Meet IBM Tivoli Netcool / OMNIbus

Greetings, Habrahabr!
I continue to introduce you to IBM products to monitor the state of the IT infrastructure.
In my last article, I talked about ITM - a server and application monitoring system.
Today we will talk about ITNO (IBM Tivoli Netcool / OMNIbus) - the event information processing system.
We consider the architecture of the product and its main features.
If you already can not wait to learn about ITNO - welcome to habrakat.

Architecture.

I suggest starting with a review of the solution architecture.
As I mentioned ITNO is a system for processing event information, it processes and consolidates data from monitoring and control systems.

IBM Tivoli Netcool / OMNIbus architecture

')
The main element of ITNO is ObjectServer, which is a database located in RAM, thereby achieving a high system speed. If the server crashes, the database will not suffer due to the mechanism for creating control points (saving the database and change logs at the file level). ObjectServer is the central repository of event information and is accessible via the GUI or CLI. All actions with it can be performed using SQL.

Representation.

Work with events is possible through the desktop version of the client to ObjectServer, as well as via a web browser using the Web GUI view server integrated into the Tivoli Integrated Portal.

List of active events


The display view is configured using filters that indicate which events will be displayed and the views that are responsible for displaying the selected columns from the ObjectServer.

Filter Creation Interface

Automation.

It is possible to perform automatic reactions and enrich events with the help of ITNO. These functions are implemented using triggers, which are program code that is executed in three cases:
- admission to the system of a new event;
- timer operation;
- response to the internal signal of the ObjectServer.
Triggers play an important role in the operation of the event processing server. The work of ITNO is built on them and such fundamental mechanisms as deduplication and correlation are implemented.

Trigger Interface


Control over the operation of ITNO components is performed by the Process Agent (PA) utility. With PA, you can start / stop ITNO components, both locally and remotely.
Also important components of the architecture are the samples and gateways, which will be discussed further.

Integration.

It is not difficult to conclude about why samples and gateways are needed by reading the section name. That's right, then we will talk about integration with third-party systems.
Most of the event information goes to the ObjectServer from the samples. The sample brings information from data sources to a general form and transmits it as an event to ITNO. At the moment there are more than three hundred types of samples that allows you to integrate with most systems. An important feature of the samples is the possibility of enriching the event with the help of lookup files. As an example of using samples, we can consider the option of integrating the ITM monitoring system with ITNO: when a situation in the monitoring system is triggered, the data is transferred to the EIF sample, which in turn processes them and sends them to ITNO.
Let's move from consideration of samples to gateways. Their main function is to transfer data from the ObjectServer to other systems. The most current example is integration with the Service Desk. Another common use case is the implementation of a fault-tolerant architecture in which gateways are used to replicate event information. Using gateways, both one-way (unidirectional gateway) and two-way (bidirectional gateway) integration is possible.

Conclusion

In my small article I tried to provide basic information about ITNO, without going into details of the implementation of all functions. This material will help the reader to understand the principle of the system and to form their own understanding of the considered IBM product.
Summing up the article, I would like to characterize ITNO as not the cheapest, but at the same time the most flexible, expandable and fast event information processing system.