Process The name of the active process with the highest

CPU usage.

IDProcess The process identity (pid) of the active process

with the highest CPU usage.

Processor The CPU examined.

PercentProcessorTime The total percentage usage of the CPU.

PrcPercentUserTime The percentage usage of the CPU used by the

process.

PrcPercentPriviledgedTime The percentage privileged time of the CPU used by

the process.

PrcPriorityBase The base priority of the process.

Severity The default value is critical.

Windows correlated events: Process hogging CPU


Slow hard drive

The TMW_SlowHardDrive indication is generated from the following indications:

v TMW_SlowPhysicalDrive indication from the Physical Disk resource model

v TMW_SlowLogicalDrive indication from the Logical Disk resource model

This correlation is generated when a slow drive is indicated in both the logical

drive and the physical drive. In this situation, the physical hard drive is possibly

too slow.

TMW_SlowHardDrive contains the following event properties:



CurrentLogicalQLength The current queue length for the logical disk

CurrentPhysicalQLength The current queue length for the physical disk

PercentLogicalDiskTime The percentage usage of the logical disk

PercentPhysicalDiskTime The percentage usage of the physical disk


Windows correlated events: Slow hard drive


Appendix B. Windows return codes for built-in actions

This appendix describes the return codes for built-in actions for resource models

running on Windows-based operating systems.

The following table lists the return codes by category:

Return Code Category See Page

Common to all built-in actions 249

Built-in actions of the Event Log resource model only 250

Built-in actions of the Network Interface Card resource model only 251

Built-in actions of the Service resource model only 252

All built-in actions

The return codes common to all built-in actions are as follows:

RETURN CODE 9

The resource model does not implement this method.

RETURN CODE 97

The called method is not implemented by this method provider.

RETURN CODE 98

It was not possible to spawn an instance of the output parameters of the

called method. This might be because there is not enough memory.

RETURN CODE 99

It was not possible to get the definition of the output parameters of the

called method.


Built-in actions of the event log resource model

The Event Log resource model contains the following built-in actions:

v EnlargeIRPStackSize action

v DeleteRegistry action

v RaiseSessTimeOut action

Enlarge IRP stack size action

The return codes specific to the EnlargeIRPStackSize built-in action of the Event

Log resource model are as follows:

RETURN CODE 0

The action was successfully executed.

RETURN CODE 1

An error occurred while accessing the system registry.

RETURN CODE 2

The registry key:

SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\

IRPStackSize was not updated because its value is already greater than the

suggested value of 12.

Delete registry action

The return codes specific to the DeleteRegistry built-in action of the Event Log

resource model are as follows:

RETURN CODE 0


Raise session time out action

The return codes specific to the RaiseSessTimeOut built-in action of the Event Log


RETURN CODE 0


RETURN CODE 1

The registry

key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\

SessTimeOut was not updated because its value is already greater than the

maximum suggested value of 70.

RETURN CODE 2

The registry

key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\

SessTimeOut was not found in the registry, it was created and its value was

set to 55.

Windows return codes: Built-in actions of the event log resource model


Built-in actions of the Network Interface Card resource model

The Network Interface Card resource model contains the following built-in actions:

v AdjustInitWorkItems action

v AjustMaxWorkItems action

Adjust initial work items action

The return codes specific to the AdjustInitWorkItems built-in action of the Network

Interface Card resource model are as follows:

RETURN CODE 0


RETURN CODE 1

The registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet

\Services\LanmanServer\Parameters\InitWorkItems was set to a value that

is already greater than the suggested value.

Adjust maximum work items action

The return codes specific to the AdjustMaxWorkItems built-in action of the

Network Interface Card resource model are as follows:

RETURN CODE 0


RETURN CODE 1

The registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet

\Services\LanmanServer\Parameters\MaxWorkItems was set to a value that

is already greater than the suggested value.

Windows return codes: Built-in actions of the Network Interface Card resource model

Appendix B. Windows return codes for built-in actions 251

Built-in actions of the Service resource model

The Service resource model contains only one built-in action, the RestartService

action.

Restart service action

The return codes specific to the RestartService built-in action of the Service


RETURN CODE 0


RETURN CODE 1

An error occurred while retrieving the input parameters.

RETURN CODE 2

Wrong type of Input Parameters.

RETURN CODE 3

Unable to open the service control manager.

RETURN CODE 4

Unable to open the service. This might be because the service does not

exist on the target machine.

RETURN CODE 5

Unable to query the status of the service.

RETURN CODE 6

It was not possible to start the service. This might be because some service

prerequisites have not been met.

RETURN CODE 7

It was not possible to start the service. This might be because the service is

corrupted.

RETURN CODE 8

It was not possible to restart the service. This might be because some

service prerequisites have not been met.

Windows return codes: Built-in actions of the Service resource model


Appendix C. MOF file properties

This appendix describes the MOF files used by the resource models and the CIM

classes and properties which they define.

DMXCpu.mof

This MOF file defines the DMXCpu CIM class.

Property Type Description

idleTime NUMERIC The percentage of time that the CPU is idle,

measured over the last monitoring cycle. The

value is expressed as a fraction between zero and

one.

loadAvg1 NUMERIC The number of running or runnable tasks,

averaged over the last one minute.


averaged over the last 15 minutes.


averaged over the last 5 minutes.

spare STRING The key property by which data is logged and

indications are sent.

SystemName STRING The key property by which data is logged and

indications are sent.

SystemUpTime NUMERIC The elapsed time that the computer has been

running since it was last started, in seconds.

sysTime NUMERIC The percentage of time that the CPU spent in

system mode, measured over the last monitoring

cycle. The value is expressed as a fraction

between zero and one.

userTime NUMERIC The percentage of time that the CPU spent in

user mode, measured over the last monitoring

cycle. The value is expressed as a fraction

between zero and one.

DMXFile.mof

This MOF file defines the DMXFile CIM class..


accessTime NUMERIC The time when the file was last accessed. The

number of seconds since the standard UNIX

epoch, 00:00:00 January 1, 1970 UTC.

changeTime NUMERIC The time when the file attributes were last

modified. The number of seconds since the

standard UNIX epoch, 00:00:00 January 1, 1970

UTC.

crc32 NUMERIC The bit cyclic redundancy checksum..



modificationTime NUMERIC The time when the file data was last modified.

The number of seconds since the standard UNIX

epoch, 00:00:00 January 1, 1970 UTC.

pathName STRING The fully qualified path name of the file..

size NUMERIC The size of the file in bytes.

DMXFileSystem.mof

This MOF file defines the DMXFileSystem CIM class.


availInodeNumber NUMERIC The number of file i-nodes that are available to

the non-superuser.

availKBytes NUMERIC The file system space that is in available to the

non-superuser, in kilobytes.

mountPoint STRING The location in the directory structure at which

the file system is mounted. For example, the file

system /dev/hda1 might be mounted on /boot.

totalInodeNumber NUMERIC The total number of file i-nodes. An i-node is a

data structure that describes a file in a UNIX file

system. Therefore, the total i-node number

defines the number of files that can be created in

a file system.

totalKBytes NUMERIC The total file system space, in kilobytes.

usedInodeNumber NUMERIC The number of file i-nodes that are in use.

usedKBytes NUMERIC The file system space that is in use, in kilobytes.

DMXMemory.mof

This MOF file defines the DMXMemory CIM class.


availSwapSpace NUMERIC The available paging (or swap) space, in

kilobytes.

availVirtualStorage NUMERIC The available virtual storage, in kilobytes.

pageiInsRate NUMERIC The paging-in rate, measured over the last

monitoring cycle, in pages per second.

pageOutsRate NUMERIC The paging-out rate, measured over the last

monitoring cycle, in pages per second.

totalKBytes NUMERIC The total file system space, in kilobytes.

usedInodeNumber NUMERIC The number of file i-nodes that are in use.

usedKBytes NUMERIC The file system space that is in use, in kilobytes.


DMXNetworkInterface.mof

This MOF file defines the DMXNetworkInterface CIM class.


deltaCollisions NUMERIC The number of packet collisions since the last

monitoring cycle.

deltaInPackets NUMERIC The number of data packets received since the

last monitoring cycle.

deltaInPackets NUMERIC The number of data packets received with errors

since the last monitoring cycle.

deltOutPacketsErr NUMERIC The number of data packets sent with errors since

the last monitoring cycle. networkInterface

networkInterface STRING The name of the network interface card.

status STRING The interface status:

v DOWN

v UNKNOWN

v UP&NOTRUNNING

v UP&RUNNING

type STRING The type of network interface card:

v ETHERNET

v LOOPBACK

v NOTSUPPORTED

v TOKENRING

DMXNetworkRPCNFS.mof

This MOF file defines the DMXNetworkRPCNFS CIM class.


deltaNFSClientBadCalls NUMERIC The number of bad NFS client calls since the


deltaNFSClientCalls NUMERIC The number of NFS client calls since the last

monitoring cycle.

deltaNFSServerBadCalls NUMERIC The number of bad NFS server calls since

the last monitoring cycle.

deltaNFSServerCalls NUMERIC The number of NFS server calls since the last

monitoring cycle.

deltaNFSServerGetattr NUMERIC The number of NFS server get attribute

operations since the last monitoring cycle.

deltaNFSServerLookup NUMERIC The number of NFS server look-up

operations since the last monitoring cycle.

deltaNFSServerRead NUMERIC The number of NFS server reads since the


deltaNFSServerReadLink NUMERIC The number of times the NFS server has

read symbolic links since the last monitoring

cycle.

deltaNFSServerWrite NUMERIC The number of NFS server writes since the

last monitoring cycle.e.

Appendix C. MOF file properties 255


deltaRPCClientBadCalls NUMERIC The number of bad RPC client calls since the


deltaRPCClientBadXid NUMERIC The number of duplicate responses received

by the client since the last monitoring cycle.

This can occur if the client does not receive a

response and retransmits the request. The

server may respond to both the original and

duplicate requests, causing the client to

receive more than one response to a request.

deltaRPCClientCalls NUMERIC The number of RPC client calls since the last

monitoring cycle.

deltaRPCClientRetrans NUMERIC The number of RPC client retransmissions


deltaRPCClientTimeouts NUMERIC The number of RPC client timeouts since the


deltaRPCServerBadCalls NUMERIC The number of bad RPC server calls since

the last monitoring cycle.

deltaRPCServerCalls NUMERIC The number of RPC server calls since the


deltaRPCServerDupChecks NUMERIC The number of RPC server calls serviced

from the duplicate request cache since the


deltaRPCServerDupReqs NUMERIC The number of duplicate RPC server calls


spare STRING The key property by which data is logged

and indications are sent.

DMXPhysicalDisk.mof

This MOF file defines the DMXPhysicalDisk CIM class.


AvgDiskBytesXfer NUMERIC The average number of bytes per disk

transfer.

AvgDiskSecXfer NUMERIC The time in seconds of the average disk

transfer.

DiskBytesSec NUMERIC The number of bytes transferred to or from

the disk during write or read operations per

second.

DiskReadBytesSec NUMERIC The number of bytes transferred per second

from the disk during read operations.

DiskReadsSec NUMERIC The number of read operations on the disk

per second.

DiskWriteBytesSec NUMERIC The number of bytes transferred per second

from the disk during write operations.

DiskWritesSec NUMERIC The number of write operations on the disk

per second.

DiskXfersSec NUMERIC The number of read and write operations on

the disk per second.


|

|

||||

||||

||||

|||||

||||

||||

||||

||||

||||


PercentDiskReadTime NUMERIC The percentage of elapsed time during

which the selected disk drive is busy

servicing read requests

PercentDiskTime NUMERIC The percentage of elapsed time during


servicing read or write requests.

PercentDiskWriteTime NUMERIC The percentage of elapsed time during


servicing write requests

PhysicalDisk STRING The name of the physical disk

DMXProcess.mof

This MOF file defines the DMXProcess CIM class.


arguments STRING The arguments of the process..

basename STRING The basename of the executable of the

process.

egid NUMERIC The effective Group ID.

euid NUMERIC The effective User ID.

gid NUMERIC The Group ID.

memUsed NUMERIC The memory used, in kilobytes.

name STRING The name of the process.

percentProcessor Time NUMERIC The percentage of CPU time used for the

process.

pid NUMERIC The ID of the process.

ppid NUMERIC The ID of the parent process.

state STRING One of the following status types:

v Waiting

v Ready

v Running

v Stopped

v Zombie

terminal STRING The name of controlling terminal for the

process.

uid NUMERIC The User ID.

DMXSecurity.mof

This MOF file defines the DMXFileSec, DMXGroup, and DMXUser CIM classes.


DMXFileSec

group STRING The group of the file.


|||

|||||

|||||

|||||

||||

|


DMXFileSec

mode STRING The string representation of the access

permissions of the file. For example,

-rw-r--r--.

numMode NUMERIC The numeric representations of the access

permissions of the file.

owner STRING The owner of the file.

pathName STRING The fully qualified name of the file.

size NUMERIC The file size (in bytes).

DMXGroup

duplicated NUMERIC An indication set to one if the group’s name

is duplicated; otherwise zero.

groupName STRING The name of the group.

id NUMERIC The identifier of the group.

passwordNull NUMERIC An indication set to one if the group’s

password is not set; otherwise zero.

DMXUser

duplicated NUMERIC An indication set to one if the user’s name is

duplicated; otherwise zero.

id NUMERIC The identifier of the user.

numLogged NUMERIC he number of times the user has logged in.

DMXFileSec

passwordNull NUMERIC An indication set to one if the user’s

password is not set; otherwise zero.

userName STRING The name of the user.

DMXSystem.mof

This MOF file defines the DMXSystem CIM class.


SystemName STRING The key property by which data is logged

and indications are sent.

SystemUpTime NUMERIC The elapsed time that the computer has been

running since it was last started, in seconds.

HistoryDMXLogCfgFmt.mof

This MOF file defines the HistoryLogCfgFmt CIM class.


entryId STRING The key property by which data is logged

and indications are sent. Set to a number

based on entries found, 1 to X.


|

|

||||

|||||


listOfMessageIDs STRING List of message IDs which matched messages

in the History Log. The format of the list is

Message ID, repeated as needed.

numberOfMessages NUMERIC Count of the number of messages matched

for the jobs in the listOfJobs

string listOfJobs STRING List of jobs with matching messages in the

History Log. The format of the list is Job

Number/User/Job Name. Repeated as needed


|||

|||||

||||

|||||||

Appendix D. Support information

If you have a problem with your IBM software, you want to resolve it quickly. This

section describes the following options for obtaining support for IBM software

products:

v “Searching knowledge bases”

v “Obtaining fixes”

v “Receiving weekly support updates” on page 262

v “Contacting IBM Software Support” on page 263

Searching knowledge bases

You can search the available knowledge bases to determine whether your problem

was already encountered and is already documented.

Searching the information center

IBM provides extensive documentation that can be installed on your local

computer or on an intranet server. You can use the search function of this

information center to query conceptual information, instructions for completing

tasks, and reference information.

Searching the Internet

If you cannot find an answer to your question in the information center, search the

Internet for the latest, most complete information that might help you resolve your

problem.

To search multiple Internet resources for your product, use the Web search topic in

your information center. In the navigation frame, click Troubleshooting and

support � Searching knowledge bases and select Web search. From this topic, you

can search a variety of resources, including the following:

v IBM technotes

v IBM downloads

v IBM Redbooks™

v IBM developerWorks®

v Forums and newsgroups

v Google

Obtaining fixes

A product fix might be available to resolve your problem. To determine what fixes

are available for your IBM software product, follow these steps:

1. Go to the IBM Software Support Web site at:

http://www.ibm.com/support/us/.

2. Click Downloads and drivers in the Support topics section.

3. Select the Software category.

4. Select a product in the Sub-category list.

5. In the Find downloads and drivers by product section, select one software

category from the Category list.


|

|

|||

|

|

|

|

||

||

|

||||

|

|||

||||

|

|

|

|

|

|

||

||

||

|

|

|

||

http://www.ibm.com/support/us/

6. Select one product from the Sub-category list.

7. Type more search terms in the Search within results if you want to refine your

search.

8. Click Search.

9. From the list of downloads returned by your search, click the name of a fix to

read the description of the fix and to optionally download the fix.

For more information about the types of fixes that are available, see the IBM

Software Support Handbook at

http://techsupport.services.ibm.com/guides/handbook.html.

Receiving weekly support updates

To receive weekly e-mail notifications about fixes and other software support news,

follow these steps:

1. Go to the IBM Software Support Web site at

http://www.ibm.com/software/support.

2. Click My support in the upper right corner of the page.

3. If you have already registered for My support, sign in and skip to the next

step. If you have not registered, click register now. Complete the registration

form using your e-mail address as your IBM ID and click Submit.

4. Click Edit profile.

5. In the Products list, select Software. A second list is displayed.

6. In the second list, select a product segment, for example, Application servers.

A third list is displayed.

7. In the third list, select a product sub-segment, for example, Distributed

Application & Web Servers. A list of applicable products is displayed.

8. Select the products for which you want to receive updates, for example, IBM

HTTP Server and WebSphere Application Server.

9. Click Add products.

10. After selecting all products that are of interest to you, click Subscribe to email

on the Edit profile tab.

11. Select Please send these documents by weekly email.

12. Update your e-mail address as needed.

13. In the Documents list, select Software.

14. Select the types of documents that you want to receive information about.

15. Click Update.

If you experience problems with the My support feature, you can obtain help in

one of the following ways:

Online

Send an e-mail message to [email protected], describing your problem.

By phone

Call 1-800-IBM-4You (1-800-426-4968).


|

||

|

||

|||

||

||

||

|

|||

|

|

||

||

||

|

||

|

|

|

|

|

||

||

||

|

http://techsupport.services.ibm.com/guides/handbook.html

http://www.ibm.com/software/support

Contacting IBM Software Support

IBM Software Support provides assistance with product defects.

Before contacting IBM Software Support, your company must have an active IBM

software maintenance contract, and you must be authorized to submit problems to

IBM. The type of software maintenance contract that you need depends on the

type of product you have:

v For IBM distributed software products (including, but not limited to, Tivoli,

Lotus®, and Rational® products, as well as DB2 and WebSphere products that

run on Windows, or UNIX operating systems), enroll in Passport Advantage® in

one of the following ways:

Online

Go to the Passport Advantage Web site at

http://www.lotus.com/services/passport.nsf/

WebDocs/Passport_Advantage_Home and click How to Enroll.

By phone

For the phone number to call in your country, go to the IBM Software

Support Web site at

http://techsupport.services.ibm.com/guides/contacts.html and click the

name of your geographic region.v For customers with Subscription and Support (S & S) contracts, go to the

Software Service Request Web site at

https://techsupport.services.ibm.com/ssr/login.

v For customers with IBMLink™, CATIA, Linux, S/390, iSeries, pSeries®, zSeries®,

and other support agreements, go to the IBM Support Line Web site at

http://www.ibm.com/services/us/index.wss/so/its/a1000030/dt006.

v For IBM eServer™ software products (including, but not limited to, DB2 and

WebSphere products that run in zSeries, pSeries, and iSeries environments), you

can purchase a software maintenance agreement by working directly with an

IBM sales representative or an IBM Business Partner. For more information

about support for eServer software products, go to the IBM Technical Support

Advantage Web site at http://www.ibm.com/servers/eserver/techsupport.html.

If you are not sure what type of software maintenance contract you need, call

1-800-IBMSERV (1-800-426-7378) in the United States. From other countries, go to

the contacts page of the IBM Software Support Handbook on the Web at

http://techsupport.services.ibm.com/guides/contacts.html and click the name of

your geographic region for phone numbers of people who provide support for

your location.

To contact IBM Software support, follow these steps:

1. “Determining the business impact”

2. “Describing problems and gathering information” on page 264

3. “Submitting problems” on page 264

Determining the business impact

When you report a problem to IBM, you are asked to supply a severity level.

Therefore, you need to understand and assess the business impact of the problem

that you are reporting. Use the following criteria:

Appendix D. Support information 263

||

|

||||

||||

||||

|||||

|||

|||

||||||

||||||

|

|

|

|

|

|||

http://www.lotus.com/services/passport.nsf/ WebDocs/Passport_Advantage_Home

http://www.lotus.com/services/passport.nsf/ WebDocs/Passport_Advantage_Home

http://techsupport.services.ibm.com/guides/contacts.html

https://techsupport.services.ibm.com/ssr/login

http://www.ibm.com/services/us/index.wss/so/its/a1000030/dt006

http://www.ibm.com/servers/eserver/techsupport.html


Severity 1

The problem has a critical business impact. You are unable to use the

program, resulting in a critical impact on operations. This condition

requires an immediate solution.

Severity 2

The problem has a significant business impact. The program is usable, but

it is severely limited.

Severity 3

The problem has some business impact. The program is usable, but less

significant features (not critical to operations) are unavailable.

Severity 4

The problem has minimal business impact. The problem causes little impact

on operations, or a reasonable circumvention to the problem was

implemented.

Describing problems and gathering information

When describing a problem to IBM, be as specific as possible. Include all relevant

background information so that IBM Software Support specialists can help you

solve the problem efficiently. To save time, know the answers to these questions:

v What software versions were you running when the problem occurred?

v Do you have logs, traces, and messages that are related to the problem

symptoms? IBM Software Support is likely to ask for this information.

v Can you re-create the problem? If so, what steps were performed to re-create the

problem?

v Did you make any changes to the system? For example, did you make changes

to the hardware, operating system, networking software, and so on.

v Are you currently using a workaround for the problem? If so, be prepared to

explain the workaround when you report the problem.

Submitting problems

You can submit your problem to IBM Software Support in one of two ways:

Online

Click Submit and track problems on the IBM Software Support site

athttp://www.ibm.com/software/support/probsub.html. Type your

information into the appropriate problem submission form.

By phone

For the phone number to call in your country, go to the contacts page of

the IBM Software Support Handbook at

http://techsupport.services.ibm.com/guides/contacts.html and click the

name of your geographic region.

If the problem you submit is for a software defect or for missing or inaccurate

documentation, IBM Software Support creates an Authorized Program Analysis

Report (APAR). The APAR describes the problem in detail. Whenever possible,

IBM Software Support provides a workaround that you can implement until the

APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the

Software Support Web site daily, so that other users who experience the same

problem can benefit from the same resolution.


||||

|||

|||

||||

|

|||

|

||

||

||

||

|

|

||||

|||||

|||||||

http://www.ibm.com/software/support/probsub.html


Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document in

other countries. Consult your local IBM representative for information on the

products and services currently available in your area. Any reference to an IBM

product, program, or service is not intended to state or imply that only that IBM

product, program, or service may be used. Any functionally equivalent product,

program, or service that does not infringe any IBM intellectual property right may

be used instead. However, it is the user’s responsibility to evaluate and verify the

operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter

described in this document. The furnishing of this document does not give you

any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing

IBM Corporation

North Castle Drive

Armonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM

Intellectual Property Department in your country or send inquiries, in writing, to:

IBM World Trade Asia Corporation

Licensing

2-31 Roppongi 3-chome, Minato-ku

Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other

country where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS

PUBLICATION ″AS IS″ WITHOUT WARRANTY OF ANY KIND, EITHER

EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS

FOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certain

transactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors.

Changes are periodically made to the information herein; these changes will be

incorporated in new editions of the publication. IBM may make improvements

and/or changes in the product(s) and/or the program(s) described in this

publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for

convenience only and do not in any manner serve as an endorsement of those Web

sites. The materials at those Web sites are not part of the materials for this IBM

product and use of those Web sites is at your own risk.


IBM may use or distribute any of the information you supply in any way it

believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose

of enabling: (i) the exchange of information between independently created

programs and other programs (including this one) and (ii) the mutual use of the

information which has been exchanged, should contact:

IBM Corporation

2Z4A/101

11400 Burnet Road

Austin, TX 78758 U.S.A.

Such information may be available, subject to appropriate terms and conditions,

including in some cases payment of a fee.

The licensed program described in this document and all licensed material

available for it are provided by IBM under terms of the IBM Customer Agreement,

IBM International Program License Agreement or any equivalent agreement

between us.

This information contains examples of data and reports used in daily business

operations. To illustrate them as completely as possible, the examples include the

names of individuals, companies, brands, and products. All of these names are

fictitious and any similarity to the names and addresses used by an actual business

enterprise is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which

illustrate programming techniques on various operating platforms. You may copy,

modify, and distribute these sample programs in any form without payment to

IBM, for the purposes of developing, using, marketing or distributing application

programs conforming to the application programming interface for the operating

platform for which the sample programs are written. These examples have not

been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or

imply reliability, serviceability, or function of these programs. You may copy,

modify, and distribute these sample programs in any form without payment to

IBM for the purposes of developing, using, marketing, or distributing application

programs conforming to IBM’s application programming interfaces.

If you are viewing this information in softcopy form, the photographs and color

illustrations might not appear.


Trademarks

IBM, the IBM logo, AIX, OS/390, S/390, OS/400, iSeries, Tivoli, the Tivoli logo,

Tivoli Enterprise, IBM Tivoli Enterprise Console, and Tivoli Enterprise Data

Warehouse are trademarks or registered trademarks of International Business

Machines Corporation in the United States, other countries, or both.

Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in

the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and other

countries.

Java and all Java-based trademarks and logos are trademarks or

registered trademarks of Sun Microsystems, Inc. in the United States and

other countries.

Other company, product, and service names may be trademarks or service marks

of others.

Notices 267

Glossary

A

Adapter Configuration Facility. In the IBM Tivoli

Enterprise Console, a graphical user interface that

enables a Tivoli administrator to easily configure and

customize event adapters.

C

cache. A buffer storage that contains frequently

accessed instructions and data; it is used to reduce

access time.

configuration file. A file that specifies the

characteristics of a system device or network.

D

data view. In IBM Tivoli Monitoring, a way of

displaying data in the Web Health Console.

database browser. In IBM Tivoli Monitoring, the Web

Health Console component that provides hierarchical

access to information about current resource problems.

This information can come from any endpoint to which

the Web Health Console has access, and it might

pertain to any resource model installed on that

endpoint. See also Web Health Console and resource

model.

default policy. In a Tivoli environment, a set of

resource property values that are assigned to a resource

when the resource is created.

defragmentation. The process of running a software

utility to rewrite fragmented data to contiguous sectors

of a computer storage medium to improve access and

retrieval time.

Desktop Management Task Force (DMTF). An

alliance of computer vendors that was convened to

define streamlined management of the diverse

operating systems commonly found in an enterprise.

E

endpoint. In a Tivoli environment, a Tivoli client that

is the ultimate recipient for any type of Tivoli

operation.

event. In a Tivoli environment, any significant change

in the state of a system resource, network resource, or

network application. An event can be generated for a

problem, for the resolution of a problem, or for the

successful completion of a task. Examples of events are

the normal starting and stopping of a process, the

abnormal termination of a process, and the

malfunctioning of a server. See also indication.

event class. In the IBM Tivoli Enterprise Console, a

classification for an event that indicates the type of

information that the event adapter sends to the event

server.

F

fragmentation. An operating system’s process of

writing different parts of a file to discontiguous sectors

on a computer storage medium when contiguous space

that is large enough to contain the entire file is not

available. When data is thus fragmented, the time that

it takes to access the data can increase because the

operating system must search different tracks for

information that should be in one location.

G

gateway. In a Tivoli environment, software running on

a managed node that provides all communication

services between a group of endpoints and the rest of

the Tivoli environment. This gateway includes the

multiplexed distribution (MDist) function, enabling it to

act as the fanout point for distributions to many

endpoints.

I

IBM Tivoli Enterprise Console. A Tivoli product that

collects, processes, and automatically initiates corrective

actions for system, application, network, and database

events; it is the central control point for events from all

sources. The IBM Tivoli Enterprise Console provides a

centralized, global view of the network computing

environment; it uses distributed event monitors to

collect information, a central event server to process

information, and distributed event consoles to present

information to system administrators.

IBM Tivoli Monitoring. A Tivoli application that

applies preconfigured, automated best practices to the

automated monitoring of essential system resources.

The application detects bottlenecks and other potential

problems and provides for the automatic recovery from

critical situations, which eliminates the need for system

administrators to manually scan through extensive

performance data. The application also integrates

seamlessly with other Tivoli Availability solutions,

including the IBM Tivoli Business Systems Manager


and the IBM Tivoli Enterprise Console. Previously

called Tivoli Distributed Monitoring (Advanced

Edition).

indication. An entity triggered by the occurrence of a

problem in an endpoint relating to one or more

resources. Indications are consolidated into events

within the endpoint being monitored. See also event.

installation repository (IR). In Tivoli Software

Installation Service (SIS), the directory that contains

reusable installation images and other data that is used

by SIS.

M

managed node. In a Tivoli environment, any managed

resource on which the Tivoli Management Framework

is installed.

monitoring collection. In IBM Tivoli Monitoring, a

collection of predefined monitors. Several monitoring

collections are packaged with IBM Tivoli Monitoring,

but Tivoli administrators can also use

custom-developed and third-party monitoring

collections. See also custom monitor.

O

object. In object-oriented design or programming, a

concrete realization of a class that consists of data and

the operations associated with that data.

P

policy region. In a Tivoli environment, a group of

managed resources that share one or more common

policies. Tivoli administrators use policy regions to

model the management and organizational structure of

a network computing environment. The administrators

can group similar resources, define access to and

control the resources, and associate rules for governing

the resources.

policy subregion. In a Tivoli environment, a policy

region created or residing in another policy region.

When a policy subregion is created, it initially uses the

resource and policy properties of the parent policy

region. The Tivoli administrator can later change or

customize these properties to reflect the specific needs

and differences of the subregion.

profile. In a Tivoli environment, a container for

application-specific information about a particular type

of resource. A Tivoli application specifies the template

for its profiles; the template includes information about

the resources that can be managed by that Tivoli

application.

A profile is created in the context of a profile manager;

the profile manager links a profile to the Tivoli resource

(for example, a managed node) that uses the

information contained in the profile. A profile does not

have any direct subscribers.

profile manager. In a Tivoli environment, a container

for profiles that links the profiles to a set of resources,

called subscribers. Tivoli administrators use profile

managers to organize and distribute profiles. A profile

manager is created in the context of a policy region and

is a managed resource in a policy region.

R

reference model. In the context of Tivoli software, the

model configuration for a system or set of systems that

is used to maintain consistent configurations in a

distributed environment. In Tivoli Inventory, reference

models are created in the configuration repository.

resource. In IBM Tivoli Monitoring context, a resource

is anything that affects the operation of the system and

includes physical and logical disks, CPUs, memory,

printers, as well as the processes running, services,

such as LanMan and the Windows event log, and

TCP/IP.

resource model. In IBM Tivoli Monitoring, the logical

modeling of one or more resources, along with the

logic on which cyclical data collection, data analysis,

and monitoring are based. Related events and actions

are triggered, if required. For any resource model, users

can specify individual thresholds and event aggregation

rules. See also event.

rule base. In the IBM Tivoli Enterprise Console, one or

more rule sets and the event class definitions for which

the rules are written. The IBM Tivoli Enterprise

Console uses the rule base in managing events. An

organization can create many rule bases, with each rule

base fulfilling a different set of needs for network

computing management.

S

Software Installation Service (SIS). A Tivoli product

that provides an easy-to-use, efficient interface for

installing Tivoli Enterprise™ software. SIS uses Tivoli’s

MDist technology and provides automated checking for

prerequisite software, a reusable repository of

installation images, and both graphical and

command-line interfaces for deploying Tivoli products

to a large number of computers.

subscriber. In a Tivoli environment, a managed node,

a profile manager, an endpoint, or another Tivoli client

that is subscribed to a profile manager. Although

profiles are distributed to a subscriber, the subscriber

might or might not be the final destination of the

profile distribution.

Glossary


T

task library. In a Tivoli environment, a container in

which a Tivoli administrator can create and store tasks

and jobs.

threshold. (1) In software products, a value that

defines a limit for a monitored condition. (2) In IBM

Tivoli Monitoring, a threshold is a named property

with a user-defined value. Typically, the value specified

for a threshold represents a significant level of a

performance-related entity, which, if exceeded, a system

administrator might want to know about.

Tivoli Distributed Monitoring. Previous name of

Tivoli Distributed Monitoring (Classic Edition).

Tivoli Distributed Monitoring (Advanced Edition).

Previous name of IBM Tivoli Monitoring.

Tivoli Distributed Monitoring (Classic Edition). A

Tivoli application that provides distributed monitors for

monitoring system resources. The application initiates

necessary corrective actions and informs system

administrators of potential problems. These monitors

can be centrally configured and deployed to monitor

individual machines. The application also integrates

seamlessly with other Tivoli Availability solutions,

including the IBM Tivoli Enterprise Console. Previously

called Tivoli Distributed Monitoring.

Tivoli environment. The Tivoli applications, based

upon the Tivoli Management Framework, that are

installed at a specific customer location and that

address network computing management issues across

many platforms. In a Tivoli environment, a system

administrator can distribute software, manage user

configurations, change access privileges, automate

operations, monitor resources, and schedule jobs.

Tivoli management agent. In the Tivoli environment,

an agent that securely performs administrative

operations.

Tivoli Management Framework. The base software

that is required to run the applications in the Tivoli

product suite. This software infrastructure enables the

integration of systems management applications from

Tivoli Systems Inc. and the Tivoli Partners.

In a Tivoli environment, the Tivoli Management

Framework is installed on every client and server;

however, the TMR server is the only server that holds

the full object database.

Tivoli management region. In a Tivoli environment, a

Tivoli server and the set of clients that it serves. An

organization can have more than one Tivoli

management region. A Tivoli management region

addresses the physical connectivity of resources

whereas a policy region addresses the logical

organization of resources.

W

Web Health Console. In IBM Tivoli Monitoring, a

component that displays real-time and historical data

for any resource model at any endpoint. Using the

graphical user interface, users can locate individual

problems associated with one or more resources. The

status is displayed as a value between 0 (representing

an identified problem, that is, an event) and 100

(representing no recent indications). Users can select

views of resource problems as tabular data, different

types of charts, and so on.

Glossary

Glossary 271

Glossary


Index

Aaccount not valid for root indication 156

account not valid for root problem 155

actions, built-in (Windows)adjust initial work items 57, 251

adjust maximum work items 57, 251

common 249

delete registry 250

delete registry key shares 13

description 249

enlarge IRP stack size 13, 250

Event Log resource model 13, 250

Network Interface Card resource model 57, 251

Parametric Services resource model 65

raise session timeout 14, 250

restart service 100, 252

Services Failing Service 100

Services resource model 100, 252

Services Stopped Service 100

adjust initial work items action 57, 251

adjust maximum work items action 57, 251

adjust work items indication 43

alternative groups parameter 160

alternative owners parameter 160

ASP Disk Mirroring resource modeldescription 167

indications 167

mirroring not active indication 168

parameters 169

ASP nearing capacity indication 171

ASP overflow indication 172

ASP Utilizationresource model

description 170

ASP Utilization resource modelASP nearing capacity indication 171

ASP overflow indication 172

indications 170

logging 173

parameters 173

available disk space configuration parameter 94

available file system space configuration parameter 162

available space threshold 115, 117

BBasic Average CPU Utilization

resource modeldescription 174

Basic Average CPU Utilization resource modelindications 174

Basic CPU Utilization Guideline Exceeded indication 174

Basic CPU Utilization GuidelineLong Running Exceeded

indication 175

Basic CPU Utilization Peak Exceeded indication 176


indication 177

Basic CPU Utilization resource modelBasic CPU Utilization Guideline Exceeded indication 174

Basic CPU Utilization resource model (continued)Basic CPU Utilization Guideline Long Running Exceeded

indication 175

Basic CPU Utilization Peak Exceeded indication 176


indication 177

logging 178

Basic Interactive CPU Utilizationresource model

description 179

Basic Interactive CPU Utilization Guideline 180

Basic Interactive CPU Utilization Guideline Exceeded

indication 179


indication 181

Basic Interactive CPU Utilization Peak Long Running 182

Basic Interactive CPU Utilization resource modelBasic Interactive CPU Utilization Guideline Exceeded

indication 179

Basic Interactive CPU Utilization Guideline Long Running

Exceeded indication 180


indication 181

Basic Interactive CPU Utilization Peak Long Running

Exceeded indication 182

indications 179

logging 183

booksfeedback viii

online viii

ordering viii

broadcast frames problem 41

browser threshold 99

built-in actions (Windows)adjust initial work items 251

adjust maximum work items 251

common 249

delete registry 250

description 249

enlarge IRP stack size 250

Event Log resource model 250

Network Interface Card resource model 251

raise session timeout 250

restart service 252

Services resource model 252

busy drive from high paging correlated event 236

busy drive from low avail correlated event 237

busy hardware indication 86

bytes transferred per second problem 14, 67

Ccache problem 22

client connectivity problems 8

Collect Configuration modeldescription 7

Collect Configuration resource modellogging 7

committed bytes problem 23

computers parameter 61

Configuration object not active indication 185


Configuration Objectsresource model

description 185

Configuration Objects resource modelConfiguration object not active indication 185

indications 185

parameters 186

congested TCP network correlated event 238

conventions used xii

correlated eventsbusy drive from high paging 236

busy drive from low avail 237

congested TCP network 238

critical memory leak 240

critically low disk space 239

description 235

faulty disk subsystem 241

high disk read bytes per second 242

high disk write bytes per second 243

high drive transfer rate 244

high percent drive time 245

possible disk fragmentation 246

process hogging CPU 247

slow hard drive 248

CPU cannot keep up with hardware indication 86

CPU resource modeldescription 107

high CPU overload indication 108

high CPU usage by system indication 108

indications 108

logging 109

percentage of CPU in idle threshold 108, 109

percentage of CPU used by system threshold 109

thresholds 109

critical memory leak correlated event 240

critically low disk space correlated event 239

customer supportSee Software Support

DDatabase CPU Utilization


Database CPU Utilization Exceeded indication 187

Database CPU Utilization resource modelDatabase CPU Utilization Exceeded 187

indications 187

logging 188

defined users parameter 160

delete registry action 250

delete registry key shares action 13

detection of malfunctioning devices problem 8

directory names, notation xi

disk fragmentation (possible) correlated event 246

disk space problem 14

Distribution Queuesresource model

description 189

Distribution Queues resource modelHigh priority distribution queue not active indication 189

indications 189

Normal priority distribution queue not active

indication 190

parameters 190

DMXCpu resource model 107

DMXFile resource model 111

DMXFileSystem resource model 114

DMXMemory resource model 120

DMXNetworkInterface resource model 124

DMXNetworkRPCNFS resource model 131

DMXProcess resource model 149

DMXSecurity resource model 155

DMXSpp resource model 162

duplicate account indication 156

Eeducation

See Tivoli technical training

endpoint name 5

enlarge IRP stack size action 13, 250

environment variables, notation xi

event ID 11 indication 10







event IDs parameter 61

Event Log resource modelactions 13

built-in actions 250


delete registry action 250

delete registry key shares action 13

description 7, 107, 167

detection of malfunctioning devices problem 8

enlarge IRP stack size action 13, 250








indication properties 12

indications 9

problems highlighted 8

raise session timeout action 14, 250

server connectivity problems 8

thresholds 13

event severity parameter 61

EventLog threshold 99

eventsgeneric

Generic Script resource model 229

events, correlated (Windows) 235

excessive page faults threshold 39

excessive paging threshold 26, 29, 39

Ffaulty disk subsystem correlated event 241

file attributes changed indication 111

file changed indication 112

file not present indication 112

File resource modeldescription 111

file attributes changed indication 111

file changed indication 112

file not present indication 112


File resource model (continued)file to be checked parameter 113, 118

ignored file system parameter 119

indications 111

logging 113

parameters 113

File System resource modelavailable space threshold 115, 117

description 113

fragmented file system indication 114

indications 114

logging 119, 232

low percentage of available I-nodes indication 116

low space available indication 115

parameters 117

percent available space threshold 116, 117

percentage of available I-nodes threshold 117

percentage of file system space used threshold 115, 117

percentage of I-nodes used threshold 115, 117

thresholds 117

file to be checked parameter 113, 118

files to be monitored parameter 160

filter type parameter 61

fixes, obtaining 261

fragmented data problem 100

fragmented file system indication 114

Ggeneric script indications

genericgeneric script 229

Generic Script resource modeldescription 229

events 229

ITM generic script indication 229

parameters 230

Hhandle leaks problem 81

hardware keeping CPU busy indication 87

high bytes per second threshold 21, 69, 70, 71, 72, 73

high CPU overload indication 108

high CPU usage by system indication 108

high CPU usage indication 83

high CPU usage interrupt threshold 86, 87, 88, 89, 90, 91

high CPU usage problem 81, 84

high CPU usage process threshold 89, 90, 91

high CPU usage threshold 86, 87, 88, 89, 90, 91

high CPU usage user privilege threshold 91

high current commands indication 45

high current commands modifier threshold 45, 50, 51, 52, 54,

56

high current percent time indication 75

high disk read bytes per second correlated event 242

high disk write bytes per second correlated event 243

high drive transfer rate correlated event 244

high duplicate RPC server calls indication 132

high errored out ratio threshold 46, 56

high fragment ratio indication 101

high fragment ratio threshold 102, 104

high input packets in error indication 126

high interrupts per second threshold 86, 87, 88, 91

high job errors indication 76

high job errors per day indication 77

high log-in number for user indication 156

high network traffic indication 133

high NFS buffer size indication 133

high NFS server get-attribute operations indication 134

high NFS server read operations indication 135

high NFS server readlink operations indication 135

high NFS server write operations indication 136

high not ready errors indication 77

high not ready errors per day indication 78

high number of zombie processes indication 149

high out of paper errors indication 78

high out of paper errors per day indication 79

high output packets in error indication 127

high output queue length modifier threshold 47, 48, 57

high paging indication 25

high percent broadcast threshold 44, 51, 52, 53

high percent bytes per second threshold 43, 45, 47, 48, 49, 50,

51, 52, 53, 54, 55, 56, 57

high percent disk time indication 68

high percent drive time correlated event 245

high percent usage delta indication 88

high percent usage delta threshold 89, 91

high percent usage threshold 21, 69, 70, 71, 72, 74

high percent utilization threshold 43, 44, 45, 49, 50, 51, 52, 53,

54, 55, 56, 57

high percentage disk time indication 15

high percentage packet collisions indication 127

high ping indication 102

High priority distribution queue not active indication 189

high processes indication 89

high queue length threshold 19, 21, 69, 70, 71, 72, 73, 74

high read bytes per second indication 16

high retransmitted calls indication 137

high RPC bad calls indication 137

high segments retransmitted threshold 103, 104

high timeouts and badxids indication 138

high transfer rate indication 17, 70

high work item shortages threshold 43, 49, 53, 55, 56, 57

high write bytes per second indication 18, 71

HighCPUUsageUserPrivthreshold 91

History Logresource model

description 191

History Log resource modelindications 191

List of jobs not empty indication 191

parameters 192

host name 5

IIBM Tivoli Monitoring

publication library viii

ignored file system parameter 119

illegal group indication 157

illegal owner indication 157

indicationsOS/400

ASP Disk Mirroring resource model 167

ASP nearing capacity 171

ASP overflow 172

ASP Utilization resource model 170

Basic Average CPU Utilization resource model 174

Basic CPU Utilization Guideline Exceeded 174

Basic CPU Utilization Guideline Long Running

Exceeded 175

Index 275

indications (continued)OS/400 (continued)

Basic CPU Utilization Peak Exceeded 176

Basic CPU Utilization Peak Long Running

Exceeded 177

Basic Interactive CPU Utilization Guideline

Exceeded 179

Basic Interactive CPU Utilization Guideline Long

Running Exceeded 180

Basic Interactive CPU Utilization Peak Exceeded 181

Basic Interactive CPU Utilization Peak Long Running

Exceeded 182


Configuration object not active 185

Configuration Objects resource model 185

Database CPU Utilization Exceeded 187

Database CPU Utilization resource model 187

Distribution Queues resource model 189

High priority distribution queue not active 189

History Log resource model 191

Interactive Feature CPU Utilization Exceeded 196

Interactive Feature CPU Utilization resource

model 196

Job Log resource model 198

Job Log Warning Message 198

Job Not Active 204

Job Queue Not Active 201

Job Queue Not Assigned 202

Job Queue resource model 201

Job Status resource model 204

Last Changed Date Different 213

List of jobs not empty 191

Management Central Critical 206

Management Central Events resource model 206

Management Central Harmless 207

Management Central Unknown 207

Management Central Warning 207

mirroring not active 168

Network Attributes Mismatch 209

Network Attributes resource model 209

No writers started for output queue 211

Normal priority distribution queue not active 190

Object Owner Different 214

Object Size Exceeded 214

Output queue not active 212

Output Queues resource model 211

Parametric Object and File resource model 213

Subsystem Not Active 218

Subsystem Status resource model 218

System ASP Used Near Peak Guidelines 220

System Disk Resources resource model 220

System Object Mismatch 223

System Value resource model 223

TCP Interface Not Active 225

TCP Interface resource model 225

TCP Service Not Active 227

TCP Service resource model 227

Too Many Jobs Queued 202

Total Auxiliary Storage Reached Capacity

Guidelines 221

Total Auxiliary Storage Reached Peak Guidelines 222

UNIX and Linuxaccount not valid for root 156

CPU resource model 108

duplicate account 156

file attributes changed 111

file changed 112

indications (continued)UNIX and Linux (continued)

file not present 112

File resource model 111

File System resource model 114

fragmented file system 114

high CPU overload 108

high CPU usage by system 108

high duplicate RPC server calls 132

high input packets in error 126

high log-in number for user 156

high network traffic 133

high NFS buffer size 133

high NFS server get-attribute operations 134

high NFS server read operations 135

high NFS server readlink operations 135

high NFS server write operations 136

high number of zombie processes 149

high output packets in error 127

high percentage packet collisions 127

high retransmitted calls 137

high RPC bad calls 137

high timeouts and badxids 138

illegal group 157

illegal owner 157

interface not enabled 128

interface not operational 128

low percentage of available I-nodes 116

low space available 115

low storage space 121

low swap space 121

Memory resource model 121

Network Interface resource model 126

Network RPC-NFS resource model 132

nonexistent file 158

null password 158

process consuming high CPU 150

process killed or nonexistent 150

Process resource model 149

process stopped 151

Security resource model 155

slow network 139

suspect supergroup 158

suspect superuser 159

system thrashing 122

unknown interface status 129

wrong file mode 159

Windowsadjust work items 43

busy hardware 86

CPU cannot keep up with hardware 86

event ID 11 10

event ID 15 10

event ID 2011 11

event ID 2511 11

event ID 3013 11

event ID 7023 12

event ID 9 9


hardware keeping CPU busy 87

high current commands 45

high current percent time 75

high fragment ratio 101

high job errors 76

high job errors per day 77

high not ready errors 77

high not ready errors per day 78


indications (continued)Windows (continued)

high out of paper errors 78

high out of paper errors per day 79

high paging 25

high percent disk time 68

high percent usage delta 88

high percentage disk time 15

high ping 102

high processes 89

high read bytes per second 16

high transfer rate 17, 70

high write bytes per second 18, 71

logical disk possible fragmentation 19

Logical Disk resource model 15

low available memory 25

low available memory causing hard paging 27

low available memory causing many problems 28

low available memory causing soft paging and pagefile

resizing 29

low available memory is causing excessive soft

paging 26

low available memory with a small pagefile 31

low available memory with high cache 32

low copy read hits 32

low data map hits 33

low disk space 19

memory leak in private bytes 36

memory leak in system drivers 37



pagefile is resizing 38

Parametric Event Log resource model 60


Parametric TCP/IP Ports resource model 66

physical disk possible fragmentation 72

Physical Disk resource model 68

Printer resource model 75

process handle leak 82

process high CPU 82


processor busy 90

Processor resource model 85

properties 12

redirector affecting server 48

redirector overloaded affecting segment 50

segment affecting server 52

segments ReXmit 103

services failing service 63, 97


services stopped service 64, 98

slow logical drive 20

slow physical drive 72

state of the defined port 66

TCP/IP resource model 101

Windows event logged 60

information centers, searching for problem resolution 261

input packets in error threshold 126, 129

Interactive Feature CPU Utilizationresource model

description 196

Interactive Feature CPU Utilization Exceeded indication 196

Interactive Feature CPU Utilization resource modelindications 196

Interactive Feature CPU Utilization Exceeded

indication 196

logging 197

interface not enabled indication 128

interface not operational indication 128

Internetsearching for problem resolution 261

ITM generic script event 229

ITM Resource Model Reference Guideabout vii

contents vii

prerequisite knowledge vii

prerequisite publications ix

related publications ix

target audience vii

Jjob errors per day threshold 77, 80

job errors threshold 76, 80

Job Logresource model

description 198

Job Log resource modelindications 198

Job Log Warning Message indication 198

parameters 199

Job Log Warning Message indication 198

Job Not Active indication 204

Job Queueresource model

description 201

Job Queue Not Active indication 201

Job Queue Not Assigned indication 202

Job Queue resource modelindications 201

Job Queue Not Active indication 201

Job Queue Not Assigned indication 202

parameters 203

Too Many Jobs Queued indication 202

Job Statusresource model

description 204

Job Status resource modelindications 204

Job Not Active indication 204

parameters 205

Kkey services problem 96

knowledge bases, searching for problem resolution 261

LLanmanServer threshold 99

LanmanWorkstation threshold 99

Last Changed Date Different indication 213

List of jobs not empty indication 191

log file type parameter 62

loggingOS/400


Basic CPU Utilization resource model 178


Database CPU Utilization resource model 188

Interactive Feature CPU Utilization resource

model 197

Storage Pools resource model 216

Index 277

logging (continued)OS/400 (continued)

System Disk Resources resource model 222

UNIX and LinuxCollect Configuration resource model 7




File System resource modelOnly one 232






Server Performance Prediction resource model 163

WindowsLogical Disk resource model 21











logical disk possible fragmentation indication 19

Logical Disk resource modelbytes transferred per second problem 14

description 14

disk space problem 14

high bytes per second threshold 21


high percent usage threshold 21

high queue length threshold 19, 21

high read bytes per second indication 16

high transfer rate indication 17

high write bytes per second indication 18

indications 15

logging 21

logical disk possible fragmentation indication 19

low disk space indication 19

low disk space threshold 21

percent usage problem 14

prerequisites 15


slow logical drive indication 20

thresholds 21

logons by same user problem 155

low available memory causing hard paging indication 27

low available memory causing many problems indication 28


resizing indication 29

low available memory indication 25

low available memory is causing excessive soft paging

indication 26

low available memory problem 23

low available memory with a small pagefile indication 31

low available memory with high cache indication 32

low cache hits percent threshold 39

low copy read hits indication 32

low data map hits indication 33

low disk space indication 19

low disk space threshold 21

low percentage of available I-nodes indication 116

low segments threshold 102, 104

low space available indication 115

low storage space indication 121

low swap space indication 121

MManagement Central Critical indication 206

Management Central Eventsresource model

description 206

Management Central Events resource modelindications 206

Management Central Critical indication 206

Management Central Harmless indication 207

Management Central Unknown indication 207

Management Central Warning indication 207

Management Central Unknown indication 207

Management Central Warning indication 207

Management CentralHarmless indication 207

manualsfeedback viii

online viii

ordering viii

maximum handles indication 82, 83

maximum number of zombie processes threshold 149, 151

maximum print jobs threshold 80

maximum print queues threshold 80

maximum processes indication 82, 83

Memory (UNIX and Linux) resource modeldescription 120

indications 121

logging 123

low storage space indication 121

low swap space indication 121

memory page-in rate threshold 122, 123

memory page-out rate threshold 122, 123

percentage of available swap space threshold 122, 123

percentage of available virtual storage threshold 121, 123

system thrashing indication 122

thresholds 123

Memory (Windows) resource modelcache problem 22

committed bytes problem 23

description 22

excessive page faults threshold 39

excessive paging threshold 26, 29, 39

high paging indication 25

indications 24

logging 39

low available memory causing hard paging indication 27

low available memory causing many problems

indication 28


resizing indication 29

low available memory indication 25

low available memory is causing excessive soft paging

indication 26

low available memory problem 23

low available memory with a small pagefile indication 31

low available memory with high cache indication 32

low cache hits percent threshold 39

low copy read hits indication 32

low data map hits indication 33

memory leak in private bytes indication 36

memory leak in system drivers indication 37

memory leaks problem 23

minimum available bytes threshold 39


Memory (Windows) resource model (continued)minimum committed bytes threshold 39

pagefile is resizing indication 38

paging and page faulting problem 23


thresholds 39

memory leak in private bytes indication 36

memory leak in system drivers indication 37

memory leaks problem 23

memory page-in rate threshold 122, 123

memory page-out rate threshold 122, 123

minimum available bytes threshold 39

minimum committed bytes threshold 39

mirroring not active indication 168

moderate DG threshold 102, 104

multiple CPU problems 85

NNetlogon threshold 99

Network Attributesresource model

description 209

Network Attributes Mismatch indication 209

Network Attributes resource modelindications 209

Network Attributes Mismatch indication 209

parameters 210

network congestion problem 100

network interface card problem 41

Network Interface Card resource modelactions 57

adjust initial work items action 57, 251

adjust maximum work items action 57, 251

adjust work items indication 43

broadcast frames problem 41


description 41

high current commands indication 45

high current commands modifier threshold 45, 50, 51, 52,

54, 56

high errored out ratio threshold 46, 56

high output queue length mod threshold 47, 48, 57

high percent broadcast threshold 44, 51, 52, 53

high percent bytes per second threshold 43, 45, 47, 48, 49,

50, 51, 52, 53, 54, 55, 56, 57

high percent utilization threshold 43, 44, 45, 49, 50, 51, 52,

53, 54, 55, 56, 57

high work item shortages threshold 43, 49, 53, 55, 56, 57

indications 42

logging 57

network interface card problem 41


redirector affecting server indication 48

redirector overloaded affecting segment indication 50

segment affecting server indication 52

server and workstation services problem 41

thresholds 56

Network Interface resource modeldescription 124

high input packets in error indication 126, 127

high percentage packet collisions indication 127

indications 126

input packets in error threshold 126, 129

interface not enabled indication 128

interface not operational indication 128

logging 130

Network Interface resource model (continued)output packets in error threshold 127, 129

packet collision percentage threshold 128, 130

parameters 130

SNMP Community Nameparameter 130, 163

thresholds 129

unknown interface status indication 129

Network RPC-NFS resource modeldescription 131

high duplicate RPC server calls indication 132

high network traffic indication 133

high NFS buffer size indication 133

high NFS server get-attribute operations indication 134

high NFS server read operations indication 135

high NFS server readlink operations indication 135

high NFS server write operations indication 136

high retransmitted calls indication 137

high RPC bad calls indication 137

high timeouts and badxids indication 138

indications 132

logging 140

percentage of bad RPC calls threshold 138, 140

percentage of client RPC badxids threshold 138, 140

percentage of client RPC calls in time-out threshold 138,

140

percentage of client RPC retransmissions threshold 137,

140

percentage of NFS server getattr operations threshold 134,

139

percentage of NFS server read operations threshold 135,

139

percentage of NFS server readlink operations

threshold 136, 139

percentage of NFS server write operations threshold 136,

140

percentage of server RPC duplicate requests

threshold 132, 140

slow network indication 139

thresholds 139

No writers started for output queue indication 211

nonexistent file indication 158

Normal priority distribution queue not active indication 190

not ready errors per day threshold 78, 80

not ready errors threshold 77, 80

notationenvironment variables xi

path names xi

typeface xi

NtLmSsp threshold 100

null password indication 158

OObject Owner Different indication 214

Object Size Exceeded indication 214

obsoletethreshold

Maximum Print Queues 80

thresholdsMaximum Print Queues 80

MostPrintQueues 80

online publications x

ordering publications x

out of paper errors per day threshold 79, 80

out of paper errors threshold 79, 80

output packets in error threshold 127, 129

Index 279

Output queue not active indication 212

Output Queuesresource model

description 211

Output Queues resource modelindications 211

No writers started for output queue indication 211

Output queue not active indication 212

parameters 212

Ppacket collision percentage threshold 128, 130

paging and page faulting problem 23

parameterscommon 5

genericGeneric Script resource model 230

OS/400ASP Disk Mirroring resource model 169


Configuration Objects resource model 186

Distribution Queues resource model 190

History Log resource model 192

Job Log resource model 199

Job Queue resource model 203

Job Status resource model 205

Network Attributes resource model 210

Output Queues resource model 212

Parametric Object and File resource model 215

Storage Pools resource model 216

Subsystem Status resource model 219

System Value resource model 224

TCP Interface resource model 226

TCP Service resource model 228

SNMP Community name 130

UNIX and Linuxalternative groups 160

alternative owners 160

available file system space configuration 162

defined users 160



file to be checked 113, 118

files to be monitored 160

ignored file system 119





SNMP Community Name 130, 163

special groups 160

special users 160

Windowsavailable disk space configuration 94

computers 61

event IDs 61

event severity 61

filter type 61

log file type 62

Parametric Event Log resource model 61



physical disk configuration 94

port numbers 67

possible state of a port 67


parameters (continued)Windows (continued)

services 65

source 62

Windows 2000 logs 62

Parametric Event Log resource modelcomputers parameter 61

description 59

event IDs parameter 61

event severity parameter 61

filter type parameter 61

indications 60

log file type parameter 62

parameters 61

source parameter 62

Windows 2000 logs parameter 62

Windows event logged indication 60

Parametric Object and Fileresource model

description 213

Parametric Object and File resource modelindications 213

Last Changed Date Different indication 213

Object Owner Different indication 214

Object Size Exceeded indication 214

parameters 215

Parametric Services resource modelactions 65

description 62

indications 63

logging 65

parameters 65

port numbers parameter 67

possible state of a port parameter 67

services failing service indication 63

services parameter 65

services stopped service indication 64

Parametric TCP/IP Ports resource modeldescription 65

indications 66

logging 67

parameters 67

prerequisites 66

state of the defined port indication 66

path names, notation xi

percent available space threshold 116, 117

percent processor threshold 76, 80

percent processor time problem 74

percent usage problem 14, 68

percentage of available I-nodes threshold 117

percentage of available swap space threshold 122, 123

percentage of available virtual storage threshold 121, 123

percentage of bad RPC calls threshold 138, 140

percentage of client RPC badxids threshold 138, 140

percentage of client RPC calls in time-out threshold 138, 140

percentage of client RPC retransmissions threshold 137, 140

percentage of CPU in idle threshold 108, 109

percentage of CPU used by system threshold 109

percentage of CPU used threshold 150, 152

percentage of file system space used threshold 115, 117

percentage of I-nodes used threshold 115, 117

percentage of NFS server getattr operations threshold 134,

139

percentage of NFS server read operations threshold 135, 139

percentage of NFS server readlink operations threshold 136,

139

percentage of NFS server write operations threshold 136, 140


percentage of server RPC duplicate requests threshold 132,

140

physical disk configuration parameter 94

physical disk possible fragmentation indication 72

Physical Disk resource modelbytes transferred per second problem 67

description 67

high bytes per second threshold 69, 70, 71, 72, 73


high percent usage threshold 69, 70, 71, 72, 74

high queue length threshold 69, 70, 71, 72, 73, 74

high transfer rate indication 70

high write bytes per second indication 71

indications 68

logging 74

percent usage problem 68

physical disk possible fragmentation indication 72


slow physical drive indication 72

thresholds 73

port numbers parameter 67

possible disk fragmentation correlated event 246

possible state of a port parameter 67

prerequisitespublications ix

softwareresource models (OS/400) 2

resource models (UNIX and Linux) 1

resource models (Windows) 1

Tivoli product knowledge ix

WindowsLogical Disk resource model 15




printer errors problem 74

Printer resource modeldescription 74

high current percent time indication 75

high job errors indication 76

high job errors per day indication 77

high not ready errors indication 77

high not ready errors per day indication 78

high out of paper errors indication 78

high out of paper errors per day indication 79

indications 75

job errors per day threshold 77, 80

job errors threshold 76, 80

logging 80

maximum print jobs threshold 80

maximum print queues threshold 80

not ready errors per day threshold 78, 80

not ready errors threshold 77, 80

out of paper errors per day threshold 79, 80

out of paper errors threshold 79, 80

percent processor threshold 76, 80

percent processor time problem 74

printer errors problem 74

thresholds 80

problem determinationdescribing problems 264

determining business impact 263

submitting problems 264

problems highlightedUNIX and Linux

account not valid for root 155

logons by same user 155

problems highlighted (continued)UNIX and Linux (continued)

process is stopped or killed 148


process uses too much CPU time 148

property changes 155


suspect superuser 155

too many zombie processes in the system 148

Windowsbroadcast frames 41

bytes transferred per second 14, 67

cache 22


committed bytes 23

detection of malfunctioning devices 8

disk space 14

fragmented data 100

handle leaks 81

high CPU usage 81, 84

key services 96

low available memory 23

memory leaks 23


network congestion 100

network interface card 41

paging and page faulting 23

percent processor time 74

percent usage 14, 68

printer errors 74

server and workstation services 41


unstable services 96

Process (UNIX and Linux) resource modeldescription 148

high number of zombie processes indication 149

indications 149

logging 154

maximum number of zombie processes threshold 149, 151

parameters 152

percentage of CPU used threshold 150, 152


process consuming high CPU indication 150

process is stopped or killed problem 148

process killed or nonexistent indication 150

process stopped indication 151

process uses too much CPU time problem 148

thresholds 151

too many zombie processes in the system problem 148

Process (Windows) resource modeldescription 81

handle leaks problem 81

high CPU usage indication 83

high CPU usage problem 81

indications 81

logging 83

maximum handles indication 82, 83

maximum processes indication 82, 83


process handle leak indication 82

process high CPU indication 82

thresholds 83

process consuming high CPU indication 150

process handle leak indication 82

process high CPU indication 82

process hogging CPU correlated event 247

process is stopped or killed problem 148

Index 281

process killed or nonexistent indication 150

process stopped indication 151

process uses too much CPU time problem 148

processor busy threshold 90

Processor resource modelbusy hardware indication 86

CPU cannot keep up with hardware indication 86

description 84

hardware keeping CPU busy indication 87

high CPU usage interrupt threshold 86, 87, 88, 89, 90, 91

high CPU usage problem 84

high CPU usage process threshold 89, 90, 91

high CPU usage threshold 86, 87, 88, 89, 90, 91

high CPU usage user privilege threshold 91

high interrupts per second threshold 86, 87, 88, 91

high percent usage delta indication 88

high percent usage delta threshold 89, 91

high processes indication 89

indications 85

logging 91



processor busy threshold 90

thresholds 91

total CPUs modifier threshold 87, 88, 91

property changes problem 155

publicationsfeedback viii

online viii, x

ordering viii, x

related ix

Rraise session timeout action 14, 250

redirector affecting server indication 48

redirector overloaded affecting segment indication 50

resource modelsgeneric

Generic Script 229

LinuxEvent Log 107

OS/400ASP Disk Mirroring 167

ASP Utilization 170

Basic Average CPU Utilization 174

Basic Interactive CPU Utilization 179

Configuration Objects 185

Database CPU Utilization 187

Distribution Queues 189

Event Log 167

History Log 191

Interactive Feature CPU Utilization 196

Job Log 198

Job Queue 201

Job Status 204

Management Central Events 206

Network Attributes 209

Output Queues 211

Parametric Object and File 213

Storage Pools 216

Subsystem Status 218

System Disk Resources 220

System Value 223

TCP Interface 225

TCP Service 227

resource models (continued)Solaris only

Network RPC-NFS - 131

UNIXEvent Log 107

UNIX and LinuxCollect Configuration 7

CPU 107

File 111

File System 113

Memory 120

Network Interface 124

Network RPC-NFS 131

Process 148

Security 155

Server Performance Prediction 161

WindowsEvent Log 7

Logical Disk 14

Memory 22

Network Interface Card 41

Parametric Event Log 59

Parametric Services 62

Parametric TCP/IP Ports 65

Physical Disk 67

Printer 74

Process 81

Processor 84

Server Performance Prediction 92

Services 96

TCP/IP 100

TMW_Spp 92

resource models (OS/400)prerequisites 2

resource models (UNIX and Linux)prerequisites 1

resource models (Windows)prerequisites 1

restart service action 100, 252

SSecurity resource model

account not valid for root indication 156

account not valid for root problem 155

alternative groups parameter 160

alternative owners parameter 160

defined users parameter 160

description 155

duplicate account indication 156

files to be monitored parameter 160

high log-in number for user indication 156

illegal group indication 157

illegal owner indication 157

indications 155

logging 160

logons by same user problem 155

nonexistent file indication 158

null password indication 158

parameters 160


property changes problem 155

special groups parameter 160

special users parameter 160

suspect supergroup indication 158

suspect superuser indication 159

suspect superuser problem 155


Security resource model (continued)wrong file mode indication 159

segment affecting server indication 52

segments ReXmit indication 103

server and workstation services problem 41


Server Performance Prediction (UNIX and Linux) resource

modelavailable file system space configuration parameter 162

description 161

logging 163

parameters 162

Server Performance Prediction (Windows) resource model 92

available disk space configuration parameter 94

logging 94

parameters 94

physical disk configuration parameter 94

Server Performance Prediction resource modelprerequisites 93

services failing service indication 63, 97

services parameter 65

Services resource modelactions 100

browser threshold 99


description 96

EventLog threshold 99

indications 97

key services problem 96

LanmanServer threshold 99

LanmanWorkstation threshold 99

Netlogon threshold 99

NtLmSsp threshold 100


restart service action 100, 252

services failing service indication 97

services stopped service indication 98

thresholds 98

Tivoli endpoint threshold 100

unstable services problem 96

services stopped service indication 64, 98

slow hard drive correlated event 248

slow logical drive indication 20

slow network indication 139

slow physical drive indication 72

SNMPCommunity Name parameter 130, 163

SNMP Community Name 130

Software Supportcontacting 263

describing problems 264

determining business impact 263

receiving weekly updates 262

submitting problems 264

source parameter 62

special groups parameter 160

special users parameter 160

state of the defined port indication 66

Storage Poolsresource model

description 216

Storage Pools resource modellogging 216

parameters 216

styletypeface conventions xi

Subsystem Not Active indication 218

Subsystem resource modelSubsystem Not Active indication 218

Subsystem Statusresource model

description 218

Subsystem Status resource modelindications 218

parameters 219

suspect supergroup indication 158

suspect superuser indication 159

suspect superuser problem 155

syntaxTivoli command xii

Tivoli typeface conventions used xi

System Disk Resourcesresource model

description 220

System Disk Resources resource modelindications 220

logging 222

System ASP Used Near Peak Guidelines indication 220

Total Auxiliary Storage Reached Capacity indication 221


indication 222

System Object Mismatch indication 223

system thrashing indication 122

System Valueresource model

description 223

System Value resource modelindications 223

parameters 224

System Object Mismatch indication 223

TTCP Interface


TCP Interface Not Active indication 225

TCP Interface resource modelindications 225

parameters 226

TCP Interface Not Active indication 225

TCP Serviceresource model

description 227

TCP Service Not Active indication 227

TCP Service resource modelindications 227

parameters 228

TCP Service Not Active indication 227

TCP/IP resource modeldescription 100

fragmented data problem 100

high fragment ratio indication 101

high fragment ratio threshold 102, 104

high ping indication 102

high segments retransmitted threshold 103, 104

indications 101

logging 104

low segments threshold 102, 104

moderate DG threshold 102, 104

network congestion problem 100

prerequisites 101


segments ReXmitindication 103

Index 283

TCP/IP resource model (continued)thresholds 103

terminologyendpoint name, defined 5

host name, defined 5

thresholdobsolete

HighCPUUsageUserPriv 91

thresholdsobsolete

MostPrintQueues 80

UNIX and Linuxavailable space 115, 117



input packets in error 126, 129

maximum number of zombie processes 149, 151

memory page-in rate 122, 123

memory page-out rate 122, 123




output packets in error 127, 129

packet collision percentage 128, 130

percent available space 116, 117

percentage of available I-nodes 117

percentage of available swap space 122, 123

percentage of available virtual storage 121, 123

percentage of bad RPC calls 138, 140

percentage of client RPC badxids 138, 140

percentage of client RPC calls in time-out 138, 140

percentage of client RPC retransmissions 137, 140

percentage of CPU in idle 108, 109

percentage of CPU used 150, 152

percentage of CPU used by system 109

percentage of file system space used 115, 117

percentage of I-nodes used 115, 117

percentage of NFS server getattr operations 134, 139

percentage of NFS server read operations 135, 139

percentage of NFS server readlink operations 136, 139

percentage of NFS server write operations 136, 140

percentage of server RPC duplicate requests 132, 140


Windowsbrowser 99


EventLog 99

excessive page faults 39

excessive paging 26, 29, 39

high bytes per second 21, 69, 70, 71, 72, 73

high CPU usage 83, 86, 87, 88, 89, 90, 91

high CPU usage interrupt 86, 87, 88, 89, 90, 91

high CPU usage process 89, 90, 91

high CPU usage user privilege 91

high current commands modifier 45, 50, 51, 52, 54, 56

high errored out ratio 46, 56

high fragment ratio 102, 104

high interrupts per second 86, 87, 88, 91

high output queue length modifier 47, 57

high output queuelength modifier 48

high percent broadcast 44, 51, 52, 53

high percent bytes per second 43, 45, 47, 48, 49, 50, 51,

52, 53, 54, 55, 56, 57

high percent usage 21, 69, 70, 71, 72, 74

high percent usage delta 89, 91

high percent utilization 43, 44, 45, 49, 50, 51, 52, 53, 54,

55, 56, 57

thresholds (continued)Windows (continued)

high queue length 19, 21, 69, 70, 71, 72, 73, 74

high segments retransmitted 103, 104

high work item shortages 43, 49, 53, 55, 56, 57

job errors 76, 80

job errors per day 77, 80

LanmanServer 99

LanmanWorkstation 99

Logical Disk resource model 21

low cache hits percent 39

low disk space 21

low segments 102, 104

maximum handles 82, 83

maximum print jobs 80

maximum print queues 80

maximum processes 82, 83

memory resource model 39

minimum available bytes 39

minimum committed bytes 39

moderate DG 102, 104

Netlogon 99


not ready errors 77, 80

not ready errors per day 78, 80

NtLmSsp 100

out of paper errors 79, 80

out of paper errors per day 79, 80

percent processor 76, 80







Tivoli endpoint 100

total CPUs modifier 87, 88, 91

Tivoli command syntax xii

Tivoli endpoint threshold 100

Tivoli technical training x

TMW_Configuration 7

TMW_EventLog resource model 8

TMW_LogicalDisk resource model 15

TMW_MemoryModel resource model 24

TMW_NetworkIntCard resource model 42

TMW_ParamEventLog resource model 59

TMW_ParamPorts resource model 66

TMW_ParamServices resource model 62

TMW_PhysicalDiskModel resource model 68

TMW_PrintModel resource model 75

TMW_Process resource model 81

TMW_Processor resource model 85

TMW_Services resource model 96

TMW_Spp resource model 92, 93

TMW_TCPIP resource model 101

Too Many Jobs Queued indication 202

too many zombie processes in the system problem 148

Total Auxiliary Storage Reached Capacity indication 221


indication 222

Total Auxiliary Storage Reached Peak Guidelines

indication 220

total CPUs modifier threshold 87, 88, 91

training, Tivoli technical x

typefaceconventions used xi


Uunknown interface status indication 129

unstable services problem 96

Vvariables, notation for xi

WWindows 2000 logs parameter 62

Windows event logged indication 60

wrong file mode indication 159

Index 285

��

SH19-4570-04

IBM Tivoli Monitoring: Resource Model Reference Guide

Documents

Transcript of IBM Tivoli Monitoring: Resource Model Reference Guide