|
|
The Cisco Info Server is the core of the Cisco Info Center system. This chapter contains information about how the Cisco Info Server works and explains how to start an Cisco Info Server.
You should read this chapter to understand how the Cisco Info Server is set up. Once you are familiar with this, we recommend you use the Process Control system to manage the Cisco Info Server. See Chapter 2, "Process Control" for detailed information.
Additional information about the Cisco Info Server is included in Appendix A, "Cisco Info Server Reference".
This chapter includes the following sections:
The Cisco Info Server is the core of Cisco Info Center and is where all event and status data is stored and managed.
The Cisco Info Server is an active, main-memory database. Event information is passed to the Cisco Info Server from external programs, such as mediators or gateways, and this information is stored in a series of database tables. The Cisco Info Server uses the event information to update a status table, called alerts.status. When an event is stored in this table, it is known as an alert. For more information about the database tables, see Section, "Cisco Info Server Table Formats".
The Cisco Info Server updates the stored information using a process of deduplication. This process ensures that event information is not duplicated and this reduces the amount of data in the Cisco Info Server. See Section, "Deduplication" for more details.
The Cisco Info Server also stores details of users and their privileges, information about how to display events in the Event List, class information to generic type events, menus for Cisco Info Admin Desktop tools and other information for the management of the system. This means the Cisco Info Admin Desktop tools can attach to the Cisco Info Server and use the event information. For example, the Event List can attach to the Cisco Info Server, validate the user's identity and allow users to view and manipulate these alerts, depending on their security. The objective view also attaches to the Cisco Info Server and allows users to view the information in a graphical display.
Information can be exported from the Cisco Info Server to other applications by attaching a Cisco Info Gateway. The Cisco Info Gateway monitors the alerts.status table for changes. The operation and configuration of a Cisco Info Gateway is covered in the Cisco Info Center Mediator and Gateway Reference manual.
The Cisco Info Server is also capable of responding automatically to particular events or state of event. This is known as automation. For details, see Chapter 5, "Automation".
An Cisco Info Server uses Cisco Info Server SQL as its command language. For details on the syntax of Cisco Info Server SQL see Appendix A, "Cisco Info Server Reference".
The following sections describe how the Cisco Info Server reduces the event information using the deduplication process.
Event information is forwarded to the Cisco Info Server from mediators or gateways with an identifier field. This field is used as a key and the alerts.status table is searched for an identical key.
When an identical key is not found in the status table, an alert entry is inserted into the alerts.status table. All the field information from the Cisco Info Mediator is placed in this new entry, including the FirstOccurrence time.
When an identical key is found, that entry is updated with the latest status information. The process of updating involves updating the LastOccurrence field with the time from the incoming event and incrementing the Count field. No other fields are updated unless the ReawakenClosed property in the Cisco Info Server is set to true. In this case, the Severity field is updated when the severity in the Cisco Info Server's alert is 0 (Closed) and when DeackOnReawaken is set, the Acknowledged field is cleared. This key matching process is referred to as deduplication.
The Identifier field plays a critical role in how an event is deduplicated and what makes a unique event. Identifier fields are generated by the mediators sending the event. The generation of the identifier is controlled by the Cisco Info Mediator rules file, which is Cisco Info Mediator specific.
For more information on the generation of identifier fields, see the Cisco Info Center Mediator and Gateway Reference manual.
The Cisco Info Server uses a narrow casting mechanism called IDUC (Insert, Delete, Update, or Control) to notify client tools of changes in event information. To avoid network and system saturation, IDUC messages are bundled up on a discrete interval. When this interval expires, an IDUC packet is sent to each client tool with the details of all changes in the alerts. This interval is called the Cisco Info Server granularity and is controlled by a property called granularity. Granularity is, by default, set to 60 seconds. Reducing the granularity increases the real-time response of the client tools but greatly increases the network traffic and Cisco Info Server load. The sixty second value is optimal for most systems and it is recommended the value not be changed unless under the guidance of technical support.
This section describes how to start a Cisco Info Server quickly. You need to have a Cisco Info Server running before you can use any of the components of Cisco Info Center.
host% $OMNIHOME/bin/nco_objserv -name NCOMS
For more information about the command line options, see Section, "Command Line Options".
Upon start up, nco_objserv attempts to open the $OMNIHOME/etc/<servername>.sql file, where <servername> is the name of the server. Therefore, for the default setup, $OMNIHOME/etc/NCOMS.sql is opened and read. This file defines the database configuration of the Cisco Info Server. When this file is not found, the Cisco Info Server exits with the message:
When the Cisco Info Server reads this file, and errors exist in the SQL, the Cisco Info Server exits with the message:
Error parsing object definitions in NCOMS.sqlOnce this file has been read, by default, the Cisco Info Server scans the directory defined in the environment variable $OMNIDB. When this variable is not set, $OMNIHOME/db is used instead. This directory contains all the state information from the previous run of nco_objserv, as well as user names, automation triggers and actions, and other configuration information. Files are stored with the following naming convention:
<servername>.<databasename>.<tablename>.dat
Where <servername> is the name of the server, <databasename> is the name of the database, and <tablename> is the name of the table within that database. For each database and table within it, nco_objserv looks up these files and loads their contents into that table.
As well as the .dat files, some tables in the database create files with the .trans extension. These files are transaction logs of changes in the table as the .dat file was last written to. The .dat files are updated every five minutes, at which point, the .trans files are consolidated and cleared.
As an example, for the Cisco Info Server named NCOMS, the files looked for are:
When the Cisco Info Server is running, these files are kept up to date with the current state of the Cisco Info Server, unless transient mode is enabled (not recommended).
You can configure Cisco Info Center to use one or multiple Cisco Info Servers. However, each Cisco Info Server in the system requires a unique name. This is the name used by clients to connect to the Cisco Info Server and is used throughout configuration.
Before you start any Cisco Info Servers, you should specify the names you are going to use. The default name for the Cisco Info Server is NCOMS (Cisco Info Center Master Server).
Note, the names must be in upper case. Also, do not use a name that ends with the letters _PA or _GATE as these letters are reserved to identify a Process Control agent or Cisco Info Gateway, respectively.
For each Cisco Info Server name, an entry must exist in the interfaces file, and a port must be allocated in the /etc/services file (see Section, "Service File Entries for Multiple Cisco Info Servers").
host% $OMNIHOME/install/nco_new_server NCOMS2
This creates the default database initialization files for the new Cisco Info Server. These are described in "Database Initialization".
When you are running more than one Cisco Info Server, each Cisco Info Server in the system should contain an entry in the /etc/services file on all machines. The entry uses the following form:
nco_<servername> <nnnn>/tcp
Where <servername> is the name of the Cisco Info Server and <nnnn> is a four digit port number. For the Cisco Info Server named NCOMS, the entry in /etc/services should read:
nco_NCOMS 4100/tcp
The port can be set to any number, however, do not use the numbers 1 to 1024 as these are generally assigned as system numbers.
The /etc/services file may be managed by Network Information Service (NIS). In this case, you should make the entry in the NIS services file, then push the updated configuration to all machines.
Without the entries in the /etc/services file on a machine where multiple Cisco Info Servers exist, the second and later Cisco Info Servers are unable to start as they all attempt to use the same socket. Without the entries in the /etc/services file on a machine which is a client of a machine with multiple Cisco Info Servers, the Cisco Info Admin Desktop tools find themselves connecting to one server but receiving update information from one of the other servers. For this reason, it is important the required entries are present in the /etc/services file.
The following sections describe the command line options for the Cisco Info Server. The options use the following format:
nco_objserv -option <parameter>
Each Cisco Info Server requires a unique name. This is the name referred to in the interfaces file. The default name for the Cisco Info Server is NCOMS.
You can override the default name with the -name command line option followed by a string, which should be the name of the Cisco Info Server. This is appropriate where more than one Cisco Info Server is in use or where the system is to be configured with an alternative name (rather than NCOMS) for the first Cisco Info Server.
When the Cisco Info Server starts an external process (usually from within the automation system where an action has an external effect defined) it contacts a Process Control agent to start the process. For this to function, the Cisco Info Server needs the name of a Process Control agent. To set the Process Control agent, use the -pa option followed by a string representing the name of the Process Control agent to send requests to. Without specifying the -pa option, the Cisco Info Server contacts NCO_PA as its default Process Control agent.
Before you run Cisco Info Center, the port for each Cisco Info Server is specified in the /etc/services file. See Section, "Service File Entries for Multiple Cisco Info Servers". To specify another port number when you start the Cisco Info Server, use the -port option. For example, to test the port number 4300, specify -port 4300 on the command line.
The property file is read at start-up to configure the Cisco Info Server. Use the Configuration tool to manipulate the properties. See Chapter 4, "Configuration", for more information. When a Cisco Info Server is not running, you can manipulate the properties using the Properties Editor (nco_xprops). See Section, "Edit the Cisco Info Server Properties", for more information.
The default property file is named $OMNIHOME/etc/<servername>.props, where <servername> is the name of the Cisco Info Server. For example, when the server name is NCOMS, the properties file is, by default, $OMNIHOME/etc/NCOMS.props.
The Cisco Info Server has a command line option, -propsfile <filename>. This allows you to point the Cisco Info Server at an alternative properties file.
When the Cisco Info Server is running, it writes a log file noting significant information in that file. By default, the log file is stored in the directory $OMNIHOME/log with the name of the server used as the name for the log file (for example, for a server named NCOMS, a log file is written as NCOMS.log). With -uniquelog set, the Cisco Info Server appends the process id of the Cisco Info Server to the log file name. For example, when the NCOMS Cisco Info Server is running as process 1835, the log file is called NCOMS.1835.log. This option allows the Cisco Info Server to create unique log files for each run.
By default, the log file is written in the $OMNIHOME/log directory with the log file name being the name of the Cisco Info Server. To override the default and specify a different name, use the -logfile option followed by a full pathname to a file. The -uniquelog option is overridden by -logfile.
The log file process can be stopped from writing to a file and send its output to the UNIX standard output, that is, the console where the command is run.
To do this, use the -stderr command line option. No log files are written to disk when using -stderr.
Some administrators require a delete log. This is a separate log file which logs all delete commands issued on the Cisco Info Server. The option is enabled by specifying the -DELETES option followed by the name of the file where you want the delete log information to be written.
The Cisco Info Server can be run in secure mode. The -secure option controls the authentication of any Cisco Info Mediator or Cisco Info Gateway connection requests with a user name and an encrypted password.
When a connection request is sent, the Cisco Info Server issues an authentication message. The Cisco Info Mediator or Cisco Info Gateway must respond with the correct user name and password. The user name and password are set in the Cisco Info Mediator and Cisco Info Gateway properties. See the Cisco Info Center Mediator and Gateway Reference manual for more information. When the user name and password are incorrect, the Cisco Info Server issues an error message.
The default is unsecure mode. This is set with the -unsecure option.
The Cisco Info Server can collect statistics (for example, the number of events or mediators.) By default, the statistics gathering facility is disabled and the stats table in the NCOMS.sql file is commented out.
To start the statistics gathering facility, edit the NCOMS.sql file and remove the comments from the stats table, then use the -stats option on the command line.The default time interval for statistics collection is 900 seconds. Following is the format of the stats table:
create table stats(StatTime time,NumClients int,NumRealtime int,NumProbes int,NumGateways int,NumMonitors int,NumProxys int,EventCount int,JournalCount int,DetailCount int,unique(StatTime),permanent);
The Cisco Info Server uses a per-client broadcast mechanism called IDUC to inform clients of changes in the tables. By default, this is set to 60 seconds. The -granularity option controls the batching of IDUC broadcasts, taking a time in seconds as its parameter; reducing this value increases the update rate to the clients.
While the Cisco Info Server is running it maintains a persistent store of the tables, which are used for recovery purposes. These tables are written out every time there is a modification except for the rapidly changing tables alerts.status and alerts.journal. For these, the system keeps a transaction log between intervals of writing out the complete table. The -interval option, followed by an integer value representing a time in seconds, allows the administrator to set the number of seconds between writing out the table and clearing the transaction log. Setting this to a lower value increases the frequency the Cisco Info Server save the tables. The default interval is 300 seconds.
An internal clock is used to control the sampling of automation triggers. By default, this is set to 1 second, but it can be overridden by setting the -autotick option with a parameter which is the number of seconds to sample with.
The Cisco Info Server uses an internal timer by default on Solaris systems. This timer is used to give a timing mechanism to the automation system. To override this default setting, use the -timer command line option followed by the parameters:
The Cisco Info Server can, by default, support 64 connections from Cisco Info Admin Desktop clients, Cisco Info Gateways and mediators. This maximum number of connections can be increased by specifying the option -connections followed by a value for the new maximum number of connections.
The Cisco Info Server is a multi-threaded application and each thread maintains its own stack. By default, the stack for each thread is 64K. For situations where the Cisco Info Server may need a larger stack for its threads, use the option -stacksize followed by an integer representing the number of bytes to allocate to each thread's stack.
This option is only useful for detecting problems with the Cisco Info Server and should only be used under the advice of technical support.
Debug messages can be added to the log file using the -debug option followed by an integer which represents the level of debug. For example, -debug 0 is the default, which generates no debug messages. Set 1, 2, and 3 to generate more debug messages.
When the Cisco Info Server is overloaded, you can change the queue size by using the -queue option followed by a value. The default setting is 1024. This option only allows you to increase the value from the default.
When the system memory becomes overloaded, you can change the internal hash size tables to improve memory usage by using the -hashsize option followed by a value. The default is 5013.
To obtain the Cisco Info Server version number, use the -version option. For example, specify the following command:
host% nco_objserv -version
The Cisco Info Server displays its version details. All other options are ignored.
To display a list of options supported on the installed Cisco Info Server, run the Cisco Info Server with the -help option.
For example, specify the following command:
host% nco_objserv -help
The Cisco Info Server displays a usage message which details all the available options and briefly describes their purpose.
When nco_objserv is started with the -norecover command line option, the Cisco Info Server makes no attempt to recover the files in $OMNIDB (or $OMNIHOME/db when $OMNIDB is not set), and starts with completely empty tables. This includes the master database names table, so no tools can connect. The only access is through the nco_sql command. This mode is for maintenance only.
When nco_objserv is started with the -transient command line option, the Cisco Info Server makes no attempt to write to the files in $OMNIDB (or $OMNIHOME/db when $OMNIDB is not set), however, it does load the contents of those files at start up.
The Cisco Info Server is made up of six databases:
The database name appears at the start of a tablename in the following format:
<databasename>.<tablename>
It is recommended that this fully qualified name is used when referring to any table.
Alert related tables are described in more detail in the following sections in Appendix A:
Authentication tables are described in more details in the following sections in Appendix A:
Automation tables are described in more details in the following sections in Appendix A:
The Java Event List table is described in more detail in the following section in Appendix A:
This section describes the Cisco Info Server support utilities and processes which allow you to customize the Cisco Info Server.
More information about the support commands is available in Section, "Cisco Info Server Interactive Commands", in Appendix A.
There may be occasions when it is useful to log into the command line interface of the Cisco Info Server. For example, you must login to the Cisco Info Server to create a new database table or to modify the alerts.status table, or to stop the Cisco Info Server.
To start the nco_sql utility, specify the following command:
host% nco_sql -user root -server <servername>
Where <servername> is the name of the Cisco Info Server (when this option is omitted, the default server NCOMS is used). You are then prompted for your Cisco Info Center password. Once you have logged in, the following prompt appears:
1>
Step 1 Press Return to get a new line.
Step 2 Specify go to issue the command.
Step 3 Press Return to send the command to the Cisco Info Server.
The results of the command are displayed on the terminal.
To exit nco_sql, press <Control D> or specify quit.
To stop the Cisco Info Server:
Step 1 Stop the Cisco Info Server with the command:
host% nco_sql -user root -server <servername>
Where <servername> is the name of the Cisco Info Server.
Step 2 Specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
It is possible to add extra databases and tables to the Cisco Info Server to complement the standard tables. An example of this would be to maintain a table that is populated by an automation, which detects a node down and copies alert details across to the new table.
Step 1 Stop the Cisco Info Server with the nco_sql command.
Step 2 Next, specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
Step 3 You cannot modify the tables when the Cisco Info Server is running. You can create tables and databases, however, the configuration of these is lost when the Cisco Info Server restarts. To make a permanent change, you must modify the Cisco Info Server's initialization file. We recommend you shutdown the Cisco Info Server to do this.
Step 4 Locate the server's initialization SQL file. The Cisco Info Server's initialization file is located in the $OMNIHOME/etc/servername.sql directory. For example, the server named NCOMS keeps its initialization file in the $OMNIHOME/etc/NCOMS.sql directory.
Step 5 Make a copy of the initialization SQL file. Before making any changes, make a copy of the initialization SQL file to allow you to roll back any changes made.
Step 6 Edit the initialization SQL file. The initialization SQL file contains a set of CREATE DATABASE and CREATE TABLE commands. Do not modify these commands. Move to the end of the file to add the new entries.
Step 7 Add your CREATE DATABASE/TABLE section. At the end of the file, add your CREATE DATABASE and CREATE TABLE sections. These commands are documented in Section, "Cisco Info Server SQL", in Appendix A. For example, the following commands show how to create a new database called netusers, with a table of user IDs and full names, called userlist.
To create a new database called netusers, specify the following command:
CREATE DATABASE netusers;
Before creating the table, you must specify the USE DATABASE command so the Cisco Info Server creates the table within the correct database:
USE DATABASE netusers;
The start of the CREATE TABLE command specifies what table should be created:
CREATE TABLE userlist {
The following two lines add a twenty character field called userid and a
128 character field called username:
userid char(20),
username char(128),
The unique userid command makes the table unique on the userid field. A unique entry must be included in all tables you create. Not doing so causes problems within the Cisco Info Server, which is optimized for unique table operations.
unique(userid),
The permanent command makes the Cisco Info Server automatically save the contents of the table to disk, in the same way the other Cisco Info Server tables are saved. When the Cisco Info Server is restarted after being shutdown, the contents of the table are automatically restored.
The following example shows the complete SQL code for creating the database and table:
CREATE DATABASE netusers;
USE DATABASE netusers;
CREATE TABLE userlist {
userid char(20),
username char(128),
unique(userid),
permanent
}
Step 8 Save the initialization SQL file.
Step 9 Restart your system. Make sure you check for any error messages from the Cisco Info Server when it starts up, which may indicate errors in your new SQL code.
The system may need to carry more than just the basic alert information with each alert. For example, some users of Cisco Info Center require a Customer field, which contains the name of the customer who uses that device on the network. Other users have added Internet URLs to their alerts to allow them to call up company Intranets with the on-line documentation for a device.
In Table A-2 ("alerts.status Table") in Appendix A, particular fields are marked as mandatory. Do not modify or remove these fields from the alerts.status table.
In the following sequence of operations, it is assumed the changes are being made on a Cisco Info Server named NCOMS. Substitute this name with the name of the Cisco Info Server you are changing.
Step 1 Stop the Cisco Info Server with the nco_sql command.
Step 2 Specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
Step 3 You cannot modify the tables when the Cisco Info Server is running. It is possible to create tables and databases, however, the configuration of these is lost when the Cisco Info Server restarts. To make a permanent change, you must modify the Cisco Info Server's initialization file and it is recommended that you shutdown the Cisco Info Server.
Step 4 Make a backup of your data. Make a copy of all data in the $OMNIHOME/db directory to a chosen directory.
Step 5 Copy your initialization SQL file. Copy the $OMNIHOME/etc/NCOMS.sql file to $OMNIHOME/etc/NCOMS.orig. This allows the nco_migrate utility to operate.
Step 6 Edit the initialization SQL file. Edit the NCOMS.sql file with your preferred editor. To modify the alerts.status table, locate the CREATE TABLE status line and change the definition within the braces {}.
Step 7 Save the NCOMS.sql initialization file when you have completed your editing.
Step 8 Migrate your existing data to the new database. The NCOMS.sql utility takes the previous (NCOMS.sql) configuration and the new (NCOMS.sql) configuration and works out how to move the data into the new configuration. To run migration, specify:
host% $OMNIHOME/bin/nco_migrate -server NCOMS
The process should be automatic.
Step 9 Restart the Cisco Info Server.
With new fields installed, it is possible to populate them in two ways:
Cisco Info Servers receive event information from external programs, such as Mediators and Gateways. Using a standard configuration, the external programs forward information directly to the Cisco Info Server. For example, a Cisco Info Mediator may have the server set to a default Cisco Info Server, called NCOMS, in its properties file. A Proxy Server configuration is illustrated in Figure 1-1.
Where a large number of external programs are forwarding event information directly to the Cisco Info Server, this can have a negative impact on performance.
A Proxy Server can be used as a buffer to reduce the number of direct connections to the primary Cisco Info Server. The Mediators can connect to the Proxy Server, which then forwards any information to the Cisco Info Server.
Proxy Servers can be started quickly on the command line. However, once you have become familiar with the command line options, you should start the Proxy Server with the Process Control system. See Chapter 2, "Process Control".
host% nco_proxyserv -name NCO_PROXY1 -server NCOMS
Each Proxy Server requires a unique name. This is the name referred to in the interfaces file. The default name for the Proxy Server is NCO_PROXY.
You can override the default name with the -name command line option, followed by the name of the Proxy Server. This option is appropriate when using more than one Proxy Server or using an alternative name, rather than NCO_PROXY.
This is the name of the Cisco Info Server to which the Proxy Server is to connect. The default is NCOMS.
The Proxy Server allows you to use an alternative properties file with the command line option, -propsfile <filename>. The default property file is named $OMNIHOME/etc/<servername>.props, where <servername> is the name of the Proxy Server.
For example, when the Proxy Server is NCO_PROXY, the properties file is by default, $OMNIHOME/etc/NCO_PROXY.props.
By default, the log file is written in the $OMNIHOME/log directory with the log file name being the name of the Proxy Server. To override the default and specify a different name, use the -logfile option followed by a full pathname to a file.
The Proxy Server can, by default, support a maximum of thirty connections from Mediators and Gateways. This maximum number of connections can be increased by specifying the -max option followed by the new maximum number of connections.
This option sets the ratio for connections to the Proxy Server. The ratio is for incoming connections, for example from mediators, to outgoing connections to a Cisco Info Server. The default is 10:1.
Debug messages can be added to the log file using the -debug option followed by an integer which represents the level of debug. For example, -debug 0 is the default, which generates no debug messages. Set to 1, 2, and 3 to generate more debug messages. This option is only useful for detecting problems with the Proxy Server and should only be used under the advice of technical support.
To find out the Proxy Server version, use the -version command line option. For example, specify the following command:
host% nco_proxyserv -version
The Proxy Server displays the version details. All other options are ignored.
To obtain information about the options supported on the installed Cisco Info Server, run the Cisco Info Server with the -help option. For example, specify the following command:
host% nco_proxyserv -help
The Proxy Server displays a usage message which details all the available options and briefly describes their purpose.
The Properties Editor window allows you to edit the information contained in properties files without running the Cisco Info Server. A properties file is any file with a .props extension. This means that you can use this window to edit the properties file for the Cisco Info Server, as well as proxy Cisco Info Servers and Mediators.
Cisco Info Server properties can be edited when the Cisco Info Server is running using the Configuration tool. See Chapter 4, "Configuration", for more information.
To start editing the Cisco Info Server properties, specify:
host% $OMNIHOME/bin/nco_xprops
Figure 1-2 shows the Properties Editor window.
To edit the Cisco Info Server properties:
1. Select Generic from the Type options list. The list of generic properties files are then displayed in the File options list.
2. Select a properties file from the File options list.
3. Click on the Open button. The Properties Editor searches the /Omnibus/etc directory for files with a .props extension and then lists the properties.
To change the property values:
1. Click on a property to select it. The name and value appears in the Property frame.
2. Edit the value.
3. Click on the Update button.
Default properties are displayed in black. When you change a default property, it is displayed in white to show that it has been modified.
When you edit the property name, the button label changes to Add. Click on the Add button to specify this as a new property to the list.
To delete a property from the list:
1. Click on the property to select it.
2. Click on the Remove button.
To save the changed properties, click on the Save button.
Posted: Thu Mar 18 11:22:31 PST 1999
Copyright 1989-1999©Cisco Systems Inc.
