ibm tivoli monitoringpublib.boulder.ibm.com/tividd/td/itm/sh19-4570-01/en_us/...contents preface...
TRANSCRIPT
IBM Tivoli®
MonitoringResource Model ReferenceVersion 5.1.1 SH19-4570-01
���
IBM Tivoli®
MonitoringResource Model ReferenceVersion 5.1.1 SH19-4570-01
���
Tivoli Monitoring Resource Model Reference, Version 5.1.1
Copyright Notice
© Copyright IBM Corporation 1999, 2002. All rights reserved. May only be used pursuant to a Tivoli SystemsSoftware License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBMCustomer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, storedin a retrieval system, or translated into any computer language, in any form or by any means, electronic,mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBMCorporation. IBM Corporation grants you limited permission to make hardcopy or other reproductions of anymachine-readable documentation for your own use, provided that each such reproduction shall carry the IBMCorporation copyright notice. No other rights under copyright are granted without prior written permission ofIBM Corporation. The document is not intended for production and is furnished “as is” without warranty of anykind. All warranties on this document are hereby disclaimed, including the warranties of merchantabilityand fitness for a particular purpose.
U.S. Government Users Restricted Rights—Use, duplication or disclosure restricted by GSA ADP ScheduleContract with IBM Corporation.
Trademarks
IBM, Tivoli, the Tivoli logo, AIX, OS/390, S/390, OS/400, AS/400, iSeries, Tivoli Enterprise, Tivoli EnterpriseConsole, and TME 10 are trademarks or registered trademarks of International Business Machines Corporation orTivoli Systems Inc. in the United States, other countries, or both.
Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the United States, othercountries, or both.
UNIX is a registered trademark of The Open Group in the United States and other countries.
Java and all Java-based trademarks and logos are trademarks or registered trademarks of SunMicrosystems, Inc. in the United States and other countries.
Other company, product, and service names may be trademarks or service marks of others.
NoticesReferences in this publication to Tivoli Systems or IBM products, programs, or services do not imply that theywill be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products,programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or servicescan be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM,any functionally equivalent product, program, or service can be used instead of the referenced product, program,or service. The evaluation and verification of operation in conjunction with other products, except those expresslydesignated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patentsor pending patent applications covering subject matter in this document. The furnishing of this document doesnot give you any license to these patents. You can send license inquiries, in writing, to the IBM Director ofLicensing, IBM Corporation, North Castle Drive, Armonk, New York 10504-1785, U.S.A.
ISO 9001 Certification
This product was developed using an ISO 9001 certified quality system.
Certification has been awarded by Bureau Veritas Quality International (BVQI) (Certification No.BVQI - 92086 / A).
BVQI is a world leader in quality certification and is currently recognized by more than 20accreditation bodies.
Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviiWho Should Read This Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
What is New in this Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
What This Reference Contains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
Publications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx
IBM Tivoli Monitoring Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx
Prerequisite and Related Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Accessing Publications Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Ordering Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Providing Feedback about Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Contacting Customer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Typeface Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Operating System-dependent Variables and Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii
Part I. Resource Models for Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Chapter 1. Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 2011. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 2511. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 3013. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Event ID 7023. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Indication Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 2. Logical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
High Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
High Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
iiiIBM Tivoli Monitoring Resource Model Reference
High Transfer Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
High Percentage Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Logical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Slow Logical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Chapter 3. Memory Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Low Available Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Low Available Memory Causing Hard Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Low Available Memory Causing Soft Paging and Pagefile Resizing . . . . . . . . . . . . . . . . . . . . . 29
Low Available Memory Is Causing Excessive Soft Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Low Available Memory Causing Many Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Low Available Memory with High Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Low Available Memory with a High Working Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Low Available Memory with a Small Pagefile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Low Copy Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Low Data Map Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Low MDL Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Low Pin Read Hits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Pagefile Is Resizing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Memory Leak In Private Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Memory Leak In System Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Memory Leak In System Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Chapter 4. Network Interface Card Resource Model . . . . . . . . . . . . . . . . . . . . . 45Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Adjust Work Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
High Broadcast Frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
High Current Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
High Errored Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
iv Version 5.1.1
Network Interface Card Overworked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Network Interface Card Too Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Redirector Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Redirector Overloaded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Redirector Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Segment Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Segment Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Server Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Server Overloaded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Server Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Chapter 5. Parametric Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . 67Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Windows Event Logged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Chapter 6. Parametric Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 71Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Chapter 7. Parametric TCP/IP Ports Resource Model . . . . . . . . . . . . . . . . . . . . 75Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
State of the Defined Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Chapter 8. Physical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
vIBM Tivoli Monitoring Resource Model Reference
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
High Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
High Transfer Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
High Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Physical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Slow Physical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Chapter 9. Printer Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
High Current Percent Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
High Job Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
High Job Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
High Not Ready Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
High Not Ready Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
High Out Of Paper Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
High Out Of Paper Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Chapter 10. Process Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Process Handle Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Process High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Chapter 11. Processor Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Busy Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
CPU Cannot Keep up with Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Hardware Keeping CPU Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
High Percent Usage Delta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
vi Version 5.1.1
High Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Processor Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Chapter 12. Server Performance Prediction Resource Model . . . . . . . . . . 115Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Chapter 13. Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Chapter 14. TCP/IP Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
High Fragment Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
High Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Segments ReXmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Part II. Resource Models for UNIX/Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Chapter 15. CPU Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
High CPU Overload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
High CPU Usage by System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
viiIBM Tivoli Monitoring Resource Model Reference
||
||
Chapter 16. File Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
File Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
File Attributes Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
File not Present . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Chapter 17. File System Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Low Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Low Percent Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Fragmented File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Low Percentage of Available I-nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Chapter 18. Memory Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Low Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Low Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
System Thrashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Chapter 19. Network Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 159Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
High Input Packets in Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
High Output Packets in Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
High Percentage Packet Collisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
viii Version 5.1.1
||
||
||
||
||
Interface Not Enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Interface Not Operational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Unknown Interface Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Chapter 20. Network RPC-NFS Resource Model . . . . . . . . . . . . . . . . . . . . . . . . 169Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
High NFS Buffer Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
High NFS Server Get-attribute Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
High NFS Server Read Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
High NFS Server Readlink Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
High NFS Server Write Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
High Duplicate RPC Server Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
High Retransmitted Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
High RPC Bad Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
High Timeouts and Badxids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
High Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Slow Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Chapter 21. Process Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
High Number of Zombie Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Process Consuming High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Process Killed or Nonexistent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Process Stopped . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Chapter 22. Security Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
ixIBM Tivoli Monitoring Resource Model Reference
||
||
Duplicate Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Nonexistent File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
High Log-in Number for User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Illegal Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Illegal Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Account not Valid for Root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Null Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Suspect Supergroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Suspect Superuser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Wrong File Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Chapter 23. Server Performance Prediction Resource Model . . . . . . . . . . 201Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Part III. Resource Models for OS/400 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Chapter 24. ASP Disk Mirroring Resource Model . . . . . . . . . . . . . . . . . . . . . . . 209Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Mirroring not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Chapter 25. ASP Utilization Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
ASP Nearing Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
ASP Overflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Chapter 26. Basic CPU Utilization Resource Model. . . . . . . . . . . . . . . . . . . . . 217Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Basic CPU Utilization Peak Long Running Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
x Version 5.1.1
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Basic CPU Utilization Guideline Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Basic CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Basic CPU Utilization Peak Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Chapter 27. Basic Interactive CPU Utilization Resource Model . . . . . . . . 223Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Basic Interactive CPU Utilization Peak Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . 224
Basic Interactive CPU Utilization Guideline Long Running Exceeded. . . . . . . . . . . . . . . . . . . 224
Basic Interactive CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Basic Interactive CPU Utilization Peak Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Chapter 28. Configuration Objects Resource Model . . . . . . . . . . . . . . . . . . . . 229Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Configuration Object Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Chapter 29. Database CPU Utilization Resource Model. . . . . . . . . . . . . . . . . 231Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Database CPU Utilization Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Chapter 30. Distribution Queues Resource Model . . . . . . . . . . . . . . . . . . . . . . 233Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Normal Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
High Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Chapter 31. History Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
List Of Jobs Not Empty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Chapter 32. Interactive Feature CPU Utilization Resource Model . . . . . . 237
xiIBM Tivoli Monitoring Resource Model Reference
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Interactive Feature CPU Utilization Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Chapter 33. Job Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Job Log Warning Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Chapter 34. Job Queue Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Too Many Jobs Queued . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Job Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Job Queue Not Assigned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Chapter 35. Job Status Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Job Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Chapter 36. Management Central Events Resource Model . . . . . . . . . . . . . 249Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Management Central Unknown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Critical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Harmless. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Chapter 37. Network Attributes Resource Model. . . . . . . . . . . . . . . . . . . . . . . . 253Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Network Attributes Mismatch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Chapter 38. Output Queues Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
xii Version 5.1.1
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
No Writers Started For Output Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Output Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Chapter 39. Parametric Object and File Resource Model . . . . . . . . . . . . . . . 257Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Object Owner Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Last Changed Date Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Object Size Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Chapter 40. Storage Pools Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Chapter 41. Subsystem Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Subsystem Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Chapter 42. System Disk Resources Resource Model . . . . . . . . . . . . . . . . . . 265Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Total Auxiliary Storage Reached Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 266
System ASP Used Near Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Total Auxiliary Storage Reached Capacity Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Chapter 43. System Value Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
System Object Mismatch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Chapter 44. TCP Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
xiiiIBM Tivoli Monitoring Resource Model Reference
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
TCP Interface Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Chapter 45. TCP Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
TCP Service Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Part IV. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Appendix A. Return Codes for Built-in Actions (Windows). . . . . . . . . . . . . 277All Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Built-in Actions of the Event Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Enlarge IRP Stack Size Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Delete Registry Action. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Raise Session Time Out Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Built-in Actions of the Network Interface Card Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Adjust Initial Work Items Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Adjust Maximum Work Items Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Built-in Actions of the Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Restart Service Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Appendix B. Correlated Events (Windows) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281Busy Drive from High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Busy Drive from Low Avail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Congested TCP Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Critically Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Critical Memory Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Faulty Disk Subsystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
High Disk Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
High Disk Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
High Drive Transfer Rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Possible Disk Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Process Hogging CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
xiv Version 5.1.1
||
||
||
||
||
||
||
||
||
Slow Hard Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
xvIBM Tivoli Monitoring Resource Model Reference
xvi Version 5.1.1
Preface
IBM Tivoli®Monitoring enables you to monitor availability and performance status ofresources on your systems to identify bottlenecks and potential resource problems. Thisreference provides key information about the resource models included in this product.
IBM Tivoli Monitoring was formerly known as Tivoli Distributed Monitoring (AdvancedEdition).
Who Should Read This ReferenceThe target audiences for this reference are system administrators and system installers.
To make effective use of the product you require knowledge and practical experience of thefollowing:
¶ Importing, installing, and managing the Tivoli Management Framework® and the Tivolimanagement environment
¶ System administration on the systems where you plan to install Tivoli Monitoringcomponents, and which you plan to monitor using the product
You should also be familiar with the Tivoli Enterprise Console® product.
What is New in this ReleaseIBM Tivoli Monitoring Version 5.1.1 is a development of, and upgrades, Tivoli MonitoringVersion 5.1 and Tivoli Distributed Monitoring (Advanced Edition) Version 4.1 and providesthe following additional functionality:
OS/400 SupportThe product now supports OS/400 endpoints. See the IBM Tivoli Monitoring: User’sGuide, for details, and Part III, “Resource Models for OS/400” of this guide for thespecific resource models.
Tivoli Enterprise Data Warehouse SupportThe product now provides a Tivoli Monitoring Data Warehouse Support componentto store data in the Tivoli Enterprise Data Warehouse schema. See the correspondingchapter of the IBM Tivoli Monitoring: User’s Guide for details.
What This Reference ContainsThis reference contains the following sections:
Part I. Resource Models for Windows®
¶ “Chapter 1, “Event Log Resource Model””
Describes the Event Log resource model.
¶ “Chapter 2, “Logical Disk Resource Model””
Describes the Logical Disk resource model.
¶ “Chapter 3, “Memory Resource Model””
Describes the Memory resource model.
¶ “Chapter 4, “Network Interface Card Resource Model””
Describes the Network Interface Card resource model, which runs on Windows NT®.
xviiIBM Tivoli Monitoring Resource Model Reference
¶ “Chapter 5, “Parametric Event Log Resource Model””
Describes the Parametric Event Log resource model.
¶ “Chapter 6, “Parametric Services Resource Model””
Describes the Parametric Services resource model.
¶ “Chapter 7, “Parametric TCP/IP Ports Resource Model””
Describes the Parametric TCP/IP resource model.
¶ “Chapter 8, “Physical Disk Resource Model””
Describes the Physical Disk resource model.
¶ “Chapter 9, “Printer Resource Model””
Describes the Printer resource model.
¶ “Chapter 10, “Process Resource Model””
Describes the Process resource model.
¶ “Chapter 11, “Processor Resource Model””
Describes the Processor resource model.
¶ “Chapter 12, “Server Performance Prediction Resource Model””
Describes the Server Performance Prediction resource model.
¶ “Chapter 13, “Services Resource Model””
Describes the Services resource model.
¶ “Chapter 14, “TCP/IP Resource Model””
Describes the TCP/IP resource model.
Part II. Resource Models for UNIX®/Linux
¶ “Chapter 15, “CPU Resource Model””
Describes the CPU resource model.
¶ “Chapter 16, “File Resource Model””
Describes the File resource model.
¶ “Chapter 17, “File System Resource Model””
Describes the File System resource model.
¶ “Chapter 18, “Memory Resource Model””
Describes the Memory resource model.
¶ “Chapter 19, “Network Interface Resource Model””
Describes the Network Interface resource model.
¶ “Chapter 20, “Network RPC-NFS Resource Model””
Describes the Network RPC-NFS resource model, which is available only for Solarisplatforms.
¶ Chapter 21, “Chapter 21, “Process Resource Model””
Describes the Process resource model.
¶ “Chapter 22, “Security Resource Model””
Describes the Security resource model.
¶ “Chapter 23, “Server Performance Prediction Resource Model””
What This Reference Contains
xviii Version 5.1.1
Describes the Server Performance Prediction resource model.
Part III. Resource Models for OS/400
¶ “Chapter 24, “ASP Disk Mirroring Resource Model””
Describes the ASP Disk Mirroring resource model.
¶ “Chapter 25, “ASP Utilization Resource Model””
Describes the ASP Utilization resource model.
¶ “Chapter 26, “Basic CPU Utilization Resource Model””
Describes the Basic CPU Utilization resource model.
¶ “Chapter 27, “Basic Interactive CPU Utilization Resource Model””
Describes the Basic Interactive CPU Utilization resource model.
¶ “Chapter 28, “Configuration Objects Resource Model””
Describes the Configuration Objects resource model.
¶ “Chapter 29, “Database CPU Utilization Resource Model””
Describes the Database CPU Utilization resource model.
¶ “Chapter 30, “Distribution Queues Resource Model””
Describes the Distribution Queues resource model.
¶ “Chapter 31, “History Log Resource Model””
Describes the History Log resource model.
¶ “Chapter 32, “Interactive Feature CPU Utilization Resource Model””
Describes the Interactive Feature CPU Utilization resource model.
¶ “Chapter 33, “Job Log Resource Model””
Describes the Job Log resource model.
¶ “Chapter 34, “Job Queue Resource Model””
Describes the Job Queue resource model.
¶ “Chapter 35, “Job Status Resource Model””
Describes the Job Status resource model.
¶ “Chapter 36, “Management Central Events Resource Model””
Describes the Management Central Events resource model.
¶ “Chapter 37, “Network Attributes Resource Model””
Describes the Network Attributes resource model.
¶ “Chapter 38, “Output Queues Resource Model””
Describes the Output Queue resource model.
¶ “Chapter 39, “Parametric Object and File Resource Model””
Describes the Parametric Object and File resource model.
¶ “Chapter 40, “Storage Pools Resource Model””
Describes the Storage Pools resource model.
¶ “Chapter 41, “Subsystem Resource Model””
Describes the Subsystem resource model.
What This Reference Contains
xixIBM Tivoli Monitoring Resource Model Reference
¶ “Chapter 42, “System Disk Resources Resource Model””
Describes the System Disk Resources resource model.
¶ “Chapter 43, “System Value Resource Model””
Describes the System Value resource model.
¶ “Chapter 44, “TCP Interface Resource Model””
Describes the TCP Interface resource model.
¶ “Chapter 45, “TCP Service Resource Model””
Describes the TCP Service Resource Model.
Part IV. Appendixes
¶ “Appendix A, “Return Codes for Built-in Actions (Windows)””
Lists return codes for the Windows resource models that have built-in actions.
¶ “Appendix B, “Correlated Events (Windows)””
Describes correlated events and the indications from which each one is generated.
PublicationsThis section lists publications in the IBM Tivoli Monitoring library and any other relateddocuments. It also describes how to access Tivoli publications online, how to order Tivolipublications, and how to make comments on Tivoli publications.
IBM Tivoli Monitoring LibraryThe following documents are available in the IBM Tivoli Monitoring library:
¶ IBM Tivoli Monitoring: Resource Model Reference, SH19-4570
Provides information about using and customizing the resource models that can be usedwith IBM Tivoli Monitoring.
¶ IBM Tivoli Monitoring: User’s Guide, SH19-4569
Describes how to install, customize, and use IBM Tivoli Monitoring to manage systemand application resources.
¶ IBM Tivoli Monitoring: Workbench User’s Guide, SH19-4571
Describes how to use the IBM Tivoli Monitoring Workbench to create new resourcemodels or to modify existing ones.
¶ IBM Tivoli Monitoring: Release Notes, GI10-5793
Provides the most current information about IBM Tivoli Monitoring.
¶ IBM Tivoli Monitoring: Road Map for a Typical Installation, GI11-0938
Describes typical installation scenarios.
¶ IBM Tivoli Monitoring: Deployment Supplement, SC23-4799
Describes how to use the deployment wizard for a custom installation.
Versions of these documents in PDF and HTML formats can be found on the IBM TivoliMonitoring and IBM Tivoli Monitoring Workbench product CDs. They are stored in theBooks directory, and can be accessed by selecting the file Books/infocenter.html withyour Web browser. This displays an HTML page from which all of the documents can beaccessed in either format.
What This Reference Contains
xx Version 5.1.1
Prerequisite and Related PublicationsBefore beginning the installation, read the following prerequisite and related documentationfor more information about the management options that IBM Tivoli Monitoring provides:
¶ Tivoli Management Framework: User’s Guide
Provide prerequisite information about setting up the Tivoli Management Framework andTivoli environment.
¶ Tivoli Management Framework: Planning and Installation
Provide prerequisite information about setting up the Tivoli Management Framework andTivoli environment.
¶ Tivoli Management Framework: Reference Manual
Provide prerequisite information about setting up the Tivoli Management Framework andTivoli environment.
¶ Tivoli Software Installation Service: User’s Guide
Provides task-oriented information on how to import, manage, and install TivoliManagement Environment® software on selected machines and managed nodes withinyour Tivoli management region.
¶ Tivoli Software Installation Service: Release Notes
Provides important information about using and installing the Tivoli SoftwareInstallation Service (SIS).
¶ Tivoli Enterprise Console: Rule Builder’s Guide
Provides information about using the Tivoli Enterprise Console rule editor and graphicalrule builder to modify existing rules and create new rules to match your specific eventmanagement needs.
¶ Tivoli Enterprise Console: Release Notes, Version 3.7 or later
Provides the most current information about Tivoli Enterprise Console.
¶ Tivoli Business Systems Management: Distributed User’s Guide, Version 1.5 (if youintend to use Tivoli Business Systems Manager to monitor IBM Tivoli Monitoringevents)
Describes how to use the Tivoli Business Systems Manager product.
¶ Tivoli Business Systems Management: Console User’s Guide, Version 1.5 (if you intendto use Tivoli Business Systems Manager to monitor IBM Tivoli Monitoring events)
Describes how to use the Tivoli Business Systems Manager console.
Accessing Publications OnlineYou can access many Tivoli publications online at the Tivoli Customer Support Web site:http://www.tivoli.com/support/documents/
These publications are available in PDF or HTML format, or both. Translated documents arealso available for some products.
Ordering PublicationsYou can order many Tivoli publications online at the following Web site:http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi
You can also order by telephone by calling one of these numbers:
¶ In the United States: 800-879-2755
Publications
xxiIBM Tivoli Monitoring Resource Model Reference
¶ In Canada: 800-426-4968
¶ In other countries, for a list of telephone numbers, see the following Web site:http://www.tivoli.com/inside/store/lit_order.html
Providing Feedback about PublicationsWe are very interested in hearing about your experience with Tivoli products anddocumentation, and we welcome your suggestions for improvements. If you have commentsor suggestions about our products and documentation, contact us in one of the followingways:
¶ Send an e-mail to [email protected].
¶ Complete our customer feedback survey at the following Web site:http://www.tivoli.com/support/survey/
Note: This version of the IBM Tivoli Monitoring: Resource Model Reference is notavailable in hardcopy format.
Contacting Customer SupportIf you have a problem with any Tivoli product, you can contact Tivoli Customer Support.See the Tivoli Customer Support Handbook at the following Web site:http://www.tivoli.com/support/handbook
The handbook provides information about how to contact Tivoli Customer Support,depending on the severity of your problem, and the following information:
¶ Registration and eligibility
¶ Telephone numbers and e-mail addresses, depending on the country you are in
¶ What information you should gather before contacting support
Conventions Used in This GuideThis book uses several conventions for special terms and actions, operatingsystem-dependent commands and paths, and margin graphics.
Typeface ConventionsThe following typeface conventions are used in this book:
Bold Lowercase and mixed-case commands, command options, and flags thatappear within text appear like this, in bold type.
Graphical user interface elements (except for titles of windows and dialogs)and names of keys also appear like this, in bold type.
Italic Variables, values you must provide, new terms, and words and phrases thatare emphasized appear like this, in italic type.
Monospace Commands, command options, and flags that appear on a separate line, codeexamples, output, and message text appear like this, in monospace type.
Names of files and directories, text strings you must type, when they appearwithin text and HTML and XML tags also appear like this, in monospacetype.
Publications
xxii Version 5.1.1
Operating System-dependent Variables and PathsThis book uses the UNIX convention for specifying environment variables and for directorynotation.
When using the Windows command line, replace $variable with %variable% forenvironment variables and replace each forward slash (/) with a backslash (\) in directorypaths.
Note: If you are using the bash shell on a Windows system, you can use the UNIXconventions.
Conventions Used in This Guide
xxiiiIBM Tivoli Monitoring Resource Model Reference
Conventions Used in This Guide
xxiv Version 5.1.1
Part I. Resource Models for WindowsChapter 1. Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Event ID 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 2011. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 2511. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Event ID 3013. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Event ID 7023. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Indication Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 2. Logical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
High Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
High Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
High Transfer Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
High Percentage Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Logical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Low Disk Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Slow Logical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Chapter 3. Memory Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
High Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Low Available Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Low Available Memory Causing Hard Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Low Available Memory Causing Soft Paging and Pagefile Resizing . . . . . . . . . . . . . . . . . . . . . 29
Low Available Memory Is Causing Excessive Soft Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Low Available Memory Causing Many Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
1IBM Tivoli Monitoring Resource Model Reference
Low Available Memory with High Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Low Available Memory with a High Working Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Low Available Memory with a Small Pagefile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Low Copy Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Low Data Map Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Low MDL Read Hits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Low Pin Read Hits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Pagefile Is Resizing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Memory Leak In Private Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Memory Leak In System Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Memory Leak In System Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Chapter 4. Network Interface Card Resource Model . . . . . . . . . . . . . . . . . . . . . 45Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Adjust Work Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
High Broadcast Frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
High Current Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
High Errored Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Network Interface Card Overworked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Network Interface Card Too Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Redirector Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Redirector Overloaded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Redirector Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Segment Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Segment Affecting Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Server Affecting Redirector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Server Overloaded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Server Overloaded Affecting Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Chapter 5. Parametric Event Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . 67Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
2 Version 5.1.1
Windows Event Logged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Chapter 6. Parametric Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 71Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Chapter 7. Parametric TCP/IP Ports Resource Model . . . . . . . . . . . . . . . . . . . . 75Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
State of the Defined Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Chapter 8. Physical Disk Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
High Percent Disk Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
High Read Bytes per Second . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
High Transfer Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
High Write Bytes per Second. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Physical Disk Possible Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Slow Physical Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Chapter 9. Printer Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Indications and Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
High Current Percent Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
High Job Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
High Job Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
3IBM Tivoli Monitoring Resource Model Reference
High Not Ready Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
High Not Ready Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
High Out Of Paper Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
High Out Of Paper Errors Per Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Chapter 10. Process Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Process Handle Leak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Process High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Chapter 11. Processor Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Busy Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
CPU Cannot Keep up with Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Hardware Keeping CPU Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
High Percent Usage Delta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
High Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Processor Busy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Chapter 12. Server Performance Prediction Resource Model . . . . . . . . . . 115Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Chapter 13. Services Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Services Failing Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Services Stopped Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
4 Version 5.1.1
||
Built-in Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Chapter 14. TCP/IP Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
High Fragment Ratio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
High Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Segments ReXmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
5IBM Tivoli Monitoring Resource Model Reference
6 Version 5.1.1
Event Log Resource Model
This chapter describes the Event Log resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_EventLog
Category Windows
Thresholds Yes
Parameters No
Built-in actions Yes
Clearing events No
Default cycle time 600 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows NT and Window 2000endpoints.
The Event Log resource model examines the Windows System Event Log for events thatnormally require immediate attention, or can be rectified with a simple registry edit. TheEvent Log resource model highlights the following problems:
¶ Client connectivity problems
Busy networks can cause clients to time out. This indication can be trapped. When it is,the registry value that determines the time out period can be enlarged. This solutionmust only be tried a few times. After which, the problem is more likely to be caused bya problem with the network card or drivers.
¶ Detection of malfunctioning devices
Events 9, 11, and 15 are the most common events that occur when a device or driver ismisbehaving. Trapping these errors helps to correct the devices as soon as possible.
¶ Server connectivity problems
Bad IRPStackSize and OEM installs of Windows are common situations that prevent theserver service from operating correctly. If the server service is not functioning properly,clients cannot connect to the affected machine.
1
7IBM Tivoli Monitoring Resource Model Reference
1.E
vent
Lo
gR
esou
rceM
od
el
Indications and EventsThe following table lists the events that can be generated by the Event Log resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_EventID9 Event ID 9 Warning 8
TMW_EventID11 Event ID 11 Warning 8
TMWEvent_ID15 Event ID 15 Warning 9
TMW_EventID2011 Event ID 2011 Warning 9
TMW_EventID2511 Event ID 2511 Warning 9
TMW_EventID3013 Event ID 3013 Warning 10
TMW_EventID7023 Event ID 7023 Warning 10
Event ID 9This indication is sent when a device or device driver times out. See “Indication Properties”on page 11 for information on the properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by the threshold Maximum Number Of Logs)and has the event ID of 9, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Event ID 11This indication is sent when an error is detected on a device or device controller. See“Indication Properties” on page 11 for information on the properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number Of Logs) and has theevent ID of 11, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
8 Version 5.1.1
Event ID 15This indication is sent when a drive (typically removable media, for example, CD-ROM) isnot ready for access or is not functioning properly. See “Indication Properties” on page 11for information on the properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) and has theevent ID of 15, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Event ID 2011This indications is sent when the IRPStackSize is too small. Event 7023 will typically occurwith this event. See “Indication Properties” on page 11 for information on the properties forthis event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) and has theevent ID of 2011, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Event ID 2511This indication is sent when a shared directory no longer exists. See “Indication Properties”on page 11 for information on the properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) and has theevent ID of 2511, this indication is sent.
Indications and Events
9IBM Tivoli Monitoring Resource Model Reference
1.E
vent
Lo
gR
esou
rceM
od
el
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Event ID 3013This indication is sent when the redirector is timing out. See “Indication Properties” onpage 11 for information on the properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) with the eventID of 3013, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Event ID 7023This indication is sent when there is not enough server storage space. When it occurs byitself, the problem usually has to do with OEM installs of either Windows or Service Packs.Microsoft®’s Knowledge Base article Q151427 details this event. The solution is usually toreinstall of the latest service pack. See “Indication Properties” on page 11 for information onthe properties for this event.
No particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by Maximum Number of Logs) with the eventID of 7023, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
10 Version 5.1.1
Indication PropertiesAll the indications in the Event Log resource model have the following properties.
EvtID Identifies the event by number (key attribute)
RepeatCountNumber of Event ID events received in a cycle
LogfileThe name of the log file in which the event was generated (for example, system,security, or application)
SourceNameThe source of the event (key attribute)
TimeGeneratedThe time that the event was generated
TimeWrittenThe time that the event was written to the Event Log
ComputerNameThe name of the computer where the event occurred (key attribute)
MessageThe message text of the event
ThresholdsThe following table lists the thresholds that can be set for the Event Log resource model.For each threshold it shows the name, a short description, and the default value:
Threshold Description Default
Maximum Number of Logs(MostNumberOfLogs)
This threshold determines the maximum number of newestevents in the event log that are examined.
100
Built-in ActionsThis resource model has the following built-in actions:
Indication Built-in Actions
Event ID 20111. Notifies the system administrator that the IRPStackSize is too small.
2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEMS\CurrentControlSet\
Services\LanmanServer\Parameters\IRPStackSize and
3. Sets the value to 0xCh (Decimal value 12).
The system must be rebooted for this change to take effect.
Indications and Events
11IBM Tivoli Monitoring Resource Model Reference
1.E
vent
Lo
gR
esou
rceM
od
el
Indication Built-in Actions
Event ID 25111. Notifies the system administrator that a shared directory no longer exists.
2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Shares and the system must be rebooted for thischange to take effect.
3. Deletes the key that represents the sharename.
Event ID 30131. Notifies the system administrator that the redirector is timing out.
2. Edits the registry key ComputerName\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Parameters\SessTimeOut to a higher value. Whenthe value is not present, the default value is 0x2Dh (decimal value 45)seconds. Corrective actions consist of raising this value by an increment of0xAh (decimal value 10).
The system must be rebooted for this change to take effect. After threeattempts, user intervention is required. The system administrator shouldexamine the network subsystem and possibly reinstall or repair network driversor devices.
Built-in Actions
12 Version 5.1.1
Logical Disk Resource Model
This chapter describes the Logical Disk resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_LogicalDisk
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Logical Disk resource model highlights the following problems:
¶ Bytes Transferred Per Second
This indicates the raw amount of data that is transferred through the disk. The maximumbytes per second that a disk subsystem can handle depends on the type of hard drive, thetype of controller, the drive configuration, and, in the case of most IDE-based harddrives, the speed of the CPU.
¶ Disk Space
Low disk space can often make it impossible to reboot a Windows NT machine. Thethreshold value is based on the percentage of free space on the disk. Administratorsmonitoring systems with disks of less than one gigabyte should raise this value. A goodguideline is to keep enough free disk space to allow the pagefile to reach its maximumsize limit.
¶ Percentage Usage
The percentage of used disk often needs to be altered when monitoring file servers forbottlenecks. File servers, print servers, and mail servers use a high percent of disk space.
However, workstations typically use a high percentage of disk space in short bursts.Performance in CPU speed and general system response decline.
2
13IBM Tivoli Monitoring Resource Model Reference
2.L
og
icalD
iskR
esou
rceM
od
el
PrerequisitesThe Logical Disk resource model requires disk counters to be enabled on the Windowsendpoints.
To enable disk counters, perform the following steps on each endpoint:
1. On Windows NT systems, issue the diskperf -y command.
On Windows 2000 systems, issue the diskperf -yv command.
2. Reboot the system.
Indications and EventsThe following table lists the events that can be generated by the Logical Disk resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_HighLogicalDiskReadBytesSec High Read Bytes per Second Minor 15
TMW_HighLogicalDiskWriteBytesSec High Write Bytes per Second Minor 16
TMW_HighLogicalDiskXferRate High Transfer Rate Minor 17
TMW_HighLogicalPercentDiskTime High Percentage Disk Time Warning 18
TMW_LogicalPossibleFrag Logical Disk Possible Fragmentation Minor 19
TMW_LowLogicalDiskSpace Low Disk Space Warning 20
TMW_SlowLogicalDrive Slow Logical Drive Warning 21
Prerequisites
14 Version 5.1.1
High Read Bytes per SecondThis indication is sent when a logical disk is reading a lot of data.
The indication has the following attributes:
PercentDiskReadThe percentage of the logical drive being used to read data
DiskReadBytesSecThe number of bytes read per second on the logical disk
DiskReadSecThe number of transactions that are read per second on the logical disk
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The maximum amount of bytes transferred per second(being written or read) exceeds this threshold.
1572864
High Percent Usage(HighPercentUsage)
The time that the selected disk drive spends for read orwrite requests exceeds this threshold.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
15IBM Tivoli Monitoring Resource Model Reference
2.L
og
icalD
iskR
esou
rceM
od
el
High Write Bytes per SecondThis indication is sent when a logical disk is writing a lot of data.
The indication has the following attributes:
DiskWriteBytesSecThe number of bytes written per second on the logical disk
DiskWriteSecThe number of transactions that are written per second on the logical disk
PercentDiskWriteThe percent of the logical drive used during write operations.
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The amount of bytes transferred per second (beingwritten or read) exceeds this threshold.
1572864
High Percent Usage(HighPercentUsage)
The percent of time that the selected disk drive spendsfor read or write requests exceeds this threshold.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
16 Version 5.1.1
High Transfer RateThis indication is sent when a logical disk is used heavily to transfer data, both for readingand writing.
The indication has the following attributes:
DiskXfersSecThe rate of bytes read or written per second on the logical disk
DiskReadsSecThe rate of bytes read per second on the logical disk
DiskWritesSecThe rate of bytes written per second on the logical disk
PercentDiskReadTimeThe percentage of the logical drive used for read operations
PercentDiskWriteTimeThe percentage of the logical drive used for write operations
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk read or write bytes per second exceed thisthreshold.
1572864
High Percent Usage(HighPercentUsage)
The percentage of time that the logical drive spends forread or write requests exceeds this threshold.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
17IBM Tivoli Monitoring Resource Model Reference
2.L
og
icalD
iskR
esou
rceM
od
el
High Percentage Disk TimeThis indication is sent when a logical disk is being used a high percent of the time.
The indication has the following attributes:
PercentDiskTimeThe percentage of time that the logical drive is being used
PercentWriteTimeThe percentage of time that the logical drive is used for write operations
PercentReadTimeThe percentage of time that the logical drive is being used for read operations
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Queue Length(HighQLength)
The maximum number of outstanding requests, includingthose in progress, on the disk exceeds this threshold.
3
High Percent Usage(HighPercentUsage)
The time spent by the selected disk to work exceeds thisthreshold.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
18 Version 5.1.1
Logical Disk Possible FragmentationThis indication is sent when a high percentage of logical disk is being used, but the queuelength is not long, and bytes per second reading and writing are not high.
The indication has the following attributes:
PercentDiskTimeThe percentage of time that the logical drive is being used
DiskBytesSecThe read and write transfer rate per second
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk bytes per seconds value does not exceed thisthreshold.
1572864
High Percent Usage(HighPercentUsage)
The time spent by the selected disk to work exceeds thisthreshold.
90
High Queue Length(HighQLength)
This threshold must not be exceeded. 3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
19IBM Tivoli Monitoring Resource Model Reference
2.L
og
icalD
iskR
esou
rceM
od
el
Low Disk SpaceThis indication is sent when a logical drive has very little free space.
The indication has the following attributes:
PercentFreeSpaceThe percentage of free space on the logical drive
FreeMBThe actual size of free space on the logical drive in megabytes
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Disk Space(LowDiskSpace)
The free disk space drops below this threshold. 5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 5
Holes 0
Indications and Events
20 Version 5.1.1
Slow Logical DriveThis indication is sent when the logical disk is too slow to keep up with the work it mustperform.
The indication has the following attributes:
CurrentDiskQLengthThe number of jobs waiting to be processed by the logical disk
PercentDiskTimeThe percentage of time that the logical disk is being used
AvgQLengthThe average queue length
AvgReadQLengthThe average queue length for read operations
AvgWriteQLengthThe average queue length for write operations
DiskReadBytesSecThe number of bytes read per second on the logical disk
DiskWriteBytesSecThe number of bytes read per second on the logical disk
PhysicalDiskThe physical disk on which the logical disk resides (Key attribute)
LogicalDiskThe logical disk that is being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk bytes per seconds value exceeds this threshold. 1572864
High Queue Length(HighQLength)
The number of outstanding requests, including those inprogress, on the disk exceeds this threshold.
3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
21IBM Tivoli Monitoring Resource Model Reference
2.L
og
icalD
iskR
esou
rceM
od
el
ThresholdsThe following table lists the thresholds that can be set for the Logical Disk resource model.For each threshold it shows the name, a short description, and the default value:
Threshold Description Default
High Bytes per Second(HighBytesSec)
This threshold determines the maximum amount of bytestransferred per second (being written or read). Thedefault is based on the average logical disk.
1572864
High Queue Length(HighQLength)
This threshold determines the maximum number ofoutstanding requests, including those in progress, on thedisk. This is an exact length, not an average over thetime interval.
3
High Percent Usage(HighPercentUsage)
This threshold determines what percent of time that theselected disk drive spends for read or write requests istoo high.
90
Low Disk Space(LowDiskSpace)
This threshold determines what percentage of free diskspace is too low.
5
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
LogicalDisk Bytes TransferredLogicalDisk
The logical disk to be measured
DiskBytesSecThe amount of bytes per second being written orread
Queue LengthLogicalDisk
The logical disk to be measured
AvgQLengthThe average queue length for jobs
Percent SpaceLogicalDisk
The logical disk to be measured
PercentFreeSpaceThe percentage of free space on the logical disk
Percent Disk UsageLogicalDisk
The logical disk to be measured
PercentDiskTimeThe percentage of time that the logical drive isbeing used
Thresholds
22 Version 5.1.1
Memory Resource Model
This chapter describes the Memory resource model for Windows systems. The Memoryresource model detects bottlenecks specifically associated with RAM. Because nearly everydevice within the system uses RAM, most bottlenecks and problems will appear here.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_MemoryModel
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Memory resource model highlights the following problems:
¶ Cache
When cache is used, four different areas are examined:
v Copy Reads
v Data Maps
v MDL Reads
v Pin Reads
The Hit Percentage Rate is examined for each area. This gives an idea of how muchdata was supplied by the cache and how much was supplied from another location. Ifcache is used, ideally it should provide at least 70% of the data. A lower percentageindicates data is being lost in the cache or that the cache is not large enough.
3
23IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
¶ Committed bytes
Committed bytes indicate the amount of virtual memory, in bytes, that have beencommitted. The commit limit is the current limit of physical space (either RAM or inthe pagefile) that is available for the committed bytes.
If the committed bytes become larger than the commit limit, the pagefile must beenlarged. Having a pagefile that is constantly in flux causes some performance problemsbecause the system spends time extending the pagefile or shrinking it. This process alsoinvolves the slowest part of the system and is prone to becoming a bottleneck.
The committed bytes has an upper limit. This is dictated by a setting in the systemcontrol applet. If the pagefile reaches its maximum limit, it is almost guaranteed thatavailable memory will be extremely low. In this situation a major performancedegradation can be expected.
If committed bytes continues to grow and there is not enough available physical space tohold the committed memory, a core dump will probably occur.
The initial size of the pagefile is best determined by the amount of RAM in the system.A good guideline is 150% of the amount of RAM.
¶ Low available memory
Available memory is checked constantly to ensure it does not drop below 10 MB. Whenavailable memory is low, performance declines slightly, but the system still workscorrectly. However, the administrator needs to know that memory is low and may needto monitor it.
As available memory drops, Windows NT systems try to keep the available memoryabove 4 MB. At this point memory is too low and the operating system spends moretime keeping memory available than processing requests. Additionally, high pagingbegins to occur, and the pagefile reaches its maximum size.
¶ Memory leaks
These three different areas of memory need to be analyzed for a possible leak:
v Private Bytes
v System Code
v System Drivers
The top five processes are examined in the Private Bytes. The total pools of SystemCode and System Drivers are also examined for growth. This generally indicates amemory leak in the affected area of memory.
¶ Paging and page faulting
Page Faults occur when Windows NT moves a piece of data to another portion of RAMor to the pagefile. Paging moves data to the hard drive, so it is incorporated in thecounters for Page Faults.
Page faults are considered high when they reach approximately 350 page faults persecond. Paging is considered high at approximately 60 pages per second. Performancedeclines because the system moves data to and from the hard drive, typically the slowestcomponent of the system. The hard drive and processor become busier and overallperformance of the machine decreases.
Overview
24 Version 5.1.1
Indications and EventsThe following table lists the events that can be generated by the Memory resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_HighPaging High Paging Warning 26
TMW_LowAvail Low Available Memory Warning 27
TMW_LowAvailCausingHardPaging Low Available Memory CausingHard Paging
Warning 28
TMW_LowAvailCausingSoftPagePagefileResize Low Available Memory CausingSoft Paging and PagefileResizing
Warning 30
TMW_LowAvailCausingSoftPaging Low Available Memory IsCausing Excessive Soft Paging
Warning 30
TMW_LowAvailCausingManyProblems Low Available Memory CausingMany Problems
Critical 31
TMW_LowAvailHighCache Low Available Memory withHigh Cache
Warning 32
TMW_LowAvailHighWS Low Available Memory withHigh Working Set
Warning 33
TMW_LowAvailWithSmallPageFile Low Available Memory With ASmall Pagefile
Warning 35
TMW_LowCopyReadHits Low Copy Read Hits Minor 36
TMW_LowDataMapHits Low Data Map Hits Minor 37
TMW_LowMDLReadHits Low MDL Read Hits Minor 38
TMW_LowPinReadHits Low Pin Read Hits Minor 39
TMW_PageFileResizing Pagefile Is Resizing Warning 40
TMW_MemoryLeakInPB Memory Leak In Private Bytes Critical 41
TMW_MemoryLeakInSC Memory Leak in System Code Critical 42
TMW_MemoryLeakInSD Memory Leak in SystemDrivers
Critical 43
Indications and Events
25IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
High PagingThis indication is sent when there is a high amount of paging to the pagefile.
The indication has the following attributes:
PagesSecThe number of pages swapped per second
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
ExcessivePaging The number of pages per second exceeds this threshold. 60
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 15
Holes 1
Indications and Events
26 Version 5.1.1
Low Available MemoryThis indication is sent when the available memory is low, but it is not clear in which area ofmemory the problem is located.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
N/A This indication is sent when the cache must be largerthan the total amount of Working Set and availablememory.
N/A
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 2
Indications and Events
27IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Low Available Memory Causing Hard PagingThis indication is sent when low available memory causes too much paging to the pagefile.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
PageFaultsSecThe current rate of page faults per second
PagesSecThe current rate of pages per second
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
Minimum Committed Bytes(MinimumCommitted)
This threshold is not crossed. 5242880
ExcessivePageFaults Paging to disk and to other areas of memory is higherthan this threshold.
350
ExcessivePaging The number of pages per second exceeds thisthreshold.
60
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
28 Version 5.1.1
Low Available Memory Causing Soft Paging and Pagefile ResizingThis indication is sent when excessive soft paging and pagefile resizing is being caused bylow available memory.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
PageFaultsSecThe current rate of page faults per second
CommittedBytesThe current total of committed bytes
CommittedLimitThe upper limit of the committed bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
ExcessivePageFaults Paging to disk and to other areas of memory is higherthan this threshold.
350
Excessive Paging(ExcessivePaging)
This threshold must not be exceeded. 60
Minimum Committed Bytes(MinimumCommitted)
The difference between the current committed bytesand the peak current bytes is smaller than thisthreshold.
5242880
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
29IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Low Available Memory Is Causing Excessive Soft PagingThis indication is sent when the available memory is low and is causing a high amount ofpage faults
The indication has the following attributes:
PageFaultsSecThe current value for page faults per second
TotalAvailThe total of available memory in bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
ExcessivePageFaults Page faults per second are higher than this threshold. 350
Excessive Paging(ExcessivePaging)
This threshold must not be exceeded. 60
Minimum Committed Bytes(MinimumCommitted)
This threshold must not be exceeded. 5242880
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
30 Version 5.1.1
Low Available Memory Causing Many ProblemsThis indication is sent when multiple problems are being caused by lack of availablememory.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
PageFaultsSecThe current rate of page faults per second
PagesSecThe current rate of pages per second
CommittedBytesThe current total of committed bytes
CommittedLimitThe upper limit of the committed bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
ExcessivePageFaults Paging to disk and to other areas of memory ishigher than this threshold.
350
ExcessivePaging The number of pages per second exceeds thisthreshold.
60
Minimum Committed Bytes(MinimumCommitted)
The difference between the current committed bytesand the peak current bytes is smaller than thisthreshold.
5242880
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
31IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Low Available Memory with High CacheThis indication is sent when available memory is low due to a large amount of memorybeing taken up by cache.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
N/A This indication is sent when the cache must be largerthan the total amount of Working Set and availablememory.
N/A
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
32 Version 5.1.1
Low Available Memory with a High Working SetThis indication is sent when available memory is low and the working set is high.
The indication has the following attributes:
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
HighProcessWorkingSetThe working set of the process with the highest working set
HighProcessPrivateBytesThe private bytes of the process with the highest working set
HighProcessPoolNPBytesThe pool non-paged bytes of the process with the highest working set
HighProcessPoolPPBytesThe pool paged bytes of the process with the highest working set
HighProcessVirtualBytesThe virtual bytes of the process with the highest working set
HighProcessIDProcessThe numeric ID of the process with the highest working set
TotalProcessesThe total number of processes
HighProcessThe string name of the process with the highest working set
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
N/A This indication is sent when the working set must belarger than the total amount of cache and availablememory.
N/A
Indications and Events
33IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 2
Indications and Events
34 Version 5.1.1
Low Available Memory with a Small PagefileThis indication is sent when available memory is low and the pagefile is being resized.
The indication has the following attributes:
CommittedBytesThe current total of committed bytes
CommittedLimitThe upper limit of the committed bytes
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Committed The difference between the committed bytes andcommitted limit is lower than this threshold.
5242880
Minimum Available Bytes(MinimumAvail)
Available memory is lower than this threshold. 10485760
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
35IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Low Copy Read HitsThis indication is sent when a copy read hit from cache does not retrieve a high percentageof data.
The indication has the following attributes:
AvrgCopyReadHitsPercentThe percentage average of copy read hits
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Cache Hits Percent(LowCacheHitsPercent)
The number of copy read hits is lower than thethreshold.
70
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
36 Version 5.1.1
Low Data Map HitsThis indication is sent when a data map hit from cache does not retrieve a high percentageof data.
The indication has the following attributes:
AvrgDataMapHitsPercentThe percentage average of data map hits
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Cache Hits Percent(LowCacheHitsPercent)
The number of copy read hits is lower than thethreshold.
70
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
37IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Low MDL Read HitsThis indication is sent when the MDL read hit from cache does not retrieve a highpercentage of data. Continuous occurrences of this indication show that there is not enoughcache. Either adding more RAM or adjusting the registry will help this situation.
The indication has the following attributes:
AvrgMDLReadHitsPercentThe percentage average of MDL read hits
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Cache Hits Percent(LowCacheHitsPercent)
The number of MDL read hits is lower than thisthreshold
70
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
38 Version 5.1.1
Low Pin Read HitsThis indication is sent when a pin read hit from cache does not retrieve a high percentage ofdata. The pin read hits are too low. Continuous occurrences of this indication show that thereis not enough cache. Either adding more RAM or adjusting the registry will help thissituation.
The indication has the following attributes:
AvrgPinReadHitsPercentThe percentage average of pin read hits
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
PercentAvailThe percentage of available memory in comparison to the size of the working setand the cache
PercentWSThe percentage of working set memory in comparison to the size of availablememory and the cache
PercentCacheThe percentage of cache memory in comparison to the size of the working set andthe available memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Cache Hits Percent(LowCacheHitsPercent)
The number of pin read hits is lower than this threshold. 70
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
39IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Pagefile Is ResizingThe pagefile is resizing indication. This indication is sent when the pagefile is being resized.
The indication has the following attributes:
CommittedBytesThe current total of committed bytes
CommittedLimitThe upper limit of the committed bytes
TotalAvailThe total of available memory in bytes
TotalWorkingSetThe total working set size in bytes
TotalCacheThe total cache size in bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Minimum Committed Bytes(MinimumCommitted)
The difference between the current committed bytesand the peak current bytes is smaller than thisthreshold.
5242880
Minimum Available Bytes(MinimumAvail)
This threshold must not be crossed. 10485760
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
40 Version 5.1.1
Memory Leak In Private BytesThis indication is sent when there is a memory leak in the private memory, which is thememory pages that cannot be shared with other processes.
The indication has the following attributes:
IDProcessThe numeric ID of the process with the memory leak
CurrentWorkingSetThe current working set of the process
CurrentPrivateBytesThe current private bytes of the process
CurrentPoolNonPagedBytesThe current pool of non-paged bytes of the process
CurrentPoolPagedBytesThe current pool of paged bytes of the process
CurrentVirtualBytesThe current virtual bytes set of the process
ProcessThe name of the process
No specific threshold causes this indication to be sent. The decision tree examines the topfive processes in this memory area and compares them with the top five processes from thelast cycle. It tries to find identical processes by matching the process IDs and thencomparing the amount of memory it is using for this particular pool of memory. If thememory size has grown since the last cycle, this indication is sent.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 40
Holes 1
Indications and Events
41IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
Memory Leak In System CodeThis indication is sent when there is a memory leak in the system code. The system code isthe area of pageable memory in ntoskrnl.exe, hal.dll, and the boot drivers and file systemsloaded by ntldr/osloader.
The indication has the following attributes:
OrigSizeThe original size of the system code memory
SysDriverBytesThe current size of the system code memory in bytes
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
N/A The decision tree examines the system code pool ofmemory and finds that the memory size has grown sincethe previous cycle.
N/A
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 40
Holes 10
Indications and Events
42 Version 5.1.1
Memory Leak In System DriversThis indication is sent when there is a memory leak in the system drivers.
The indication has the following attributes:
OrigSizeThe original size of the system driver memory
SysCodeThe current size of the system driver memory
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
N/A The decision tree examines the system drivers pool ofmemory and finds that the memory size has grown sincethe previous cycle.
N/A
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 40
Holes 10
Indications and Events
43IBM Tivoli Monitoring Resource Model Reference
3.M
emo
ryR
esou
rceM
od
el
ThresholdsThe following table lists the thresholds that can be set for the Memory resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Excessive Page Faults(ExcessivePageFaults)
This threshold indicates how much paging to disk andto other areas of memory is too high.
350
Excessive Paging(ExcessivePaging)
This threshold indicates when pages per second are toohigh.
60
Low Cache Hits Percent(LowCacheHitsPercent)
This threshold indicates what percentage is too lowwhen reading data from the cache.
70
Minimum Available Bytes(MinimumAvail)
This threshold indicates at what point available memoryis too low (in bytes).
10485760
Minimum Committed Bytes(MinimumCommitted)
This threshold indicates the lowest limit for thedifference between total committed bytes andcommitted limit values.
5242880
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Process Process Memory UsageProcess The process being monitored
WorkingSetThe working set
PrivateBytesThe number of private bytes used by the process
VirtualBytesThe number of virtual bytes used by the process
ID The process ID
Memory Memory UsageMemory The memory instance
TotalAvailThe total available memory
TotalCacheThe total cache memory
CommittedBytesThe bytes committed to this memory
PagingPagesSec
The number of pages per second
PageFaultsSecThe rate of page faults per second
Thresholds
44 Version 5.1.1
Network Interface Card Resource Model
The Network Interface Card (NIC) resource model detects bottlenecks specifically associatedwith all network interface cards installed on Windows NT systems.
Note: The Network Interface Card (NIC) resource model is not supported on Windows2000.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_NetworkIntCard
Category System
Thresholds Yes
Parameters No
Built-in actions Yes
Clearing events Yes
Default cycle time 150 seconds
PrerequisitesThe Network Interface Card resource model requires Windows NT. SNMP and the NetworkMonitoring Agent must be installed in the Network properties.
Note: The Network Monitoring Agent must be installed prior to installing TCP/IP. Once youhave installed the Network Monitoring Agent, check the Performance Monitor tooland ensure that the Network Interface object is displayed.
Overview
Resource model distributionThis resource model should be distributed to Windows NT endpoints.
The Network Interface Card resource model highlights the following problems:
¶ Broadcast frames
If too much of the network is broadcast frames for an extended period of time, thenetwork administrator should segment the network further or redesign the network to usefewer broadcast frames.
¶ Network interface card
4
45IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
The core of the network subsystem is the network interface card (NIC). If a networkcard is not fast enough to handle the number of requests from other nodes on thenetwork or from internal counterparts, all aspects of the network subsystem are affected.Tests are made to determine if a network card is too slow, or if there is too much datatrying to be sent through the network.
¶ Percentage usage
To identify the network component being overused, tests are performed on thepercentage of the network segment being used, the server service, and the workstationservice (redirector). This reveals if the system is part of a busier network, is servicingtoo many requests, or is requesting too much.
The system administrator must determine whether to upgrade the server or workstationservice, or whether to distribute the workload differently.
¶ Server and workstation services
The server and workstation services are vital to the network operations of Windows NTand Windows 2000. Performance statistics for each service, such as bytes per second inand out, sessions with errors, or high requests to the services are examined.
Indications and EventsThe following table lists the events that can be generated by the Network Interface Cardresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_AdjustWorkItems Adjust Work Items Warning 47
TMW_HighBroadcastFrames High Broadcast Frames Warning 48
TMW_HighCurrentCommands High Current Commands Warning 49
TMW_HighErroredRatio High Errored Ratio Critical 50
TMW_NICOverworked Network Interface CardOverworked
Warning 51
TMW_NICTooSlow Network Interface Card Too Slow Warning 52
TMW_RedirectorAffectingServer Redirector Affecting Server Warning 53
TMW_RedirectorOverloaded Redirector Overloaded Warning 55
TMW_RedirectorOverloadedAffectingSegment Redirector Overloaded AffectingSegment
Warning 56
TMW_SegmentAffectingRedirector Segment Affecting Redirector Warning 58
TMW_SegmentAffectingServer Segment Affecting Server Warning 60
TMW_ServerAffectingRedirector Server Affecting Redirector Warning 61
TMW_ServerOverloaded Server Overloaded Warning 62
TMW_ServerOverloadedAffectingSegment Server Overloaded AffectingSegment
Warning 63
Overview
46 Version 5.1.1
Adjust Work ItemsThe work item shortage is too high and the Windows NT registry needs to be adjusted. Thisindication occurs when there is only a high work item shortage. This can be remedied byadjusting the max work items in the registry.
The indication has the following attributes:
WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point thenetwork utilization of the internal segment is toohigh.
40
High Work Item Shortages(HighWorkItemShortages)
This threshold must not be exceeded. 10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
47IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
High Broadcast FramesThis indication is sent when broadcast frames are too high on the internal segment.
The indication has the following attributes:
PercentNetworkUtilThe percentage value of network utilization on the segment
PercentBroadcastFramesThe percentage value of broadcast frames on the network segment
NetworkSegmentThe identity of the network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Broadcast(HighPercentBroadcast)
This threshold measures the percentage of broadcastframes on the internal network segment.
90
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
48 Version 5.1.1
High Current CommandsThis indication is sent when current commands are too high on the redirector. Because thepercentage utilization of bytes per second is normal, this is most likely due to a problemwith the workstation service or a software component tied into the service.
The indication has the following attributes:
CurrentCommandsThe current commands that are queued for service on the redirector
RedirectorBPSThe bytes per second being transferred through the redirector
CurrentBandWidthThe bandwidth of the network interface card
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Current Commands Modifier(HighCurrCmdsMod)
This threshold counts the requests to theredirector that are currently queued for service.If this number is much larger than the numberof network adapter cards installed in thecomputer, the networks, servers, or both beingaccessed have serious bottlenecks. This value isused in conjunction with the number ofnetwork cards installed on the system. Thefinal threshold value is calculated bymultiplying the number of network cards in thesystem by this threshold. If the currentcommands rise above this level, there is abottleneck occurring. When the value ofcurrent commands is greater than the productof this threshold times the total number ofinstalled network cards, this indication isgenerated.
10
High Percent Bytes Per Second(HighPercentBytesSec)
This threshold must not be exceeded. 9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point thenetwork utilization of the internal segment istoo high.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
49IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
High Errored RatioThis indication is sent when the ratio between the number of sessions errored out, and thesum of sessions timed out and logged off is high. This indicates how frequently networkproblems are causing dropped sessions on the server.
The indication has the following attributes:
SessionsErroredRatioThe ratio of sessions errored out to the total sessions on the server
SessionsErroredOutThe number of sessions errored out on the server
SessionsForcedOffThe number of sessions forced off the server bandwidth of the network interfacecard
SessionsLoggedOffThe number of sessions logged off the server
ServerTotalSessionsThe total number of sessions on the server
The indication is generated when the following threshold is exceeded:
Threshold Description Default
High Errored Out Ratio(HighErroredOutRatio)
This threshold indicates the ratio of sessions beingerrored out in comparison to sessions either logging outor being timed out. This number is a percentagegenerated by dividing the number of sessions errored outby the sum of the sessions forced off (timed out) andlogged off.
50
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
50 Version 5.1.1
Network Interface Card OverworkedThis indication is sent when the network interface card is overworked. Bytes per secondthrough the network card is too high and the outbound queue length is getting too large.
The indication has the following attributes:
OutputQueueLengthThe number of requests queued up to be sent out the network interface card
NICBPSThe bytes per second transferred through the network interface card
CurrentBandWidthThe bandwidth of the network interface card
NetworkInterfaceThe identity of network interface card being examined (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
High Output Queue Length Modifier(HighOutputQueueLengthMod)
The network card has an output queue that isused to queue network requests. This thresholdis a modifier that can be adjusted by theadministrator to adjust the threshold for theoutput queue length for the network interface.This threshold is calculated using the totalnumber of network interface cards in the systemplus this value.
3
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. Because there will be an internaldynamic calculation, the threshold value is apercentile that indicates what percentage of thebandwidth is considered too high. For example:830 KBPS is considered high for 10 MBethernet networks. This value is about 8 percent.
9
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 1
Indications and Events
51IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Network Interface Card Too SlowThis indication is sent when the outbound queue length is getting too large but the bytes persecond traveling through the network interface card are normal.
The indication has the following attributes:
OutputQueueLengthThe number of requests queued up to be sent out the network interface card
NICBPSThe bytes per second transferred through the network interface card
CurrentBandWidthThe bandwidth of the network interface card
NetworkInterfaceThe identity of network interface card being examined (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
High Output Queue Length Modifier(HighOutputQueueLengthMod)
The network card has an output queue that isused to queue network requests. This thresholdis a modifier that can be adjusted by theadministrator to adjust the threshold for theoutput queue length for the network interface.This threshold is calculated using the totalnumber of network interface cards in thesystem plus this value.
3
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second,a dynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. Because there will be an internaldynamic calculation, the threshold value is apercentile that indicates what percentage of thebandwidth is considered too high. For example:830 KBPS is considered high for 10 MBethernet networks. This value is about 8percent.
9
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 1
Indications and Events
52 Version 5.1.1
Redirector Affecting ServerThis indication is sent when there is a high work item shortage, but bytes per second on theserver are not exceeding the threshold, and bytes per second on the redirector are exceedingthe threshold. This affects the percentage utilization of the network segment.
The indication has the following attributes:
WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server
RedirectorBPSThe number of bytes per second transferring through the redirector
CurrentBandWidthThe bandwidth of the network interface card
PercentNetworkUtilThe percentage of network utilization on the segment
NetworkSegmentThe identity of the network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent. The bytes per secondthrough the redirector are greater than the number ofbytes per second. This number is reached bymultiplying the current bandwidth with thisthreshold, and dividing the result by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
High Work Item Shortages(HighWorkItemShortages)
This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the server servicereceives a request. HighWorkItemShortages indicatesthat the initial work items or maximum work itemsparameters may need tuning.
10
Indications and Events
53IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
54 Version 5.1.1
Redirector OverloadedThis indication is sent when current commands are high and bytes per second on theredirector are high, but the network segment percentage utilization is normal. The redirectoris unable to keep up with the number of requests being made to it.
The indication has the following attributes:
CurrentCommandsThe current commands that are queued for service on the redirector
RedirectorBPSThe number of bytes per second transferring through the redirector
CurrentBandWidthThe bandwidth of the network interface card
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Current Commands Modifier(HighCurrCmdsMod)
This threshold counts the requests to the redirectorthat are currently queued for service. If the numberof current commands is greater than the product ofthis threshold times the total number of installednetwork cards, this indication is sent.
10
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
The bytes per second through the redirector aregreater than this threshold, which is calculated bymultiplying the current bandwidth with theHighPercentBytesSec threshold, and dividing theresult by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
55IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Redirector Overloaded Affecting SegmentThis indication is sent when the redirector, or workstation service, is being overloaded and itis generating a bottleneck on the network segment. The current commands and bytes persecond on the redirector are exceeded. This usually causes the percentage utilization of thenetwork segment to be exceeded.
The indication has the following attributes:
CurrentCommandsThe current commands that are queued for service on the redirector
RedirectorBPSThe number of bytes per second transferring through the redirector
CurrentBandWidthThe bandwidth of the network interface card
PercentNetworkUtilThe percentage of network utilization on the segment
NetworkSegmentThe network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Current Commands Modifier(HighCurrCmdsMod)
This threshold counts the requests to theredirector that are currently queued for service. Ifthis number is much larger than the number ofnetwork adapter cards installed in the computer,the networks, servers, or both being accessedhave a serious bottleneck. This value is used inconjunction with the number of network cardsinstalled on the system. The final threshold valueis calculated by multiplying the number ofnetwork cards in the system by this threshold.
10
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be createdbased on the current bandwidth of the networkinterface card. When the bytes per secondthrough the redirector are greater than the numberof high bytes per second, this indication is sent.This value is calculated by multiplying thecurrent bandwidth with the High PercentageBytes per Second threshold, and dividing theresult by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point thenetwork utilization of the internal segment is toohigh.
40
Indications and Events
56 Version 5.1.1
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
57IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Segment Affecting RedirectorThis indication is sent when the current commands are high, but bytes per second on boththe redirector and server services are not high. It is then assumed that the current commandsare high due to a high percentage utilization of the network segment.
The indication has the following attributes:
CurrentBandWidthThe bandwidth of the network interface card
CurrentCommandsThe current commands that are queued for service on the redirector
PercentNetworkUtilThe percentage of network utilization on the segment
NetworkSegmentThe network segment being analyzed (Key attribute)
ServerBPSThe bytes per second being transferred through the server
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Current CommandsModifier (HighCurrCmdsMod)
This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks, servers,or both being accessed have a serious bottleneck.This value is used in conjunction with the number ofnetwork cards installed on the system. The finalthreshold value is calculated by multiplying thenumber of network cards in the system by thisthreshold.
10
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be created based onthe current bandwidth of the network interface card.Because there will be an internal dynamic calculation,the threshold value is a percentile that indicates whatpercentage of the bandwidth is considered too high.For example: 830 KBPS is considered high for 10MB ethernet networks. This value is about 8 percent.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
Indications and Events
58 Version 5.1.1
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
59IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Segment Affecting ServerThis indication is sent when there is a high work item shortage, but bytes per second on theredirector and the server are not high. It is assumed that the high work item shortage is dueto a percentage utilization on the network segment.
The indication has the following attributes:
WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server
PercentNetworkUtilThe percentage of network utilization on the segment
NetworkSegmentThe network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be created based onthe current bandwidth of the network interface card.Because there will be an internal dynamic calculation,the threshold value is a percentile that indicates whatpercentage of the bandwidth is considered too high.For example: 830 KBPS is considered high for 10 MBethernet networks. This value is about 8 percent.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
High Work Item Shortages(HighWorkItemShortages)
This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the server servicereceives a request. HighWorkItemShortages indicatesthat the initial work items or maximum work itemsparameters may need tuning.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
60 Version 5.1.1
Server Affecting RedirectorThis indication is sent when current commands are high, server bytes per second are high,but bytes per second on the redirector are not high. This causes the network segmentpercentage utilization to rise. The redirector for the segment is overloaded due to the highamount of information coming through the server.
The indication has the following attributes:
CurrentCommandsThe current commands that are queued for service on the redirector
ServerBPSThe bytes per second being transferred through the server
CurrentBandWidthThe bandwidth of the network interface card
PercentNetworkUtilThe percentage of network utilization on the segment
NetworkSegmentThe network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Current CommandsModifier (HighCurrCmdsMod)
This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks, servers,or both being accessed have a serious bottleneck.This value is used in conjunction with the number ofnetwork cards installed on the system. The finalthreshold value is calculated by multiplying thenumber of network cards in the system by thisthreshold.
10
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
The bytes per second through the server are greaterthan the number of high bytes per second. This valueis calculated by multiplying the current bandwidthwith this threshold, and dividing the result by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
61IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Server OverloadedThis indication is sent when there is a high work item shortage and bytes per second arehigh on the server service. Because the percentage utilization of the network segment isnormal, the work demand on the server service is probably too high.
The indication has the following attributes:
WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server (Key attribute)
ServerBPSThe bytes per second being transferred through the server
CurrentBandWidthThe bandwidth of the network interface card
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Bytes Per Second(HighPercentBytesSec)
The bytes per second through the server are greaterthan the number of high bytes per second. This valueis calculated by multiplying the current bandwidthwith this threshold, and dividing the result by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
High Work Item Shortages(HighWorkItemShortages)
This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the server servicereceives a request. HighWorkItemShortages indicatesthat the initial work items or maximum work itemsparameters may need tuning.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
62 Version 5.1.1
Server Overloaded Affecting SegmentThis indication is sent when there is a high work item shortage and a high bytes per secondthrough the server service. The server for a segment is overloaded due to the high amount ofdata being requested from the server.
The indication has the following attributes:
WorkItemShortagesThe number of times that work items cannot be allocated to service incomingrequests to the server (Key attribute)
ServerBPSThe bytes per second being transferred through the server
CurrentBandWidthThe bandwidth of the network interface card
PercentNetworkUtilThe percentage value of network utilization on the segment
NetworkSegmentThe identity of the network segment being analyzed (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Broadcast(HighPercentBroadcast)
This threshold must not be exceeded. 90
High Percent Bytes Per Second(HighPercentBytesSec)
The bytes per second through the server are greaterthan the number of high bytes per second. This valueis calculated by multiplying the current bandwidthwith this threshold, and dividing the result by 100.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
High Work Item Shortages(HighWorkItemShortages)
This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the server servicereceives a request. HighWorkItemShortages indicatesthat the initial work items or maximum work itemsparameters may need tuning.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
63IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
ThresholdsThe following table lists the thresholds that can be set for the Network Interface Cardresource model. For each threshold it shows the name, a short description, and the defaultvalue:
Threshold Description Default
High Current Commands Modifier(HighCurrCmdsMod)
This threshold counts the requests to the redirectorthat are currently queued for service. If this numberis much larger than the number of network adaptercards installed in the computer, the networks,servers, or both being accessed have a seriousbottleneck. This value is used in conjunction withthe number of network cards installed on thesystem. The final threshold value is calculated bymultiplying the number of network cards in thesystem by this threshold.
10
High Errored Out Ratio(HighErroredOutRatio)
This threshold indicates the ratio of sessions beingerrored out in comparison to sessions either loggingout or being timed out. This number is a percentagegenerated by dividing the number of sessionserrored out by the sum of the sessions forced off(timed out) and logged off.
50
High Output Queue LengthModifier(HighOutputQueueLengthMod)
The network card has an output queue that is usedto queue network requests. This threshold is amodifier that can be adjusted by the administratorto adjust the threshold for the output queue lengthfor the network interface. This threshold iscalculated using the total number of networkinterface cards in the system plus this value.
3
High Percent Broadcast(HighPercentBroadcast)
This threshold measures the percentage of broadcastframes on the internal network segment.
90
High Percent Bytes Per Second(HighPercentBytesSec)
To test for a high amount of bytes per second, adynamic threshold value needs to be created basedon the current bandwidth of the network interfacecard. Because there will be an internal dynamiccalculation, the threshold value is a percentile thatindicates what percentage of the bandwidth isconsidered too high. For example: 830 KBPS isconsidered high for 10 MB ethernet networks. Thisvalue is about 8 percent.
9
High Percent Utilization(HighPercentUtilization)
This threshold determines at what point the networkutilization of the internal segment is too high.
40
High Work Item Shortages(HighWorkItemShortages)
This occurs when no work item is available, or nowork item can be allocated to service the incomingrequest. A work item is used when the serverservice receives a request. HighWorkItemShortagesindicates that the initial work items or maximumwork items parameters may need tuning.
10
Thresholds
64 Version 5.1.1
Built-in ActionsThis resource model has the following built-in actions:
¶ Adjust the InitWorkItems registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\InitWorkItems to a value of 512.
¶ Adjust the MaxWorkItems registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\MaxWorkItems. This value can only go to 64 on WindowsNT Workstations and 65 535 on Windows NT Servers.
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Redirector Bytes RateBytesTotalSec
The rate at which the redirector is processing databytes.
RedirectorThe redirector being monitored
Current CommandsRedirector
The redirector being monitored
CurrentCommandsThe number of requests that are currently queued forthe redirector.
Network Segment Percent BroadcastSegment The segment being monitored
PercentNetworkUtilThe percent of the network being used
PercentBroadcastFramesThe percent of the network that is broadcast frames
Server Bytes RateBytesTotalSec
The total number of bytes passing through thenetwork per second
Server The server being monitored
Server ActivityServerTotalSession
The number of sessions on the server
SessionsErroredOutThe number of sessions that ended in error
SessionsForcedOffThe number of sessions forced offline
SessionsLoggedOffThe number of sessions logged off
WorkItemShortagesIdentifies work item shortages
server Identifies server being monitored
Built-in Actions
65IBM Tivoli Monitoring Resource Model Reference
4.N
etwo
rkIn
terfaceC
ardR
esou
rceM
od
el
Resource Context Properties
Network Interface Card Network TrafficBytesTotalSec
The total number of bytes passing through thenetwork per second
CurrentBandwidthThe network bandwidth
NetworkInterfaceCardThe network interface card being monitored
Output Queue LengthOutput Queue Length
The length of the queue for output
Network Interface CardThe card being monitored
Logging
66 Version 5.1.1
Parametric Event Log Resource Model
This chapter describes the Parametric Event Log resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_ParamEventLog
Category Windows
Thresholds No
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
This resource model examines the Windows NT or Windows 2000 Event Log for events thatare specified by the user through the parameter configuration.
Indications and EventsThe following table lists the event that can be generated by the Parametric Event Logresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_NTEventLogOccurred Windows Event Logged Warning 68
5
67IBM Tivoli Monitoring Resource Model Reference
5.P
arametric
Even
tL
og
Reso
urce
Mo
del
Windows Event LoggedThis indication is sent when the user-specified event occurs and is logged in the Windowsevent log.
The indication has the following attributes:
EventIDIdentifies the event
RepeatCountThe number of Event ID events received during a cycle
LogfileThe name of the log file in which the event was generated (for example, system,security, or application).
SourceNameThe source of the event (Key attribute)
TimeGeneratedThe time that the event was generated
TimeWrittenThe time that the event was written to the Event Log
ComputerNameThe name of the computer where the event occurred (Key attribute)
MessageThe message text of the event
SeverityThe severity of the event
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
68 Version 5.1.1
ThresholdsNo particular threshold is exceeded to generate this indication. If an event in the Event Logis within the first set of events (determined by MostNumberOfLogs) and has the Event ID of9, this indication is sent.
ParametersThe following table lists the parameters that can be set for this resource model.
Parameter Description Default
Event IDs (Eids) Allows you to specify the number of the required eventIDs to be monitored. This must be the value of the eventID from the Windows event log.
Numeric list
Event Severity (Severity) Allows you to specify the severity of the events to bemonitored. You can choose any of the following severitylevels:
¶ Information: Set to Harmless on Tivoli EnterpriseConsole server. Default: False
¶ Warning. Default: False
¶ Error: Set to Minor on Tivoli Enterprise Consoleserver. Default: False
¶ Audit success: Set to Harmless on Tivoli EnterpriseConsole server. Default: False
¶ Audit failure: Set to Minor on Tivoli EnterpriseConsole server. Default: False
Boolean list
Log File Type (LogType) The type of log file that you are interested in. You canchoose any of the following types:
SecurityRecords security events. Default: False
SystemRecords events logged by the Windows NTsystem components. Default: False
ApplicationRecords events logged by applications. Default:False
Boolean list
Windows 2000 Logs(Win2kLogs)
The type of Windows 2000 file that you are interestedin. You can choose any of the following types:
¶ Directory Services. Default: False
¶ File Replication. Default: False
¶ DNS Server. Default: False
Boolean list
Source (Source) The source of the event log. This is the software thathas logged the event. The software can be either anapplication or a system component, such as a driver. Thename of the source must be as shown in the WindowsNT or Windows 2000 event log.
String list
Thresholds
69IBM Tivoli Monitoring Resource Model Reference
5.P
arametric
Even
tL
og
Reso
urce
Mo
del
Parameter Description Default
Computers (Computers) The computer which originated the event. You mustspecify the exact name of the computer, as shown in theWindows NT or Windows 2000 event log.
String list
Filter Type (FilterType) The type of filter applied to the parameters specifiedwith this dialog. You can select an AND or OR filter.The AND filter will trigger an event only when all ofthe conditions specified by the other parameters are met.The OR filter will trigger an event when any one of theconditions specified by the other parameters is met. Thedefault value is AND.
Choice list
Parameters
70 Version 5.1.1
Parametric Services Resource Model
This chapter describes the Parametric Services resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_ParamServices
Category Windows
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The resource model allows you to monitor the services you require.
Indications and EventsThe following table lists the event that can be generated by the Parametric Services resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_ParamServicesFailingService Services Failing Service Critical 72
TMW_ParamServicesStoppedService Services Stopped Service Critical 73
6
71IBM Tivoli Monitoring Resource Model Reference
6.P
arametric
Services
Reso
urce
Mo
del
Services Failing ServiceThis indication is sent when one of the listed services is not stable. This can cause problemsfor the local machine and for connected machines over the network. Services that are notstable should be stopped to prevent them from causing any bottlenecks or damage.
The indication has the following attributes:
NameThe name of the service being examined (Key attribute)
StartModeThe start mode of the service
State The current state of the service
ServiceStatusThe current status of the service
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
72 Version 5.1.1
|||
Services Stopped ServiceThis indication is sent when one of the listed services is stopped. If a key service is stopped,it must be restarted to ensure Windows is working properly.
The indication has the following attributes:
Name The name of the service being examined (Key attribute)
StartModeThe start mode of the service
ServiceStatusThe current status of the service
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
73IBM Tivoli Monitoring Resource Model Reference
||
6.P
arametric
Services
Reso
urce
Mo
del
ParametersThe single parameter that can be set for this resource model is Services (services). It is astring list. You must specify the exact name of the service, as defined in the Registry underthe following key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
The following lists the default services that can be monitored with the Parametric Servicesresource model:
¶ lcfd
¶ LanmanWorkstation
¶ LanmanServer
¶ NtLmSsp
¶ Netlogon
¶ EventLog
¶ Browser
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Service Services StatusState The state of the service
Status The status of the service
Service The service being monitored
Parameters
74 Version 5.1.1
Parametric TCP/IP Ports Resource Model
This chapter describes the Parametric TCP/IP Ports resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_ParamPorts
Category Windows
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
This resource model checks the TCP and UDP port numbers you specify and generatesevents whenever these ports are in a specified state or states. You can customize thisresource model to monitor the state of TCP/IP ports used by an application.
The resource model includes the information provider file NetworkPortInfoProvider.dll.
PrerequisitesThe parametric TCP/IP ports resource model requires TCP/IP and SNMP to be installed.
Indications and EventsThe following table lists the event that can be generated by the Parametric TCP/IP Portsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_ParamPortStatus State of the Defined Port Warning 76
7
75IBM Tivoli Monitoring Resource Model Reference
7.P
arametric
TC
P/IP
Po
rtsR
esou
rceM
od
el
State of the Defined PortThis indication is sent when both of the conditions set by the parameters Port Number andPossible State of a Port are met.
The indication has the following attributes:
LocalPortThe port number (Key attribute)
LocalPortNameThe name of the port being monitored
State Indicates the state of the port being monitored
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
76 Version 5.1.1
ParametersThe following table lists the parameters that can be set for this resource model. Together, theparameters function as a filter.
Parameter Description Default
Port Numbers(ParamPortList)
Allows you to specify the port numbers to be monitored. Numeric list
Possible State of a Port(ParamPortStatusList)
Allows you to specify the state of the defined port orports to be monitored. Ports can be monitored for one ormore of the following states:
¶ LISTENING. Default: False
¶ CLOSED. Default: True
Boolean list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Port Port StateState The state of the port
Port The port
Parameters
77IBM Tivoli Monitoring Resource Model Reference
7.P
arametric
TC
P/IP
Po
rtsR
esou
rceM
od
el
Logging
78 Version 5.1.1
Physical Disk Resource Model
This chapter describes the Physical Disk resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_PhysicalDiskModel
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Physical Disk resource model detects bottlenecks specifically associated with allphysical disks that are configured on the system. This model highlights the followingproblems:
¶ Bytes transferred per second
Bytes transferred per second indicates the raw amount of data that is transferred throughthe disk. The maximum bytes per second a disk subsystem can handle depends on thetype of hard drive, the type of controller, the drive configuration, and, in the case ofmost IDE-based hard drives, the speed of the CPU. Bytes transferred per second can bea good indicator of whether or not too much data is being pushed through the disk.
¶ Percentage usage
Another indicator that a disk is being over worked or is causing a bottleneck is thepercentage usage of the disk. This particular threshold often needs to be altered whenmonitoring file servers for bottlenecks.
File servers, along with print and mail servers, can expect the percentage usage to beconsistently high and are generally expected to show high use. However, in the case ofworkstations, these machines should typically see high percentage usage of disks in shortbursts.
8
79IBM Tivoli Monitoring Resource Model Reference
8.P
hysical
Disk
Reso
urce
Mo
del
Workstations experiencing high disk usage will often see declining performance in CPUspeed and general system response. In these situations, a high percentage usage of thedisk is generating a bottleneck.
PrerequisitesThis resource model requires disk counters to be enabled on the Windows endpoints.
To enable disks counters, perform the following steps on each endpoint:
1. On Windows NT systems, issue the diskperf -y command.
On Windows 2000 systems, issue the diskperf -yv command.
2. Reboot the system.
Indications and EventsThe following table lists the events that can be generated by the Physical Disk resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_HighPhysicalPercentDiskTime High Percent Disk Time Warning 81
TMW_HighPhysicalDiskReadBytesSec High Read Bytes per Second Minor 82
TMW_HighPhysicalDiskXferRate High Transfer Rate Minor 83
TMW_HighPhysicalDiskWriteBytesSec High Write Bytes per Second Minor 84
TMW_PhysicalPossibleFrag Physical Disk PossibleFragmentation
Minor 85
TMW_SlowPhysicalDrive Slow Physical Drive Warning 86
Overview
80 Version 5.1.1
High Percent Disk TimeThis indication is sent when a physical disk is in heavy use, and the drive cannot process therequests fast enough. This lengthens the queue.
The indication has the following attributes:
PercentDiskTimeThe percentage of time that the physical drive is being used
PercentWriteTimeThe percentage of time that the physical drive is used for write operations
PercentReadTimeThe percentage of time that the physical drive is being used for read operations
PhysicalDiskThe physical disk on which the physical disk resides (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
This threshold must not be exceeded. 1 572 864
High Queue Length(HighQLength)
The maximum number of outstanding requests, includingthose in progress, on the disk exceeds this threshold.
3
High Percent Usage(HighPercentUsage)
The time spent by the selected disk to work exceeds thisthreshold.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
81IBM Tivoli Monitoring Resource Model Reference
8.P
hysical
Disk
Reso
urce
Mo
del
High Read Bytes per SecondThis indication is sent when a physical drive is in heavy use reading data.
The indication has the following attributes:
PercentDiskReadThe percentage of the physical drive being used to read data
DiskReadBytesSecThe number of bytes read per second on the physical disk
DiskReadSecThe number of transactions that are read per second on the physical disk
PhysicalDiskThe physical disk being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The amount of bytes transferred per second (beingwritten or read) exceeds this threshold.
1 572 864
High Percent Usage(HighPercentUsage)
The percent of time that the selected disk drive spendsfor read or write requests exceeds this threshold.
90
High Queue Length(HighQLength)
This threshold must not be exceeded. 3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
82 Version 5.1.1
High Transfer RateThis indication is sent when a physical disk is used heavily to transfer data, both for readingand writing.
The indication has the following attributes:
DiskXfersSecThe rate of bytes read or written per second on the physical disk
DiskReadsSecThe rate of bytes read per second on the physical disk
DiskWritesSecThe rate of bytes written per second on the physical disk
PercentDiskReadTimeThe percentage of the physical drive used for read operations
PercentDiskWriteTimeThe percentage of the physical drive used for write operations
PhysicalDiskThe physical disk being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk read or write bytes per second exceed thisthreshold.
1572864
High Percent Usage(HighPercentUsage)
The percentage of time that the physical drive spendsfor read or write requests exceeds this threshold.
90
High Queue Length(HighQLength)
This threshold must not be exceeded. 3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
83IBM Tivoli Monitoring Resource Model Reference
8.P
hysical
Disk
Reso
urce
Mo
del
High Write Bytes per SecondThis indication is sent when a physical disk is writing a lot of data.
The indication has the following attributes:
DiskWriteBytesSecThe number of bytes read per second on the physical disk
DiskWriteSecThe number of bytes read per second on the physical disk
PercentDiskWriteThe percent of the physical drive used during write operations
PhysicalDiskThe physical disk being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The amount of bytes written per second exceeds thisthreshold.
1572864
High Percent Usage(HighPercentUsage)
The percent of time that the selected disk drive spendsfor read or write requests exceeds this threshold.
90
High Queue Length(HighQLength)
This threshold must not be exceeded. 3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
84 Version 5.1.1
Physical Disk Possible FragmentationThis indication is sent when a high percentage of physical disk is being used, but the queuelength is not long, and bytes per second reading and writing are not high.
The indication has the following attributes:
PercentDiskTimeThe percentage of time that the physical drive is being used
DiskBytesSecThe read and write transfer rate per second
PhysicalDiskThe physical disk being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk bytes per seconds value does not exceed thisthreshold.
1572864
High Percent Usage(HighPercentUsage)
The time spent by the selected disk to work exceeds thisthreshold.
90
High Queue Length(HighQLength)
This threshold must not be exceeded. 3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
85IBM Tivoli Monitoring Resource Model Reference
8.P
hysical
Disk
Reso
urce
Mo
del
Slow Physical DriveThis indication is sent when the physical disk is too slow to keep up with the work it mustperform.
The indication has the following attributes:
CurrentDiskQLengthThe number of jobs waiting to be processed by the physical disk
PercentDiskTimeThe percentage of time that the physical disk is being used
AvgQLengthThe average queue length
AvgReadQLengthThe average queue length for read operations
AvgWriteQLengthThe average queue length for write operations
DiskReadBytesSecThe number of bytes read per second on the physical disk
DiskWriteBytesSecThe number of bytes read per second on the physical disk
PhysicalDiskThe physical disk being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Bytes per Second(HighBytesSec)
The disk bytes per seconds value exceeds this threshold. 1572864
High Queue Length(HighQLength)
The number of outstanding requests, including those inprogress, on the disk exceeds this threshold.
3
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 1
Indications and Events
86 Version 5.1.1
ThresholdsThe following table lists the thresholds that can be set for the Physical Disk resource model.For each threshold it shows the name, a short description, and the default value:
Threshold Description Default
High Bytes per Second(HighBytesSec)
This threshold determines how many bytes per second(either reading per second or writing per second) is toohigh. Different disk sub-systems have differentmaximums, so the default threshold value is targetedtowards the average physical disk.
1 572 864
High Percent Usage(HighPercentUsage)
This threshold determines what percent of time that theselected disk drive spends for read or write requests istoo high.
90
High Queue Length(HighQLength)
This threshold determines the maximum number ofoutstanding requests, including those in progress, on thedisk. This is an exact length, not an average over thetime interval.
3
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
PhysicalDisk Bytes TransferredPhysicalDisk
The physical disk to be measured
DiskBytesSecThe amount of bytes per second being written orread
Percent Disk UsagePhysicalDisk
The physical disk to be measured
PercentDiskTimeThe percentage of time that the Physical drive isbeing used
Queue LengthPhysicalDisk
The physical disk to be measured
AvgQLengthThe average queue length for jobs
Thresholds
87IBM Tivoli Monitoring Resource Model Reference
8.P
hysical
Disk
Reso
urce
Mo
del
Logging
88 Version 5.1.1
Printer Resource Model
This chapter describes the Printer resource model for Windows 2000 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_PrintModel
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 1200 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows 2000 endpoints only.
The Printer resource model determines if there are any bottlenecks in the print engine ofWindows 2000. These bottleneck checks include determining if a print queue is generatingan abnormally high amount of errors, if a print device is being overworked, and generalfunctionality of the print server.
The Printer resource model highlights the following problems:
¶ Printer Errors
If the number of errors is too high then this should be addressed as soon as possible.Various errors include not ready errors (the print device is off-line or has a pendingmessage), out of paper errors (if a print device is consistently running out of paper, thenthe administrator should look into upgrading the paper trays), and other job relatederrors.
¶ Percentage processor time
As with all processes, the print server utilizes the CPU. Monitoring the percentageprocessor time of the print server will help catch a potential bottleneck.
9
89IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
Indications and EventsThe following table lists the events that can be generated by the Printer resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_HighCurrentPercentTime High Current Percentage Time Warning 91
TMW_HighJobErrors High Job Errors Warning 92
TMW_HighJobErrorsPerDay High Job Errors Per Day Harmless 93
TMW_HighNotReadyErrors High Not Ready Errors Warning 94
TMW_HighNotReadyErrorsPerDay High Not Ready Errors Per Day Harmless 95
TMW_HighOutOfPaperErrors High Out Of Paper Errors Minor 94
TMW_HighOutOfPaperErrorsPerDay High Out Of Paper Errors PerDay
Harmless 97
Indications and Events
90 Version 5.1.1
High Current Percent TimeThis indication is sent when a job uses a lot of CPU on the print server.
The indication has the following attributes:
CurrentPercentTimeJobThe current percentage processor time being used by the print job
CurrentPercentTimeThe total current percentage usage of the CPU
JobObjectThe identity of the print job being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percent Processor(PercentProcessor)
This threshold indicates when a job has a percentageusage of the processor that is too high.
80
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
91IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
High Job ErrorsThis indication is sent when there is a high amount of job errors per cycle. This is typical ofcorrupted or bad drivers installed on either the workstation sending the print job, or theserver in which the printer is installed.
The indication has the following attributes:
JobErrorsThe total number of job errors
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Job Errors (JobErrors) This threshold indicates the number of job errors percycle that can occur before determining that a printer orprint device is experiencing excessive problems.
0
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
92 Version 5.1.1
High Job Errors Per DayThis indication is sent when there is a high amount of job related errors per day. This istypical of corrupted or bad drivers installed on either the workstation sending the print job,or the server in which the printer is installed.
The indication has the following attributes:
JobErrorsPerDayThe total number of job errors per day
TotalJobErrorsThe total number of job errors since the last reboot
SystemUpTimeDaysThe time, in days, that the system has been running
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Job Errors Per Day(JobErrorsPerDay)
This threshold indicates the number of job errors perday that can occur before determining that a printer orprint device is experiencing excessive problems.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
93IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
High Not Ready ErrorsThis indication is sent when the printing device is either offline or experiencing a paper jam.
The indication has the following attributes:
NotReadyErrorsThe total number of not ready errors
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Not Ready Errors(NotReadyErrors)
This threshold indicates how many not ready errors canoccur per cycle before determining that a printer or printdevice is experiencing excessive problems.
8
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
94 Version 5.1.1
High Not Ready Errors Per DayThis indication is sent when the printing device is either off-line or experiencing a paperjam.
The indication has the following attributes:
NotReadyErrorsPerDayThe total number of not ready errors, calculated per day
TotalNotReadyErrorsThe total number of not ready errors since the last reboot
SystemUpTimeDaysThe time that the system has been running, in days
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Not Ready Errors Per Day(NotReadyErrorsPerDay)
This threshold indicates how many not ready errors canoccur per day before determining that a printer or printdevice is experiencing excessive problems.
8
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
95IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
High Out Of Paper ErrorsThis indication is sent when the paper supply is insufficient for the job demand.
The indication has the following attributes:
OOPErrorsThe total number of out-of-paper errors
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Out Of Paper Errors(OutOfPaperErrors)
This is the maximum number of times per cycle, that aprint device can report an out-of-paper error beforedetermining that the print device is experiencing toomany out-of-paper errors in a cycle.
6
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
96 Version 5.1.1
High Out Of Paper Errors Per DayThis indication is sent when the paper supply is insufficient for the daily job demand.
The indication has the following attributes:
OOPErrorsPerDayThe total number of out-of-paper errors, calculated per day
TotalOOPErrorsThe total number of out of paper errors since the last reboot
SystemUpTimeDaysThe time that the system has been running, in days
PrintQueueThe print queue, or printer in Microsoft terms, being examined (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Out Of Paper Errors Per Day(OutOfPaperErrorsPerDay)
This threshold indicates the maximum number oftimes per day, that a print device can report an out ofpaper error before determining that the print device isexperiencing too many out of paper errors in a day.
6
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
97IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
ThresholdsThe following table lists the thresholds that can be set for the Printer resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Job Errors (JobErrors) This threshold indicates the number of job errors percycle that can occur before determining that a printeror print device is experiencing excessive problems.
0
Job Errors Per Day(JobErrorsPerDay)
This threshold indicates the number of job errors perday that can occur before determining that a printer orprint device is experiencing excessive problems.
10
Maximum Print Jobs(MostPrintJobs)
This threshold indicates the maximum number of printjobs that will be examined when looking forbottlenecks such as job errors per day, or a job’spercentage processor usage.
60
Maximum Print Queues(MostPrintQueues)
This threshold indicates the maximum number of printqueues (or in Microsoft terms, printers), that will beexamined when looking for bottlenecks such as notready errors and out of paper errors.
30
Not Ready Errors(NotReadyErrors)
This threshold indicates how many not ready errorscan occur per cycle before determining that a printeror print device is experiencing excessive problems.
0
Not Ready Errors Per Day(NotReadyErrorsPerDay)
This threshold indicates how many not ready errorscan occur per day before determining that a printer orprint device is experiencing excessive problems.
8
Out Of Paper Errors(OutOfPaperErrors)
This is the maximum number of times per cycle, thata print device can report an out-of-paper error beforedetermining that the print device is experiencing toomany out-of-paper errors in a cycle.
0
Out Of Paper Errors Per Day(OutOfPaperErrorsPerDay)
This threshold indicates the maximum number oftimes per day, that a print device can report an out ofpaper error before determining that the print device isexperiencing too many out of paper errors in a day.
6
Percent Processor(PercentProcessor)
This threshold indicates when a job has a percentageusage of the processor that is too high.
80
Thresholds
98 Version 5.1.1
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
PrintQueue ErrorsPrintQueue
The queue
JobErrorsThe number of jobs in error
NotReadyErrorsThe number of not ready errors
OutOfPaperErrorsThe out-of-paper errors
Logging
99IBM Tivoli Monitoring Resource Model Reference
9.P
rinter
Reso
urce
Mo
del
Logging
100 Version 5.1.1
Process Resource Model
This chapter describes the Process resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_Process
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Process resource model looks for bottlenecks relating to the processes running on thesystem. The Process resource model highlights the following problems:
¶ Handle leaks
The resource model performs a check to make sure there are no processes with a handleleak. If handle leaks go unchecked, other processes may not be able to run later.
¶ High CPU usage
Processes that have high CPU usage threaten the overall performance of the systembecause the CPU will not have much chance to perform requests made by otherprocesses and devices.
10
101IBM Tivoli Monitoring Resource Model Reference
10.P
rocess
Reso
urce
Mo
del
Indications and EventsThe following table lists the events that can be generated by the Process resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_ProcessHandleLeak Process Handle Leak Warning 102
TMW_ProcessHighCPU Process High CPU Critical 103
Process Handle LeakThis indication is sent when a process leaks handles.
The indication has the following attributes:
CurrentHanProcessIDThe process being monitored (Key attribute)
CurrentHandleCountThe current number of handles allocated to the process
ProcessThe process being monitored (Key attribute)
The top n processes (where n is the value of the Maximum Processes threshold) that have anumber of handles in excess of the Maximum Handles threshold, are compared with the topn processes from the previous cycle. Process IDs are matched and for each process presentin both cycles the number of handles in use is compared. If the handle count has increasedsince the last cycle for a process, an indication is sent. The following thresholds are used:
Threshold Description Default
Maximum Processes(MaxProcesses)
This threshold indicates the maximum number ofprocesses that will be compared. These processes will beordered from the process with the highest handle countto the lowest.
5
Maximum Handles(MaxHandles)
This threshold indicates the number of handles that aprocess can use, above which the process will beconsidered as a candidate for the Process Handle Leakindication.
300
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 40
Holes 1
Indications and Events
102 Version 5.1.1
Process High CPUThis indication is sent when a process is using too much CPU time.
The indication has the following attributes:
IDProcessThe process being monitored (Key attribute)
PrcPercentUserTimeThe percentage usage of the CPU that is being used by the process
PrcPercentPrivilegedTimeThe percentage privileged time of the CPU that is being used by the process
PrcPriorityBaseThe base priority of the process
ProcessThe process being monitored (Key attribute)
An indication is sent for each of the top n processes (where n is the value of the MaximumProcesses threshold) that have a CPU usage in excess of the High CPU Usage threshold.The full details of the thresholds are as follows:
Threshold Description Default
N/A The process ID is not equal to zero. N/A
High CPU Usage(HighCPUUse)
This threshold indicates when a process is using toomuch of the processor in terms of percentage usage.
60
Maximum Processes(MaxProcesses)
This threshold indicates the maximum number ofprocesses that will be taken into consideration for thisindication. These processes will be ordered from theprocess with the highest CPU usage to the lowest.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 20
Holes 3
Indications and Events
103IBM Tivoli Monitoring Resource Model Reference
10.P
rocess
Reso
urce
Mo
del
ThresholdsThe following table lists the thresholds that can be set for the Process resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
High CPU Usage(HighCPUUse)
This threshold indicates when a process is using toomuch of the processors in terms of percentage usage.
60
Maximum Processes(MaxProcesses)
For the Process Handle Leak indication, this thresholdindicates the maximum number of processes that will becompared. These processes will be ordered from theprocess with the highest handle count to the lowest. Forthe Process High CPU indication, this thresholdindicates the maximum number of processes that will betaken into consideration for this indication. Theseprocesses will be ordered from the process with thehighest CPU usage to the lowest.
5
Maximum Handles(MaxHandles)
This threshold indicates the number of handles that aprocess can use, above which the process will beconsidered as a candidate for the Process Handle Leakindication.
300
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Process Handle UsageProcess The name of the process
HandleCountThe number of handles allocated to the process
PercentProcessorTimeThe percent of processor time used by the process
ID The process
CPU UsageProcess The name of the process
PercentUserTimeThe percentage usage of the CPU that is being usedby the process
PercentPrivilegedTimeThe percentage privileged time of the CPU that isbeing used by the process
ID The process
Thresholds
104 Version 5.1.1
Processor Resource Model
This chapter describes the Processor resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_Processor
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Processor resource model detects bottlenecks happening within or from the CentralProcessing Unit (CPU). The Processor resource model highlights the following problems:
¶ High CPU usage
Because every process and every device on the system has to interact with the CPU,either directly or through a controller, it is imperative that the CPU is not beingextensively used by a single process or device for an extended period of time. Theremay be exceptions to this rule for certain application-based servers.
The system administrator needs ultimately to decide how much utilization one processmakes of the CPU for these situations. Tests to determine how busy a CPU are includechecking the percentage usage, the percentage interrupts, and the queue length.
¶ Multiple CPU problems
With systems running with more than one processor, it is not always obvious that a CPUmay not be working. A check is made to ensure that all CPUs are being utilized atapproximately the same rate.
If there are problems with a CPU, the CPU activity will either be abnormally high ortotally inactive, in either case this check will detect the CPU that is faulty.
11
105IBM Tivoli Monitoring Resource Model Reference
11.P
rocesso
rR
esou
rceM
od
el
Indications and EventsThe following table lists the events that can be generated by the Processor resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_BusyHardware Busy Hardware Warning 107
TMW_CPUCantKeepUpWithHW CPU Cannot Keep up with Hardware Critical 108
TMW_HWKeepingCPUBusy Hardware Keeping CPU Busy Warning 109
TMW_HighPercentUsageDelta High Percent Usage Delta Minor 110
TMW_HighProcesses High Processes Critical 111
TMW_ProcessorBusy Processor Busy Critical 112
Indications and Events
106 Version 5.1.1
Busy HardwareThis indication is sent when one or more devices installed on the system are tying up theCPU.
The indication has the following attributes:
PercentProcessorTimeThe total current percentage usage of the CPU
PercentInterruptTimeThe current percentage usage of the CPU as it handles interrupt requests
InterruptsSecThe number of interrupts per second that are passed to the CPU
ProcessorThe processor being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected to sustainthat rate for an extended amount of time.
80
High CPU Usage Interrupt(HighCPUUsageInterrupt)
This threshold indicates when a high percent of theCPU is being used for interrupt requests, generallymade by hardware devices.
20
High Interrupts per Second(HighInterruptsSec)
This threshold indicates the maximum rate at which thedevices installed on the system are accessing the CPU(interrupts per second)
600
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 15
Holes 3
Indications and Events
107IBM Tivoli Monitoring Resource Model Reference
11.P
rocesso
rR
esou
rceM
od
el
CPU Cannot Keep up with HardwareThis indication is sent when the CPU can not keep up with hardware requests.
The indication has the following attributes:
PercentProcessorTimeThe total current percentage usage of the CPU
PercentInterruptTimeThe current percentage usage of the CPU as it handles interrupt requests
InterruptsSecThe number of interrupts per second that are passed to the CPU
ProcessorThe processor being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected tosustain that rate for an extended amount of time.
80
High CPU Usage Interrupt(HighCPUUsageInterrupt)
This threshold indicates when a high percent of theCPU is being used for interrupt requests, generallymade by hardware devices.
20
High Interrupts per Second(HighInterruptsSec)
This threshold must not be exceeded. 600
Total CPUs Modifier(TotalCPUsMod)
This threshold is a modifier that is added to the totalnumber of CPUs in the system. The result is thethreshold that determines when the queue for thesystems processors is too long.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 15
Holes 3
Indications and Events
108 Version 5.1.1
Hardware Keeping CPU BusyThis indication is sent when the queue length is normal but CPU usage is high and a highpercent of the CPU is being used for interrupt requests. This keeps the CPU busy.
The indication has the following attributes:
PercentProcessorTimeThe total current percentage usage of the CPU
PercentInterruptTimeThe current percentage usage of the CPU as it handles interrupt requests
InterruptsSecThe number of interrupts per second that are passed to the CPU
ProcessorThe processor being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected tosustain that rate for an extended amount of time.
80
High CPU Usage Interrupt(HighCPUUsageInterrupt)
This threshold indicates when a high percent of theCPU is being used for interrupt requests, generallymade by hardware devices.
20
High Interrupts per Second(HighInterruptsSec)
This threshold must not be exceeded. 600
N/A The queue length must be normal. N/A
Total CPUs Modifier(TotalCPUsMod)
This threshold must not be exceeded. 10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 15
Holes 3
Indications and Events
109IBM Tivoli Monitoring Resource Model Reference
11.P
rocesso
rR
esou
rceM
od
el
High Percent Usage DeltaThis indication is sent when there is a high percentage of usage between multiple processorsinstalled on a system.
The indication has the following attributes:
PercentUsageFirstIdentifies what percent of the most used processor is being used
PercentUsageLastIdentifies what percent of the least used processor is being used
ProcessPercentProcessorTimeThe percentage processor time of the process with the highest percentage processortime
IDProcessThe process with the highest percentage processor time
ProcessorThe processor being monitored (Key attribute)
LowProcessorThe least used processor
ProcessThe name of the process with the highest percentage process time
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High Percent Usage Delta(HighPercentUsageDelta)
This threshold indicates the difference in percentageusage between the highest used CPU and the lowestused CPU.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console No
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 3
Indications and Events
110 Version 5.1.1
High ProcessesThis indication is sent when one or more processes have a CPU usage above the High CPUUsage Process threshold.
The indication has the following attributes:
HighProcessesThe total number of high usage processes
IDProcessThe process with the highest CPU usage
PercentProcessorTimeThe total percentage usage of the CPU
ProcessThe name of the process with the highest CPU usage that is active on the CPU
ProcessorThe processor being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected tosustain that rate for an extended amount of time.
80
High CPU Usage Interrupt(HighCPUUsageInterrupt)
This threshold indicates when a high percent of theCPU is being used for interrupt requests, generallymade by hardware devices.
20
High CPU Usage Process(HighCPUUsageProcess)
This threshold indicates the maximum percent of CPUusage for a single process allowed.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
111IBM Tivoli Monitoring Resource Model Reference
11.P
rocesso
rR
esou
rceM
od
el
Processor BusyThis indication is sent when CPU usage is high, but there do not seem to be any particularprocess or hardware requests.
The indication has the following attributes:
PercentProcessorTimeThe total current percentage usage of the CPU
PercentInterruptTimeThe current percentage usage of the CPU as it handles interrupt requests
PercentUserTimeThe percentage user time of the CPU
PercentPrivilegedTimeThe percentage privileged time of the CPU
ProcessorThe processor being monitored (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent of theCPU is being used. CPUs are expected to reach 100%marks quite often, but generally not expected to sustainthat rate for an extended amount of time.
80
High CPU Usage Process(HighCPUUsageProcess)
This threshold must not be exceeded. 40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 20
Holes 1
Indications and Events
112 Version 5.1.1
ThresholdsThe following table lists the thresholds that can be set for the Processor resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
High CPU Usage(HighCPUUsage)
This threshold indicates when a high percent ofthe CPU is being used. CPUs are expected toreach 100% marks quite often, but generally notexpected to sustain that rate for an extendedamount of time.
80
High CPU Usage Interrupt(HighCPUUsageInterrupt)
This threshold indicates when a high percent ofthe CPU is being used for interrupt requests,generally made by hardware devices.
20
High CPU Usage Process(HighCPUUsageProcess)
This threshold indicates the maximum percent ofCPU usage for a single process allowed.
40
High CPU Usage User Privilege(HighCPUUsageUserPriv)
This threshold indicates the maximum percent ofCPU usage by all the processes running. Thisvalue is obtained by adding the percent user timeand the percent privileged time
70
High Interrupts per Second(HighInterruptsSec)
This threshold indicates the maximum rate atwhich the devices installed on the system areaccessing the CPU (interrupts per second)
600
High Percent Usage Delta(HighPercentUsageDelta)
This threshold indicates the difference inpercentage usage between the highest used CPUand the lowest used CPU.
5
Total CPUs Modifier(TotalCPUsMod)
This threshold is a modifier that is added to thetotal number of CPUs in the system. The result isthe threshold that determines when the queue forthe systems processors is too long.The processorqueue length is the instantaneous length of theprocessor queue in units of threads. All processorsuse a single queue in which threads wait forprocessor cycles. This length does not include thethreads that are currently running.
10
Thresholds
113IBM Tivoli Monitoring Resource Model Reference
11.P
rocesso
rR
esou
rceM
od
el
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Processor Load BalanceDelta The percentage difference of usage between the
highest used processor and the least used
HighestPercentUsageIdentifies what percent of the most used processor isbeing used
LowestPercentUsageIdentifies what percent of the least used processor isbeing used
Interrupt TimeProcessor
The processor being monitored
InterruptsSecThe number of interrupts per second that are passedto the CPU
CPU UsageProcessor
The processor being monitored
PercentInterruptTimeThe current percentage usage of the CPU as ithandles interrupt requests
PercentProcessorTimeThe total current percentage usage of the CPU
PercentPrivilegedTimeThe percentage privileged time of the CPU
PercentUserTimeThe percentage user time of the CPU
System Processor Queue LengthProcessor
The processor being monitored
ProcessorQueueLengthThe queue length of the processor
Logging
114 Version 5.1.1
Server Performance Prediction ResourceModel
This chapter describes the Server Performance Prediction resource model for Windowssystems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_Spp
Category Windows
Thresholds No
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 30 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Server Performance Prediction resource model gathers data from Windows systems forthe Tivoli Decision Support Guide for Server Performance Prediction (Advanced Edition).This resource model does not have thresholds, indications or events.
PrerequisitesTo run this resource model the following prerequisites apply:
1. The logical and physical disk counters must be enabled (diskperf -y). A reboot isnecessary after the enablement.
2. The Network Monitor Agent must be installed prior to TCP/IP and the Network Interfaceperformance object must be available from the performance monitor.
3. The TCP/IP must be installed.
4. The SNMP must be installed.
12
115IBM Tivoli Monitoring Resource Model Reference
|
|
||
||
|
|
12.S
erverP
erform
ance
Pred
iction
ParametersThe following table lists the parameters that can be set for the Server PerformancePrediction resource model.
Parameter Description Default
Physical Disk Configuration(PhysicalDiskConf)
The instance for which you want the diskI/O and disk transfer rates calculated.
Values: 0-3.
Choice list
Network Interface Configuration(NetworkInterfacesConf)
The network interface for which you wantthe network interface values calculated.
Values: 1-4.
Choice list
Available Disk Space Configuration(DiskSpaceAvailableConf)
The instance for which you want theavailable disk space calculated.
Values: System Drive, All, C:, D:, E:, A:, allother drives.
Choice list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
LogicalDisk SPP Guide for NTLogicalDisk
The logical disk being monitored
FreeMB The free megabytes on the disk
Memory SPP Guide for NTMemory The memory being monitored
PageInputSecThe number of page inputs per second
PageOutputSecThe number of page outputs per second
Avail The available memory
NetworkInterface SPP Guide for NTPacketsOutboundErrors
The number of errors sending outbound packets
PacketsReceivedErrorsThe number of errors for packets being received
PacketsSentSecThe number of packets sent per second
PacketsReceivedSecThe number of packets received per second
NetworkInterfaceThe network interface card
Objects SPP Guide for NTObjects The objects being monitored
NumberOfProcessesThe number of processes running
Parameters
116 Version 5.1.1
Resource Context Properties
PhysicalDisk SPP Guide for NTPhysicalDisk
The physical disk being monitored
DiskBytesSecThe disk bytes per second being written or read
DiskXfersSecThe rate of bytes read or written per second on thephysical disk
System SPP Guide for NTSystem The name of the system being monitored
ProcessorQueueLengthThe length of the processor queue
PrcTotPrivTimeThe percentage privileged time of the CPU that isbeing used
PrcTotUserTimeThe percentage of total user time
PrcTotCpuTimeThe percentage of total CPU time
Logging
117IBM Tivoli Monitoring Resource Model Reference
12.S
erverP
erform
ance
Pred
iction
Logging
118 Version 5.1.1
Services Resource Model
This chapter describes the Services resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_Services
Category Windows
Thresholds Yes
Parameters No
Built-in actions Yes
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The Services resource model checks all installed services to make sure they are functioningcorrectly and that key services are running. It highlights the following problems:
¶ Key services
Some services are vital to the operation of Windows. The resource model checks thatkey services are not stopped to ensure proper functioning of the system.
¶ Unstable services
Services, like any other installed software, can become corrupted or unstable. Theresource model checks that all installed services are stable. Unstable services must bestopped to ensure they do not harm other functions of the system.
13
119IBM Tivoli Monitoring Resource Model Reference
13.S
ervicesR
esou
rceM
od
el
Indications and EventsThe following table lists the events that can be generated by the Services resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
TMW_ServicesFailingService Services Failing Service Critical 120
TMW_ServicesStoppedService Services Stopped Service Critical 121
Services Failing ServiceThis indication is sent when any service is not stable. Services that are not stable can causeproblems for the local machine and for connected machines over the network and should bestopped.
The indication has the following attributes:
NameThe name of the service being examined (Key attribute)
StartModeThe start mode of the service
State The current state of the service
ServiceStatusThe current status of the service
Because the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
120 Version 5.1.1
Services Stopped ServiceThis indication is sent when one of the key services is stopped. If a key service is stopped,it must be restarted to ensure Windows is working properly.
The indication has the following attributes:
Name The name of the service being examined (Key attribute)
StartModeThe start mode of the service
ServiceStatusThe current status of the service
Because the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
121IBM Tivoli Monitoring Resource Model Reference
13.S
ervicesR
esou
rceM
od
el
ThresholdsBecause the Service resource model determines primarily whether a service is runningcorrectly, there are no real numeric thresholds to be measured or exceeded. However, in thismodel, the threshold values act as numerical flags where 0 is false and any other number istrue. With this, the user can determine which services they want to monitor.
For example, in the threshold section, LanmanServer (Server service) is set to 1 meaning theresource model checks if the Server service is running. System Administrators may decidethat on certain systems the Server service does not need to run. On those systems they canchange the profile to set the Server threshold value to 0 and the resource model does notcheck if the Server service is running.
The following table lists the thresholds that can be set for the Services resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Browser (Browser) This threshold determines the smooth running of thebrowser service. If the browser threshold is set to 0, thebrowser service is not checked to ensure it has started.Use the browser service to create the list of computersand networks in the network neighborhood. It is alsoneeded so that the local machine is present on othernetwork neighborhoods throughout the local network.
1
EventLog (EventLog) This threshold determines whether the EventLog serviceis running correctly. If this threshold is set to 0, theEventLog service is not checked to ensure it has started.This service logs errors and information regarding thelocal machine. Important data can be found in the eventlog when an administrator is trying to correct amalfunctioning component of Windows.
1
LanmanServer(LanmanServer)
This threshold determines whether the LanmanServerservice is running correctly. This threshold is set to 0,the LanmanServer service is not checked to ensure it hasstarted. Better known as the Server service, this serviceis used to manage shares that are accessible to otherworkstations on the network. Without this service, nomachine can connect to the local machine.
1
LanmanWorkstation(LanmanWorkstation)
This threshold determines whether theLanmanWorkstation service is running correctly. Thisthreshold is set to 0, the LanmanWorkstation service cannot be checked to ensure it has started. This service isthe workstation service; it is the counterpart of theserver service. If it is not running, the local machine cannot connect to other machines on the network.
1
Tivoli endpoint (lcfd) This threshold determines whether the Tivoli endpointservice, which provides the endpoint with connectivityto the Tivoli Management Environment, is runningcorrectly. If the Tivoli endpoint threshold is set to 0, theTivoli endpoint service will not be checked to ensurethat it has started.
1
Thresholds
122 Version 5.1.1
Threshold Description Default
Netlogon (Netlogon) This threshold determines whether this service isrunning correctly. If the Netlogon threshold is set to 0,the Netlogon service is not checked to ensure it hasstarted. Use the Netlogon service when logging onto thelocal workstation as well as processing logon attemptsfrom remote machines. If the Net Logon service is notfunctioning properly, it is possible that nobody can logon to the system.
1
NtLmSsp (NtLmSsp) This threshold determines whether this service isrunning correctly. If the NtLmSsp threshold is set to 0,the NtLmSsp service is not checked to ensure it hasstarted. The NtLmSsp is the Windows LM SecuritySupport Provider. It provides Windows security toremote procedure call (RPC) programs that usetransports other than named pipes. This service does nothave to be running at all times, but if it is, this does notcause any problems.
1
Built-in ActionsThis resource model has the following built-in action:
Restart ServiceIf a key service is in a stopped or paused state, this action restarts the service. Thesystem administrator is also notified.
Thresholds
123IBM Tivoli Monitoring Resource Model Reference
13.S
ervicesR
esou
rceM
od
el
Built-in Actions
124 Version 5.1.1
TCP/IP Resource Model
This chapter describes the TCP/IP resource model for Windows systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TMW_TCPIP
Category Windows
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 180 seconds
Overview
Resource model distributionThis resource model should be distributed to Windows endpoints.
The TCP/IP resource model looks for bottlenecks found within the TCP/IP protocol. Ithighlights the following problems:
¶ Fragmented data
Fragmented datagrams are datagrams sent through the network that are incomplete.Fragments have to wait at their destination point to be reassembled.
When datagrams have to be reassembled, it requires CPU time that could otherwise beput to use servicing current processes or interrupt request. Therefore, excessivefragmented datagrams need to be minimized whenever possible.
¶ Network congestion
Congestion can be a big problem on any type of network. One way of diagnosingcongestion is to look for retransmitted TCP segments and high ping rates.
PrerequisitesThe TCP/IP resource model requires TCP/IP and SNMP to be installed.
14
125IBM Tivoli Monitoring Resource Model Reference
14.T
CP
/IPR
esou
rceM
od
el
Indications and EventsThe following table lists the events that can be generated by the resource model, the nameof the indication from which each event is generated, the default severity of the event, andwhere you can find a detailed description of the indication:
Event Indication Severity Page
TMW_HighFragRatio High Fragment Ratio Warning 127
TMW_HighPing High Ping Warning 128
TMW_SegmentsReXmit Segments ReXmit Warning 129
Indications and Events
126 Version 5.1.1
High Fragment RatioThis indication is sent when the ratio between fragmented datagrams received to totaldatagrams received is greater than the High Fragment Ratio threshold. This ratio rises themore the local network becomes congested, particularly with IP.
This particular indication is more of an informative indication, as it is usually a result ofsome other bottleneck. Indications coming from the Network Interface Card resource modelcan help determine the cause.
The indication has the following attributes:
FragsToDGRatioThe ratio of fragmented datagrams to total datagrams
DGReceivedSecThe number of datagrams received per second
DGSentSecThe number of datagrams being sent per second
DGSecThe number of datagrams transmitted per second
FragReceivedSecThe number of fragmented datagrams received per second
FragReassembledSecThe number of fragmented datagrams reassembled per second
The indication is generated when the following threshold is exceeded:
Threshold Description Default
High Fragment Ratio(HighFragRatio)
This threshold indicates a ratio between fragmenteddatagrams and datagrams received whole. It is used todetermine when this value becomes too high.
80
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
127IBM Tivoli Monitoring Resource Model Reference
14.T
CP
/IPR
esou
rceM
od
el
High PingThis indication is sent when a high amount of datagrams is being received compared to thenumber of segments, which is common when a system is being pinged excessively.
The indication has the following attributes:
DGReceivedSecThe number of datagrams received per second
SegmentsRcvdSecThe number of segments received per second
DGSentSecThe number of datagrams being sent per second
SegmentsSentSecThe number of segments being sent per second
DGSecThe number of datagrams transmitted per second
SegmentsSecThe number of segments transmitted per second
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Low Segments(LowSegments)
This threshold indicates the minimum TCP segments persecond. This threshold, used with the Moderate DGthreshold, determines whether a system is receiving ahigh number of pings.
10
Moderate DG(ModerateDG)
This threshold indicates when the rate of datagrams persecond are moderate. This should not be treated as athreshold indicating a high amount of datagrams, but asone that indicates an above normal threshold.
60
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
128 Version 5.1.1
Segments ReXmitThis indication is sent when TCP segments have to be resent. This indicates congestion onthe network with the TCP protocol. Indications from the Network Interface resource modelcan lend more insight.
The indication has the following attributes:
SegmentsReXmitSecThe number of segments retransmitted per second
DGSecThe number of datagrams transmitted per second
SegmentsSentSecThe number of segments being sent per second
FragsToDGRatioRatio of fragmented datagrams to total datagrams
The indication is generated when the following threshold is exceeded:
Threshold Description Default
High Segment Retransmitted(HighSegmenReXmit)
This threshold indicates the maximum TCP segmentsbeing retransmitted.
1
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
129IBM Tivoli Monitoring Resource Model Reference
14.T
CP
/IPR
esou
rceM
od
el
ThresholdsThe following table lists the thresholds that can be set for the TCP/IP resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
High Fragment Ratio(HighFragRatio)
This threshold indicates a ratio between fragmenteddatagrams and datagrams received whole. It is usedto determine when this value becomes too high.
80
High Segment Retransmitted(HighSegmenReXmit)
This threshold indicates the maximum TCP segmentsbeing retransmitted.
1
Low Segments(LowSegments)
This threshold indicates the minimum TCP segmentsper second. This threshold, used with the ModerateDG threshold, determines whether a system isreceiving a high number of pings.
10
Moderate DG (ModerateDG) This threshold indicates when the rate of datagramsper second are moderate. This should not be treatedas a threshold indicating a high amount of datagrams,but as one that indicates an above normal threshold.
60
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
TCPIP Segments RetransmittedTCP The protocol
SegmentsRetrasmittedThe number of segments retransmitted
Segments TrafficTCP Identifies the protocol
SegmentSentSecThe number of segments sent per second
SegmentsSecThe number of segments per second
SegmentRcvdSecThe number of segments received per second
IP Datagrams TrafficIP Identifies the protocol
DGSentSecThe number of datagrams sent per second
DGSec The number of datagrams per second
DGReceivedSecThe number of datagrams received per second
Fragments ReceivedIP Identifies the protocol
FragmentsReceivedSecThe number of fragments received per second
Thresholds
130 Version 5.1.1
Part II. Resource Models forUNIX/LinuxChapter 15. CPU Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
High CPU Overload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
High CPU Usage by System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Chapter 16. File Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
File Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
File Attributes Changed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
File not Present . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Chapter 17. File System Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Low Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Low Percent Space Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Fragmented File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Low Percentage of Available I-nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Chapter 18. Memory Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Low Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
131IBM Tivoli Monitoring Resource Model Reference
||
||
||
||
||
Low Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
System Thrashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Chapter 19. Network Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . 159Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
High Input Packets in Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
High Output Packets in Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
High Percentage Packet Collisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Interface Not Enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Interface Not Operational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Unknown Interface Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Chapter 20. Network RPC-NFS Resource Model . . . . . . . . . . . . . . . . . . . . . . . . 169Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
High NFS Buffer Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
High NFS Server Get-attribute Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
High NFS Server Read Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
High NFS Server Readlink Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
High NFS Server Write Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
High Duplicate RPC Server Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
High Retransmitted Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
High RPC Bad Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
High Timeouts and Badxids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
High Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Slow Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Chapter 21. Process Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
132 Version 5.1.1
||
||
High Number of Zombie Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Process Consuming High CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Process Killed or Nonexistent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Process Stopped . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Thresholds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Chapter 22. Security Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Duplicate Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Nonexistent File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
High Log-in Number for User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Illegal Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Illegal Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Account not Valid for Root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Null Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Suspect Supergroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Suspect Superuser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Wrong File Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Description of the .mof File Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Chapter 23. Server Performance Prediction Resource Model . . . . . . . . . . 201Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
133IBM Tivoli Monitoring Resource Model Reference
||
||
134 Version 5.1.1
CPU Resource Model
This chapter describes the CPU resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXCpu
Category UNIX/Linux
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
This resource model detects problems with the central processing unit (CPU) of a computer,for example, how long processes wait in the queue to be processed.
Indications and EventsThe following table lists the events that can be generated by the CPU resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:
Event Indication Severity Page
Low_IdleCPUUsage High CPU Overload Warning 136
High_SysCPUUsage High CPU Usage by System Warning 137
15
135IBM Tivoli Monitoring Resource Model Reference
15.C
PU
Reso
urce
Mo
del
High CPU OverloadThis indication is sent if a low percentage of CPU is idle.
The indication has the following attributes:
percidlecpuThe percent of CPU that is idle
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of CPU in Idle(IdleCPUTimeThr)
This threshold indicates the minimum percentage ofCPU that should be idle to maintain satisfactory systemperformance.
20
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
136 Version 5.1.1
High CPU Usage by SystemThis indication is sent when a high percentage of CPU is used for system requests.
The indication has the following attributes:
percsyscpuusageThe percent of CPU time spent on system requests
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of CPU Used by System(SysCPUTimeThr)
This threshold measures the percentage ofCPU required for service system requests.
80
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
137IBM Tivoli Monitoring Resource Model Reference
15.C
PU
Reso
urce
Mo
del
ThresholdsThe following table lists the thresholds that can be set for the CPU resource model. For eachthreshold it shows the name, a short description, and the default value:
Threshold Description Default
Percentage of CPU in Idle(IdleCPUTimeThr)
This threshold indicates the minimumpercentage of CPU that should be idle tomaintain satisfactory system performance.
20
Percentage of CPU Used by System(SysCPUTimeThr)
This threshold measures the percentage ofCPU required for service system requests.
80
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
CPU Percent usagename Identifies the single instance
prcIdleTimeThe percent of the time that the CPU is idle.
prSysTimeThe percent of the time that the CPU in systemmode.
prcUserTimeThe percent of the time that the CPU is in usermode.
CPU Average Loadingname Identifies the single instance
loadAvg1The number of processes running every minute
loadAvg5The number of processes running every 5 minutes
loadAvg15The number of processes running every 15 minutes
Description of the .mof File PropertiesThis section lists all properties used by the DMXCpu.mof file for the CPU resource model.This .mof file uses one CIM class: DMXCpu.
Property Type Description
idleTime NUMERIC The percent of the time that the CPU is idle
userTime NUMERIC The percent of the time that the CPU is in usermode.
sysTime NUMERIC The percent of the time that the CPU is insystem mode.
loadAvg1 NUMERIC The number of processes running every minute.
Thresholds
138 Version 5.1.1
|
||
||||
|||
||||
||||
|||
Property Type Description
loadAvg5 NUMERIC The number of processes running every 5minutes.
loadAvg15 NUMERIC The number of processes running every 15minutes.
Description of the .mof File Properties
139IBM Tivoli Monitoring Resource Model Reference
|||
||||
||||
15.C
PU
Reso
urce
Mo
del
Description of the .mof File Properties
140 Version 5.1.1
File Resource Model
This chapter describes the File resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXFile
Category UNIX/Linux
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
The File resource model gives information about files in the system.
Indications and EventsThe following table lists the events that can be generated by the File resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:
Event Indication Severity Page
FileChanged File Changed Warning 142
FilesAttributeChange File Attributes Changed Warning 143
FileNotPresent File not Present Warning 144
16
141IBM Tivoli Monitoring Resource Model Reference
16.F
ileR
esou
rceM
od
el
File ChangedThis indication is sent when the file checksum or the file modification time changes.
The indication has the following attributes:
pathnameThe path name of the file being monitored (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
142 Version 5.1.1
File Attributes ChangedThis indication is sent when the date and time of last updates to file are different from theprevious cycle.
The indication has the following attributes:
pathnameThe path name of the file being monitored (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
143IBM Tivoli Monitoring Resource Model Reference
16.F
ileR
esou
rceM
od
el
File not PresentThis indication is sent when the user tries to monitor a file that does not exist on themachine, for example, because it was deleted.
The indication has the following attributes:
pathnameThe path name of the file being monitored (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
144 Version 5.1.1
ParametersThe following table lists the parameters that can be set for the File resource model.
Parameter Description ParameterType
Files to Be Checked(FileList)
The files that you want to monitor. Enter the file details,separated by the pipe character, in the field to the left ofthe Add button in the following format:
path_filename
String list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
File File Timespathname
The file path
modificationTimeThe time when the contents of file change
changeTimeThe time when the file attributes change
File ChecksumfileName The filename
size The filesize
checksumThe checksum that changes
Description of the .mof File PropertiesThis section lists all properties used by the DMXFile.mof file for the File resource model.This .mof file uses one CIM class: DMXFile.
Property Type Description
pathName STRING The file path name.
size NUMERIC The file size (in bytes).
accessTime NUMERIC The time when the file is accessed (number ofseconds since the standard UNIX Epoch,00:00:00 January 1, 1970 UTC).
modificationTime NUMERIC The time when the contents of the file change(number of seconds since the standard UNIXEpoch, 00:00:00 January 1, 1970 UTC).
changeTime NUMERIC The time when the file atrributes change (numberof seconds since the standard UNIX Epoch,00:00:00 January 1, 1970 UTC).
crc32 NUMERIC The 32-bit cycle redundance code.
Parameters
145IBM Tivoli Monitoring Resource Model Reference
|
||
||||
|||
|||
|||||
|||||
|||||
|||
16.F
ileR
esou
rceM
od
el
Description of the .mof File Properties
146 Version 5.1.1
File System Resource Model
This chapter describes the File System resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXFileSystem
Category UNIX/Linux
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
This resource model measures how efficiently the file systems are being used.
Indications and EventsThe following table lists the events that can be generated by the File System resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
LowKAvail Low Space Available Critical 148
LowPercSpcAvail Low Percent Space Available Critical 148
FragmentedFileSystem Fragmented File System Minor 149
LowPercInodesAvail Low Percentage of AvailableI-nodes
Warning 150
17
147IBM Tivoli Monitoring Resource Model Reference
17.F
ileS
ystemR
esou
rceM
od
el
Low Space AvailableThis indication is sent when the available number of kilobytes on the specified file systemgoes below the threshold.
The indication has the following attributes:
n_availThe number of kilobytes available on the specified disk drive.
mountnameThe mount point on which the file system is mounted. (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Available Space (KB)(AvailableSpace)
This threshold indicates the minimum amount ofavailable space (KB) that is required on the file system.
7000
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Low Percent Space AvailableThis indication is sent when the percent space available to the specified file system goesbelow the threshold.
The indication has the following attributes:
PercSpcAvailThe percent space available.
mountnameThe mount point on which the file system is mounted. (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percent Available Space(KB) (PrcAvailKspace)
This threshold indicates the minimum percentage of filesystem space that is being available.
15
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
148 Version 5.1.1
|
||
|
||
||
|
||||
|||||
|
|
|||
||
||
||
||
Fragmented File SystemThis indication is sent when the number of used i-nodes is high but the used file systemspace is relatively low.
The indication has the following attributes:
percinodeusedThe percentage of used i-nodes in the file system
perckbusedThe percentage of space being used by the file system
mountnameThe mount point on which the file system is mounted (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of File System SpaceUsed (PrcUsedKspace)
This threshold indicates the maximumpercentage of file system space that is beingused.
85
Percentage of I-nodes Used(PrcUsedInodes)
This threshold indicates the maximumpercentage of file system space that can bededicated to i-nodes without causing highfragmentation of the file system.
80
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
149IBM Tivoli Monitoring Resource Model Reference
17.F
ileS
ystemR
esou
rceM
od
el
Low Percentage of Available I-nodesThis indication is sent when the percentage of available i-nodes is below the threshold.
The indication has the following attributes:
percavailinodesThe percentage of available i-nodes
mountnameThe mount point on which the file system is mounted (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of Available I-nodes(PrcAvailInodes)
This threshold indicates the minimum percentageof file system space available for i-nodes.
20
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
150 Version 5.1.1
ThresholdsThe following table lists the thresholds that can be set for the File System resource model.For each threshold it shows the name, a short description, and the default value:
Threshold Description Default
Available Space (KB) (AvailableSpace) This threshold indicates the minimumamount of available space (KB) that isrequired on the file system.
7000
Percent Available Space (KB)(PrcAvailKspace)
This threshold indicates the minimumpercentage of file system space that is beingavailable.
15
Percentage of Available I-nodes(PrcAvailInodes)
This threshold indicates the minimumpercentage of file system space availablefor i-nodes.
20
Percentage of File System Space Used(PrcUsedKspace)
This threshold indicates the maximumpercentage of file system space that must beavailable.
80
Percentage of I-nodes Used(PrcUsedInodes)
This threshold indicates the maximumpercentage of file system space that can bededicated to i-nodes without causing highfragmentation of the file system.
80
ParametersThe following table lists the parameters that can be set for the File System resource model.
Parameter Description ParameterType
Ignored File Systems(IgnoredFileSystems)
The file systems that you want to ignore. Insert here thelist of the file systems that you want ignore. Correctsintax is:<File Systems>
String list
File Systems To MonitorWith Different Thresholds(FileSystemsToMonitorDiffThres)
Insert here the File Systems’ names that you wantmonitor with different thresholds by default. The correctsintax is:
<FS name> | a | b | c | d | e Where:
¶ a is: Percent of I-nodes used
¶ b is: Percent of FS used space
¶ c is: Avalaible space (in Kbytes)
¶ d is: Percent of available I-nodes
¶ e is: Percent of FS available space
The ″–″ character can be used to set a threshold to thedefault value.
An error code ″11″ is returned if the syntax is incorrect.
String List
Thresholds
151IBM Tivoli Monitoring Resource Model Reference
|||||
|
|
|
|||||
|||||
|
||||
|||
|
|
|
|
|
|
||
|
|
17.F
ileS
ystemR
esou
rceM
od
el
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
File System File System Availabilitymountpoint
The mount point on which the file system ismounted.
percUsedThe percent of file system space that is being used
percInodesUsedThe percent of i-nodes being used
percAvailThe percent of file system space available
Description of the .mof File PropertiesThis section lists all properties used by the DMXFileSystem.mof file for the File Systemresource model. This .mof file uses one CIM class: DMXFileSystem.
Property Type Description
mountPoint STRING The mount point of the file system.
totalKBytes NUMERIC The total file system space (in kilobytes).
usedKBytes NUMERIC The file system space that is being used (inkilobytes).
availKBytes NUMERIC The file system space that is available (inkilobytes).
totalInodeNumber NUMERIC The total of i-nodes.
usedInodeNumber NUMERIC The i-nodes being used.
availInodeNumber NUMERIC The available i-nodes.
Logging
152 Version 5.1.1
||
|
||
||||
|||
|||
||||
||||
|||
|||
|||
Memory Resource Model
This chapter describes the Memory resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXMemory
Category UNIX-Linux
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
This resource model provides information about how the memory is used.
Indications and EventsThe following table lists the events that can be generated by the Memory resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
LowStorage Low Storage Space Critical 154
LowSwap Low Swap Space Critical 155
Thrashing System Thrashing Critical 156
18
153IBM Tivoli Monitoring Resource Model Reference
18.M
emo
ryR
esou
rceM
od
el
Low Storage SpaceThis indication is sent when the percentage of available storage space in the system is lowerthan the threshold.
The indication has the following attributes:
percavailstorageThe percentage of available storage space
totavailstorageThe available storage space in kilobytes
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of Available Virtual Storage(AvailVirtualStorage)
This threshold measures the percentageof total virtual storage that is available.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 20
Holes 0
Indications and Events
154 Version 5.1.1
Low Swap SpaceThis indication is sent when the percentage of swap space available on the system goesbelow the threshold.
The indication has the following attributes:
percavailswapThe percentage of available swap space
totavailswapThe available swap space in kilobytes
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of Available Swap Space(SwapSpacePrc)
This threshold indicates the minimumpercentage of all swap space that must beavailable.
30
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 0
Indications and Events
155IBM Tivoli Monitoring Resource Model Reference
18.M
emo
ryR
esou
rceM
od
el
System ThrashingThis indication is sent when there is excessive or unusual system paging, for example, whenthe page-in or page-out rate exceeds the threshold.
The indication has the following attributes:
pageins The rate of paging in
pageouts The rate of paging out
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Memory Page-in Rate(PageInRate)
This threshold indicates the maximum occurrences ofpaging in per second, as averaged over the cycle.
400
Memory Page-out Rate(PageOutRate)
This threshold indicates the maximum occurrences ofpaging out per second, as averaged over the cycle.
400
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 0
Indications and Events
156 Version 5.1.1
ThresholdsThe following table lists the thresholds that can be set for the Memory resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Memory Page-in Rate (PageInRate) This threshold indicates the maximumoccurrences of paging in per second, asaveraged over the cycle.
400
Memory Page-out Rate (PageOutRate) This threshold indicates the maximumoccurrences of paging out per second, asaveraged over the cycle.
400
Percentage of Available Swap Space(SwapSpacePrc)
This threshold indicates the minimumpercentage of all swap space that must beavailable.
30
Percentage of Available Virtual Storage(AvailVirtualStorage)
This threshold measures the percentage oftotal virtual storage that is available.
40
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Memory Memory Pagingname Identifies the single instance
pageInsRateThe rate of paging in for the cycle
pageOutsRateThe rate of paging out for the cycle
Memory Memory Availabilityname Identifies the single instance
PrcAvailSwapThe percent of swap space that is available
PrcAvailStorageThe percentage of storage space that is available
Description of the .mof File PropertiesThis section lists all properties used by the DMXMemory.mof file for the Memory resourcemodel. This .mof file uses one CIM class: DMXMemory.
Property Type Description
totalSwapSpace NUMERIC The total swap space (in kilobytes)
usedSwapSpace NUMERIC The used swap space (in kilobytes)
availSwapSpace NUMERIC The available swap space (in kilobytes)
pageInsRate NUMERIC Paging in per second (pages/sec)
pageOutsRate NUMERIC Paging out per second (pages/sec)
Thresholds
157IBM Tivoli Monitoring Resource Model Reference
|
||
||||
|||
|||
|||
|||
|||
18.M
emo
ryR
esou
rceM
od
el
Property Type Description
totalVirtualStorage NUMERIC The total virtual storage (in kilobytes)
usedVirtualStorage NUMERIC The used virtual storage (in kilobytes)
availVirtualStorage NUMERIC The available virtual storage (in kilobytes)
Description of the .mof File Properties
158 Version 5.1.1
|||
|||
|||
|||
Network Interface Resource Model
This chapter describes the Network Interface resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXNetworkInterface
Category UNIX/Linux
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 150 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
The Network Interface resource model detects problems with the following installed networkinterfaces
¶ Loopback
¶ Ethernet
¶ Token-Ring
Events are generated when performance data, such as bytes per second in and out andsessions with errors or requests, become critical.
Note: To run this resource model on AIX and HP endpoints, the SNMP deamon must beactive.
Indications and EventsThe following table lists the events that can be generated by the resource model, the nameof the indication from which each event is generated, the default severity of the event, andwhere you can find a detailed description of the indication:
19
159IBM Tivoli Monitoring Resource Model Reference
19.N
etwo
rkIn
terfaceR
esou
rceM
od
el
Event Indication Severity Page
HighInputErrPacks High Input Packets in Error Warning 160
HighOutErrorPacks High Output Packets in Error Warning 161
HighPacktsCollision High Percentage Packet Collisions Critical 162
InterfaceNotEnabled Interface Not Enabled Warning 163
InterfaceNotOperat Interface Not Operational Warning 164
IntStatUnknown Unknown Interface Status Critical 165
High Input Packets in ErrorThis indication is sent when a high percentage of input packets are going into error.
The indication has the following attributes:
totinpacksThe total input packets
percinerrpacksThe percentage of input packets that are going into error
interfacenameThe network interface (Key attribute)
interfacetypeThe network interface type
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Input Packets in Error(PercInPacketErrThr)
This threshold indicates the maximum percentage ofinput packets in error allowed.
20
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
160 Version 5.1.1
High Output Packets in ErrorThis indication is sent when a high percentage of output packets are going into error.
The indication has the following attributes:
totoutpacksThe total output packets
percouterrpacksThe percentage of output packets that are going into error
interfacenameThe network interface (Key attribute)
interfacetypeThe network interface type
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Output Packets in Error(PercOutPacketErrThr)
This threshold indicates the maximum percentage ofoutput packets in error allowed.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
161IBM Tivoli Monitoring Resource Model Reference
19.N
etwo
rkIn
terfaceR
esou
rceM
od
el
High Percentage Packet CollisionsThis indication is sent when a high percentage of output packets are colliding. This indicatesthat the packets being sent might be corrupted or that there might be a network overload.
The indication has the following attributes:
totoutpacksThe total output packets
percPacktsCollisionThe percentage of packets that are colliding
interfacenameThe interface name (Key attribute)
interfacetypeThe interface card type
The indication is generated only if the system uses an Ethernet card and when the followingthreshold is exceeded:
Threshold Description Default
Packet Collision Percentage(PercPacketCollisionThr)
This threshold indicates the maximum percentage ofcorrupted packets allowed.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
162 Version 5.1.1
Interface Not EnabledThis indication is sent when the interface status is not up
The indication has the following attributes:
interfacenameThe name of the network interface (Key attribute)
interfacetypeThe type of the interface card
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
163IBM Tivoli Monitoring Resource Model Reference
19.N
etwo
rkIn
terfaceR
esou
rceM
od
el
Interface Not OperationalThis indication is sent when the interface has been enabled, but is not in a running state. Theinterface driver might not be correctly installed.
The indication has the following attributes:
interfacenameThe name of the network interface (Key attribute)
interfacetypeThe type of interface card
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
164 Version 5.1.1
Unknown Interface StatusThis indication is sent when the status of the monitored interface can not be retrieved.
The indication has the following attributes:
interfacenameThe name of the network interface (Key attribute)
intercafetypeThe type of interface card
interfacestatusThe status of the interface card
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
165IBM Tivoli Monitoring Resource Model Reference
19.N
etwo
rkIn
terfaceR
esou
rceM
od
el
ThresholdsThe following table lists the thresholds that can be set for the Network Interface resourcemodel. For each threshold it shows the name, a short description, and the default value:
Threshold Description Default
Input Packets in Error(PercInPacketErrThr)
This threshold indicates the maximum percentageof input packets in error allowed.
20
Output Packets in Error(PercOutPacketErrThr)
This threshold indicates the maximum percentageof output packets in error allowed.
10
Packet Collision Percentage(PercPacketCollisionThr)
This threshold indicates the maximum percentageof corrupted packets allowed.
10
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Network Interface CardInterfacename
The name of the interface card
InPacks The total number of input packets
InPacksErrThe percent of input packets in error
OutPacksThe total number of output packets
OutPackErrThe percent of output packets in error
OutPackCollThe percent of output packets colliding
Description of the .mof File PropertiesThis section lists all properties used by the DMXNetworkInterface.mof file for theNetwork Interface resource model. This .mof file uses one CIM class:DMXNetworkInterface.
Property Type Description
networkInterface STRING The name of the network interface card.
type STRING The type of interface card (″ETHERNET″,″TOKENRING″, ″LOOPBACK″,″NOTSUPPORTED″).
status STRING The interface status (″DOWN″,″UP&RUNNING″, ″UP&NOTRUNNING″,″UNKNOWN″).
deltaInPackets NUMERIC The delta number of input packets.
deltaInPacketsErr NUMERIC The delta number of input packets in error.
Thresholds
166 Version 5.1.1
|
|||
||||
|||
|||||
|||||
|||
|||
Property Type Description
deltaOutPackets NUMERIC The delta number of output packets.
deltaOutPacketsErr NUMERIC The delta number of output packets in error.
deltaCollisions NUMERIC The delta number of corrupted packets.
Description of the .mof File Properties
167IBM Tivoli Monitoring Resource Model Reference
|||
|||
|||
|||
19.N
etwo
rkIn
terfaceR
esou
rceM
od
el
Description of the .mof File Properties
168 Version 5.1.1
Network RPC-NFS Resource Model
This chapter describes the Network RPC-NFS resource model for Solaris systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXNetworkRPCNFS
Category Solaris
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 150 seconds
Overview
Resource model distributionThis resource model should be distributed to Solaris endpoints.
The Network RPC-NFS resource model detects problems and monitors the performance ofthe RPC and NFS servers and clients.
Indications and EventsThe following table lists the events that can be generated by the resource model, the nameof the indication from which each event is generated, the default severity of the event, andwhere you can find a detailed description of the indication:
Event Indication Severity Page
HighNFSBufferSize High NFS Buffer Size Warning 170
HighNFSSrvGetattr High NFS Server Get-attribute Operations Warning 171
HighNFSSrvRead High NFS Server Read Operations Warning 171
HighNFSSrvReadLink High NFS Server Readlink Operations Warning 173
HighNFSSrvWrites High NFS Server Write Operations Warning 174
HighPercDupReqs High Duplicate RPC Server Calls Warning 175
HighPercRetrans High Retransmitted Calls Critical 176
HighPercRPCBadCalls High RPC Bad Calls Warning 177
20
169IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
Event Indication Severity Page
HighTimeoutsAnd_Badxids High Timeouts and Badxids Warning 178
NetworkBusy High Network Traffic Warning 179
NetworkSlow Slow Network Warning 180
High NFS Buffer SizeThis indication is sent when the percentage of client RPC calls that were retransmitted ortimed out is too high, and there are no duplicate acknowledgements.
The indication has the following attributes:
totrpccallsThe total client RPC calls
percrpcretransThe percentage of client RPC calls that were retransmitted
percrpctimeoutsThe percentage of client RPC calls that timed out
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of Client RPC Calls in Time-out(RPCCLCallsToutPercThr)
This threshold indicates the maximumpercentage of timed-out client RPCcalls allowed to maintain acceptablenetwork traffic level.
5
Percentage of Client RPC Retransmissions(RPCCLRetransPercThr)
This threshold indicates the maximumof client RPC retransmissionsallowed.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
170 Version 5.1.1
High NFS Server Get-attribute OperationsThis indication is sent when the percentage of NFS server calls to read the client attributecache is too high.
The indication has the following attributes:
totnfssrvcallsThe total NFS server calls
percnfssrvgetattrThe percentage of NFS server requests to read the client attribute cache
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of NFS Server Getattr Operations(NFSSrvGettatrThr)
This threshold indicates the maximumpercentage of NFS server calls to readthe client cache attribute withoutimpacting NFS server performance.
40
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
171IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
High NFS Server Read OperationsThis indication is sent when the percentage of NFS server calls for read operations is toohigh.
The indication has the following attributes:
totnfssrvcallsThe total NFS server calls
percnfssrvreadThe percentage of NFS server calls for read operations
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of NFS Server Read Operations(NFSSrvReadThr)
This threshold indicates the maximumpercentage of NFS server readoperations allowed.
30
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
172 Version 5.1.1
High NFS Server Readlink OperationsThis indication is sent when the percentage of NFS server calls for readlink operationscompared to the total lookup calls on the NFS server is too high.
The indication has the following attributes:
totnfssrvlookupThe total lookup calls on the NFS server
percnfssrvreadlinkThe percentage of NFS server calls for readlink operations
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of NFS Server Readlink Operations(NFSSrvReadlinkThr)
This threshold indicates themaximum percentage of NFS serverread operations using symbolic linkson file systems exported by theserver.
10
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
173IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
High NFS Server Write OperationsThis indication is sent when the percentage of NFS server calls for write operations is toohigh.
The indication has the following attributes:
totnfssrvcallsThe total number of NFS server calls
percnfssrvwritesThe percentage of NFS server calls for write operations
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of NFS Server Write Operations(NFSSrvWriteThr)
This threshold indicates the maximumpercentage of NFS server writeoperations allowed without impactingNFS performance.
15
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
174 Version 5.1.1
High Duplicate RPC Server CallsThis indication is sent when the percentage of RPC server calls that are duplicates is toohigh. This can be due to transmission problems.
The indication has the following attributes:
totrpcsrvdupreqsThe total number of RPC server calls that are duplicate requests
percrpcsrvdupreqsThe percentage of RPC server calls that are duplicate requests
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of Server RPC Duplicate Requests(RPCSrvDupCallsThr)
This threshold indicates the maximumpercentage of duplicate RPC callsallowed.
60
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
175IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
High Retransmitted CallsThis indication is sent when the percentage of client RPC calls being retransmitted is toohigh.
The indication has the following attributes:
totrpccallsThe total number of RPC client calls
percrpcretransThe percentage of RPC client calls being retransmitted
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of Client RPC Retransmissions(RPCCLRetransPercThr)
This threshold indicates the maximum ofclient RPC retransmissions allowed.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 5
Holes 0
Indications and Events
176 Version 5.1.1
High RPC Bad CallsThis indication is sent when the percentage of RPC server or client calls being rejected bythe RPC is too high.
The indication has the following attributes:
totrpcsrvcallsThe total number of RPC server calls
percrpcsrvbadcallsThe percentage of RPC server calls being rejected
totrpcclcallsThe total number of RPC client calls
percrpcclbadcallsThe percentage of RPC client calls being rejected
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of Bad RPC Calls(RPCBadCallsPercThr)
This threshold indicates the maximum number ofbad RPC calls allowed to maintain acceptablenetwork performance. It refers to both client andserver RPC bad calls.
30
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 5
Holes 0
Indications and Events
177IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
High Timeouts and BadxidsThis indication is sent when the percentages of timed-out RPC client calls and badxids(duplicate acknowledgements) are too high.
The indication has the following attributes:
totrpccallsThe total number of RPC client calls
percrpctimeoutsThe percentage of timed-out RPC client calls
percrpcbadxidsThe percentage of badxids
name Identifies the single instance (Key attribute)
The indication is generated when the following thresholds are exceeded:
Threshold Description Default
Percentage of Client RPC Badxids(RPCCLBAdXidsPercThr)
This threshold indicates the maximumpercentage of badxids (duplicateacknowledgements) allowed by RPCclient maintaining acceptable networktraffic level.
5
Percentage of Client RPC Calls in Time-out(RPCCLCallsToutPercThr)
This threshold indicates the maximumpercentage of timed-out client RPCcalls allowed to maintain acceptablenetwork traffic level.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
178 Version 5.1.1
High Network TrafficThis indication is sent when the number of client RPC calls being retransmitted is close tothe client RPC calls timing out.
The indication has the following attributes:
numrpcretransThe number of RPC retransmissions
numrpctimeoutsThe number of timed-out RPC client calls
name Identifies the single instance (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
179IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
Slow NetworkThis indication is sent when the number of timed-out client RPC calls approaches thenumber of client RPC duplicate acknowledgements (badxids) for a single NFS request.
The indication has the following attributes:
numrpcbadcallsThe number of timed-out client RPC calls
numrpcdupacksThe number of client RPC duplicate acknowledgements (badxids) for a single NFSrequest
name Identifies the single instance (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
180 Version 5.1.1
ThresholdsThe following table lists the thresholds that can be set for the Network resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Percentage of Bad RPC Calls(RPCBadCallsPercThr)
This threshold indicates the maximumnumber of bad RPC calls allowed tomaintain acceptable networkperformance. It refers to both clientand server RPC bad calls.
30
Percentage of Client RPC Badxids(RPCCLBAdXidsPercThr)
This threshold indicates the maximumpercentage of badxids (duplicateacknowledgements) allowed by RPCclient maintaining acceptable networktraffic level.
5
Percentage of Client RPC Calls in Time-out(RPCCLCallsToutPercThr)
This threshold indicates the maximumpercentage of timed-out client RPCcalls allowed to maintain acceptablenetwork traffic level.
5
Percentage of Client RPC Retransmissions(RPCCLRetransPercThr)
This threshold indicates the maximumof client RPC retransmissions allowed.
5
Percentage of NFS Server Getattr Operations(NFSSrvGettatrThr)
This threshold indicates the maximumpercentage of NFS server calls to readthe client cache attribute withoutimpacting NFS server performance.
40
Percentage of NFS Server ReadlinkOperations (NFSSrvReadlinkThr)
This threshold indicates the maximumpercentage of NFS server readoperations using symbolic links on filesystems exported by the server.
10
Percentage of NFS Server Read Operations(NFSSrvReadThr)
This threshold indicates the maximumpercentage of NFS server readoperations allowed.
30
Percentage of NFS Server Write Operations(NFSSrvWriteThr)
This threshold indicates the maximumpercentage of NFS server writeoperations allowed without impactingNFS performance.
15
Percentage of Server RPC DuplicateRequests (RPCSrvDupCallsThr)
This threshold indicates the maximumpercentage of duplicate RPC callsallowed.
60
Thresholds
181IBM Tivoli Monitoring Resource Model Reference
20.N
etwo
rkR
PC
-NF
SR
esou
rceM
od
el
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
NFS Servername Identifies the single instance
NFScalls The NFS calls
NFSbadcallsThe NFS calls that are timed out
NFSgetattrThe NFS requests to read the client attribute cache
NFSread The NFS read operations
NFSwriteThe NFS write operations
NFSlookupThe lookup calls on the NFS server
NFSreadlinkThe NFS server calls for readlink operations
Clientname Identifies the single instance
NFScalls The NFS calls
NFSbadcallsThe NFS calls that are timed out
RPC Clientname Identifies the single instance
RPCcallsThe client RPC calls
RPCbadcallsThe number of timed-out client RPC calls
RPCretransThe RPC client calls being retransmitted
RPCbadxidsThe badxids
RPCtimeoutsThe client RPC calls that timed out
Servername Identifies the single instance
RPCCallsThe client RPC calls
RPCBadcallsThe number of timed-out client RPC calls
RPCDuprequestsThe RPC server calls that are duplicate requests
RPCDupchecksThe number of RPC server calls that are looked upin the duplicate request cache.
Logging
182 Version 5.1.1
Process Resource Model
This chapter describes the Process resource model for UNIX systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXProcess
Category UNIX/Linux
Thresholds Yes
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 60 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
The Process resource model looks for bottlenecks in running processes. Problems highlightinclude:
¶ A process uses too much CPU time
¶ Too many zombie processes in the system
¶ A process is stopped or killed
¶ A process that was requested does not exist
21
183IBM Tivoli Monitoring Resource Model Reference
21.P
rocess
Reso
urce
Mo
del
Indications and EventsThe following table lists the events that can be generated by the Process resource model, thename of the indication from which each event is generated, the default severity of the event,and where you can find a detailed description of the indication:
Event Indication Severity Page
HighZombieProcesses High Number of Zombie Processes Warning 184
ProcessHighCPU Process Consuming High CPU Minor 185
ProcessKilledOrNotExisting Process Killed or Nonexistent Critical 186
ProcessStopped Process Stopped Critical 187
High Number of Zombie ProcessesThis indication is sent when the number of processes in a zombie state is too high. Aprocess is a zombie when it has been terminated and its results have not been gathered bythe parent process.
The indication has the following attributes:
numZombieThe number of zombie processes
name Identifies the single instance (Key attribute)
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Maximum Number of Zombie Processes(HighZombieProcess)
This threshold indicates the maximumnumber of zombie processes allowedwithout impacting system performance.
20
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 6
Holes 1
Indications and Events
184 Version 5.1.1
Process Consuming High CPUThis indication is sent when a process uses too much CPU time.
The indication has the following attributes:
IDProcess The ID of the process being monitored (Key attribute)
PrcProcessorTimeThe percentage of CPU time used for the process
Process The process being monitored (Key attribute)
state The status of the process
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Percentage of CPU Used(HighCPUUsed)
This threshold indicates the maximum percentage ofCPU that can be used by a single process withoutimpacting system performance. When a process uses ahigh percentage of CPU, it reduces available CPU timefor other processes.
60
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 20
Holes 3
Indications and Events
185IBM Tivoli Monitoring Resource Model Reference
21.P
rocess
Reso
urce
Mo
del
Process Killed or NonexistentThis event is sent when a process is stopped using the command sh ... stop, or when theresource model detects that the process is no longer present in the system. Specify anyprocesses in the Processes parameters.
The indication has the following attributes:
name The process being monitored (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
186 Version 5.1.1
Process StoppedThis event is generated when the process has the state stopped. The process continues to bepresent in the system, and can be monitored using the ps -ef command. Specify anyprocesses in the Processes parameters.
The indication has the following attributes:
ProcessIDThe ID of the process being monitored (Key attribute)
ParentProcessIDThe parent of the process being monitored
name The process being monitored (Key attribute)
ProcessStatusThe status of the process being monitored
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 3
Holes 0
Indications and Events
187IBM Tivoli Monitoring Resource Model Reference
21.P
rocess
Reso
urce
Mo
del
ThresholdsThe following table lists the thresholds that can be set for the Process resource model. Foreach threshold it shows the name, a short description, and the default value:
Threshold Description Default
Maximum Number of Zombie Processes(HighZombieProcess)
This threshold indicates the maximumnumber of zombie processes allowedwithout impacting system performance.
20
Percentage of CPU Used (HighCPUUsed) This threshold indicates the maximumpercentage of CPU that can be used by asingle process without impacting systemperformance. When a process uses a highpercentage of CPU, it reduces availableCPU time for other processes.
60
ParametersThe following table lists the parameter that can be set for the Process resource model.
Parameter Description Default
Processes (processes) The single processes to be monitored for the ProcessStopped and Process Killed or Nonexistent events.
String list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Process Processor UsageProcess The name of the process
PID The ID of the process
PercentProcessUsageThe percentage of CPU that the process is using
Description of the .mof File PropertiesThis section lists all properties used by the DMXProcess.mof file for the Process resourcemodel. This .mof file uses one CIM class: DMXProcess.
Property Type Description
pid NUMERIC The ID of the process.
name STRING The name of the process.
ppid NUMERIC The ID of the parent process.
uid NUMERIC The User ID.
gid NUMERIC The Group ID.
Thresholds
188 Version 5.1.1
|
||
||||
|||
|||
|||
|||
|||
Property Type Description
euid NUMERIC The effective User ID.
egid NUMERIC The effective Group ID.
state STRING The status of the process (″Waiting″, ″Ready″,″Running″, ″Stopped″, ″Zombie″)
memUsed NUMERIC The memory being used (in kilobytes).
percentProcessorTime NUMERIC The percentage of CPU time used for theprocess.
Description of the .mof File Properties
189IBM Tivoli Monitoring Resource Model Reference
|||
|||
|||
||||
|||
||||
21.P
rocess
Reso
urce
Mo
del
Description of the .mof File Properties
190 Version 5.1.1
Security Resource Model
This chapter describes the Security resource model for UNIX/Linux systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXSecurity
Category UNIX/Linux
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
The Security resource model provides information about files and the users logged onto thesystem. It highlights the following items or changes that might indicate security breaches:
¶ Property changes, such as the owner, group, or attributes, for certain files
¶ The number of logons onto the system by the same user
¶ A suspect superuser
¶ An account that is not valid for root
Indications and EventsThe following table lists the events that can be generated by the Security resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
DuplicatedAccount Duplicate Account Minor 192
FileNotExisting Nonexistent File Warning 193
HighLoggingNumber High Log-in Number for User Minor 193
22
191IBM Tivoli Monitoring Resource Model Reference
22.S
ecurity
Reso
urce
Mo
del
Event Indication Severity Page
IllegalGroup Illegal Group Critical 194
IllegalOwner Illegal Owner Critical 194
NotRegularRootAccount Account not Valid for Root Harmless 195
PasswdNull Null Password Critical 195
SuspectSuperGroup Suspect Supergroup Critical 196
SuspectSuperUser Suspect Superuser Critical 196
WrongMode Wrong File Mode Critical 197
Duplicate AccountThis indication is sent when two users or groups have the same user or group ID.
The indication has the following attribute:
id The ID that has been duplicated (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 0
Indications and Events
192 Version 5.1.1
Nonexistent FileThis indication is sent when the user wants to monitor a file that does not exist on themachine, for example, because it was deleted.
The indication has the following attribute:
pathnameThe pathname of the file specified (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
High Log-in Number for UserThis indication is sent when a specified user is logged to the system a number of timeshigher than what specified in the Defined Users parameter.
The indication has the following attributes:
numlogged The number of times the user has logged in
username The ID of the user (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 1
Indications and Events
193IBM Tivoli Monitoring Resource Model Reference
||
22.S
ecurity
Reso
urce
Mo
del
Illegal GroupThis indication is sent when a security-sensitive file does not have a superuser group.
The indication has the following attributes:
fullname The full file path (Key attribute)
group The file group being monitored
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Illegal OwnerThis indication is sent when a security-sensitive file has an owner who is not a superuser.
The indication has the following attributes:
owner The owner of the file
fullname The full file path (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
194 Version 5.1.1
Account not Valid for RootThis indication is sent when the account ID is not valid for root.
The indication has the following attributes:
id The ID of the root account that was created (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Null PasswordThis indication is sent when a user and/or a group has a password that is set to null.
The indication has the following attributes:
id The ID of the user or group (Key attribute)
name Identifies the single instance
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
195IBM Tivoli Monitoring Resource Model Reference
22.S
ecurity
Reso
urce
Mo
del
Suspect SupergroupThis indication is sent when the supergroup is suspected of being an intruder.
The indication has the following attributes:
groupidThe ID of the suspicious group
groupnameThe group name of the file that is suspicious (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Suspect SuperuserThis indication is sent when superuser is suspected of being an intruder.
The indication has the following attributes:
id The user ID that is suspicious
userName The user name (Key attribute)
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
196 Version 5.1.1
Wrong File ModeThis indication is sent when security-sensitive files have a file mode that is different fromthe default mode.
The indication has the following attributes:
actualmode The type of access permission that the file actually has on the system.
rightmode The type of access permission that the file should have in the parameters asdefined from the IBM Tivoli Monitoring desktop.
filename The name of the file (Key attribute).
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
197IBM Tivoli Monitoring Resource Model Reference
22.S
ecurity
Reso
urce
Mo
del
ParametersThe following table lists the parameters that can be set for the Security resource model.
Parameter Description ParameterType
Alternative Groups(AlternativeGroup)
Groups other than root that can own certain securityfiles in the system
String list
Alternative Owners(AlternativeOwners)
Users that can own certain security files in the system String list
Defined Users (Users) Users to be monitored in the following format:
username | login_limit
String list
Files to Be Monitored(FilesList)
The files that you want to monitor. Enter the file details,separated by the pipe character, in the field to the left ofthe Add button in the following format:
filename | string_mode (as listed with the ls -lacommand) | owner | group
String list
Special Groups(Supergroups)
The groups that can become supergroups in the system String list
Special Users (Superusers) Users that can become superusers in the system String list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
User LogginguserName
The name of the user logging on
id The ID of the suspicious user
numLoggedThe number of times the user is logged in
Note: The above properties are logged only if the user islogged to the system a number of times higher than whatspecified in the Defined Users parameter.
File File UsagefileName The file name being monitored
group The file group being monitored
owner The file owner being monitored
mode The type of access permission to the file
size The file size being monitored
Parameters
198 Version 5.1.1
||
|
|
|||
Description of the .mof File PropertiesThis section lists all properties used by the DMXSecurity.mof file for the Security resourcemodel. This .mof file uses three CIM classes: DMXFileSec, DMXUser, DMXGroup.
Property Type Description
pathName STRING The name of the path.
owner STRING The file owner.
group STRING The file group.
mode STRING The type of access permission to the file.
numMode NUMERIC The UNIX (numeric) mode of the file.
size NUMERIC The file size (in bytes)
userName STRING The name of the user.
id NUMERIC The id of the user.
numLogged NUMERIC The number of times the user has logged in.
passwordNull NUMERIC Is the password null ? (boolean: ″1″ not definedfor user, ″0″ otherwise )
duplicated NUMERIC Is the user duplicated ? (boolean: ″1″ duplicated,″0″ not duplicated)
groupName STRING The name of the group
id NUMERIC The id of the group
passwordNull NUMERIC Is the password null ? (boolean: ″1″ not definedfor group, ″0″ otherwise )
duplicated NUMERIC Is the group duplicated ? (boolean: ″1″duplicated, ″0″ not duplicated)
Description of the .mof File Properties
199IBM Tivoli Monitoring Resource Model Reference
|
||
||||
|||
|||
|||
|||
|||
|||
|||
|||
|||
||||
||||
|||
|||
||||
||||
22.S
ecurity
Reso
urce
Mo
del
Description of the .mof File Properties
200 Version 5.1.1
Server Performance Prediction ResourceModel
This chapter describes the Server Performance Prediction resource model for UNIX/Linuxsystems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DMXSpp
Category UNIX/Linux
Thresholds No
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 10 seconds
Overview
Resource model distributionThis resource model should be distributed to UNIX and Linux endpoints.
The Server Performance Prediction resource model gathers data from UNIX and Linuxsystems for the Tivoli Decision Support Guide for Server Performance Prediction (AdvancedEdition). This resource model does not have thresholds, indications or events.
Note: To run this resource model on AIX and HP endpoints, the SNMP deamon must beactive.
ParametersThe following table lists the parameters that can be set for the Server PerformancePrediction resource model.
Parameter Description Default
Network Interface Configuration(NetworkInterfacesConf)
The network interface for which you want thenetwork interface values calculated. Values: 1-4.
Choice list
23
201IBM Tivoli Monitoring Resource Model Reference
23.S
erverP
erform
ance
Pred
iction
Parameter Description Default
Available File System Space Configuration(FileSystemSpaceAvailableConf)
The instance for which you want the availablefile system space calculated. Values: /, /usr,/tmp, /var, /home.
String list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Cpu SPP Guide for UNIXidleTime The idle cpu time as a percentage of total cpu time
userTimeThe cpu time spent on user applications as apercentage of total cpu time
sysTime The cpu time spent by the system as a percentageof total cpu time
loadAvg1The average number of processes running in themost recent calendar minute
FileSystem SPP Guide for UNIXmountPoint
The directory on which the file system is mounted
availKBytesThe free kilobytes on the disk
prcInodeUsedThe percentage of Inodes used in the file system
Memory SPP Guide for UNIXavailSwapSpace
The amount of space available to be swapped
pageInsRateThe number of page inputs per second
pageOutsRateThe number of page outputs per second
pctusedVirtualStorageThe percentage of total memory (including cachememory and swap space) being used
Parameters
202 Version 5.1.1
Resource Context Properties
NetworkInterface SPP Guide for UNIXdeltaInPackets
The delta of packets received, compared with theprevious cycle
deltaInPacketsErrThe delta of errors for packets received, comparedwith the previous cycle
deltaOutPacketsThe delta of packets sent, compared with theprevious cycle
deltaOutPacketsErrThe delta of errors for packets sent, compared withthe previous cycle
deltaCollisionsThe delta of packet collisions, compared with theprevious cycle
networkInterfaceThe network interface card
NetworkRPCNFS SPP Guide for UNIXdeltaNFSClientCalls
The number of calls from the NFS client,compared with the previous cycle.
Processes SPP Guide for UNIXnumberWaitProcesses
The number of processes waiting to run
numberOfProcessesThe total number of processes
Logging
203IBM Tivoli Monitoring Resource Model Reference
23.S
erverP
erform
ance
Pred
iction
Logging
204 Version 5.1.1
Part III. Resource Models for OS/400Chapter 24. ASP Disk Mirroring Resource Model . . . . . . . . . . . . . . . . . . . . . . . 209
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Mirroring not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Chapter 25. ASP Utilization Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
ASP Nearing Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
ASP Overflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Chapter 26. Basic CPU Utilization Resource Model. . . . . . . . . . . . . . . . . . . . . 217Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Basic CPU Utilization Peak Long Running Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Basic CPU Utilization Guideline Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Basic CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Basic CPU Utilization Peak Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Chapter 27. Basic Interactive CPU Utilization Resource Model . . . . . . . . 223Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Basic Interactive CPU Utilization Peak Long Running Exceeded . . . . . . . . . . . . . . . . . . . . . . 224
Basic Interactive CPU Utilization Guideline Long Running Exceeded. . . . . . . . . . . . . . . . . . . 224
Basic Interactive CPU Utilization Guideline Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Basic Interactive CPU Utilization Peak Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Chapter 28. Configuration Objects Resource Model . . . . . . . . . . . . . . . . . . . . 229Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Configuration Object Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
205IBM Tivoli Monitoring Resource Model Reference
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Chapter 29. Database CPU Utilization Resource Model. . . . . . . . . . . . . . . . . 231Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Database CPU Utilization Exceeded. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Chapter 30. Distribution Queues Resource Model . . . . . . . . . . . . . . . . . . . . . . 233Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Normal Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
High Priority Distribution Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Chapter 31. History Log Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
List Of Jobs Not Empty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Chapter 32. Interactive Feature CPU Utilization Resource Model . . . . . . 237Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Interactive Feature CPU Utilization Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Chapter 33. Job Log Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Job Log Warning Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Chapter 34. Job Queue Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Too Many Jobs Queued . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Job Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Job Queue Not Assigned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
206 Version 5.1.1
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Chapter 35. Job Status Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Job Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Chapter 36. Management Central Events Resource Model . . . . . . . . . . . . . 249Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Management Central Unknown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Critical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Management Central Harmless. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Chapter 37. Network Attributes Resource Model. . . . . . . . . . . . . . . . . . . . . . . . 253Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Network Attributes Mismatch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Chapter 38. Output Queues Resource Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
No Writers Started For Output Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Output Queue Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Chapter 39. Parametric Object and File Resource Model . . . . . . . . . . . . . . . 257Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Object Owner Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Last Changed Date Different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Object Size Exceeded . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Chapter 40. Storage Pools Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
207IBM Tivoli Monitoring Resource Model Reference
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
Chapter 41. Subsystem Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Subsystem Not Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Chapter 42. System Disk Resources Resource Model . . . . . . . . . . . . . . . . . . 265Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Total Auxiliary Storage Reached Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . 266
System ASP Used Near Peak Capacity Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Total Auxiliary Storage Reached Capacity Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Chapter 43. System Value Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
System Object Mismatch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Chapter 44. TCP Interface Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
TCP Interface Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Chapter 45. TCP Service Resource Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Indications and Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
TCP Service Not Active. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
208 Version 5.1.1
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
||
ASP Disk Mirroring Resource Model
This chapter describes the Auxiliary Storage Pool (ASP) Disk Mirroring resource model forOS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name ASPDiskMirroringStatus400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The ASP Disk Mirroring resource model, given in input one or more ASP numbers, gets alist of disks for each ASP, checking the mirroring status of each disk.
Indications and EventsThe following table lists the events that can be generated by the ASP Disk Mirroringresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
MirroringNotActive MirroringNotActive Warning 210
24
209IBM Tivoli Monitoring Resource Model Reference
|
|
||
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
|||||
24.A
SP
Disk
Mirro
ring
Reso
urce
Mo
del
Mirroring not ActiveThis indication is sent when a disk unit is part of a mirrored pair, but the mirroring iscurrently not active. You may need to investigate why the mirroring is not active. There maybe a hardware problem.
The indication has the following attributes:
diskResourceNameThe name of the disk being monitored
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 2
Holes 0
Indications and Events
210 Version 5.1.1
|
|||
|
||
|
|||
||
||
||
|||
ParametersThe following table lists the parameters that can be set for the ASP Disk Mirroring resourcemodel.
Parameter Description ParameterType
ASPs to monitor for DiskMirroring Status (ASPs)
The ASP numbers that you want to monitor. Duringeach cycle the mirroring status of each disk is checked.
String list
Parameters
211IBM Tivoli Monitoring Resource Model Reference
|
||
|||||
|||||
24.A
SP
Disk
Mirro
ring
Reso
urce
Mo
del
212 Version 5.1.1
ASP Utilization Resource Model
This chapter describes the Auxiliary Storage Pool (ASP) Utilization resource model forOS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name ASPUtilization400
Category OS/400
Thresholds Yes
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 900 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The ASP Utilization resource model monitors the Auxiliary Storage Pool (ASP) Utilizationfor the specified ASPs and sends events if the ASP is approaching being filled.
Indications and EventsThe following table lists the events that can be generated by the ASP Utilization resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
ASPNearingCapacity ASP nearing capacity Warning 214
ASPOverflow ASP overflow Warning 215
25
213IBM Tivoli Monitoring Resource Model Reference
|
|
||
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
||||
|||||
25.A
SP
Utilizatio
nR
esou
rceM
od
el
ASP Nearing CapacityThis indication is sent when the ASP is nearing capacity with the specified percent value.The percent used has remained above the threshold value for several hours. You shouldconsider adding storage to the ASP, or archiving or removing objects that are no longerneeded.
The indication has the following attributes:
ASPInstanceThe instance being monitored
totalAvailableMbytesPercentageThe percent value
The indication is generated when the following threshold is exceeded:
Threshold Description Default
total Available MBytesPercentage Threshold
This threshold indicates a percent value above whichthe specified ASPInstance is nearing capacity.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
214 Version 5.1.1
|
||||
|
||
||
|
||||
|||||
|
|
|||
||
||
||
|||
ASP OverflowThis indication is sent when the ASP has overflowed to the system ASP. You shouldconsider adding storage to the ASP, or archiving or removing objects that are no longerneeded.
The indication has the following attributes:
overflowStorageMBytesThe amount of overflow
ASPInstanceThe instance being monitored
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
215IBM Tivoli Monitoring Resource Model Reference
|
|||
|
||
||
|
|||
||
||
||
|||
25.A
SP
Utilizatio
nR
esou
rceM
od
el
ParametersThe following table lists the parameters that can be set for the ASP Utilization resourcemodel.
Parameter Description ParameterType
Auxiliary Storage PoolInstances (ASPs)
The ASP instances. You can enter one or more numbersas enumeration parameters, or can enter the string’*ALL’ to enumerate all ASPs.
String list
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
ASP UtilizationASPInstance
The instance being moniored on
overflowStorageMBytesThe amount of overflow
totalAvailableMBytesPercentageThe percent value above which the specified ASPinstance is nearing capacity
Parameters
216 Version 5.1.1
|
||
|||||
|||||
|
|
|
||
|||
|
||
|
||
|||||
||
|||
Basic CPU Utilization Resource Model
This chapter describes the Basic CPU Utilization resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name BasicCPU400
Category OS/400
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the overall CPU utilization of the system.
Indications and EventsThe following table lists the events that can be generated by the Basic CPU Utilizationresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
BasicCPUUtilizationPeakLongRunningExceeded Basic CPU Utilization Peak LongRunning Exceeded
Warning 218
BasicCPUUtilizationGuidelineLongRunningExceeded
Basic CPU Utilization GuidelineLong Running Exceeded
Warning 218
BasicCPUUtilizationGuidelineExceeded Basic CPU Utilization GuidelineExceeded
Warning 219
BasicCPUUtilizationPeakExceeded Basic CPU Utilization PeakExceeded
Warning 220
26
217IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|
|
|||
|||||
|||||
||||||
|||||
|||||
|
26.B
asicC
PU
Utilizatio
nR
esou
rceM
od
el
Basic CPU Utilization Peak Long Running ExceededThis indication is sent when the overall CPU utilization has been over its threshold value forpeak usage for several hours. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet processing demands.
The indication has the following attributes:
basicAverageCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization Peak SingleProcessor Long RunningThreshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a singleprocessor system.
90
CPU Utilization Peak DoubleProcessor Long RunningThreshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a doubleprocessor system.
93
CPU Utilization Peak TripleProcessor Long RunningThreshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a triple processorsystem.
95
CPU Utilization PeakMultiple Processor LongRunning Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a multipleprocessor system.
97
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 180
Holes 20
Basic CPU Utilization Guideline Long Running ExceededThis indication is sent when the overall CPU utilization has been over its guideline value forseveral hours. You may need to investigate adding CPU resources or determining if jobs areusing more CPU than they should. Having too high a CPU utilization can result in inabilityto satisfactorily meet peak processing demands.
The indication has the following attributes:
basicAverageCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization GuidelineSingle Processor LongRunning Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a singleprocessor system.
80
Indications and Events
218 Version 5.1.1
|
||||
|
||
|
||||
|||
|||
|
|||
|||
|
|||
|||
|
|||
|||
|
|
|
|||
||
||
||
|||
|
||||
|
||
|
||||
|||
|||
|
Threshold Description Default
CPU Utilization GuidelineDouble Processor LongRunning Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a doubleprocessor system.
85
CPU Utilization GuidelineTriple Processor LongRunning Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a tripleprocessor system.
89
CPU Utilization GuidelineMultiple Processor LongRunning Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a multipleprocessor system.
93
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 180
Holes 20
Basic CPU Utilization Guideline ExceededThis indication is sent when the overall CPU utilization has been over its guideline value forpeak usage for more than an hour. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet peak processing demands.
The indication has the following attributes:
basicAverageCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization GuidelineSingle Processor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a singleprocessor system.
85
CPU Utilization GuidelineDouble Processor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a doubleprocessor system.
88
CPU Utilization GuidelineTriple Processor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a tripleprocessor system.
91
CPU Utilization GuidelineMultiple Processor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the guideline with a multipleprocessor system.
95
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Indications and Events
219IBM Tivoli Monitoring Resource Model Reference
|||
|||
|||
|
|||
|||
|
|||
|||
|
|
|
|||
||
||
||
|||
|
||||
|
||
|
||||
|||||
|
|||||
|
|||||
|
|||||
|
|
|
|||
||
26.B
asicC
PU
Utilizatio
nR
esou
rceM
od
el
Setting Default
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Basic CPU Utilization Peak ExceededThis indication is sent when the overall CPU utilization has been over its threshold value forpeak usage for more than an hour. You may need to investigate adding CPU resources ordetermining if jobs are using more CPU than they should. Having too high a CPU utilizationcan result in inability to satisfactorily meet processing demands.
The indication has the following attributes:
basicAverageCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization Peak SingleProcessor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a singleprocessor system.
94
CPU Utilization Peak DoubleProcesso Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a doubleprocessor system.
96
CPU Utilization Peak TripleProcessor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a triple processorsystem.
97
CPU Utilization PeakMultiple Processor Threshold
Overall CPU utilization threshold to verify whether theCPU utilization is over the peak with a multipleprocessor system.
99
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
220 Version 5.1.1
||
||
||
|||
|
||||
|
||
|
||||
|||||
|
|||||
|
|||||
|
|||||
|
|
|
|||
||
||
||
|||
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
BasicCPU Utilizationspare A key property
basicAverageCPUPctThe percent value
numOfProcessorsThe number of processors
Logging
221IBM Tivoli Monitoring Resource Model Reference
|
||
|||
|
||
|
||
|||||
||
||
26.B
asicC
PU
Utilizatio
nR
esou
rceM
od
el
222 Version 5.1.1
Basic Interactive CPU Utilization ResourceModel
This chapter describes the Basic Interactive CPU Utilization resource model for OS/400systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name BasicInteractiveCPU400
Category OS/400
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the interactive CPU utilization of the system. This should onlybe used on system models which support the interactive CPU metric.
Indications and EventsThe following table lists the events that can be generated by the Basic Interactive CPUUtilization resource model, the name of the indication from which each event is generated,the default severity of the event, and where you can find a detailed description of theindication:
Event Indication Severity Page
BasicInteractiveCPUUtilizationPeakLongRunningExceeded
Basic Interactive CPU UtilizationPeak Long Running Exceeded
Warning 224
BasicInteractiveCPUUtilizationGuidelineLongRunningExceeded
Basic Interactive CPU UtilizationGuideline Long RunningExceeded
Warning 224
27
223IBM Tivoli Monitoring Resource Model Reference
|
|
|
||
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
||||
|||||
||||||
|||||
||
27.B
asicIn
teractiveC
PU
Utilizatio
nR
esou
rceM
od
el
Event Indication Severity Page
BasicInteractiveCPUUtilizationGuidelineExceeded
Basic Interactive CPU UtilizationGuideline Exceeded
Warning 225
BasicInteractiveCPUUtilizationPeakExceeded Basic Interactive CPU UtilizationPeak Exceeded
Warning 226
Basic Interactive CPU Utilization Peak Long Running ExceededThis indication is sent when the overall interactive CPU utilization has been over itsthreshold value for peak usage for several hours. You may need to investigate addinginteractive CPU resources or determining if interactive jobs are using more CPU than theyshould. Having too high an interactive CPU utilization can result in inability to satisfactorilymeet interactive processing demands.
The indication has the following attributes:
basicInteractiveCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization Peak SingleProcessor Long RunningThreshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a singleprocessor system.
60
CPU Utilization Peak DoubleProcessor Long RunningThreshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a doubleprocessor system.
75
CPU Utilization Peak TripleProcessor Long RunningThreshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a tripleprocessor system.
85
CPU Utilization PeakMultiple Processor LongRunning Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a multipleprocessor system.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 180
Holes 20
Basic Interactive CPU Utilization Guideline Long Running ExceededThis indication is sent when the interactive CPU utilization has been over its guideline valuefor several hours. You may need to investigate adding interactive CPU resources ordetermining if interactive jobs are using more CPU than they should. Having too high aninteractive CPU utilization can result in inability to satisfactorily meet peak interactiveprocessing demands.
The indication has the following attributes:
Indications and Events
224 Version 5.1.1
||||
||||||
|||||
|
|
|||||
|
||
|
||||
|||
|||
|
|||
|||
|
|||
|||
|
|||
|||
|
|
|
|||
||
||
||
|||
|
|||||
|
basicInteractiveCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization GuidelineSingle Processor LongRunning Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a singleprocessor system.
45
CPU Utilization GuidelineDouble Processor LongRunning Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a doubleprocessor system.
60
CPU Utilization GuidelineTriple Processor LongRunning Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a tripleprocessor system.
70
CPU Utilization GuidelineMultiple Processor LongRunning Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with amultiple processor system.
75
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 180
Holes 20
Basic Interactive CPU Utilization Guideline ExceededThis indication is sent when the interactive CPU utilization has been over its guideline valuefor peak usage for more than an hour. You may need to investigate adding interactive CPUresources or determining if interactive jobs are using more CPU than they should. Havingtoo high a CPU utilization can result in inability to satisfactorily meet interactive processingdemands.
The indication has the following attributes:
basicInteractiveCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization GuidelineSingle Processor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a singleprocessor system.
56
CPU Utilization GuidelineDouble Processor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a doubleprocessor system.
71
CPU Utilization GuidelineTriple Processor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with a tripleprocessor system.
81
Indications and Events
225IBM Tivoli Monitoring Resource Model Reference
||
|
||||
|||
|||
|
|||
|||
|
|||
|||
|
|||
|||
|
|
|
|||
||
||
||
|||
|
|||||
|
||
|
||||
|||||
|
|||||
|
|||||
|
27.B
asicIn
teractiveC
PU
Utilizatio
nR
esou
rceM
od
el
Threshold Description Default
CPU Utilization GuidelineMultiple Processor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the guideline with amultiple processor system.
86
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Basic Interactive CPU Utilization Peak ExceededThis indication is sent when the interactive CPU utilization has been over its threshold valuefor peak usage for more than an hour. You may need to investigate adding interactive CPUresources or determining if interactive jobs are using more CPU than they should. Havingtoo high a CPU utilization can result in inability to satisfactorily meet interactive processingdemands.
The indication has the following attributes:
basicInteractiveCPUPctThe percent value.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
CPU Utilization Peak SingleProcessor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a singleprocessor system.
70
CPU Utilization Peak DoubleProcesso Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a doubleprocessor system.
83
CPU Utilization Peak TripleProcessor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a tripleprocessor system.
91
CPU Utilization PeakMultiple Processor Threshold
Interactive CPU utilization threshold to verify whetherthe CPU utilization is over the peak with a multipleprocessor system.
94
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
Indications and Events
226 Version 5.1.1
|||
|||||
|
|
|
|||
||
||
||
|||
|
|||||
|
||
|
||||
|||||
|
|||||
|
|||||
|
|||||
|
|
|
|||
||
||
||
|||
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
InteractiveCPU Utilizationspare A key property
basicInteractiveCPUPctThe percent value
numOfProcessorsThe number of processors
Logging
227IBM Tivoli Monitoring Resource Model Reference
|
||
|||
|
||
|
||
|||||
||
||
27.B
asicIn
teractiveC
PU
Utilizatio
nR
esou
rceM
od
el
228 Version 5.1.1
Configuration Objects Resource Model
This chapter describes the Configuration Objects resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name ConfigurationObjects400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the status of configuration objects. The user can enter one ormore configuration object name and type. Then, during each cycle, the resource modelmonitors the status of each object.
Indications and EventsThe following table lists the events that can be generated by the Configuration Objectsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
ConfigurationObjectNotActive Configuration Object Not Active Warning 229
Configuration Object Not ActiveThis indication is sent when the configuration object is not active. You may need toinvestigate whether it is purposely varied off, or whether there is a problem with it or anassociated configuration object. For example, a line may not be active because its controlleris not active.
28
229IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
|||||
|
||||
28.C
on
figu
ration
Ob
jectsR
esou
rceM
od
el
The indication has the following attributes:
cfgObjectNameThe configuration object name
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Configuration Objectsresource model.
Parameter Description ParameterType
Configuration Objects(ConfigurationObjects)
The Configuration Object’s name and type separated bya comma. One or more parameter strings of″<name>,<type>″ are allowed where type can be: NWS- Network Server, NWI - Network Interface, LIN - Line,CTL - Controller, DEV - Device, Name is maximum 10character long string and can contain wildcards of ’*’and ’?’. For example, a parameter string of ’*,lin’ willcheck all line configuration objects.
String list
Indications and Events
230 Version 5.1.1
|
||
|
|||
||
||
||
|||
|
||
|||||
||||||||||
|
Database CPU Utilization Resource Model
This chapter describes the Database CPU Utilization resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DatabaseCPUUtilization400
Category OS/400
Thresholds No
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The Database CPU Utilization resource model checks if the system is exceeding itsthreshold limit for database CPU utilization. This metric is supported on certain models ofnewer hardware. If the Database CPU Threshold is 100, then there is no threshold limit onthe system. These checks are for systems which have a Database CPU Threshold limit lessthan 100.
Indications and EventsThe following table lists the events that can be generated by the Database CPU Utilizationresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
DatabaseCPUUtilizationExceeded Database CPU UtilizationExceeded
Warning 231
Database CPU Utilization ExceededThis indication is sent when Database CPU utilization has been over its threshold value forover an hour. You may need to investigate adding database CPU resources or determining if
29
231IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||||
|
|||
|||||
|||||
|
|
||
29.D
atabase
CP
UU
tilization
Res.
Mo
del
jobs are using more database CPU than they should. Having a too high database CPUutilization can result in inability to satisfactorily meet processing demands.
The indication has the following attributes:
databaseCapabilityCPUPctThe percent value
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
DatabaseCPU Utilizationspare
databaseCapabilityCPUPctThe percent value
databaseThresholdPctThe database CPU threshold limit
Indications and Events
232 Version 5.1.1
||
|
||
|
|||
||
||
||
|||
|
||
|||
|
||
|
||
||||
||
||
Distribution Queues Resource Model
This chapter describes the Distribution Queues resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name DistributionQueues400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 900 seconds
Note: This resource model should have a cycle time of at least several minutes.
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The Distribution Queues resource model monitors the status of the high and normal priorityservice levels for distribution queues.
Indications and EventsThe following table lists the events that can be generated by the Distribution Queuesresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
NormalPriorityDistributionQueueNotActive Normal Priority DistributionQueue Not Active
Warning 234
HighPriorityDistributionQueueNotActive High Priority Distribution QueueNot Active
Warning 234
30
233IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|
|||||
||
|
|||
|||||
|||||
|||||
|
30.D
istribu
tion
Qu
eues
Reso
urce
Mo
del
Normal Priority Distribution Queue Not ActiveThis indication is sent when the normal priority service level for the distribution queue isnot active.
The indication has the following attributes:
distributionQueueNameThe name of the distribution queue
statusNormalPriorityThe status of the normal priority service level
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
High Priority Distribution Queue Not ActiveThis indication is sent when the high priority service level for the distribution queue is notactive.
The indication has the following attributes:
distributionQueueNameThe name of the distribution queue
statusHighPriorityThe status of the high priority service level
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Distribution Queues resourcemodel.
Parameter Description ParameterType
Distribution Queue Names(DistributionQueues)
The name of the distribution queues to monitor. You canenter one or more name strings each a maximum of 10characters long. The name strings can contain wildcardscharacters of ’*’ and ’?’.
String list
Indications and Events
234 Version 5.1.1
|
||
|
||
||
|
|||
||
||
||
|||
|
||
|
||
||
|
|||
||
||
||
|||
|
||
|||||
||||||
|
History Log Resource Model
This chapter describes the History Log resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name HistoryLog400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 600 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model finds specific messages in the history log. The history log containsmany status and error messages from the system. You may enter message numbers and textstrings as parameters. They will be compared to history log entries.
Indications and EventsThe following table lists the events that can be generated by the History Log resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
ListOfJobsNotEmpty List Of Jobs Not Empty Warning 235
List Of Jobs Not EmptyThis indication is sent when the list of jobs is not empty. One or more jobs have issuedmessages to the History Log. The input message ID and test string match one or moreentries in the History Log. The job names are included in the event. You may need toinvestigate why the jobs have issued the messages.
31
235IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
|||||
|
||||
31.H
istory
Lo
gR
esou
rceM
od
el
The indication has the following attributes:
ListOfJobsThe list of jobs
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the History Log resource model.
Parameter Description ParameterType
Message Match Parameters(MatchParms)
The message IDs and text strings to match againstHistory Log entries. The input fomat for each parameteris ″<message ID>,<pattern to match>″. The message IDis a maximum of 7 characters and can contain wildcardsof ’*’ and ’?’. The pattern to match can be a maximumof 100 characters and can contain wildcards of ’*’ and’?’.Note: The message text from the History Log recordson the OS/400 endpoint will be in the primary languageof the system. So the match parameter text should be inthat language.
String list
Indications and Events
236 Version 5.1.1
|
||
|
|||
||
||
||
|||
|
|
|||||
|||||||||||||
|
Interactive Feature CPU UtilizationResource Model
This chapter describes the Interactive Feature CPU Utilization resource model for OS/400systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name InteractiveFeatureCPUUtilization400
Category OS/400
Thresholds No
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model checks if the system is exceeding its threshold limit for InteractiveFeature CPU utilization. This is supported only on certain models. If the Interactive FeatureCPU Threshold is 100, then there is no threshold limit on the system. These checks are forsystems which have an Interactive Feature CPU threshold limit less than 100.
Indications and EventsThe following table lists the events that can be generated by the Interactive Feature CPUUtilization resource model, the name of the indication from which each event is generated,the default severity of the event, and where you can find a detailed description of theindication:
Event Indication Severity Page
InteractiveFeatureCPUUtilizationExceeded Interactive Feature CPUUtilization Exceeded
Warning 238
32
237IBM Tivoli Monitoring Resource Model Reference
|
|
|
||
|
||
||
||
||
||
||
||
|||
|
|||||
||||
|
||||
|||||
|||||
|
32.In
teractiveF
eature
CP
UU
tilization
Res.
Mo
del
Interactive Feature CPU Utilization ExceededThis indication is sent when the Interactive Feature CPU utilization has been over itsthreshold value for over an hour. You may need to investigate adding Interactive FeatureCPU resources or determining if interactive jobs are using more CPU than they should.Having too high an Interactive Feature CPU utilization can result in inability to satisfactorilymeet processing demands.
The indication has the following attributes:
basicInteractiveCPUPctThe percent value
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 10
Holes 2
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
InteractiveFeatureCPU Utilizationspare
basicInteractiveCPUPctThe percent value
interactiveThresholdPctThe threshold limit
Indications and Events
238 Version 5.1.1
|
|||||
|
||
|
|||
||
||
||
|||
|
||
|||
|
||
|
||
||||
||
||
Job Log Resource Model
This chapter describes the Job Log resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name JobLog400
Category OS/400
Thresholds Yes
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 600 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model checks a job’s Job Log for specific messages. The parameters containthe message numbers and text strings to match. They will be compared to the log entries forthe input jobs.
Indications and EventsThe following table lists the events that can be generated by the Job Log resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
JobLogWarningMessage Job Log Warning Message Warning 239
Job Log Warning MessageThis indication is sent when the a job has issued warning messages to its Job Log. The inputmessage ID and test string matches one or more entries in the job’s log. The job name isincluded in the event. You may need to investigate why the job has issued the message.
The indication has the following attributes:
33
239IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
|||||
|
|||
|
33.Jo
bL
og
Reso
urce
Mo
del
JobNameThe name of the job.
MessageIDThe message ID.
MessageTextThe text of the message.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Number of matches threshold(numOfMatchesThreshold)
This threshold indicates the number of matches abovewhich the job log warning message is sent.
1
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Job Log resource model.
Parameter Description ParameterType
Matching Parameters(matchParms)
The message IDs and text strings to match. The inputfomat for each parameter is ″<message ID>,<pattern tomatch>″. The message ID is a maximum of 7 charactersand can contain wildcards of ’*’ and ’?’. The pattern tomatch can be a maximum of 100 characters and cancontain wildcards of ’*’ and ’?’. The pattern will matchif it is found anywhere in the message text. The fullmessage including variable insert text will be used in thematch processing.Note: The message text from the Job Log entries on theOS/400 endpoint will be in the primary language of thesystem. So the match parameter text should be in thatlanguage.
String list
Indications and Events
240 Version 5.1.1
||
||
||
|
||||
|||||
|
|
|||
||
||
||
|||
|
|
|||||
|||||||||||||||
|
Parameter Description ParameterType
Job Names (JobNames) One or more job names to search their logs. Theparameter format is: ″[<subsystem library> / ]<subsystem name>,<job name>,<job user> [ , <jobnumber> ]″ where the items contained in brackets (’[ ]’)are optional. If the ″< subsystem library> /″ is not inputthen QSYS library is assumed. If ″, <job number>″ isnot input then ’*’ is assumed. Each of the input itemscan contain wild card characters ’*’ and ’?’ where ’*’matches any number of any characters, and ’?’ matchesany one character. Each parameter item can be up to amaximum of 10 characters long except for job numberwhich can be a maximum of 6 characters long.
String list
Parameters
241IBM Tivoli Monitoring Resource Model Reference
||||
|||||||||||||
|
33.Jo
bL
og
Reso
urce
Mo
del
242 Version 5.1.1
Job Queue Resource Model
This chapter describes the Job Queue resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name JobQueue400
Category OS/400
Thresholds Yes
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 1800 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors that one or more job queues, which have jobs queued to them,are assigned to a subsystem so that the jobs can be started.
Indications and EventsThe following table lists the events that can be generated by the Job Queue resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
TooManyJobsQueued Too Many Jobs Queued Warning 243
JobQueueNotActive Job Queue Not Active Warning 244
JobQueueNotAssigned Job Queue Not Assigned Warning 244
Too Many Jobs QueuedThis indication is sent when a job queue has more than the threshold number of jobsqueued. You may need to investigate if the job queue is running properly, or if the overallsystem is running properly.
34
243IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
||||
||||
|||||
|
|||
34.Jo
bQ
ueu
eR
esou
rceM
od
el
The indication has the following attributes:
numberOfJobsThe number of jobs.
jobQueueNameThe name of the job queue.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Maximum number of allowedqueued jobs
This threshold indicates the maximum number ofallowed queued jobs in a job queue.
5
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Job Queue Not ActiveThis indication is sent when the a job queue is not active. You may need to investigate whythe job queue is not active. It may have never been started, or it was held.
The indication has the following attributes:
jobQueueStatusThe status of the job queue.
jobQueueNameThe name of the job queue.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Job Queue Not AssignedThis indication is sent when the job queue has a number of jobs to run, however the jobqueue has not been assigned to a subsystem. You may want to investigate if the job queueshould be assigned to a subsystem so that the jobs can be started.
The indication has the following attributes:
jobQueueNameThe name of the job queue.
The following table shows the default settings for this indication:
Indications and Events
244 Version 5.1.1
|
||
||
|
||||
|||||
|
|
|||
||
||
||
|||
|
||
|
||
||
|
|||
||
||
||
|||
|
|||
|
||
|
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Job Queue resource model.
Parameter Description ParameterType
Job Queues To BeMonitored (JobQueues)
Job queues to be monitored. Enter the library and nameof the job queues to be monitored. The parameter formatis ″<library>/<name>″ where both items are a maximum10 characters long and can contain wildcards ’*’ and ’?’.For example, ’*/*’ will find all Job Queues.
String list
Indications and Events
245IBM Tivoli Monitoring Resource Model Reference
|||
||
||
||
|||
|
|
|||||
|||||||
|
34.Jo
bQ
ueu
eR
esou
rceM
od
el
246 Version 5.1.1
Job Status Resource Model
This chapter describes the Job Status resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name JobStatus400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 120 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the job status. Given a list of job names, it sends an event ifany of the jobs are not active. The input job names can contain wild cards.
Indications and EventsThe following table lists the events that can be generated by the Job Status resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
JobNotActive Job Not Active Warning 247
Job Not ActiveThis indication is sent when a job is not active.
The indication has the following attributes:
jobNameThe name of the job.
35
247IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
|||||
|
|
|
||
35.Jo
bS
tatus
Reso
urce
Mo
del
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Job Status resource model.
Parameter Description ParameterType
Job Names (Jobs) The list of jobs to be monitored. The parameter formatis: [<subsystem library> / ] <subsystem name>,<jobname>,<job user> [,<job number>]
String list
Indications and Events
248 Version 5.1.1
|
|||
||
||
||
|||
|
|
|||||
||||
|
Management Central Events ResourceModel
This chapter describes the Management Central Events resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name ManagementCentralEvent400
Category OS/400
Thresholds No
Parameters No
Built-in actions No
Clearing events No
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors all Management Central events and forwards them to TEC.This resource model should be distributed to all Management Central central systems thatare actively being managed by Management Central.the network attributes.
Indications and EventsThe following table lists the events that can be generated by the Management Central Eventsresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
ManagementCentralUnknown Management Central Unknown Minor 250
ManagementCentralCritical Management Central Critical Critical 250
ManagementCentralWarning Management Central Warning Warning 250
ManagementCentralHarmless Management Central Harmless Harmless 250
36
249IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
||||
||||
||||
|||||
36.M
anag
emen
tC
entral
Even
tsR
esou
rceM
od
el
Management Central UnknownThis indication is sent when a mangement unknown central event is detected.
The indication has the following attributes:
event The event.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Management Central CriticalThis indication is sent when a mangement critical central event is detected.
The indication has the following attributes:
event The event.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Management Central WarningThis indication is sent when a mangement warning central event is detected.
The indication has the following attributes:
event The event.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Management Central HarmlessThis indication is sent when a mangement harmless central event is detected.
The indication has the following attributes:
event The event.
The following table shows the default settings for this indication:
Indications and Events
250 Version 5.1.1
|
|
|
||
|
|||
||
||
||
|||
|
|
|
||
|
|||
||
||
||
|||
|
|
|
||
|
|||
||
||
||
|||
|
|
|
||
|
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Indications and Events
251IBM Tivoli Monitoring Resource Model Reference
|||
||
||
||
||
36.M
anag
emen
tC
entral
Even
tsR
esou
rceM
od
el
252 Version 5.1.1
Network Attributes Resource Model
This chapter describes the Network Attributes resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name NetworkAttributes400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 43200 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the network attributes. The user provides one or more networkattribute names along with a corresponding value. During each cycle the resource modelmonitors that the network attribute’s value is equal to its desired value.
Indications and EventsThe following table lists the events that can be generated by the Network Attributes resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
NetworkAttributeMismatch Network Attributes Mismatch Warning 253
Network Attributes MismatchThis indication is sent when the network attribute is not currently set to the desired value.You may need to investigate why the network attribute was changed and whether it shouldbe changed back to the desired value.
The indication has the following attributes:
37
253IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
|||||
|
|||
|
37.N
etwo
rkA
ttribu
tesR
esou
rceM
od
el
networkAttributeNameThe name of the network attribute.
expectedValueThe value desired for the network attribute.
valueMetricThe actual value.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Network Attributes resourcemodel.
Parameter Description ParameterType
Attribute Names(AttributeNames)
The list of network attribute names. The full name mustbe used with no wildcard characters.
String list
Attribute Values(AttributeValues)
The list of network attribute values to be comparedagainst the monitored resource’s value. This parametervalue is associated with the respective attribute name inits parameter list. For example, the first value in thisparameter list is compared against the current value ofthe first attribute in the name list.
String list
Indications and Events
254 Version 5.1.1
||
||
||
|
|||
||
||
||
|||
|
||
|||||
|||||
||||||||
|
Output Queues Resource Model
This chapter describes the Output Queue resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name OutputQueues400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 900 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The Output Queues resource model checks if the output queues and their writers are active.
Indications and EventsThe following table lists the events that can be generated by the Output Queues resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
NoWritersStartedForOutputQueue No Writers Started For OutputQueue
Minor 255
OutputQueueNotActive Output Queue Not Active Minor 256
No Writers Started For Output QueueThis indication is sent when the output queue has one or more jobs waiting, but no writersare started to handle the jobs. You may need to assign a writer or find out if the jobs shouldbe removed.
The indication has the following attributes:
38
255IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|
|
|||
|||||
|||||
|||||
|
|||
|
38.O
utp
ut
Qu
eues
Reso
urce
Mo
del
numberOfFilesThe number of files in the queue
numberStartedWritersThe number of writers handling the files
outputQueueNameThe name of the output queue
writerJobStatusThe status of the writer
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Output Queue Not ActiveThis indication is sent when the output queue has files queued but it is not active. You mayneed to check on why the queue is not active, or why it has files queued.
The indication has the following attributes:
outputQueueNameThe name of the output queue
currentStatusThe status of the output queue
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Output Queues resourcemodel.
Parameter Description ParameterType
Output Queue Library andName (OutputQueues)
The library and name for the output queues to monitor.The parameter format is ″<library>/<name>″ where bothitems are a maximum 10 characters long and cancontain wildcards ’*’ and ’?’.
String list
Indications and Events
256 Version 5.1.1
||
||
||
||
|
|||
||
||
||
|||
|
||
|
||
||
|
|||
||
||
||
|||
|
||
|||||
||||||
|
Parametric Object and File ResourceModel
This chapter describes the Parametric Object and File resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name ParametricObjectAndFile400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 1200 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model allows you to monitor native objects and files for owner, size, andchange date. The object or file can be in the QSYS native or Integrated File System.
Indications and EventsThe following table lists the events that can be generated by the Parametric Object and Fileresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
ObjectOwnerDifferent Object Owner Different Warning 257
LastChangedDateDifferent Last Changed Date Different Warning 258
ObjectSizeExceeded Object Size Exceeded Warning 258
Object Owner DifferentThis indication is sent when the object’s owner does not match the input parameter. Youmay need to investigate why the object owner is not the desired owner.
39
257IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
||||
||||
|||||
|
||
39.P
arametric
Ob
jectan
dF
ileR
esou
rceM
od
el
The indication has the following attributes:
objectNameThe name of the object.
objectOwnerThe owner of the object.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Last Changed Date DifferentThis indication is sent when the object has changed since the input parameter date. You mayneed to investigate why the object has changed.
The indication has the following attributes:
lastChangedDateThe date of the last change.
objectNameThe name of the object.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
Object Size ExceededThis indication is sent when the object size is larger than the threshold value. You may needto investigate why the object is too large.
The indication has the following attributes:
objectSizeThe size of the object.
objectNameThe name of the object.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Indications and Events
258 Version 5.1.1
|
||
||
|
|||
||
||
||
|||
|
||
|
||
||
|
|||
||
||
||
|||
|
||
|
||
||
|
|||
||
||
||
Setting Default
Holes 0
ParametersThe following table lists the parameters that can be set for the Parametric Object and Fileresource model.
Parameter Description ParameterType
Object Size (ObjectSize) The size of the object (in bytes) to compare against. Numeric list.
Last Changed Date(LastChangedDate)
The date to compare against. The format isYYYY/MM/DD where YYYY is four digits for the year,MM is two digits for the month, and DD is two digitsfor the day. For example, 2002/01/17 for January 17,2002.
String list.
Fully qualified objectnames (Objects)
Enter one or more fully qualified object or file pathnames. For example, ’/mydir/myfile’ for IFS files, and’/qsys.lib/mylib.lib/myfile.file’ for QSYS objects
String list.
Object Owner(ObjectOwner)
The object owner. Enter the user profile name tocompare against the object’s owner.
String list.
Indications and Events
259IBM Tivoli Monitoring Resource Model Reference
||
|||
|
||
|||||
|||
|||||||
|
|||||
|
|||||
39.P
arametric
Ob
jectan
dF
ileR
esou
rceM
od
el
260 Version 5.1.1
Storage Pools Resource Model
This chapter describes the Storage Pools resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name StoragePools400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events No
Default cycle time 300 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The Storage Pools resource model monitors and logs the metrics for storage pools. Thisresource model does not produce events.
ParametersThe following table lists the parameters that can be set for the Storage Pools resource model.
Parameter Description ParameterType
Storage Pool Names(StoragePools)
The names of the storage pools. The names are each amaximum 10 characters long and can contain wildcardscharacters ’*’ and ’?’. The names are system definedand include ’MACHINE’, ’BASE’, ’INTERACT’,’SPOOL’, and ’SHRPOOL1’ through ’SHRPOOL60’.
String list
40
261IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|
|||||
|||||||
|
|
40.S
torag
eP
oo
lsR
esou
rceM
od
el
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
StoragePool PerformancestoragePoolName
The name of the storage pool
databaseFaultsThe number of database faults
nonDatabaseFaultsThe number of non database faults
databasePagesThe number of database pages
nonDatabasePagesThe number of non database pages
activeToWaitTransitionsThe number of active to wait transitions
activeToIneligibleTransitionsThe number of active to ineligible transitions
waitToIneligibleTransitionsThe number of wait to ineligible transitions
activityLevelThe activity level
totalSizeMBytesThe total size
Logging
262 Version 5.1.1
|
||
|||
|
||
|
||
|||||
||
||
||
||
||
||
||
||
||
Subsystem Resource Model
This chapter describes the Subsystem resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name SubsystemStatus400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 900 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model checks the status of a list of subsystems and sends an event if there is asubsystem that is not active.
Indications and EventsThe following table lists the events that can be generated by the Subsystem resource model,the name of the indication from which each event is generated, the default severity of theevent, and where you can find a detailed description of the indication:
Event Indication Severity Page
SubsystemNotActive Subsystem Not Active Warning 263
Subsystem Not ActiveThis indication is sent when the subsystem is not active.
The indication has the following attributes:
sbsNameThe name of the subsystem.
41
263IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
||
|
|||
|||||
|||||
|
|
|
||
41.S
ub
systemR
esou
rceM
od
el
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the Subsystem resource model.
Parameter Description ParameterType
Subsystem Names(Subsystems)
The list of subsystem to be monitored. Enter one ormore Subsystem names. The parameter format is’<library>/<name>’. Both the library and name are amaximum 10 characters long and can contain wildcardcharacters ’*’ and ’?’.
String list
Indications and Events
264 Version 5.1.1
|
|||
||
||
||
|||
|
|
|||||
|||||||
|
System Disk Resources Resource Model
This chapter describes the System Disk Resources resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name SystemDiskResources400
Category OS/400
Thresholds Yes
Parameters No
Built-in actions No
Clearing events Yes
Default cycle time 900 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the overall system resources for system and ASP utilization.
Indications and EventsThe following table lists the events that can be generated by the System Disk Resourcesresource model, the name of the indication from which each event is generated, the defaultseverity of the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TotalAuxiliaryStorageReachedPeakCapacityGuidelines
Total Auxiliary Storage ReachedPeak Capacity Guidelines
Warning 266
SystemASPUsedNearPeak System ASP Used Near PeakCapacity Guidelines
Warning 266
TotalAuxiliaryStorageReachedCapacityGuidelinesTotal Auxiliary Storage ReachedCapacity Guidelines
Warning 267
42
265IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|
|
|||
|||||
||||||
|||||
|||||
|
42.S
ystemD
iskR
esou
rcesR
es.M
od
el
Total Auxiliary Storage Reached Peak Capacity GuidelinesThis indication is sent when the total auxiliary storage has reached peak capacity guidelinesfor percent used. The percent used has remained above the threshold value for several hours.You should consider adding auxiliary storage to the system, or archiving or removing objectsthat are no longer needed.
The indication has the following attributes:
TotalAuxiliaryStorageAvailablePercentThe percent value of total auxiliary storage.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Total Auxiliary StorageAvailable Peak Threshold
If this threshold is exceeded, the total auxiliary storageusage has reached peak capacity guidelines.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 8
Holes 0
System ASP Used Near Peak Capacity GuidelinesThis indication is sent when the system ASP is nearing its peak capacity guidelines forpercent used. The percent used has remained above the threshold value for several hours.You should consider adding storage to the system ASP, or archiving or removing objects thatare no longer needed.
The indication has the following attributes:
systemASPUsedPctThe percent value of used System ASP.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
System ASP Used PercentThreshold
If this threshold is exceeded, the System is nearingpeak capacity guidelines.
90
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 4
Holes 0
Indications and Events
266 Version 5.1.1
|
||||
|
||
|
||||
|||||
|
|
|||
||
||
||
|||
|
||||
|
||
|
||||
|||||
|
|
|||
||
||
||
|||
Total Auxiliary Storage Reached Capacity GuidelinesThis indication is sent when the the total auxiliary storage has reached capacity guidelinesfor percent used. The percent used has remained above the threshold value for several hours.You should consider adding auxiliary storage to the system, or archiving or removing objectsthat are no longer needed.
The indication has the following attributes:
TotalAuxiliaryStorageAvailablePercentThe percent value of total auxiliary storage.
The indication is generated when the following threshold is exceeded:
Threshold Description Default
Total Auxiliary StorageAvailable Threshold
If this threshold is exceeded, the total auxiliary storageusage has reached capacity guidelines.
80
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 30
Holes 2
LoggingThe following table shows the resource, context and properties for which data can belogged:
Resource Context Properties
Disk Utilizationspare
systemASPusedPctThe percent value of used system ASP
totalAuxiliaryStorageAvailablePercentageThe percent value of total auxiliary storage
Indications and Events
267IBM Tivoli Monitoring Resource Model Reference
|
||||
|
||
|
||||
|||||
|
|
|||
||
||
||
|||
|
||
|||
|
||
|
||
||||
||
||
42.S
ystemD
iskR
esou
rcesR
es.M
od
el
268 Version 5.1.1
System Value Resource Model
This chapter describes the System Value resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name SystemValue400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 43200 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
The user inputs one or more system value names along with a corresponding value as itsdesired value. Then in each cycle this resource model checks if the system value’s value isequal to the desired value.
Indications and EventsThe following table lists the events that can be generated by the System Value resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
SystemObjectMismatch System Object Mismatch Warning 269
System Object MismatchThis indication is sent when the system value is not set to the desired value. You may needto investigate why the system value was changed and whether it should be changed back tothe desired value.
This indication has the following attributes:
43
269IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|||
|
|||
|||||
|||||
|
|||
|
43.S
ystemV
alue
Reso
urce
Mo
del
systemValueNameThe name of the system value.
valueMetricThe metric of the value.
expectedValueThe desired value.
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the System Value resource model.
Parameter Description ParameterType
System Value Names(SystemValues)
The System Value names to be monitored. The fullSystem Value name must be entered with no wildcardcharacters.
String list
System Value Values(SystemValueValues)
Values to be used to verify the contents of a specificSystem Value. These entries must be in the same orderas their respective System Value name parameters.
String list
Indications and Events
270 Version 5.1.1
||
||
||
|
|||
||
||
||
|||
|
|
|||||
|||||
|
|||||
|
TCP Interface Resource Model
This chapter describes the TCP Interface resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TCPInterface400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 600 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the status of one or more TCP interface.
Indications and EventsThe following table lists the events that can be generated by the TCP Interface resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TCPInterfaceNotActive TCP Interface Not Active Warning 271
TCP Interface Not ActiveThis indication is sent when the TCP Interface is not active. You may need to investigatewhy the interface was not started or has ended.
The indication has the following attributes:
interfaceNameThe interface name.
44
271IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|
|
|||
|||||
|||||
|
||
|
||
44.T
CP
Interface
Reso
urce
Mo
del
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the TCP Interface resourcemodel.
Parameter Description ParameterType
TCP IP Interfaces(TCPIPInterfaces)
The list of TCP IP interfaces to be monitored. Theaddress can be an IP address or host name (e.g. 9.5.1.2or david.mycompany.com). No wildcards are allowed inthe parameter. The user may optionally enter the numberof seconds to delay waiting for the connection torespond. This is separated by a comma from the TCPaddress. If not entered the default wait time is 3seconds. (e.g. 127.0.0.1,3)
String list
Indications and Events
272 Version 5.1.1
|
|||
||
||
||
|||
|
||
|||||
||||||||||
|
TCP Service Resource Model
This chapter describes the TCP Service resource model for OS/400 systems.
The following table shows the key characteristics of this resource model:
Resource Model at a Glance
Internal name TCPService400
Category OS/400
Thresholds No
Parameters Yes
Built-in actions No
Clearing events Yes
Default cycle time 600 seconds
Overview
Resource model distributionThis resource model should be distributed to OS/400 endpoints.
This resource model monitors the TCP service.
Indications and EventsThe following table lists the events that can be generated by the TCP Service resourcemodel, the name of the indication from which each event is generated, the default severityof the event, and where you can find a detailed description of the indication:
Event Indication Severity Page
TCPServiceNotActive TCP Service Not Active Warning 273
TCP Service Not ActiveThis indication is sent when the TCP Service is not active. You may need to investigate whythe service was not started or has ended.
The indication has the following attributes:
serviceNameThe service name.
45
273IBM Tivoli Monitoring Resource Model Reference
|
|
|
|
||
||
||
||
||
||
||
|||
|
|||||
|
|
|||
|||||
|||||
|
||
|
||
45.T
CP
Service
Reso
urce
Mo
del
The following table shows the default settings for this indication:
Setting Default
Send indications to Tivoli Enterprise Console Yes
Send indications to Tivoli Business Systems Manager No
Occurrences 1
Holes 0
ParametersThe following table lists the parameters that can be set for the TCP Service resource model.
Parameter Description ParameterType
TCP IP Services(TCPIPServices)
The list of TCP address and service name separated by acomma. The TCP address can be an IP address or hostname (e.g. david.mycompany.com or 9.5.1.2). Theservice name can be a number (port number) or the fullservice name. No wildcards are allowed in either item.
String list
Indications and Events
274 Version 5.1.1
|
|||
||
||
||
|||
|
|
|||||
|||||||
|
Part IV. Appendixes
275IBM Tivoli Monitoring Resource Model Reference
276 Version 5.1.1
Return Codes for Built-in Actions(Windows)
This appendix describes the return codes for built-in actions for resource models running onWindows systems.
The following table lists the return codes by category:
Return Code Category See Page
Common to all built-in actions 277
Built-in actions of the Event Log resource model only 278
Built-in actions of the Network Interface Card resource model only 279
Built-in actions of the Service resource model only 280
All Built-in ActionsThe return codes common to all built-in actions are as follows:
RETURN CODE 99It was not possible to get the definition of the output parameters of the calledmethod.
RETURN CODE 98It was not possible to spawn an instance of the output parameters of the calledmethod. This might be because there is not enough memory.
RETURN CODE 97The called method is not implemented by this method provider.
RETURN CODE 9The resource model does not implement this method.
A
277IBM Tivoli Monitoring Resource Model Reference
A.
Retu
rnC
od
esfo
rB
uilt-in
Actio
ns
(Win
do
ws)
Built-in Actions of the Event Log Resource ModelThe Event Log resource model has the following built-in actions:
¶ EnlargeIRPStackSize action
¶ DeleteRegistry action
¶ RaiseSessTimeOut action
Enlarge IRP Stack Size ActionThe return codes specific to the EnlargeIRPStackSize built-in action of the Event Logresource model are as follows:
RETURN CODE 0The action has been successfully executed.
RETURN CODE 1An error occurred while accessing the system registry.
RETURN CODE 2The registry key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\IRPStackSize wasnot updated because its value is already greater than 12 (its suggested value).
Delete Registry ActionThe return codes specific to the DeleteRegistry built-in action of the Event Log resourcemodel are as follows:
RETURN CODE 0The action has been successfully executed.
Raise Session Time Out ActionThe return codes specific to the RaiseSessTimeOut built-in action of the Event Log resourcemodel are as follows:
RETURN CODE 0The action has been successfully executed.
RETURN CODE 1The registry key: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SessTimeOut was not updated because its value is already greater than 70 (itsmaximum suggested value).
RETURN CODE 2The registry key: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SessTimeOut was not found in the registry, it has been created and its value hasbeen set to 55.
Built-in Actions of the Event Log Resource Model
278 Version 5.1.1
Built-in Actions of the Network Interface Card Resource ModelThe Network Interface Card resource model has the following built-in actions:
¶ AdjustInitWorkItems action
¶ AjustMaxWorkItems action
Adjust Initial Work Items ActionThe return codes specific to the AdjustInitWorkItems built-in action of the Network InterfaceCard resource model are as follows:
RETURN CODE 0The action has been successfully executed.
RETURN CODE 1The registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\InitWorkItems was set to a value that is alreadygreater than the suggested value.
Adjust Maximum Work Items ActionThe return codes specific to the AdjustMaxWorkItems built-in action of the NetworkInterface Card resource model are as follows:
RETURN CODE 0The action has been successfully executed.
RETURN CODE 1The registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\MaxWorkItems was set to a value that is alreadygreater than the suggested value.
Built-in Actions of the Network Interface Card Resource Model
279IBM Tivoli Monitoring Resource Model Reference
A.
Retu
rnC
od
esfo
rB
uilt-in
Actio
ns
(Win
do
ws)
Built-in Actions of the Service Resource ModelThe Service resource model has only one built-in action, the RestartService action.
Restart Service ActionThe return codes specific to the RestartService built-in action of the Service resource modelare as follows:
RETURN CODE 0The action has been successfully executed.
RETURN CODE 1An error occurred while retrieving the input parameters.
RETURN CODE 2Wrong type of Input Parameters.
RETURN CODE 3Unable to open the service control manager.
RETURN CODE 4Unable to open the service. This might be because the service does not exist on thetarget machine.
RETURN CODE 5Unable to query the status of the service.
RETURN CODE 6It was not possible to start the service. This might be because some serviceprerequisites have not been met.
RETURN CODE 7It was not possible to start the service. This might be because the service iscorrupted.
RETURN CODE 8It was not possible to restart the service. This might be because some serviceprerequisites have not been met.
Built-in Actions of the Service Resource Model
280 Version 5.1.1
Correlated Events (Windows)
This appendix describes all correlated events and the indications from which each one isgenerated. Correlated events are only generated for Windows resource models.
The following table lists the correlated events:
Correlated Event See Page
Busy Drive from High Paging 282
Busy Drive from Low Avail 283
Congested TCP Network 284
Critically Low Disk Space 285
Critical Memory Leak 286
Faulty Disk Subsystem 287
High Disk Read Bytes per Second 288
High Disk Write Bytes per Second 289
High Drive Transfer Rate 290
High Percent Disk Time 291
Possible Disk Fragmentation 292
Process Hogging CPU 293
Slow Hard Drive 294
B
281IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
Busy Drive from High PagingThe TMW_BusyDriveFromPaging indication is generated from the following indications:
¶ TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource model
¶ TMW_HighPaging indication from the Memory resource model
This event is generated when it is determined that the local logical disk is busy which ismost likely being caused by excessive hard page faulting.
TMW_BusyDriveFromPaging has the following event properties:
Disk The logical disk being analyzed
PercentDiskTime The percentage usage of the logical drive
PagesSec The number of pages per second
TotalAvail The total of available memory in bytes
TotalWorkingSet The total working set size in bytes
TotalCache The total cache size in bytes
Severity The default value is warning
Busy Drive from High Paging
282 Version 5.1.1
Busy Drive from Low AvailThe TMW_BusyDriveFromLowAvail indication is generated from the following indications:
¶ TMW_LowAvailCausingManyProblems indication from the Memory resource model
¶ TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource model
This event is a relatively serious event because it indicates not only that the local disk isunusually busy, but also that memory is low, paging is high, and the page file is changing.This combination will ultimately cause a core dump if left unchecked.
TMW_BusyDriveFromLowAvail has the following event properties:
Disk The logical disk that is being analyzed
PercentDiskTime The percentage usage of the logical drive
TotalAvail The total of available memory in bytes
PageFaultsSec The current value for page faults per second
PagesSec The current value of pages per second
CommittedBytes The current total of committed bytes
CommittedLimit The upper limit of the committed bytes
Severity The default value is critical
Busy Drive from Low Avail
283IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
Congested TCP NetworkThe TMW_CongestedTCPNetwork indication is generated from the following indications:
¶ TMW_NICOverworked indication from the NIC resource model
¶ TMW_SegmentsReXmit indication from the TCP/IP resource model
This indicates that the TCP/IP network segment that the originating machine is on may becongested. Congested TCP Network is generated when an indication of an overworked NICand a high amount of retransmitted segments are sent.
TMW_CongestedTCPNetwork has the following event properties:
NetworkInterface The identity of network interface card being examined
SegmentsReXmitSec The number of segments retransmitted per second
DGSec The number of datagrams transmitted per second
SegmentsSec The number of segments being sent per second
FragsToDGRatio Ratio of fragmented datagrams to total datagrams
OuputQueueLength The length of the output queue
NICBPS The bytes per second transferred through the networkinterface card
CurrentBandWidth The bandwidth of the network interface card
Severity The default value is warning
Congested TCP Network
284 Version 5.1.1
Critically Low Disk SpaceThe TMW_CriticallyLowDiskSpace indication is generated from the following indications:
¶ TMW_LowAvailCausingSoftPagePagefileResize indication from the Memory resourcemodel
¶ TMW_LowLogicalDiskSpace indication from the Logical Disk resource model
This indicates that disk space is low, and it may soon come into demand. If the systemneeds additional space to resize a pagefile, and the logical disk where the pagefile resides islow on space, a core dump may occur.
TMW_CriticallyLowDiskSpace has the following event properties:
Disk The logical disk that is being analyzed
PercentFreeSpace The percentage amount of free space on the logical drive
FreeMB The actual size of free space on the logical drive inMegabytes
CommittedBytes The current total of Committed Bytes
CommittedLimit The upper limit of the Committed Bytes
TotalAvail The total of available memory in bytes
PageFaultsSec The current value for page faults per second
Severity The default value is critical
Critically Low Disk Space
285IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
Critical Memory LeakThe TMW_CriticalMemoryLeakInWS indication is generated from the following indications:
¶ TMW_MemoryLeakInPB indication from the Memory resource model
¶ TMW_LowAvailHighWS indication from the Memory resource model
A memory leak together with an indication of low available memory due to a high workingset will generate this event. This indicates that not only is memory low, but it is also beingconsumed and will soon run out.
TMW_CriticalMemoryLeakInWS has the following event properties:
LeakyProcess The process with the memory leak
IDLeakyProcess The numeric ID of the process with the memory leak
CurrentWorkingSet The current working set of the process
CurrentPrivateBytes The current private bytes of the process
TotalAvail The total of available memory in bytes
TotalWorkingSet The total working set size in bytes
TotalCache The total cache size in bytes
PercentAvail The percentage of available memory in comparison to thesize of the working set and the cache
PercentWS The percentage of working set memory in comparison to thesize of available memory and the cache
PercentCache The percentage of cache memory in comparison to the sizeof the working set and the available memory
IDHighWSProcess The numeric ID of the process with the highest working set
NumProcesses The total number of processes
HighWSProcess The working set of the process with the highest working set
Severity The default value is critical
Critical Memory Leak
286 Version 5.1.1
Faulty Disk SubsystemThe TMW_FaultyDiskSubsystem indication is generated from the following indications:
¶ TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource model
¶ TMW_BusyHardware indication from the Processor resource model
¶ TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource model
A faulty disk subsystem event is generated when a disk is very busy both in terms of justitself and how busy it is keeping the CPU. Sometimes, as in the case of major file servers,this can be expected. However, for most machines, an extremely busy drive over anextended period of time indicates a disk or controller is failing.
TMW_FaultyDiskSubsystem has the following event properties:
LogicalDisk The logical disk that is being analyzed
PhysicalDisk The physical disk that is being analyzed
LogicalPercentDiskTime The percentage usage of the logical drive
PhysicalPercentDiskTime The percentage usage of the physical drive
Processor The identity of the CPU
PercentProcessorTime The current percentage use of the CPU
PercentInterruptTime The current percentage usage of the CPU as it handlesinterrupt requests
InterruptsSec The number of interrupts per second that are passed to theCPU
Severity The default value is critical
Faulty Disk Subsystem
287IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
High Disk Read Bytes per SecondThe TMW_HighDiskReadBytesSec indication is generated from the following indications:
¶ TMW_HighPhysicalDiskReadBytesSec indication from the Physical Disk resource model
¶ TMW_HighLogicalDiskReadBytesSec indication from the Logical Disk resource model
This correlation is generated when a high read bytes per second is indicated in both thelogical drive and the physical drive. This usually indicates that bytes per second read fromthe physical drive is high.
TMW_HighDiskReadBytesSec has the following event properties:
LogicalDisk The logical disk that is being analyzed
PhysicalDisk The physical disk on which the logical disk resides
LogicalDiskReadBytes The number of bytes read per second on the logical disk
PhysicalDiskReadBytesSec The number of bytes read per second on the physical disk
LogicalDiskReadSec The number of read transactions per second on the logicaldisk
PhysicalDiskReadSec The number of read transactions per second on the physicaldisk
LogicalPercentDiskRead The percentage usage of the logical drive during a readoperation
PhysicalPercentDiskRead The percentage usage of the physical drive during a readoperation
Severity The default value is warning
High Disk Read Bytes per Second
288 Version 5.1.1
High Disk Write Bytes per SecondThe TMW_HighDiskWriteBytesSec indication is generated from the following indications:
¶ TMW_HighLogicalDiskWriteBytesSec indication from the Logical Disk resource model
¶ TMW_HighPhysicalDiskWriteBytesSec indication from the Physical Disk resource model
This correlation is generated when a high write bytes per second is indicated in both thelogical drive and physical drive. This usually indicates that bytes per second written to thephysical drive is high.
TMW_HighDiskWriteBytesSec has the following event properties:
LogicalDisk The logical disk that is being analyzed
PhysicalDisk The physical disk on which the logical disk resides
LogicalDiskWriteBytesSec The number of bytes read per second on the logical disk
PhysicalDiskWriteBytesSec The number of bytes read per second on the physical disk
LogicalDiskWriteSec The number of read transaction per second on the logicaldisk
PhysicalDiskWriteSec The number of read transaction per second on the physicaldisk
LogicalPercentDiskWrite The percentage usage of the logical drive during a writeoperation
PhysicalPercentDiskWrite The percentage usage of the physical drive during a writeoperation
Severity The default value is warning
High Disk Write Bytes per Second
289IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
High Drive Transfer RateThe TMW_HighDriveXferRate indication is generated from the following indications:
¶ TMW_HighLogicalDiskXferRate indication from the Logical Disk resource model
¶ TMW_HighPhysicalDiskXferRate indication from the Physical Disk resource model
This correlation is generated when a high read and written bytes per second is indicated inboth the logical drive and physical drive. This usually indicates that bytes per secondtransferred through the physical drive is high.
TMW_HighDriveXferRate has the following event properties:
LogicalDisk The logical disk that is being analyzed.
PhysicalDisk The physical disk on which the logical disk resides.
LogicalDiskXfersSec The rate of bytes transmitted (read or write) per second onthe logical disk.
PhysicalDiskXfersSec The rate of bytes transmitted (read or write) per second onthe physical disk.
LogicalPercentDiskReadTimeThe percentage usage of the logical drive during a readoperation.
PhysicalPercentDiskReadTimeThe percentage usage of the physical drive during a readoperation.
Severity The default value is warning.
High Drive Transfer Rate
290 Version 5.1.1
High Percent Disk TimeThe TMW_HighPercentDiskTime indication is generated from the following indications:
¶ TMW_HighPhysicalPercentDiskTime indication from the Physical Disk resource model
¶ TMW_HighLogicalPercentDiskTime indication from the Logical Disk resource model
This correlation is generated when a high percentage disk time is indicated in both thelogical drive and physical drive. A busy physical disk is the most likely cause.
TMW_HighPercentDiskTime has the following event properties:
LogicalDisk The logical disk that is being analyzed.
PhysicalDisk The physical disk on which the logical disk resides.
LogicalPercentDiskTime The percentage usage of the logical drive.
PhysicalPercentDiskTime The percentage usage of the physical drive.
LogicalPercentReadTime The percentage usage of the logical drive during a readoperation.
PhysicalPercentReadTime The percentage usage of the physical drive during a readoperation.
LogicalPercentWriteTime The percentage usage of the logical drive during a writeoperation.
PhysicalPercentWriteTime The percentage usage of the physical drive during a writeoperation.
Severity The default value is warning.
High Percent Disk Time
291IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
Possible Disk FragmentationThe TMW_PossibleFrag indication is generated from the following indications:
¶ TMW_LogicalPossibleFrag indication from the Logical Disk resource model
¶ TMW_PhysicalPossibleFrag indication from the Physical Disk resource model
This correlation is generated when a possible fragmentation is indicated in both the logicaldrive and physical drive. It signifies that there is possibly some fragmentation on thephysical drive.
TMW_PossibleFrag has the following event properties:
LogicalDisk The logical disk that is being analyzed
PhysicalDisk The physical disk that is being analyzed
LogicalPercentDiskTime The percentage usage of the logical disk
PhysicalPercentDiskTime The percentage usage of the physical disk
LogicalDiskBytesSec The transfer rate (both read and write) per second of logicaldisk
PhysicalDiskBytesSec The transfer rate (both read and write) per second ofphysical disk
Severity The default value is minor
Possible Disk Fragmentation
292 Version 5.1.1
Process Hogging CPUThe TMW_ProcessHoggingCPU indication is generated from the following indications:
¶ TMW_HighProcesses indication from the Processor resource model
¶ TMW_ProcessHighCPU indication from the Process resource model
This indication is generated when CPU has a high percentage utilization and one or moreprocesses use an unusually high percentage of CPU.
TMW_ProcessHoggingCPU has the following event properties:
Process The name of the active process with the highest CPU usage.
IDProcess The process identity (pid) of the active process with thehighest CPU usage.
Processor The CPU being examined.
PercentProcessorTime The total percentage usage of the CPU.
PrcPercentUserTime The percentage usage of the CPU that is being used by theprocess.
PrcPercentPriviledgedTime The percentage privileged time of the CPU that is being usedby the process.
PrcPriorityBase The base priority of the process.
Severity The default value is critical.
Process Hogging CPU
293IBM Tivoli Monitoring Resource Model Reference
B.
Co
rrelatedE
vents
(Win
do
ws)
Slow Hard DriveThe TMW_SlowHardDrive indication is generated from the following indications:
¶ TMW_SlowPhysicalDrive indication from the Physical Disk resource model
¶ TMW_SlowLogicalDrive indication from the Logical Disk resource model
This correlation is generated when a slow drive is indicated in both the logical drive and thephysical drive. In this situation, the physical hard drive is possibly too slow.
TMW_SlowHardDrive has the following event properties:
LogicalDisk The logical disk that is being analyzed
PhysicalDisk The physical disk on which the logical disk resides
CurrentLogicalQLength The current queue length for the logical disk
CurrentPhysicalQLength The current queue length for the physical disk
PercentLogicalDiskTime The percentage usage of the logical disk
PercentPhysicalDiskTime The percentage usage of the physical disk
Severity The default value is warning
Slow Hard Drive
294 Version 5.1.1
Glossary
A
Adapter Configuration Facility. In the Tivoli EnterpriseConsole, a graphical user interface that enables a Tivoliadministrator to easily configure and customize event adapters.
C
cache. A buffer storage that contains frequently accessedinstructions and data; it is used to reduce access time.
configuration file. A file that specifies the characteristics of asystem device or network.
D
data view. In IBM Tivoli Monitoring, a way of displayingdata in the Web Health Console.
database browser. In IBM Tivoli Monitoring, the Web HealthConsole component that provides hierarchical access toinformation about current resource problems. This informationcan come from any endpoint to which the Web Health Consolehas access, and it might pertain to any resource model installedon that endpoint. See also Web Health Console and resourcemodel.
default policy. In a Tivoli environment, a set of resourceproperty values that are assigned to a resource when theresource is created.
defragmentation. The process of running a software utility torewrite fragmented data to contiguous sectors of a computerstorage medium to improve access and retrieval time.
Desktop Management Task Force (DMTF). An alliance ofcomputer vendors that was convened to define streamlinedmanagement of the diverse operating systems commonly foundin an enterprise.
E
endpoint. In a Tivoli environment, a Tivoli client that is theultimate recipient for any type of Tivoli operation.
event. In a Tivoli environment, any significant change in thestate of a system resource, network resource, or networkapplication. An event can be generated for a problem, for theresolution of a problem, or for the successful completion of atask. Examples of events are the normal starting and stoppingof a process, the abnormal termination of a process, and themalfunctioning of a server. See also indication.
event class. In the Tivoli Enterprise Console, a classificationfor an event that indicates the type of information that the eventadapter will send to the event server.
F
fragmentation. An operating system’s process of writingdifferent parts of a file to discontiguous sectors on a computerstorage medium when contiguous space that is large enough tocontain the entire file is not available. When data is thusfragmented, the time that it takes to access the data mayincrease because the operating system must search differenttracks for information that should be in one location.
G
gateway. In a Tivoli environment, software running on amanaged node that provides all communication servicesbetween a group of endpoints and the rest of the Tivolienvironment. This gateway includes the multiplexed distribution(MDist) function, enabling it to act as the fanout point fordistributions to many endpoints.
H
Web Health Console. In IBM Tivoli Monitoring, a componentthat displays real-time and historical data for any resourcemodel at any endpoint. Using the graphical user interface, userscan locate individual problems associated with one or moreresources. The status is displayed as a value between 0(representing an identified problem, that is, an event) and 100(representing no recent indications). Users can select views ofresource problems as tabular data, different types of charts, andso on.
I
IBM Tivoli Monitoring. A Tivoli application that appliespreconfigured, automated best practices to the automatedmonitoring of essential system resources. The applicationdetects bottlenecks and other potential problems and providesfor the automatic recovery from critical situations, whicheliminates the need for system administrators to manually scanthrough extensive performance data. The application alsointegrates seamlessly with other Tivoli Availability solutions,including the Tivoli Business Systems Manager and the TivoliEnterprise Console. Previously called Tivoli DistributedMonitoring (Advanced Edition).
indication. An entity triggered by the occurrence of a problemin an endpoint relating to one or more resources. Indications areconsolidated into events within the endpoint being monitored.See also event.
installation repository (IR). In Tivoli Software InstallationService (SIS), the directory that contains reusable installationimages and other data that is used by SIS.
295IBM Tivoli Monitoring Resource Model Reference
Glo
ssary
M
managed node. In a Tivoli environment, any managedresource on which the Tivoli Management Framework isinstalled.
monitoring collection. In IBM Tivoli Monitoring, a collectionof predefined monitors. Several monitoring collections arepackaged with IBM Tivoli Monitoring, but Tivoli administratorscan also use custom-developed and third-party monitoringcollections. See also custom monitor.
O
object. In object-oriented design or programming, a concreterealization of a class that consists of data and the operationsassociated with that data.
P
policy region. In a Tivoli environment, a group of managedresources that share one or more common policies. Tivoliadministrators use policy regions to model the management andorganizational structure of a network computing environment.The administrators can group similar resources, define access toand control the resources, and associate rules for governing theresources.
policy subregion. In a Tivoli environment, a policy regioncreated or residing in another policy region. When a policysubregion is created, it initially uses the resource and policyproperties of the parent policy region. The Tivoli administratorcan later change or customize these properties to reflect thespecific needs and differences of the subregion.
profile. In a Tivoli environment, a container forapplication-specific information about a particular type ofresource. A Tivoli application specifies the template for itsprofiles; the template includes information about the resourcesthat can be managed by that Tivoli application. A profile iscreated in the context of a profile manager; the profile managerlinks a profile to the Tivoli resource (for example, a managednode) that uses the information contained in the profile. Aprofile does not have any direct subscribers.
profile manager. In a Tivoli environment, a container forprofiles that links the profiles to a set of resources, calledsubscribers. Tivoli administrators use profile managers toorganize and distribute profiles. A profile manager is created inthe context of a policy region and is a managed resource in apolicy region.
R
reference model. In the context of Tivoli software, the modelconfiguration for a system or set of systems that is used tomaintain consistent configurations in a distributed environment.In Tivoli Inventory, reference models are created in theconfiguration repository.
resource. In IBM Tivoli Monitoring context, a resource isanything that affects the operation of the system and includesphysical and logical disks, CPUs, memory, printers, as well asthe processes running, services, such as LanMan and theWindows event log, and TCP/IP.
resource model. In IBM Tivoli Monitoring, the logicalmodeling of one or more resources, along with the logic onwhich cyclical data collection, data analysis, and monitoring arebased. Related events and actions are triggered, if required. Forany resource model, users can specify individual thresholds andevent aggregation rules. See also event.
rule base. In the Tivoli Enterprise Console, one or more rulesets and the event class definitions for which the rules arewritten. The Tivoli Enterprise Console uses the rule base inmanaging events. An organization can create many rule bases,with each rule base fulfilling a different set of needs fornetwork computing management.
S
Software Installation Service (SIS). A Tivoli product thatprovides an easy-to-use, efficient interface for installing TivoliEnterprise™ software. SIS uses Tivoli’s MDist technology andprovides automated checking for prerequisite software, areusable repository of installation images, and both graphicaland command line interfaces for deploying Tivoli products to alarge number of computers.
subscriber. In a Tivoli environment, a managed node, aprofile manager, an endpoint, or another Tivoli client that issubscribed to a profile manager. Although profiles aredistributed to a subscriber, the subscriber may or may not bethe final destination of the profile distribution.
T
task library. In a Tivoli environment, a container in which aTivoli administrator can create and store tasks and jobs.
threshold. (1) In software products, a value that defines alimit for a monitored condition. (2) In IBM Tivoli Monitoring,a threshold is a named property with a user-defined value.Typically, the value specified for a threshold represents asignificant level of a performance-related entity, which, ifexceeded, a system administrator might want to know about.
Tivoli Distributed Monitoring. Previous name of TivoliDistributed Monitoring (Classic Edition).
Tivoli Distributed Monitoring (Advanced Edition). Previousname of IBM Tivoli Monitoring.
Tivoli Distributed Monitoring (Classic Edition). A Tivoliapplication that provides distributed monitors for monitoringsystem resources. The application initiates necessary correctiveactions and informs system administrators of potentialproblems. These monitors can be centrally configured anddeployed to monitor individual machines. The application also
managed node • Tivoli Distributed Monitoring (Classic Edition)
296 Version 5.1.1
integrates seamlessly with other Tivoli Availability solutions,including the Tivoli Enterprise Console. Previously called TivoliDistributed Monitoring.
Tivoli Enterprise Console. A Tivoli product that collects,processes, and automatically initiates corrective actions forsystem, application, network, and database events; it is thecentral control point for events from all sources. The TivoliEnterprise Console provides a centralized, global view of thenetwork computing environment; it uses distributed eventmonitors to collect information, a central event server toprocess information, and distributed event consoles to presentinformation to system administrators.
Tivoli environment. The Tivoli applications, based upon theTivoli Management Framework, that are installed at a specificcustomer location and that address network computingmanagement issues across many platforms. In a Tivolienvironment, a system administrator can distribute software,manage user configurations, change access privileges, automateoperations, monitor resources, and schedule jobs.
Tivoli management agent. In the Tivoli environment, anagent that securely performs administrative operations.
Tivoli Management Framework. The base software that isrequired to run the applications in the Tivoli product suite. Thissoftware infrastructure enables the integration of systemsmanagement applications from Tivoli Systems Inc. and theTivoli Partners. In a Tivoli environment, the Tivoli ManagementFramework is installed on every client and server; however, theTMR server is the only server that holds the full objectdatabase.
Tivoli management region. In a Tivoli environment, a Tivoliserver and the set of clients that it serves. An organization canhave more than one Tivoli management region. A Tivolimanagement region addresses the physical connectivity ofresources whereas a policy region addresses the logicalorganization of resources.
Tivoli Enterprise Console • Tivoli management region
297IBM Tivoli Monitoring Resource Model Reference
Glo
ssary
Glossary
298 Version 5.1.1
Index
Aaccount not valid for root indication 195account not valid for root problem 191actions, built-in (Windows)
adjust initial work items 65, 279adjust maximum work items 65, 279common 277delete registry 278delete registry key shares 12description 277enlarge IRP stack size 11, 278Event Log resource model 11, 278Network Interface Card resource model 65, 279raise session timeout 12, 278restart service 123, 280Services resource model 123, 280
adjust initial work items action 65, 279adjust maximum work items action 65, 279adjust work items indication 47alternative groups parameter 198alternative owners parameter 198ASP Disk Mirroring resource model
description 209indications 209mirroring not active indication 210parameters 211
ASP nearing capacity indication 214ASP overflow indication 215ASP Utilization
resource modeldescription 213
ASP Utilization resource modelASP nearing capacity indication 214ASP overflow indication 215indications 213logging 216parameters 216
available disk space configuration parameter 116available file system space configuration parameter 202available space threshold 148, 151
BBasic CPU Utilization
resource modeldescription 217
Basic CPU Utilization Guideline Exceeded indication 219Basic CPU Utilization GuidelineLong Running Exceeded
indication 218Basic CPU Utilization Peak Exceeded indication 220Basic CPU Utilization Peak Long Running Exceeded
indication 218
Basic CPU Utilization resource modelBasic CPU Utilization Guideline Exceeded indication 219Basic CPU Utilization Guideline Long Running Exceeded
indication 218Basic CPU Utilization Peak Exceeded indication 220Basic CPU Utilization Peak Long Running Exceeded
indication 218indications 217logging 221
Basic Interactive CPU Utilizationresource model
description 223Basic Interactive CPU Utilization Guideline Exceeded
indication 225Basic Interactive CPU Utilization Peak Exceeded
indication 226Basic Interactive CPU Utilization resource model
Basic Interactive CPU Utilization Guideline Exceededindication 225
Basic Interactive CPU Utilization Peak Exceededindication 226
indications 223logging 227
booksfeedback xxonline xxordering xx
broadcast frames problem 45browser threshold 122built-in actions (Windows)
adjust initial work items 279adjust maximum work items 279common 277decription 277delete registry 278enlarge IRP stack size 278Event Log resource model 278Network Interface Card resource model 279raise session timeout 278restart service 280Services resource model 280
busy drive from high paging correlated event 282busy drive from low avail correlated event 283busy hardware indication 107bytes transferred per second problem 13, 79
Ccache problem 23client connectivity problems 7committed bytes problem 24computers parameter 70
299IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Configuration object not active indication 229Configuration Objects
resource modeldescription 229
Configuration Objects resource modelConfiguration object not active indication 229indications 229parameters 230
congested TCP network correlated event 284correlated events
busy drive from high paging 282busy drive from low avail 283congested TCP network 284critical memory leak 286critically low disk space 285description 281faulty disk subsystem 287high disk read bytes per second 288high disk write bytes per second 289high drive transfer rate 290high percent drive time 291possible disk fragmentation 292process hogging CPU 293slow hard drive 294
CPU cannot keep up with hardware indication 108CPU resource model
description 135high CPU overload indication 136high CPU usage by system indication 137indications 135logging 138percentage of CPU in idle threshold 136, 138percentage of CPU used by system threshold 137, 138thresholds 138
critical memory leak correlated event 286critically low disk space correlated event 285Customer Support xxii
DDatabase CPU Utilization
resource modeldescription 231
Database CPU Utilization Exceeded indication 231Database CPU Utilization resource model
Database CPU Utilization Exceeded 231indications 231logging 232
defined users parameter 198delete registry action 278delete registry key shares action 12detection of malfunctioning devices problem 7directory names, notation xxiiidisk fragmentation (possible) correlated event 292disk space problem 13Distribution Queues
resource modeldescription 233
Distribution Queues resource modelHigh priority distribution queue not active indication 234indications 233Normal priority distribution queue not active
indication 234parameters 234
DMXCpu resource model 135DMXFile resource model 141DMXFileSystem resource model 147DMXMemory resource model 153DMXNetworkInterface resource model 159DMXNetworkRPCNFS resource model 169DMXProcess resource model 183DMXSecurity resource model 191DMXSpp resource model 201duplicate account indication 192
Ee-mail contact xxiienlarge IRP stack size action 11, 278environment variables, notation xxiiievent ID 11 indication 8event ID 15 indication 9event ID 2011 indication 9event ID 2511 indication 9event ID 3013 indication 10event ID 7023 indication 10event ID 9 indication 8event IDs parameter 69Event Log resource model
actions 11built-in actions 278client connectivity problems 7delete registry action 278delete registry key shares action 12description 7detection of malfunctioning devices problem 7enlarge IRP stack size action 11, 278event ID 11 indication 8event ID 15 indication 9event ID 2011 indication 9event ID 2511 indication 9event ID 3013 indication 10event ID 7023 indication 10event ID 9 indication 8indication properties 11indications 8problems highlighted 7raise session timeout action 12, 278server connectivity problems 7thresholds 11
event severity parameter 69EventLog threshold 122events, correlated (Windows) 281excessive page faults threshold 44excessive paging threshold 29, 30, 44
300 Version 5.1.1
Ffaulty disk subsystem correlated event 287feedback about publications xxiifile attributes changed indication 143file changed indication 142file not present indication 144File resource model
description 141file attributes changed indication 143file changed indication 142file not present indication 144file to be checked parameter 145, 151ignored file system parameter 151indications 141logging 145parameters 145
File System resource modelavailable space threshold 148, 151description 147fragmented file system indication 149indications 147logging 152low percent space available indication 148low percentage of available I-nodes indication 150low space available indication 148parameters 151percent available space threshold 148, 151percentage of available I-nodes threshold 150, 151percentage of file system space used threshold 149, 151percentage of I-nodes used threshold 149, 151thresholds 151
file to be checked parameter 145, 151files to be monitored parameter 198filter type parameter 70fragmented data problem 125fragmented file system indication 149
Hhandle leaks problem 101hardware keeping CPU busy indication 109high broadcast frames indication 48high bytes per second threshold 22, 81, 82, 83, 84, 85, 86, 87high CPU overload indication 136high CPU usage by system indication 137high CPU usage indication 103, 104high CPU usage interrupt threshold 107, 108, 109, 111, 113high CPU usage problem 101, 105high CPU usage process threshold 111, 112, 113high CPU usage threshold 107, 108, 109, 111, 112, 113high CPU usage user privilege threshold 113high current commands indication 49high current commands modifier threshold 49, 55, 56, 58, 61,
64high current percent time indication 91high disk read bytes per second correlated event 288high disk write bytes per second correlated event 289high drive transfer rate correlated event 290high duplicate RPC server calls indication 175
high errored out ratio threshold 50, 64high errored ratio indication 50high fragment ratio indication 127high fragment ratio threshold 127, 130high input packets in error indication 160high interrupts per second threshold 107, 108, 109, 113high job errors indication 92high job errors per day indication 93high log-in number for user indication 193high network traffic indication 179high NFS buffer size indication 170high NFS server get-attribute operations indication 171high NFS server read operations indication 172high NFS server readlink operations indication 173high NFS server write operations indication 174high not ready errors indication 94high not ready errors per day indication 95high number of zombie processes indication 184high out of paper errors indication 96high out of paper errors per day indication 97high output packets in error indication 161high output queue length modifier threshold 51, 52, 64high paging indication 26high percent broadcast threshold 48, 55, 56, 58, 60, 61, 63, 64high percent bytes per second threshold 47, 49, 51, 52, 53, 55,
56, 58, 60, 61, 62, 63, 64high percent disk time indication 81high percent drive time correlated event 291high percent usage delta indication 110high percent usage delta threshold 110, 113high percent usage threshold 22, 81, 82, 83, 84, 85, 87high percent utilization threshold 47, 48, 49, 53, 55, 56, 58,
60, 61, 62, 63, 64high percentage disk time indication 18high percentage packet collisions indication 162high ping indication 128High priority distribution queue not active indication 234high processes indication 111high queue length threshold 19, 22, 81, 82, 83, 84, 85, 86, 87high read bytes per second indication 15, 82high retransmitted calls indication 176high RPC bad calls indication 177high segments retransmitted threshold 129, 130high timeouts and badxids indication 178high transfer rate indication 17, 83high work item shortages threshold 47, 53, 60, 62, 63, 64high write bytes per second indication 16, 84History Log
resource modeldescription 235
History Log resource modelindications 235List of jobs not empty indication 235parameters 236
301IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Iignored file system parameter 151illegal group indication 194illegal owner indication 194indications
OS/400ASP Disk Mirroring resource model 209ASP nearing capacity 214ASP overflow 215ASP Utilization resource model 213Basic CPU Utilization Guideline Exceeded 219Basic CPU Utilization Guideline Long Running
Exceeded 218Basic CPU Utilization Peak Exceeded 220Basic CPU Utilization Peak Long Running
Exceeded 218Basic CPU Utilization resource model 217Basic Interactive CPU Utilization Guideline
Exceeded 225Basic Interactive CPU Utilization Peak Exceeded 226Basic Interactive CPU Utilization resource model 223Configuration object not active 229Configuration Objects resource model 229Database CPU Utilization Exceeded 231Database CPU Utilization resource model 231Distribution Queues resource model 233High priority distribution queue not active 234History Log resource model 235Interactive Feature CPU Utilization Exceeded 238Interactive Feature CPU Utilization resource model 237Job Log resource model 239Job Log Warning Message 239Job Not Active 247Job Queue Not Active 244Job Queue Not Assigned 244Job Queue resource model 243Job Status resource model 247Last Changed Date Differentt 258List of jobs not empty 235Management Central Critical 250Management Central Events resource model 249Management Central Harmless 250Management Central Unknown 250Management Central Warning 250mirroring not active 210Network Attributes Mismatch 253Network Attributes resource model 253No writers started for output queue 255Normal priority distribution queue not active 234Object Owner Different 257Object Size Exceeded 258Output queue not active 256Output Queues resource model 255Parametric Object and File resource model 257Subsystem Not Active 263Subsystem resource model 263System ASP Used Near Peak Capacity Guidelines 266System Disk Resources resource model 265System Object Mismatch 269System Value resource model 269TCP Interface Not Active 271
indications (continued)OS/400 (continued)
TCP Interface resource model 271TCP Service Not Active 273TCP Service resource model 273Too Many Jobs Queued 243Total Auxiliary Storage Reached Capacity
Guidelines 267Total Auxiliary Storage Reached Peak Guidelines 266
UNIX/Linuxaccount not valid for root 195CPU resource model 135duplicate account 192file attributes changed 143file changed 142file not present 144File resource model 141File System resource model 147fragmented file system 149high CPU overload 136high CPU usage by system 137high duplicate RPC server calls 175high input packets in error 160high log-in number for user 193high network traffic 179high NFS buffer size 170high NFS server get-attribute operations 171high NFS server read operations 172high NFS server readlink operations 173high NFS server write operations 174high number of zombie processes 184high output packets in error 161high percentage packet collisions 162high retransmitted calls 176high RPC bad calls 177high timeouts and badxids 178illegal group 194illegal owner 194interface not enabled 163interface not operational 164low percent space available 148low percentage of available I-nodes 150low space available 148low storage space 154low swap space 155Memory resource model 153Network Interface resource model 159Network RPC-NFS resource model 169nonexistent file 193null password 195process consuming high CPU 185process killed or nonexistent 186Process resource model 184process stopped 187Security resource model 191slow network 180suspect supergroup 196suspect superuser 196system thrashing 156unknown interface status 165wrong file mode 197
302 Version 5.1.1
indications (continued)Windows
adjust work items 47busy hardware 107CPU cannot keep up with hardware 108event ID 11 8event ID 15 9event ID 2011 9event ID 2511 9event ID 3013 10event ID 9 8event ID7023 10Event Log resource model 8hardware keeping CPU busy 109high broadcast frames 48high current commands 49high current percent time 91high errored ratio 50high fragment ratio 127high job errors 92high job errors per day 93high not ready errors 94high not ready errors per day 95high out of paper errors 96high out of paper errors per day 97high paging 26high percent disk time 81high percent usage delta 110high percentage disk time 18high ping 128high processes 111high read bytes per second 15, 82high transfer rate 17, 83high write bytes per second 16, 84logical disk possible fragmentation 19Logical Disk resource model 14low available memory 27low available memory causing hard paging 28low available memory causing many problems 31low available memory causing soft paging and pagefile
resizing 29low available memory is causing excessive soft
paging 30low available memory with a high working set 33low available memory with a small pagefile 35low available memory with high cache 32low copy read hits 36low data map hits 37low disk space 20low MDL read hits 38low pin read hits 39memory leak in private bytes 41memory leak in system code 42memory leak in system drivers 43Memory resource model 25network interface card overworked 51Network Interface Card resource model 46network interface card too slow 52pagefile is resizing 40Parametric Services resource model 71Parmetric Event Log resource model 67
indications (continued)Windows (continued)
Parmetric TCP/IP Ports resource model 75physical disk possible fragmentation 85Physical Disk resource model 80Printer resource model 90process handle leak 102process high CPU 103Process resource model 102processor busy 112Processor resource model 106properties 11redirector affecting server 53redirector overloaded 55redirector overloaded affecting segment 56segment affecting redirector 58segment affecting server 60segments ReXmit 129server affecting redirector 61server overloaded 62server overloaded affecting segment 63services failing service 72, 120Services resource model 120services stopped service 73, 121slow logical drive 21slow physical drive 86state of the defined port 76TCP/IP resource model 126Windows event logged 68
input packets in error threshold 160, 166Interactive Feature CPU Utilization
resource modeldescription 237
Interactive Feature CPU Utilization Exceeded indication 238Interactive Feature CPU Utilization resource model
indications 237Interactive Feature CPU Utilization Exceeded
indication 238logging 238
interface not enabled indication 163interface not operational indication 164
Jjob errors per day threshold 93, 98job errors threshold 92, 98Job Log
resource modeldescription 239
Job Log resource modelindications 239Job Log Warning Message indication 239parameters 240
Job Log Warning Message indication 239Job Not Active indication 247Job Queue
resource modeldescription 243
Job Queue Not Active indication 244
303IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Job Queue Not Assigned indication 244Job Queue resource model
indications 243Job Queue Not Active indication 244Job Queue Not Assigned indication 244parameters 245Too Many Jobs Queued indication 243
Job Statusresource model
description 247Job Status resource model
indications 247Job Not Active indication 247parameters 248
Kkey services problem 119
LLanmanServer threshold 122LanmanWorkstation threshold 122Last Changed Date Different indication 258List of jobs not empty indication 235log file type parameter 69logging
OS/400ASP Utilization resource model 216Basic CPU Utilization resource model 221Basic Interactive CPU Utilization resource model 227Database CPU Utilization resource model 232Interactive Feature CPU Utilization resource model 238Storage Pools resource model 262System Disk Resources resource model 267
UNIX/LinuxCPU resource model 138File resource model 145File System resource model 152Memory resource model 157Network Interface resource model 166Network RPC-NFS resource model 182Process resource model 188Security resource model 198Server Performance Prediction resource model 202
WindowsLogical Disk resource model 22Memory resource model 44Network Interface Card resource model 65Parmetric Services resource model 74Parmetric TCP/IP Ports resource model 77Physical Disk resource model 87Printer resource model 99Process resource model 104Processor resource model 114Server Performance Prediction resource model 116TCP/IP resource model 130
logical disk possible fragmentation indication 19Logical Disk resource model
bytes transferred per second problem 13description 13disk space problem 13high bytes per second threshold 22high percent disk time indication 18high percent usage threshold 22high queue length threshold 19, 22high read bytes per second indication 15high transfer rate indication 17high write bytes per second indication 16indications 14logging 22logical disk possible fragmentation indication 19low disk space indication 20low disk space threshold 22percent usage problem 13prerequisites 14problems highlighted 13slow logical drive indication 21thresholds 22
logons by same user problem 191low available memory causing hard paging indication 28low available memory causing many problems indication 31low available memory causing soft paging and pagefile resizing
indication 29low available memory indication 27low available memory is causing excessive soft paging
indication 30low available memory problem 24low available memory with a high working set indication 33low available memory with a small pagefile indication 35low available memory with high cache indication 32low cache hits percent threshold 44low copy read hits indication 36low data map hits indication 37low disk space indication 20low disk space threshold 22low MDL read hits indication 38low percent space available indication 148low percentage of available I-nodes indication 150low pin read hits indication 39low segments threshold 128, 130low space available indication 148low storage space indication 154low swap space indication 155
MManagement Central Critical indication 250Management Central Events
resource modeldescription 249
Management Central Events resource modelindications 249Management Central Critical indication 250Management Central Harmless indication 250Management Central Unknown indication 250
304 Version 5.1.1
Management Central Events resource model (continued)Management Central Warning indication 250
Management Central Unknown indication 250Management Central Warning indication 250Management CentralHarmless indication 250manuals
feedback xxonline xxordering xx
maximum handles indication 102, 104maximum number of zombie processes threshold 184, 188maximum print jobs threshold 98maximum print queues threshold 98maximum processes indication 102, 103, 104Memory (UNIX/Linux) resource model
description 153indications 153logging 157low storage space indication 154low swap space indication 155memory page-in rate threshold 156, 157memory page-out rate threshold 156, 157percentage of available swap space threshold 155, 157percentage of available virtual storage threshold 154, 157system thrashing indication 156thresholds 157
Memory (Windows) resource modelcache problem 23committed bytes problem 24description 23excessive page faults threshold 44excessive paging threshold 29, 30, 44high paging indication 26indications 25logging 44low available memory causing hard paging indication 28low available memory causing many problems
indication 31low available memory causing soft paging and pagefile
resizing indication 29low available memory indication 27low available memory is causing excessive soft paging
indication 30low available memory problem 24low available memory with a high working set
indication 33low available memory with a small pagefile indication 35low available memory with high cache indication 32low cache hits percent threshold 44low copy read hits indication 36low data map hits indication 37low MDL read hits indication 38low pin read hits indication 39memory leak in private bytes indication 41memory leak in system code indication 42memory leak in system drivers indication 43memory leaks problem 24minimum available bytes threshold 44minimum committed bytes threshold 28, 44pagefile is resizing indication 40paging and page faulting problem 24
Memory (Windows) resource model (continued)problems highlighted 23thresholds 44
memory leak in private bytes indication 41memory leak in system code indication 42memory leak in system drivers indication 43memory leaks problem 24memory page-in rate threshold 156, 157memory page-out rate threshold 156, 157minimum available bytes threshold 44minimum committed bytes threshold 28, 44mirroring not active indication 210moderate DG threshold 128, 130Mof file properties
CPU resource model 138File resource model 145File System resource model 152Memory resource model 157Network Interface resource model 166Process resource model 188Security resource model 199
multiple CPU problems 105
NNetlogon threshold 123Network Attributes
resource modeldescription 253
Network Attributes Mismatch indication 253Network Attributes resource model
indications 253Network Attributes Mismatch indication 253parameters 254
network congestion problem 125network interface card overworked indication 51network interface card problem 45Network Interface Card resource model
actions 65adjust initial work items action 65, 279adjust maximum work items action 65, 279adjust work items indication 47broadcast frames problem 45built-in actions 279description 45high broadcast frames indication 48high current commands indication 49high current commands modifier threshold 49, 55, 56, 58,
61, 64high errored out ratio threshold 50, 64high errored ratio indication 50high output queue length mod threshold 51, 52, 64high percent broadcast threshold 48, 55, 56, 58, 60, 61, 63,
64high percent bytes per second threshold 47, 49, 51, 52, 53,
55, 56, 58, 60, 61, 62, 63, 64high percent utilization threshold 47, 48, 49, 53, 55, 56,
58, 60, 61, 62, 63, 64high work item shortages threshold 47, 53, 60, 62, 63, 64
305IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Network Interface Card resource model (continued)indications 46logging 65network interface card overworked indication 51network interface card problem 45network interface card too slow indication 52prerequisites 45problems highlighted 45redirector affecting server indication 53redirector overloaded affecting segment indication 56redirector overloaded indication 55segment affecting redirector indication 58segment affecting server indication 60server affecting redirector indication 61server and workstation services problem 46server overloaded affecting segment indication 63server overloaded indication 62thresholds 64
network interface card too slow indication 52network interface configuration parameter 116, 201Network Interface resource model
description 159high input packets in error indication 160, 161high percentage packet collisions indication 162indications 159input packets in error threshold 160, 166interface not enabled indication 163interface not operational indication 164logging 166output packets in error threshold 161, 166packet collision percentage threshold 162, 166thresholds 166unknown interface status indication 165
Network RPC-NFS resource modeldescription 169high duplicate RPC server calls indication 175high network traffic indication 179high NFS buffer size indication 170high NFS server get-attribute operations indication 171high NFS server read operations indication 172high NFS server readlink operations indication 173high NFS server write operations indication 174high retransmitted calls indication 176high RPC bad calls indication 177high timeouts and badxids indication 178indications 169logging 182percentage of bad RPC calls threshold 177, 181percentage of client RPC badxids threshold 178, 181percentage of client RPC calls in time-out threshold 178,
181percentage of client RPC retransmissions threshold 176,
181percentage of NFS server getattr operations threshold 171,
181percentage of NFS server read operations threshold 172,
181percentage of NFS server readlink operations
threshold 173, 181percentage of NFS server write operations threshold 174,
181
Network RPC-NFS resource model (continued)percentage of server RPC duplicate requests threshold 175,
181slow network indication 180thresholds 181
No writers started for output queue indication 255nonexistent file indication 193Normal priority distribution queue not active indication 234not ready errors per day threshold 95, 98not ready errors threshold 94, 98notation
environment variables xxiiipath names xxiiitypeface xxiii
NtLmSsp threshold 123null password indication 195
OObject Owner Different indication 257Object Size Exceeded indication 258online publications xxiordering publications xxiout of paper errors per day threshold 97, 98out of paper errors threshold 96, 98output packets in error threshold 161, 166Output queue not active indication 256Output Queues
resource modeldescription 255
Output Queues resource modelindications 255No writers started for output queue indication 255Output queue not active indication 256parameters 256
Ppacket collision percentage threshold 162, 166paging and page faulting problem 24parameters
OS/400ASP Disk Mirroring resource model 211ASP Utilization resource model 216Configuration Objects resource model 230Distribution Queues resource model 234History Log resource model 236Job Log resource model 240Job Queue resource model 245Job Status resource model 248Network Attributes resource model 254Output Queues resource model 256Parametric Object and File resource model 259Storage Pools resource model 261Subsystem resource model 264System Value resource model 270TCP Interface resource model 272
306 Version 5.1.1
parameters (continued)OS/400 (continued)
TCP Service resource model 274UNIX/Linux
alternative groups 198alternative owners 198available file system space configuration 202defined users 198File resource model 145File System resource model 151file to be checked 145, 151files to be monitored 198ignored file system 151network interface configuration 201Process resource model 188processes 188Security resource model 198Server Performance Prediction resource model 201special groups 198special users 198
Windowsavailable disk space configuration 116computers 70event IDs 69event severity 69filter type 70log file type 69network interface configuration 116Parmetric Event Log resource model 69Parmetric Services resource model 74Parmetric TCP/IP Ports resource model 77physical disk configuration 116port numbers 77possible state of a port 77Server Performance Prediction resource model 116services 74source 69Windows 2000 logs 69
Parametric Event Log resource modelcomputers parameter 70description 67event IDs parameter 69event severity parameter 69filter type parameter 70indications 67log file type parameter 69parameters 69source parameter 69thresholds 69Windows 2000 logs parameter 69Windows event logged indication 68
Parametric Object and Fileresource model
description 257Parametric Object and File resource model
indications 257Last Changed Date Different indication 258Object Owner Different indication 257Object Size Exceeded indication 258parameters 259
Parametric Services resource modeldescription 71indications 71logging 74parameters 74port numbers parameter 77possible state of a port parameter 77services failing service indication 72services parameter 74services stopped service indication 73
Parametric TCP/IP Ports resource modeldescription 75indications 75logging 77parameters 77prerequisites 75state of the defined port indication 76
path names, notation xxiiipercent available space threshold 148, 151percent processor threshold 91, 98percent processor time problem 89percent usage problem 13, 79percentage of available I-nodes threshold 150, 151percentage of available swap space threshold 155, 157percentage of available virtual storage threshold 154, 157percentage of bad RPC calls threshold 177, 181percentage of client RPC badxids threshold 178, 181percentage of client RPC calls in time-out threshold 178, 181percentage of client RPC retransmissions threshold 176, 181percentage of CPU in idle threshold 136, 138percentage of CPU used by system threshold 137, 138percentage of CPU used threshold 185, 188percentage of file system space used threshold 149, 151percentage of I-nodes used threshold 149, 151percentage of NFS server getattr operations threshold 171,
181percentage of NFS server read operations threshold 172, 181percentage of NFS server readlink operations threshold 173,
181percentage of NFS server write operations threshold 174, 181percentage of server RPC duplicate requests threshold 175,
181physical disk configuration parameter 116physical disk possible fragmentation indication 85Physical Disk resource model
bytes transferred per second problem 79description 79high bytes per second threshold 81, 82, 83, 84, 85, 86, 87high percent disk time indication 81high percent usage threshold 81, 82, 83, 84, 85, 87high queue length threshold 81, 82, 83, 84, 85, 86, 87high read bytes per second indication 82high transfer rate indication 83high write bytes per second indication 84indications 80logging 87percent usage problem 79physical disk possible fragmentation indication 85prerequisites 80problems highlighted 79slow physical drive indication 86
307IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Physical Disk resource model (continued)thresholds 87
port numbers parameter 77possible disk fragmentation correlated event 292possible state of a port parameter 77prerequisites
WindowsLogical Disk resource model 14Network Interface Card resource model 45Parametric TCP/IP Ports resource model 75Physical Disk resource model 80TCP/IP resource model 125
printer errors problem 89Printer resource model
description 89high current percent time indication 91high job errors indication 92high job errors per day indication 93high not ready errors indication 94high not ready errors per day indication 95high out of paper errors indication 96high out of paper errors per day indication 97indications 90job errors per day threshold 93, 98job errors threshold 92, 98logging 99maximum print jobs threshold 98maximum print queues threshold 98not ready errors per day threshold 95, 98not ready errors threshold 94, 98out of paper errors per day threshold 97, 98out of paper errors threshold 96, 98percent processor threshold 91, 98percent processor time problem 89printer errors problem 89problems highlighted 89thresholds 98
problems highlightedUNIX/Linux
account not valid for root 191logons by same user 191process is stopped or killed 183Process resource model 183process uses too much CPU time 183property changes 191requested process does not exist 183Security resource model 191suspect superuser 191too many zombie processes in the system 183
Windowsbroadcast frames 45bytes transferred per second 13, 79cache 23client connectivity problems 7committed bytes 24detection of malfunctioning devices 7disk space 13fragmented data 125handle leaks 101high CPU usage 101, 105key services 119
problems highlighted (continued)Windows (continued)
low available memory 24memory leaks 24multiple CPU problems 105network congestion 125network interface card 45paging and page faulting 24percent processor time 89percent usage 13, 79printer errors 89server and workstation services 46server connectivity problems 7unstable services 119
Process (UNIX/Linux) resource modeldescription 183high number of zombie processes indication 184indications 184logging 188maximum number of zombie processes threshold 184, 188parameters 188percentage of CPU used threshold 185, 188problems highlighted 183process consuming high CPU indication 185process is stopped or killed problem 183process killed or nonexistent indication 186process stopped indication 187process uses too much CPU time problem 183processes parameter 188requested process does not exist problem 183thresholds 188too many zombie processes in the system problem 183
Process (Windows) resource modeldescription 101handle leaks problem 101high CPU usage indication 103, 104high CPU usage problem 101indications 102logging 104maximum handles indication 102, 104maximum processes indication 102, 103, 104problems highlighted 101process handle leak indication 102process high CPU indication 103thresholds 104
process consuming high CPU indication 185process handle leak indication 102process high CPU indication 103process hogging CPU correlated event 293process is stopped or killed problem 183process killed or nonexistent indication 186process stopped indication 187process uses too much CPU time problem 183processes parameter 188processor busy threshold 112Processor resource model
busy hardware indication 107CPU cannot keep up with hardware indication 108description 105hardware keeping CPU busy indication 109
308 Version 5.1.1
Processor resource model (continued)high CPU usage interrupt threshold 107, 108, 109, 111,
113high CPU usage problem 105high CPU usage process threshold 111, 112, 113high CPU usage threshold 107, 108, 109, 111, 112, 113high CPU usage user privilege threshold 113high interrupts per second threshold 107, 108, 109, 113high percent usage delta indication 110high percent usage delta threshold 110, 113high processes indication 111indications 106logging 114multiple CPU problems 105problems highlighted 105processor busy threshold 112thresholds 113total CPUs modifier threshold 108, 109, 113
property changes problem 191publications
feedback xxonline xxordering xx
Rraise session timeout action 12, 278redirector affecting server indication 53redirector overloaded affecting segment indication 56redirector overloaded indication 55requested process does not exist problem 183resource models
OS/400ASP Disk Mirroring 209ASP Utilization 213Basic CPU Utilization 217Basic Interactive CPU Utilization 223Configuration Objects 229Database CPU Utilization 231Distribution Queues 233History Log 235Interactive Feature CPU Utilization 237Job Log 239Job Queue 243Job Status 247Management Central Events 249Network Attributes 253Output Queues 255Parametric Object and File 257Storage Pools 261Subsystem 263System Disk Resources 265System Value 269TCP Interface 271TCP Service 273
Solaris onlyNetwork RPC-NFS - see resource models,
UNIX/Linux 169
resource models (continued)UNIX/Linux
CPU 135File 141File System 147Memory 153Network Interface 159Network RPC-NFS 169Process 183Security 191Server Performance Prediction 201
WindowsEvent Log 7Logical Disk 13Memory 23Network Interface Card 45Parametric Event Log 67Parametric Services 71Parametric TCP/IP Ports 75Physical Disk 79Printer 89Process 101Processor 105Server Performance Prediction 115Services 119TCP/IP 125TMW_Spp 115
restart service action 123, 280
SSecurity resource model
account not valid for root indication 195account not valid for root problem 191alternative groups parameter 198alternative owners parameter 198defined users parameter 198description 191duplicate account indication 192files to be monitored parameter 198high log-in number for user indication 193illegal group indication 194illegal owner indication 194indications 191logging 198logons by same user problem 191nonexistent file indication 193null password indication 195parameters 198problems highlighted 191property changes problem 191special groups parameter 198special users parameter 198suspect supergroup indication 196suspect superuser indication 196suspect superuser problem 191wrong file mode indication 197
segment affecting redirector indication 58segment affecting server indication 60
309IBM Tivoli Monitoring Resource Model Reference
Ind
ex
segments ReXmit indication 129server affecting redirector indication 61server and workstation services problem 46server connectivity problems 7server overloaded affecting segment indication 63server overloaded indication 62Server Performance Prediction (UNIX/Linux) resource model
available file system space configuration parameter 202description 201logging 202network interface configuration parameter 201parameters 201
Server Performance Prediction (Windows) resource model 115available disk space configuration parameter 116logging 116network interface configuration parameter 116parameters 116physical disk configuration parameter 116
services failing service indication 72, 120services parameter 74Services resource model
actions 123browser threshold 122built-in actions 280description 119EventLog threshold 122indications 120key services problem 119LanmanServer threshold 122LanmanWorkstation threshold 122Netlogon threshold 123NtLmSsp threshold 123problems highlighted 119restart service action 123, 280services failing service indication 120services stopped service indication 121thresholds 122Tivoli endpoint threshold 122unstable services problem 119
services stopped service indication 73, 121slow hard drive correlated event 294slow logical drive indication 21slow network indication 180slow physical drive indication 86source parameter 69special groups parameter 198special users parameter 198state of the defined port indication 76Storage Pools
resource modeldescription 261
Storage Pools resource modellogging 262parameters 261
Subsystemresource model
description 263Subsystem Not Active indication 263Subsystem resource model
indications 263parameters 264
Subsystem resource model (continued)Subsystem Not Active indication 263
suspect supergroup indication 196suspect superuser indication 196suspect superuser problem 191System Disk Resources
resource modeldescription 265
System Disk Resources resource modelindications 265logging 267System ASP Used Near Peak Capacity Guidelines
indication 266Total Auxiliary Storage Reached Capacity indication 267Total Auxiliary Storage Reached Peak Capacity Guidelines
indication 266System Object Mismatch indication 269system thrashing indication 156System Value
resource modeldescription 269
System Value resource modelindications 269parameters 270System Object Mismatch indication 269
TTCP Interface
resource modeldescription 271
TCP Interface Not Active indication 271TCP Interface resource model
indications 271parameters 272TCP Interface Not Active indication 271
TCP Serviceresource model
description 273TCP Service Not Active indication 273TCP Service resource model
indications 273parameters 274TCP Service Not Active indication 273
TCP/IP resource modeldescription 125fragmented data problem 125high fragment ratio indication 127high fragment ratio threshold 127, 130high ping indication 128high segments retransmitted threshold 129, 130indications 126logging 130low segments threshold 128, 130moderate DG threshold 128, 130network congestion problem 125prerequisites 125problems highlighted 125segments ReXmitindication 129
310 Version 5.1.1
TCP/IP resource model (continued)thresholds 130
thresholdsUNIX/Linux
available space 148, 151CPU resource model 138File System resource model 151input packets in error 160, 166maximum number of zombie processes 184, 188memory page-in rate 156, 157memory page-out rate 156, 157Memory resource model 157Network Interface resource model 166Network RPC-NFS resource model 181output packets in error 161, 166packet collision percentage 162, 166percent available space 148, 151percentage of available I-nodes 150, 151percentage of available swap space 155, 157percentage of available virtual storage 154, 157percentage of bad RPC calls 177, 181percentage of client RPC badxids 178, 181percentage of client RPC calls in time-out 178, 181percentage of client RPC retransmissions 176, 181percentage of CPU in idle 136, 138percentage of CPU used 185, 188percentage of CPU used by system 137, 138percentage of file system space used 149, 151percentage of I-nodes used 149, 151percentage of NFS server getattr operations 171, 181percentage of NFS server read operations 172, 181percentage of NFS server readlink operations 173, 181percentage of NFS server write operations 174, 181percentage of server RPC duplicate requests 175, 181Process resource model 188
Windowsbrowser 122Event Log resource model 11EventLog 122excessive page faults 44excessive paging 29, 30, 44high bytes per second 22, 81, 82, 83, 84, 85, 86, 87high CPU usage 103, 104, 107, 108, 109, 111, 112, 113high CPU usage interrupt 107, 108, 109, 111, 113high CPU usage process 111, 112, 113high CPU usage user privilege 113high current commands modifier 49, 55, 56, 58, 61, 64high errored out ratio 50, 64high fragment ratio 127, 130high interrupts per second 107, 108, 109, 113high output queue length modifier 51, 64high output queuelength modifier 52high percent broadcast 48, 55, 56, 58, 60, 61, 63, 64high percent bytes per second 47, 49, 51, 52, 53, 55,
56, 58, 60, 61, 62, 63, 64high percent usage 22, 81, 82, 83, 84, 85, 87high percent usage delta 110, 113high percent utilization 47, 48, 49, 53, 55, 56, 58, 60,
61, 62, 63, 64high queue length 19, 22, 81, 82, 83, 84, 85, 86, 87high segments retransmitted 129, 130
thresholds (continued)Windows (continued)
high work item shortages 47, 53, 60, 62, 63, 64job errors 92, 98job errors per day 28, 93, 98LanmanServer 122LanmanWorkstation 122Logical Disk resource model 22low cache hits percent 44low disk space 22low segments 128, 130maximum handles 102, 104maximum print jobs 98maximum print queues 98maximum processes 102, 103, 104memory resource model 44minimum available bytes 44minimum committed bytes 44moderate DG 128, 130Netlogon 123Network Interface Card resource model 64not ready errors 94, 98not ready errors per day 95, 98NtLmSsp 123out of paper errors 96, 98out of paper errors per day 97, 98Parmetric Event Log resource model 69percent processor 91, 98Physical Disk resource model 87Printer resource model 98Process resource model 104Processor resource model 113Services resource model 122TCP/IP resource model 130Tivoli endpoint 122total CPUs modifier 108, 109, 113
Tivoli Customer Support xxiiTivoli endpoint threshold 122TMW_EventLog resource model 7TMW_LogicalDisk resource model 13TMW_MemoryModel resource model 23TMW_NetworkIntCard resource model 45TMW_ParamEventLog resource model 67TMW_ParamPorts resource model 75TMW_ParamServices resource model 71TMW_PhysicalDiskModel resource model 79TMW_PrintModel resource model 89TMW_Process resource model 101TMW_Processor resource model 105TMW_Services resource model 119TMW_Spp resource model 115TMW_TCPIP resource model 125Too Many Jobs Queued indication 243too many zombie processes in the system problem 183Total Auxiliary Storage Reached Capacity indication 267Total Auxiliary Storage Reached Peak Capacity Guidelines
indication 266total CPUs modifier threshold 108, 109, 113
311IBM Tivoli Monitoring Resource Model Reference
Ind
ex
Uunknown interface status indication 165unstable services problem 119
Vvariables, notation for xxiii
Wwhat’s new in this release xviiWindows 2000 logs parameter 69Windows event logged indication 68wrong file mode indication 197
312 Version 5.1.1
���
SH19-4570-01