TIBCO HAWK FAQ

What are the different components available in Tibco Hawk?

TIBCO Hawk Agent

TIBCO Hawk agent is an autonomous process that resideson each computer and monitors systems and applications on that computer. Agentsrun independently of the TIBCO Hawk Display.Agents operate autonomously and are active whenever theoperating system they monitor is active. Agents use sets of rules, calledrulebases, to configure system management, status, and automation tasks. A TIBCO Hawk agent must be installed on each computer youwish to monitor.

TIBCO Hawk Microagent

TIBCO Hawk Microagent (HMA) is a partner process to theTIBCO Hawk agent and provides the local agent with methods for monitoring thehost operating system. Like the agent, a TIBCO Hawk Microagent is generallyinstalled on each computer you wish to monitor.

TIBCO Hawk Display Program

The TIBCO Hawk Display program is used by systemadministrators to view network health and to create rulebases (sets of rulesthat automate monitoring activities). A TIBCO Hawk Display should be installed on any computersyou wish to use for monitoring the network or for building rulebases. TIBCO Hawk Event Service

The TIBCO Hawk Event Service is a process that recordsTIBCO Hawk alerts and changes in agent status. When communication with an agentis lost, the Event Service can invoke a user-provided script. Alerts andnotifications can be recorded to log files or a database.Typically, the TIBCO Hawk Event Service is installed on aminimal number of computers in the network.

 Listout the Microagents used to write rulebases ?

• Process MicroAgent: allows processes to be monitored (e.g. number of processes and resources used)

• Filesystem MicroAgent: allows file systems to be monitored (e.g. space available)

• System microagent: system resources to be monitored (e.g. CPU and memory utilization)

• Logfile MicroAgent: allows system logs to be read

• Custom MicroAgent: allows scripts to be executed on a system and return some values

• Database MicroAgent: monitor the system tables of database engines via JDBC

• JVM MicroAgent: monitors JVM resources (e.g. memory and thread information)

• JMX MicroAgent: monitors JMX information

• SNMP MicroAgent: communicates with SNMP services

Howto monitor logs using Hawk with rulebases?

createNew rulebase –> rules –>Data source –>LogfileonNewLine(logfile=/opt/tibco/tra/domain/application/logs/<<applicationlog file name>>.log)testeditor–> if (nextLine Equals ERROR) then your actiontype ur wish.Clickok and apply changes for all hawk agent and send selected to specific hawkagent to deploy your rulebase.

Howto write rulebase to Monitor Queue and topic using Hawk ?

If youwish to monitor the queues and topics, perform the following :Location: C:\tibco\ems\samples\admin\hawk\tibjmsadmin.hmaJarLocation : \tibco\ems\clients\java contains the 2 jar files1.change the username,password,server properties in tibemsadmin.hma and copy itin to hawk\admin-plugins<classname>com.tibco.tibjms.admin.hawk.HawkController</classname>(dont change the class name it should be HawkController)<arguments> <arg>-user</arg> <arg>admin</arg> <arg>-password</arg> <arg>MyPassword</arg> <arg>-server</arg> <arg>tcp://server1.yourcompany.com:7222</arg> <arg>-timeout</arg> <arg>5</arg></arguments>2. locatejms.jar,tibjmsadmin.jar files and copy them into hawk\admin-plugins folder.

TibcoHawk Rule base to check for memory usage for a particular Queue and send alerts?

Rulebase to check for memory usage for a particular Queue.

1.Selectthe JMS controller microagent and mention the required Queue name to bemonitored.

2.Selectthe condition for 80% threshold limit.Pendingmessage size >= 83886080 (80% of total memory)

3Thenprovide the Alert message details and mail alert details.

Howto add TIBCO HAWK Rulebase to an Application?

Login to TIBCOadministrator using your credentials.

In TIBCOAdministrator, click Application Management.

3. Select the applicationfor which the rulebase has been defined, and expand it.

4. In the ConfigurationBuilder pane, click the service or process name for which the rulebase has beendefined. A service is named with a .arr suffix. A process is named with a .parsuffix.

5. Click the Monitoringtab

6. In the Rulebasespanel, click Add

7. Click Browse and inthe window that appears, navigate to the directory where the rulebase is storedand select the rulebase. Click OK.

8. Click Save.When you deploy theservice, TIBCO Hawk Agent saves the rulebase file in the<install-path>\tibco\tra\domain\<domain-name>\rulebase folder.When the conditionsspecified in the rulebase occur, the results display in the Resource Management> Machines View Machine panel.

How does TIBCO Hawk agent operates?

The Hawk agent uses microagents as an object to represent and interact with the managed object in your local machine. Then, the agent loads the rulebases as monitoring policies to monitor your system or your applications. It uses RV Messaging to communicate with the microagents, and uses EMS or RV messaging to communicate with other agents, Event Service and Hawk Display. It also communicates using instances of TIBCO Hawk Display but it works independently with the Display and other agents.

What is the difference between the Hawk Microagent(HMA) and Application Microagents?

HMA or Hawk Microagents are default microagents residing on your local machine to monitor system’s health and statistics. HMA can be a platform-specific or platform-independent microagent. It means that every platform has its own specific microagent or it has microagents that are default to any platform.
The Application Microagents, on the other hand, are microagents that are specifically created or coded to monitor the application statistics. Only those applications that use AMI are dynamically discovered by the Hawk System and represented by microagents that enables those applications to be managed and monitored.

What is AMI or Application Management Interface?

Application Management Interface (AMI) is a gateway between the external applications and Hawk System that uses RV Messaging to communicate. It is used as a protocol in instrumenting an application with a management interface that allows the application to be monitored and controlled by exposing internal application methods to the TIBCO Hawk system.

TIBCO Hawk Agents operate by loading rulebases. So, what are rulebases?

Rulebase refers to a collection of rules that controls the monitoring conducted by the agents, which can be created or modified using the rulebase editor in the TIBCO HAWK Display. It uses a microagent method as a data source to create one or more tests. These tests use If/else construct to check the conditions and includes action if the condition evaluates to true. An action, can be sending an alert or notification messages, execute an OS command, creating post condition, or invoking another microgent method.

What are Alert Messages?

Alert messages originate from a rulebase that implements the monitoring policy or logic. When a specified condition occurs, the agent publishes an alert message to the TIBCO Hawk Display and presents it by colors to show the severity of the alert. It uses colors such as red for high alert, orange for medium alert, yellow for low alert, cyan if it’s recovering, green if it’s ok and purple for no heartbeat. These colors are default to the Hawk Display but it also allows you to change them based on your own preference. You can also suspend an alert message that will be temporarily neutralized to prevent it from interfering with other monitoring tasks. If ever a condition ceases, these alerts will be cleared or removed in the Display.

What is a rulebase scheduling?

Rulebase scheduling allows you to create a schedule that defines when a rulebase, rule, test or action is active or not. These schedules can be imposed on the rulebase to control the monitoring activity and performing corrective tasks. You can define and assign a schedule using the TIBCO Hawk Display, which must be saved on a file so that it can be assigned later on to one or more agents and can be applied to any rulebase objects.
In creating a schedule, you can also specify inclusion and exclusion periods. For example, you can set a rulebase to be activated only during office hours and be deactivated during holidays. For the inclusion period, you can use Mondays to Fridays from 8 AM to 5PM and for the exclusion period you can include holidays such as Christmas and New Year.

What are the Hawk Group operations?

There are three Hawk Group operations: the Network Query, Network Query with test and Network Action. These group operations allow you to detect and solve problems in the network. If you want to research and test on how to build rules, these Hawk Group operations can be used as an interactive tool.
Network Query, from the name itself, queries one or more agents in the network to detect the location where such specified condition exists. It is such a powerful feature that allows you to communicate with multiple TIBCO Hawk agents at one time. As an individual agent, you can ask or query multiple agents in your network.
The Network Query with test, on the other hand, is where you apply a test based on the results of the network query. You can use these tests to filter the result set, but these tests are optional and only one test per query is allowed.
Lastly, the Network Action specifies an action to be performed on any agent in the network but you can only specify an action one at a time.
Both the Network query and Network Action allow you to combine common and identical tasks which can be executed in a single operation and can be performed on each agent in the network.