ibm tivoli netcool/omnibus generic log file probe ... january 31, ... the ibm tivoli netcool/omnibus...

IBM® Tivoli® Netcool/OMNIbus Generic Log File ProbeVersion 8.0

Reference GuideSeptember 30, 2012

SC23-6071-06

��

NoticeBefore using this information and the product it supports, read the information in “Notices and Trademarks,” on page 15.

Edition notice

This edition (SC23-6071-06) applies to version 8.0 of IBM Tivoli Netcool/OMNIbus Generic Log File Probe and to allsubsequent releases and modifications until otherwise indicated in new editions.

This edition replaces SC23-6071-05.

© Copyright IBM Corporation 2006, 2012.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

About this guide . . . . . . . . . . . vDocument control page . . . . . . . . . . . vConventions used in this guide . . . . . . . . v

IBM Tivoli Netcool/OMNIbus GenericLog File Probe . . . . . . . . . . . . 1Summary . . . . . . . . . . . . . . . 1Installing probes . . . . . . . . . . . . . 2Data acquisition . . . . . . . . . . . . . 3

Peer-to-peer failover functionality . . . . . . 3Re-reading the log file . . . . . . . . . . 4Modes of operation . . . . . . . . . . . 4Windows considerations . . . . . . . . . 4

Detecting corrupt events . . . . . . . . . 5Detecting events that contain no line separators . 5

Properties and command line options . . . . . . 5Elements. . . . . . . . . . . . . . . . 9Error messages . . . . . . . . . . . . . 10ProbeWatch messages . . . . . . . . . . . 11Known issues. . . . . . . . . . . . . . 12

Running multiple Generic Log File Probeinstances on the same Windows machine . . . 12

Appendix. Notices and Trademarks . . 15Notices . . . . . . . . . . . . . . . . 15Trademarks . . . . . . . . . . . . . . 17

© Copyright IBM Corp. 2006, 2012 iii

iv IBM Tivoli Netcool/OMNIbus Generic Log File Probe: Reference Guide

About this guide

The following sections contain important information about using this guide.

Document control pageUse this information to track changes between versions of this guide.

The IBM Tivoli Netcool/OMNIbus Generic Log File Probe documentation isprovided in softcopy format only. To obtain the most recent version, visit the IBM®

Tivoli® Information Center:

http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.tivoli.namomnibus.doc/welcome_ptsm.htm

Table 1. Document modification history

Documentversion

Publicationdate

Comments

SC23-6071-01 September 19,2007

First IBM publication.

SC23-6071-02 August 22,2008

Support for Linux for zSeries® added.

SC23-6071-03 November 14,2008

Summary table updated.

IPv6 support information added.

FIPS information added.

Installation section added.

SC23-6071-04 June 04, 2010 Summary table updated.

Installation section updated.

SC23-6071-05 January 31,2011

Installation section replaced by “Installing probes” onpage 2.

SC23-6071-06 September 30,2012

“Summary” on page 1 updated.

The following new section added: “Known issues” onpage 12.

Conventions used in this guideAll probe guides use standard conventions for operating system-dependentenvironment variables and directory paths.

Operating system-dependent variables and paths

All probe guides use standard conventions for specifying environment variablesand describing directory paths, depending on what operating systems the probe issupported on.

© Copyright IBM Corp. 2006, 2012 v



For probes supported on UNIX and Linux operating systems, probe guides use thestandard UNIX conventions such as $variable for environment variables andforward slashes (/) in directory paths. For example:

$OMNIHOME/probes

For probes supported only on Windows operating systems, probe guides use thestandard Windows conventions such as %variable% for environment variables andbackward slashes (\) in directory paths. For example:

%OMNIHOME%\probes

For probes supported on UNIX, Linux, and Windows operating systems, probeguides use the standard UNIX conventions for specifying environment variablesand describing directory paths. When using the Windows command line withthese probes, replace the UNIX conventions used in the guide with Windowsconventions. If you are using the bash shell on a Windows system, you can use theUNIX conventions.

Note: The names of environment variables are not always the same in Windowsand UNIX environments. For example, %TEMP% in Windows environments isequivalent to $TMPDIR in UNIX and Linux environments. Where such variables aredescribed in the guide, both the UNIX and Windows conventions will be used.

Operating system-specific directory names

Where Tivoli Netcool/OMNIbus files are identified as located within an archdirectory under NCHOME or OMNIHOME, arch is a variable that represents youroperating system directory. For example:

$OMNIHOME/probes/arch

The following table lists the directory names used for each operating systemcurrently supported by Netcool/OMNIbus.

Table 2. Directory names for the arch variable

Operating system Directory name represented by arch

AIX® systems aix5

HP-UX PA-RISC-based systems hpux11

HP-UX Integrity-based systems hpux11hpia

Red Hat Linux and SUSE systems linux2x86

Linux for System z® linux2s390

Solaris systems solaris2

Windows systems win32

vi IBM Tivoli Netcool/OMNIbus Generic Log File Probe: Reference Guide

IBM Tivoli Netcool/OMNIbus Generic Log File Probe

The IBM Tivoli Netcool/OMNIbus Generic Log File Probe is a multi-platformprobe that reads a flat log file and parses the values using specified value, line,and character separators. The probe creates dynamic, numbered elementsaccording to the resulting parsed data.

This guide contains the following sections:v “Summary”v “Installing probes” on page 2v “Data acquisition” on page 3v “Properties and command line options” on page 5v “Elements” on page 9v “Error messages” on page 10v “ProbeWatch messages” on page 11v “Known issues” on page 12

SummaryEach probe works in a different way to acquire event data from its source, andtherefore has specific features, default values, and changeable properties. Use thissummary information to learn about this probe.

The following table provides a summary of the IBM Tivoli Netcool/OMNIbusGeneric Log File Probe.

Table 3. Summary

Probe target Log files

Probe executable name nco_p_glf (on UNIX and Linux operating systems)

nco_p_glf.exe (on Windows operating systems)

Package version 8.0

Probe supported on For details of supported operating systems, see thefollowing Release Notices on the IBM Software Supportwebsite:

http://www-01.ibm.com/support/docview.wss?uid=swg21432728

Properties file $OMNIHOME/probes/arch/glf.props

Rules file $OMNIHOME/probes/arch/glf.rules

Requirements For details of any additional software that this proberequires, refer to the description.txt file that issupplied in its download package.

Connection method Reads an open flat file line by line.

Remote connectivity No

Licensing Electronic licensing was deprecated with the release ofIBM Tivoli Netcool V7.2.0. All IBM Tivoli Netcool V7.2.0(and later) products use the IBM software licensingprocess.

© Copyright IBM Corp. 2006, 2012 1



Table 3. Summary (continued)

Multicultural support Available

For information about configuring multiculturalsupport, including language options, see the IBM TivoliNetcool/OMNIbus Installation and Deployment Guide(SC14-7604-00).

Peer-to-peer failover functionality Available

IP environment IPv4 and IPv6Note: The probe only supports the IPv6 environmenton IBM Tivoli Netcool/OMNIbus V7.0, 7.1, and 7.2running on Solaris.

Federal Information ProcessingStandards (FIPS)

IBM Tivoli Netcool/OMNIbus V7.2.1, 7.3.0 and 7.3.1 usethe FIPS 140-2 approved cryptographic provider: IBMCrypto for C (ICC) certificate 384 for cryptography. Thiscertificate is listed on the NIST website athttp://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2004.htm For details about configuringNetcool/OMNIbus for FIPS 140-2 mode, see IBM TivoliNetcool/OMNIbus Installation and Deployment Guide(SC14-7604).

Installing probesAll probes are installed in a similar way. The process involves downloading theappropriate installation package for your operating system, installing theappropriate files for the version of Netcool/OMNIbus that you are running, andconfiguring the probe to suit your environment.

The installation process consists of the following steps:1. Downloading the installation package for the probe from the Passport

Advantage Online website.Each probe has a single installation package for each operating systemsupported. For details about how to locate and download the installationpackage for your operating system, visit the following page on the IBM TivoliInformation Center:http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_OMNIbus.doc/probes/install/wip/out-html/reference/install_download_intro.html

2. Installing the probe using the installation package.The installation package contains the appropriate files for all supportedversions of Netcool/OMNIbus. For details about how to install the probe torun with your version of Netcool/OMNIbus, visit the following page on theIBM Tivoli Information Center:http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_OMNIbus.doc/probes/install/wip/out-html/reference/install_install_intro.html

3. Configuring the probe.This guide contains details of the essential configuration required to run thisprobe. It combines topics that are common to all probes and topics that arepeculiar to this probe. For details about additional configuration that iscommon to all probes, see the IBM Tivoli Netcool/OMNIbus Probe and GatewayGuide IBM Tivoli Netcool/OMNIbus Probe and Gateway Guide (SC14-7608).

2 IBM Tivoli Netcool/OMNIbus Generic Log File Probe: Reference Guide

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2004.htm

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2004.htm

http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_OMNIbus.doc/probes/install/wip/out-html/reference/install_download_intro.html



http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_OMNIbus.doc/probes/install/wip/out-html/reference/install_install_intro.html



Data acquisitionEach probe uses a different method to acquire data. Which method the probe usesdepends on the target system from which it receives data.

The IBM Tivoli Netcool/OMNIbus Generic Log File Probe reads a log file specifiedby the LogFileName property. The probe parses the log file using theValueSeparator, LineSeparator, and QuoteCharacter properties.

The probe assigns each string separated by a ValueSeparator as $FieldVal[n],where n is an incremental value, starting at [01]. The probe also concatenates all$FieldVal[n] elements, for each event, into an element called $Details.

Note: If there is more than one instance of a delimiter in a row (two or morespaces, for example), you can set the IgnoreNullFields property to treat the extradelimiters as a single column (or name in the name-value pair).

Data acquisition is described in the following topics:v “Peer-to-peer failover functionality”v “Re-reading the log file” on page 4v “Modes of operation” on page 4v “Windows considerations” on page 4v “Detecting corrupt events” on page 5v “Detecting events that contain no line separators” on page 5

Peer-to-peer failover functionalityThe probe supports failover configurations where two probes run simultaneously.One probe acts as the master probe, sending events to the ObjectServer; the otheracts as the slave probe on standby. If the master probe fails, the slave probeactivates.

While the slave probe receives heartbeats from the master probe, it does notforward events to the ObjectServer. If the master shuts down, the slave probe stopsreceiving heartbeats from the master and any events it receives thereafter areforwarded to the ObjectServer on behalf of the master probe. When the master isrunning again, the slave continues to receive events, but no longer sends them tothe ObjectServer.

Example property file settings for peer-to-peer failover

You set the peer-to-peer failover mode in the properties files of the master andslave probes. The settings differ for a master probe and slave probe.

The following example shows the peer-to-peer settings from the properties file of amaster probe:Server : "NCOMS"RulesFile : "master_rules_file"MessageLog : "master_log_file"PeerHost : "slave_hostname"PeerPort : 5555 # [communication port between master and slave probe]Mode : "master"

The following example shows the peer-to-peer settings from the properties file ofthe corresponding slave probe:

IBM Tivoli Netcool/OMNIbus Generic Log File Probe 3

Server : "NCOMS"RulesFile : "slave_rules_file"MessageLog : "slave_log_file"PeerHost : "master_hostname"PeerPort : 5555 # [communication port between master and slave probe]Mode : "slave"

Re-reading the log fileIf a log file is overwritten while the probe is reading it, or if an inode of the file ischanged, the probe reads the log file again from the beginning.

If the log file cannot be read (for example, if permission settings are incorrect or ifthe log file is not available), the probe tries to read the log file again. The probecontinues trying to read the log file for the length of time specified by theRetryPeriod property.

Note: The RetryPeriod property is only available on UNIX operating systems.

Modes of operationThe modes of operation determine how the probe reads the log file and therecovery file on startup.

You can run the probe in one of the following modes:v Recovery - On UNIX operating systems, the probe stores recovery data in a

recovery file. When the probe starts, it references the recovery file to determinethe point within the log file from which to start reading alarms.If a recovery file is not present (for example, when the probe starts for the firsttime), the probe creates one and sets the current position in the log file; it thenreads events as they are received. If a recovery file is present, the probe replaysthe log file from the position set in the recovery file and continues to read thelog file as new events are received.To run the probe in recovery mode, set the ReplayFile and CleanStartproperties to 0 and the RecoveryFile property to $OMNIHOME/var/glf.reco. Tospecify a recovery file other than the default recovery file, use the RecoveryFileproperty.

Note: For details of how the Generic Log File Probe runs in recovery mode onWindows operating systems, see “Windows considerations.”

v Cleanstart - The probe ignores the recovery file. To run the probe in cleanstartmode, set the CleanStart property to 1 or 2. Otherwise, set this property to 0.

Note: For details of the cleanstart settings, see “Properties and command lineoptions” on page 5.

v Replay - The probe starts reading events from the beginning of the log file andthen shuts down. To run the probe in replay mode, set the ReplayFile propertyto 1. Otherwise, set this property to 0.

Windows considerationsThe Windows version of the Generic Log File Probe does not use a recovery file.Instead, the probe uses a registry key to store an offset from the beginning of thelog file. This enables the probe to return to the same place in the log file after arestart.


To use this facility, the probe must be installed as a service. To install the probe asa service, enter the following command on the Windows command line:nco_p_glf /install

Once installed as a service, the probe can be run from the console, or it can bestarted and stopped using the Windows Services dialog box. To remove the probeafter it has been installed as a service, enter the following command on theWindows command line:nco_p_glf /remove

Detecting corrupt eventsEvents can contain free format text within quotation marks. This text can containevent terminators, but the probe does not regard such terminators as the end of theevent. However, if the free format text has opening quotation marks but nocorresponding closing quotation marks, the probe is unable to identify theterminator that ends the event. Such events are regarded as corrupt.

To detect corrupt events, the probe counts the number of terminators in each event.If the number exceeds that specified by the MaxTerminators property, it indicatesthat the event is corrupt; the probe sends a ProbeWatch message to theObjectServer and shuts down.

Detecting events that contain no line separatorsThe probe creates tokens for an event until it reaches the character specified bytheLineSeparator property. The probe then starts creating tokens for the nextevent. If the event does not contain a line separator, the probe does not knowwhere the end of the event is and treats the event as corrupt.

The MaxNumTokens property allows you to specify how many tokens the probecreates for each event. If the probe has already created the maximum number oftokens for an event and the next characters do not indicate a line separator, theprobe sends a warning message to the error log file indicating that the probe hascreated more tokens than specified by the MaxNumTokens property. The messagecontains the full details of the corrupt event and allows you to trace when theerror in the log file occurred and which events were affected.

If you set the MaxNumTokens property to 0, the probe does not send a warningmessage to the error log file if an event contains too many tokens.

Properties and command line optionsYou use properties to specify how the probe interacts with the device. You canoverride the default values by using the properties file or the command lineoptions.

The following table describes the properties and command line options specific tothis probe. For information about default properties and command line options, seethe IBM Tivoli Netcool/OMNIbus Probe and Gateway Guide, (SC23-6373).


Table 4. Properties and command line options

Property name Command line option Description

CleanStart integer -cleanstart integer Use this property to specify whetherthe probe runs in cleanstart mode. Incleanstart mode, the probe ignores therecovery file and starts reading eventscreated after the probe started. Thisproperty takes the following values:

0: The probe does not run in cleanstartmode.

1: The probe runs in cleanstart mode.

2: The probe reads the log file from thebeginning, then waits for new alarms.

The default is 0.

IgnoreNullFieldsinteger

-ignorenullfieldsinteger

Use this property to specify whetherthe probe ignores more than oneinstance of a delimiter in a row. Thisproperty takes the following values:

0: The probe treats extra delimiters asseparate columns.

1: The probe ignores extra delimiters.

The default is 1.

LineSeparator string -lineseparator string Use this property to specify the stringthat indicates the end of a line withinthe data stream. This property takesthe following values:

\r: The end of the line is marked by asingle carriage return.

\r\r: The end of the line is marked bya double carriage return.

^M: The end of the line is marked by aDOS line feed.

\n: The end of the line is marked by anew line.

The default is \n.

Note: All data that the probeencounters prior to receiving this codeis considered to be contained within asingle line.

LogFileName string -logfile string Use this property to specify the path tothe log file from which the probe readsalarm data.

The default is "".


Table 4. Properties and command line options (continued)


MaxBufferSize integer -maxbuffersize integer Use this property to specify themaximum buffer size (in bytes) that theprobe allows for a single event. If thissize is exceeded, the probe discards thebuffer and adds an $Overflow token tothe next valid event.

The default is 4098.

MaxNumTokens integer -maxnumtokens integer Use this property to specify themaximum number of tokens that theprobe creates for a single event beforesending a warning message to the logfile.

The default is 0 (the probe does notsend a warning message to the errorlog file if an event contains too manytokens).

MaxTerminators integer -maxterminators integer Use this property to specify themaximum number of terminators thatare allowed in a single event.

The default is 2.

QuoteCharacter integer -quotecharacter integer Use this property to specify the ASCIIcode for the quotation character. Theprobe processes directly all event datathat appears between quotationcharacters without attempting tointerpret it. This property takes thefollowing values:

34: The ASCII code for a doublequotation mark (").

39: The ASCII code for a singlequotation mark (').

The default is 34.

Note: If you set this property to 0, theprobe does not recognize quotationcharacters.

RecoveryFile string -recoveryfile string Use this property to specify the nameof the recovery file to which the probewrites recovery data.

The default is $OMNIHOME/var/glf.reco.

Note: This property is only valid onUNIX operating systems.




ReplayFile integer -replay (This isequivalent to Replaywith a value of 1.)

Use this property to specify whetherthe probe replays the log file. Thisproperty takes the following values:

0: The probe does not replay the logfile.

1: The probe replays the log file fromthe beginning and then shuts down.

The default is 0.

RetryPeriod integer -retryperiod integer Use this property to specify the period(in seconds) during which the probeattempts to retry reading the log file.

The default is 60.

Note: This property is only availableon UNIX operating systems. OnWindows operating systems, the probewaits for one minute before trying toopen the log file again. The probe thentries to reopen the file at one minuteintervals, up to five times, after whichit sends a ProbeWatch message to theObjectServer and shuts down.

StripCharacter string -stripcharacter string Use this property to specify thecharacters that should be stripped outof the data stream to remove carriagereturns. For example, if the probeaccepts events from both UNIX andWindows sources, set this property to\r.

The default is \.

Note: The probe only uses thisproperty if the StripCharacterFormatproperty is set to a value greater than0. The value of theStripCharacterFormat propertydetermines whether the probe stripsthis character from the token value orreplaces it with spaces.




StripCharacterFormatinteger

-stripcharacterformatinteger

Use this property to specify how theprobe handles strip characters. Thisproperty takes the following values:

0: The probe does not remove stripcharacters from the token.

1: The probe removes strip charactersfrom the start and the end of the token.

2: The probe removes all stripcharacters from the token.

3: The probe removes strip charactersfrom the token and replaces them withspaces.

The default is 0.

ValueSeparator string -valueseparator string Use this property to specify the stringthat indicates the separator for theindividual values in a line of the logfile. This property takes the followingvalues:

" ": The values are separated bywhitespace.

\t: The values are separated by a tab.

: The values are separated by a colon.

The default is " " (whitespace).

ElementsThe probe breaks event data down into tokens and parses them into elements.Elements are used to assign values to ObjectServer fields; the field values containthe event details in a form that the ObjectServer understands.

The following table describes the elements that the IBM Tivoli Netcool/OMNIbusGeneric Log File Probe generates. Not all the elements described are generated foreach event; the elements that the probe generates depends upon the event type.

Table 5. Elements

Element name Element description

$Details This element contains a concatenation of all$FieldVal[n] elements for each event.

$FieldVal[n] The probe derives these elements by parsing thelog file. [n] is the element number from thebeginning of the line. [n] starts at 01.


Table 5. Elements (continued)

Element name Element description

$Overflow This element indicates whether the previousevent was discarded due to a buffer overflow.This enables a partial alarm to be processed thatmay not conform to the expected alarm format;for example, one that follows an alarm containingopening quotation marks but no closingquotation marks.

Error messagesError messages provide information about problems that occur while running theprobe. You can use the information that they contain to resolve such problems.

The following table describes the error messages specific to this probe. Forinformation about generic error messages, see the IBM Tivoli Netcool/OMNIbusProbe and Gateway Guide, (SC23-6373).

Table 6. Error messages

Error Description Action

Corrupted record file,proceeding withcleanstart

The probe could not read therecovery file, so it runs incleanstart mode.

Check for problems with thefile system where therecovery file is stored andverify that the permissionsallow the probe access.

Failed to inform ProcessAgent of status -aborting

The probe did not receive aresponse from the processagent.

Check that the process agentis running.

Failed to install SIGQUIThandler

Failed to install SIGINThandler

Failed to install SIGTERMhandler

The probe was unable toinstall a signal handler foreither a QUIT, INT, or TERMsignal. The probe tries tocontinue but any furthersignal handling results in anerror on exit.

Contact IBM SoftwareSupport.

Failed to set property:property

The probe was unable to startbecause the indicatedproperty contains an incorrectvalue.

Check the value of theproperty indicated in theerror message.

Illegal escape sequencereason

A parsing parameter containsan illegal escape sequence.This caused the probe to shutdown.

Ensure that the log filecontains only the followingescape sequences:

v \n

v \t

v \b

v \r

v \f

v \v

v \’

v \"

v ^


Table 6. Error messages (continued)

Error Description Action

Illegal value for quotecharacter hexadecimalcharacter code

An illegal character has beenspecified for the quotationcharacter. Characters must bevalid ASCII characters (valuesbetween 0 and 0127).

Ensure that theQuoteCharacter propertycontains a valid ASCIIcharacter.

Invalid value forStripCharacterFormat.Setting to 0

An invalid value has beenspecified for theStripCharacterFormatproperty.

Change the value specifiedfor the StripCharacterFormatproperty.

Log file disappeared:reopening

Inode changed: reopening

Log file truncated:reopening

The probe could not use thelog file.

Verify that the log file existsand that the permissionsallow the probe access.

Unable to get events Event processing has failed. Check the connection to theObjectServer.

Unable to write recordfile. This may cause dataloss between two restartsof the probe.

The probe was unable to openthe recovery file.

Check that the recovery filehas the correct permissionsand that there is sufficientdisk space. Then check theproperties and command lineoptions.

ProbeWatch messagesDuring normal operations, the probe generates ProbeWatch messages and sendsthem to the ObjectServer. These messages tell the ObjectServer how the probe isrunning.

The following table describes the raw ProbeWatch error messages that the probegenerates. For information about generic ProbeWatch messages, see the IBM TivoliNetcool/OMNIbus Probe and Gateway Guide, (SC23-6373).

Table 7. ProbeWatch messages

ProbeWatch message Description Triggers or causes

Inode changed: reopening The probe has detected achange in the inode numberof the log file, so it isreopening the file.

The log file has been updated.This ProbeWatch message isgenerated on UNIX operatingsystems only.

Log file truncated:reopening

The probe detected that thesize of the log file decreased,so it is reopening the file.

The log file has decreased insize. This ProbeWatchmessage is generated onUNIX operating systems only.

Log file disappeared:reopening

The probe has an invalid filehandle and can no longerdetect the log file.

The log file can no longer bedetected by the probe. ThisProbeWatch message isgenerated on UNIX operatingsystems only.


Table 7. ProbeWatch messages (continued)

ProbeWatch message Description Triggers or causes

Failed to close/reopenfile to release lock

The probe could not reopenthe log file to release the lock.

The probe has failed to closeand reopen the log file torelease the lock.

Reopened file to releaselock

The probe closed andreopened the log file torelease the lock.

The probe closed andreopened the log file torelease the lock.

Maximum number ofterminators (number)within event has beenexceeded

The log file contained anevent that contained openingquotation marks but nocorresponding closingquotation marks.

The probe parsed an eventthat did not contain a closingquotation mark.

MaxBufferSize exceeded The event exceeded themaximum buffer size.

The probe used the wholeevent buffer before reachingthe event terminator.

Corrupted recovery file,proceeding withcleanstart

The probe could not read therecovery file, so it runs incleanstart mode.

The data in the recovery filewas unrecognizable.

Unable to write torecovery file. This maycause dataloss when theprobe is restarted

The probe failed to writerecovery information to therecovery file.

The probe found corrupt datain the recovery file.

Going Down The probe is shutting down. The probe is performing theshutdown routine andshutting down.

Running ... The probe is runningnormally.

The probe has just started up.

Unable to get events A problem occurred whiletrying to listen for traps.

Either there was a probleminitializing the connection dueto insufficient memory or, ifthis message was sent aftersome events had been parsed,there was a license failure ora connection failure.

Known issuesAt the time of release, there is known issue that you should be aware of whenrunning the probe.

This section covers the following known issue:v “Running multiple Generic Log File Probe instances on the same Windows

machine”

Running multiple Generic Log File Probe instances on thesame Windows machine

There is a known issue when running multiple Generic Log File Probe instances onthe same Windows machine.


All the probe instances attempt to access the same piece of information from thegeneric probe registry. This conflicts with each probe's own value for the samerecovery position.

To avoid this issue, when running multiple probe instances on a single Windowsmachine, you should use the Services console to start the multiple instances of theprobe. To run multiple instances of the probe, use the following steps:1. Install the probe as a service using the following command setting the

mandatory arguments shown:%OMNIHOME%\probes\win32\nco_p_glf.exe /INSTALL /INSTANCE instance_ID/CMDLINE "-name probe_name"

Where:v instance_ID specifies the unique instance ID of the probe.v probe_name specifies the unique set name for the .log, .props, and .rules files.

2. Start all the installed probe service instances.


Appendix. Notices and Trademarks

This appendix contains the following sections:v Noticesv Trademarks

NoticesThis information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not grant youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBMIntellectual Property Department in your country or send inquiries, in writing, to:

IBM World Trade Asia CorporationLicensing 2-31 Roppongi 3-chome, Minato-kuTokyo 106-0032, Japan

The following paragraph does not apply to the United Kingdom or any othercountry where such provisions are inconsistent with local law:INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express orimplied warranties in certain transactions, therefore, this statement may not applyto you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

© Copyright IBM Corp. 2006, 2012 15

Any references in this information to non-IBM Web sites are provided forconvenience only and do not in any manner serve as an endorsement of those Websites. The materials at those Web sites are not part of the materials for this IBMproduct and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who want to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM CorporationSoftware Interoperability Coordinator, Department 49XA3605 Highway 52 NRochester, MN 55901U.S.A.

Such information may be available, subject to appropriate terms and conditions,including in some cases, payment of a fee.

The licensed program described in this information and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement, or any equivalent agreementbetween us.

Any performance data contained herein was determined in a controlledenvironment. Therefore, the results obtained in other operating environments mayvary significantly. Some measurements may have been made on development-levelsystems and there is no guarantee that these measurements will be the same ongenerally available systems. Furthermore, some measurements may have beenestimated through extrapolation. Actual results may vary. Users of this documentshould verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.

All statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subjectto change without notice. Dealer prices may vary.

This information is for planning purposes only. The information herein is subject tochange before the products described become available.

This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to the names and addresses used by an actual businessenterprise is entirely coincidental.


COPYRIGHT LICENSE:

This information contains sample application programs in source language, whichillustrate programming techniques on various operating platforms. You may copy,modify, and distribute these sample programs in any form without payment toIBM, for the purposes of developing, using, marketing or distributing applicationprograms conforming to the application programming interface for the operatingplatform for which the sample programs are written. These examples have notbeen thoroughly tested under all conditions. IBM, therefore, cannot guarantee orimply reliability, serviceability, or function of these programs.

Each copy or any portion of these sample programs or any derivative work, mustinclude a copyright notice as follows:

© (your company name) (year). Portions of this code are derived from IBM Corp.Sample Programs. © Copyright IBM Corp. _enter the year or years_. All rightsreserved.

If you are viewing this information softcopy, the photographs and colorillustrations may not appear.

TrademarksIBM, the IBM logo, ibm.com, AIX, Tivoli, zSeries, and Netcool are trademarks ofInternational Business Machines Corporation in the United States, other countries,or both.

Adobe, Acrobat, Portable Document Format (PDF), PostScript, and all Adobe-basedtrademarks are either registered trademarks or trademarks of Adobe SystemsIncorporated in the United States, other countries, or both.

Intel, Intel Inside (logos), MMX, and Pentium are trademarks of Intel Corporationin the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks ofMicrosoft Corporation in the United States, other countries, or both.

Java™ and all Java-based trademarks are trademarks of Sun Microsystems, Inc. inthe United States, other countries, or both.

Linux is a trademark of Linus Torvalds in the United States, other countries, orboth.

UNIX is a registered trademark of The Open Group in the United States and othercountries.

Appendix. Notices and Trademarks 17

��

Printed in USA

SC23-6071-06

ibm tivoli netcool/omnibus generic log file probe ... january 31, ... the ibm tivoli netcool/omnibus...

Documents