Configure the Tivoli EIF LAM

The Tivoli EIF LAM allows you to retrieve Tivoli EIF (Event Integration Format) messages and send them to Moogsoft Onprem as events.

There is no UI integration for Tivoli EIF. Follow these instructions to configure the LAM.

Refer to IBM Tivoli Netcool/OMNIbus probes and gateways for further information on Tivoli products that generate EIF messages.

Before You Begin

Before you start to set up your Tivoli EIF LAM, ensure you have met the following requirements:

You know the connection mode. It can be either Server or Client.
You have identified the IP address and port of your Tivoli server.
The port for your Tivoli connection is open and accessible from Moogsoft Onprem.
You know whether your Tivoli server is configured to use UDP or TCP protocol.

If you are configuring the Tivoli EIF LAM for high availability, refer to High Availability Overviewfirst. You will need the details of the server configuration you are going to use for HA.

Configure the LAM

Edit the configuration file to control the behavior of the Tivoli EIF LAM. You can find the file at $MOOGSOFT_HOME/config/tivoli_eif_lam.conf

See the Tivoli EIF LAM Reference and LAM and Integration Reference for a full description of all properties. Some properties in the file are commented out by default. Uncomment properties to enable them.

Configure the connection properties for your Tivoli server:
- mode: Client or Server.
- address: IP address or host name of the Tivoli server.
- port: Port of the Tivoli server.
- protocol_type: TCP or UDP.
Configure the LAM behavior:
- event_ack_mode: When Moogfarmd acknowledges events from the Tivoli EIF LAM during the event processing pipeline.
- num_threads: Number of worker threads to use when processing events.
Optionally configure the LAM identification and capture logging details:
- name: Maps to $Laminstancename, so that the agent field indicates events Moogsoft Onprem ingests from this LAM.
- capture_log: Name and location of the LAM's capture log file, which it writes to for debugging purposes.
Optionally configure severity conversions. See Severity Reference for further information and "Conversion Rules" in Tokenize Source Event Data for details on conversions in general.
Optionally configure the process logging details:
- configuration_file: Name and location of the LAM's process log configuration file. See Configure Logging for more information.Configure Logging

Example

The following example demonstrates a Tivoli EIF LAM configuration.

monitor:
{
    name                    : "ITM EIF LAM",
    class                   : "CSockMonitor",
    mode                    : "SERVER",
    address                 : "216.3.128.12",
    port                    : 8412,
    protocol_type           : "TCP",
    event_ack_mode          : "queued_for_processing",
    num_threads                     : 1
},
agent:
{
    name                    : "EIF_LAM",
    capture_log             : "$MOOGSOFT_HOME/log/data-capture/tivoli_eif_lam.log"
},
log_config:
{
    configuration_file      : "$MOOGSOFT_HOME/config/logging/tivoli_eif_lam_log.json"
},

Configure the Tivoli EIF Utility

The Tivoli EIF LAMbot requires the Tivoli EIF utility in order to work. The utility replaces the standard mapping usually performed in the LAMbot and allows multiple mappings for different event types.

See Configure the Tivoli EIF Utility for details.

Configure for High Availability

Configure the Tivoli EIF LAM for high availability if required. See High Availability Overview for details.

Start and Stop the LAM

Restart the Tivoli EIF LAM to activate any changes you make to the configuration file, utility or LAMbot.

The LAM service name is tivolieiflamd.

See Control Moogsoft Onprem Processes for further details.

In this section: