IBM Operations Analytics - Log Analysis:Network Manager Insight PackVersion 1 Release 4.1

GI13-4702-05

IBM

NoteBefore using this information and the product it supports, read the information in “Notices” on page 9.

This edition applies to the Network Manager Insight Pack V1.3.5 for Operations Analytics - Log Analysis, and to allsubsequent releases and modifications until otherwise indicated in new editions.

References in content to IBM products, software, programs, services or associated technologies do not imply thatthey will be available in all countries in which IBM operates. Content, including any plans contained in content,may change at any time at IBM's sole discretion, based on market opportunities or other factors, and is notintended to be a commitment to future content, including product or feature availability, in any way. Statementsregarding IBM's future direction or intent are subject to change or withdrawal without notice and represent goalsand objectives only. Please refer to the following developerWorks® terms of use for more information athttps://www.ibm.com/developerworks/community/terms/use/.

© Copyright IBM Corporation 2014, 2017.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

About this publication . . . . . . . . v

Network Manager Insight Pack . . . . . 1Content of the Insight Pack . . . . . . . . . 1Installing the Network Manager Insight Pack . . . 3

Verifying that the Insight Pack was installed . . . 5Configuring topology search apps for use withOracle databases . . . . . . . . . . . . 5

Event annotations . . . . . . . . . . . . 6Customizing the index configuration . . . . . . 7

Notices . . . . . . . . . . . . . . . 9Trademarks . . . . . . . . . . . . . . 10

© Copyright IBM Corp. 2014, 2017 iii

iv Network Manager Insight Pack:

About this publication

This readme file contains information about how to install and configure theNetwork Manager Insight® Pack with Operations Analytics - Log Analysis.

The publications for ***, are available as PDFs from PDF documentation set. Thepublications include this readme file, other Insight Pack readme files and the ***.

In this readme, the installation directory for the Operations Analytics - LogAnalysis product is referred to as $UNITY_HOME.

If you obtained this readme file from within the Insight Pack download package,you might be viewing an out-of-date copy. For the latest readme file in PDF form,see ftp://public.dhe.ibm.com/software/tivoli/Netcool/NetcoolOperationsInsight/library/opsinsight131/. To view the readme file as online documentation, see IBM®

Knowledge Center at http://www-01.ibm.com/support/knowledgecenter/SSTPTP_1.3.1/soc/collaterals/soc_netops_kc_welcome.html.

© Copyright IBM Corp. 2014, 2017 v

vi Network Manager Insight Pack:

Network Manager Insight Pack

The Network Manager Insight Pack reads event data and network topology dataso that it can be searched and visualized in the IBM Operations Analytics - LogAnalysis product.

The Network Manager IP Edition product enriches all the event data that isgenerated by the devices on the network topology. It is stored in Tivoli®

Netcool®/OMNIbus, so that the Operations Analytics - Log Analysis product cancross-reference devices and events. The Gateway for Message Bus is used to passevent data from Tivoli Netcool/OMNIbus to Operations Analytics - Log Analysis.Also, the Network Manager Insight Pack reads topology data from the NCIMdatabase in Network Manager IP Edition to identify the paths in the topologybetween the devices.

The scope of the topology search capability is that of the entire topology network,which includes all NCIM domains. To restrict the topology search to a singledomain, you can configure a properties file that is included in the NetworkManager Insight Pack.For more information about cross-domain discoveries andaggregation domains, see the IBM Tivoli Network Manager IP Edition DiscoveryGuide.

This readme is for the Network Manager Insight Pack V1.3.5.

Content of the Insight PackThe data ingestion artifacts that are included in the Network Manager InsightPack.v Custom apps, which are described in Table 1 on page 2.

A rule set, source type, and collection are provided in theOMNIbusInsightPack_v1.3.1, which the Network Manager Insight Pack uses.

Custom apps

The following table describes the custom apps in the Insight Pack. After the InsightPack is installed, you can run the apps from the Operations Analytics - LogAnalysis UI. With Network Manager IP Edition installed and configured, the appscan also be run as right-click tools from the Network Views. With TivoliNetcool/OMNIbus Web GUI installed and configured, the apps can be run asright-click tools from the Event Viewer and Active Event List (AEL).

The custom apps use the network-enriched event data and the topology data fromthe Network Manager IP Edition NCIM database. They plot the lowest-cost routesacross the network between two nodes (that is, network entities) and count theevents that occurred on the nodes along the routes. You can specify different timeperiods for the route and events. The algorithm uses the speed of the interfacesalong the routes to calculate the routes that are lowest-cost. That is, the fastestroutes from start to end along which a packet can be sent. The network topology isbased on the most recent discovery. Historical routes are not accounted for. If yournetwork topology is changeable, the routes between the nodes can change overtime. If the network is stable, the routes stay current.

© Copyright IBM Corp. 2014, 2017 1

The apps count the events that occurred over predefined periods of time, relativeto the current time, or over a custom time period that you can specify. For thepredefined time periods, the current time is calculated differently, depending onwhich product you run the apps from. Network Manager IP Edition uses thecurrent time stamp. The Tivoli Netcool/OMNIbus Web GUI uses the time that isspecified in the FirstOccurrence field of the events.

Table 1. Custom apps that are included in the Network Manager Insight Pack

Custom app name and file name Description

Find alerts between twonodes on layer 2 topology

NM_Show_Alerts_Between_Two_Nodes_Layer2.app

This app shows the distribution of alerts onthe least-cost routes between two networkend points in a layer 2 topology. Chartsshow the alert distribution by severity andalert group for each route over the specifiedtime period. The ObjectServer field for thealert group is AlertGroup. A list of theroutes is displayed from which you cansearch the events that occurred on eachroute over the specified time period.

In the Operations Analytics - Log AnalysisUI, the app requires search results beforeyou can run it. In the search results, selectthe NmosObjInst column and then run theapp. The app finds the events between the 2nodes on which each selected eventoriginated.

Find alerts between twonodes on layer 3 topology

NM_Show_Alerts_Between_Two_Nodes_Layer3.app

This app shows the distribution of alerts onthe least-cost routes between two networkend points in a layer 3 topology. Chartsshow the alert distribution by severity andalert group for each route over the specifiedtime period. The ObjectServer field for thealert group is AlertGroup. A list of theroutes is displayed from which you cansearch the events that occurred on eachroute over the specified time period.

In the Operations Analytics - Log AnalysisUI, the app requires search results beforeyou can run it. In the search results, selectthe NmosObjInst column and then run theapp. The app finds the events between the 2nodes on which each selected eventoriginated.

For more information about running the apps, see the IBM Netcool OperationsInsight Integration Guide.

2 Network Manager Insight Pack:

Installing the Network Manager Insight PackThis topic explains how to install the Network Manager Insight Pack into theOperations Analytics - Log Analysis product and make the necessaryconfigurations. Operations Analytics - Log Analysis can be running while youinstall the Insight Pack.

Before you begin

You already completed some of these prerequisites when you installed the TivoliNetcool/OMNIbus Insight Pack. See Installing the Tivoli Netcool/OMNIbusInsight Pack for more details.v Install the Operations Analytics - Log Analysis product. IBM Operations

Analytics - Log Analysis V1.3.5 are supported. For upgrades, migrate the datafrom previous instances of the product. See the Operations Analytics - LogAnalysis documentation on the IBM Knowledge Center.

v Ensure that the OMNIbusInsightPack_v1.3.1 is installed before a data source iscreated. For more information, see the readme file for the Tivoli Netcool/OMNIbusInsight Pack.

v Download the Insight Pack installation package from IBM Passport Advantage®.The Insight Pack image is contained within the Operations Analytics - LogAnalysis download, see information about Event Search integration and TopologySearch integration in http://www-01.ibm.com/support/docview.wss?uid=swg24043698. The file name of the Insight Pack isNetworkManagerInsightPack_V1.3.0.0.zip.

v Install Python 2.6 or later with the simplejson library, which is required by thecustom apps that are included in the Insight Pack.

v Over large network topologies, the topology search can be performanceintensive. It is therefore important to determine which parts of your networkyou want to use the topology search on. You can define those parts of thenetwork into a single domain. Alternatively, implement the cross-domaindiscovery function in Network Manager IP Edition to create a single aggregationdomain of the domains that you want to search. You can restrict the scope of thetopology search to that domain or aggregation domain. To do so, set thencp.dla.ncim.domain property to the name of the domain. If you still anticipatea detrimental impact on performance, you can also set thencp.spf.multipath.maxLinks property. This property sets a threshold on thenumber of links that are processed when the paths between the two end pointsare retrieved. If the threshold number is breached, only the first identified routebetween the two end points is retrieved. Make these settings in step “Installingthe Network Manager Insight Pack” of this task. For more information aboutdeploying Network Manager IP Edition to monitor networks of small, medium,and larger networks, see the IBM Tivoli Network Manager IP Edition ProductOverview. For more information about the cross-domain discovery function, seethe IBM Tivoli Network Manager IP Edition Discovery Guide.

v Obtain the details of the NCIM database that is used to store the networktopology for the Network Manager IP Edition product.

Procedure1. Copy the NetworkManagerInsightPack_V1.3.0.0.zip installation package to

$UNITY_HOME/unity_content.

Tip: For better housekeeping, create a new $UNITY_HOME/unity_content/NetworkManager directory and copy the installation package there.

Network Manager Insight Pack 3

2. Use the $UNITY_HOME/utilities/pkg_mgmt.sh command to install the InsightPack. For example, to install into $UNITY_HOME/unity_content/NetworkManager,run the command as follows:$UNITY_HOME/utilities/pkg_mgmt.sh -install $UNITY_HOME/unity_content//NetworkManagerNetworkManagerInsightPack_V1.3.0.0.zip

3. In $UNITY_HOME/AppFramework/Apps/NetworkManagerInsightPack_V1.3.0.0/Network_Topology_Search/NM_EndToEndSearch.properties, specify the details ofthe NCIM database.

Tip: You can obtain most of the information that is required from the$NCHOME/etc/precision/DbLogins.cfg or DbLogins.DOMAIN.cfg files (whereDOMAIN is the name of the domain).

ncp.dla.ncim.domainLimits the scope of the topology search capability to a single domain inyour topology. For multiple domains, implement the cross-domaindiscovery function in Network Manager IP Edition and specify the name ofthe aggregation domain. For all domains in the topology, comment out thisproperty. Do not leave it blank.

ncp.spf.multipath.maxLinksSets a limit on the number of links that are processed when the pathsbetween the two end points are retrieved. If the number of links exceedsthe limit, only the first identified path is returned. For example, you specifyncp.spf.multipath.maxLinks = 1000. If 999 links are processed, all pathsbetween the two end points are retrieved. If 1001 links are processed, onepath is calculated and then processing stops.

ncp.dla.datasource.typeThe type of database used to store the Network Manager IP Editiontopology. Possible values are db2 or oracle.

ncp.dla.datasource.driverThe database driver. For DB2®, type com.ibm.db2.jcc.DB2Driver. ForOracle, type oracle.jdbc.driver.OracleDriver.

ncp.dla.datasource.urlThe database URL. For DB2, the URL is as follows:jdbc:db2://host:port/name

For Oracle the URL is as follows:jdbc:oracle:thin:@host:port:name

In each case, host is the database host name, port is the port number, andname is the database name, for example, NCIM.

ncp.dla.datasource.schemaType the NCIM database schema name. The default is ncim.

ncp.dla.datasource.ncpgui.schemaType the NCPGUI database schema name. The default is ncpgui.

ncp.dla.datasource.usernameType the database user name.

ncp.dla.datasource.password.Type the database password.

ncp.dla.datasource.encryptedIf the password is encrypted, type true. If not, type false.

4 Network Manager Insight Pack:

ncp.dla.datasource.keyfileType the name of and path to the cryptographic key file, for example$UNITY_HOME/wlp/usr/servers/Unity/keystore/unity.ks.

ncp.dla.datasource.loginTimeoutChange the number of seconds until the login times out, if required.

Optionally change the logging information, which is specified by thejava.util.logging.* properties.

Resultsv The NetworkManagerInsightPack_V1.3.0.0 Insight Pack is installed into the

directory that you created in step “Installing the Network Manager InsightPack” on page 3.

v The Rule Set, Source Type, and Collection are in place. You can view theseresources in the Administrative Settings page of Operations Analytics - LogAnalysis.

What to do nextv Verify that the Insight Pack was successfully installed.v If you are using an Oracle database, make the extra configurations that are

required to support Oracle. Configure the products to support the topologysearch capability. See the IBM Netcool Operations Insight Integration Guide.

Verifying that the Insight Pack was installedRun the pkg_mgmt command to verify that the Insight Pack was installed, or checkthe Operations Analytics - Log Analysis.

Procedurev Run the pkg_mgmt as follows:

$SCALA_HOME/utilities/pkg_mgmt.sh -list

Search the results for a line similar to the following example. In this example,V1.3.0.0 is installed.[packagemanager] NetworkManagerInsightPack_V1.3.0.0 /home/myhome/IBM/LogAnalysis/unity_content/NetworkManager

v On the Operations Analytics - Log Analysis UI, check for the following items inthe Search Dashboards area: NetworkManagerInsightPack > Find eventsbetween two nodes on layer 3 topology or NetworkManagerInsightPack >Find events between two nodes on layer 2 topology

Configuring topology search apps for use with Oracledatabases

If you are using an Oracle database for topology storage (that is, as the NCIMdatabase), obtain the Oracle driver and point to the driver in the custom apps. Youcan skip this task if you are using a DB2 database. You can make this configurationwhile the products and Insight Pack are still running.

Before you begin

Install and configure the supported products, and install and configure theNetwork Manager Insight Pack

Network Manager Insight Pack 5

Procedure1. Obtain and install the Oracle driver from the Oracle website.2. On the Operations Analytics - Log Analysis host, save the driver to

$UNITY_HOME/wlp/usr/servers/Unity/apps/Unity.war/WEB-INF/lib.3. Point the custom apps to the driver:

a. Open the following files for editing:v $UNITY_HOME/AppFramework/Apps/NetworkManagerInsightPack_v1.3.0.0/

Network_Topology_Search/NM_Show_Alerts_Between_Two_Nodes_Layer2.sh

v $UNITY_HOME/AppFramework/Apps/NetworkManagerInsightPack_v1.3.0.0/Network_Topology_Search/NM_Show_Alerts_Between_Two_Nodes_Layer3.sh

b. Insert the path to the Oracle driver into the classpath parameter. Forexample, change it from this classpath:$UNITY_LIB_PATH/db2jcc.jar:$UNITY_LIB_PATH/log4j-1.2.16.jar

To this classpath:To: $UNITY_LIB_PATH/db2jcc.jar:$UNITY_LIB_PATH/ojdbc14.jar:$UNITY_LIB_PATH/log4j-1.2.16.jar

4. In the $UNITY_HOME/AppFramework/Apps/NetworkManagerInsightPack_V1.3.0.0/Network_Topology_Search/NM_EndToEndSearch.properties file, which point theInsight Pack to the NCIM database, ensure that the following properties forOracle are correctly set.

ncp.dla.datasource.typeEnter oracle.

ncp.dla.datasource.driverEnter the driver name, for example oracle.jdbc.driver.OracleDriver.

ncp.dla.datasource.urlEnter the URL, in the format jdbc:oracle:thin:@host:port:name, wherename is the name of the database. For example,jdbc:oracle:thin:@192.168.1.2:1521:itnm

Event annotationsThe event annotations that are defined by the Network Manager Insight Packindex configuration file. These fields are the same as those in the TivoliNetcool/OMNIbus Insight Pack.

For more information, see the Tivoli Netcool/OMNIbus Insight Pack README. Youcan download the README at ftp://public.dhe.ibm.com/software/tivoli/Netcool/NetcoolOperationsInsight/library/opsinsight131/.Related tasks:“Customizing the index configuration” on page 7

6 Network Manager Insight Pack:

Customizing the index configurationBecause the rule set, source type, and collection are provided in theOMNIbusInsightPack_v1.3.1, any customizations must be made to that InsightPack, not the Network Manager Insight Pack. Refer to theOMNIbusInsightPack_v1.3.1 README for more information about customizing thatInsight Pack.

For more information, see the Tivoli Netcool/OMNIbus Insight Pack README. Youcan download the README at ftp://public.dhe.ibm.com/software/tivoli/Netcool/NetcoolOperationsInsight/library/opsinsight131/.Related reference:“Event annotations” on page 6Related information:

Operations Analytics Log Analysis V1.3.5 documentation: Configuring theDSV toolkit

Operations Analytics Log Analysis V1.3.3 documentation: Configuring theDSV toolkit

Network Manager Insight Pack 7

8 Network Manager Insight Pack:

Notices

This information was developed for products and services offered in the U.S.A.IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not give youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBMIntellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan, Ltd.1623-14, Shimotsuruma, Yamato-shiKanagawa 242-8502 Japan

The following paragraph does not apply to the United Kingdom or any othercountry where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certaintransactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM Web sites are provided forconvenience only and do not in any manner serve as an endorsement of those Websites. The materials at those Web sites are not part of the materials for this IBMproduct and use of those Web sites is at your own risk.

© Copyright IBM Corp. 2014, 2017 9

IBM may use or distribute any of the information you supply in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM Corporation2Z4A/10111400 Burnet RoadAustin, TX 78758 U.S.A.

Such information may be available, subject to appropriate terms and conditions,including in some cases payment of a fee.

The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.

Any performance data contained herein was determined in a controlledenvironment. Therefore, the results obtained in other operating environments mayvary significantly. Some measurements may have been made on development-levelsystems and there is no guarantee that these measurements will be the same ongenerally available systems. Furthermore, some measurement may have beenestimated through extrapolation. Actual results may vary. Users of this documentshould verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.

All statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to the names and addresses used by an actual businessenterprise is entirely coincidental.

If you are viewing this information in softcopy form, the photographs and colorillustrations might not be displayed.

TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks ofInternational Business Machines Corp., registered in many jurisdictions worldwide.Other product and service names might be trademarks of IBM or other companies.A current list of IBM trademarks is available on the Web at “Copyright andtrademark information” at www.ibm.com/legal/copytrade.shtml.

10 Network Manager Insight Pack:

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registeredtrademarks or trademarks of Adobe Systems Incorporated in the United States,other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registeredtrademarks of Oracle and/or its affiliates.

Linux is a trademark of Linus Torvalds in the United States, other countries, orboth.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks ofMicrosoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and othercountries.

Other product and service names might be trademarks of IBM or other companies.

Notices 11