Moogsoft Docs

Configure the OEM LAM

Oracle Enterprise Manager (OEM) is a set of web-based tools that manage software and hardware produced by Oracle Corporation as well as by some non-Oracle entities.

OEM LAM and OEM Connector extracts event data from OEM (Oracle Enterprise Manager), formats it and then sends it to Moogsoft AIOps.

See Oracle Enterprise Manager for UI configuration instructions.

The OEM LAM and OEM Connector performs the following actions:

  • Data collection : OEM event connector collects the event data from OEM and sends it to an external application, e.g. Moogsoft AIOps.
  • Data normalization : OEM LAM formats and normalizes the retrieved data into an event that can be sent to Moogsoft AIOps.
  • Emit the events : OEM LAM sends the normalized event to Moogsoft AIOps.

    The LAM workflow is as follows:
  1. LAM reads the configuration from the oem_lam.conf file.
  2. The OEM Connector pushes the events via configured mechanism (http/https, etc.) to the OEM LAM in XML format.
  3. The OEM LAM parses the events and converts it into JSON using Org.json library and submits it to an Extractor.
  4. The Extractor extracts the events from the JSON Strings.
  5. The events are parsed and converted into normalized Moogsoft AIOps events.
  6. The normalized events are then published to MooMS bus.

OEM LAM Configuration

The OEM LAM is used to communicate with the Moogsoft OEM Connector. Therefore, the events received from the Moogsoft OEM Connector are processed according to the configurations in the oem_lam.conf file.

The configuration file contains a JSON object. At the first layer of the object, LAM has a parameter called config , and the object that follows config has all the necessary information to control the LAM.

The OEM LAM configuration file has the following sections:



HA Configuration


Constants and Conversions


The OEM LAM takes its input from the OEM Connector. The details of the connection with the OEM Connector is defined in the monitor section of the configuration file.You can configure the parameters here to establish a connection with OEM.


name and class String

Reserved fields: do not change. Default values are OEM Lam Monitor and COemMonitor.



The port on the server that listens for events from OEM. It is an optional value that defaults to 8888, and the defined port value is 48002.



The host name or IP address of the OEM Server where the OEM LAM is running. Default address is localhost .

use_ssl Boolean Set to true if you want the server to use HTTPS. The default value is false .
use_client_certificates Boolean

Set to true if you want client certification. By default it is set to false. If set to true , ssl must also be enabled.

client_ca_filename String

Enter the name of the root ca file. This should be stored in the directory given in path_to_ssl_files field.

auth_token String

A shared secret token in the request body used to authenticate requests. If not defined or empty, then authentication via this means is disabled. If defined, then all requests must contain this token in the body otherwise the request will be rejected.

encrypted_auth_token String Use this option to specify the 'shared secret' body token in encrypted form in the configuration file.
header_auth_token String A shared secret token in the request header used to authenticate requests. If not defined or empty, then authentication via this means is disabled. If defined, then all requests must contain this token in the header otherwise the request will be rejected.
encrypted_header_auth_token String Use this option to specify the 'shared secret' header token in encrypted form in the configuration file.
authentication_type String

When set to basic , authentication uses the graze login. If set to none (default) or configuration is not specified, then basic authentication will not occur.

authentication_cache Boolean

Valid only when authentication_type is set to basic.

When set to true (default), a hashed version of user's password is kept in the internal cache for the duration of their session. This speeds request handling, but it can be a security issue for some users. If set to false , the basic authentication internal cache is disabled. Users are authenticated with each request, which slows request handling.

accept_all_json Boolean

If set to true , the OEM LAM will expect and process incoming requests using any form of JSON. If set to false , Moogsoft AIOps OEM LAM protocol is used. Defaults to true .

  • When accept_all_json is set to true , an event sender does not conform to the Moogsoft AIOps OEM LAM protocol. Together with list_contains_multiple_events set to true , an event sender (such as a third party commercial off-the-shelf product which defines its own rigid output of events) can be accepted into the OEM LAM and be converted into Moogsoft AIOps  events. Events are then sent out to MooMS.

  • When accept_all_json is set to false , the event sender sends events that must conform to the Moogsoft AIOps OEM LAM protocol. This is done when you do not want to make changes to the default OEM LAM config or to the lambot. It is possible to make changes at the events' sender side to send events conforming with the JSON that can be received at Moogsoft AIOps.

lists_contain_multiple_events Boolean

When the Moogsoft OEM LAM protocol is not in use, then you must define whether a list should be interpreted as multiple events or as a single one.

num_threads Integer

The number of worker threads that should be used to handle incoming connections. It is an optional value that defaults to the number of CPUs available. Default value is 5.

rest_response_mode String

Defines when the REST response is sent during the event ingestion lifecycle.

Default mode: on_receipt . If not specified, the mode will set to on_receipt .

Possible Modes are:
on_receipt = Respond to REST once a valid event has been received.
event_forwarded = Respond to REST once the event is sent out to MooMS.
event_processed = Respond to REST once the event has been processed by a Farmd Instance's AlertBuilder Moolet.


To provide more details on event procesing in Moogsoft AIOps, you can use event_forwarded or event_processed mode.



This is used when the rest_response_mode is in event_processed mode. I t determines the number of seconds to wait for a response regarding an event being processed by Farmd before timing out and sending a general error response to the REST connection. This configuration has no effect when rest_response_mode is in on_receipt or event_forwarded , as those modes do not require a response from Farmd or other bespoke processes.
Default: 20 seconds. If not specified, the default value will be used.



This determines when an Event from this LAM should be acknowledged by the receiving process.
Default: queued_for_processing . If not specified, then default mode will be used.
Possible modes are:
queued_for_processing = Acknowledge Event once it has been added to the Moolet queue.
event_processed = Acknowledge Event once it has been
processed by a Moolet.

Secure Sockets Layer

ssl Boolean

Set to true to enable SSL Communication:

  • path_to_ssl_files: Enter the path of the directory where all the certificates are stored. If the path begins with ‘.’ or ‘/’ then, the path will be used as specified. Otherwise, MOOGSOFT_HOME is prepended to the path. For example, if MOOGSOFT_HOME is /opt/moogsoft/ and path_to_ssl is set to config , then the location will be defined as /opt/moogsoft/confi g.

  • ssl_key_filename : Enter the ssl key filename here e.g. "server.key".

  • ssl_cert_filename : Enter the ssl certificate filename here e.g. "server.pem".
  • ssl_protocols : Only applicable if use_ssl = true. This configuration dictates which SSL protocols are enforced by the OEM LAM; the following protocols are allowed to be specified:
    • SSLv3
    • TLSv1
    • TLSv1.1
    • TLSv1.2

    If SSL is in use and no value is specified for this configuration then only TLSv1.2 is allowed by default.


Config File

            name                          : "OEM Lam Monitor",
            class                         : "COemMonitor",

            port                          : 48002,

            address                       : "localhost",

            use_ssl                       : false,

            path_to_ssl_files             : "config",

 			ssl_key_filename              : "server.key",

 			ssl_cert_filename             : "server.pem",

 			use_client_certificates       : false,
            client_ca_filename            : "ca.crt",

            auth_token                    : "my_secret",

		    #encrypted_auth_token         : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",
            header_auth_token             : "my_secret",

			#encrypted_header_auth_token  : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",

            ssl_protocols                 : 

			authentication_type           : "none",

            authentication_cache          : true,

            accept_all_json               : true,

            lists_contain_multiple_events : false,

            num_threads                   : 5,

            rest_response_mode            : "on_receipt",

            rpc_response_timeout          : 20,
            event_ack_mode                : "queued_for_processing"


Unlike other LAM configuration files, oem_lam.conf only uses JSON, so the mapper is set internally and is not configurable. Other source identification components of the configuration file, such as Regex will not be used.

Agent and Process Log

Agent and Process Log allow you to define the following properties:

  • name : Identifies events the LAM sends to the Message Bus.
  • capture_log : Name and location of the LAM's capture log file. See Moogsoft AIOps Component Logs for more information.
  • configuration_file : Name and location of the LAM's process log configuration file. See Moogsoft AIOps Component Logs for more information.

HA Configuration

Refer to the document HA Configuration


For events received in JSON format, you can directly map the event fields of OEM with Moogsoft fields. The parameters of the received events are displayed in Moogsoft AIOps according to the mapping done here:

mapping :
            catchAll: "overflow",
                { name: "signature", rule:      "host1::oem::cpu" },
                { name: "source_id", rule:      "FQDN" },
                { name: "external_id", rule:    "OEM" },
                { name: "manager", rule:        "OEM" },
                { name: "source", rule:         "Hostname" },
                { name: "class", rule:          "$Description.content"},
                { name: "agent", rule:          "$LamInstanceName"},
                { name: "agent_location", rule: "OEM Data Centre" },
                { name: "type", rule:           "$Priority.content" },
                { name: "severity", rule:       "$Severity.content" },
                { name: "description", rule:    "$Summary.content" },
                { name: "agent_time", rule:     "$moog_now"}
            presend: "OemLam.js"

The above example specifies the mapping of the OEM event fields with the Moogsoft AIOps fields.

To map the sub-field values of a field in an OEM event, the "." operator is used, e.g. " $Summary.content€. Here .content€ is a subfield of the field "Description".

Data not mapped to Moogsoft AIOps Fields goes into "Custom Info".

Constants and Conversions

Constants and Conversions allows you to convert format of the received data.

Severity and sevConverter
has a conversion defined as sevConverter in the Conversions section, this looks up the value of severity defined in the severity section of constants and returns back the mapped integer corresponding to the severity
"CLEAR" : 0,
"WARNING" : 2,
"MINOR" : 3,
"MAJOR" : 4

lookup: "severity",
input: "STRING",
output: "INTEGER"

stringToInt Used in a conversion which forces the system to turn a string token into an integer value.
    input  : "STRING",
    output : "INTEGER"


Example Constants and Conversions
                "CLEAR"         : 0,
                "INDETERMINATE" : 1,
                "WARNING"       : 2,
                "MINOR"         : 3,
                "MAJOR"         : 4,
                "CRITICAL"      : 5
                lookup: "severity",
                input:  "STRING",
                output: "INTEGER"
                input:      "STRING",
                output:     "INTEGER"

Severity Reference

Moogsoft Severity Levels
            "CLEAR" 		: 0,
            "INDETERMINATE" : 1,
            "WARNING" 		: 2,
            "MINOR" 		: 3,
            "MAJOR" 		: 4,
            "CRITICAL" 		: 5,
Level Description
0 Clear
1 Indeterminate
2 Warning
3 Minor
4 Major
5 Critical

Service Operation Reference

Process Name Service Name
oem_lam oemlamd

Start the LAM Service:

service oemlamd start

Stop the LAM Service:

service oemlamd stop

Check the LAM Service status:

service oemlamd status

You can use a GET request to check the status of the OEM LAM. See "Check the LAM Status" in the REST LAM Configuration Guide for further information and examples.

Command Line Reference

To see the available optional attributes of the oem_lam , run the following command:

oem_lam --help

The oem _lam is a command line executable, and has the following optional attributes:

Option Description


Points to a pathname to find the configuration file for the LAM. This is where the entire configuration for the LAM is specified.
--help Displays all the command line options.

Displays the component’s version number.


Specifies the level of debugging. By default, user gets everything. In common with all executables in MOOG, having it set at that level can result in a lot of output (many messages per event message processed).

In all production implementations, it is recommended that log level is set to WARN. This ensures only warning, error and fatal messages are recorded.

Performance Information

Minimum requirement
Component Value
CPU 2 core
Operating System CentOS Linux release 6.7


LAM Version Tool Version Verified by
1.0 OEM version 12c Moogsoft
1.1 OEM version 12c Moogsoft
1.2 OEM version 12c Moogsoft