The IBM Tivoli Monitoring: UNIX Log Agent predefined situations describe system conditions that you want to monitor at your site. Use these situations to begin monitoring any managed object quickly, or as models for customizing your own situations. In some cases, the values assigned to the predefined situations are examples only and should be modified to reflect the conditions of your distributed system.
The names, descriptions, logic, and threshold values for the situations follow.
HACMP_acquire_service_addr configures boot address to the corresponding service address and starts TCP/IP servers and network daemons by running the telnet -a command. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ acquire_service_addr
HACMP_acquire_takeover_addr acquires takeover IP address by checking configured standby addresses and swapping them with failed service addresses. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ acquire_takeover_addr
HACMP_config_too_long sends a periodic console message when a node has been in reconfiguration for more than six minutes. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ config_too_long
HACMP_event_error occurs when an HACMP event script fails for some reason. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ event_error
HACMP_fall_standby sends a console message when a standby adapter fails or is no longer available because it has been used to take over the IP address of another adapter. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ fail_standby
HACMP_get_disk_vg_fs acquires disk, volume group and file system resources as part of takeover. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ get_disk_vg_fs
HACMP_join_standby sends a console message when a standby adapter becomes available. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ join_standby
HACMP_network_down occurs when the cluster determines that a network has failed. The event script provided takes no default action, because the appropriate action will be site or LAN specific. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ network_down
HACMP_network_down_complete occurs only after a network_down event has successfully completed. The event script provided takes no default action, because the appropriate action will be site or LAN specific. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ network_down_complete
HACMP_network_up occurs when the cluster determines that a network has become available. The event script provided takes no default action, bvecause the appropriate action will be site or LAN specific. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ network_up
HACMP_network_up_complete occurs only after a network_up_event has successfully completed. The event script provided takes no default action, because the appropriate action will be site or LAN specific. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ network_up_complete
HACMP_node_down occurs when a node is detaching from the cluster, either voluntarily or due to a failure. Depending on whether the node is local or remote, either the node_down_local or node_down_remote subevent is called. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ node_down
HACMP_node_down_complete occurs only after a node_down event has successfully completed. Depending on whether the node is local or remote, either the node_down_local or node_down_remote_complete subevent is called. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ node_down_complete
HACMP_node_down_local releases resources taken from a remote node, stops application servers, releases a service address taken from a remote node, releases concurrent volume groups, unmounts file systems, and reconfigures the node to its boot address. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_down_local
HACMP_node_down_local_complete instructs the cluster manager to exit when the local node has completed detaching from the cluster. This event occurs only after a node_down_local event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_down_local_complete
HACMP_node_down_remote unmounts any NFS file systems and places a concurrent volume group in nonconcurrent mode when the local node is the only surviving node in the cluster. If the failed node did not go down gracefully, acquires a failed nodes resources: file systems, volume groups, and disks and service address. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_down_remote
HACMP_node_down_rmt_complete starts takeover application servers if the remote node did not go down gracefully. This event occurs only after node_down_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_down_remote_complete
HACMP_node_up occurs when a node is joining the cluster. Depending on whether the node is local or remote, either the node_up_local or node_up_remote subevent is called. This event occurs only after node_down_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ node_up
HACMP_node_up_complete occurs only after a node_up has successfully completed. Depending on whether the node is local or remote, either node_up_local_complete or node_up_remote_complete subevent is called. This event occurs only after node_down_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_up_complete
HACMP_node_up_local when the local node attaches to the cluster, the HACMP_node_up_local situation acquires the services address, clears the application server file, acquires file systems, volume groups and disk resources, exports file systems and either activitaes concurrent volume groups or puts them into concurrent mode depending upon the status of the remote nodes(s). This event occurs only after node_down_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_up_local
HACMP_node_up_local_complete starts application servers and then checks to see if an inactive takeover is needed. This event only occurs after node_up_local event has successfully completed.This event occurs only after node_down_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_up_local_complete
HACMP_node_up_remote causes the local node to do an NFS mount only after the remote node and to place the concurrent volume groups into concurrent mode. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_up_remote
HACMP_node_up_remote_complete allows the local node to do an NFS mount only after the remote node is completely up. This event occurs only after a node_up_remote event has successfully completed. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ node_up_remote_complete
HACMP_release_service_addr detaches the service address and reconfigures to the boot address. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ release_service_addr
HACMP_release_takeover_addr identifies a takeover address to be released because a standby adapter on the local node is masquerading as the service address of the remote node. Reconfigures the local standby into its original role. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ release_takeover_addr
HACMP_release_vg_fs releases volume groups and file systems that the local node took from the remote node. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ release_vg_fs
HACMP_start_server starts application servers. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ start_server
HACMP_stop_server stops application servers. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log*AND *SCAN Log_Entries.Description *EQ stop_server
HACMP_swap_adapter exchanges or swaps the IP addresses of two network interface. NIS and name serving are temporarily turned off during the event. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ swap_adapter
HACMP_swap_adapter_complete occurs only after a swap_adapter event has successfully completed. Ensures that the local ARP cache is updated by deleting entries and pinging cluster IP addresses. This situation is not activated at startup. This situation has the following formula:
*IF *SCAN Log_Entries.Log_Name *EQ cluster.log *AND *SCAN Log_Entries.Description *EQ swap_adapter_complete
UNIX_LAA_Bad_su_to_root_Warning raises an alert if a logon failure to root message is written to usr/adm/suaudit more than three times within a minute.
Log_Entries.Log_Path EQ /usr/adm/
AND
Log_Entries.Log_Name EQ suaudit
AND
*SCAN Log_Entries.Description EQ 'Badsu'
AND
*SCAN Log_Entries.Description EQ 'to root'
AND
Log_Entries.Frequency_Threshold GT 3
AND
Log_Entries.Period_Threshold EQ 60
UNIX_LAA_Log_Size_Warning raises an alert if the size of any monitored log exceeds 10 Mbytes.
Monitored_Logs.Size GT 10485760
See also:
Attribute Groups Used by
Predefined Workspaces
Organization of the Predefined Workspaces