Tivoli Event Management

1. Tivoli Event Management Overview & Directions Tivoli North Central User Group Meeting Kevin Myers, 02 April 2008

2. Statement Of Direction And Intent • All statements of direction or intent are provided for planning purposes only and are subject to change or withdrawal without notice • This presentation represents our current goals and objectives • We are listening to customers’ views on the future directions of our solutions

3. Agenda • Event Management Strategic Direction • OMNIbus Overview • Event Management Evolution & Directions • Upgrade methodology

4. Event Management – Strategic Direction • OMNIbus and TEC will converge to a single, strategic converged Event Management product between now and 1H2009 • Industry leading solution for event management of any type or size of infrastructure • Integrate the positive qualities of both systems, preserving customers investments in deployed assets • There is existing integration between the two products today • Our Converged Event Manager will be based on the OMNIbus architecture and will include features provided with TEC • We encourage all customers to eventually upgrade to the converged event management platform: • You can upgrade on your timeline. • TEC/OMNIbus co-existence and interoperation between will be provided while convergence is delivered • Tivoli is putting in place recommendations and capabilities to enable you to control this upgrade, and execute in smooth, non-disruptive steps. • For customers wishing to remain with TEC, we will continue to support TEC 3.9 functionality and provide platform currency and support at minimum through April 2012

5. OMNIbus Advantages over TEC • ObjectServer is optimized for speed and is highly scalable • OMNIbus uses ANSI SQL and regular expression (like Perl) correlation languages - PROLOG skills no longer needed • Compliant with FDCC standards and delivering FIPS 140-2 and Common Criteria (EAL-2) compliance in 2008. Evaluation underway for EAL-4+. • Out of the box failover capabilities for the ObjectServer, Gateways and probes • Deduplication out of the box – no more dup_detect rules • Manager of Managers – Integration with almost every device and monitoring product (250+) • Less overall costs to maintain ObjectServer once configured • Out-of-the-box ready to run rules with best practices • Very flexible and intuitive

6. Key Assumptions Guiding Unification • OMNIbus is the base for the convergence of the event infrastructure for entire Tivoli product portfolio and will be focus of future integration work • TIP (Tivoli Integrated Portal) is the common and strategic console for operations and policy management for Tivoli’s product portfolio (evolution of the integrations in ITM TEP) • WebTop as the event management console of choice • Movement towards an integrated, contextual control of multiple event types • Tivoli Monitoring (TEMA/TEMS/TEPS) is the strategic monitoring platform for Tivoli’s product portfolio and the base for Tivoli’s product portfolio self-management capabilities • ITM v6 agents and Netcool SSM/ASM agents are converging to provide a single and richer agent infrastructure with combined assets. In the converged agent infrastructure: • Configuration and monitoring data flow to TEP/TIP through ITM server • Optionally agents will be able to send events to OMNIbus and/or TEC using: • SNMP traps • EIF interface

8. OMNIbus Summary – Event Management in “Real-Time” • Depth And Breadth Of Event Coverage And Correlation • Collection - Thousands of event sources – Generic and Vendor-specific • Consolidation/Normalization - Common and customizable event format • Event Reduction • “Deduplication” • Correlation (Internal to OMNIbus and Parallel with other Tivoli components) • Tool Integration • Archive, reporting, other Tivoli components, and 3rd party products • Workflow integration via Trouble Ticket tie-in (bi-directional) • Ease Of Use And Deployment • Rapid Deployment • High productivity – easy of use • Interactive Desktop views • Reduce operator knowledge requirements • Context-sensitive tools • Automations (notification) • In-line direction and actions for operators (tools/resolutions) • High Availability And Scale • High-availability and resiliency features (DB transactions, synchronization of events) • Multi-tiered architectures for scale The broad event coverage provided by OMNIbus positions us as the premier solution in the marketplace

9. Display ObjectServers High performance throughput Failover ObjectServers Aggregation ObjectServers Netcool / Gateway FailOver ObjectServer Netcool / ObjectServer Collection ObjectServers Normalize and Enrich Events • Netcool Probes • Rules & Lookup files Broad Scope (systems, applications, data network, Voice network, VoIP, EMSs, etc) Desktop and/or Web Views Netcool/OMNIbus Strengths: High Availability and Scale OMNIbus ObjectServer supports very high event arrival rates • Large number of supported event feeds • In-memory event model • Optional persistence to an RDBMS archive • Optimized for common correlation patterns: • De-duplication and State based correlation • Filtering • Automation • Reduce datacenter staff workload and lower administration costs • Elegant high availability / failover solution • ObjectServer state replication • Event source (probe) failover / failback algorithms • Mature ObjectServer topologies supporting many event sources and/or event consoles • Specialized in high volume event feeds for time sensitive transactions: Telco Transmission management, Financial Trading Floors

10. Netcool Knowledge Library SNMP support (>175 MIBs),including: • Vendor Alliances (~25): • Alcatel • Motorola • Siemens • Ericsson • Tellabs • Marconi • Lucent • Nokia • Huawei • Fujitsu • Ciena • Cisco • Juniper • Checkpoint • Cramer • Metasolv • SAP • Xtera • Voyence OMNIbus integrations Bridge MIB RFC 1493 MIB-II RFC 1213/2096 RMON MIBs OSPF MIB BGP MIB ifStack MIB VRRP MIB ATM Forum MIB RFC 1695 for ATM switches ATM Forum PNNI (Single Pier) MIB ATM Forum ILMI MIB ATM Forum LANE Client MIB Frame Relay MIB RFC 1315 FDDI MIB RFC 1512 31 different Cisco MIBs (including MPLS VPNs) 21 Nortel MIBs 6 different Extreme Networks MIBs (inc VLANs) Juniper MPLS VPN support Probes (~ 200): Email Probe Enterprise SNMP EMS Probe Ericsson 3GPP (OSS-RC/RANOS/CNOS) Ericsson ACP 1000 Ericsson AXE 10 per Class 5 Voice Switch Ericsson BNSI Ericsson MD110 Ericsson RANOS (3GPP) Ericsson Xmate Exec Probe Fibermux LightWatch FIFO FLEXR Probe Freshwater Sitescope Fujitsu FENS Fujitsu ICS Probe Fujitsu Netsmart Generic Logfile Probe Generic trapd/syslog capture per device Glenayre VMS Probe Hewlett Packard IT/Operations Center Hewlett Packard OpenView NNM Hewlett Packard Vantage Point Operations Cisco WAN Manager CMS400 Probe Compaq Tandem Informix Ion Networks Sentinel 2000 KBU Fivemere Kodiak EMS Lucent 5ESS - Class 5 Voice Switch Lucent Agile ATM Lucent ECP Lucent ITM-NM/OMS Lucent ITM-SC Lucent JMTE (CORBA) Lucent Naviscore Lucent NFM Lucent OMC (CORBA) Lucent OTAF/SDHLR Lucent Wavestar SNMS ADC Metrica NPR Airspan Sitespan Alcatel 1000 E10/OCB-283 Alcatel 5620 Logfile Alcatel 5620 NM CORBA Alcatel 5620 SAM Alcatel AWS Alcatel DSC Dex per Class 5 Voice Switch Alcatel MT20 Alcatel NMC 1300 Alcatel OMC-R (3GPP) Alcatel OMC-R (Q3 Interface) Alcatel OMC-R (Terminal Server Connection) Alcatel OMC-S Alcatel OS-OS Alcatel S12 Alcatel SMC 1360 Aprisma Spectrum Arcom Environmental Monitoring System Ascom CLOG Ascom PANMAN Ascom TimePlex TimeView/2000 Avaya Definity G3 per switch BMC Patrol CA Unicenter TNG Castlerock SNMPC Comverse Dantel PointMaster DAWCOM DEC VAX Operator Communication Facility ECI Lightsoft CORBA ECI/eNM ECI/Telematics Gateways (~ 30): Bi-Directional Flat File HP OpenView IBM DB2 6.2 IBM DB2 7.1 IBM Informix 9.20 MS SQL ObjectServer 3.5 Remedy 7 Siebel SNMP Socket ObjectServer v7 Unidirectional Oracle 10.1.0.2 EE & SE Peoplesoft Vantive 8

11. Tivoli Client Successes in All Industries Finance: 96 of Top 100 Institutions Communications: The majority of leading companies Healthcare: 9 of 10 Top Companies Retail: 8 of 10 Top Companies Government Agencies Energy/Utilities Manufacturing/Industrial Media/Entertainment 11 11

12. “ ” Efficiency and Effectiveness • Manage more with the same staffing levels • Reduce ‘truck rolls’ through automated diagnostics • Reduced training costs through standardisation of monitoring platform Peter Hascher, BT Global Services

13. OMNIbus References EDS - "OMNIbus 7.2 continues to enhance one of the most robust event management platforms in the industry. I don’t need many of the new features, but I need the speed, flexibility, and scalability of the OMNIbus Object Server to deliver services to my customers.“ IBM displaced HP's OpenView Network Node Manager at Integra Telecom, a Portland, Ore., telco that services the western United States. Integra Telecom, following it's acquisition of Electric Lightwave, found itself with both HP's OpenView and IBM's Netcool. In the evaluation it undertook to centralize on one fault and event management system, Integra found that "IBM had additional functionality that HP didn't have and it was at a lower cost than HP OpenView," said Integra CIO Julie Rouzee. "I believe [HP is] a little behind on being competitive. They had a product we were interested in, but it was not available in the market [when Integra Telecom did its evaluation]," she said.

14. TEC Architecture Overview Event Sources Event Processing Event Visualization Event Mapping Local Filters State Correlation Rules Event suppression and summarization TEC Java Console (Event Groups) Prolog Rules Automation (Actions) Integration with 3rd parties Event association Event Management Fact files Default mapping TEC Adapter(s) TEC Event Sources TEC Gateway(s) (TME) CLIs EIF TEC Server (TME) TEC Web Console (Browser) WAS Appl Server Tivoli/IBM Products (ITM, NetView, etc) CLIs EIF TEC Event Datastore (RDBMS) ETLs TDW 1.3

15. OMNIbus core Architecture Overview Event Sources Event Processing Event Visualization OMNIbus Gateway(s) Integration with Tivoli and 3rd parties Native Console Automation Rules (SQL) Filter, deduplication, Lookup files Event Management Event Mapping Lookup files Filters Event Sources OMNIbus Probe(s) Web Console (Browser) OMNIbus Server WebTop ITNM (Precision) In Memory Event datastore Topology model based correlation Archive Discovery & Monitors RDBMS

16. Event Processing Unification: Concepts Our research indicates that most correlation rules fall into five categories: • Suppression, e.g. de-duplication, filter out, thresholding • Summarization, e.g. sequence and set, incomplete sequence and set • Modification, e.g. change status, set attribute value, link cause and effect • Automation, e.g. local and remote task execution • Forwarding, e.g. event routing Remaining rules fall into more specialized activities • Advanced scripting • Event enrichment through lookup tables or fact files • … Best practices from customers and technicians that have architected and completed upgrade to OMNIbus: • Goals based review of current correlation rules key • One-for-one rules migration may diminish potential value OMNIbus provides over TEC

17. TEC  OMNIbus Upgrade Scenario - General • Stand-alone TEC environment • TEC consoles native or in TEP • TEC Server does the correlation • OMNIbus is installed • Event metadata definitions are created in using tools delivered in OMNIbus 7.2 (Nov ’07) • Rules are converted to triggers where not available out-of-the-box (manual process using Redbook and white papers) Phase 1 Phase 0 OMNIbus Service Desk(s) Service Desk(s) Rules Event Sync metadata Upgrade TEC TEC Rules Rules • Customer is free to move event sources, operator consoles and rules processing in whatever order they prefer • Service desk integration to OMNIbus created via appropriate gateway • Operator consoles in TIP • All event sources flow to OMNIbus and may be replaced with appropriate native probe • All Systems Management rules processing done in Netcool • TEC server retired Phase 3 Phase 3 Phase 2 OMNIbus OMNIbus Service Desk(s) Service Desk(s) EIF EIF Event Sync TEC

18. TEC to OMNIbus Upgrade Methodology • Three Main Patterns seen to-date • Deploy OMNIbus into TEC environment • Move event sources and event processing to OMNIbus over time • Continue to leverage TEC Prolog investment via integration for necessary event classes in rare cases if necessary • Allows flexibility over time for event processing system of choice as ‘manager of managers’ • Create parallel OMNIbus environment • Implement event processing and reconfigure event sources application by application • Allows potential for ‘fresh start’ architecture leveraging all advantages of OMNIbus over TEC • Deployment of TBSM 4.1 and leveraging OMNIbus architecture over time • OMNIbus is underlying event engine with TBSM 4.1 • TEC can initially feed TBSM, but event sources and processing can be converted in ‘Phase 2’ to directly feed OMNIbus • Minimal architectural considerations for use of OMNIbus for enterprise event management in this scenario • IBM Redbook Best Practices for IBM Tivoli Enterprise Console to NetCool/OMNIbus Upgrade available in 2Q08

19. Preview - Best Practices for IBM Tivoli Enterprise Console to Netcool/OMNIbus Upgrade Redbook • Overview of common OMNIbus and TEC deployment configurations and architectures • Planning Guides for Environmental Assessment and Upgrade • Overview of event source types and best practices for integration into OMNIbus • Coverage of event volume scale and performance considerations • Discussion of BAROC definition and event processing examples for most common patterns • Overview of desktop upgrade and event view customization • Review of common upgrade strategies • Covers TEC or OMNIbus as manager-of-managers

20. Backup

21. Event Flows Integrations Available Today Tivoli Enterprise Portal TEC Event Console • ITM Events fully integrated to TEC & Omnibus • Customers have out of the box integration • TEC Console native in the TEP • Single console, contextually integrated (click and launch to ITM workspace which is source of event) • TEC and OMNIbus integrated • Either can be event manager of managers • Events in one are forwarded to the other • google: “ABSM Best Practices” AEL • CEI business events integrated to TEC • Single console for business and IT events • SOA probe for CEI integration to OMNIbus – by EOY • OMNIbus Active Event List can be displayed within TEP OMNIbus TEC CEI ITM ITSM WBI Telco Network Enterprise Systems

22. Click Across Pop-up Propagate Notify Event Key enhancements in OMNIbus 7.2 • Accelerated Event Notification • Powerful new escalation feature • Health and Performance agent • Leverage ITM functionality (MOSWOS) • Tivoli Enterprise Console features • Class Hierarchy – instance of • Extended Attributes • Baroc2sql extraction script • Enhanced failover features • gw_counterpart_down • gw_counterpart_up • IPv6 • Globalisation - Language packs • IBM Support Assistant plug-in • No electronic licensing

23. TEC - OMNIbus Technical Similarities

24. OMNIbus 7.2 detail

25. Accelerated Event Notification in OMNIbus Pop-up Click Across (Webtop Server) Desktop Notification Client Minimise latency Low volume of urgent events Nominated users/desktop Web or native event list Display Notify Propagate Collection Event

26. Health and Performance Metrics Availability monitoring Client activity monitoring Throughput and activity metrics Event Stream Characteristics Class, origin, status, etc. Inserts by client on ObjectServer Amount of ObjectServer time used by individual clients and automations Out of the box situations with expert advice Take action commands for TEC server Future – health and performance of probes Health & Performance Agents for TEC & OMNIbus Tivoli Enterprise Portal Provides the ability to see how well Event Engine is performing from within TEP TEC Event Console AEL TEC Omnibus Health & Performance Agent Health & Performance Agent OMNIbus Probes TEC Gateway Health & Performance Agent Health & Performance Agent TEC Event Sources OMNIbus Event Sources

27. OMNIbus Health and Performance Agent

28. Out-of-the-box FailoverImproved configuration for high-availability systems • Replace existing external script using nco_ping/nco_sql • Two new signals that will be raised by gateway: • gw_counterpart_down: When the gateway detects that the primary ObjectServer is unavailable, it will raise a gateway counterpart down signal in the backup ObjectServer. • gw_counterpart_up : When the primary ObjectServer becomes available again the gateway will raise gateway counterpart up signal in the Backup ObjectServer. • Example signal triggers to enable/disable selected automations on backup ObjectServer

29. Class hierarchy support for TEC transition • TEC supports representing events as a class hierarchy whereas the ObjectServer stores and processes events in a ‘flat’ normalized representation. • The ObjectServer will provide support for processing events with regard to their position in the event hierarchy and to allow information in extended slots [columns] to be processed. • Retain performance advantage of ObjectServer structure • probe rules file functions to build the extended attribute information into a single attribute field • ObjectServer will support processing an event with regard to the events location in the class hierarchy. (e.g. “instance of” sql) • ObjectServer will read and write field values stored in extended attribute slots • Baroc2sql Class hierarchy extraction script