|
|
You should read this chapter to understand how the Cisco Info Server is set up. Once you are familiar with this information, we recommend you use the Process Control system to manage the Cisco Info Server. See Chapter 2, "Process Control" for detailed information.
Additional information about the Cisco Info Server is included in Appendix A, "Cisco Info Server Reference".
This chapter includes the following sections:
The Cisco Info Server is the core of Cisco Info Center and is where all event and status data is stored and managed.
The Cisco Info Server is an active, main-memory database. Event information is passed to the Cisco Info Server from external programs, such as Mediators or Gateways, and this information is stored in a series of database tables. The Cisco Info Server uses the event information to update the alerts.status table. When an event is stored in this table, it is known as an alert. For more information about the database tables, see Section, "Cisco Info Server Table Formats".
The Cisco Info Server updates the stored information using a process of deduplication. This process ensures that event information is not duplicated and this reduces the amount of data in the Cisco Info Server. See Section, "Deduplication" for more details.
The Cisco Info Server also stores details of users and their privileges, information about how to display events in the Event List, class information of generic type events, menus for Cisco Info Admin Desktop tools and other information for the management of the system. This means the Cisco Info Admin Desktop tools can attach to the Cisco Info Server and use the event information. For example, the Event List can attach to the Cisco Info Server, validate the user's identity and allow users to view and manipulate these alerts, depending upon their security. The Objective View also attaches to the Cisco Info Server and allows users to view the information in a graphical display.
Information can be exported from the Cisco Info Server to other applications by attaching a Cisco Info Gateway. The Cisco Info Gateway monitors the alerts.status table for changes. The operation and configuration of a Cisco Info Gateway is covered in the Cisco Info Center Mediator and Gateway Reference manual.
The Cisco Info Server is also capable of responding automatically to particular events or the state of an event. This is known as Automation. For details, see Chapter 5, "Automation".
A Cisco Info Server uses Cisco Info Server SQL as its command language. For details on the syntax of Cisco Info Server SQL see Appendix A, "Cisco Info Server Reference".
The following sections describe how the Cisco Info Server reduces the event information using the deduplication process.
Event information is forwarded to the Cisco Info Server from Mediators or Gateways with an identifier field. This field is used as a key and the alerts.status table is searched for an identical key.
When an identical key is not found in the status table, an alert entry is inserted into the alerts.status table. All the field information from the Cisco Info Mediator is placed in this new entry, including the FirstOccurrence time.
When an identical key is found, that entry is updated with the latest status information. The process of updating involves updating the LastOccurrence field with the time from the incoming event and incrementing the Count field. No other fields are updated unless the ReawakenClosed property in the Cisco Info Server is set to true. In this case, the Severity field is updated when the severity in the Cisco Info Server's alert is 0 (Closed) and when DeackOnReawaken is set, the Acknowledged field is cleared. This key matching process is referred to as deduplication.
The Identifier field plays a critical role in how an event is deduplicated and what makes a unique event. Identifier fields are generated by the Mediators sending the event. The generation of the identifier is controlled by the Cisco Info Mediator rules file, which is Cisco Info Mediator specific.
For more information on the generation of identifier fields, see the Cisco Info Center Mediator and Gateway Reference manual.
The Cisco Info Server uses a narrow casting mechanism called IDUC (Insert, Delete, Update, or Control) to notify client tools of changes in event information. To avoid network and system saturation, IDUC messages are bundled up on a discrete interval. When this interval expires, an IDUC packet is sent to each client tool with the details of all changes in the alerts. This interval is called the Cisco Info Server granularity and is controlled by a property called granularity. Granularity is, by default, set to 60 seconds. Reducing the granularity increases the real-time response of the client tools but greatly increases the network traffic and Cisco Info Server load. The sixty second value is optimal for most systems and it is recommended the value not be changed unless under the guidance of technical support.
This section describes how to start a Cisco Info Server quickly. You need to have a Cisco Info Server running before you can use any of the components of Cisco Info Center.
To start the Cisco Info Server, use the nco_objserv command. For example, the following command would start a Cisco Info Server named NCOMS:
host% $OMNIHOME/bin/nco_objserv -name NCOMS
For more information about the command line options, see Section, "Command Line Options".
Upon start-up, nco_objserv attempts to open the $OMNIHOME/etc/<servername>.sql file, where <servername> is the name of the server. Therefore, for the default setup, $OMNIHOME/etc/NCOMS.sql is opened and read. This file defines the database configuration of the Cisco Info Server. When this file is not found, the Cisco Info Server exits with the message:
When the Cisco Info Server reads this file, and errors exist in the SQL, the Cisco Info Server exits with the message:
Error parsing object definitions in NCOMS.sqlOnce this file has been read, by default, the Cisco Info Server scans the directory defined in the environment variable $OMNIDB. When this variable is not set, $OMNIHOME/db is used instead. This directory contains all the state information from the previous run of nco_objserv, as well as user names, automation triggers and actions, and other configuration information. Files are stored with the following naming convention:
<servername>.<databasename>.<tablename>.dat
Where <servername> is the name of the server, <databasename> is the name of the database, and <tablename> is the name of the table within that database. For each database and table within it, nco_objserv looks up these files and loads their contents into that table.
As well as the .dat files, some tables in the database create files with the .trans extension. These files are transaction logs of changes in the table as the .dat file was last written to. The .dat files are updated every five minutes, at which point, the .trans files are consolidated and cleared.
As an example, for the Cisco Info Server named NCOMS, the files looked for are:
When the Cisco Info Server is running, these files are kept up to date with the current state of the Cisco Info Server, unless transient mode is enabled (not recommended).
Before you start any Cisco Info Servers, you should specify the names you are going to use. The default name for the Cisco Info Server is NCOMS (Cisco Info Center Master Server).
Note, the names must be in upper case. Also, do not use a name that ends with the letters _PA or _GATE as these letters are reserved to identify a Process Control agent or Cisco Info Gateway, respectively.
For each Cisco Info Server name, an entry must exist in the interfaces file, and a port must be allocated in the /etc/services file (see Section, "Service File Entries for Multiple Cisco Info Servers").
To create a new Cisco Info Server, use the nco_new_server command. For example, to create a new Cisco Info Server called NCOMS2, specify the following command:
host% $OMNIHOME/install/nco_new_server NCOMS2
This creates the default database initialization files for the new Cisco Info Server. These are described in "Database Initialization".
When you are running more than one Cisco Info Server, each Cisco Info Server in the system should contain an entry in the /etc/services file on all machines. The entry uses the following form:
nco_<servername> <nnnn>/tcp
Where <servername> is the name of the Cisco Info Server and <nnnn> is a four digit port number. For the Cisco Info Server named NCOMS, the entry in /etc/services should read:
nco_NCOMS 4100/tcp
The port can be set to any number, however, do not use the numbers 1 to 1024 as these are generally assigned as system numbers.
The /etc/services file may be managed by Network Information Service (NIS). In this case, you should make the entry in the NIS services file, then push the updated configuration to all machines.
Without the entries in the /etc/services file on a machine where multiple Cisco Info Servers exist, the second and later Cisco Info Servers are unable to start as they all attempt to use the same socket. Without the entries in the /etc/services file on a machine which is a client of a machine with multiple Cisco Info Servers, the Cisco Info Admin Desktop tools find themselves connecting to one server but receiving update information from one of the other servers. For this reason, it is important the required entries are present in the /etc/services file.
The following sections describe the command line options for the Cisco Info Server. The options use the following format:
nco_objserv -option <parameter>
Each Cisco Info Server requires a unique name. This is the name referred to in the interfaces file. The default name for the Cisco Info Server is NCOMS.
You can override the default name with the -name command line option followed by a string, which should be the name of the Cisco Info Server. This is appropriate where more than one Cisco Info Server is in use or where the system is to be configured with an alternative name (rather than NCOMS) for the first Cisco Info Server.
Before you run Cisco Info Center, the port for each Cisco Info Server is specified in the /etc/services file. See Section, "Service File Entries for Multiple Cisco Info Servers". To specify another port number when you start the Cisco Info Server, use the -port option. For example, to test the port number 4300, specify -port 4300 on the command line.
The property file is read at start-up to configure the Cisco Info Server. Use the Configuration tool to manipulate the properties. See Chapter 4, "Configuration Manager", for more information. When a Cisco Info Server is not running, you can manipulate the properties using the Properties Editor (nco_xprops). See Section, "Edit the Cisco Info Server Properties", for more information.
The default property file is named $OMNIHOME/etc/<servername>.props, where <servername> is the name of the Cisco Info Server. For example, when the server name is NCOMS, the properties file is, by default, $OMNIHOME/etc/NCOMS.props.
The Cisco Info Server has a command line option, -propsfile <filename>. This allows you to point the Cisco Info Server at an alternative properties file.
By default, the log file is written in the $OMNIHOME/log directory with the log file name being the name of the Cisco Info Server. To override the default and specify a different name, use the -logfile option followed by a full pathname to a file. The -uniquelog option is overridden by -logfile.
The log file process can be stopped from writing to a file and send its output to the UNIX standard output, that is, the console where the command is run.
To do this, use the -stderr command line option. No log files are written to disk when using -stderr.
Some administrators require a delete log. This is a separate log file which logs all delete commands issued on the Cisco Info Server. The option is enabled by specifying the -DELETES option followed by the name of the file where you want the delete log information to be written.
The Cisco Info Server can be run in secure mode. The -secure option controls the authentication of any Cisco Info Mediator or Cisco Info Gateway connection requests with a user name and an encrypted password.
When a connection request is sent, the Cisco Info Server issues an authentication message. The Cisco Info Mediator or Cisco Info Gateway must respond with the correct user name and password. The user name and password are set in the Cisco Info Mediator and Cisco Info Gateway properties. See the Cisco Info Center Mediator and Gateway Reference manual for more information. When the user name and password are incorrect, the Cisco Info Server issues an error message.
The default is unsecure mode. This is set with the -unsecure option.
The Cisco Info Server can collect statistics (for example, the number of events or Mediators.) By default, the statistics gathering facility is disabled and the stats table in the NCOMS.sql file is commented out.
create table stats(StatTime time,NumClients int,NumRealtime int,NumProbes int,NumGateways int,NumMonitors int,NumProxys int,EventCount int,JournalCount int,DetailCount int,unique(StatTime),permanent);
The Cisco Info Server uses a per-client broadcast mechanism called IDUC to inform clients of changes in the tables. By default, this is set to 60 seconds. The -granularity option controls the batching of IDUC broadcasts, taking a time in seconds as its parameter; reducing this value increases the update rate to the clients.
While the Cisco Info Server is running, it maintains a persistent store of the tables, which are used for recovery purposes. These tables are written out every time there is a modification except for the rapidly changing tables alerts.status and alerts.journal. For these, the system keeps a transaction log between intervals of writing out the complete table. The -interval option, followed by an integer value representing a time in seconds, allows the administrator to set the number of seconds between writing out the table and clearing the transaction log. Setting this to a lower value increases the frequency the Cisco Info Server save the tables. The default interval is 300 seconds.
An internal clock is used to control the sampling of automation triggers. By default, this is set to 1 second, but it can be overridden by setting the -autotick option with a parameter which is the number of seconds to sample with.
The Cisco Info Server uses an internal timer by default on Solaris systems. This timer is used to give a timing mechanism to the automation system. To override this default setting, use the -timer command line option followed by the parameters:
The Cisco Info Server can, by default, support 64 connections from Cisco Info Admin Desktop clients, Cisco Info Gateways and Mediators. This maximum number of connections can be increased by specifying the option -connections followed by a value for the new maximum number of connections.
Debug messages can be added to the log file using the -debug option followed by an integer which represents the level of debug. For example, -debug 0 is the default, which generates no debug messages. Set 1, 2, and 3 to generate more debug messages.
host% nco_objserv -version
The Cisco Info Server displays its version details. All other options are ignored.
For example, specify the following command:
host% nco_objserv -help
The Cisco Info Server displays a usage message which details all the available options and briefly describes their purpose.
When nco_objserv is started with the -norecover command line option, the Cisco Info Server makes no attempt to recover the files in $OMNIDB (or $OMNIHOME/db when $OMNIDB is not set), and starts with completely empty tables. This includes the master database names table, so no tools can connect. The only access is through the nco_sql command. This mode is for maintenance only.
When nco_objserv is started with the -transient command line option, the Cisco Info Server makes no attempt to write to the files in $OMNIDB (or $OMNIHOME/db when $OMNIDB is not set), however, it does load the contents of those files at start up.
The Cisco Info Server is made up of the following databases:
The database name appears at the start of a tablename in the following format:
<databasename>.<tablename>
It is recommended this fully qualified name is used when referring to any table.
Alert related tables are described in more detail in the following sections in Appendix A:
Authentication tables are described in more details in the following sections in Appendix A:
Automation tables are described in more details in the following sections in Appendix A:
The Java Event List table is described in more detail in the following section in Appendix A:
This section describes the Cisco Info Server support utilities and processes which allow you to customize the Cisco Info Server.
More information about the support commands is available in Section, "Cisco Info Server Interactive Commands", in Appendix A.
You can login to the Cisco Info Server using the nco_sql utility, which requires a username and password.
To start the nco_sql utility, specify the following command:
host% nco_sql -user root -server <servername>
Where <servername> is the name of the Cisco Info Server (when this option is omitted, the default server NCOMS is used). You are then prompted for your Cisco Info Center password. Once you have logged in, the following prompt appears:
1>
Step 1 Press Return to get a new line.
Step 2 Specify go to issue the command.
Step 3 Press Return to send the command to the Cisco Info Server.
The results of the command are displayed on the screen.
To exit nco_sql, press <Ctrl D> or specify quit.
To stop the Cisco Info Server:
Step 1 Stop the Cisco Info Server with the command:
host% nco_sql -user root -server <servername>
Where <servername> is the name of the Cisco Info Server.
Step 2 Specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
Step 1 Stop the Cisco Info Server with the nco_sql command.
Step 2 Next, specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
Step 3 You cannot modify the tables when the Cisco Info Server is running. You can create tables and databases, however, the configuration of these is lost when the Cisco Info Server restarts. To make a permanent change, you must modify the Cisco Info Server's initialization file. We recommend you shutdown the Cisco Info Server to do this.
Step 4 Locate the server's initialization SQL file. The Cisco Info Server's initialization file is located in the $OMNIHOME/etc/servername.sql directory. For example, the server named NCOMS keeps its initialization file in the $OMNIHOME/etc/NCOMS.sql directory.
Step 5 Make a copy of the initialization SQL file. Before making any changes, make a copy of the initialization SQL file to allow you to roll back any changes made.
Step 6 Edit the initialization SQL file. The initialization SQL file contains a set of CREATE DATABASE and CREATE TABLE commands. Do not modify these commands. Move to the end of the file to add the new entries.
Step 7 Add your CREATE DATABASE/TABLE section. At the end of the file, add your CREATE DATABASE and CREATE TABLE sections. These commands are documented in Section, "Cisco Info Server SQL", in Appendix A. For example, the following commands show how to create a new database called netusers, with a table of user IDs and full names, called userlist.
To create a new database called netusers, specify the following command:
CREATE DATABASE netusers;
Before creating the table, you must specify the USE DATABASE command so the Cisco Info Server creates the table within the correct database:
USE DATABASE netusers;
The start of the CREATE TABLE command specifies what table should be created:
CREATE TABLE userlist {
The following two lines add a twenty character field called userid and a
128 character field called username:
userid char(20),
username char(128),
The unique <userid> command makes the table unique on the <userid> field. A unique entry must be included in all tables you create. Not doing so causes problems within the Cisco Info Server, which is optimized for unique table operations.
unique(<userid>),
The permanent command makes the Cisco Info Server automatically save the contents of the table to disk, in the same way the other Cisco Info Server tables are saved. When the Cisco Info Server is restarted after being shutdown, the contents of the table are automatically restored.
The following example shows the complete SQL code for creating the database and table:
CREATE DATABASE netusers;
USE DATABASE netusers;
CREATE TABLE userlist {
userid char(20),
username char(128),
unique(userid),
permanent
}
Step 8 Save the initialization SQL file.
Step 9 Restart your system. Make sure you check for any error messages from the Cisco Info Server when it starts up, which may indicate errors in your new SQL code.
In Table A-2 ("alerts.status Table") in Appendix A, particular fields are marked as mandatory. Do not modify or remove these fields from the alerts.status table.
In the following sequence of operations, it is assumed the changes are being made on a Cisco Info Server named NCOMS. Substitute this name with the name of the Cisco Info Server you are changing.
Step 1 Stop the Cisco Info Server with the nco_sql command.
Step 2 Specify a shutdown command. For more information, see Section, "shutdown" in Appendix A.
Step 3 You cannot modify the tables when the Cisco Info Server is running. It is possible to create tables and databases, however, the configuration of these is lost when the Cisco Info Server restarts. To make a permanent change, you must modify the Cisco Info Server's initialization file and it is recommended that you shutdown the Cisco Info Server.
Step 4 Make a backup of your data. Make a copy of all data in the $OMNIHOME/db directory to a chosen directory.
Step 5 Copy your initialization SQL file. Copy the $OMNIHOME/etc/NCOMS.sql file to $OMNIHOME/etc/NCOMS.orig. This allows the nco_migrate utility to operate.
Step 6 Edit the initialization SQL file. Edit the NCOMS.sql file with your preferred editor. To modify the alerts.status table, locate the CREATE TABLE status line and change the definition within the braces {}.
Step 7 Save the NCOMS.sql initialization file when you have completed your editing.
Step 8 Migrate your existing data to the new database. The NCOMS.sql utility takes the previous (NCOMS.sql) configuration and the new (NCOMS.sql) configuration and works out how to move the data into the new configuration. To run migration, specify:
host% $OMNIHOME/bin/nco_migrate -server NCOMS
The process should be automatic.
Step 9 Restart the Cisco Info Server.
With new fields installed, it is possible to populate them in two ways:
Cisco Info Servers receive event information from external programs, such as Mediators and Gateways. Using a standard configuration, the external programs forward information directly to the Cisco Info Server. For example, a Cisco Info Mediator may have the server set to a default Cisco Info Server, called NCOMS, in its properties file. A Proxy Server configuration is illustrated in Figure 1-1.
Where a large number of external programs are forwarding event information directly to the Cisco Info Server, this can have a negative impact on performance.
Proxy Servers can be started quickly on the command line. However, once you have become familiar with the command line options, you should start the Proxy Server with the Process Control system. See Chapter 2, "Process Control".
host% nco_proxyserv -name NCO_PROXY1 -server NCOMS
Each Proxy Server requires a unique name. This is the name referred to in the interfaces file. The default name for the Proxy Server is NCO_PROXY.
You can override the default name with the -name command line option, followed by the name of the Proxy Server. This option is appropriate when using more than one Proxy Server or using an alternative name, rather than NCO_PROXY.
This is the name of the Cisco Info Server to which the Proxy Server is to connect. The default is NCOMS.
The Proxy Server allows you to use an alternative properties file with the command line option, -propsfile <filename>. The default property file is named $OMNIHOME/etc/<servername>.props, where <servername> is the name of the Proxy Server.
For example, when the Proxy Server is NCO_PROXY, the properties file is by default, $OMNIHOME/etc/NCO_PROXY.props.
The Proxy Server can, by default, support a maximum of thirty connections from Mediators and Gateways. This maximum number of connections can be increased by specifying the -max option followed by the new maximum number of connections.
This option sets the ratio for connections to the Proxy Server. The ratio is for incoming connections, for example from Mediators, to outgoing connections to a Cisco Info Server. The default is 10:1.
To find out the Proxy Server version, use the -version command line option. For example, specify the following command:
host% nco_proxyserv -version
The Proxy Server displays the version details. All other options are ignored.
host% nco_proxyserv -help
The Proxy Server displays a usage message which details all the available options and briefly describes their purpose.
The Properties Editor window allows you to edit the information contained in properties files without running the Cisco Info Server. A properties file is any file with a .props extension. This means that you can use this window to edit the properties file for the Cisco Info Server, as well as proxy Cisco Info Servers and Mediators.
Cisco Info Server properties can be edited when the Cisco Info Server is running using the Configuration tool. See Chapter 4, "Configuration Manager", for more information.
To start editing the Cisco Info Server properties, specify:
host% $OMNIHOME/bin/nco_xprops
Figure 1-2 shows the Properties Editor window.
To edit the Cisco Info Server properties:
1. Select Generic from the Type options list. The list of generic properties files are then displayed in the File options list.
2. Select a properties file from the File options list.
3. Click on the Open button. The Properties Editor searches the /Omnibus/etc directory for files with a .props extension and then lists the properties.
To change the property values:
1. Click on a property to select it. The name and value appears in the Property frame.
2. Edit the value.
3. Click on the Update button.
Default properties are displayed in black. When you change a default property, it is displayed in white to show that it has been modified.
When you edit the property name, the button label changes to Add. Click on the Add button to specify this as a new property to the list.
To delete a property from the list:
1. Click on the property to select it.
2. Click on the Remove button.
To save the changed properties, click on the Save button.
Posted: Thu Apr 1 10:59:13 PST 1999
Copyright 1989-1999©Cisco Systems Inc.
