TBSM Multiple Event Identifiers

Introduction

The official documentation doesn't say much about multiple event identifiers.

http://www-01.ibm.com/support/knowledgecenter/SSSPFK_6.1.1.3/com.ibm.tivoli.itbsm.doc/ServiceConfigurationGuide/bsmu_srvt_edit_id_fields.html

http://www-01.ibm.com/support/knowledgecenter/SSSPFK_6.1.1.3/com.ibm.tivoli.itbsm.doc/ServiceConfigurationGuide/bsmu_isrt_create_good_marg_bad_rules.html
http://www-01.ibm.com/support/knowledgecenter/SSSPFK_6.1.1.3/com.ibm.tivoli.itbsm.doc/customization/bsms_dlkc_id_rules.html

So let’s do a quick summary of what we can:

- we can set multiple event identifiers in incoming status rule

- we can set multiple event identifiers in EventIdentifiersRules.xml or any artifact of category eventidentifiers in XMLtoolkit

But how to make sure they would match and do know they do match?

Solution

Multiple event identifiers in Incoming status rules are logically associated like there was logical AND operator between them:

So this definition of CAM_FailedRequestsStatusRule_TDW rule should be understood: all rows returned  by CAM_RRT_SubTrans_DataFetcher will affect my service if data returned in the following fields has the following values:

APPLICATION=MyApp AND

SUBTRANSACTION=MySubTrans AND

TRANSACTIONS=MyTrans

Same time, if I have multiple values for same label, it means OR.

For incoming status rule like:

So my instance expects that CAM_BSM_Identity_OMNI rule can catch all events with two alternative BSM_Identity values:

- MyApp#t#MyTrans#s#MySubTrans OR

- MySubTrans(5D21DD108FD43941892543AA0872D0EA)-cdm:process.Activity

If we're looking at EventIdentifierRules.xml, there's a concept of policies and rules, for example:

    <Policy name="ITM6.x">

        <Rule name="ManagedSystemName">

            <Token keyword="ATTR" value="cdm:ManagedSystemName"/>

        </Rule>

    </Policy>

    <Mapping policy="ITM6.x" class="%" />

You can have many policies mapped on many classes (which can be mapped on many templates) and you can have many rules within every policy.

In our case, for ITCAM Tx subtransactions class we have one policy with many rules:

                        <Policy name="CAM_SubTransaction_Activity">

                                    <Rule name="CAM_GetBSM_Identity">

                                                <Token keyword="ATTR" value="cdm:ActivityName" />

                                                <condition operator='like' value='%#s#%' />

                                    </Rule>

                                    <Rule name="CAM_GetApplicationName" field="APPLICATION">

                                                <Relationship relationship='cdm:uses'

                                                            relationshipSource='cdm:process.Activity'>

                                                            <Relationship relationship='cdm:federates'

                                                                        relationshipSource='cdm:process.BusinessProcess'>

                                                                        <Token keyword="ATTR" value="cdm:ActivityName" />

                                                            </Relationship>

                                                </Relationship>

                                    </Rule>

                                    <Rule name="CAM_GetTransactionName" field="TRANSACTIONS">

                                                <Relationship relationship='cdm:uses'

                                                            relationshipSource='cdm:process.Activity'>

                                                            <Token keyword="ATTR" value="cdm:Label" />

                                                </Relationship>

                                    </Rule>

                                    <Rule name="CAM_GetSubTransactionName" field="SUBTRANSACTION">

                                                <Token keyword="ATTR" value="cdm:Label" />

                                                <condition operator='like' value='%#s#%' />

                                    </Rule>

                        </Policy>

and one mapping of that policy on a class:

<Mapping policy="CAM_SubTransaction_Activity" class="cdm:process.Activity" />

But one class has many policies mapped on them:

<Mapping policy="CAM_Transaction_Activity" class="cdm:process.Activity" />

<Mapping policy="CAM_SubTransaction_Activity" class="cdm:process.Activity" />

<Mapping policy="CAM_TT_Object" class="%" />

Means, every mapping of a policy on a class is like element of logical OR operation. And every rule is a logical element of logical AND operation with other rules within same policy.

It is all conditional, because here comes additional aspect of field parameter of <Rule> tag.

The field parameter.

The field parameter in rule in policy in EventIdentifier enables that rule will be used only in case of having such field with such a name also in Incoming status rule specified as service instance name field.

So there's no AND operator between those rules in policy in EventIdentifierRules.xml which haven't been specified in Incoming Status Rule in template.

On another hand, there won't be any value assigned to service instance name fields selected in Incoming Status Rule in Template A if corresponding fields haven't been configured in rules of policies mapped on class (mapped on Template A in CDM_TO_TBSM4x_MAP_Templates.xml) in EventIdentifierRules.xml/

Conclusion

You need two places to go to and configure your event identifiers:

a)     Templates and incoming status rules / numerical rules / text rules – Service Instance Name Fields

b)     XMLtoolkit artifact EventIdentifierRules.xml (or any custom artifact from category eventidentifiers) – field parameters in rules defined within policies

Additionally, don’t forget: your policies defined in eventidentifiers artifacts must be mapped on CDM or custom classes that have mapping definition stored in CDM_TO_TBSM4x_MAP_Templates.xml and map on the same template that has the incoming status rule (numerical/text rule) you want with the Service Instance Name fields you want.

Otherwise your events or KPIs fetcher in fetchers won’t affect your service tree elements and you will not be showing correct status or availability on dashboards and your outage reports will also miss data and will generate false monthly results!

TBSM Event Identifiers - default BSM_Identity vs custom ones.

This is going to be a technical post.
TBSM is still quite powerful tool to track your service components availability and calculate your service outage durations and report on them.
One of the key elements to make it all happen is mapping events or KPIs on the service tree items.
There's a default mechanism for that, or rather a field called BSM_Identity.
I have made a finding that I wanted to share with you. It's not documented too well in the official documentation.
In short: BSM_Identity is event identifier. Name of field in event or SELECT statement that is expected to contain a value that will identify one and just one service instance in TBSM service tree. You can have one or more event identifiers (sometimes you need more same time in order to achieve uniqueness) and they can have other names than BSM_Identity, but BSM_Identity is the one which is default, as stated here:
http://www-01.ibm.com/support/knowledgecenter/SSSPFK_6.1.1.3/com.ibm.tivoli.itbsm.doc/customization/bsms_dlkc_id_rules.html
But how does it work in real life?
We do have to specify name of event identifiers in Incoming Status Rules. We basically can choose from all existing fields in alerts.status in case of ObjectServer being the data feed or all fields returned in SQL SELECT in a data fetcher or all fields returned via policy fetcher. There are no defaults. We have to choose one or more fields.
On another hand, if we integrate with TADDM or CMDBs via SCR API, we don't have to specify any name of a field in eventidentifiers artifacts if we don't want to. In such a case, by default their names will be BSM_Identity.
It means if we want to work with defaults, we can only achieve it if we ensure that we're:
a) adding BSM_Identity field to alerts.status table in ObjectServer,
b) using BSM_Identity alias SQL SELECT statements in data fetchers
c) using BSM_Identity as label in Impact DSA used in policy fetchers
Simple? ;)
I can post more examples if people are interested in it.