XClarity is an Infrastructure Monitoring Application which monitors network, server, storage, power devices, etc. It is a distributed software that monitors the IT environment and generate events based on data which has been exposed with rest APIs or from third parties. This document describes the configurations required to establish a connection between the XClarity application and the XClarity LAM.

The workflow for gathering events from an XClarity server, and publishing it to Moogsoft AIOps is as follows:

1. The LAM reads configuration from given xclarity_lam.conf file.
2. The LAM connects with the host and sends the GET REST request based on uri provided in LAM Config.
3. The event data of all the devices monitored in XClarity is received by the LAM as a response. The format of received events is JSON.
4. If filter variable in monitor section is set, then LAM will filter the events based on the filter criteria set in the config file.
5. The LAM parses the events and then publishes it to the MooMS bus.
6. The unmapped event data is sent to the overflow variable.
7. The events are published to the subject “Events”.

XClarity LAM Configuration

The events received from the XClarity server are processed according to the configurations in the xcl arity_lam.conf file. The processed events are published to Moogsoft AIOps.

The configuration file contains a JSON object. At the first layer of the object, LAM has a parameter called config , and the object that follows config has all the necessary information to control the LAM.

The following configuration sections are available in the XClarity LAM configuration file:

Monitor

Agent

HA Configuration

Mapping

Constants and Conversions

Monitor

The XClarity LAM fetches the events from the XClarity Rest Server. You can configure parameters here to establish a connection with XClarity:

General

Filter

Secure Sockets Layer

The following table lists the fields which are included in an event and the operators which can be used on a field:

Example

monitor:
        {
            
            name                    		: "Xclarity Lam Monitor",

            class                   		: "CXclarityMonitor",

			host_name                   	: "localhost",

            uri                         	: [
												"events",
										  	  ],
			user_name                   	: "username",
            
            password                    	: "password",

			#encrypted_password         	: "ieytOFRUdLpZx53nijEw0rOh07VEr8w9lBxdCc7229o=",

			ssl 							: false,
            
            ssl_keystore_file_path      	: "KeyStore.jks",
            
            ssl_keystore_password       	: "password",
            
   			polling_interval            	: 10,

            max_retries                 	: -1,
  
            retry_interval              	: 60,

			timeout							: 120,
 			events_date_format          	: "yyyy-MM-dd'T'HH:mm:ss'Z'",

            filter                      	: "false",

            filter_type                 	: "FIELDREGEXAND",    
          
            filter_comparison_operators 	: [
                                           		"EQ"                                    
                                          	  ],

            filter_field_names          	: [
                                           		"cn"
                                          	  ],

			filter_field_values         	: [
                                            	 ""
                                          	  ]
		   
		    
         },

Examples of filter criteria:

Example 1 : Non-regular Expression filtering with all event fields.

			filter                      : "true",

            filter_type                 : "FIELDNOTREGEXOR",    
          
            filter_comparison_operators : "EQ",                                    
            
            filter_field_names          : "cn",

            filter_field_values         : "1",

Here the FIELDNOTREGEXOR filter type is used. Since "cn" is entered in the field filter_field_names ,  all the fields of an event will be compared with the value "1" in the field filter_field_values . If any of the field has value equal to "1", then events will be filtered and processed by the LAM.

Example 2 : Non-regular Expression filtering with selected event fields.

			filter                      : "true",

            filter_type                 : "FIELDNOTREGEXOR",    
          
            filter_comparison_operators : [
                                           "LT",
                                           "GT"                                    
                                          ],

		    filter_field_names          : [
										   "severity",
										   "timeStamp"
										  ],

            filter_field_values         : [
										   "200",
                                           "2016-11-07T16:01:03Z"
                                          ],

Here the FIELDNOTREGEXOR filter type is used. Only two fields of an event are entered in the filter_field_names , and the filter_comparison_operators field also has two operators defined for each event field in filter_field_names. Therefore, the events with severity less than "200" or time stamp greater than "2016-11-07T16:01:03Z" will be filtered and processed by the LAM.

Example 3 : Regular Expression filtering with selected event fields.

			filter                      : "true",

            filter_type                 : "FIELDREGEXOR",                                        
            
            filter_field_names          : [
										   "severity",
										   "timeStamp"
										  ],

            filter_field_values         : [
										   "200",
                                           "2016-11-07T16:01:03Z"
                                          ],

Here the FIELDREGEXOR filter type is used. The operators do not work with a regular expression filter. The events with severity equal to "200" or time stamp equal to "2016-11-07T16:01:03Z" will be filtered and processed by the LAM.

Agent

Agent allows you to define two parameters:

HA Configuration

Refer to the document Integrations HA Configuration

Mapping

Variables section is not required in the XClarity LAM, you can directly map the event's field of XClarity with moogsoft fields. The parameters of the received events are displayed in the Moogsoft AIOps according to the mapping done here:

mapping :
        {
            catchAll: "overflow",
            rules:
            [
                { name: "signature", rule:      "$eventID" },
                { name: "source_id", rule:      "$sourceID" },
                { name: "external_id", rule:    "$componentID" },
                { name: "manager", rule:        "XClarity" },
                { name: "source", rule:         "$systemName" },
                { name: "class", rule:          "$typeText" },
                { name: "agent", rule:          "$LamInstanceName" },
                { name: "agent_location", rule: "$LamInstanceName" },
                { name: "type", rule:           "$typeText" },
                { name: "severity", rule:       "$severityText", conversion: "sevConverter" },
                { name: "description", rule:    "$msg" },
                { name: "agent_time", rule:     "$eventDate", conversion: "timeConverter"}
            ]
        },
        filter:
        {
            presend: "XclarityLam.js"
        }

In the above example, the signature field is used by the LAM to identify the correlated events, it is mapped to eventID here. However, you can also change it as per the requirement. Data not mapped to Moogsoft AIOps Fields goes into "Custom Info".

You can define number of these rules covering the base attribute of an event.

Constants and Conversions

severity:

{

 "OK"            : 0,
 "Informational" : 1,
 "Warning"       : 2,
 "Minor"         : 3,
 "Major"         : 4,
 "Critical"      : 5,
 "Fatal"         : 5,
 "Error"         : 5

}        

sevConverter:

 {
     lookup  : "severity",
     input   : "STRING",
     output  : "INTEGER"
  },

stringToInt:
{
    input  : "STRING",
    output : "INTEGER"
},

timeConverter:
{
    timeFormat : "yyyy-MM-dd'T'HH:mm:ss.SSS",
    input      : "STRING",
    output     : "INTEGER"
}

Example

constants:
        {
            severity:
            {
                "OK"            : 0,
                "Informational" : 1,
                "Warning"       : 2,
                "Minor"         : 3,
                "Major"         : 4,
                "Critical"      : 5,
                "Fatal"         : 5,
                "Error"         : 5
            }
        },
        conversions:
        {
            sevConverter:
            {
                lookup: "severity",
                input:  "STRING",
                output: "INTEGER"
            },
	    	            
            stringToInt:
            {
                input:      "STRING",
                output:     "INTEGER"
            },     
 
			timeConverter:
            {
                timeFormat: "yyyy-MM-dd'T'HH:mm:ss",
                input:      "STRING",
                output:     "INTEGER"
            }  
            
        },

Severity Reference

severity:
        {
            "CLEAR" 		: 0,
            "INDETERMINATE" : 1,
            "WARNING" 		: 2,
            "MINOR" 		: 3,
            "MAJOR" 		: 4,
            "CRITICAL" 		: 5,
            
        }

Service Operation Reference

Start the LAM Service:

service xclaritylamd start

Stop the LAM Service:

service xclaritylamd stop

Check the LAM Service status:

service xclaritylamd status

Command Line Reference

To see the available optional attributes of the XClarity_lam, run the following command:

xclarity_lam --help

The xclarity_lam is a command line executable, and has the following optional attributes:

Performance Information

Version