ibm tivoli monitoring: resource model reference guide - support
TRANSCRIPT
IBM
Tivoli
Monitoring
Resource
Model
Reference
Guide
Version
5.1.1
(Fix
Pack
05,
Revised
October,
2003)
SH19-4570-02
���
IBM
Tivoli
Monitoring
Resource
Model
Reference
Guide
Version
5.1.1
(Fix
Pack
05,
Revised
October,
2003)
SH19-4570-02
���
Note
Before
using
this
information
and
the
product
it
supports,
be
sure
to
read
the
general
information
under
"Notices″
in
the
back
matter
of
this
book.
Fourth
Edition
(October
2003)
This
edition
applies
to
version
5
release
1
modification
level
1
of
IBM®
Tivoli®
Monitoring
and
to
all
subsequent
releases
and
modifications
until
otherwise
indicated
in
new
editions.
This
edition
replaces
SH19-4570-01.
©
Copyright
IBM
Corporation
1999,
2003.
All
rights
reserved.
Note
to
U.S.
Government
Users
Restricted
Rights—Use,
duplication
or
disclosure
restricted
by
GSA
ADP
Schedule
Contract
with
IBM
Corporation.
Contents
Preface
.
.
.
.
.
.
.
.
.
.
.
.
.
. vii
About
this
guide
.
.
.
.
.
.
.
.
.
.
.
. vii
Who
should
read
this
guide
.
.
.
.
.
.
.
.
. vii
Publications
.
.
.
.
.
.
.
.
.
.
.
.
.
. vii
IBM
Tivoli
Monitoring
library
.
.
.
.
.
.
. vii
Prerequisite
publications
.
.
.
.
.
.
.
.
. viii
Related
publications
.
.
.
.
.
.
.
.
.
. viii
Accessing
publications
online
.
.
.
.
.
.
. ix
Ordering
publications
.
.
.
.
.
.
.
.
.
. ix
Accessibility
.
.
.
.
.
.
.
.
.
.
.
.
.
. ix
Contacting
customer
support
.
.
.
.
.
.
.
. ix
Conventions
used
in
this
guide
.
.
.
.
.
.
.
. x
Typeface
conventions
.
.
.
.
.
.
.
.
.
. x
Operating
system-dependent
variables
and
paths
x
Tivoli
command
syntax
.
.
.
.
.
.
.
.
. xi
Chapter
1.
Introduction
.
.
.
.
.
.
.
. 1
What
this
reference
contains
.
.
.
.
.
.
.
.
. 1
Prerequisite
software
for
resource
models
.
.
.
.
. 1
Running
Tivoli
commands
.
.
.
.
.
.
.
.
.
. 3
Running
Tivoli
commands
on
UNIX
operating
systems
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 4
Running
Tivoli
commands
on
Windows
operating
systems
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 4
Where
to
find
additional
information
about
shells
4
Establishing
the
Tivoli
environment
within
a
shell
5
Establishing
the
Tivoli
environment
on
an
endpoint
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 5
Common
parameters
.
.
.
.
.
.
.
.
.
.
. 6
Chapter
2.
Windows
resource
models
.
. 7
Event
Log
resource
model
.
.
.
.
.
.
.
.
.
. 7
Description
.
.
.
.
.
.
.
.
.
.
.
.
.
. 7
Indications
and
events
.
.
.
.
.
.
.
.
.
. 7
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 13
Built-in
actions
.
.
.
.
.
.
.
.
.
.
.
. 13
Logical
Disk
resource
model
.
.
.
.
.
.
.
.
. 15
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 15
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 15
Indications
and
events
.
.
.
.
.
.
.
.
.
. 16
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 24
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 24
Memory
resource
model
.
.
.
.
.
.
.
.
.
. 25
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 25
Indications
and
events
.
.
.
.
.
.
.
.
.
. 26
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 46
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 46
Network
Interface
Card
resource
model
.
.
.
.
. 48
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 48
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 49
Indications
and
events
.
.
.
.
.
.
.
.
.
. 49
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 69
Built-in
actions
.
.
.
.
.
.
.
.
.
.
.
. 70
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 70
Parametric
Event
Log
resource
model
.
.
.
.
. 72
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 72
Indications
and
events
.
.
.
.
.
.
.
.
.
. 72
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 73
Parametric
Services
resource
model
.
.
.
.
.
. 76
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 76
Indications
and
events
.
.
.
.
.
.
.
.
.
. 76
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 79
Built-in
actions
.
.
.
.
.
.
.
.
.
.
.
. 79
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 79
Parametric
TCP/IP
Ports
resource
model
.
.
.
. 80
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 80
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 80
Indications
and
events
.
.
.
.
.
.
.
.
.
. 80
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 81
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 81
Physical
Disk
resource
model
.
.
.
.
.
.
.
. 82
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 82
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 82
Indications
and
events
.
.
.
.
.
.
.
.
.
. 83
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 90
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 90
Printer
resource
model
.
.
.
.
.
.
.
.
.
. 91
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 91
Indications
and
events
.
.
.
.
.
.
.
.
.
. 91
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 99
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 100
Process
resource
model
.
.
.
.
.
.
.
.
.
. 101
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 101
Indications
and
events
.
.
.
.
.
.
.
.
. 102
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 104
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 104
Processor
resource
model
.
.
.
.
.
.
.
.
. 105
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 105
Indications
and
events
.
.
.
.
.
.
.
.
. 105
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 113
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 114
Server
Performance
Prediction
resource
model
.
. 115
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 115
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 115
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 117
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 117
Services
resource
model
.
.
.
.
.
.
.
.
.
. 119
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 119
Indications
and
events
.
.
.
.
.
.
.
.
. 120
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 123
Built-in
actions
.
.
.
.
.
.
.
.
.
.
.
. 124
TCP/IP
resource
model
.
.
.
.
.
.
.
.
.
. 125
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 125
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 125
Indications
and
events
.
.
.
.
.
.
.
.
. 125
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 129
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 129
Chapter
3.
UNIX
and
Linux
resource
models
.
.
.
.
.
.
.
.
.
.
.
.
.
. 131
iii
CPU
resource
model
.
.
.
.
.
.
.
.
.
.
. 131
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 131
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 131
Indications
and
events
.
.
.
.
.
.
.
.
. 131
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 134
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 134
Description
of
the
.mof
file
properties
.
.
.
. 134
File
resource
model
.
.
.
.
.
.
.
.
.
.
. 136
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 136
Indications
and
events
.
.
.
.
.
.
.
.
. 136
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 140
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 140
Description
of
the
.mof
file
properties
.
.
.
. 140
File
System
resource
model
.
.
.
.
.
.
.
.
. 141
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 141
Indications
and
events
.
.
.
.
.
.
.
.
. 141
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 146
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 146
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 146
Description
of
the
.mof
file
properties
.
.
.
. 147
Memory
resource
model
.
.
.
.
.
.
.
.
.
. 148
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 148
Indications
and
events
.
.
.
.
.
.
.
.
. 148
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 152
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 152
Description
of
the
.mof
file
properties
.
.
.
. 152
Network
Interface
resource
model
.
.
.
.
.
. 154
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 154
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 154
Indications
and
events
.
.
.
.
.
.
.
.
. 154
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 161
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 162
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 162
Description
of
the
.mof
file
properties
.
.
.
. 162
Network
RPC-NFS
resource
model
.
.
.
.
.
. 164
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 164
Indications
and
events
.
.
.
.
.
.
.
.
. 164
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 176
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 177
Process
resource
model
.
.
.
.
.
.
.
.
.
. 178
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 178
Indications
and
events
.
.
.
.
.
.
.
.
. 179
Thresholds
.
.
.
.
.
.
.
.
.
.
.
.
. 183
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 183
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 185
Description
of
the
.mof
file
properties
.
.
.
. 185
Security
resource
model
.
.
.
.
.
.
.
.
.
. 187
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 187
Indications
and
events
.
.
.
.
.
.
.
.
. 187
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 194
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 194
Description
of
the
.mof
file
properties
.
.
.
. 194
Server
Performance
Prediction
resource
model
.
. 196
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 196
Prerequisites
.
.
.
.
.
.
.
.
.
.
.
.
. 196
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 197
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 197
Chapter
4.
OS/400
resource
models
199
ASP
Disk
Mirroring
resource
model
.
.
.
.
.
. 199
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 199
Indications
and
events
.
.
.
.
.
.
.
.
. 199
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 201
ASP
Utilization
resource
model
.
.
.
.
.
.
. 202
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 202
Indications
and
events
.
.
.
.
.
.
.
.
. 202
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 205
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 205
Basic
Average
CPU
Utilization
resource
model
.
. 206
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 206
Indications
and
events
.
.
.
.
.
.
.
.
. 206
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 210
Basic
Interactive
CPU
Utilization
resource
model
211
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 211
Indications
and
events
.
.
.
.
.
.
.
.
. 211
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 215
Configuration
Objects
resource
model
.
.
.
.
. 217
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 217
Indications
and
events
.
.
.
.
.
.
.
.
. 217
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 218
Database
CPU
Utilization
resource
model
.
.
.
. 219
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 219
Indications
and
events
.
.
.
.
.
.
.
.
. 219
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 220
Distribution
Queues
resource
model
.
.
.
.
.
. 221
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 221
Indications
and
events
.
.
.
.
.
.
.
.
. 221
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 222
History
Log
resource
model
.
.
.
.
.
.
.
. 223
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 223
Indications
and
events
.
.
.
.
.
.
.
.
. 223
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 224
Interactive
Feature
CPU
Utilization
resource
model
225
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 225
Indications
and
events
.
.
.
.
.
.
.
.
. 225
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 226
Job
Log
resource
model
.
.
.
.
.
.
.
.
.
. 227
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 227
Indications
and
events
.
.
.
.
.
.
.
.
. 227
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 228
Job
Queue
resource
model
.
.
.
.
.
.
.
.
. 230
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 230
Indications
and
events
.
.
.
.
.
.
.
.
. 230
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 232
Job
Status
Events
resource
model
.
.
.
.
.
.
. 233
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 233
Indications
and
events
.
.
.
.
.
.
.
.
. 233
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 234
Management
Central
Events
resource
model
.
.
. 235
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 235
Indications
and
events
.
.
.
.
.
.
.
.
. 235
Network
Attributes
resource
model
.
.
.
.
.
. 238
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 238
Indications
and
events
.
.
.
.
.
.
.
.
. 238
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 239
Output
Queues
resource
model
.
.
.
.
.
.
. 240
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 240
Indications
and
events
.
.
.
.
.
.
.
.
. 240
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 241
Parametric
Object
and
Files
resource
model
.
.
. 242
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 242
Indications
and
events
.
.
.
.
.
.
.
.
. 242
iv
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 244
Storage
Pools
resource
model
.
.
.
.
.
.
.
. 245
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Subsystem
Status
resource
model
.
.
.
.
.
.
. 247
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 247
Indications
and
events
.
.
.
.
.
.
.
.
. 247
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 248
System
Disk
Resources
resource
model
.
.
.
.
. 249
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 249
Indications
and
events
.
.
.
.
.
.
.
.
. 249
Logging
.
.
.
.
.
.
.
.
.
.
.
.
.
. 251
System
Value
resource
model
.
.
.
.
.
.
.
. 252
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 252
Indications
and
events
.
.
.
.
.
.
.
.
. 252
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 253
TCP
Interface
resource
model
.
.
.
.
.
.
.
. 254
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 254
Indications
and
events
.
.
.
.
.
.
.
.
. 254
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 255
TCP
Service
resource
model
.
.
.
.
.
.
.
. 256
Description
.
.
.
.
.
.
.
.
.
.
.
.
. 256
Indications
and
events
.
.
.
.
.
.
.
.
. 256
Parameters
.
.
.
.
.
.
.
.
.
.
.
.
. 257
Appendix
A.
Windows
return
codes
for
built-in
actions
.
.
.
.
.
.
.
.
. 259
All
built-in
actions
.
.
.
.
.
.
.
.
.
.
.
. 259
Built-in
actions
of
the
event
log
resource
model
260
Enlarge
IRP
stack
size
action
.
.
.
.
.
.
. 260
Delete
registry
action
.
.
.
.
.
.
.
.
.
. 260
Raise
session
time
out
action
.
.
.
.
.
.
. 260
Built-in
actions
of
the
network
interface
card
resource
model
.
.
.
.
.
.
.
.
.
.
.
.
. 261
Adjust
initial
work
items
action
.
.
.
.
.
. 261
Adjust
maximum
work
items
action
.
.
.
.
. 261
Built-in
actions
of
the
service
resource
model
.
.
. 262
Restart
service
action
.
.
.
.
.
.
.
.
.
. 262
Appendix
B.
Windows
correlated
events
.
.
.
.
.
.
.
.
.
.
.
.
.
. 263
Busy
drive
from
high
paging
.
.
.
.
.
.
.
. 264
Busy
drive
from
low
avail
.
.
.
.
.
.
.
.
. 265
Congested
TCP
network
.
.
.
.
.
.
.
.
.
. 266
Critically
low
disk
space
.
.
.
.
.
.
.
.
. 267
Critical
memory
leak
.
.
.
.
.
.
.
.
.
.
. 268
Faulty
disk
subsystem
.
.
.
.
.
.
.
.
.
. 269
High
disk
read
bytes
per
second
.
.
.
.
.
.
. 270
High
disk
write
bytes
per
second
.
.
.
.
.
.
. 271
High
drive
transfer
rate
.
.
.
.
.
.
.
.
.
. 272
High
percent
disk
time
.
.
.
.
.
.
.
.
.
. 273
Possible
disk
fragmentation
.
.
.
.
.
.
.
. 274
Process
hogging
CPU
.
.
.
.
.
.
.
.
.
.
. 275
Slow
hard
drive
.
.
.
.
.
.
.
.
.
.
.
. 276
Notices
.
.
.
.
.
.
.
.
.
.
.
.
.
. 277
Trademarks
.
.
.
.
.
.
.
.
.
.
.
.
.
. 279
Glossary
.
.
.
.
.
.
.
.
.
.
.
.
. 281
Index
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 285
Contents
v
vi
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Preface
About
this
guide
The
IBM
Tivoli
Monitoring
product
enables
you
to
monitor
the
availability
and
performance
status
of
your
system
resources
to
identify
bottlenecks
and
potential
resource
problems.
The
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
provides
key
information
about
the
resource
models
included
in
this
product.
Note:
The
IBM
Tivoli
Monitoring
product
was
formerly
known
as
Tivoli
Distributed
Monitoring
(Advanced
Edition).
Who
should
read
this
guide
The
target
audience
for
this
guide
is
system
administrators
responsible
for
the
installation
of
Tivoli
products
and
patches,
system
managers,
and
database
administrators
who
use
Tivoli
products
to
manage
resources.
Users
of
this
guide
should
be
familiar
with
the
following
topics:
v
Tivoli
management
software
v
System
administration
on
systems
where
you
plan
to
install
Tivoli
Monitoring
components,
and
systems
that
you
plan
to
monitor
using
the
product
v
UNIX®
operating
systems
v
Windows®
operating
systems
v
z/OS®
operating
systems
v
Tivoli
Enterprise™
Data
Warehouse
v
IBM
Tivoli
Enterprise
Console®
v
IBM
Tivoli
Business
Systems
Manager
(optional)
Publications
This
section
lists
publications
in
the
IBM
Tivoli®
Monitoring
library
and
other
related
documents.
It
also
describes
how
to
access
Tivoli
publications
online,
how
to
order
Tivoli
publications,
and
how
to
make
comments
on
Tivoli
publications.
IBM
Tivoli
Monitoring
library
The
following
documents
are
available
in
the
IBM
Tivoli
Monitoring
library:
v
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide,
SH19-4570
Provides
information
about
using
and
customizing
IBM
Tivoli
Monitoring
resource
models.
v
IBM
Tivoli
Monitoring:
User’s
Guide,
SH19-4569
Describes
how
to
install,
customize,
and
use
IBM
Tivoli
Monitoring
to
manage
system
and
application
resources.
v
IBM
Tivoli
Monitoring:
Resource
Model
Builder
User’s
Guide,
SH32-1391
Describes
how
to
use
the
IBM
Tivoli
Monitoring
Resource
Model
Rule
Builder
to
create
new
resource
models
or
to
modify
existing
ones.
v
IBM
Tivoli
Monitoring:
Release
Notes,
GI10-5793
Provides
the
most
current
information
about
IBM
Tivoli
Monitoring.
vii
v
IBM
Tivoli
Monitoring:
Road
Map
for
a
Typical
Installation,
GI11-0938
Describes
typical
installation
scenarios.
v
IBM
Tivoli
Monitoring:
Deployment
Supplement,
SC23-4799
Describes
how
to
use
the
deployment
wizard
for
a
custom
installation.
Prerequisite
publications
To
use
the
information
in
this
guide
effectively,
you
must
have
some
prerequisite
knowledge,
which
you
can
get
from
the
following
guides:
v
Tivoli
Management
Framework:
User’s
Guide
Provides
the
concepts
and
procedures
for
using
Tivoli
Management
Framework
services.
v
Tivoli
Management
Framework:
Planning
for
Deployment
Guide
Provides
information
about
the
architecture
provided
by
Tivoli
Management
Framework
and
the
choices
to
consider
when
planning
the
deployment
of
aTivoli
environment.
v
Tivoli
Management
Framework:
Reference
Manual
Provides
detailed
information
about
Tivoli
Management
Framework
commands,
writing
scripts
that
are
later
run
as
Tivoli
tasks,
and
Tivoli-provided
tasks.
Related
publications
The
following
documents
also
provide
useful
information:
v
Tivoli
Software
Installation
Service:
User’s
Guide
Provides
task-oriented
information
on
how
to
import,
manage,
and
install
Tivoli
Management
Environment®
software
on
selected
machines
and
managed
nodes
within
your
Tivoli
management
region.
v
Tivoli
Software
Installation
Service:
Release
Notes
Provides
important
information
about
using
and
installing
the
Tivoli
Software
Installation
Service
(SIS).
v
IBM
Tivoli
Enterprise
Console:
Rule
Builder’s
Guide
Provides
information
about
using
the
IBM
Tivoli
Enterprise
Console
rule
editor
and
graphical
rule
builder
to
modify
existing
rules
and
create
new
rules
to
match
your
specific
event
management
needs.
v
IBM
Tivoli
Enterprise
Console:
Release
Notes,
Version
3.7
or
later
Provides
the
most
current
information
about
IBM
Tivoli
Enterprise
Console.
v
Tivoli
Business
Systems
Management:
Distributed
User’s
Guide,
Version
1.5
(if
you
intend
to
use
Tivoli
Business
Systems
Manager
to
monitor
IBM
Tivoli
Monitoring
events)
Describes
how
to
use
the
Tivoli
Business
Systems
Manager
product.
v
Tivoli
Business
Systems
Management:
Console
User’s
Guide,
Version
1.5
(if
you
intend
to
use
Tivoli
Business
Systems
Manager
to
monitor
IBM
Tivoli
Monitoring
events)
Describes
how
to
use
the
Tivoli
Business
Systems
Manager
console.
The
Tivoli
Software
Glossary
includes
definitions
for
many
of
the
technical
terms
related
to
Tivoli
software.
The
Tivoli
Software
Glossary
is
available,
in
English
only,
at
the
following
Web
site:
http://publib.boulder.ibm.com/tividd/glossary/termsmst04.htm
viii
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Accessing
publications
online
The
documentation
CD
contains
the
publications
that
are
in
the
product
library.
The
format
of
the
publications
is
PDF,
HTML,
or
both.
Refer
to
the
readme
file
on
the
CD
for
instructions
on
how
to
access
the
documentation.
IBM
posts
publications
for
this
and
all
other
Tivoli
products,
as
they
become
available
and
whenever
they
are
updated,
to
the
Tivoli
software
information
center
Web
site.
Access
the
Tivoli
software
information
center
by
first
going
to
the
Tivoli
software
library
at
the
following
Web
address:
http://www.ibm.com/software/tivoli/library
Scroll
down
and
click
the
Product
manuals
link.
In
the
Tivoli
Technical
Product
Documents
Alphabetical
Listing
window,
click
IBM
Tivoli
Monitoring
to
access
all
of
the
IBM
Tivoli
Monitoring
product
manuals.
Note:
If
you
documents
on
other
than
letter-sized
paper,
set
the
option
in
the
File
—>
window
that
allows
Adobe
Reader
to
letter-sized
pages
on
your
local
paper.
The
IBM
Software
Support
Web
site
provides
the
latest
information
about
known
product
limitations
and
workarounds
for
your
product.
You
can
view
this
information
at
the
following
Web
site:
http://www-3.ibm.com/software/support
Ordering
publications
You
can
order
many
Tivoli
publications
online
at
the
following
Web
site:
http://www.elink.ibmlink.ibm.com/public/applications/publications/
cgibin/pbi.cgi
You
can
also
order
by
telephone
by
calling
one
of
these
numbers:
v
In
the
United
States:
800-879-2755
v
In
Canada:
800-426-4968
v
In
other
countries,
for
a
list
of
telephone
numbers,
see
the
following
Web
site:
http://www-3.ibm.com/software/tivoli/order-lit/
Accessibility
Accessibility
features
help
users
with
a
physical
disability,
such
as
restricted
mobility
or
limited
vision,
to
use
software
products
successfully.
With
this
product,
you
can
use
assistive
technologies
to
hear
and
navigate
the
interface.
You
can
also
use
the
keyboard
instead
of
the
mouse
to
operate
most
features
of
the
graphical
user
interface.
For
additional
information,
see
the
Accessibility
Appendix
in
the
user’s
guide
for
this
product.
Contacting
customer
support
If
you
have
a
problem
with
any
Tivoli
product,
see
the
following
IBM
Software
Support
Web
site:
http://www-3.ibm.com/software/sysmgmt/products/support/
Preface
ix
If
you
want
to
contact
software
support,
see
the
IBM
Software
Support
Guide
at
the
following
Web
site:
http://techsupport.services.ibm.com/guides/handbook.html
The
guide
provides
information
about
how
to
contact
IBM
Software
Support,
depending
on
the
severity
of
your
problem,
and
the
following
information:
v
Registration
and
eligibility
v
Telephone
numbers,
depending
on
the
country
in
which
you
are
located
v
Information
you
must
have
before
contacting
IBM
customer
support
Conventions
used
in
this
guide
This
guide
uses
several
conventions
for
special
terms
and
actions,
and
operating
system-dependent
commands
and
paths.
Typeface
conventions
This
guide
uses
the
following
typeface
conventions:
Bold
v
Lowercase
commands
and
mixed
case
commands
that
are
otherwise
difficult
to
distinguish
from
surrounding
text
v
Interface
controls
(check
boxes,
push
buttons,
radio
buttons,
spin
buttons,
fields,
folders,
icons,
list
boxes,
items
inside
list
boxes,
multicolumn
lists,
containers,
menu
choices,
menu
names,
tabs,
property
sheets)
and
labels
(such
as
Tip:,
and
Operating
system
considerations:)
v
Keywords
and
parameters
in
text
Italic
v
Words
defined
in
text
v
Emphasis
of
words
(words
as
words)
v
New
terms
in
text
(except
in
a
definition
list)
v
Variables
and
values
you
must
provide
Monospace
v
Examples
and
code
examples
v
File
names,
programming
keywords,
and
other
elements
that
are
difficult
to
distinguish
from
surrounding
text
v
Message
text
and
prompts
addressed
to
the
user
v
Text
that
the
user
must
type
v
Values
for
arguments
or
command
options
Operating
system-dependent
variables
and
paths
The
publications
in
this
library
use
the
UNIX
convention
for
specifying
environment
variables
and
for
directory
notation.
When
using
the
Windows
command
line,
replace
$variable
with
%variable%
for
environment
variables
and
replace
each
forward
slash
(/)
with
a
backslash
(\)
in
directory
paths.
The
names
of
environment
variables
are
not
always
the
same
in
Windows
and
UNIX.
x
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Note:
If
you
are
using
the
bash
shell
on
a
Windows
system,
you
can
use
the
UNIX
conventions.
Tivoli
command
syntax
The
following
special
characters
define
Tivoli
command
syntax:
[
]
Identifies
elements
that
are
optional.
Required
elements
do
not
have
brackets
around
them.
...
Indicates
that
you
can
specify
multiple
values
for
the
previous
element.
Separate
multiple
values
by
a
space,
unless
otherwise
directed
by
command
information.
If
the
ellipsis
for
an
element
follows
a
closing
bracket,
use
the
syntax
within
the
brackets
to
specify
multiple
values.
For
example,
to
specify
two
administrators
for
the
option
[–a
admin]...,
use
–a
admin1
–a
admin2.
If
the
ellipsis
for
an
element
is
within
the
brackets,
use
the
syntax
of
the
last
element
to
specify
multiple
values.
For
example,
to
specify
two
hosts
for
the
option
[–h
host...],
use
–h
host1
host2.
|
Indicates
mutually
exclusive
information.
You
can
use
the
element
on
either
the
left
or
right
of
the
vertical
bar.
{
}
Delimits
a
set
of
mutually
exclusive
elements
when
a
command
requires
one
of
them.
Brackets
([
])
are
around
elements
that
are
optional.
In
addition
to
the
special
characters,
Tivoli
command
syntax
uses
the
typeface
conventions
described
in
the
Preface
of
this
document.
The
following
examples
illustrate
the
typeface
conventions
used
in
Tivoli
command
syntax:
v
wcrtpr
[–a
admin]...
[–s
region]
[–m
resource]...
name
The
name
argument
is
the
only
required
element
for
the
wcrtpr
command.
The
brackets
around
the
options
indicate
they
are
optional.
The
ellipsis
after
the
–a
admin
resource
option
means
that
you
can
specify
multiple
administrators
multiple
times.
The
ellipsis
after
the
–m
resource
option
means
that
you
can
specify
multiple
resources
multiple
times.v
wchkdb
[–o
outfile]
[–u]
[–x]
{–f
infile
|
–i
|
object...}
The
–f,
–i,
and
object
elements
are
mutually
exclusive.
Braces
that
surround
elements
indicate
that
you
are
including
a
required
element.
If
you
specify
the
object
argument,
you
can
specify
more
than
one
object.
Preface
xi
xii
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Chapter
1.
Introduction
This
book
is
a
reference
guide
designed
for
use
with
the
procedures
described
in
the
IBM
Tivoli
Monitoring:
User’s
Guide.
It
provides
alphabetical
listings
and
detailed
descriptions
of
the
following
software
functions:
v
Resource
models
v
Tasks
v
Server
commands
What
this
reference
contains
This
reference
contains
the
following
chapters
and
appendixes:
v
Chapter
1,
“Introduction”
provides
an
overview
of
the
installation
and
setup
of
IBM
Tivoli
Monitoring.
v
Chapter
2,
“Windows
resource
models,”
on
page
7
provides
an
alphabetical
listing
of
each
Windows
resource
model
with
a
detailed
description
of
the
resource
model.
v
Chapter
3,
“UNIX
and
Linux
resource
models,”
on
page
131
provides
an
alphabetical
listing
of
each
UNIX
and
Linux
resource
model
with
a
detailed
description
of
the
resource
model.
v
Chapter
4,
“OS/400
resource
models,”
on
page
199
provides
an
alphabetical
listing
of
each
OS/400
resource
model
with
a
detailed
description
of
the
resource
model.
v
Appendix
A,
“Windows
return
codes
for
built-in
actions,”
on
page
259
lists
return
codes
for
the
Windows®
resource
models
that
have
built-in
actions.
v
Appendix
B,
“Windows
correlated
events,”
on
page
263
describes
correlated
events
and
the
indications
from
which
each
event
is
generated.
Prerequisite
software
for
resource
models
Information
about
prerequisite
software
required
to
run
IBM
Tivoli
Monitoring
resource
models
is
provided
in
the
individual
sections
for
each
resource
model.
The
following
tables
list
all
resource
models,
by
operating
system,
that
require
additional
steps
or
software
to
run
the
resource
model.
The
following
table
lists
the
resource
models
for
Windows
operating
systems
and
where
to
locate
prerequisite
information
required
to
run
the
resource
model.
Table
1.
Prerequisites
for
Windows
resource
models
Windows
resource
model
name
Location
of
prerequisite
information
Event
Log
None
required.
Logical
Disk
“Prerequisites”
on
page
15.
Memory
None
required.
Network
Interface
Card
“Prerequisites”
on
page
49.
Parametric
Event
Log
None
required.
Parametric
Services
None
required.
Parametric
TCP/IP
Ports
“Prerequisites”
on
page
80.
1
Table
1.
Prerequisites
for
Windows
resource
models
(continued)
Windows
resource
model
name
Location
of
prerequisite
information
Physical
Disk
“Prerequisites”
on
page
82.
Printer
None
required.
Process
None
required.
Processor
None
required.
Server
Performance
Prediction
“Prerequisites”
on
page
115.
Services
None
required.
TCP/IP
“Prerequisites”
on
page
125.
The
following
table
lists
the
resource
models
for
UNIX
and
Linux
operating
systems
and
where
to
locate
prerequisite
information
required
to
run
the
resource
model.
Table
2.
Prerequisites
for
UNIX
and
Linux
resource
models
UNIX
and
Linux
resource
model
name
Location
of
prerequisite
information
CPU
“Prerequisites”
on
page
131.
File
None
required.
File
System
None
required.
Memory
None
required.
Network
Interface
“Prerequisites”
on
page
154.
Network
RPC-NFS
None
required.
Process
None
required.
Security
None
required.
Server
Performance
Prediction
“Prerequisites”
on
page
196.
The
following
table
lists
the
resource
models
for
OS/400
operating
systems
and
where
to
locate
prerequisite
information
required
to
run
the
resource
model.
Table
3.
Prerequisites
for
OS/400
resource
models
OS/400
resource
model
name
Location
of
prerequisite
information
ASP
Disk
Mirroring
None
required.
ASP
Utilization
None
required.
Basic
Average
CPU
Utilization
None
required.
Basic
Interactive
CPU
Utilization
None
required.
Configuration
Objects
None
required.
Database
CPU
Utilization
None
required.
Distribution
Queues
None
required.
History
Log
None
required.
Interactive
Feature
CPU
Utilization
None
required.
Job
Log
None
required.
Job
Queue
None
required.
Job
Status
Events
None
required.
Management
Central
Events
None
required.
2
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Table
3.
Prerequisites
for
OS/400
resource
models
(continued)
OS/400
resource
model
name
Location
of
prerequisite
information
Network
Attributes
None
required.
Output
Queues
None
required.
Parametric
Object
and
Files
None
required.
Storage
Pools
None
required.
Subsystem
Status
None
required.
System
Disk
Resources
None
required.
System
Value
None
required.
TCP
Interface
None
required.
TCP
Service
None
required.
Running
Tivoli
commands
You
can
perform
system
operations
from
a
UNIX
or
Windows
command
line
interface
(CLI)
in
addition
to
using
the
Tivoli
desktop.
Operations
that
you
run
from
the
command
line
are
referred
to
as
CLI
commands.
Consider
using
the
command
line
interface
rather
than
the
graphical
user
interface
to
invoke
a
Tivoli
management
application
operation
in
the
following
circumstances:
v
You
do
not
have
access
to
a
graphical
user
interface,
such
as
when
you
dial
in
over
a
modem.
v
You
want
to
group
a
number
of
operations
together
inside
a
shell
script.
v
You
want
to
use
accessibility
tools
that
require
text-based
input
of
commands.
Most
Tivoli
CLI
commands
begin
with
the
letter
w
to
identify
them
as
Tivoli
commands.
Command
names
use
a
w+verb+object
syntax.
Example:
Use
the
wdmrm
command
to
add
or
remove
a
resource
model.
Most
Tivoli
commands
run
within
a
bash
shell
on
a
managed
node
or
on
a
Tivoli
management
region
server.
A
shell
is
a
command
interpreter
that
enables
the
operating
system
to
process
commands.
You
can
run
commands
from
a
shell
command
line
or
include
them
in
shell
scripts
on
UNIX
or
Windows
operating
systems.
A
Tivoli
management
region
server
is
a
Tivoli
server
and
the
set
of
clients
that
it
serves.
A
Tivoli
management
region
addresses
the
physical
connectivity
of
resources
whereas
a
policy
region
addresses
the
logical
organization
of
resources.
Before
running
Tivoli
commands,
you
must
set
the
Tivoli
environment
variables
for
the
shell.
The
managed
node
or
Tivoli
management
region
server
installation
process
supplies
the
scripts
to
set
the
Tivoli
environment
variables.
The
following
sections
of
this
guide
contain
descriptions
of
the
procedures
to
run
these
scripts:
“Setting
the
Tivoli
environment
on
UNIX
operating
systems”
on
page
5
and
“Setting
the
Tivoli
environment
on
Windows
operating
systems”
on
page
5.
You
must
also
have
the
appropriate
Tivoli
authorization
role
for
running
each
command.
Refer
to
the
reference
information
for
each
command
to
see
the
required
authorization
role.
Chapter
1.
Introduction
3
Note:
Some
Tivoli
commands
can
run
on
an
endpoint.
To
set
the
Tivoli
environment
variables
on
an
endpoint,
see
“Establishing
the
Tivoli
environment
on
an
endpoint”
on
page
5.
Running
Tivoli
commands
on
UNIX
operating
systems
The
UNIX
operating
systems
contain
shells.
Tivoli
commands
can
run
in
the
Bourne,
Korn,
C,
and
bash
shells.
The
Bourne
shell
is
the
standard
UNIX
shell.
Every
UNIX
system
includes
the
Bourne
shell.
The
Korn
shell
supports
the
features
of
the
Bourne
shell
and
contains
extensions
applicable
only
to
the
Korn
shell.
The
C
shell
name
comes
from
the
C
programming
language
syntax.
The
bash
shell
supports
many
features
of
the
UNIX
shells.
Both
UNIX
and
Windows
systems
use
the
bash
shell.
Running
Tivoli
commands
on
Windows
operating
systems
When
you
install
a
Windows
managed
node
or
Windows
Tivoli
management
region
server,
the
installation
process
copies
the
bash
shell
executable
file
to
the
machine.
The
bash
shell
supports
many
UNIX
commands
and
UNIX
command
syntax.
An
example
is
the
forward
slash
(/)
for
the
directory
separator.
The
bash
shell
supports
the
features
of
the
Bourne
shell,
as
well
as
contains
extensions
applicable
only
to
the
bash
shell.
Note:
You
can
use
the
Windows
MS-DOS
shell
instead
of
the
bash
shell
to
run
most
Tivoli
commands
(after
you
set
the
Tivoli
environment
variables
with
the
%SystemRoot%\system32\drivers\etc\Tivoli\setup_env
command).
However,
some
commands
and
Tivoli
tasks
require
a
bash
shell
to
run
successfully.
All
examples
of
Tivoli
commands
in
Tivoli
publications
use
bash
shell
syntax.
Where
to
find
additional
information
about
shells
The
following
lists
include
resources
where
you
can
find
additional
information
about
the
various
shells.
These
resources
were
available
at
the
time
the
lists
were
created.
The
lists
do
not
show
all
of
the
material
that
is
available,
and
Tivoli
does
not
provide
opinions
or
recommendations
about
any
of
these
resources.
UNIX
shells:
v
UNIX
in
a
Nutshell:
A
Desktop
Quick
Reference
for
System
V
Release
4
and
Solaris
7
(O’Reilly
Nutshell
handbook)
by
Arnold
Robbins.
ISBN:
1-56592-427-4.
v
Portable
Shell
Programming:
An
Extensive
Collection
of
Bourne
Shell
Examples
by
Bruce
Blinn.
ISBN:
0-13-451494-7.
v
Learning
the
Korn
Shell
(O’Reilly
Nutshell
handbook)
by
Bill
Rosenblatt
and
Mike
Loukides.
ISBN:
1-56592-054-6.
v
UNIX
C
Shell
Desk
Reference
by
Martin
Arick.
ISBN:
0-47-155680-7.
Bash
shell:
v
Learning
the
bash
Shell
(O’Reilly
Nutshell
handbook)
by
Cameron
Newham
and
Bill
Rosenblatt.
ISBN:
1-56592-347-2.
v
A
Brief
Introduction
to
the
bash
Shell
by
Jane
Anna
Langley.
http://www.cs.ups.edu/acl/unix_talk/bash.html
v
Bash
FAQ
(GNU
documentation).
http://www.delorie.com/gnu/docs/bash/FAQ
v
Bash
Reference
Manual
(GNU
documentation).
http://www.gnu.org/manual/bash/index.html
4
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
v
bash
command
reference
information
(GNU
documentation).
http://www.delorie.com/gnu/docs/bash/bash.1.html
Establishing
the
Tivoli
environment
within
a
shell
When
you
install
a
managed
node
or
Tivoli
management
region
server,
the
installation
process
supplies
shell
setup
scripts.
You
use
these
scripts
to
set
the
environment
variables
needed
for
running
Tivoli
commands.
Setting
the
Tivoli
environment
on
UNIX
operating
systems
The
following
steps
describe
how
to
set
the
Tivoli
environment
within
a
UNIX
shell:
1.
Log
in
to
a
UNIX
managed
node
or
Tivoli
management
region
server.
2.
Run
the
appropriate
setup
script
for
the
shell.
For
the
Bourne,
Korn,
or
bash
shell,
run
the
following
command:
.
/etc/Tivoli/setup_env.sh
For
the
C
shell,
run
the
following
command:
source
/etc/Tivoli/setup_env.csh
Setting
the
Tivoli
environment
on
Windows
operating
systems
The
following
steps
describe
how
to
set
the
Tivoli
environment
and
start
a
bash
shell
on
Windows.
1.
Log
in
to
a
Windows
managed
node
or
Tivoli
management
region
server.
2.
Open
a
command
window.
3.
Run
the
following
command
in
the
command
window
to
set
Tivoli
environment
variables:
%SystemRoot%\system32\drivers\etc\Tivoli\setup_env.cmd
4.
Run
one
of
the
following
commands
in
the
command
window
to
start
the
bash
shell:
sh
—OR—
bash
Establishing
the
Tivoli
environment
on
an
endpoint
When
you
install
an
endpoint,
the
installation
process
supplies
setup
scripts.
Use
these
scripts
to
set
the
environment
variables
required
for
running
Tivoli
commands
on
an
endpoint.
The
following
steps
describe
how
to
set
the
Tivoli
environment
on
an
endpoint:
1.
Log
in
to
an
endpoint.
2.
Open
a
command
window.
3.
Run
the
appropriate
setup
script
in
the
command
window.
The
following
table
contains
setup
scripts
for
the
different
endpoint
operating
systems.
Chapter
1.
Introduction
5
Table
4.
Setup
scripts
for
endpoint
operating
systems
Operating
System
Setup
Script
Location
Setup
Script
Name
AIX,
Solaris
/etc/Tivoli/lcf/endpoint_label
lcf_env.sh
(for
Bourne,
Korn,
and
bash
shells)
—OR—
lcf_env.csh
(for
C
shell)
Windows
%SystemRoot%\Tivoli\lcf\
endpoint_label
lcf_env.cmd
(for
MS-DOS)
or
lcf_env.sh
(for
bash
shell)
Common
parameters
This
section
describes
the
names
used
to
refer
to
Tivoli
endpoints
and
hosts.
For
detailed
information
on
IBM
Tivoli
Monitoring,
see
the
IBM
Tivoli
Monitoring
User’s
Guide.
Endpoint
Name
The
Tivoli
Management
Framework
product
assigns
the
endpoint
label
when
creating
the
endpoint
within
the
Tivoli
environment.
Some
IBM
Tivoli
Monitoring
commands
use
this
label,
but
an
IBM
Tivoli
Monitoring
command
cannot
assign
or
modify
the
label.
This
label
is
usually
a
string,
such
as
Endpoint1.
The
variable
for
this
label
is
EndpointName.
Host
Name
The
host
name
is
the
name
that
is
assigned
to
the
server
within
the
network.
Some
IBM
Tivoli
Monitoring
commands
use
this
name,
but
an
IBM
Tivoli
Monitoring
command
cannot
assign
or
modify
the
name.
The
network
determines
the
format
of
this
name.
The
name
can
be
a
string,
such
as
acme.sp.dynamite.com,
or
an
IP
address,
such
as
123.123.123.1.
The
variable
for
this
label
is
HostName.
Type
hostname
at
the
command
line
to
determine
the
host
name.
6
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Chapter
2.
Windows
resource
models
This
chapter
describes
resource
models
for
computers
that
run
on
Windows-based
operating
systems.
Event
Log
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Event
Log
resource
model
examines
the
Windows
System
Event
Log
for
events
that
normally
require
immediate
attention,
or
can
be
rectified
with
a
simple
registry
edit.
The
Event
Log
resource
model
highlights
the
following
areas:
v
Client
connectivity
problems
Busy
networks
can
cause
clients
to
time
out.
This
indication
can
be
trapped.
When
it
is,
the
registry
value
that
determines
the
time
out
period
can
be
enlarged.
After
attempting
to
connect
a
few
times
without
success,
the
problem
might
be
related
to
a
faulty
network
card
or
drivers.
v
Detection
of
malfunctioning
devices
Events
9,
11,
and
15
are
the
most
common
events
that
occur
when
a
device
or
driver
is
malfunctioning.
Isolate
and
investigate
the
cause
of
the
errors
as
soon
as
possible.
v
Server
connectivity
problems
Bad
IRPStackSize
and
OEM
installations
of
Windows
are
common
situations
that
prevent
the
server
service
from
operating
correctly.
If
the
server
service
is
not
functioning
properly,
clients
cannot
connect
to
the
affected
machine.
The
following
table
shows
the
key
characteristics
of
the
event
log
resource
model:
Resource
model
at
a
glance
Built-in
actions
Yes
Category
Windows
Clearing
events
No
Default
cycle
time
600
seconds
Internal
name
TMW_EventLog
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Event
Log
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
7
Event
Indication
Severity
Page
TMW_EventID9
Event
ID
9
Warning
8
TMW_EventID11
Event
ID
11
Warning
8
TMWEvent_ID15
Event
ID
15
Warning
9
TMW_EventID2011
Event
ID
2011
Warning
9
TMW_EventID2511
Event
ID
2511
Warning
9
TMW_EventID3013
Event
ID
3013
Warning
11
TMW_EventID7023
Event
ID
7023
Warning
11
Event
ID
9
This
indication
is
sent
when
a
device
or
device
driver
times
out.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
the
threshold
Maximum
Number
Of
Logs)
and
contains
the
event
ID
of
9,
this
indication
is
sent.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Event
ID
11
This
indication
is
sent
when
an
error
is
detected
on
a
device
or
device
controller.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
Of
Logs)
and
contains
the
event
ID
of
11,
this
indication
is
sent.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
8
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Event
ID
15
This
indication
is
sent
when
a
drive
(typically
removable
media,
for
example,
a
CD-ROM)
is
not
ready
for
access
or
is
not
functioning
properly.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
of
Logs)
and
contains
the
event
ID
of
15,
this
indication
is
sent.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Event
ID
2011
This
indication
is
sent
when
the
IRPStackSize
is
too
small.
Event
7023
will
typically
occur
with
this
event.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
of
Logs)
and
contains
the
event
ID
of
2011,
this
indication
is
sent.
For
information
about
built-in
actions,
see
“Built-in
actions”
on
page
13.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Event
ID
2511
This
indication
is
sent
when
a
shared
directory
no
longer
exists.
This
condition
is
only
detected
when
the
Windows
operating
system
is
started.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
of
Logs)
and
contains
the
event
ID
of
2511,
this
indication
is
sent.
Chapter
2.
Windows
resource
models
9
For
information
about
built-in
actions,
see
“Built-in
actions”
on
page
13.
10
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Warning
Event
ID
3013
This
indication
is
sent
when
the
redirector,
or
workstation
service,
times
out.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
of
Logs)
with
the
event
ID
of
3013,
this
indication
is
sent.
For
information
about
built-in
actions,
see
“Built-in
actions”
on
page
13.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Event
ID
7023
This
indication
is
sent
when
there
is
not
enough
server
storage
space.
When
this
behavior
occurs
by
itself,
the
problem
is
usually
related
to
OEM
installations
of
either
Windows
or
Windows
service
packs.
Microsoft®
Knowledge
Base
article
Q151427
details
this
event.
The
solution
is
usually
to
reinstall
the
latest
service
pack.
See
“Indication
properties”
on
page
13
for
information
on
the
properties
for
this
event.
No
threshold
is
exceeded
to
generate
this
indication.
If
an
event
in
the
event
log
is
within
the
first
set
of
events
(determined
by
Maximum
Number
of
Logs)
with
the
event
ID
of
7023,
this
indication
is
sent.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Chapter
2.
Windows
resource
models
11
Setting
Default
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
12
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Indication
properties
All
the
indications
in
the
Event
Log
resource
model
have
the
following
properties:
ComputerName
The
name
of
the
computer
where
the
event
occurred.
ComputerName
is
a
key
attribute.
EvtID
Identifies
the
event
by
number.
EvtID
is
a
key
attribute.
Logfile
The
name
of
the
log
file
in
which
the
event
was
generated
(for
example,
system,
security,
or
application)
Message
The
message
text
of
the
event
RepeatCount
Number
of
Event
ID
events
received
in
a
cycle
SourceName
The
source
of
the
event.
SourceName
is
a
key
attribute.
TimeGenerated
The
time
the
event
was
generated
TimeWritten
The
time
the
event
was
written
to
the
event
log
Note:
Some
attributes
are
denoted
as
key
attributes.
Key
attributes
to
allow
you
to
distinguish
one
attribute
from
another
when
there
is
more
than
one
instance
of
an
indication.
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Event
Log
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Maximum
Number
of
Logs
(MostNumberOfLogs)
This
threshold
is
the
maximum
number
of
newest
events
in
the
event
log
that
is
examined.
100
Built-in
actions
This
resource
model
contains
the
following
built-in
actions:
Indication
Built-in
actions
Event
ID
2011
1.
Notifies
the
system
administrator
that
the
IRPStackSize
is
too
small.
2.
Edits
the
registry
key
Computer
Name\HKEY_LOCAL_MACHINE\SYSTEMS\CurrentControlSet\
Services\LanmanServer\Parameters\IRPStackSize.
3.
Sets
the
value
to
0xCh
(decimal
value
12).
Note:
The
system
must
be
rebooted
for
this
change
to
take
effect.
For
additional
information,
see
“Event
ID
2011”
on
page
9.
Chapter
2.
Windows
resource
models
13
Indication
Built-in
actions
Event
ID
2511
1.
Notifies
the
system
administrator
that
a
shared
directory
no
longer
exists.
2.
Edits
the
registry
key
Computer
Name\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Shares.
3.
Deletes
the
key
that
represents
the
sharename.
Note:
The
system
must
be
rebooted
for
this
change
to
take
effect.
For
additional
information,
see
“Event
ID
2511”
on
page
9.
Event
ID
3013
1.
Notifies
the
system
administrator
that
the
redirector,
or
workstation
service,
is
timing
out.
2.
Edits
the
registry
key
Computer
Name\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Parameters\SessTimeOut
to
a
higher
value.
When
the
value
is
not
present,
the
default
value
is
0x2Dh
(decimal
value
45)
seconds.
Corrective
actions
consist
of
raising
this
value
by
an
increment
of
0xAh
(decimal
value
10).
Note:
The
system
must
be
rebooted
for
this
change
to
take
effect.
After
three
attempts,
user
intervention
is
required.
The
system
administrator
can
examine
the
network
subsystem
and
reinstall
or
repair
network
drivers
or
devices.
For
additional
information,
see
“Event
ID
3013”
on
page
11.
14
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Logical
Disk
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Logical
Disk
resource
model
detects
bottlenecks
associated
with
all
logical
disks,
such
as
C:,
that
are
configured
on
your
systems.
The
Logical
Disk
resource
model
highlights
the
following
areas:
v
Excessive
Disk
Usage
The
percentage
of
used
disk
needs
to
be
altered
when
monitoring
file
servers
for
bottlenecks.
File
servers,
servers,
and
servers
use
a
high
percentage
of
disk
space.
However,
workstations
typically
use
a
high
percentage
of
disk
space
in
short
bursts.
When
disk
usage
is
significantly
increased,
performance
in
processor
speed
and
general
system
response
decline.
v
High
Transfer
Rate
This
indicates
the
raw
amount
of
data
that
is
transferred
through
the
disk.
The
maximum
transfer
rate
that
a
disk
subsystem
can
handle
depends
on
the
type
of
hard
drive,
the
type
of
controller,
the
drive
configuration,
and,
in
the
case
of
most
IDE-based
hard
drives,
the
speed
of
the
processor.
v
Low
Disk
Space
Low
disk
space
makes
it
impossible
to
reboot
a
Windows
machine.
The
threshold
value
is
based
on
the
percentage
of
free
space
on
the
disk.
Administrators
monitoring
systems
with
disks
of
less
than
one
gigabyte
should
raise
this
value.
A
good
guideline
is
to
keep
enough
free
disk
space
to
allow
the
pagefile
to
reach
its
maximum
size
limit.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
TMW_LogicalDisk
Parameters
No
Thresholds
Yes
Prerequisites
The
Logical
Disk
resource
model
requires
disk
counters
to
be
enabled
on
Windows-based
operating
systems.
To
enable
disk
counters,
perform
the
following
steps
on
each
Windows-based
operating
system:
1.
On
Windows
NT
systems,
issue
the
diskperf
–y
command.
On
systems
running
Windows
2000,
Windows
XP,
and
Windows
Server
2003,
issue
the
diskperf
–yv
command.
Chapter
2.
Windows
resource
models
15
2.
Reboot
the
system.
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Logical
Disk
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_HighLogicalDiskReadBytesSec
High
Read
Bytes
per
Second
Minor
18
TMW_HighLogicalDiskWriteBytesSec
High
Write
Bytes
per
Second
Minor
20
TMW_HighLogicalDiskXferRate
High
Transfer
Rate
Minor
19
TMW_HighLogicalPercentDiskTime
High
Percentage
Disk
Time
Warning
17
TMW_LogicalPossibleFrag
Logical
Disk
Possible
Fragmentation
Minor
21
TMW_LowLogicalDiskSpace
Low
Disk
Space
Warning
22
TMW_SlowLogicalDrive
Slow
Logical
Drive
Warning
23
16
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Percentage
Disk
Time
This
indication
is
sent
when
the
drive
is
spending
too
much
time
processing
small
data
segments.
Possible
causes
are
bad
cluster
size,
fragmentation,
or
bad
cache
settings.
The
indication
contains
the
following
attributes:
LogicalDisk
The
logical
disk
that
is
analyzed.
LogicalDisk
is
a
key
attribute.
PercentDiskTime
The
percentage
of
time
that
the
logical
drive
is
used
PercentReadTime
The
percentage
of
time
that
the
logical
drive
is
used
for
read
operations
PercentWriteTime
The
percentage
of
time
that
the
logical
drive
is
used
for
write
operations
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
is
busy
servicing
read
or
write
requests
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
17
High
Read
Bytes
per
Second
This
indication
is
sent
when
a
logical
disk
is
reading
an
excessive
amount
of
data
per
second.
The
indication
contains
the
following
attributes:
DiskReadBytesSec
The
number
of
bytes
read
per
second
on
the
logical
disk
DiskReadSec
The
number
of
transactions
that
are
read
per
second
on
the
logical
disk
LogicalDisk
The
logical
disk
that
is
analyzed.
LogicalDisk
is
a
key
attribute.
PercentDiskRead
The
percentage
of
the
logical
drive
used
to
read
data
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
maximum
number
of
bytes
read
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
write
requests
must
exceed
this
threshold.
90
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Events
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
18
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Transfer
Rate
This
indication
is
sent
when
a
logical
disk
is
reading
and
writing
an
excessive
amount
of
data.
The
indication
contains
the
following
attributes:
DiskReadsSec
The
rate
of
bytes
read
per
second
on
the
logical
disk
DiskWritesSec
The
rate
of
bytes
written
per
second
on
the
logical
disk
DiskXfersSec
The
rate
of
bytes
read
or
written
per
second
on
the
logical
disk
LogicalDisk
The
logical
disk
that
is
analyzed.
LogicalDisk
is
a
key
attribute.
PercentDiskReadTime
The
percentage
of
the
logical
drive
used
for
read
operations
PercentDiskWriteTime
The
percentage
of
the
logical
drive
used
for
write
operations
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
Number
of
bytes
read
or
written
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
is
busy
servicing
read
and
write
requests
must
exceed
this
threshold.
90
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
19
High
Write
Bytes
per
Second
This
indication
is
sent
when
a
logical
disk
is
writing
an
excessive
amount
of
data
per
second.
The
indication
contains
the
following
attributes:
DiskWriteBytesSec
The
number
of
bytes
written
per
second
on
the
logical
disk
DiskWriteSec
The
number
of
transactions
that
are
written
per
second
on
the
logical
disk
PercentDiskWrite
The
percent
of
the
logical
drive
used
during
write
operations.
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
LogicalDisk
The
logical
disk
that
is
analyzed.
LogicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
maximum
number
of
bytes
written
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
is
busy
servicing
write
requests
must
exceed
this
threshold.
90
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
20
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Logical
Disk
Possible
Fragmentation
This
indication
is
sent
when
a
disk
might
be
excessively
fragmented.
Excessive
fragmentation
occurs
when
a
high
percentage
of
the
logical
disk
is
used,
the
queue
length
is
not
long,
and
read
and
write
transfer
rates
are
not
high.
The
indication
contains
the
following
attributes:
DiskBytesSec
The
number
of
bytes
read
or
written
per
second.
LogicalDisk
The
logical
disk.
LogicalDisk
is
a
key
attribute.
PercentDiskTime
The
percentage
of
time
that
the
logical
drive
is
used
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
not
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
is
busy
servicing
read
or
write
requests
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
not
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
21
Low
Disk
Space
This
indication
is
sent
when
a
logical
drive
contains
very
little
free
space.
It
indicates
that
disk
space
is
dangerously
low
and
action
must
be
taken
to
free
space.
The
indication
contains
the
following
attributes:
FreeMB
The
actual
size
of
free
space
on
the
logical
drive
in
megabytes
LogicalDisk
The
logical
disk
analyzed.
LogicalDisk
is
a
key
attribute.
PercentFreeSpace
The
percentage
of
free
space
on
the
logical
drive
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Low
Disk
Space
(LowDiskSpace)
The
percentage
of
free
disk
space
must
be
less
than
or
equal
to
this
threshold.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
5
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
22
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Slow
Logical
Drive
This
indication
is
sent
when
the
logical
disk
is
too
slow
to
keep
up
with
the
work
it
must
perform.
The
indication
contains
the
following
attributes:
AvgQLength
The
average
queue
length
AvgReadQLength
The
average
queue
length
for
read
operations
AvgWriteQLength
The
average
queue
length
for
write
operations
CurrentDiskQLength
The
number
of
jobs
waiting
to
be
processed
by
the
logical
disk
DiskReadBytesSec
The
number
of
bytes
read
per
second
on
the
logical
disk
DiskWriteBytesSec
The
number
of
bytes
read
per
second
on
the
logical
disk
LogicalDisk
The
logical
disk
that
is
analyzed.
LogicalDisk
is
a
key
attribute.
PercentDiskTime
The
percentage
of
time
that
the
logical
disk
is
used
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
exceed
this
threshold.
1
572
864
High
Queue
Length
(HighQLength)
The
number
of
outstanding
requests,
including
those
in
progress,
on
the
disk
must
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
23
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Logical
Disk
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
This
threshold
is
the
maximum
amount
of
bytes
read
or
written
per
second.
The
default
is
based
on
the
average
logical
disk.
1
572
864
High
Percent
Usage
(HighPercentUsage)
This
threshold
is
the
maximum
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
write
requests.
90
High
Queue
Length
(HighQLength)
This
threshold
is
the
maximum
number
of
outstanding
requests
for
the
disk.
It
includes
those
in
progress
at
the
time
of
the
snapshot.
This
is
an
exact
length,
not
an
average
over
the
time
interval.
3
Low
Disk
Space
(LowDiskSpace)
This
threshold
is
the
minimum
percentage
of
free
disk
space
allowed
on
a
logical
disk.
5
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
LogicalDisk
Bytes
Transferred
DiskBytesSec
The
number
of
bytes
read
or
written
per
second
LogicalDisk
The
logical
disk
name
Queue
Length
AvgQLength
The
average
queue
length
for
jobs
LogicalDisk
The
logical
disk
name
Percent
Space
LogicalDisk
The
logical
disk
name
PercentFreeSpace
The
percentage
of
free
space
on
the
logical
disk
Percent
Disk
Usage
LogicalDisk
The
logical
disk
name
PercentDiskTime
The
percentage
of
time
that
the
logical
drive
is
used
24
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Memory
resource
model
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
TMW_MemoryModel
Parameters
No
Thresholds
Yes
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
This
resource
model
detects
bottlenecks
specifically
associated
with
RAM.
Because
most
devices
in
the
system
use
RAM,
bottlenecks
and
problems
will
usually
appear
here.
The
Memory
resource
model
highlights
the
following
areas:
v
Cache
When
cache
is
used,
four
different
areas
are
examined:
–
Copy
reads
–
Data
maps
–
MDL
reads
–
Pin
reads
The
Hit
Percentage
Rate
is
examined
for
each
area.
This
gives
an
idea
of
how
much
data
was
supplied
by
the
cache
and
how
much
was
supplied
from
another
location.
If
cache
is
used,
ideally
it
will
provide
at
least
70%
of
the
data.
A
lower
percentage
indicates
data
is
lost
in
the
cache
or
that
the
cache
is
not
large
enough.
Chapter
2.
Windows
resource
models
25
v
Committed
bytes
Committed
bytes
indicate
the
amount
of
virtual
memory,
in
bytes,
that
have
been
committed.
The
commit
limit
is
the
current
limit
of
physical
space
(either
RAM
or
in
the
pagefile)
that
is
available
for
the
committed
bytes.
If
the
committed
bytes
become
larger
than
the
commit
limit,
the
pagefile
must
be
enlarged.
A
pagefile
that
is
constantly
in
flux
causes
performance
problems
because
the
system
spends
time
extending
or
shrinking
the
pagefile.
This
process
also
involves
the
slowest
part
of
the
system
and
is
prone
to
becoming
a
bottleneck.
The
committed
bytes
has
an
upper
limit.
The
value
is
dictated
by
a
setting
in
the
system
control
applet.
If
the
pagefile
reaches
its
maximum
limit,
it
is
assumed
that
available
memory
will
be
extremely
low.
In
this
situation,
a
major
performance
degradation
can
be
expected.
If
committed
bytes
continues
to
grow
and
there
is
not
enough
available
physical
space
to
hold
the
committed
memory,
a
core
dump
will
probably
occur.
The
initial
size
of
the
pagefile
is
best
determined
by
the
amount
of
RAM
in
the
system.
A
good
guideline
is
150%
of
the
amount
of
RAM.
v
Low
available
memory
Available
memory
is
checked
constantly
to
ensure
it
does
not
drop
below
10
MB.
When
available
memory
is
low,
performance
declines
slightly,
but
the
system
still
works
correctly.
Inform
your
system
administrator
needs
to
know
that
memory
is
low
to
consider
monitoring.
As
available
memory
drops,
the
Windows
operating®system
attempts
to
keep
the
available
memory
above
4
MB.
At
this
point,
memory
is
too
low
and
the
operating
system
spends
more
time
keeping
memory
available
than
processing
requests.
Additionally,
high
paging
begins
to
occur,
and
the
pagefile
reaches
its
maximum
size.
v
Memory
leaks
These
three
different
areas
of
memory
need
to
be
analyzed
for
a
possible
leak:
–
Private
bytes
–
System
code
–
System
drivers
The
top
five
processes
are
examined
in
the
Private
Bytes.
The
total
pools
of
System
Code
and
System
Drivers
are
also
examined
for
growth.
This
generally
indicates
a
memory
leak
in
the
affected
area
of
memory.
v
Paging
and
page
faulting
Page
Faults
occur
when
Windowsmoves
a
piece
of
data
to
another
portion
of
RAM
or
to
the
pagefile.
Paging
moves
data
to
the
hard
drive,
so
it
is
incorporated
in
the
counters
for
Page
Faults.
Page
faults
are
considered
high
when
they
reach
approximately
350
page
faults
per
second.
Paging
is
considered
high
at
approximately
60
pages
per
second.
Performance
declines
because
the
system
moves
data
to
and
from
the
hard
drive,
typically
the
slowest
component
of
the
system.
The
hard
drive
and
processor
become
busier
and
overall
performance
of
the
machine
decreases.
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Memory
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
26
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Event
Indication
Severity
Page
TMW_HighPaging
High
Paging
Warning
28
TMW_LowAvail
Low
Available
Memory
Warning
29
TMW_LowAvailCausingHardPaging
Low
Available
Memory
Causing
Hard
Paging
Warning
31
TMW_LowAvailCausingManyProblems
Low
Available
Memory
Causing
Many
Problems
Critical
32
TMW_LowAvailCausingSoftPagePagefileResize
Low
Available
Memory
Causing
Soft
Paging
and
Pagefile
Resizing
Warning
30
TMW_LowAvailCausingSoftPaging
Low
Available
Memory
Is
Causing
Excessive
Soft
Paging
Warning
30
TMW_LowAvailHighCache
Low
Available
Memory
with
High
Cache
Warning
37
TMW_LowAvailHighWS
Low
Available
Memory
with
High
Working
Set
Warning
34
TMW_LowAvailWithSmallPageFile
Low
Available
Memory
with
a
Small
Pagefile
Warning
36
TMW_LowCopyReadHits
Low
Copy
Read
Hits
Minor
38
TMW_LowDataMapHits
Low
Data
Map
Hits
Minor
39
TMW_LowMDLReadHits
Low
MDL
Read
Hits
Minor
40
TMW_LowPinReadHits
Low
Pin
Read
Hits
Minor
41
TMW_MemoryLeakInPB
Memory
Leak
in
Private
Bytes
Critical
42
TMW_MemoryLeakInSC
Memory
Leak
in
System
Code
Critical
43
TMW_MemoryLeakInSD
Memory
Leak
in
System
Drivers
Critical
44
TMW_PageFileResizing
Pagefile
is
Resizing
Warning
45
Chapter
2.
Windows
resource
models
27
High
Paging
This
indication
is
sent
when
there
is
an
excessive
number
of
pages
read
from
or
written
to
disk
to
resolve
hard
page
faults.
Hard
page
faults
occur
when
a
process
requires
code
or
data
that
is
not
in
its
working
set
or
elsewhere
in
physical
memory
and
must
be
retrieved
from
disk.
A
high
paging
rate
can
cause
system-wide
delays.
The
indication
contains
the
following
attributes:
PagesSec
The
number
of
pages
swapped
per
second
TotalAvail
The
total
of
available
memory
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
TotalCache
The
total
cache
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Excessive
Paging
(ExcessivePaging)
The
number
of
pages
per
second
must
exceed
this
threshold.
60
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
15
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
28
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Available
Memory
This
indication
is
sent
when
the
available
memory
is
low,
but
it
is
not
clear
in
which
area
of
memory
the
problem
is
located.
The
indication
contains
the
following
attributes:
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
be
lower
than
this
threshold.
10
485
760
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Severity
Warning
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Chapter
2.
Windows
resource
models
29
Low
Available
Memory
Causing
Excessive
Soft
Paging
This
indication
is
sent
when
the
available
memory
is
low
and
is
causing
a
large
number
of
page
faults.
The
indication
contains
the
following
attributes:
PageFaultsSec
The
current
value
for
page
faults
per
second
TotalAvail
The
total
of
available
memory
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Excessive
Page
Faults
(ExcessivePageFaults)
The
number
of
page
faults
per
second
must
exceed
this
threshold.
350
Excessive
Paging
(ExcessivePaging)
The
paging
rate
must
not
exceed
this
threshold.
60
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
not
exceed
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
not
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
greater
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
30
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Available
Memory
Causing
Hard
Paging
This
indication
is
sent
when
low
available
memory
causes
too
much
paging
to
the
pagefile.
The
indication
contains
the
following
attributes:
PageFaultsSec
The
current
rate
of
page
faults
per
second
PagesSec
The
current
rate
of
pages
per
second
TotalAvail
The
total
of
available
memory
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Excessive
Page
Faults
(ExcessivePageFaults)
The
number
of
page
faults
per
second
must
exceed
this
threshold.
350
Excessive
Paging
(ExcessivePaging)
The
paging
rate
must
exceed
this
threshold.
60
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
be
lower
than
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
not
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
greater
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
31
Low
Available
Memory
Causing
Many
Problems
This
indication
is
sent
when
multiple
problems
are
caused
by
lack
of
available
memory.
The
indication
contains
the
following
attributes:
CommittedBytes
The
current
total
of
committed
bytes
CommittedLimit
The
upper
limit
of
the
committed
bytes
PageFaultsSec
The
current
rate
of
page
faults
per
second
PagesSec
The
current
rate
of
pages
per
second
TotalAvail
The
total
of
available
memory
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Excessive
Page
Faults
(ExcessivePageFaults)
The
number
of
page
faults
per
second
must
exceed
this
threshold.
350
Excessive
Paging
(ExcessivePaging)
The
paging
rate
must
exceed
this
threshold.
60
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
not
exceed
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
less
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
32
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Available
Memory
Causing
Soft
Paging
and
Pagefile
Resizing
This
indication
is
sent
when
excessive
soft
paging
and
pagefile
resizing
is
caused
by
low
available
memory.
The
indication
contains
the
following
attributes:
CommittedBytes
The
current
total
of
committed
bytes
CommittedLimit
The
upper
limit
of
the
committed
bytes
PageFaultsSec
The
current
rate
of
page
faults
per
second
TotalAvail
The
total
of
available
memory
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Excessive
Paging
(ExcessivePaging)
The
paging
rate
must
not
exceed
this
threshold.
60
ExcessivePageFaults
The
number
of
page
faults
per
second
must
exceed
this
threshold.
350
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
lower
than
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
not
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
less
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
33
Low
Available
Memory
with
a
High
Working
Set
This
indication
is
sent
when
available
memory
is
low
because
a
large
amount
of
memory
is
in
use
by
the
working
set.
This
indication
is
sent
when
the
size
of
the
working
set
is
larger
than
both
the
cache
and
the
available
memory.
The
indication
contains
the
following
attributes:
HighProcess
The
string
name
of
the
process
with
the
highest
working
set
HighProcessIDProcess
The
numeric
ID
of
the
process
with
the
highest
working
set
HighProcessPoolNPBytes
The
pool
non-paged
bytes
of
the
process
with
the
highest
working
set
HighProcessPoolPPBytes
The
pool
paged
bytes
of
the
process
with
the
highest
working
set
HighProcessPrivateBytes
The
private
bytes
of
the
process
with
the
highest
working
set
HighProcessVirtualBytes
The
virtual
bytes
of
the
process
with
the
highest
working
set
HighProcessWorkingSet
The
working
set
of
the
process
with
the
highest
working
set
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalProcesses
The
total
number
of
processes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
not
exceed
this
threshold.
10
485
760
34
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
35
Low
Available
Memory
with
a
Small
Pagefile
This
indication
is
sent
when
available
memory
is
low
and
the
pagefile
is
resized.
The
indication
contains
the
following
attributes:
CommittedBytes
The
current
total
of
committed
bytes
CommittedLimit
The
upper
limit
of
the
committed
bytes
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
be
lower
than
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
less
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
36
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Available
Memory
with
High
Cache
This
indication
is
sent
when
available
memory
is
low
because
a
large
amount
of
memory
used
by
the
cache.
This
indication
is
sent
when
the
size
of
the
cache
is
larger
than
both
the
working
set
and
the
available
memory.
The
indication
contains
the
following
attributes:
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
be
lower
than
this
threshold.
10
485
760
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
37
Low
Copy
Read
Hits
This
indication
is
sent
when
the
percentage
of
copy
read
requests
that
hit
the
cache
is
too
low.
A
copy
read
is
a
file
read
operation
that
is
satisfied
by
a
memory
copy
from
a
page
in
the
cache
to
the
program
buffer.
If
a
copy
read
request
is
not
satisfied
by
the
cache,
a
disk
read
is
required
to
provide
access
to
the
data.
The
indication
contains
the
following
attributes:
AvrgCopyReadHitsPercent
The
percentage
average
of
copy
read
hits
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Low
Cache
Hits
Percent
(LowCacheHitsPercent)
The
percentage
of
copy
read
hits
must
not
exceed
this
threshold.
70
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Severity
Minor
38
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Data
Map
Hits
This
indication
is
sent
when
the
percentage
of
data
map
hits
from
the
file
system
cache
is
too
low.
A
data
map
that
is
not
found
in
the
file
system
cache
requires
a
disk
read
operation
to
retrieve
the
information.
The
indication
contains
the
following
attributes:
AvrgDataMapHitsPercent
The
percentage
average
of
data
map
hits
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Low
Cache
Hits
Percent
(LowCacheHitsPercent)
The
percentage
of
data
map
hits
must
not
exceed
this
threshold.
70
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Severity
Minor
Chapter
2.
Windows
resource
models
39
Low
MDL
Read
Hits
This
indication
is
sent
when
the
percentage
of
Memory
Descriptor
List
(MDL)
hits
from
the
file
system
cache
is
too
low.
A
Memory
Descriptor
List
that
is
not
found
in
the
file
system
cache
requires
a
disk
read
operation
to
retrieve
the
information.
Continuous
occurrence
of
this
indication
shows
that
there
is
not
enough
available
cache.
Adding
memory
or
adjusting
the
registry
will
remedy
the
situation.
The
indication
contains
the
following
attributes:
AvrgMDLReadHitsPercent
The
percentage
average
of
MDL
read
hits
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Low
Cache
Hits
Percent
(LowCacheHitsPercent)
The
percentage
of
MDL
read
hits
must
not
exceed
this
threshold
70
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
40
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Pin
Read
Hits
This
indication
is
sent
when
the
percentage
of
pin
read
hits
from
the
file
system
cache
is
too
low.
While
pinned,
the
physical
address
of
a
page
in
the
file
system
cache
is
not
altered.
A
pin
read
that
is
not
satisfied
by
the
file
system
cache
requires
a
disk
read
operation
to
retrieve
the
information.
Continuous
occurrence
of
this
indication
shows
that
there
is
not
enough
available
cache.
Adding
memory
or
adjusting
the
registry
will
remedy
this
situation.
The
indication
contains
the
following
attributes:
AvrgPinReadHitsPercent
The
percentage
average
of
pin
read
hits
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Low
Cache
Hits
Percent
(LowCacheHitsPercent)
The
percentage
of
pin
read
hits
must
not
exceed
this
threshold.
70
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
41
Memory
Leak
in
Private
Bytes
This
indication
is
sent
when
there
is
a
memory
leak
in
the
private
bytes
area
of
memory.
Private
memory
cannot
be
shared
with
other
processes.
The
indication
contains
the
following
attributes:
CurrentPoolNonPagedBytes
The
current
pool
of
non-paged
bytes
of
the
process
CurrentPoolPagedBytes
The
current
pool
of
paged
bytes
of
the
process
CurrentPrivateBytes
The
current
private
bytes
of
the
process
CurrentVirtualBytes
The
current
virtual
bytes
set
of
the
process
CurrentWorkingSet
The
current
working
set
of
the
process
IDProcess
The
numeric
ID
of
the
process
with
the
memory
leak.
IDProcess
is
a
key
attribute.
Process
The
name
of
the
process.
Process
is
a
key
attribute.
No
specific
threshold
causes
this
indication
to
be
sent.
The
decision
tree
examines
the
top
five
processes
in
this
memory
area
and
compares
them
with
the
top
five
processes
from
the
last
cycle.
It
tries
to
find
identical
processes
by
matching
the
process
IDs
and
then
comparing
the
amount
of
memory
it
is
using
for
this
pool
of
memory.
If
the
memory
size
has
grown
since
the
last
cycle,
this
indication
is
sent.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
40
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
42
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Memory
Leak
in
System
Code
This
indication
is
sent
when
the
system
code
memory
size
has
grown
since
the
previous
cycle.
The
system
code
is
the
area
of
pageable
memory
in
ntoskrnl.exe,
hal.dll,
and
the
boot
drivers
and
file
system
drivers
loaded
by
the
ntldr
and
osloader
processes.
The
indication
contains
the
following
attributes:
OrigSize
The
original
size
of
the
system
code
memory
in
bytes.
SysCodeBytes
The
current
size
of
the
system
code
memory
in
bytes.
No
specific
threshold
causes
this
indication
to
be
sent.
The
decision
tree
examines
the
system
code
pool
of
memory
and
sends
this
indication
if
it
finds
that
the
memory
size
has
grown
since
the
previous
cycle.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
10
Occurrences
40
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
2.
Windows
resource
models
43
Memory
Leak
in
System
Drivers
This
indication
is
sent
when
the
system
driver
memory
size
has
grown
since
the
previous
cycle.
The
system
driver
area
is
the
pageable
memory
used
by
the
device
drivers.
The
indication
contains
the
following
attributes:
OrigSize
The
original
size
of
the
system
driver
memory
in
bytes.
SysDriverBytes
The
current
size
of
the
system
driver
memory
in
bytes.
No
specific
threshold
causes
this
indication
to
be
sent.
The
decision
tree
examines
the
system
drivers
pool
of
memory
and
sends
this
indication
if
it
finds
that
the
memory
size
has
grown
since
the
previous
cycle.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
10
Occurrences
40
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
44
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Pagefile
is
Resizing
This
indication
is
sent
when
the
pagefile
is
resized,
an
operation
which
consumes
processor
resources
and
can
cause
fragmentation
in
the
pagefile.
The
indication
contains
the
following
attributes:
CommittedBytes
The
current
total
of
committed
bytes
CommittedLimit
The
upper
limit
of
the
committed
bytes
TotalAvail
The
total
of
available
memory
in
bytes
TotalCache
The
total
cache
size
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Minimum
Available
Bytes
(MinimumAvail)
Available
memory
must
not
exceed
this
threshold.
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
The
amount
of
committed
memory
is
approaching
the
commit
limit.
The
difference
between
the
commit
limit
and
the
amount
of
committed
memory
must
be
less
than
this
threshold.
5
242
880
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
45
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Memory
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Excessive
Page
Faults
(ExcessivePageFaults)
This
threshold
is
the
maximum
number
of
page
faults
per
second.
A
page
fault
occurs
when
a
process
requires
code
or
data
that
is
not
in
its
working
set
(its
space
in
physical
memory).
This
value
includes
both
hard
faults
(those
that
require
disk
access)
and
soft
faults
(where
the
faulted
page
is
found
elsewhere
in
physical
memory).
350
Excessive
Paging
(ExcessivePaging)
This
threshold
is
the
maximum
number
of
pages
read
from
or
written
to
disk
per
second
to
resolve
hard
page
faults.
Hard
page
faults
occur
when
a
process
requires
code
or
data
that
is
not
in
its
working
set
or
elsewhere
in
physical
memory,
and
must
be
retrieved
from
disk.
60
Low
Cache
Hits
Percent
(LowCacheHitsPercent)
This
threshold
is
the
minimum
percentage
of
hits
that
must
occur
when
reading
data
from
cache.
70
Minimum
Available
Bytes
(MinimumAvail)
This
threshold
is
the
minimum
amount
of
available
memory
(in
bytes).
10
485
760
Minimum
Committed
Bytes
(MinimumCommitted)
This
threshold
is
the
minimum
value
for
the
difference
between
the
committed
memory
and
the
commit
limit
(in
bytes).
Committed
memory
is
physical
memory
for
which
space
has
been
reserved
on
the
disk
paging
files,
in
the
event
that
the
memory
must
written
to
disk.
The
commit
limit
is
the
amount
of
virtual
memory
that
can
be
committed
without
having
to
extend
the
paging
files.
When
the
difference
between
the
committed
memory
and
the
committed
limit
is
too
small,
paging
files
must
be
increased
in
size.
5
242
880
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
46
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Resource
Context
Properties
Memory
Memory
Usage
CommittedBytes
The
physical
memory
for
which
space
has
been
reserved
on
the
disk
paging
files,
in
bytes
Memory
The
memory
instance,
in
bytes
TotalAvail
The
total
available
memory,
in
bytes
TotalCache
The
total
cache
memory,
in
bytes
Paging
PageFaultsSec
The
number
of
page
faults
per
second
PagesSec
The
number
of
pages
per
second
Process
Process
Memory
Usage
ID
The
process
identifier
PrivateBytes
The
number
of
private
bytes
used
by
the
process,
in
bytes
Process
The
process
name
VirtualBytes
The
size
of
the
virtual
address
used
by
the
process,
in
bytes
WorkingSet
The
working
set,
in
bytes
Chapter
2.
Windows
resource
models
47
Network
Interface
Card
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Network
Interface
Card
resource
model
detects
bottlenecks
specifically
associated
with
all
network
interface
cards
installed
on
Windows-based
operating
systems.
Note:
The
Network
Interface
Card
resource
model
generates
the
subset
of
events
related
to
network
segments
only
on
Windows
NT
operating
systems.
For
Windows
2000,
Windows
XP,
or
Windows
Server
2003,
this
resource
model
does
not
generate
the
events
or
the
metrics
associated
with
network
segments.
For
a
list
of
events
generated
on
Windows
NT
only,
see
“Indications
and
events”
on
page
49.
The
Network
Interface
Card
resource
model
highlights
the
following
areas:
v
Broadcast
frames
If
too
much
of
the
network
is
broadcast
frames
for
an
extended
period
of
time,
segment
the
network
further
or
redesign
the
network
to
use
fewer
broadcast
frames.
v
Network
interface
card
The
core
of
the
network
subsystem
is
the
network
interface
card.
If
a
network
card
is
not
fast
enough
to
handle
the
number
of
requests
from
other
nodes
on
the
network
or
from
internal
counterparts,
all
aspects
of
the
network
subsystem
are
affected.
Tests
are
made
to
determine
if
a
network
card
is
too
slow,
or
if
there
is
too
much
data
trying
to
be
sent
through
the
network.
v
Percentage
usage
To
identify
the
network
component
overused,
tests
are
performed
on
the
percentage
of
the
network
segment
used,
the
server
service,
and
the
workstation
service
(redirector).
This
reveals
if
the
system
is
part
of
a
busier
network,
is
servicing
too
many
requests,
or
is
requesting
too
much.
Determine
whether
to
upgrade
the
server
or
workstation
service,
or
to
distribute
the
workload
differently.
v
Server
and
workstation
services
The
server
and
workstation
services
are
vital
to
the
network
operations
of
Windows.
Performance
statistics
for
each
service,
such
as
data
transfer
rate
in
and
out,
sessions
with
errors,
or
high
requests
to
the
services
are
examined.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
Yes
Category
Windows
Clearing
events
Yes
Default
cycle
time
150
seconds
48
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Resource
model
at
a
glance
Internal
name
TMW_NetworkIntCard
Parameters
No
Thresholds
Yes
Prerequisites
The
Network
Interface
Card
resource
model
requires
disk
counters
to
be
enabled
on
Windows-based
operating
systems.
To
enable
disk
counters,
perform
the
following
steps
on
each
Windows-based
operating
system:
1.
On
Windows
NT
systems,
issue
the
diskperf
–y
command.
On
systems
running
Windows
2000,
Windows
XP,
and
Windows
Server
2003,
issue
the
diskperf
–yv
command.
2.
Reboot
the
system.
On
systems
running
Windows
2000,
Windows
XP,
or
Windows
Server
2003,
the
prerequisites
needed
to
run
the
Network
Interface
Card
resource
model
are
installed
as
part
of
the
base
operating
system.
Note:
To
ensure
that
the
Network
Interface
and
Network
Segment
performance
objects
are
available,
run
the
Performance
Monitor
tool,
perfmon,
from
the
command
line.
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Network
Interface
Card
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_AdjustWorkItems
Adjust
Work
Items
Warning
51
TMW_HighBroadcastFrames
High
Broadcast
Frames
This
indication
is
valid
for
Windows
NT
only.
Warning
52
TMW_HighCurrentCommands
High
Current
Commands
Warning
53
TMW_HighErroredRatio
High
Errored
Ratio
Critical
54
TMW_NICOverworked
Network
Interface
Card
Overworked
Warning
55
TMW_NICTooSlow
Network
Interface
Card
Too
Slow
Warning
56
TMW_RedirectorAffectingServer
Redirector
Affecting
Server
This
indication
is
valid
for
Windows
NT
only.
Warning
57
TMW_RedirectorOverloaded
Redirector
Overloaded
Warning
59
Chapter
2.
Windows
resource
models
49
Event
Indication
Severity
Page
TMW_RedirectorOverloadedAffectingSegment
Redirector
Overloaded
Affecting
Segment
This
indication
is
valid
for
Windows
NT
only.
Warning
60
TMW_SegmentAffectingRedirector
Segment
Affecting
Redirector
This
indication
is
valid
for
Windows
NT
only.
Warning
62
TMW_SegmentAffectingServer
Segment
Affecting
Server
This
indication
is
valid
for
Windows
NT
only.
Warning
64
TMW_ServerAffectingRedirector
Server
Affecting
Redirector
This
indication
is
valid
for
Windows
NT
only.
Warning
65
TMW_ServerOverloaded
Server
Overloaded
Warning
67
TMW_ServerOverloadedAffectingSegment
Server
Overloaded
Affecting
Segment
This
indication
is
valid
for
Windows
NT
only.
Warning
68
Note:
When
running
the
wdmeditprf
–P
command,
you
might
receive
a
message
related
to
the
IntNotSupported
indication
for
the
Network
Interface
Card
resource
model
for
Windows.
The
IntNotSupported
indication
is
obsolete
for
this
version
of
the
product.
Ignore
any
output
messages
related
to
this
indication.
50
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Adjust
work
items
This
indication
is
sent
when
there
is
an
insufficient
number
of
work
items
to
service
incoming
requests
to
the
Windows
server.
The
Windows
registry
can
be
adjusted
to
improve
performance.
See
“Built-in
actions”
on
page
70
for
information
about
automatically
adjusting
the
Windows
registry.
The
indication
contains
the
following
attribute:
WorkItemShortages
The
number
of
times
that
work
items
cannot
be
allocated
to
service
incoming
requests
to
the
server
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
server
service.
Server
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
of
the
internal
network
segment
must
not
exceed
this
threshold.
On
Windows
NT
systems,
this
threshold
must
not
be
exceeded.
On
Windows
2000,
Windows
XP,
or
Windows
Server
2003
operating
systems,
this
threshold
is
ignored.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
The
number
of
times
that
a
work
item
can
not
be
allocated
for
an
incoming
request
to
the
server
service
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
51
High
Broadcast
Frames
This
indication
is
sent
when
the
number
of
broadcast
frames
on
the
internal
segment
is
too
high.
This
indication
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
NetworkSegment
The
identity
of
the
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentBroadcastFrames
The
percentage
value
of
broadcast
frames
on
the
network
segment
PercentNetworkUtil
The
percentage
value
of
network
utilization
on
the
segment
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
exceed
this
threshold.
90
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
52
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Current
Commands
This
indication
is
sent
when
the
number
of
current
commands
on
the
redirector,
or
workstation
service,
is
too
high.
Because
the
redirector
throughput
is
normal,
it
is
assumed
a
problem
with
the
workstation
service
or
a
software
component
connected
to
that
service.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
CurrentCommands
The
current
commands
that
are
queued
for
service
on
the
redirector,
or
workstation
service
RedirectorBPS
The
bytes
per
second
transferred
through
the
redirector,
or
workstation
service
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
value
is
multiplied
by
the
number
of
network
cards
installed
on
the
system.
If
the
number
of
current
commands
rises
above
this
level,
a
bottleneck
occurs.
The
number
of
current
commands
must
exceed
this
threshold.
10
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service.
Redirector
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
not
exceed
this
threshold.
On
Windows
NT
systems,
this
threshold
must
not
be
exceeded.
On
Windows
2000,
Windows
XP,
or
Windows
Server
2003
operating
systems,
this
threshold
is
ignored.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
53
High
Errored
Ratio
This
indication
is
sent
when
the
ratio
between
the
number
of
sessions
errored
out
and
the
sum
of
sessions
errored
out,
forced
off
and
logged
off
is
high.
This
indicates
how
frequently
network
problems
are
causing
dropped
sessions
on
the
server
service.
The
indication
contains
the
following
attributes:
ServerTotalSessions
The
total
number
of
sessions
on
the
server
errored
out,
forced
off,
and
logged
off
SessionsErroredOut
The
number
of
sessions
errored
out
on
the
server
SessionsErroredRatio
The
percentage
of
sessions
errored
out
to
the
sum
of
the
sessions
errored
out,
forced
off,
and
logged
off
SessionsForcedOff
The
number
of
sessions
forced
off
the
server
SessionsLoggedOff
The
number
of
sessions
logged
off
the
server
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
High
Errored
Out
Ratio
(HighErroredOutRatio)
This
threshold
is
a
percentage
generated
by
dividing
the
number
of
sessions
errored
out
by
the
sum
of
the
sessions
errored
out,
forced
off,
and
logged
off.
This
threshold
must
be
exceeded.
50
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
54
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Network
Interface
Card
Overworked
This
indication
is
sent
when
the
data
transfer
rate
through
the
network
card
is
too
high
and
the
outbound
queue
length
is
too
large.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
NetworkInterface
The
identity
of
network
interface
card
examined.
NetworkInterface
is
a
key
attribute.
NICBPS
The
throughput
of
the
network
interface
card
OutputQueueLength
The
number
of
requests
queued
up
to
be
sent
out
the
network
interface
card
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Output
Queue
Length
Modifier
(HighOutputQueueLengthMod)
The
length
of
the
network
card
output
queue
must
exceed
the
sum
of
the
number
of
network
cards
installed
in
the
system
plus
this
value.
3
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
may
be
used
by
the
network
card.
Network
card
throughput
must
exceed
this
threshold.
9
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
55
Network
Interface
Card
Too
Slow
This
indication
is
sent
when
the
outbound
queue
length
is
high
but
the
data
transfer
rate
through
the
network
interface
card
is
normal.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
NetworkInterface
The
identity
of
network
interface
card
examined.
NetworkInterface
is
a
key
attribute.
NICBPS
The
bytes
per
second
transferred
through
the
network
interface
card
OutputQueueLength
The
number
of
requests
queued
up
to
be
sent
out
the
network
interface
card
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Output
Queue
Length
Modifier
(HighOutputQueueLengthMod)
The
length
of
the
network
card
output
queue
must
exceed
the
sum
of
the
number
of
network
cards
installed
in
the
system
plus
this
value.
3
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
network
card.
Network
card
throughput
must
not
exceed
this
threshold.
9
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
56
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Redirector
Affecting
Server
This
indication
is
sent
when
there
is
a
high
work
item
shortage,
the
data
transfer
rate
on
the
redirector
is
high,
and
the
data
transfer
rate
on
the
server
service
is
normal.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
NetworkSegment
The
identity
of
the
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
of
network
utilization
on
the
segment
RedirectorBPS
The
number
of
bytes
per
second
transferring
through
the
redirector,
or
workstation
service
WorkItemShortages
The
number
of
times
that
work
items
cannot
be
allocated
to
service
incoming
requests
to
the
server
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
may
be
used
by
the
server
service
and
the
redirector.
Redirector
throughput
must
exceed
this
threshold.
Server
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
The
number
of
times
that
a
work
item
cannot
be
allocated
to
process
an
incoming
request
to
the
Windows
server
service
must
exceed
this
threshold.
10
Chapter
2.
Windows
resource
models
57
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
58
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Redirector
Overloaded
This
indication
is
sent
when
the
redirector,
or
workstation
service,
is
unable
to
process
the
number
of
incoming
requests.
The
number
of
current
commands
and
the
data
transfer
rate
on
the
redirector
are
high,
but
the
network
segment
percent
utilization
is
normal.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
CurrentCommands
The
current
commands
that
are
queued
for
service
on
the
redirector,
or
workstation
service
RedirectorBPS
The
number
of
bytes
per
second
transferring
through
the
redirector,
or
workstation
service
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
value
is
multiplied
by
the
number
of
network
cards
installed
on
the
system.
If
the
number
of
current
commands
rises
above
this
level,
a
bottleneck
occurs.
The
number
of
current
commands
must
exceed
this
threshold.
10
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service.
Redirector
throughput
must
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
not
exceed
this
threshold.
On
Windows
NT
systems,
this
threshold
must
not
be
exceeded.
On
Windows
2000,
Windows
XP,
or
Windows
Server
2003
operating
systems,
this
threshold
is
ignored.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
59
Redirector
Overloaded
Affecting
Segment
This
indication
is
sent
when
the
redirector,
or
workstation
service,
is
overloaded
and
is
causing
a
bottleneck
on
the
network
segment.
The
current
commands
and
the
data
transfer
rate
on
the
redirector
are
exceeded.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
CurrentCommands
The
current
commands
that
are
queued
for
service
on
the
redirector,
or
workstation
service
NetworkSegment
The
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
of
network
utilization
on
the
segment
RedirectorBPS
The
number
of
bytes
per
second
transferring
through
the
redirector,
or
workstation
service
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
value
is
multiplied
by
the
number
of
network
cards
installed
on
the
system.
If
the
number
of
current
commands
rises
above
this
level,
a
bottleneck
occurs.
The
number
of
current
commands
must
exceed
this
threshold.
10
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service.
Redirector
throughput
must
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
60
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
61
Segment
Affecting
Redirector
This
indication
is
sent
when
the
network
segment
is
overloaded
and
then
affects
the
redirector,
or
workstation
service.
The
number
of
current
commands
is
large,
but
the
data
transfer
rate
on
both
the
server
and
redirector
are
normal.
Utilization
of
the
network
segment
is
also
high,
and
it
is
assumed
that
this
is
the
reason
for
the
large
current
command
count.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
CurrentCommands
The
current
commands
that
are
queued
for
service
on
the
redirector,
or
workstation
service
NetworkSegment
The
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
of
network
utilization
on
the
segment
ServerBPS
The
bytes
per
second
transferred
through
the
server
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
value
is
multiplied
by
the
number
of
network
cards
installed
on
the
system.
If
the
number
of
current
commands
rises
above
this
level,
a
bottleneck
occurs.
The
number
of
current
commands
must
exceed
this
threshold.
10
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service,
and
server
service.
Redirector
and
server
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
62
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
63
Segment
Affecting
Server
This
indication
is
sent
when
the
network
segment
is
overloaded,
affecting
the
server
service.
There
is
a
work
item
shortage,
but
the
data
transfer
rate
on
both
the
server
and
redirector,
or
workstation
service,
are
normal.
Utilization
of
the
network
segment
is
also
high,
and
it
is
assumed
that
this
is
the
reason
for
the
work
item
shortage.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
NetworkSegment
The
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
of
network
utilization
on
the
segment
WorkItemShortages
The
number
of
times
that
work
items
cannot
be
allocated
to
service
incoming
requests
to
the
server
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service,
and
server
service.
Redirector
and
server
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
The
number
of
times
that
a
work
item
cannot
be
allocated
to
process
an
incoming
request
to
the
Windows
server
service
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
64
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Server
Affecting
Redirector
This
indication
is
sent
when
the
network
segment
is
overloaded
due
to
the
large
amount
of
data
coming
through
the
server
service.
Current
commands
and
server
data
transfer
rate
are
high,
but
the
data
transfer
rate
on
the
redirector,
or
workstation
service,
is
normal.
This
causes
utilization
of
the
network
segment
to
rise.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
CurrentCommands
The
current
commands
that
are
queued
for
service
on
the
redirector,
or
workstation
service
NetworkSegment
The
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
of
network
utilization
on
the
segment
ServerBPS
The
bytes
per
second
transferred
through
the
server
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
value
is
multiplied
by
the
number
of
network
cards
installed
on
the
system.
If
the
number
of
current
commands
rises
above
this
level,
a
bottleneck
occurs.
The
number
of
current
commands
must
exceed
this
threshold.
10
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
redirector,
or
workstation
service,
and
server
service.
Server
throughput
must
exceed
this
threshold.
Redirector
throughput
must
not
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Chapter
2.
Windows
resource
models
65
Setting
Default
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
66
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Server
Overloaded
This
indication
is
sent
when
the
work
load
on
the
server
service
is
too
high.
This
occurs
when
there
is
a
work
item
shortage,
the
data
transfer
rate
on
the
server
is
high
and
the
utilization
of
the
network
segment
is
normal.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
ServerBPS
The
bytes
per
second
transferred
through
the
server
WorkItemShortages
The
number
of
times
that
work
items
cannot
be
allocated
to
service
incoming
requests
to
the
server.
WorkItemShortages
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
server
service.
Server
throughput
must
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
not
exceed
this
threshold.
On
Windows
NT
systems,
this
threshold
must
not
be
exceeded.
On
Windows
2000,
Windows
XP,
or
Windows
Server
2003
operating
systems,
this
threshold
is
ignored.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
The
number
of
times
that
a
work
item
cannot
be
allocated
to
process
an
incoming
request
to
the
Windows
server
service
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
67
Server
Overloaded
Affecting
Segment
This
indication
is
sent
when
the
server
service
is
overloaded
because
a
a
large
amount
of
data
has
been
requested
from
the
server.
This
occurs
when
there
is
a
work
item
shortage
and
a
high
data
transfer
rate
through
the
server.
This
event
is
only
generated
on
Windows
NT
systems.
The
indication
contains
the
following
attributes:
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
NetworkSegment
The
identity
of
the
network
segment
analyzed.
NetworkSegment
is
a
key
attribute.
PercentNetworkUtil
The
percentage
value
of
network
utilization
on
the
segment
ServerBPS
The
bytes
per
second
transferred
through
the
server
WorkItemShortages
The
number
of
times
that
work
items
cannot
be
allocated
to
service
incoming
requests
to
the
server.
WorkItemShortages
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
the
server
service.
Server
throughput
must
exceed
this
threshold.
9
High
Percent
Utilization
(HighPercentUtilization)
The
utilization
on
the
internal
network
segment
must
exceed
this
threshold.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
The
number
of
times
that
a
work
item
cannot
be
allocated
to
process
an
incoming
request
to
the
Windows
server
service
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
68
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Network
Interface
Card
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
Current
Commands
Modifier
(HighCurrCmdsMod)
This
threshold
counts
the
number
of
requests
to
the
redirector,
or
workstation
service,
that
are
currently
queued
for
service.
If
this
number
is
much
larger
than
the
number
of
network
cards
installed
in
the
computer,
congestion
can
occur.
This
threshold
is
calculated
by
multiplying
the
number
of
network
cards
in
the
system
by
this
value.
10
High
Errored
Out
Ratio
(HighErroredOutRatio)
This
threshold
is
a
percentage
generated
by
dividing
the
number
of
sessions
errored
out
by
the
sum
of
the
sessions
errored
out,
forced
off,
and
logged
off.
50
High
Output
Queue
Length
Modifier
(HighOutputQueueLengthMod)
This
threshold
adjusts
the
output
queue
length
for
a
network
card.
It
is
calculated
by
adding
the
number
of
network
cards
in
the
system
to
this
value.
3
High
Percent
Broadcast
(HighPercentBroadcast)
The
percentage
of
broadcast
frames
on
the
internal
network
segment
must
not
exceed
this
threshold.
HighPercentBroadcast
is
a
Windows
NT-only
property;
therefore
this
threshold
is
only
valid
when
running
the
Network
Interface
Card
resource
model
on
a
Windows
NT
operating
system.
For
other
Windows
operating
systems,
this
threshold
is
ignored.
90
High
Percent
Bytes
Per
Second
(HighPercentBytesSec)
This
threshold
is
the
maximum
percentage
of
network
card
bandwidth
that
can
be
used
by
a
process,
such
as
the
server
service
or
the
redirector,
or
workstation
service.
The
bandwidth
of
the
network
card
is
multiplied
by
this
value
to
determine
the
threshold,
which
is
then
used
to
determine
if
the
data
transfer
rate
is
excessive.
9
High
Percent
Utilization
(HighPercentUtilization)
This
threshold
is
the
maximum
percentage
of
network
utilization
of
the
internal
segment.
HighPercentUtilization
is
a
Windows
NT-only
property;
therefore
this
threshold
is
only
valid
when
running
the
Network
Interface
Card
resource
model
on
a
Windows
NT
operating
system.
For
other
Windows
operating
systems,
this
threshold
is
ignored.
40
High
Work
Item
Shortages
(HighWorkItemShortages)
This
threshold
is
the
maximum
number
of
times
that
no
work
item
is
available,
or
no
work
item
can
be
allocated
to
the
server
service
to
process
an
incoming
request.
10
Chapter
2.
Windows
resource
models
69
Built-in
actions
This
resource
model
contains
the
following
built-in
actions
associated
to
the
Adjust
Work
Items
indication
(TMW_AdjustWorkItems
event):
v
Adjust
the
InitWorkItems
registry
key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
LanManServer\Parameters\InitWorkItems
to
a
value
of
512.
v
Adjust
the
MaxWorkItems
registry
key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
LanManServer\Parameters\MaxWorkItems.
The
maximum
value
for
Windows
Workstations
is
64
and
65
535
on
Windows
Servers.
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Network
Interface
Card
Network
Traffic
BytesTotalSec
The
rate
at
which
the
network
is
processing
data
(bytes
per
second)
CurrentBandwidth
The
network
card
bandwidth
(bytes
per
second)
NetworkInterfaceCard
The
network
interface
card
name
Output
Queue
Length
Network
Interface
Card
The
network
interface
card
monitored
Output
Queue
Length
The
length
of
the
queue
for
output
Network
Segment
Percent
Broadcast
Data
for
the
Network
Segment
resource
is
logged
on
Windows
NT
systems
only.
PercentBroadcastFrames
The
percentage
of
broadcast
frames
on
the
network
segment
PercentNetworkUtil
The
percentage
of
the
network
utilization
Segment
The
segment
identifier
Redirector
Bytes
Rate
BytesTotalSec
The
rate
at
which
the
redirector,
or
workstation
service,
is
processing
data
(bytes
per
second)
Redirector
The
redirector
instance
Current
Commands
CurrentCommands
The
number
of
requests
that
are
currently
queued
for
the
redirector,
or
workstation
service.
Redirector
The
redirector
instance
70
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Resource
Context
Properties
Server
Bytes
Rate
BytesTotalSec
The
rate
at
which
the
server
is
processing
data
(bytes
per
second)
Server
The
server
instance
Server
Activity
Server
The
server
instance
ServerTotalSession
The
number
of
sessions
on
the
server
SessionsErroredOut
The
number
of
sessions
that
ended
in
error
SessionsForcedOff
The
number
of
sessions
forced
offline
SessionsLoggedOff
The
number
of
sessions
logged
off
WorkItemShortages
The
number
of
work
item
shortages
Chapter
2.
Windows
resource
models
71
Parametric
Event
Log
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
This
resource
model
examines
the
Windows
event
logs
for
events
that
are
specified
by
the
user
through
the
parameter
configuration.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
No
Default
cycle
time
60
seconds
Internal
name
TMW_ParamEventLog
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
event
that
can
be
generated
by
the
Parametric
Event
Log
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_NTEventLogOccurred
Windows
event
logged
Warning
73
72
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Windows
Event
Logged
This
indication
is
sent
when
the
user-specified
event
occurs
and
is
logged
in
the
Windows
event
log.
The
indication
contains
the
following
attributes:
ComputerName
The
name
of
the
computer
where
the
event
occurred.
ComputerName
is
a
key
attribute.
EvtID
Identifies
the
event
EvtID
is
a
key
attribute.
Logfile
The
name
of
the
log
file
in
which
the
event
was
generated
(for
example,
system,
security,
or
application).
Message
The
message
text
of
the
event
RepeatCount
The
number
of
Event
ID
events
received
during
a
cycle
Severity
The
severity
of
the
event
TimeGenerated
The
time
the
event
was
generated
TimeWritten
The
time
the
event
was
written
to
the
event
log
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
this
resource
model.
When
no
parameters
are
specified
for
any
of
the
filters,
the
resource
model
generates
an
event
for
each
event
that
appears
in
any
of
the
three
event
logs
of
the
system.
Parameter
Description
Default
Computers
(Computers)
This
parameter
is
the
list
of
computers
from
which
the
events
were
generated.
Each
value
must
be
the
same
as
the
Computer
field
of
the
event,
as
shown
in
the
Windows
event
log.
None
Chapter
2.
Windows
resource
models
73
Parameter
Description
Default
Event
IDs
(Eids)
This
parameter
is
the
list
of
event
identifiers
to
be
monitored.
Each
value
must
be
the
same
as
the
Event
ID
field
of
the
event,
as
shown
in
the
Windows
event
log.
None
Event
Severity
(Severity)
This
parameter
is
the
set
of
event
severities
to
be
monitored.
You
may
select
any
of
the
following
severities:
v
Error
v
Information
v
Security
audit
failure
v
Security
audit
success
v
Warning
These
event
severities
correspond
to
the
following
IBM
Tivoli
Enterprise
Console
severities:
Error
Minor
Information
Harmless
Security
audit
failure
Minor
Security
audit
success
Harmless
Warning
Warning
For
Windows
NT
operating
systems,
this
filter
is
not
available
for
non-English
systems
due
to
a
limitation
of
the
Windows
operating
system
Management
Instrumentation
(WMI).
On
Windows
2000,
Windows
XP,
and
Windows
Server
2003
operating
systems,
this
filter
can
be
used
with
any
language.
None
Filter
Type
(FilterType)
This
parameter
specifies
the
way
in
which
the
other
parameters
are
applied
to
the
events
in
the
event
log.
The
AND
filter
triggers
an
event
only
when
all
of
the
conditions
specified
by
the
other
parameters
are
met.
The
OR
filter
triggers
an
event
when
any
of
the
conditions
specified
by
the
other
parameters
is
met.
AND
Log
File
Type
(LogType)
This
parameter
is
the
set
of
event
logs
to
be
monitored.
You
may
select
any
of
the
following
logs:
Application
Records
events
logged
by
applications.
Security
Records
security
events.
System
Records
events
logged
by
the
Windows
operating
system
components.
None
74
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameter
Description
Default
Source
(Source)
This
parameter
is
the
list
of
software
components
that
logged
the
events.
The
source
may
be
an
application
or
a
system
component,
such
as
a
device
driver.
Each
value
must
be
the
same
as
the
Source
field
of
the
event,
as
shown
in
the
Windows
event
log.
None
Windows
2000
Logs
(Win2kLogs)
This
parameter
is
the
set
of
Windows
2000
event
logs
to
be
monitored.
You
may
select
any
of
the
following
logs:
v
Directory
Service
v
DNS
Server
v
File
Replication
Service
None
Chapter
2.
Windows
resource
models
75
Parametric
Services
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Parametric
Services
resource
model
checks
that
the
services
specified
by
the
user
are
running
and
functioning
properly.
Events
are
generated
when:
v
User-specified
services
are
stopped.
v
User-specified
services
are
unstable.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
Yes
Category
Windows
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
TMW_ParamServices
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
event
that
can
be
generated
by
the
Parametric
Services
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_ParamServicesFailingService
Services
Failing
Service
Critical
77
TMW_ParamServicesStoppedService
Services
Stopped
Service
Critical
78
76
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Services
Failing
Service
This
indication
is
sent
when
one
of
the
user-specified
services
is
in
an
unstable
state.
The
possible
state
values
that
Windows
might
assign
to
a
service
are:
v
Continue
Pending
v
Pause
Pending
v
Paused
v
Running
v
Start
Pending
v
Stop
Pending
v
Stopped
v
Unknown
The
possible
status
values
that
Windows
might
assign
to
a
service
are:
v
Degraded
v
Error
v
OK
v
Pred
Failure
(predicting
a
failure)
v
Service
v
Starting
v
Stopping
v
Unknown
This
event
is
sent
if
the
service
state
is
not
Stopped
and
the
status
is
other
than
OK,
Starting,
or
Stopping.
Unstable
services
should
be
stopped
to
prevent
them
from
adversely
affecting
the
system.
The
indication
contains
the
following
attributes:
Name
The
name
of
the
service
examined.
Name
is
a
key
attribute.
ServiceStatus
The
current
status
of
the
service
StartMode
The
start
mode
of
the
service
State
The
current
state
of
the
service
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
2.
Windows
resource
models
77
Services
Stopped
Service
This
indication
is
sent
when
one
of
the
user-specified
services
is
stopped.
If
a
key
service
is
stopped,
it
must
be
restarted
to
ensure
that
the
Windows
operating
system
is
working
properly.
The
indication
contains
the
following
attributes:
Name
The
name
of
the
service
examined.
Name
is
a
key
attribute.
ServiceStatus
The
current
status
of
the
service
StartMode
The
start
mode
of
the
service
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
78
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameters
The
following
table
lists
the
parameter
that
can
be
set
for
this
resource
model.
Parameter
Description
Default
Services
(services)
This
parameter
is
the
list
of
services
to
be
monitored
on
Windows
operating
systems.
You
must
specify
the
exact
name
of
each
service,
as
defined
in
the
Registry
under
the
following
key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl
Set\Services
The
following
list
shows
the
exact
default
name
for
each
service,
as
defined
in
the
Registry:
v
Browser
v
EventLog
v
LanmanServer
v
LanmanWorkstation
v
lcfd
v
Netlogon
v
NtLmSsp
Built-in
actions
This
resource
model
contains
the
following
built-in
actions:
Indication
Built-in
actions
Services
Failing
Service
If
the
service
is
in
a
started
or
paused
state,
this
action
stops
the
service
and
then
starts
it
again.
Services
Stopped
Service
If
the
service
is
in
a
started
or
paused
state,
this
action
stops
the
service
and
then
starts
it
again.
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Service
Services
Status
Service
The
service
name
State
The
state
of
the
service
Status
The
status
of
the
service
For
additional
information
about
state
values
and
status
values
for
Windows-based
operating
systems,
see
“Services
Failing
Service”
on
page
77.
Chapter
2.
Windows
resource
models
79
Parametric
TCP/IP
Ports
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Parametric
TCP/IP
Ports
resource
model
monitors
the
TCP
and
user
datagram
protocol
(UDP)
ports
that
you
specify.
It
sends
an
event
when
a
monitored
port
is
found
in
one
of
the
selected
states.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
TMW_ParamPorts
Parameters
Yes
Thresholds
No
Prerequisites
The
parametric
TCP/IP
ports
resource
model
requires
the
TCP/IP
protocol
to
be
installed.
Note:
If
you
do
not
specify
a
port
number,
the
resource
model
returns
the
following
error
message:
Unable
to
Start
(11)
Indications
and
events
The
following
table
lists
the
event
that
can
be
generated
by
the
Parametric
TCP/IP
Ports
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_ParamPortStatus
State
of
the
Defined
Port
Warning
80
State
of
the
Defined
Port
This
indication
is
sent
when
a
specified
port
is
found
to
be
in
one
of
the
selected
states.
For
example,
if
you
enter
a
port
number
and
select
CLOSED
in
the
check
box,
an
event
is
generated
when
the
specified
port
connection
is
closed.
The
indication
contains
the
following
attributes:
LocalPort
The
port
number.
LocalPort
is
a
key
attribute.
80
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
LocalPortName
The
name
of
the
port
monitored
State
Indicates
the
state
of
the
port
monitored
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
this
resource
model.
Together,
the
parameters
function
as
a
filter.
Parameter
Description
Default
Port
Numbers
(ParamPortList)
This
parameter
is
the
list
of
port
numbers
to
be
monitored.
None
Possible
State
of
a
Port
(ParamPortStatusList)
This
parameter
is
the
set
of
port
states
that
will
be
monitored.Ports
can
be
monitored
for
one
or
more
of
the
following
states:
v
CLOSED
v
LISTENING
CLOSED
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Port
Port
State
Port
The
port
State
The
state
of
the
port
Chapter
2.
Windows
resource
models
81
Physical
Disk
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Physical
Disk
resource
model
detects
bottlenecks
associated
with
the
physical
disks
that
are
configured
on
the
system.
This
resource
model
highlights
the
following
areas:
v
Bytes
transferred
per
second
Bytes
transferred
per
second
indicates
the
raw
amount
of
data
that
is
transferred
through
the
disk.
The
maximum
transfer
rate
per
second
a
disk
subsystem
can
handle
depends
on
the
type
of
hard
drive,
the
type
of
controller,
the
drive
configuration,
and,
in
the
case
of
most
IDE-based
hard
drives,
the
speed
of
the
processor.
Data
transfer
rate
can
be
a
good
indicator
of
whether
too
much
data
is
routed
through
the
disk.
v
Percentage
usage
Another
indicator
that
a
disk
is
over
worked
or
is
causing
a
bottleneck
is
the
percentage
usage
of
the
disk.
This
threshold
needs
to
be
altered
when
monitoring
file
servers
for
bottlenecks.
File
servers,
servers,
and
servers
can
expect
to
use
a
high
percentage
of
disk
space.
For
workstations,
the
high
percentage
of
disk
usage
is
typically
experienced
in
short
bursts.
Workstations
experiencing
high
disk
usage
will
see
declining
performance
in
processor
speed
and
general
system
response.
In
these
situations,
a
high
percentage
usage
of
the
disk
creates
a
bottleneck.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
TMW_PhysicalDiskModel
Parameters
No
Thresholds
Yes
Prerequisites
This
resource
model
requires
disk
counters
to
be
enabled
on
Windows-based
operating
systems.
To
enable
disks
counters,
perform
the
following
steps
on
each
Windows-based
operating
systems:
1.
On
Windows
NT
systems,
issue
the
diskperf
-y
command.
On
Windows
2000,
Windows
XP,
and
Windows
Server
2003,
issue
the
diskperf
-yv
command.
2.
Reboot
the
system.
82
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Physical
Disk
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_HighPhysicalDiskReadBytesSec
High
Read
Bytes
per
Second
Minor
85
TMW_HighPhysicalDiskWriteBytesSec
High
Write
Bytes
per
Second
Minor
87
TMW_HighPhysicalDiskXferRate
High
Transfer
Rate
Minor
86
TMW_HighPhysicalPercentDiskTime
High
Percent
Disk
Time
Warning
84
TMW_PhysicalPossibleFrag
Physical
Disk
Possible
Fragmentation
Minor
88
TMW_SlowPhysicalDrive
Slow
Physical
Drive
Warning
89
Chapter
2.
Windows
resource
models
83
High
Percent
Disk
Time
This
indication
is
sent
when
the
percentage
of
time
that
a
physical
disk
is
in
use
is
high.
The
drive
cannot
process
requests
fast
enough
and
the
disk
queue
grows.
The
indication
contains
the
following
attributes:
PercentDiskTime
The
percentage
of
time
that
the
physical
drive
is
used
PercentReadTime
The
percentage
of
time
that
the
physical
drive
is
used
for
read
operations
PercentWriteTime
The
percentage
of
time
that
the
physical
drive
is
used
for
write
operations
PhysicalDisk
The
physical
disk
on
which
the
physical
disk
resides.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
not
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
write
requests
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
84
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Read
Bytes
per
Second
This
indication
is
sent
when
a
physical
disk
is
reading
an
excessive
amount
of
data
per
second.
The
indication
contains
the
following
attributes:
DiskReadBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
DiskReadSec
The
number
of
transactions
that
are
read
per
second
on
the
physical
disk
PercentDiskRead
The
percentage
of
the
physical
drive
used
to
read
data
PhysicalDisk
The
physical
disk
monitored.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
requests
must
not
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
85
High
Transfer
Rate
This
indication
is
sent
when
a
physical
disk
is
reading
and
writing
an
excessive
amount
of
data
per
second.
The
indication
contains
the
following
attributes:
DiskReadsSec
The
rate
of
bytes
read
per
second
on
the
physical
disk
DiskWritesSec
The
rate
of
bytes
written
per
second
on
the
physical
disk
DiskXfersSec
The
rate
of
bytes
read
or
written
per
second
on
the
physical
disk
PercentDiskReadTime
The
percentage
of
the
physical
drive
used
for
read
operations
PercentDiskWriteTime
The
percentage
of
the
physical
drive
used
for
write
operations
PhysicalDisk
The
physical
disk
monitored.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
written
requests
must
not
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
86
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Write
Bytes
per
Second
This
indication
is
sent
when
a
physical
disk
is
writing
an
excessive
amount
of
data
per
second.
The
indication
contains
the
following
attributes:
DiskWriteBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
DiskWriteSec
The
number
of
bytes
read
per
second
on
the
physical
disk
PercentDiskWrite
The
percent
of
the
physical
drive
used
during
write
operations
PhysicalDisk
The
physical
disk
monitored.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
written
per
second
must
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
written
requests
must
not
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
87
Physical
Disk
Possible
Fragmentation
This
indication
is
sent
when
a
disk
may
be
excessively
fragmented.
This
event
occurs
when
the
percentage
of
disk
usage
is
too
high,
the
queue
length
is
low,
and
the
transfer
rates
are
low.
The
indication
contains
the
following
attributes:
DiskBytesSec
The
number
of
bytes
read
or
written
per
second
PercentDiskTime
The
percentage
of
time
that
the
physical
drive
is
used
PhysicalDisk
The
physical
disk
monitored.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
not
exceed
this
threshold.
1
572
864
High
Percent
Usage
(HighPercentUsage)
The
number
of
outstanding
requests,
including
those
in
progress
on
the
disk,
must
exceed
this
threshold.
90
High
Queue
Length
(HighQLength)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
written
requests
must
not
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
88
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Slow
Physical
Drive
This
indication
is
sent
when
the
physical
disk
is
too
slow
to
keep
up
with
the
work
it
must
perform.
The
data
transfer
rate
and
request
queue
length
for
the
drive
are
both
high.
The
indication
contains
the
following
attributes:
AvgQLength
The
average
queue
length
AvgReadQLength
The
average
queue
length
for
read
operations
AvgWriteQLength
The
average
queue
length
for
write
operations
CurrentDiskQLength
The
number
of
jobs
waiting
to
be
processed
by
the
physical
disk
DiskReadBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
DiskWriteBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
PercentDiskTime
The
percentage
of
time
that
the
physical
disk
is
used
PhysicalDisk
The
physical
disk
monitored.
PhysicalDisk
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
The
number
of
bytes
read
or
written
per
second
must
exceed
this
threshold.
1
572
864
High
Queue
Length
(HighQLength)
The
percentage
of
time
that
the
selected
disk
is
busy
servicing
read
or
written
requests
must
exceed
this
threshold.
3
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
89
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Physical
Disk
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
Bytes
per
Second
(HighBytesSec)
This
threshold
is
the
maximum
number
of
bytes
read
or
written
per
second.
The
default
is
based
on
the
average
physical
disk.
1
572
864
High
Percent
Usage
(HighPercentUsage)
This
threshold
is
the
maximum
percentage
of
time
that
the
selected
disk
drive
spends
servicing
read
or
write
requests.
90
High
Queue
Length
(HighQLength)
This
threshold
is
the
maximum
number
of
outstanding
requests
for
the
disk.
It
includes
requests
in
progress
at
the
time
of
the
snapshot.
This
is
an
exact
length,
not
an
average
over
the
time
interval.
3
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
PhysicalDisk
Bytes
Transferred
DiskBytesSec
The
amount
of
data
read
or
written
per
second
PhysicalDisk
The
physical
disk
identifier
Percent
Disk
Usage
PercentDiskTime
The
percentage
of
time
that
the
physical
drive
is
in
use
PhysicalDisk
The
physical
disk
identifier
Queue
Length
AvgQLength
The
average
queue
length
PhysicalDisk
The
physical
disk
identifier
90
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Printer
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows
2000,
Windows
XP,
or
Windows
Server
2003-based
operating
systems.
This
resource
model
cannot
be
used
with
Windows
NT
operating
systems.
The
Printer
resource
model
determines
if
there
are
any
problems
in
the
Windows
printing
engine.
These
checks
include
determining
if
a
queue
is
generating
an
abnormally
high
number
of
errors,
such
as
out-of-paper
errors,
or
consuming
too
much
processor
time.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
1200
seconds
Internal
name
TMW_PrintModel
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Printer
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_HighCurrentPercentTime
High
Current
Percentage
Time
Warning
92
TMW_HighJobErrors
High
Job
Errors
Warning
93
TMW_HighJobErrorsPerDay
High
Job
Errors
Per
Day
Harmless
94
TMW_HighNotReadyErrors
High
Not
Ready
Errors
Warning
95
TMW_HighNotReadyErrorsPerDay
High
Not
Ready
Errors
Per
Day
Harmless
96
TMW_HighOutOfPaperErrors
High
Out
Of
Paper
Errors
Minor
95
TMW_HighOutOfPaperErrorsPerDay
High
Out
Of
Paper
Errors
Per
Day
Harmless
98
Chapter
2.
Windows
resource
models
91
High
Current
Percent
Time
This
indication
is
sent
when
a
job
is
using
a
large
amount
of
processor
time
on
the
server.
If
processor-intensive
jobs
are
continually
sent
to
the
printer,
the
administrator
must
decide
if
a
processor
upgrade
is
required
or
if
larger
jobs
should
be
off-loaded
to
a
more
powerful
server.
The
indication
contains
the
following
attributes:
CurrentPercentTime
The
total
percentage
of
processor
usage
CurrentPercentTimeJob
The
percentage
of
processor
time
used
by
the
job
JobObject
The
identity
of
the
job.
JobObject
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percent
Processor
(PercentProcessor)
This
percentage
of
the
processor
time
used
by
a
job
must
exceed
this
threshold.
80
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
92
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Job
Errors
This
indication
is
sent
when
the
number
of
printer
job
errors
is
high.
This
behavior
is
typical
of
corrupted
or
bad
drivers
installed
on
either
the
workstation
sending
the
job
or
on
the
server.
The
indication
contains
the
following
attributes:
JobErrors
The
total
number
of
job
errors
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Job
Errors
(JobErrors)
The
number
of
job
errors
must
exceed
this
threshold.
0
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
93
High
Job
Errors
per
Day
This
indication
is
sent
when
the
number
of
printer
job
errors
per
day
is
high.
This
behavior
is
typical
of
corrupted
or
bad
drivers
installed
on
either
the
workstation
sending
the
job
or
on
the
server.
The
indication
contains
the
following
attributes:
JobErrorsPerDay
The
total
number
of
job
errors
per
day
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
SystemUpTimeDays
The
time
the
system
has
been
running,
in
days
TotalJobErrors
The
total
number
of
job
errors
since
the
last
reboot
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Job
Errors
Per
Day
(JobErrorsPerDay)
The
number
of
job
errors
per
day
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Harmless
94
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Not
Ready
Errors
This
indiction
is
sent
when
the
number
of
printer
not--ready
errors
is
high.
The
printer
may
be
offline
or
experiencing
a
paper
jam.
The
indication
contains
the
following
attributes:
NotReadyErrors
The
total
number
of
not
ready
errors
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Not
Ready
Errors
(NotReadyErrors)
The
number
of
not
ready
errors
must
exceed
this
threshold.
0
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
95
High
Not
Ready
Errors
per
Day
This
indication
is
sent
when
the
number
of
printer
not-ready
errors
per
day
is
high.
The
printer
may
be
offline
or
experiencing
a
paper
jam.
The
indication
contains
the
following
attributes:
NotReadyErrorsPerDay
The
total
number
of
not
ready
errors,
calculated
per
day
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
SystemUpTimeDays
The
time
the
system
has
been
running,
in
days
TotalNotReadyErrors
The
total
number
of
not
ready
errors
since
the
last
reboot
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Not
Ready
Errors
Per
Day
(NotReadyErrorsPerDay)
The
number
of
not
ready
errors
per
day
must
exceed
this
threshold.
8
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Harmless
96
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Out
of
Paper
Errors
This
indication
is
sent
when
the
number
of
printer
out-of-paper
errors
is
high.
The
paper
supply
is
insufficient
for
the
demand.
Solutions
to
the
problem
include
additional
or
larger
paper
trays,
or
routing
jobs
to
other,
larger
printers.
The
indication
contains
the
following
attributes:
OOPErrors
The
total
number
of
out-of-paper
errors
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Out
Of
Paper
Errors
(OutOfPaperErrors)
The
number
of
out-of-paper
errors
must
exceed
this
threshold.
0
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
Chapter
2.
Windows
resource
models
97
High
Out
of
Paper
Errors
per
Day
This
indication
is
sent
when
the
number
of
printer
out-of-paper
errors
per
day
is
high.
The
paper
supply
is
insufficient
for
the
demand.
Solutions
to
the
problem
include
additional
or
larger
paper
trays,
or
routing
jobs
to
other,
larger
printers.
The
indication
contains
the
following
attributes:
OOPErrorsPerDay
The
total
number
of
out-of-paper
errors,
calculated
per
day
PrintQueue
The
queue,
or
printer
name.
PrintQueue
is
a
key
attribute.
SystemUpTimeDays
The
time
the
system
has
been
running,
in
days
TotalOOPErrors
The
total
number
of
out-of-paper
errors
since
the
last
reboot
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Out
Of
Paper
Errors
Per
Day
(OutOfPaperErrorsPerDay)
The
number
of
out-of-paper
errors
must
exceed
this
threshold.
6
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Harmless
98
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Printer
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Job
Errors
(JobErrors)
This
threshold
is
the
maximum
number
of
job
errors
that
can
occur
per
monitoring
cycle.
0
Job
Errors
Per
Day
(JobErrorsPerDay)
This
threshold
is
the
maximum
number
of
job
errors
that
can
occur
per
day.
10
Maximum
Jobs
(MostPrintJobs)
This
threshold
is
the
maximum
number
of
jobs
that
will
be
examined
when
looking
for
problems
such
as
out-of-paper
errors
or
high
processor
utilization.
60
Maximum
Queues
(MostPrintQueues)
This
threshold
is
obsolete.
None.
Not
Ready
Errors
(NotReadyErrors)
This
threshold
is
the
maximum
number
of
not-ready
errors
that
can
occur
per
monitoring
cycle.
0
Not
Ready
Errors
Per
Day
(NotReadyErrorsPerDay)
This
threshold
is
the
maximum
number
of
not-ready
errors
that
can
occur
per
day.
8
Out
Of
Paper
Errors
(OutOfPaperErrors)
This
threshold
is
the
maximum
number
of
out-of-paper
errors
that
can
occur
per
monitoring
cycle.
0
Out
Of
Paper
Errors
Per
Day
(OutOfPaperErrorsPerDay)
This
threshold
is
the
maximum
number
of
out-of-paper
errors
that
can
occur
per
day.
6
Percent
Processor
(PercentProcessor)
This
threshold
is
the
maximum
percentage
of
processor
time
that
a
single
job
may
consume.
80
Chapter
2.
Windows
resource
models
99
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
PrintQueue
Errors
JobErrors
The
number
of
jobs
in
error
NotReadyErrors
The
number
of
not
ready
errors
OutOfPaperErrors
The
out-of-paper
errors
PrintQueue
The
queue
name
100
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Process
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Process
resource
model
looks
for
bottlenecks
that
occur
in
running
processes,
such
as
processes
using
excessive
processor
time.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
TMW_Process
Parameters
No
Thresholds
Yes
Chapter
2.
Windows
resource
models
101
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Process
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_ProcessHandleLeak
Process
Handle
Leak
Warning
102
TMW_ProcessHighCPU
Process
High
CPU
Critical
103
Process
Handle
Leak
This
indication
is
sent
when
a
process
leaks
handles.
The
resource
model
examines
the
top
n
processes,
where
n
is
the
value
of
the
Maximum
Processes
threshold,
that
are
using
more
handles
than
the
Maximum
Handles
threshold.
These
are
compared
to
the
top
n
processes
from
the
previous
monitoring
cycle.
Process
identifiers
are
matched
and,
for
each
process
that
is
present
in
both
cycles,
the
number
of
handles
in
use
is
compared.
If
the
handle
count
has
increased,
this
indication
is
sent.
The
indication
contains
the
following
attributes:
CurrentHandleCount
The
current
number
of
handles
allocated
to
the
process
CurrentHanProcessID
The
process
identifier.
CurrentHanProcessID
is
a
key
attribute.
Process
The
process
name.
Process
is
a
key
attribute.
Threshold
Description
Default
Maximum
Handles
(MaxHandles)
The
maximum
number
of
handles
the
process
is
using
use
must
exceed
this
threshold.
300
Maximum
Processes
(MaxProcesses)
This
threshold
is
the
maximum
number
of
processes
that
will
be
compared.
These
processes
are
ordered
from
the
process
with
the
highest
handle
count
to
the
lowest.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
40
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
102
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Process
High
CPU
This
indication
is
sent
when
a
process
uses
too
much
processor
time.
An
indication
is
sent
for
each
of
the
top
n
processes,
where
n
is
the
value
of
the
Maximum
Processes
threshold,
that
are
using
a
higher
percentage
of
processor
time
than
the
High
CPU
Usage
threshold.
The
indication
contains
the
following
attributes:
IDProcess
The
process
identifier.
IDProcess
is
a
key
attribute.
PrcPercentPrivilegedTime
The
percentage
privileged
time
of
the
CPU
used
by
the
process
PrcPercentUserTime
The
percentage
usage
of
the
CPU
used
by
the
process
PrcPriorityBase
The
base
priority
of
the
process
Process
The
process
name.
Process
is
a
key
attribute.
Threshold
Description
Default
High
CPU
Usage
(HighCPUUse)
The
maximum
percentage
of
processor
time
that
a
process
is
using
must
exceed
this
threshold.
60
Maximum
Processes
(MaxProcesses)
This
threshold
is
the
maximum
number
of
processes
that
will
be
compared.
These
processes
are
ordered
from
the
process
with
the
highest
CPU
or
processor
usage
to
the
lowest.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
3
Occurrences
20
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
2.
Windows
resource
models
103
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Process
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
CPU
Usage
(HighCPUUse)
This
threshold
is
the
maximum
percentage
of
processor
time
that
a
process
can
use.
60
Maximum
Handles
(MaxHandles)
This
threshold
is
the
maximum
number
of
handles
that
a
process
can
use.
300
Maximum
Processes
(MaxProcesses)
This
threshold
is
the
maximum
number
of
processes
that
will
be
compared.
For
the
Process
Handle
Leak
indication,
the
processes
are
ordered
from
the
process
with
the
highest
handle
count
to
the
lowest.
For
the
Process
High
CPU
indication,
the
processes
are
ordered
from
the
process
with
the
highest
processor
usage
to
the
lowest.
5
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Process
Handle
Usage
HandleCount
The
number
of
handles
allocated
to
the
process
ID
The
process
identifier
PercentProcessorTime
The
percentage
of
processor
time
used
by
the
process
Process
The
name
of
the
process
This
resource
model
logs
data
only
if
the
Maximum
Handles
(MaxHandles)
threshold
is
exceeded.
For
additional
information
about
threshold
values
for
the
Process
resource
model
for
Windows-based
operating
systems,
see
“Process
Handle
Leak”
on
page
102.
CPU
Usage
ID
The
process
identifier
PercentPrivilegedTime
The
percentage
of
privileged
processor
time
used
by
the
process
PercentUserTime
The
percentage
usage
of
the
CPU
used
by
the
process
Process
The
name
of
the
process
This
resource
model
logs
data
only
if
the
High
CPU
Usage
(HighCPUUse)
threshold
is
exceeded.
For
additional
information
about
threshold
values
for
the
Process
resource
model
for
Windows-based
operating
systems,
see
“Thresholds.”
104
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Processor
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Processor
resource
model
detects
bottlenecks
related
to
the
central
processing
unit
(CPU).
Events
are
generated
when
processor
usage
is
high
or
when
all
processors
in
a
multi-processor
system
are
not
utilized
at
approximately
the
same
rate.
The
Processor
resource
model
detects
bottlenecks
happening
within
or
from
the
Central
Processing
Unit
(CPU).
The
Processor
resource
model
highlights
the
following
areas:
v
High
CPU
usage
Because
every
process
and
every
device
on
the
system
must
interact
with
the
CPU,
either
directly
or
through
a
controller,
it
is
imperative
that
the
CPU
is
not
extensively
used
by
a
single
process
or
device
for
an
extended
period
of
time.
There
can
be
exceptions
to
this
rule
for
certain
application-based
servers.
The
system
administrator
needs
ultimately
to
decide
how
much
utilization
one
process
makes
of
the
CPU
for
these
situations.
Tests
to
determine
how
busy
a
CPU
are
include
checking
the
percentage
usage,
the
percentage
interrupts,
and
the
queue
length.
v
Multiple
CPU
problems
With
systems
running
with
more
than
one
processor,
it
is
not
always
obvious
that
a
CPU
is
not
working.
A
check
is
made
to
ensure
that
all
CPUs
are
utilized
at
approximately
the
same
rate.
If
there
are
problems
with
a
CPU,
the
CPU
activity
will
either
be
abnormally
high
or
totally
inactive,
in
either
case
this
check
will
detect
the
CPU
that
is
faulty.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
TMW_Processor
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Processor
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Chapter
2.
Windows
resource
models
105
Event
Indication
Severity
Page
TMW_HighPercentUsageDelta
High
Percent
Usage
Delta
Minor
110
TMW_BusyHardware
Busy
Hardware
Warning
107
TMW_CPUCantKeepUpWithHW
CPU
Cannot
Keep
up
with
Hardware
Critical
108
TMW_HighProcesses
High
Processes
Critical
111
TMW_HWKeepingCPUBusy
Hardware
Keeping
CPU
Busy
Warning
109
TMW_ProcessorBusy
Processor
Busy
Critical
112
106
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Busy
Hardware
This
indication
is
sent
when
one
or
more
devices
installed
in
the
system
use
an
excessive
amount
of
processor
time.
The
interrupt
rate
is
high
and
the
processor
is
spending
an
excessive
amount
of
time
handling
these
interrupts.
The
indication
contains
the
following
attributes:
InterruptsSec
The
number
of
interrupts
per
second
that
are
passed
to
the
processor
PercentInterruptTime
The
percentage
usage
of
the
processor
as
it
handles
interrupt
requests
PercentProcessorTime
The
percentage
of
usage
of
the
processor
Processor
The
processor
identifier.
Processor
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
The
percentage
of
the
total
processor
capacity
that
is
currently
being
used
must
exceed
this
threshold.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
The
percentage
of
processor
time
used
to
service
interrupts
must
exceed
this
threshold.
20
High
Interrupts
per
Second
(HighInterruptsSec)
The
number
of
interrupts
per
second
(the
rate
at
which
devices
are
accessing
the
processor)
must
exceed
this
threshold.
600
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
3
Occurrences
15
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
107
CPU
Cannot
Keep
Up
with
Hardware
This
indication
is
sent
when
the
number
of
hardware
requests
exceed
the
capacity
of
the
processor.
Processor
usage,
time
spent
handling
interrupts,
and
the
number
of
threads
waiting
in
the
processor
queue
are
all
high.
The
indication
contains
the
following
attributes:
InterruptsSec
The
number
of
interrupts
per
second
that
are
passed
to
the
processor
PercentInterruptTime
The
percentage
usage
of
the
processor
as
it
handles
interrupt
requests
PercentProcessorTime
The
percentage
of
usage
of
the
processor
Processor
The
processor
identifier.
Processor
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
The
percentage
of
the
total
processor
capacity
that
is
currently
being
used
must
exceed
this
threshold.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
The
percentage
of
processor
time
used
to
service
interrupts
must
exceed
this
threshold.
20
High
Interrupts
per
Second
(HighInterruptsSec)
The
number
of
interrupts
per
second
(the
rate
at
which
devices
are
accessing
the
processor)
must
not
exceed
this
threshold.
600
Total
CPUs
Modifier
(TotalCPUsMod)
This
value
is
added
to
the
number
of
processors
in
the
system.
The
number
of
threads
waiting
in
the
processor
queue
must
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
3
Occurrences
15
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
108
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Hardware
Keeping
CPU
Busy
This
indication
is
sent
when
hardware
devices
are
keeping
the
processor
busy,
but
it
is
able
the
work
load.
Processor
usage
and
the
time
spent
servicing
interrupts
are
high,
but
the
number
of
threads
waiting
in
the
processor
queue
is
normal.
The
indication
contains
the
following
attributes:
InterruptsSec
The
number
of
interrupts
per
second
that
are
passed
to
the
processor
PercentInterruptTime
The
percentage
usage
of
the
processor
as
it
handles
interrupt
requests
PercentProcessorTime
The
percentage
of
usage
of
the
processor
Processor
The
processor
identifier.
Processor
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
The
percentage
of
the
total
processor
capacity
that
is
currently
being
used
must
exceed
this
threshold.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
The
percentage
of
processor
time
used
to
service
interrupts
must
exceed
this
threshold.
20
High
Interrupts
per
Second
(HighInterruptsSec)
The
number
of
interrupts
per
second
(the
rate
at
which
devices
are
accessing
the
processor)
must
not
exceed
this
threshold.
600
Total
CPUs
Modifier
(TotalCPUsMod)
This
value
is
added
to
the
number
of
processors
in
the
system.
The
number
of
threads
waiting
in
the
processor
queue
must
not
exceed
this
threshold.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
3
Occurrences
15
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
109
High
Percent
Usage
Delta
This
indication
is
sent
when
a
system
has
more
than
one
processor
and
the
difference
in
the
percentage
of
utilization
between
the
most-used
and
least-used
processor
is
high.
The
indication
contains
the
following
attributes:
IDProcess
The
identifier
of
the
process
with
the
highest
percentage
of
processor
time
LowProcessor
The
identifier
of
the
least-used
processor
PercentUsageFirst
The
percentage
of
utilization
of
the
most-used
processor
PercentUsageLast
The
percentage
of
utilization
of
the
least-used
processor
Process
The
name
of
the
process
using
the
highest
percentage
of
processor
time
Processor
The
identifier
of
the
most-used
processor.
Processor
is
a
key
attribute.
ProcessPercentProcessorTime
The
percentage
of
processor
time
that
the
process
using
the
highest
amount
of
resources
is
using
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
High
Percent
Usage
Delta
(HighPercentUsageDelta)
The
difference
in
percentage
usage
between
the
most-used
and
least-used
processor
must
exceed
this
threshold.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
3
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
No
Severity
Minor
110
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Processes
This
indication
is
sent
when
a
process
is
using
an
excessive
percentage
of
processor
time.
Processor
usage
is
high,
but
the
percentage
of
time
used
to
service
interrupt
requests
is
normal.
The
indication
contains
the
following
attributes:
HighProcesses
The
total
number
of
high-usage
processes
IDProcess
The
identifier
of
the
process
with
the
highest
processor
usage
PercentProcessorTime
The
total
percentage
usage
of
the
processor
Process
The
name
of
the
process
with
the
highest
processor
usage
that
is
active
on
the
CPU
Processor
The
processor
identifier.
Processor
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
The
percentage
of
the
total
processor
capacity
that
is
currently
being
used
must
exceed
this
threshold.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
The
percentage
of
processor
time
used
to
service
interrupts
must
not
exceed
this
threshold.
20
High
CPU
Usage
Process
(HighCPUUsageProcess)
The
percentage
of
processor
utilization
by
a
a
single
process
must
exceed
this
threshold.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
2.
Windows
resource
models
111
Processor
Busy
This
indication
is
sent
when
processor
usage
is
high,
but
no
specific
processes
or
devices
are
responsible.
The
indication
contains
the
following
attributes:
PercentInterruptTime
The
percentage
usage
of
the
processor
as
it
handles
interrupt
requests
PercentPrivilegedTime
The
percentage
privileged
time
of
the
processor
PercentProcessorTime
The
percentage
of
usage
of
the
processor
PercentUserTime
The
percentage
user
time
of
the
processor
Processor
The
processor
identifier.
Processor
is
a
key
attribute.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
The
percentage
of
the
total
processor
capacity
that
is
currently
being
used
must
exceed
this
threshold.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
The
percentage
of
processor
time
used
to
service
interrupts
must
not
exceed
this
threshold.
20
High
CPU
Usage
Process
(HighCPUUsageProcess)
The
percentage
of
processor
utilization
by
a
a
single
process
must
not
exceed
this
threshold.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
20
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
112
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Processor
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
CPU
Usage
(HighCPUUsage)
This
threshold
is
the
maximum
percentage
of
processor
usage.
Although
processor
usage
can
reach
100
percent,
it
should
not
be
sustained
for
an
extended
period
of
time.
80
High
CPU
Usage
Interrupt
(HighCPUUsageInterrupt)
This
threshold
is
the
maximum
percentage
of
processor
usage
for
interrupt
requests,
generated
by
hardware
devices.
20
High
CPU
Usage
Process
(HighCPUUsageProcess)
This
threshold
is
the
maximum
percentage
of
processor
utilization
for
a
single
process.
40
High
CPU
Usage
User
Privilege
(HighCPUUsageUserPriv)
This
threshold
is
obsolete.
None.
High
Interrupts
per
Second
(HighInterruptsSec)
This
threshold
is
the
maximum
number
of
device
interrupts
to
the
processor
per
second.
600
High
Percent
Usage
Delta
(HighPercentUsageDelta)
This
threshold
is
the
maximum
difference
in
the
percentage
usage
between
the
most-used
and
least-used
processors
in
the
system.
This
threshold
is
only
used
if
more
than
one
processor
is
installed.
5
Total
CPUs
Modifier
(TotalCPUsMod)
This
value
is
added
to
the
total
number
of
processors
in
the
system.
The
resulting
value
is
the
maximum
number
of
threads
that
can
be
waiting
in
the
processor
queue.
10
Chapter
2.
Windows
resource
models
113
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Processor
Load
Balance
Delta
The
percentage
difference
of
usage
between
the
most-used
and
least-used
processors
HighestPercentUsage
Identifies
what
percent
of
the
most
used
processor
is
used
LowestPercentUsage
Identifies
what
percent
of
the
least
used
processor
is
used
Interrupt
Time
InterruptsSec
The
number
of
processor
interrupts
per
second
Processor
The
processor
identifier
CPU
Usage
PercentInterruptTime
The
percentage
usage
of
the
processor
for
interrupt
requests
PercentPrivilegedTime
The
percentage
privileged
time
of
the
processor
PercentProcessorTime
The
percentage
usage
of
the
processor
PercentUserTime
The
percentage
user
time
of
the
processor
Processor
The
processor
identifier
System
Processor
Queue
Length
Processor
The
processor
identifier
ProcessorQueueLength
The
queue
length
of
the
processor
114
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Server
Performance
Prediction
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Server
Performance
Prediction
resource
model
gathers
data
from
Windows-based
operating
systems
for
the
Tivoli
Decision
Support
Guide
for
Server
Performance
Prediction
(Advanced
Edition).
You
must
install
version
5.1.1
of
the
IBM
Tivoli
Monitoring
component,
Gathering
Historical
Data,
to
enable
Tivoli
Monitoring
to
use
Tivoli
Decision
Support
for
Server
Performance
Prediction
(Advanced
Edition)
and
Tivoli
Enterprise
Data
Warehouse.
For
installing,
configuring,
and
using
the
Gathering
Historical
Data
component,
follow
the
procedures
outlined
for
the
TDS
Configuration
component
in
the
Tivoli
Decision
Support
for
Server
Performance
Prediction
(Advanced
Edition):
Release
Notes,
Version
2.1.
This
resource
model
does
not
have
thresholds,
indications
or
events.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
No
Default
cycle
time
30
seconds
Internal
name
TMW_Spp
Parameters
Yes
Thresholds
No
Prerequisites
The
Server
Performance
Prediction
Card
resource
model
requires
disk
counters
to
be
enabled
on
Windows-based
operating
systems.
To
enable
disk
counters,
perform
the
following
steps
on
each
Windows-based
operating
system:
1.
On
Windows
NT
systems,
issue
the
diskperf
–y
command.
On
systems
running
Windows
2000,
Windows
XP,
and
Windows
Server
2003,
issue
the
diskperf
–yv
command.
2.
Reboot
the
system.
On
systems
running
Windows
2000,
Windows
XP,
or
Windows
Server
2003,
the
prerequisites
needed
to
run
the
Server
Performance
Prediction
resource
model
are
installed
as
part
of
the
base
operating
system.
Chapter
2.
Windows
resource
models
115
Note:
Do
not
use
custom
profiles
to
distribute
this
resource
model.
Distribute
the
Server
Performance
Prediction
resource
model
using
the
SPR_NtProfile
profile.
For
additional
information
about
distributing
profiles,
see
the
IBM
Tivoli
Monitoring:
User’s
Guide.
116
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Server
Performance
Prediction
resource
model.
Parameter
Description
Default
Available
Disk
Space
Configuration
(DiskSpaceAvailableConf)
This
parameter
is
the
logical
drive
or
drives
for
which
you
want
the
available
disk
space
calculated.
The
SystemDrive
option
is
the
logical
drive
on
which
the
Windows
operating
system
is
installed,
usually
C:.
Values:
System
Drive,
All,
drives
B:
—
Z:
System
Drive
Network
Interface
Configuration
(NetworkInterfacesConf)
This
parameter
is
obsolete.
None.
Physical
Disk
Configuration
(PhysicalDiskConf)
This
parameter
is
the
physical
disk
for
which
you
want
disk
transfer
rates
calculated.
The
Windows
operating
system
assigns
a
number
to
each
physical
disk
installed
in
the
system.
The
physical
disks
are
then
partitioned
into
logical
disks,
such
as
C:.
The
Performance
Monitoring
tool,
perfmon,
can
be
run
from
the
command
line
to
show
you
the
association
between
your
physical
and
logical
disks.
Start
the
perfmon
tool
and
then
press
the
CTRL
and
I
keys
simultaneously
(Ctrl+I),
or
click
+.
Select
the
PhysicalDisk
performance
object.
The
instances
box
will
show
the
physical
and
logical
disks,
as
shown
in
the
following
example.
_Total
0
C:
D:
0
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
LogicalDisk
SPP
Guide
for
NT
FreeMB
The
free
space
on
the
disk,
in
megabytes.
LogicalDisk
The
logical
disk
name
Memory
SPP
Guide
for
NT
Avail
The
available
memory
Memory
″Memory″
PageInputSec
The
number
of
page
inputs
per
second
PageOutputSec
The
number
of
page
outputs
per
second
Chapter
2.
Windows
resource
models
117
Resource
Context
Properties
NetworkInterface
SPP
Guide
for
NT
NetworkInterface
The
network
interface
card
PacketsOutboundErrors
The
number
of
errors
sending
outbound
packets
PacketsReceivedErrors
The
number
of
errors
for
packets
received
PacketsReceivedSec
The
number
of
packets
received
per
second
PacketsSentSec
The
number
of
packets
sent
per
second
Objects
SPP
Guide
for
NT
NumberOfProcesses
The
number
of
processes
running
Objects
″Objects″
PhysicalDisk
SPP
Guide
for
NT
DiskBytesSec
The
number
of
bytes
read
or
written
per
second
DiskXfersSec
The
rate
of
bytes
read
or
written
per
second
on
the
physical
disk
PhysicalDisk
The
physical
disk
identifier.
System
SPP
Guide
for
NT
PrcTotCpuTime
The
percentage
of
total
CPU
time
PrcTotPrivTime
The
percentage
privileged
time
of
the
CPU
used
PrcTotUserTime
The
percentage
of
total
user
time
ProcessorQueueLength
The
length
of
the
processor
queue
System
″System″
118
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Services
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
Services
resource
model
checks
that
the
services
selected
by
the
user
are
running
and
functioning
properly.
The
resource
model
monitors
the
following
services:
v
Browser
v
EventLog
v
LanmanServer
v
LanmanWorkstation
v
Netlogon
v
NtLmSsp
v
Tivoli
endpoint
Note:
It
is
not
necessary
to
monitor
the
Netlogon
service
if
the
computer
is
a
member
of
a
workgroup,
and
not
a
domain.
The
default
behavior
of
monitoring
this
service
assumes
that
the
computer
is
a
member
of
a
domain.
The
resource
model
highlights
the
following
areas:
v
Key
services
Some
services
are
vital
to
the
operation
of
Windows.
The
resource
model
checks
that
key
services
are
not
stopped
to
ensure
proper
functioning
of
the
system.
v
Unstable
services
Services,
like
any
other
installed
software,
can
become
corrupted
or
unstable.
The
resource
model
checks
that
all
installed
services
are
stable.
Unstable
services
must
be
stopped
to
ensure
they
do
not
harm
other
functions
of
the
system.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
Yes
Category
Windows
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
TMW_Services
Parameters
No
Thresholds
Yes
Chapter
2.
Windows
resource
models
119
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Services
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_ServicesFailingService
Services
Failing
Service
Critical
120
TMW_ServicesStoppedService
Services
Stopped
Service
Critical
122
Services
Failing
Service
This
indication
is
sent
when
one
of
the
user-specified
services
is
in
an
unstable
state.
The
possible
state
values
that
Windows
might
assign
to
a
service
are:
v
Continue
Pending
v
Pause
Pending
v
Paused
v
Running
v
Start
Pending
v
Stop
Pending
v
Stopped
v
Unknown
The
possible
status
values
that
Windows
might
assign
to
a
service
are:
v
Degraded
v
Error
v
OK
v
Pred
Failure
(predicting
a
failure)
v
Service
v
Starting
v
Stopping
v
Unknown
This
event
is
sent
if
the
service
state
is
not
Stopped
and
the
status
is
other
than
OK,
Starting,
or
Stopping.
Unstable
services
should
be
stopped
to
prevent
them
from
adversely
affecting
the
system.
The
indication
contains
the
following
attributes:
Name
The
name
of
the
service
examined.
Name
is
a
key
attribute.
ServiceStatus
The
current
status
of
the
service
StartMode
The
start
mode
of
the
service
State
The
current
state
of
the
service
120
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Because
the
Service
resource
model
determines
primarily
whether
a
service
is
running
correctly,
there
are
no
real
numeric
thresholds
to
be
measured
or
exceeded.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
2.
Windows
resource
models
121
Services
Stopped
Service
This
indication
is
sent
when
one
of
the
user-specified
services
is
stopped.
If
a
key
service
is
stopped,
it
must
be
restarted
to
ensure
that
the
Windows
operating
system
is
working
properly.
The
indication
contains
the
following
attributes:
Name
The
name
of
the
service
examined.
Name
is
a
key
attribute.
ServiceStatus
The
current
status
of
the
service
StartMode
The
start
mode
of
the
service
Because
the
Service
resource
model
determines
primarily
whether
a
service
is
running
correctly,
there
are
no
real
numeric
thresholds
to
be
measured
or
exceeded.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
122
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
Because
the
Service
resource
model
determines
primarily
whether
a
service
is
running
correctly,
there
are
no
real
numeric
thresholds
to
be
measured
or
exceeded.
In
this
resource
model,
the
threshold
values
act
as
numerical
flags
where
0
is
false
and
any
other
number
is
true.
With
this,
the
user
can
determine
which
services
they
want
to
monitor.
For
example,
in
the
threshold
section,
LanmanServer
(Server
service)
is
set
to
1
meaning
the
resource
model
checks
if
the
Server
service
is
running.
System
Administrators
can
decide
that
the
Server
service
does
not
need
to
run
on
certain
systems.
On
those
systems
they
can
change
the
profile
to
set
the
Server
threshold
value
to
0
and
the
resource
model
does
not
check
if
the
Server
service
is
running.
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Services
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Browser
(Browser)
This
threshold
determines
if
the
Browser
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
The
Browser
service
creates
the
list
of
computers
and
networks
in
the
network
neighborhood.
It
is
also
needed
so
that
the
local
machine
is
present
on
other
network
neighborhoods
throughout
the
local
network.
1
EventLog
(EventLog)
This
threshold
determines
if
the
EventLog
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
This
service
logs
information,
including
errors,
pertinent
to
the
local
machine.
This
data
is
useful
to
an
administrator
who
is
trying
to
correct
a
malfunctioning
component
of
the
Windows
operating
system.
1
LanmanServer
(LanmanServer)
This
threshold
determines
if
the
LanmanServer
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
This
service,
better
known
as
the
Server
service,
manages
shared
directories
that
are
accessible
by
other
workstations
on
the
network.
Without
this
service,
other
machines
cannot
connect
to
the
local
machine.
1
LanmanWorkstation
(LanmanWorkstation)
This
threshold
determines
if
the
LanManWorstation
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
This
service
is
the
counterpart
of
the
LanmanServer
service.
If
it
is
not
running,
the
local
machine
cannot
connect
to
other
machines
on
the
network.
1
Chapter
2.
Windows
resource
models
123
Threshold
Description
Default
Netlogon
(Netlogon)
This
threshold
determines
if
the
Netlogon
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
The
Netlogon
service
is
used
when
logging
onto
the
local
workstation
as
well
as
when
processing
logon
attempts
from
remote
machines.
If
the
Netlogon
service
is
not
functioning
properly,
it
is
possible
that
no
one
will
be
able
to
log
on
to
the
system.
Note:
It
is
not
necessary
to
monitor
the
Netlogon
service
if
the
computer
is
a
member
of
a
workgroup,
and
not
a
domain.
The
default
behavior
of
monitoring
this
service
assumes
that
the
computer
is
a
member
of
a
domain.
1
NtLmSsp
(NtLmSsp)
This
threshold
determines
if
the
NtLmSsp
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
NtLmSsp
is
the
Windows
LAN
Manager
(LM)
Security
Support
Provider.
It
provides
Windows
security
to
remote
procedure
call
(RPC)
programs
that
use
transports
other
than
named
pipes.
It
is
not
necessary
to
run
this
service
continuously,
but
doing
so
is
not
harmful.
1
Tivoli
Endpoint
(lcfd)
This
threshold
determines
if
the
Tivoli
Endpoint
service
is
monitored.
If
the
value
is
set
to
0,
the
service
is
not
monitored.
This
service
connects
the
computer
to
the
Tivoli
Management
Environment
1
Built-in
actions
This
resource
model
contains
the
following
built-in
action:
Table
5.
Indication
Built-in
actions
Services
Failing
Service
If
the
service
is
in
a
started
or
paused
state,
this
action
stops
the
service
and
then
starts
it
again.
Services
Stopped
Service
If
the
service
is
in
a
started
or
paused
state,
this
action
stops
the
service
and
then
starts
it
again.
124
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
TCP/IP
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
Windows-based
operating
systems.
The
TCP/IP
resource
model
looks
for
problems
in
the
TCP/IP
protocol.
Events
are
generated
when
the
network
is
congested,
as
seen
through
retransmitted
TCP
segments
and
high
ping
rates,
or
there
are
excessive
fragmented
datagrams.:
v
Fragmented
data
Fragmented
datagrams
are
datagrams
sent
through
the
network
that
are
incomplete.
Fragments
have
to
wait
at
their
destination
point
to
be
reassembled.
When
datagrams
have
to
be
reassembled,
it
requires
CPU
time
that
could
otherwise
be
put
to
use
servicing
current
processes
or
interrupt
request.
Therefore,
excessive
fragmented
datagrams
need
to
be
minimized
whenever
possible.
v
Network
congestion
Congestion
can
be
a
big
problem
on
any
type
of
network.
One
way
of
diagnosing
congestion
is
to
look
for
retransmitted
TCP
segments
and
high
ping
rates.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Windows
Clearing
events
Yes
Default
cycle
time
180
seconds
Internal
name
TMW_TCPIP
Parameters
No
Thresholds
Yes
Prerequisites
The
TCP/IP
resource
model
require
the
TCP/IP
protocol
and
the
SNMP
service
to
be
installed.
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TMW_HighFragRatio
High
Fragment
Ratio
Warning
126
TMW_HighPing
High
Ping
Warning
127
TMW_SegmentsReXmit
Segments
ReXmit
Warning
128
Chapter
2.
Windows
resource
models
125
High
Fragment
Ratio
This
indication
is
sent
when
the
percentage
of
fragmented
datagrams
received
compared
to
the
total
number
of
datagrams
received
is
high.
This
percentage
rises
as
the
local
network
grows
more
congested.
Indications
from
the
Network
Interface
resource
model
can
offer
more
insight
into
the
reason
for
the
congestion.
The
indication
contains
the
following
attributes:
DGReceivedSec
The
number
of
datagrams
received
per
second
DGSec
The
number
of
datagrams
transmitted
per
second
DGSentSec
The
number
of
datagrams
sent
per
second
FragReassembledSec
The
number
of
fragmented
datagrams
reassembled
per
second
FragReceivedSec
The
number
of
fragmented
datagrams
received
per
second
FragsToDGRatio
The
percentage
of
fragmented
datagrams
compared
to
the
total
datagrams
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
High
Fragment
Ratio
(HighFragRatio)
This
percentage
of
fragmented
datagrams
received
compared
to
the
total
number
of
datagrams
received
must
exceed
this
threshold.
80
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
126
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Ping
This
indication
is
sent
when
the
rate
at
which
datagrams
are
received
is
high
in
comparison
to
the
rate
at
which
segments
are
received.
This
is
common
when
a
system
is
receiving
a
large
number
of
pings.
The
indication
contains
the
following
attributes:
DGReceivedSec
The
number
of
datagrams
received
per
second
DGSec
The
number
of
datagrams
transmitted
per
second
DGSentSec
The
number
of
datagrams
sent
per
second
SegmentsRcvdSec
The
number
of
segments
received
per
second
SegmentsSec
The
number
of
segments
transmitted
per
second
SegmentsSentSec
The
number
of
segments
sent
per
second
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Low
Segments
(LowSegments)
The
number
of
segments
received
per
second
must
not
exceed
this
threshold.
10
Moderate
DG
(ModerateDG)
The
number
of
datagrams
received
per
second
must
exceed
this
threshold.
60
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
2.
Windows
resource
models
127
Segments
Retransmit
This
indication
is
sent
when
the
rate
at
which
TCP
segments
are
retransmitted
is
high.
This
indicates
network
congestion.
Indications
from
the
Network
Interface
resource
model
can
offer
more
insight
into
the
reason
for
the
congestion.
The
indication
contains
the
following
attributes:
DGSec
The
number
of
datagrams
transmitted
per
second
FragsToDGRatio
The
percentage
of
fragmented
datagrams
compared
to
total
datagrams
SegmentsReXmitSec
The
number
of
segments
retransmitted
per
second
SegmentsSentSec
The
number
of
segments
transmitted
per
second
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
High
Segment
Retransmitted
(HighSegmentReXmit)
The
number
of
segments
retransmitted
per
second
must
exceed
this
threshold.
1
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
128
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
TCP/IP
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
High
Fragment
Ratio
(HighFragRatio)
This
threshold
is
the
maximum
percentage
of
fragmented
datagrams
received
in
comparison
to
the
total
number
of
datagrams
received.
80
High
Segment
Retransmitted
(HighSegmenReXmit)
This
threshold
is
the
maximum
number
of
TCP
segments
that
can
be
retransmitted
per
second.
1
Low
Segments
(LowSegments)
This
threshold
is
the
maximum
number
of
TCP
segments
received
per
second.
This
rate
must
be
low
to
be
a
factor
in
determining
if
the
system
is
receiving
a
high
number
of
pings.
10
Moderate
DG
(ModerateDG)
This
threshold
is
the
number
of
datagrams
received
per
second.
Unlike
most
resource
model
thresholds,
Moderate
DG
indicates
when
the
rate
is
considered
to
be
moderate
(above
normal),
not
high
or
low.
60
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
IP
Datagrams
Traffic
DGReceivedSec
The
number
of
datagrams
received
per
second
DGSec
The
number
of
datagrams
sent
or
received
per
second
DGSentSec
The
number
of
datagrams
sent
per
second
IP
″IP″
Fragments
Received
FragmentsReceivedSec
The
number
of
fragments
received
per
second
IP
″IP″
Chapter
2.
Windows
resource
models
129
Resource
Context
Properties
TCPIP
Segments
Retransmitted
SegmentsRetrasmitted
The
number
of
segments
retransmitted
TCP
″TCP″
Segments
Traffic
SegmentRcvdSec
The
number
of
segments
received
per
second
SegmentsSec
The
number
of
segments
sent
or
received
per
second
SegmentSentSec
The
number
of
segments
sent
per
second
TCP
″TCP″
130
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Chapter
3.
UNIX
and
Linux
resource
models
This
chapter
describes
resource
models
for
UNIX
and
Linux
systems.
CPU
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
This
resource
model
detects
problems
with
the
central
processing
unit
(CPU)
of
a
computer,
for
example,
how
long
processes
wait
in
the
queue
to
be
processed.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX®/Linux
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
DMXCpu
Parameters
No
Thresholds
Yes
Prerequisites
The
following
operating
system
maintenance
updates
are
needed
to
run
the
CPU
resource
model
on
AIX
systems:
v
For
AIX,
Version
5.1,
bos.perf.libperfstat,
Level
5.1.0
or
later
v
bos.perf.diag_tool,
Level
5.1.0
or
later
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
CPU
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
High_SysCPUUsage
High
CPU
Usage
by
System
Warning
133
Low_IdleCPUUsage
High
CPU
Overload
Warning
132
131
High
CPU
Overload
This
indication
is
sent
if
a
low
percentage
of
CPU
is
idle.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
Name
is
a
key
attribute.
percidlecpu
The
percent
of
CPU
that
is
idle
Note:
Some
attributes
are
denoted
as
key
attributes.
Key
attributes
to
allow
you
to
distinguish
one
attribute
from
another
when
there
is
more
than
one
instance
of
an
indication.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
CPU
in
Idle
(IdleCPUTimeThr)
This
threshold
indicates
the
minimum
percentage
of
CPU
required
to
be
idle
to
maintain
adequate
system
performance.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Send
indications
to
Tivoli
Business
Systems
Manager
No
Severity
Warning
132
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
CPU
Usage
by
System
This
indication
is
sent
when
a
high
percentage
of
CPU
is
used
for
system
requests.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percsyscpuusage
The
percent
of
CPU
time
spent
on
system
requests
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
CPU
Used
by
System
(SysCPUTimeThr)
This
threshold
measures
the
percentage
of
CPU
required
for
service
system
requests.
80
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Send
indications
to
Tivoli
Business
Systems
Manager
No
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
133
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
CPU
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Percentage
of
CPU
in
Idle
(IdleCPUTimeThr)
This
threshold
indicates
the
minimum
percentage
of
CPU
required
to
be
idle
in
order
to
maintain
adequate
system
performance.
10
Percentage
of
CPU
Used
by
System
(SysCPUTimeThr)
This
threshold
measures
the
percentage
of
CPU
required
for
service
system
requests.
80
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
CPU
Average
Loading
loadAvg1
The
number
of
processes
running
every
minute
loadAvg5
The
number
of
processes
running
every
5
minutes
loadAvg15
The
number
of
processes
running
every
15
minutes
name
Identifies
the
single
instance
Percent
usage
name
Identifies
the
single
instance
prcIdleTime
The
percent
of
the
time
that
the
CPU
is
idle.
prSysTime
The
percent
of
the
time
that
the
CPU
in
system
mode.
prcUserTime
The
percent
of
the
time
that
the
CPU
is
in
user
mode.
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXCpu.mof
file
for
the
CPU
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXCpu.
Property
Type
Description
idleTime
NUMERIC
The
percent
of
the
time
that
the
CPU
is
idle
loadAvg1
NUMERIC
The
number
of
processes
running
every
minute.
loadAvg15
NUMERIC
The
number
of
processes
running
every
15
minutes.
134
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Property
Type
Description
loadAvg5
NUMERIC
The
number
of
processes
running
every
5
minutes.
sysTime
NUMERIC
The
percent
of
the
time
that
the
CPU
is
in
system
mode.
userTime
NUMERIC
The
percent
of
the
time
that
the
CPU
is
in
user
mode.
Chapter
3.
UNIX
and
Linux
resource
models
135
File
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
The
File
resource
model
gives
information
about
files
in
the
system.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
DMXFile
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
File
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
FileChanged
File
Changed
Warning
138
FileNotPresent
File
not
Present
Warning
139
FilesAttributeChange
File
Attributes
Changed
Warning
137
136
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
File
Attributes
Changed
This
indication
is
sent
when
the
date
and
time
of
last
updates
to
file
are
different
from
the
previous
cycle.
The
indication
contains
the
following
attribute:
pathname
The
fully-qualified
path
name
of
the
file
monitored.
The
pathname
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
137
File
Changed
This
indication
is
sent
when
the
file
checksum
or
the
file
modification
time
changes.
The
indication
contains
the
following
attribute:
pathname
The
fully-qualified
path
name
of
the
file
monitored.
The
pathname
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Send
indications
to
Tivoli
Business
Systems
Manager
No
Severity
Warning
138
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
File
not
Present
This
indication
is
sent
when
the
user
tries
to
monitor
a
file
that
does
not
exist
on
the
machine
or
was
deleted.
The
indication
contains
the
following
attribute:
pathname
The
fully-qualified
path
name
of
the
file
monitored.
The
pathname
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
139
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
File
resource
model.
Parameter
Description
Parameter
Type
Files
to
Be
Checked
(FileList)
The
files
that
you
want
to
monitor.
Enter
the
file
details,
separated
by
the
pipe
character
(|),
in
the
field
to
the
left
of
the
Add
button
in
the
following
format:
path_filename
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
File
File
Checksum
checksum
The
checksum
that
changes
fileName
The
filename
size
The
filesize
File
Times
changeTime
The
time
when
the
file
attributes
change
modificationTime
The
time
when
the
contents
of
file
change
pathname
The
file
fully-qualified
path
name
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXFile.mof
file
for
the
File
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXFile.
Property
Type
Description
accessTime
NUMERIC
The
time
when
the
file
is
accessed
(number
of
seconds
since
the
standard
UNIX
Epoch,
00:00:00
January
1,
1970
UTC).
changeTime
NUMERIC
The
time
when
the
file
attributes
change
(number
of
seconds
since
the
standard
UNIX
Epoch,
00:00:00
January
1,
1970
UTC).
crc32
NUMERIC
The
32-bit
cycle
redundance
code.
modificationTime
NUMERIC
The
time
when
the
contents
of
the
file
change
(number
of
seconds
since
the
standard
UNIX
Epoch,
00:00:00
January
1,
1970
UTC).
pathName
STRING
The
fully-qualified
file
path
name.
size
NUMERIC
The
file
size
(in
bytes).
140
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
File
System
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
This
resource
model
measures
how
efficiently
the
file
systems
are
used.
The
File
System
resource
model
monitors
both
UNIX
file
systems
(UFS)
and
VERITAS
file
systems
(VxFS)
on
Solaris,
HP-UX,
and
Linux
operating
systems.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
DMXFileSystem
Parameters
Yes
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
File
System
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
FragmentedFileSystem
Fragmented
File
System
Minor
142
LowKAvail
Low
Space
Available
Critical
143
LowPercInodesAvail
Low
Percentage
of
Available
i-nodes
Warning
145
LowPercSpcAvail
Low
Percent
Space
Available
Critical
143
Chapter
3.
UNIX
and
Linux
resource
models
141
Fragmented
File
System
This
indication
is
sent
when
the
number
of
used
i-nodes
is
high
but
the
used
file
system
space
is
relatively
low.
The
indication
contains
the
following
attributes:
mountname
The
mount
point
on
which
the
file
system
is
mounted.
The
mountname
attribute
is
a
key
attribute.
percinodeused
The
percentage
of
used
i-nodes
in
the
file
system
perckbused
The
percentage
of
space
used
by
the
file
system
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Percentage
of
File
System
Space
Used
(PrcUsedKspace)
This
threshold
indicates
the
maximum
percentage
of
file
system
space
that
can
be
used.
85
Percentage
of
i-nodes
Used
(PrcUsedInodes)
This
threshold
indicates
the
maximum
percentage
of
total
i-nodes
in
use
in
a
file
system.
80
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
142
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Space
Available
This
indication
is
sent
when
the
available
number
of
kilobytes
on
the
specified
file
system
goes
below
the
threshold.
The
indication
contains
the
following
attributes:
kb_avail
The
number
of
kilobytes
available
on
the
specified
disk
drive.
mountname
The
mount
point
on
which
the
file
system
is
mounted.
The
mountname
attribute
is
a
key
attribute.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Available
Space
(AvailableSpace)
This
threshold
indicates
the
minimum
amount
of
available
space,
in
kilobytes,
that
is
required
on
the
file
system.
7000
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Low
Percent
Space
Available
This
indication
is
sent
when
the
percent
space
available
to
the
specified
file
system
goes
below
the
threshold.
The
indication
contains
the
following
attributes:
mountname
The
mount
point
on
which
the
file
system
is
mounted.
The
mountname
attribute
is
a
key
attribute.
PercSpcAvail
The
percent
space
available.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percent
Available
Space
(PrcAvailKspace)
This
threshold
indicates
the
minimum
percentage
of
file
system
space
available,
in
kilobytes.
15
The
following
table
shows
the
default
settings
for
this
indication:
Chapter
3.
UNIX
and
Linux
resource
models
143
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
144
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Percentage
of
Available
I-nodes
This
indication
is
sent
when
the
percentage
of
available
i-nodes
is
below
the
threshold.
For
VxFS
file
systems,
Version
2.0
or
greater,
i-nodes
are
dynamically
allocated
from
a
pool
of
free
blocks
and
the
number
of
i-nodes
appear
unlimited.
However,
if
you
receive
this
indication,
the
internal
i-node
list
file
might
be
larger
than
the
maximum
file
size
limit
of
2
GB.
You
must
then
configure
the
VxFS
file
system
for
large
file
support.
Confirm
the
following
to
ensure
your
VxFS
file
system
configuration
enables
large
file
support:
v
Ensure
that
the
VxFS
file
system
is
disk
layout,
Version
3.0
or
greater.
v
Ensure
that
your
operating
system
version
where
the
VxFS
file
system
resides
provides
large
file
support.
v
Ensure
that
large
file
support
is
enabled
on
your
VxFS
file
system.
If
large
file
support
is
not
enabled,
set
the
largefiles
flag
on
the
file
system
using
the
fsadm
command.
The
indication
contains
the
following
attributes:
mountname
The
mount
point
on
which
the
file
system
is
mounted.
The
mountname
attribute
is
a
key
attribute.
percavailinodes
The
percentage
of
available
i-nodes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Available
I-nodes
(PrcAvailInodes)
This
threshold
indicates
the
minimum
percentage
of
total
i-nodes
available
for
use
in
the
file
system.
20
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
145
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
File
System
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Available
Space
(AvailableSpace)
Available
space,
in
kilobytes
Warning
Percentage
of
Available
i-nodes
(PrcAvailInodes)
Percentage
of
available
I-nodes
20
Percentage
of
Available
Space
(PrcAvailKspace)
Percentage
of
available
space,
in
kilobytes
Yes
Percentage
of
File
System
Space
Used
(PrcUsedKspace)
This
threshold
indicates
the
maximum
percentage
of
file
system
space
that
can
be
used
85
Percentage
of
i-nodes
Used
(PrcUsedInodes)
Percentage
of
total
I-nodes
Used
80
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
File
System
resource
model.
Parameter
Description
Parameter
Type
File
systems
to
be
monitored
(FileSystemsToMonitor
DiffThres)
File
systems
to
monitor
with
different
thresholds.
The
correct
syntax
is
as
follows:
FS_name
|
a
|
b
|
c
|
d
|
e
where:
a
is
the
percentage
of
i-nodes
used
b
is
the
percentage
of
FS
used
space
c
is
the
available
space,
in
kilobytes
d
is
the
percentage
of
available
i-nodes
e
is
the
percent
of
FS
available
space
The
en
dash
(–)
character
can
be
used
to
set
a
threshold
to
the
default
value.
The
error
code
12
is
returned
if
the
syntax
is
incorrect.
You
must
edit
the
profile
using
the
correct
syntax
and
distribute
it
again.
String
List
The
file
systems
to
be
ignored
(IgnoredFileSystems)
The
file
systems
to
be
ignored.
file_systems
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
146
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Resource
Context
Properties
File
System
File
System
Availability
mountpoint
The
mount
point
on
which
the
file
system
is
mounted.
percUsed
The
percent
of
file
system
space
used
percInodesUsed
The
percent
of
i-nodes
used
percAvail
The
percent
of
file
system
space
available
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXFileSystem.mof
file
for
the
File
System
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXFileSystem.
Property
Type
Description
availInodeNumber
NUMERIC
The
available
i-nodes.
availKBytes
NUMERIC
The
file
system
space
that
is
available
(in
kilobytes).
mountPoint
STRING
The
mount
point
of
the
file
system.
totalInodeNumber
NUMERIC
The
total
of
i-nodes.
totalKBytes
NUMERIC
The
total
file
system
space
(in
kilobytes).
usedInodeNumber
NUMERIC
The
i-nodes
being
used.
usedKBytes
NUMERIC
The
file
system
space
that
is
used,
n
kilobytes).
Note:
For
VxFS
file
systems,
the
i-node
properties
reported
are
based
on
the
number
of
i-nodes
currently
allocated
in
your
configuration.
For
VxFS,
Version
2.0
or
greater,
i-nodes
are
dynamically
allocated
from
a
pool
of
free
blocks.
The
i-node
properties
change
as
additional
i-nodes
are
added.
Chapter
3.
UNIX
and
Linux
resource
models
147
Memory
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems..
This
resource
model
provides
information
about
how
the
memory
is
used.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX-Linux
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
DMXMemory
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Memory
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
LowStorage
Low
Storage
Space
Critical
149
LowSwap
Low
Swap
Space
Critical
150
Thrashing
System
Thrashing
Critical
151
148
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Low
Storage
Space
This
indication
is
sent
when
the
percentage
of
available
storage
space
in
the
system
is
lower
than
the
threshold.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percavailstorage
The
percentage
of
available
storage
space
totavailstorage
The
available
storage
space
in
kilobytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Available
Virtual
Storage
(AvailVirtualStorage)
This
threshold
measures
the
percentage
of
total
virtual
storage
that
is
available.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
20
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
149
Low
Swap
Space
This
indication
is
sent
when
the
percentage
of
swap
space
available
on
the
system
goes
below
the
threshold.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percavailswap
The
percentage
of
available
swap
space
totavailswap
The
available
swap
space
in
kilobytes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Available
Swap
Space
(SwapSpacePrc)
This
threshold
indicates
the
minimum
percentage
of
all
swap
space
that
must
be
available.
30
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
150
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
System
Thrashing
This
indication
is
sent
when
there
is
excessive
or
unusual
system
paging,
for
example,
when
the
page-in
and
page-out
rate
exceeds
the
threshold.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
pageins
The
rate
of
paging
in
pageouts
The
rate
of
paging
out
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Memory
Page-in
Rate
(PageInRate)
This
threshold
indicates
the
maximum
occurrences
of
paging
in
per
second,
as
averaged
over
the
cycle.
400
Memory
Page-out
Rate
(PageOutRate)
This
threshold
indicates
the
maximum
occurrences
of
paging
out
per
second,
as
averaged
over
the
cycle.
400
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
6
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
151
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Memory
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Memory
Page-in
Rate
(PageInRate)
This
threshold
indicates
the
maximum
occurrences
of
paging
in
per
second,
as
averaged
over
the
cycle.
400
Memory
Page-out
Rate
(PageOutRate)
This
threshold
indicates
the
maximum
occurrences
of
paging
out
per
second,
as
averaged
over
the
cycle.
400
Percentage
of
Available
Swap
Space
(SwapSpacePrc)
This
threshold
indicates
the
minimum
percentage
of
all
swap
space
that
must
be
available.
30
Percentage
of
Available
Virtual
Storage
(AvailVirtualStorage)
This
threshold
measures
the
percentage
of
total
virtual
storage
that
is
available.
40
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Memory
Memory
Availability
name
Identifies
the
single
instance
PrcAvailSwap
The
percent
of
swap
space
that
is
available
PrcAvailStorage
The
percentage
of
storage
space
that
is
available
Memory
Paging
name
Identifies
the
single
instance
pageInsRate
The
rate
of
paging
in
for
the
cycle
pageOutsRate
The
rate
of
paging
out
for
the
cycle
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXMemory.mof
file
for
the
Memory
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXMemory.
Property
Type
Description
availSwapSpace
NUMERIC
The
available
swap
space
(in
kilobytes)
availVirtualStorage
NUMERIC
The
available
virtual
storage
(in
kilobytes)
pageInsRate
NUMERIC
Paging
in
per
second
(pages/sec)
pageOutsRate
NUMERIC
Paging
out
per
second
(pages/sec)
totalSwapSpace
NUMERIC
The
total
swap
space
(in
kilobytes)
152
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Property
Type
Description
totalVirtualStorage
NUMERIC
The
total
virtual
storage
(in
kilobytes)
usedSwapSpace
NUMERIC
The
used
swap
space
(in
kilobytes)
usedVirtualStorage
NUMERIC
The
used
virtual
storage
(in
kilobytes)
Chapter
3.
UNIX
and
Linux
resource
models
153
Network
Interface
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
The
Network
Interface
resource
model
detects
problems
with
the
following
installed
network
interfaces
v
Ethernet
v
Loopback
v
Token-Ring
Events
are
generated
when
performance
data,
such
as
bytes
per
second
in
and
out
and
sessions
with
errors
or
requests,
become
critical.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
Yes
Default
cycle
time
150
seconds
Internal
name
DMXNetworkInterface
Parameters
Yes
Thresholds
Yes
Prerequisites
For
AIX
and
HP-UX
environments,
the
SNMP
service
must
be
installed
and
running
on
your
system.
After
installing
the
SNMP
service,
set
the
value
of
the
SNMP
Community
Names
parameter
to
match
the
community
tag
in
the
SNMP
configuration
file,
/etc/snmpd.conf.
The
following
table
shows
the
snmpd.conf
community
tag
name
for
your
environment
type.
Table
6.
Environment
snmpd.conf
community
tag
AIX
community
HP-UX
get-community-name
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
HighInputErrPacks
High
Input
Packets
in
Error
Warning
155
HighOutErrorPacks
High
Output
Packets
in
Error
Warning
156
154
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Event
Indication
Severity
Page
HighPacktsCollision
High
Percentage
Packet
Collisions
Critical
157
InterfaceNotEnabled
Interface
Not
Enabled
Warning
158
InterfaceNotOperat
Interface
Not
Operational
Warning
159
IntStatUnknown
Unknown
Interface
Status
Critical
160
Note:
When
running
the
wdmsleng
command,
you
might
receive
a
message
related
to
the
IntNotSupported
indication
for
the
Network
Interface
Card
resource
model
for
Windows.
The
IntNotSupported
indication
is
obsolete
for
this
version
of
the
product.
Ignore
any
output
messages
related
to
this
indication.
High
Input
Packets
in
Error
This
indication
is
sent
when
a
high
percentage
of
input
packets
are
going
into
error.
The
indication
contains
the
following
attributes:
interfacename
The
network
interface.
The
interfacename
attribute
is
a
key
attribute.
interfacetype
The
network
interface
type
percinerrpacks
The
percentage
of
input
packets
that
are
going
into
error
totinpacks
The
total
input
packets
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Input
Packets
in
Error
(PercInPacketErrThr)
This
threshold
indicates
the
maximum
percentage
of
input
packets
in
error
allowed.
20
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
155
High
Output
Packets
in
Error
This
indication
is
sent
when
a
high
percentage
of
output
packets
are
going
into
error.
The
indication
contains
the
following
attributes:
interfacename
The
network
interface.
The
intefacename
attribute
is
a
key
attribute.
interfacetype
The
network
interface
type
percouterrpacks
The
percentage
of
output
packets
that
are
going
into
error
totoutpacks
The
total
output
packets
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Output
Packets
in
Error
(PercOutPacketErrThr)
This
threshold
indicates
the
maximum
percentage
of
output
packets
in
error
allowed.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
156
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Percentage
Packet
Collisions
This
indication
is
sent
when
a
high
percentage
of
output
packets
are
colliding.
This
indicates
that
the
packets
sent
might
be
corrupted
or
that
there
is
a
possible
network
overload.
The
indication
contains
the
following
attributes:
interfacename
The
interface
name.
The
interfacename
attribute
is
a
key
attribute.
interfacetype
The
interface
card
type
percPacktsCollision
The
percentage
of
packets
that
are
colliding
totoutpacks
The
total
output
packets
This
indication
is
sent
only
if
the
system
uses
an
ethernet
card
and
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Packet
Collision
Percentage
(PercPacketCollisionThr)
This
threshold
indicates
the
maximum
percentage
of
corrupted
packets
allowed.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
2
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
157
Interface
not
Enabled
This
indication
is
sent
when
the
interface
status
is
not
up
The
indication
contains
the
following
attributes:
interfacename
The
name
of
the
network
interface.
The
interfacename
attribute
is
a
key
attribute.
interfacetype
The
type
of
the
interface
card
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
158
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Interface
not
Operational
This
indication
is
sent
when
the
interface
is
enabled,
but
is
not
in
a
running
state.
The
interface
driver
might
not
be
correctly
installed.
The
indication
contains
the
following
attributes:
interfacename
The
name
of
the
network
interface.
The
interfacename
attribute
is
a
key
attribute.
interfacetype
The
type
of
interface
card
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
159
Unknown
Interface
Status
This
indication
is
sent
when
the
status
of
the
monitored
interface
can
not
be
retrieved.
The
indication
contains
the
following
attributes:
intercafetype
The
type
of
interface
card
interfacename
The
name
of
the
network
interface.
The
interfacename
attribute
is
a
key
attribute.
interfacestatus
The
status
of
the
interface
card
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
160
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Network
Interface
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Input
Packets
in
Error
(PercInPacketErrThr)
This
threshold
indicates
the
maximum
percentage
of
input
packets
in
error
allowed.
20
Output
Packets
in
Error
(PercOutPacketErrThr)
This
threshold
indicates
the
maximum
percentage
of
output
packets
in
error
allowed.
10
Packet
Collision
Percentage
(PercPacketCollisionThr)
This
threshold
indicates
the
maximum
percentage
of
corrupted
packets
allowed.
10
Chapter
3.
UNIX
and
Linux
resource
models
161
Parameters
The
following
table
lists
the
parameter
that
can
be
set
for
the
Network
Interface
resource
model.
The
name,
a
short
description,
and
the
default
value
is
shown
for
each
parameter:
Parameter
Description
Parameter
type
SNMP
Community
Name
(SNMPCommunityName)
This
parameter
allows
the
user
to
provide
a
list
of
community
names
that
can
be
used
by
their
specific
SNMP
agents
or
SNMP
daemons.
You
can
set
up
one
profile
per
SNMP
community
that
will
discover
the
others,
or
set
up
an
individual
profile
for
all
community
names
available.
The
SNMP
Community
Name
parameter
is
only
valid
for
AIX
systems.
If
the
SNMP
Community
Name
list
is
zero
(0),
the
default
community
name
public
is
used.
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Network
Interface
Card
Interfacename
The
name
of
the
interface
card
InPacks
The
total
number
of
input
packets
InPacksErr
The
percent
of
input
packets
in
error
OutPackErr
The
percent
of
output
packets
in
error
OutPackColl
The
percent
of
output
packets
colliding
OutPacks
The
total
number
of
output
packets
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXNetworkInterface.mof
file
for
the
Network
Interface
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXNetworkInterface.
Property
Type
Description
deltaCollisions
NUMERIC
The
delta
number
of
corrupted
packets.
deltaInPackets
NUMERIC
The
delta
number
of
input
packets.
deltaInPacketsErr
NUMERIC
The
delta
number
of
input
packets
in
error.
deltaOutPackets
NUMERIC
The
delta
number
of
output
packets.
162
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Property
Type
Description
deltaOutPacketsErr
NUMERIC
The
delta
number
of
output
packets
in
error.
networkInterface
STRING
The
name
of
the
network
interface
card.
status
STRING
One
of
the
following
interface
status
types:
v
DOWN
v
UNKNOWN
v
UP&NOTRUNNING
v
UP&RUNNING
type
STRING
One
of
the
following
types
of
interface
cards:
v
ETHERNET
v
LOOPBACK
v
NOTSUPPORTED
Chapter
3.
UNIX
and
Linux
resource
models
163
Network
RPC-NFS
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
The
Network
RPC-NFS
resource
model
detects
problems
and
monitors
the
performance
of
the
RPC
and
NFS
servers
and
clients.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
Solaris
Clearing
events
Yes
Default
cycle
time
150
seconds
Internal
name
DMXNetworkRPCNFS
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
HighNFSBufferSize
High
NFS
Buffer
Size
Warning
166
HighNFSSrvGetattr
High
NFS
Server
Get-attribute
Operations
Warning
168
HighNFSSrvRead
High
NFS
Server
Read
Operations
Warning
168
HighNFSSrvReadLink
High
NFS
Server
Readlink
Operations
Warning
170
HighNFSSrvWrites
High
NFS
Server
Write
Operations
Warning
171
HighPercDupReqs
High
Duplicate
RPC
Server
Calls
Warning
165
HighPercRetrans
High
Retransmitted
Calls
Critical
172
HighPercRPCBadCalls
High
RPC
Bad
Calls
Warning
173
HighTimeoutsAnd_Badxids
High
Timeouts
and
Badxids
Warning
174
NetworkBusy
High
Network
Traffic
Warning
166
NetworkSlow
Slow
Network
Warning
175
164
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
Duplicate
RPC
Server
Calls
This
indication
is
sent
when
the
percentage
of
RPC
server
calls
that
are
duplicates
is
too
high.
This
can
be
due
to
transmission
problems.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percrpcsrvdupreqs
The
percentage
of
RPC
server
calls
that
are
duplicate
requests
totrpcsrvdupreqs
The
total
number
of
RPC
server
calls
that
are
duplicate
requests
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Server
RPC
Duplicate
Requests
(RPCSrvDupCallsThr)
This
threshold
indicates
the
maximum
percentage
of
duplicate
RPC
calls
allowed.
60
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
165
High
Network
Traffic
This
indication
is
sent
when
the
number
of
client
RPC
calls
retransmitted
is
close
to
the
client
RPC
calls
timing
out.
Specifically,
the
indication
is
sent
when
the
ratio
of
the
two
numbers
is
between
0.8
and
1.2.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
numrpcretrans
The
number
of
RPC
retransmissions
numrpctimeouts
The
number
of
timed-out
RPC
client
calls
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
High
NFS
Buffer
Size
This
indication
is
sent
when
the
percentage
of
client
RPC
calls
that
were
retransmitted
or
timed
out
is
too
high,
and
there
are
no
duplicate
acknowledgements.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percrpcretrans
The
percentage
of
client
RPC
calls
that
were
retransmitted
percrpctimeouts
The
percentage
of
client
RPC
calls
that
timed
out
totrpccalls
The
total
client
RPC
calls
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Percentage
of
Client
RPC
Calls
in
Time-out
(RPCCLCallsToutPercThr)
This
threshold
indicates
the
maximum
percentage
of
timed-out
client
RPC
calls
allowed
to
maintain
acceptable
network
traffic
level.
5
Percentage
of
Client
RPC
Retransmissions
(RPCCLRetransPercThr)
This
threshold
indicates
the
maximum
of
client
RPC
retransmissions
allowed.
5
166
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
167
High
NFS
Server
Get-attribute
Operations
This
indication
is
sent
when
the
percentage
of
NFS
server
calls
to
read
the
client
attribute
cache
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percnfssrvgetattr
The
percentage
of
NFS
server
requests
to
read
the
client
attribute
cache
totnfssrvcalls
The
total
NFS
server
calls
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
NFS
Server
Getattr
Operations
(NFSSrvGettatrThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
calls
to
read
the
client
cache
attribute
without
impacting
NFS
server
performance.
40
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
168
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
NFS
Server
Read
Operations
This
indication
is
sent
when
the
percentage
of
NFS
server
calls
for
read
operations
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percnfssrvread
The
percentage
of
NFS
server
calls
for
read
operations
totnfssrvcalls
The
total
NFS
server
calls
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
NFS
Server
Read
Operations
(NFSSrvReadThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
read
operations
allowed.
30
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
169
High
NFS
Server
Readlink
Operations
This
indication
is
sent
when
the
percentage
of
NFS
server
calls
for
readlink
operations
compared
to
the
total
lookup
calls
on
the
NFS
server
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percnfssrvreadlink
The
percentage
of
NFS
server
calls
for
readlink
operations
totnfssrvlookup
The
total
lookup
calls
on
the
NFS
server
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
NFS
Server
Readlink
Operations
(NFSSrvReadlinkThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
read
operations
using
symbolic
links
on
file
systems
exported
by
the
server.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
170
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
NFS
Server
Write
Operations
This
indication
is
sent
when
the
percentage
of
NFS
server
calls
for
write
operations
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percnfssrvwrites
The
percentage
of
NFS
server
calls
for
write
operations
totnfssrvcalls
The
total
number
of
NFS
server
calls
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
NFS
Server
Write
Operations
(NFSSrvWriteThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
write
operations
allowed
without
impacting
NFS
performance.
15
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
171
High
Retransmitted
Calls
This
indication
is
sent
when
the
percentage
of
client
RPC
calls
retransmitted
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percrpcretrans
The
percentage
of
RPC
client
calls
retransmitted
totrpccalls
The
total
number
of
RPC
client
calls
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Client
RPC
Retransmissions
(RPCCLRetransPercThr)
This
threshold
indicates
the
maximum
of
client
RPC
retransmissions
allowed.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
5
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
172
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
RPC
Bad
Calls
This
indication
is
sent
when
the
percentage
of
RPC
server
or
client
calls
rejected
by
the
RPC
is
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percrpcclbadcalls
The
percentage
of
RPC
client
calls
rejected
percrpcsrvbadcalls
The
percentage
of
RPC
server
calls
rejected
totrpcclcalls
The
total
number
of
RPC
client
calls
totrpcsrvcalls
The
total
number
of
RPC
server
calls
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
Bad
RPC
Calls
(RPCBadCallsPercThr)
This
threshold
indicates
the
maximum
number
of
bad
RPC
calls
allowed
to
maintain
acceptable
network
performance.
It
refers
to
both
client
and
server
RPC
bad
calls.
30
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
173
High
Timeouts
and
Badxids
This
indication
is
sent
when
the
percentages
of
timed-out
RPC
client
calls
and
badxids
(duplicate
acknowledgements)
are
too
high.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
percrpctimeouts
The
percentage
of
timed-out
RPC
client
calls
percrpcbadxids
The
percentage
of
badxids
totrpccalls
The
total
number
of
RPC
client
calls
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Percentage
of
Client
RPC
Badxids
(RPCCLBAdXidsPercThr)
This
threshold
indicates
the
maximum
percentage
of
badxids
(duplicate
acknowledgements)
allowed
by
RPC
client
maintaining
acceptable
network
traffic
level.
5
Percentage
of
Client
RPC
Calls
in
Time-out
(RPCCLCallsToutPercThr)
This
threshold
indicates
the
maximum
percentage
of
timed-out
client
RPC
calls
allowed
to
maintain
acceptable
network
traffic
level.
5
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
174
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Slow
Network
This
indication
is
sent
when
the
number
of
timed-out
client
RPC
calls
approaches
the
number
of
client
RPC
duplicate
acknowledgements
(badxids)
for
a
single
NFS
request.
Specifically,
the
indication
is
sent
when
the
ratio
of
the
two
numbers
is
between
0.8
and
1.2.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
numrpcbadcalls
The
number
of
timed-out
client
RPC
calls
numrpcdupacks
The
number
of
client
RPC
duplicate
acknowledgements
(badxids)
for
a
single
NFS
request
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
175
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Network
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.
Threshold
Description
Default
Percentage
of
Bad
RPC
Calls
(RPCBadCallsPercThr)
This
threshold
indicates
the
maximum
number
of
bad
RPC
calls
allowed
to
maintain
acceptable
network
performance.
It
refers
to
both
client
and
server
RPC
bad
calls.
30
Percentage
of
Client
RPC
Badxids
(RPCCLBAdXidsPercThr)
This
threshold
indicates
the
maximum
percentage
of
badxids
(duplicate
acknowledgements)
allowed
by
RPC
client
maintaining
acceptable
network
traffic
level.
5
Percentage
of
Client
RPC
Calls
in
Time-out
(RPCCLCallsToutPercThr)
This
threshold
indicates
the
maximum
percentage
of
timed-out
client
RPC
calls
allowed
to
maintain
acceptable
network
traffic
level.
5
Percentage
of
Client
RPC
Retransmissions
(RPCCLRetransPercThr)
This
threshold
indicates
the
maximum
of
client
RPC
retransmissions
allowed.
5
Percentage
of
NFS
Server
Getattr
Operations
(NFSSrvGettatrThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
calls
to
read
the
client
cache
attribute
without
impacting
NFS
server
performance.
40
Percentage
of
NFS
Server
Read
Operations
(NFSSrvReadThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
read
operations
allowed.
30
Percentage
of
NFS
Server
Readlink
Operations
(NFSSrvReadlinkThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
read
operations
using
symbolic
links
on
file
systems
exported
by
the
server.
10
Percentage
of
NFS
Server
Write
Operations
(NFSSrvWriteThr)
This
threshold
indicates
the
maximum
percentage
of
NFS
server
write
operations
allowed
without
impacting
NFS
performance.
15
Percentage
of
Server
RPC
Duplicate
Requests
(RPCSrvDupCallsThr)
This
threshold
indicates
the
maximum
percentage
of
duplicate
RPC
calls
allowed.
60
176
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
NFS
Client
name
Identifies
the
single
instance
NFScalls
The
NFS
calls
NFSbadcalls
The
NFS
calls
that
are
timed
out
Server
name
Identifies
the
single
instance
NFSbadcalls
The
NFS
calls
that
are
timed
out
NFScalls
The
NFS
calls
NFSgetattr
The
NFS
requests
to
read
the
client
attribute
cache
NFSlookup
The
lookup
calls
on
the
NFS
server
NFSread
The
NFS
read
operations
NFSreadlink
The
NFS
server
calls
for
readlink
operations
NFSwrite
The
NFS
write
operations
RPC
Client
name
Identifies
the
single
instance
RPCbadcalls
The
number
of
timed-out
client
RPC
calls
RPCbadxids
The
badxids
RPCcalls
The
client
RPC
calls
RPCretrans
The
RPC
client
calls
retransmitted
RPCtimeouts
The
client
RPC
calls
that
timed
out
Server
name
Identifies
the
single
instance
RPCBadcalls
The
number
of
timed-out
client
RPC
calls
RPCCalls
The
client
RPC
calls
RPCDupchecks
The
number
of
RPC
server
calls
that
are
looked
up
in
the
duplicate
request
cache.
RPCDuprequests
The
RPC
server
calls
that
are
duplicate
requests
Chapter
3.
UNIX
and
Linux
resource
models
177
Process
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems..
The
Process
resource
model
looks
for
problems
in
running
processes.
Problems
highlight
include:
v
A
process
uses
too
much
CPU
time
v
Too
many
zombie
processes
in
the
system
v
A
process
is
stopped
or
killed
v
A
process
that
was
requested
does
not
exist
When
looking
for
problems,
this
resource
model
scans
all
processes
to
calculate
the
total
number
of
zombie
processes
and
find
the
processes
that
are
using
too
much
processor
time.
The
resource
model
then
uses
the
specified
filters
to
scan
for
stopped
or
nonexistent
processes.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
Yes
Default
cycle
time
60
seconds
Internal
name
DMXProcess
Parameters
Yes
Thresholds
Yes
178
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Process
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
HighZombieProcesses
High
Number
of
Zombie
Processes
Warning
179
ProcessHighCPU
Process
Consuming
High
CPU
Minor
180
ProcessKilledOrNotExisting
Process
Killed
or
Nonexistent
Critical
181
ProcessStopped
Process
Stopped
Critical
182
High
Number
of
Zombie
Processes
This
indication
is
sent
when
the
number
of
processes
in
a
zombie
state
is
too
high.
A
process
is
a
zombie
when
it
is
terminated
and
its
results
have
not
been
gathered
by
the
parent
process.
The
indication
contains
the
following
attributes:
name
Identifies
the
single
instance.
The
name
attribute
is
a
key
attribute.
numZombie
The
number
of
zombie
processes
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Maximum
Number
of
Zombie
Processes
(HighZombieProcess)
This
threshold
indicates
the
maximum
number
of
zombie
processes
allowed
without
impacting
system
performance.
20
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
3
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
3.
UNIX
and
Linux
resource
models
179
Process
Consuming
High
CPU
This
indication
is
sent
when
a
process
uses
too
much
CPU
time.
The
indication
contains
the
following
attributes:
IDProcess
The
ID
of
the
process
monitored.
IDProcess
is
a
key
attribute.
PrcProcessorTime
The
percentage
of
CPU
time
used
for
the
process
Process
The
process
monitored.
Process
is
a
key
attribute.
state
The
status
of
the
process
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Percentage
of
CPU
Used
(HighCPUUsed)
This
threshold
indicates
the
maximum
percentage
of
CPU
that
can
be
used
by
a
single
process
without
impacting
system
performance.
When
a
process
uses
a
high
percentage
of
CPU,
it
reduces
available
CPU
time
for
other
processes.
60
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
180
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Process
Killed
or
Nonexistent
This
event
is
sent
when
a
process
is
stopped
using
the
command
sh
...
stop,
or
when
the
resource
model
detects
that
the
process
is
no
longer
present
in
the
system.
Specify
any
processes
in
the
Processes
parameters.
The
indication
contains
the
following
attribute:
name
The
process
monitored.
The
name
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
181
Process
Stopped
This
event
is
generated
when
the
process
contains
the
state
stopped.
The
process
continues
to
be
present
in
the
system,
and
can
be
monitored
using
the
ps
-ef
command.
Specify
any
processes
in
the
Processes
parameters.
The
indication
contains
the
following
attributes:
name
The
process
monitored.
The
name
attribute
is
a
key
attribute.
ParentProcessID
The
parent
of
the
process
monitored
ProcessID
The
ID
of
the
process
monitored.
ProcessID
is
a
key
attribute.
ProcessStatus
The
status
of
the
process
monitored
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
182
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Thresholds
The
following
table
lists
the
thresholds
that
can
be
set
for
the
Process
resource
model.
For
each
threshold,
the
table
shows
the
name,
a
short
description,
and
the
default
value.e:
Threshold
Description
Default
Maximum
Number
of
Zombie
Processes
(HighZombieProcess)
This
threshold
indicates
the
maximum
number
of
zombie
processes
allowed
without
impacting
system
performance.
20
Percentage
of
CPU
Used
(HighCPUUsed)
This
threshold
indicates
the
maximum
percentage
of
CPU
that
can
be
used
by
a
single
process
without
impacting
system
performance.
When
a
process
uses
a
high
percentage
of
CPU,
it
reduces
available
CPU
time
for
other
processes.
60
Parameters
The
following
table
lists
the
parameter
that
can
be
set
for
the
Process
resource
model.
Chapter
3.
UNIX
and
Linux
resource
models
183
Parameter
Description
Default
filters
Filters
used
in
the
search
for
stopped
or
nonexistent
processes.
The
filters
may
vary
in
length
and
are
composed
of
key=value
pairs.
The
syntax
of
the
filter
parameter
is
as
follows:
property1=value1&property2=value2
The
following
example
looks
for
a
process
for
which
the
base
name
of
the
executable
file
is
lcfd
and
the
group
name
is
system:
basename=lcfd&group=system
where:
lcfd
The
base
name
of
the
executable
file.
system
The
name
of
the
group.
The
following
properties
are
valid
for
the
filters
parameter:
arguments
The
arguments
of
the
process.
basename
The
base
name
of
the
executable
file
generated
by
the
ps
–e
command.
effectiveGroup
The
effective
group
name
belonging
to
the
process.
effectiveUser
The
effective
user
name
belonging
to
the
process.
group
The
group
name
that
belongs
to
the
process
name
The
fully-qualified
relative
path
name
of
the
executable
file
generated
by
the
ps
–ef
command.
For
Solaris
operating
systems,
a
process
running
without
parameters
returns
a
maximum
of
80
characters,
including
the
fully-qualified
path
name
for
the
process.
This
limitation
does
not
apply
to
processes
that
contain
arguments.
ParentProcessID
The
parent
of
the
process
monitored
status
The
current
status
of
the
process.
terminal
The
controlling
terminal
for
the
process.
user
The
user
name
belonging
to
the
process.
String
list
184
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameter
Description
Default
Notes:
1.
The
ampersand
character
(&)
is
used
as
a
separator
and
functions
as
the
logical
AND.
Do
not
insert
blanks
around
the
ampersand
(&)
character.
2.
If
the
backslash
(\),
equal
(=),
or
ampersand
(&)
characters
are
used
with
filters,
they
must
be
preceded
with
a
backslash
(\)
escape
character,
as
follows:
\\
\=
\&
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Process
Processor
Usage
PercentProcessUsage
The
percentage
of
CPU
that
the
process
is
using
PID
The
ID
of
the
process
Process
The
name
of
the
process
This
resource
model
logs
data
only
if
the
Percentage
of
CPU
Used
(HighCPUUsed)
threshold
is
exceeded.
For
additional
information
about
threshold
values
for
the
Process
resource
model
for
UNIX
and
Linux-based
operating
systems,
see
“Thresholds”
on
page
183.
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXProcess.mof
file
for
the
Process
resource
model.
This
.mof
file
uses
one
CIM
class:
DMXProcess.
Property
Type
Description
arguments
STRING
The
arguments
of
the
process.
basename
STRING
The
basename
of
the
executable
of
the
process.
egid
NUMERIC
The
effective
Group
ID.
euid
NUMERIC
The
effective
User
ID.
gid
NUMERIC
The
Group
ID.
memUsed
NUMERIC
The
memory
used,
in
kilobytes.
name
STRING
The
name
of
the
process.
percentProcessor
Time
NUMERIC
The
percentage
of
CPU
time
used
for
the
process.
pid
NUMERIC
The
ID
of
the
process.
ppid
NUMERIC
The
ID
of
the
parent
process.
Chapter
3.
UNIX
and
Linux
resource
models
185
Property
Type
Description
state
STRING
One
of
the
following
status
types:
v
Waiting
v
Ready
v
Running
v
Stopped
v
Zombie
terminal
STRING
The
name
of
controlling
terminal
for
the
process.
uid
NUMERIC
The
User
ID.
186
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Security
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
The
Security
resource
model
provides
information
about
files
and
the
users
logged
onto
the
system.
It
highlights
the
following
items
or
changes
that
can
indicate
security
breaches:
v
Property
changes,
such
as
the
owner,
group,
or
attributes,
for
certain
files
v
The
number
of
log
on
attempts
to
the
system
by
the
same
user
v
A
suspect
superuser
v
An
account
that
is
not
valid
for
root
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
DMXSecurity
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Security
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
DuplicatedAccount
Duplicate
Account
Minor
188
FileNotExisting
Nonexistent
File
Warning
191
HighLoggingNumber
High
Log-in
Number
for
User
Minor
188
IllegalGroup
Illegal
Group
Critical
190
IllegalOwner
Illegal
Owner
Critical
190
NotRegularRootAccount
Account
not
Valid
for
Root
Harmless
188
PasswdNull
Null
Password
Critical
191
SuspectSuperGroup
Suspect
Supergroup
Critical
192
SuspectSuperUser
Suspect
Superuser
Critical
192
WrongMode
Wrong
File
Mode
Critical
193
Chapter
3.
UNIX
and
Linux
resource
models
187
Account
not
Valid
for
Root
This
indication
is
sent
when
the
account
ID
is
not
valid
for
root.
The
indication
contains
the
following
attribute:
id
The
ID
of
the
root
account
that
was
created.
The
id
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Harmless
Duplicate
Account
This
indication
is
sent
when
two
users
or
groups
have
the
same
user
or
group
ID.
The
indication
contains
the
following
attribute:
id
The
ID
duplicated.
The
id
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
High
Log-in
Number
for
User
This
indication
is
sent
when
a
specified
user
is
logged
to
the
system
a
number
of
times
higher
than
what
specified
in
the
Defined
Users
parameter.
The
indication
contains
the
following
attributes:
numlogged
The
number
of
times
the
user
logged
in
username
The
ID
of
the
user.
The
username
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
1
188
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
Chapter
3.
UNIX
and
Linux
resource
models
189
Illegal
Group
This
indication
is
sent
when
a
security-sensitive
file
does
not
have
a
superuser
group.
The
indication
contains
the
following
attributes:
fullname
The
fully-qualified
file
path.
The
fullname
attribute
is
a
key
attribute.
group
The
file
group
monitored
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Illegal
Owner
This
indication
is
sent
when
a
security-sensitive
file
contains
an
owner
who
is
not
a
superuser.
The
indication
contains
the
following
attributes:
fullname
The
full-qualified
file
path
name.
The
fullname
attribute
is
a
key
attribute.
owner
The
owner
of
the
file
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
190
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Nonexistent
File
This
indication
is
sent
when
the
user
wants
to
monitor
a
file
that
does
not
exist
on
the
machine
or
was
deleted.
The
indication
contains
the
following
attribute:
pathname
The
fully-qualified
pathname
of
the
file
specified.
The
pathname
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Null
Password
This
indication
is
sent
when
a
user
and/or
a
group
contains
a
password
that
is
set
to
null.
The
indication
contains
the
following
attributes:
id
The
ID
of
the
user
or
group.
The
id
attribute
is
a
key
attribute.
name
Identifies
the
single
instance
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
191
Suspect
Supergroup
This
indication
is
sent
when
the
supergroup
is
suspected
of
being
an
intruder.
The
indication
contains
the
following
attributes:
groupid
The
ID
of
the
suspicious
group
groupname
The
group
name
of
the
file
that
is
suspicious.
The
groupname
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Suspect
Superuser
This
indication
is
sent
when
superuser
is
suspected
of
being
an
intruder.
The
indication
contains
the
following
attributes:
id
The
user
ID
that
is
suspicious
userName
The
user
name.
The
userName
attribute
is
a
key
attribute.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
192
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Wrong
File
Mode
This
indication
is
sent
when
security-sensitive
files
have
a
file
mode
that
is
different
from
the
default
mode.
The
indication
contains
the
following
attributes:
actualmode
The
type
of
access
permission
that
the
file
actually
contains
on
the
system.
filename
The
name
of
the
file.
The
filename
attribute
is
a
key
attribute.
rightmode
The
type
of
access
permission
that
the
file
should
have
in
the
parameters
as
defined
from
the
IBM
Tivoli
Monitoring
desktop.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Chapter
3.
UNIX
and
Linux
resource
models
193
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Security
resource
model.
Parameter
Description
Parameter
Type
Alternative
Groups
(AlternativeGroup)
Groups
other
than
root
that
can
own
certain
security
files
in
the
system
String
list
Alternative
Owners
(AlternativeOwners)
Users
that
can
own
certain
security
files
in
the
system
String
list
Defined
Users
(Users)
Users
to
be
monitored
in
the
following
format:
username
|
login_limit
String
list
Files
to
Be
Monitored
(FilesList)
The
files
that
you
want
to
monitor.
Enter
the
file
details,
separated
by
the
pipe
character,
in
the
field
to
the
left
of
the
Add
button
in
the
following
format:
filename
|
string_mode
(as
listed
with
the
ls
–la
command)
|
owner
|
group
String
list
Special
Groups
(Supergroups)
The
groups
that
can
become
supergroups
in
the
system
String
list
Special
Users
(Superusers)
Users
that
can
become
superusers
in
the
system
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
File
File
Usage
fileName
The
file
name
monitored
group
The
file
group
monitored
mode
The
type
of
access
permission
to
the
file
owner
The
file
owner
monitored
size
The
file
size
monitored
User
Logging
id
The
ID
of
the
suspicious
user
numLogged
The
number
of
times
the
user
is
logged
in
userName
The
name
of
the
user
logging
onNote:
The
above
properties
are
logged
only
if
the
user
is
logged
to
the
system
a
number
of
times
higher
than
what
specified
in
the
Defined
Users
parameter.
Description
of
the
.mof
file
properties
This
section
lists
all
properties
used
by
the
DMXSecurity.mof
file
for
the
Security
resource
model.
This
.mof
file
uses
three
CIM
classes:
DMXFileSec,
DMXUser,
DMXGroup.
194
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Property
Type
Description
duplicated
NUMERIC
Is
the
user
duplicated?
A
flag
set
to
the
number
one
(1)
if
the
user
is
duplicated
or
set
to
zero
(0)
if
the
user
is
not
duplicated.
duplicated
NUMERIC
Is
the
group
duplicated?
A
flag
set
to
the
number
one
(1)
if
duplicated
or
a
flag
set
to
zero
(0)
if
not
duplicated.
group
STRING
The
file
group.
groupName
STRING
The
name
of
the
group
id
NUMERIC
The
ID
of
the
user.
id
NUMERIC
The
ID
of
the
group
mode
STRING
The
type
of
access
permission
to
the
file.
numLogged
NUMERIC
The
number
of
times
the
user
logged
in.
numMode
NUMERIC
The
UNIX
(numeric)
mode
of
the
file.
owner
STRING
The
file
owner.
passwordNull
NUMERIC
Is
the
password
null?
A
flag
set
to
the
number
one
(1)
if
the
password
is
null
or
zero
(0)
if
the
password
is
not
null.
passwordNull
NUMERIC
Is
the
password
null?
A
flag
set
to
the
number
one
(1)
if
the
password
is
null
or
a
flag
set
to
zero
(0)
if
the
password
is
not
null.
pathName
STRING
The
fully-qualified
path
name.
size
NUMERIC
The
file
size
(in
bytes)
userName
STRING
The
name
of
the
user.
Chapter
3.
UNIX
and
Linux
resource
models
195
Server
Performance
Prediction
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
UNIX
or
Linux
systems.
The
Server
Performance
Prediction
resource
model
gathers
data
from
UNIX-based
operating
systems
for
the
Tivoli
Decision
Support
Guide
for
Server
Performance
Prediction
(Advanced
Edition).
You
must
install
version
5.1.1
of
the
IBM
Tivoli
Monitoring
component,
Gathering
Historical
Data,
to
enable
Tivoli
Monitoring
to
use
Tivoli
Decision
Support
for
Server
Performance
Prediction
(Advanced
Edition)
and
Tivoli
Enterprise
Data
Warehouse.
For
installing,
configuring,
and
using
the
Gathering
Historical
Data
component,
follow
the
procedures
outlined
for
the
TDS
Configuration
component
in
the
Tivoli
Decision
Support
for
Server
Performance
Prediction
(Advanced
Edition):
Release
Notes,
Version
2.1.
This
resource
model
does
not
have
thresholds,
indications
or
events.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
UNIX
and
Linux
Clearing
events
No
Default
cycle
time
180
seconds
Internal
name
DMXSpp
Parameters
Yes
Thresholds
No
Prerequisites
For
AIX
and
HP-UX
environments,
the
SNMP
service
must
be
installed
and
running
on
your
system.
After
installing
the
SNMP
service,
set
the
value
of
the
SNMP
Community
Names
parameter
to
match
the
community
tag
in
the
SNMP
configuration
file,
/etc/snmpd.conf.
The
following
table
shows
the
snmpd.conf
community
tag
name
for
your
environment
type.
Table
7.
Environment
snmpd.conf
community
tag
AIX
community
HP-UX
get-community-name
Note:
Do
not
use
custom
profiles
to
distribute
this
resource
model.
Distribute
the
Server
Performance
Prediction
resource
model
using
the
SPR_NtProfile
profile.
196
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
For
additional
information
about
distributing
profiles,
see
the
IBM
Tivoli
Monitoring:
User’s
Guide.
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Server
Performance
Prediction
resource
model.
Parameter
Description
Default
Available
File
System
Space
Configuration
(FileSystemSpaceAvailableConf)
The
instance
for
which
you
want
the
available
file
system
space
calculated.
v
/
v
/home
v
/tmp
v
/usr
v
/var
Network
Interface
Configuration
(NetworkInterfacesConf)
This
parameter
is
obsolete.
None
SNMP
Community
Name
(SNMPCommunityName)
This
parameter
allows
the
user
to
provide
a
list
of
community
names
that
can
be
used
by
their
specific
SNMP
agents
or
SNMP
daemons.
You
can
set
up
one
profile
per
SNMP
community
that
will
discover
the
others,
or
set
up
an
individual
profile
for
all
community
names
available.
The
SNMP
Community
Name
parameter
is
only
valid
for
AIX
and
HP-UX
systems.
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Cpu
SPP
Guide
for
UNIX
idleTime
The
idle
cpu
time
as
a
percentage
of
total
cpu
time
loadAvg1
The
average
number
of
processes
running
in
the
most
recent
calendar
minute
sysTime
The
cpu
time
spent
by
the
system
as
a
percentage
of
total
cpu
time
userTime
The
cpu
time
spent
on
user
applications
as
a
percentage
of
total
cpu
time
FileSystem
SPP
Guide
for
UNIX
availKBytes
The
free
kilobytes
on
the
disk
mountPoint
The
directory
on
which
the
file
system
is
mounted
prcInodeUsed
The
percentage
of
Inodes
used
in
the
file
system
Chapter
3.
UNIX
and
Linux
resource
models
197
Resource
Context
Properties
Memory
SPP
Guide
for
UNIX
availSwapSpace
The
amount
of
space
available
to
be
swapped
pageInsRate
The
number
of
page
inputs
per
second
pageOutsRate
The
number
of
page
outputs
per
second
pctusedVirtualStorage
The
percentage
of
total
memory
used,
including
cache
memory
and
swap
space
NetworkInterface
SPP
Guide
for
UNIX
deltaCollisions
The
delta
of
packet
collisions,
compared
with
the
previous
cycle
deltaInPackets
The
delta
of
packets
received,
compared
with
the
previous
cycle
deltaInPacketsErr
The
delta
of
errors
for
packets
received,
compared
with
the
previous
cycle
deltaOutPackets
The
delta
of
packets
sent,
compared
with
the
previous
cycle
deltaOutPacketsErr
The
delta
of
errors
for
packets
sent,
compared
with
the
previous
cycle
networkInterface
The
network
interface
card
Processes
SPP
Guide
for
UNIX
numberOfProcesses
The
total
number
of
processes
numberWaitProcesses
The
number
of
processes
waiting
to
run
198
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Chapter
4.
OS/400
resource
models
This
chapter
describes
resource
models
for
OS/400
systems.
ASP
Disk
Mirroring
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
The
Auxiliary
Storage
Pool
(ASP)
Disk
Mirroring
resource
model,
given
in
input
of
one
or
more
ASP
numbers,
gets
a
list
of
disks
for
each
ASP,
checking
the
mirroring
status
of
each
disk.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
ASPDiskMirroringStatus400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
ASP
Disk
Mirroring
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
MirroringNotActive
MirroringNotActive
Warning
200
199
Mirroring
not
Active
This
indication
is
sent
when
a
disk
unit
is
part
of
a
mirrored
pair,
but
the
mirroring
is
currently
not
active.
Investigate
why
the
mirroring
is
not
active.
There
might
be
a
hardware
problem.
The
indication
contains
the
following
attribute:
diskResourceName
The
name
of
the
disk
monitored
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Occurrences
2
Holes
0
Severity
Warning
Clearing
Event
Yes
200
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
ASP
Disk
Mirroring
resource
model.
Parameter
Description
Parameter
Type
ASPs
to
monitor
for
Disk
Mirroring
Status
(ASPs)
The
ASP
numbers
that
you
want
to
monitor.
During
each
cycle
the
mirroring
status
of
each
disk
is
checked.
String
list
Chapter
4.
OS/400
resource
models
201
ASP
Utilization
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
The
Auxiliary
Storage
Pool
(ASP)
Utilization
resource
model
monitors
the
ASP
Utilization
for
the
specified
ASPs
and
sends
events
if
the
ASP
is
approaching
the
full
state.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
900
seconds
Internal
name
ASPUtilization400
Parameters
Yes
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
ASP
Utilization
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
ASPNearingCapacity
ASP
nearing
capacity
Warning
203
ASPOverflow
ASP
overflow
Warning
204
202
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
ASP
Nearing
Capacity
This
indication
is
sent
when
the
ASP
is
nearing
capacity
with
the
specified
percent
value.
The
percent
used
remains
above
the
threshold
value
for
several
hours.
Consider
adding
storage
to
the
ASP,
or
archiving
or
removing
objects
that
are
no
longer
needed.
The
indication
contains
the
following
attributes:
ASPInstance
The
instance
monitored
Total
available
MBytes
percentage
The
percent
value
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Total
Available
MBytes
Percentage
Threshold
(totalAvailableMBytes
PercentageThreshold)
This
threshold
indicates
a
percent
value
above
which
the
specified
ASPInstance
is
nearing
capacity.
90
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
4
Occurrences
32
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
4.
OS/400
resource
models
203
ASP
Overflow
This
indication
is
sent
when
the
ASP
overflowed
to
the
system
ASP.
Consider
adding
storage
to
the
ASP,
or
archiving
or
removing
objects
that
are
no
longer
needed.
The
indication
contains
the
following
attributes:
ASPInstance
The
instance
monitored
overflowStorageMBytes
The
amount
of
overflow
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
204
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
ASP
Utilization
resource
model.
Parameter
Description
Parameter
Type
Auxiliary
Storage
Pools
(ASPs)
The
ASP
instances.
You
can
enter
one
or
more
numbers
as
enumeration
parameters,
or
can
enter
the
string
’*ALL’
to
enumerate
all
ASPs.
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
ASP
Utilization
ASPInstance
The
instance
monitored
overflowStorageMBytes
The
amount
of
overflow
totalAvailableMBytesPercentage
The
percent
value
above
which
the
specified
ASP
instance
is
nearing
capacity
Chapter
4.
OS/400
resource
models
205
Basic
Average
CPU
Utilization
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
This
resource
model
monitors
the
overall
CPU
utilization
of
the
system.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
BasicCPU400
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Basic
Average
CPU
Utilization
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
BasicCPUUtilizationGuidelineExceeded
Basic
CPU
Utilization
Guideline
Exceeded
Warning
206
BasicCPUUtilizationGuidelineLongRunning
Exceeded
Basic
CPU
Utilization
Guideline
Long
Running
Exceeded
Warning
207
BasicCPUUtilizationPeakExceeded
Basic
CPU
Utilization
Peak
Exceeded
Warning
208
BasicCPUUtilizationPeakLongRunning
Exceeded
Basic
CPU
Utilization
Peak
Long
Running
Exceeded
Warning
209
Basic
CPU
Utilization
Guideline
Exceeded
This
indication
is
sent
when
the
overall
CPU
utilization
is
over
its
guideline
value
for
more
than
an
hour.
Investigate
adding
CPU
resources
or
determining
if
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
peak
processing
demands.
The
indication
contains
the
following
attribute:
basicAverageCPUPct
The
percent
value.
206
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Overall
CPU
Utilization
Guideline
Double
Processor
Threshold
(CPUUtilizationGuideline
DoubleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
double
processor
system.
88
Overall
CPU
Utilization
Guideline
Multiple
Processor
Threshold
(CPUUtilizationGuideline
MultipleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
multiple
processor
system.
95
Overall
CPU
Utilization
Guideline
Single
Processor
Threshold
(CPUUtilizationGuideline
SingleProcessorThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
single
processor
system.
85
Overall
CPU
Utilization
Guideline
Triple
Processor
Threshold
(CPUUtilizationGuideline
TripleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
triple
processor
system.
91
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
CPU
Utilization
Guideline
Long
Running
Exceeded
This
indication
is
sent
when
the
overall
CPU
utilization
is
over
its
guideline
value
for
several
hours.
Investigate
adding
CPU
resources
or
determining
if
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
peak
processing
demands.
The
indication
contains
the
following
attribute:
basicAverageCPUPct
The
percent
value.
Chapter
4.
OS/400
resource
models
207
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Overall
CPU
Utilization
Guideline
Double
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
DoubleProcessorLong
RunningThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
double
processor
system.
85
Overall
CPU
Utilization
Guideline
Multiple
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
MultipleProcessorLong
RunningThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
multiple
processor
system.
93
Overall
CPU
Utilization
Guideline
Single
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
SingleProcessorLong
RunningThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
single
processor
system.
80
Overall
CPU
Utilization
Guideline
Triple
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
TripleProcessorLong
RunningThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
triple
processor
system.
89
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
20
Occurrences
180
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
CPU
Utilization
Peak
Exceeded
This
indication
is
sent
when
the
overall
CPU
utilization
is
over
its
threshold
value
for
more
than
an
hour.
Investigate
adding
CPU
resources
or
determining
if
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
processing
demands.
The
indication
contains
the
following
attribute:
basicAverageCPUPct
The
percent
value.
208
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Overall
CPU
Utilization
Peak
Double
Processor
Threshold
(CPUUtilizationPeak
DoubleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
double
processor
system.
96
Overall
CPU
Utilization
Peak
Multiple
Processor
Threshold
(CPUUtilizationPeak
MultipleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
multiple
processor
system.
99
Overall
CPU
Utilization
Peak
Single
Processor
Threshold
(CPUUtilizationPeakSingle
ProcessorThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
single
processor
system.
94
Overall
CPU
Utilization
Peak
Triple
Processor
Threshold
(CPUUtilizationPeak
TripleProcessor
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
triple
processor
system.
97
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
CPU
Utilization
Peak
Long
Running
Exceeded
This
indication
is
sent
when
the
overall
CPU
utilization
is
over
its
threshold
value
for
several
hours.
Investigate
adding
CPU
resources
or
determining
if
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
processing
demands.
The
indication
contains
the
following
attribute:
basicAverageCPUPct
The
percent
value.
Chapter
4.
OS/400
resource
models
209
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Overall
CPU
Utilization
Peak
Double
Processor
Long
Running
Threshold
(CPUUtilizationPeak
DoubleProcessorLong
RunningThreshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
double
processor
system.
93
Overall
CPU
Utilization
Peak
Multiple
Processor
Long
Running
Threshold
(CPUUtilizationPeak
MultipleProcessorLong
Running
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
multiple
processor
system.
97
Overall
CPU
Utilization
Peak
Single
Processor
Long
Running
Threshold
(CPUUtilizationPeak
SingleProcessorLong
Running
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
single
processor
system.
90
Overall
CPU
Utilization
Peak
Triple
Processor
Long
Running
Threshold
(CPUUtilizationPeak
TripleProcessorLong
Running
Threshold)
Overall
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
triple
processor
system.
95
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
20
Occurrences
180
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
BasicCPU
Utilization
basicAverageCPUPct
The
percent
value
numOfProcessors
The
number
of
processors
spare
A
key
property
210
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Basic
Interactive
CPU
Utilization
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
the
basic
interactive
CPU
utilization
of
the
system.
This
should
only
be
used
on
system
models
which
support
the
interactive
CPU
metric.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
BasicInteractiveCPU400
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Basic
Interactive
CPU
Utilization
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
BasicInteractiveCPUUtilizationGuideline
Exceeded
Basic
Interactive
CPU
Utilization
Guideline
Exceeded
Warning
211
BasicInteractiveCPUUtilizationGuidelineLong
RunningExceeded
Basic
Interactive
CPU
Utilization
Guideline
Long
Running
Exceeded
Warning
212
BasicInteractiveCPUUtilizationPeakExceeded
Basic
Interactive
CPU
Utilization
Peak
Exceeded
Warning
213
BasicInteractiveCPUUtilizationPeakLong
RunningExceeded
Basic
Interactive
CPU
Utilization
Peak
Long
Running
Exceeded
Warning
214
Basic
Interactive
CPU
Utilization
Guideline
Exceeded
This
indication
is
sent
when
the
interactive
CPU
utilization
is
over
its
guideline
value
for
more
than
an
hour.
Investigate
adding
interactive
CPU
resources
or
determining
if
interactive
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
interactive
processing
demands.
The
indication
contains
the
following
attribute:
Chapter
4.
OS/400
resource
models
211
basicInteractiveCPUPct
The
percent
value.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Interactive
CPU
Utilization
Guideline
Double
Processor
Threshold
(CPUUtilizationGuideline
DoubleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
double
processor
system.
71
Interactive
CPU
Utilization
Guideline
Multiple
Processor
Threshold
(CPUUtilizationGuideline
MultipleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
multiple
processor
system.
86
Interactive
CPU
Utilization
Guideline
Single
Processor
Threshold
(CPUUtilizationGuideline
SingleProcessorThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
single
processor
system.
56
Interactive
CPU
Utilization
Guideline
Triple
Processor
Threshold
(CPUUtilizationGuideline
TripleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
triple
processor
system.
81
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
Interactive
CPU
Utilization
Guideline
Long
Running
Exceeded
This
indication
is
sent
when
the
interactive
CPU
utilization
is
over
its
guideline
value
for
several
hours.
Investigate
adding
interactive
CPU
resources
or
determining
if
interactive
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
an
interactive
CPU
utilization
can
result
in
the
inability
to
meet
peak
interactive
processing
demands.
The
indication
contains
the
following
attribute:
212
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
basicInteractiveCPUPct
The
percent
value.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Interactive
CPU
Utilization
Guideline
Double
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
DoubleProcessorLong
RunningThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
double
processor
system.
60
Interactive
CPU
Utilization
Guideline
Multiple
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
MultipleProcessorLong
RunningThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
multiple
processor
system.
75
Interactive
CPU
Utilization
Guideline
Single
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
SingleProcessorLong
RunningThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
single
processor
system.
45
Interactive
CPU
Utilization
Guideline
Triple
Processor
Long
Running
Threshold
(CPUUtilizationGuideline
TripleProcessorLong
RunningThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
guideline
with
a
triple
processor
system.
70
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
20
Occurrences
180
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
Interactive
CPU
Utilization
Peak
Exceeded
This
indication
is
sent
when
the
interactive
CPU
utilization
is
over
its
threshold
value
for
more
than
an
hour.
Investigate
adding
interactive
CPU
resources
or
determining
if
interactive
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
a
CPU
utilization
can
result
in
the
inability
to
meet
interactive
processing
demands.
The
indication
contains
the
following
attribute:
Chapter
4.
OS/400
resource
models
213
basicInteractiveCPUPct
The
percent
value.
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Interactive
CPU
Utilization
Peak
Double
Processor
Threshold
(CPUUtilizationPeak
DoubleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
double
processor
system.
83
Interactive
CPU
Utilization
Peak
Multiple
Processor
Threshold
(CPUUtilizationPeak
MultipleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
multiple
processor
system.
94
Interactive
CPU
Utilization
Peak
Single
Processor
Threshold
(CPUUtilizationPeakSingle
ProcessorThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
single
processor
system.
70
Interactive
CPU
Utilization
Peak
Triple
Processor
Threshold
(CPUUtilizationPeak
TripleProcessor
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
triple
processor
system.
91
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Basic
Interactive
CPU
Utilization
Peak
Long
Running
Exceeded
This
indication
is
sent
when
the
overall
interactive
CPU
utilization
is
over
its
threshold
value
for
several
hours.
Investigate
adding
interactive
CPU
resources
or
determining
if
interactive
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
an
interactive
CPU
utilization
can
result
in
the
inability
to
meet
interactive
processing
demands.
The
indication
contains
the
following
attribute:
basicInteractiveCPUPct
The
percent
value.
214
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
This
indication
is
dependent
on
the
following
thresholds:
Threshold
Description
Default
Interactive
CPU
Utilization
Peak
Double
Processor
Long
Running
Threshold
(CPUUtilizationPeak
DoubleProcessorLong
RunningThreshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
double
processor
system.
75
Interactive
CPU
Utilization
Peak
Multiple
Processor
Long
Running
Threshold
(CPUUtilizationPeak
MultipleProcessorLong
Running
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
multiple
processor
system.
90
Interactive
CPU
Utilization
Peak
Single
Processor
Long
Running
Threshold
(CPUUtilizationPeak
SingleProcessorLong
Running
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
single
processor
system.
60
Interactive
CPU
Utilization
Peak
Triple
Processor
Long
Running
Threshold
(CPUUtilizationPeak
TripleProcessorLong
Running
Threshold)
Interactive
CPU
utilization
threshold
to
verify
whether
the
CPU
utilization
is
over
the
peak
with
a
triple
processor
system.
85
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
20
Occurrences
180
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Chapter
4.
OS/400
resource
models
215
Resource
Context
Properties
InteractiveCPU
Utilization
basicInteractiveCPUPct
The
percent
value
numOfProcessors
The
number
of
processors
spare
A
key
property
216
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Configuration
Objects
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
This
resource
model
monitors
the
status
of
configuration
objects.
The
user
can
enter
one
or
more
configuration
object
name
and
type
pairs.
During
each
cycle,
the
resource
model
monitors
the
status
of
each
object.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
ConfigurationObjects400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
configuration
objects
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
ConfigurationObjectNotActive
Configuration
Object
Not
Active
Warning
217
Configuration
Object
Not
Active
This
indication
is
sent
when
the
configuration
object
is
not
active.
Investigate
whether
the
this
indication
is
intentionally
varied
off,
or
if
there
is
a
problem
with
the
indication,
such
as
an
associated
configuration
object.
For
example,
a
line
might
not
be
active
because
its
controller
is
not
active.
The
indication
contains
the
following
attribute:
cfgObjectName
The
configuration
object
name
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Chapter
4.
OS/400
resource
models
217
Setting
Default
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Configuration
Objects
resource
model.
Parameter
Description
Parameter
Type
Configuration
Objects
(ConfigurationObjects)
The
configuration
object
name
and
type
separated
by
a
comma.
One
or
more
parameter
strings
of
name,type
are
allowed.
where:
name
Is
the
name
consisting
of
a
10--character
maximum
string.
The
text
string
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
type
The
following
types
are
valid:
v
CTL
-
Controller
v
DEV
-
device
v
LIN
-
line
v
NWI
-
network
interface
v
NWS
-
network
server
The
following
parameter
string
example
of
will
check
all
line
configuration
objects:
*,lin
String
list
218
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Database
CPU
Utilization
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
The
Database
CPU
Utilization
resource
model
checks
if
the
system
is
exceeding
its
limit
for
database
CPU
utilization.
This
metric
is
only
supported
on
specific
models
hardware.
If
the
Database
CPU
threshold
is
100,
then
there
is
no
limit
on
the
system.
These
checks
are
for
systems
which
have
a
database
CPU
threshold
limit
less
than
100.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
DatabaseCPUUtilization400
Parameters
No
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Database
CPU
Utilization
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
DatabaseCPUUtilizationExceeded
Database
CPU
Utilization
Exceeded
Warning
219
Database
CPU
Utilization
Exceeded
This
indication
is
sent
when
Database
CPU
utilization
is
over
its
threshold
value
for
over
an
hour.
Investigate
adding
database
CPU
resources
or
determining
if
jobs
are
using
more
database
CPU
than
normally
required.
Having
a
too
high
of
a
database
CPU
utilization
can
result
in
the
inability
to
meet
processing
demands.
The
indication
contains
the
following
attribute:
databaseCapabilityCPUPct
The
percent
value
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Chapter
4.
OS/400
resource
models
219
Setting
Default
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
DatabaseCPU
Utilization
databaseCapabilityCPUPct
The
percent
value
databaseThresholdPct
The
database
CPU
threshold
limit
spare
A
key
property
220
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Distribution
Queues
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
The
Distribution
Queues
resource
model
monitors
the
status
of
the
high
and
normal
priority
service
levels
for
distribution
queues.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
900
seconds
Internal
name
DistributionQueues400
Parameters
Yes
Thresholds
No
Note:
This
resource
model
should
have
a
cycle
time
of
at
least
several
minutes.
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Distribution
Queues
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
HighPriorityDistributionQueueNotActive
High
Priority
Service
Level
is
not
Active
Warning
221
NormalPriorityDistributionQueueNotActive
Normal
Priority
Distribution
Queue
Not
Active
Warning
222
High
Priority
Distribution
Queue
Not
Active
This
indication
is
sent
when
the
high
priority
service
level
for
the
distribution
queue
is
not
active.
The
indication
contains
the
following
attributes:
distributionQueueName
The
name
of
the
distribution
queue
statusHighPriority
The
status
of
the
high
priority
service
level
The
following
table
shows
the
default
settings
for
this
indication:
Chapter
4.
OS/400
resource
models
221
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Normal
Priority
Distribution
Queue
Not
Active
This
indication
is
sent
when
the
normal
priority
service
level
for
the
distribution
queue
is
not
active.
The
indication
contains
the
following
attributes:
distributionQueueName
The
name
of
the
distribution
queue
statusNormalPriority
The
status
of
the
normal
priority
service
level
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Distribution
Queues
resource
model.
Parameter
Description
Parameter
Type
Distribution
Queue
Names
(DistributionQueues)
The
name
of
the
distribution
queues
to
monitor.
You
can
enter
one
or
more
name
strings
containing
a
maximum
of
10
characters
each.
The
name
strings
can
contain
the
asterisk
(*)
or
the
question
mark
(?)
wildcard
characters.
String
list
222
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
History
Log
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
finds
specific
messages
in
the
history
log.
The
history
log
contains
many
status
and
error
messages
from
the
system.
To
compare
history
log
entries,
enter
message
numbers
and
text
strings
as
parameters.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
No
Default
cycle
time
600
seconds
Internal
name
HistoryLog400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
History
Log
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
ListOfJobsNotEmpty
List
Of
Jobs
Not
Empty
Warning
223
List
Of
Jobs
Not
Empty
This
indication
is
sent
when
the
list
of
jobs
is
not
empty.
One
or
more
jobs
have
written
messages
to
the
history
log.
The
input
message
ID
and
test
string
match
one
or
more
entries
in
the
history
log.
The
job
names
are
included
in
the
event.
Investigate
why
the
jobs
issued
the
messages.
The
indication
contains
the
following
attribute:
ListOfJobs
The
list
of
jobs
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Chapter
4.
OS/400
resource
models
223
Setting
Default
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
History
Log
resource
model.
Parameter
Description
Parameter
Type
Message
Match
Parameters
(MatchParms)
The
message
ID
and
text
string
pairs
to
match
against
history
log
entries.
The
format
for
each
parameter
is
as
follows:
message_ID,pattern_to_match
where:
message_ID
Message
ID
is
a
maximum
of
7
characters.
The
ID
can
contain
the
ampersand
(*)
or
question
mark
(?)
wildcard
characters.
pattern_to_match
The
pattern
to
match
is
a
maximum
of
100
characters
and
can
contain
the
ampersand
(*)
or
question
mark
(?)
wildcard
characters.
The
pattern
will
match
when
found
anywhere
in
the
message
text.Note:
The
message
text
in
the
history
log
records
on
OS/400
systems
appears
in
the
primary
language
of
the
system.
The
match
parameter
text
must
also
be
in
that
language.
String
list
224
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Interactive
Feature
CPU
Utilization
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
checks
if
the
system
is
exceeding
its
limit
for
Interactive
Feature
CPU
utilization.
This
is
supported
only
on
certain
OS/400
systems.
If
the
Interactive
Feature
CPU
threshold
is
100,
then
there
is
no
limit
on
the
system.
These
checks
are
for
systems
which
have
an
Interactive
Feature
CPU
threshold
limit
less
than
100.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
300
seconds
Internal
name
InteractiveFeatureCPUUtilization400
Parameters
No
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Interactive
Feature
CPU
Utilization
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
InteractiveFeatureCPUUtilizationExceeded
Interactive
Feature
CPU
Utilization
Exceeded
Warning
225
Interactive
Feature
CPU
Utilization
Exceeded
This
indication
is
sent
when
the
Interactive
Feature
CPU
utilization
is
over
its
threshold
value
for
over
an
hour.
Investigate
adding
Interactive
Feature
CPU
resources
or
determining
if
interactive
jobs
are
using
more
CPU
than
normally
required.
Having
too
high
of
an
Interactive
Feature
CPU
utilization
can
result
in
the
inability
to
meet
processing
demands.
The
indication
contains
the
following
attribute:
basicInteractiveCPUPct
The
percent
value
The
following
table
shows
the
default
settings
for
this
indication:
Chapter
4.
OS/400
resource
models
225
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
10
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
InteractiveFeature
CPU
Utilization
basicInteractiveCPUPct
The
percent
value
interactiveThresholdPct
The
threshold
limit
spare
A
key
property
226
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Job
Log
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
checks
a
job’s
job
log
for
specific
messages.
The
parameters
contain
the
message
numbers
and
text
strings
to
match.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
No
Default
cycle
time
600
seconds
Internal
name
JobLog400
Parameters
Yes
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
job
log
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
JobLogWarningMessage
Job
Log
Warning
Message
Warning
227
Job
Log
Warning
Message
This
indication
is
sent
when
a
job
issues
warning
messages
to
its
job
log.
The
input
message
ID
and
test
string
matches
one
or
more
entries
in
the
job’s
log.
The
job
name
is
included
in
the
event.
Investigate
why
the
job
issued
the
message.
The
indication
contains
the
following
attributes:
JobName
The
name
of
the
job.
MessageID
The
message
ID.
MessageText
The
text
of
the
message.
Chapter
4.
OS/400
resource
models
227
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Number
of
matches
threshold
(numOfMatchesThreshold)
This
threshold
indicates
the
number
of
matches
above
which
the
job
log
warning
message
is
sent.
1
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Job
Log
resource
model.
Parameter
Description
Parameter
Type
Matching
Parameters
(MatchParms)
The
message
ID
and
text
string
pairs
to
match.
The
format
for
each
parameter
is
as
follows:
message_ID,pattern_to_match
where:
message_ID
Message
ID
is
a
maximum
of
7
characters.
The
ID
can
contain
the
ampersand
(*)
or
question
mark
(?)
wildcard
characters.
pattern_to_match
The
pattern
to
match
is
a
maximum
of
100
characters
and
can
contain
the
ampersand
(*)
or
question
mark
(?)
wildcard
characters.
The
pattern
will
match
when
found
anywhere
in
the
message
text.
The
pattern
will
match
if
it
is
found
anywhere
in
the
message
text.
Note:
The
message
text
in
the
job
log
entries
on
OS/400
systems
appears
in
the
primary
language
of
the
system.
The
match
parameter
text
must
also
be
in
that
language.
String
list
228
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Parameter
Description
Parameter
Type
Job
Names
(JobNames)
One
or
more
OS/400
job
names
where
jobs
will
be
queried
to
search
their
logs.
The
parameter
format,
with
optional
items
in
brackets,
is
as
follows:
[subsystem_library/]
subsystem_name,
job_name,
job_user,
[job_number]
where:
job_name
The
job
name.
The
job
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
job_number
The
job
number.
The
default
value
is
the
asterisk
(*)
wildcard
character
and
returns
all
valid
job
numbers.
The
job
number
can
contain
a
maximum
of
6
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
job_user
The
job
user.
The
job
user
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
subsystem_library
The
subsystem
library
name.
The
default
value
is
the
QSYS
library.
The
subsystem
library
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
subsystem_name
The
subsystem
name.
The
subsystem
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
String
list
Chapter
4.
OS/400
resource
models
229
Job
Queue
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
This
resource
model
monitors
that
one
or
more
job
queues,
which
have
jobs
queued
to
them,
are
assigned
to
a
subsystem
so
that
the
jobs
can
be
started.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
1800
seconds
Internal
name
JobQueue400
Parameters
Yes
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Job
Queue
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
JobQueueNotActive
Job
Queue
Not
Active
Warning
230
JobQueueNotAssigned
Job
Queue
Not
Assigned
Warning
231
TooManyJobsQueued
Too
Many
Jobs
Queued
Warning
231
Job
Queue
Not
Active
This
indication
is
sent
when
a
job
queue
is
not
active.
Investigate
why
the
job
queue
is
not
active,
such
as
the
job
queue
never
started
or
was
held.
The
indication
contains
the
following
attributes:
jobQueueName
The
name
of
the
job
queue.
jobQueueStatus
The
status
of
the
job
queue.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
230
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Job
Queue
Not
Assigned
This
indication
is
sent
when
the
job
queue
contains
a
number
of
jobs
to
run
but
is
not
assigned
to
a
subsystem.
Investigate
if
the
job
queue
should
be
assigned
to
a
subsystem
so
that
the
jobs
can
be
started.
The
indication
contains
the
following
attribute:
jobQueueName
The
name
of
the
job
queue.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Too
Many
Jobs
Queued
This
indication
is
sent
when
a
job
queue
contains
more
than
the
threshold
number
of
jobs
queued.
Investigate
if
the
job
queue
is
running
properly
and
confirm
that
the
overall
system
is
running
properly.
The
indication
contains
the
following
attributes:
jobQueueName
The
name
of
the
job
queue.
numberOfJobs
The
number
of
jobs.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Maximum
number
of
allowed
queued
jobs
(MaxAllowedQueuedJobs
Threshold)
This
threshold
indicates
the
maximum
number
of
allowed
queued
jobs
in
a
job
queue.
5
The
following
table
shows
the
default
settings
for
this
indication:
Chapter
4.
OS/400
resource
models
231
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Job
Queue
resource
model.
Parameter
Description
Parameter
Type
Job
queues
to
be
monitored
(JobQueues)
Job
queues
to
be
monitored.
Enter
the
library
and
name
of
the
job
queues
to
be
monitored.
The
format
for
this
parameter
is
as
follows:
library/name
library
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
name
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
The
following
example
finds
all
job
queues
using
wildcard
characters:
*/*
String
list
232
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Job
Status
Events
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
job
status.
Given
a
list
of
job
names,
it
sends
an
event
if
any
of
the
jobs
are
not
active.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
120
seconds
Internal
name
JobStatus400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Job
Status
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
JobNotActive
Job
Not
Active
Warning
233
Job
Not
Active
This
indication
is
sent
when
a
job
is
not
active.
The
indication
contains
the
following
attribute:
jobName
The
name
of
the
job.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Chapter
4.
OS/400
resource
models
233
Setting
Default
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Job
Status
resource
model.
Parameter
Description
Parameter
Type
Job
Names
(Jobs)
The
list
of
jobs
to
be
monitored.
The
correct
format
for
Job
Names
is
as
follows:
[subsystem_library
/]
subsystem_name,
job_name,job_user,[job_number]
where:
job_name
The
job
name.
The
job
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
job_number
The
job
number.
The
default
value
is
the
asterisk
(*)
wildcard
character
and
returns
all
valid
job
numbers.
The
job
number
can
contain
a
maximum
of
6
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
job_user
The
job
user.
The
job
user
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
subsystem_library
The
subsystem
library
name.
The
default
value
is
the
QSYS
library.
The
subsystem
library
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
subsystem_name
The
subsystem
name.
The
subsystem
name
can
contain
a
maximum
of
10
characters,
including
the
asterisk
(*)
and
question
mark
(?)
wildcard
characters.
String
list
234
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Management
Central
Events
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
all
Management
Central
events
and
forwards
them
to
the
IBM
Tivoli
Enterprise
Console
event
console.
Distribute
this
resource
model
to
each
system
used
by
Management
Central
to
manage
OS/400
endpoints.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
No
Default
cycle
time
300
seconds
Internal
name
ManagementCentralEvent400
Parameters
No
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Management
Central
Events
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
ManagementCentralCritical
Management
Central
Critical
Critical
235
ManagementCentralHarmless
Management
Central
Harmless
Harmless
236
ManagementCentralUnknown
Management
Central
Unknown
Minor
236
ManagementCentralWarning
Management
Central
Warning
Warning
236
Management
Central
Critical
This
indication
is
sent
when
a
management
critical
central
event
is
detected.
The
indication
contains
the
following
attribute:
event
The
event.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Chapter
4.
OS/400
resource
models
235
Setting
Default
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Critical
Management
Central
Harmless
This
indication
is
sent
when
a
management
harmless
central
event
is
detected.
The
indication
contains
the
following
attribute:
event
The
event.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Harmless
Management
Central
Unknown
This
indication
is
sent
when
an
unknown
management
central
event
is
detected.
The
indication
contains
the
following
attribute:
event
The
event.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
Management
Central
Warning
This
indication
is
sent
when
a
management
warning
central
event
is
detected.
The
indication
contains
the
following
attribute:
event
The
event.
The
following
table
shows
the
default
settings
for
this
indication:
236
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Clearing
Event
No
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Chapter
4.
OS/400
resource
models
237
Network
Attributes
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
This
resource
model
monitors
network
attributes.
The
user
provides
one
or
more
network
attribute
names
along
with
a
corresponding
value.
During
each
cycle,
the
resource
model
monitors
that
the
network
attribute’s
value
is
equal
to
its
desired
value.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
43200
seconds
Internal
name
NetworkAttributes400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Network
Attributes
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
NetworkAttributeMismatch
Network
Attribute
Mismatch
Warning
238
Network
Attribute
Mismatch
This
indication
is
sent
when
the
network
attribute
is
not
currently
set
as
desired.
Investigate
why
the
network
attribute
changed
and
if
it
should
be
changed
back
to
the
desired
value.
The
indication
contains
the
following
attributes:
expectedValue
The
value
desired
for
the
network
attribute.
networkAttributeName
The
name
of
the
network
attribute.
valueMetric
The
actual
value.
The
following
table
shows
the
default
settings
for
this
indication:
238
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Network
Attributes
resource
model.
Parameter
Description
Parameter
Type
Network
Attribute
Names
(AttributeNames)
The
list
of
network
attribute
names.
The
full
name
of
each
attribute
must
be
used
with
no
wildcard
characters.
String
list
Network
Attribute
Values
(AttributeValues)
The
list
of
network
attribute
values
to
be
compared
against
the
monitored
resource’s
value.
This
parameter
value
is
associated
with
the
respective
attribute
name
in
its
parameter
list.
For
example,
the
first
value
in
this
parameter
list
is
compared
against
the
current
value
of
the
first
attribute
in
the
name
list.
String
list
Chapter
4.
OS/400
resource
models
239
Output
Queues
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints..
This
resource
model
checks
if
the
output
queues
and
their
writers
are
active.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
900
seconds
Internal
name
OutputQueues400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Output
Queues
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
NoWritersStartedForOutputQueue
No
Writers
Started
For
Output
Queue
Minor
240
OutputQueueNotActive
Output
Queue
Not
Active
Minor
241
No
Writers
Started
For
Output
Queue
This
indication
is
sent
when
the
output
queue
contains
one
or
more
jobs
waiting,
but
no
writers
are
started
to
handle
the
jobs.
Assign
a
writer
or
find
out
if
the
jobs
should
be
removed.
The
indication
contains
the
following
attributes:
numberOfFiles
The
number
of
files
in
the
queue
numberStartedWriters
The
number
of
writers
handling
the
files
outputQueueName
The
name
of
the
output
queue
writerJobStatus
The
status
of
the
writer
The
following
table
shows
the
default
settings
for
this
indication:
240
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
Output
Queue
Not
Active
This
indication
is
sent
when
the
output
queue
contains
files
queued
but
it
is
not
active.
Verify
the
reason
the
queue
is
not
active,
or
why
it
contains
files
queued.
The
indication
contains
the
following
attributes:
currentStatus
The
status
of
the
output
queue
outputQueueName
The
name
of
the
output
queue
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Minor
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Output
Queues
resource
model.
Parameter
Description
Parameter
Type
Output
Queue
Library
and
Name
(OutputQueues)
The
library
and
name
for
the
output
queues
to
monitor.
The
format
is
as
follows:
library/name
library
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
name
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
String
list
Chapter
4.
OS/400
resource
models
241
Parametric
Object
and
Files
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
native
objects
and
files
for
owner,
size,
and
change
date.
The
object
or
file
can
be
in
the
QSYS
native
file
system
or
Integrated
File
System.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
1200
seconds
Internal
name
ParametricObjectAndFile400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Parametric
Object
and
File
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
LastChangedDateDifferent
Last
Changed
Date
Different
Warning
242
ObjectOwnerDifferent
Object
Owner
Different
Warning
243
ObjectSizeExceeded
Object
Size
Exceeded
Warning
243
Last
Changed
Date
Different
This
indication
is
sent
when
the
object
changed
since
the
input
parameter
date.
Investigate
why
the
object
changed.
The
indication
contains
the
following
attributes:
lastChangedDate
The
date
of
the
last
change.
objectName
The
name
of
the
object.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
242
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Object
Owner
Different
This
indication
is
sent
when
the
object’s
owner
does
not
match
the
input
parameter.
Investigate
why
the
object
owner
is
not
the
desired
owner.
The
indication
contains
the
following
attributes:
objectName
The
name
of
the
object.
objectOwner
The
owner
of
the
object.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Object
Size
Exceeded
This
indication
is
sent
when
the
object
size
is
larger
than
the
threshold
value.
Investigate
why
the
object
is
too
large.
The
indication
contains
the
following
attributes:
objectName
The
name
of
the
object.
objectSize
The
size
of
the
object.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Chapter
4.
OS/400
resource
models
243
Setting
Default
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Parametric
Object
and
File
resource
model.
You
must
specify
one
or
more
objects.
Parameter
Description
Parameter
Type
Last
Changed
Date
(LastChangedDate)
The
date
that
the
object
was
last
changed,
specified
by
zero
or
one.
The
following
example
shows
the
correct
format
for
the
date,
such
as
2003/10/17
for
October
17,
2003.
YYYY/MM/DD
where:
YYYY
the
four-digits
year
MM
the
two-digit
month
DD
the
two-digit
day
The
Last
Date
Changed
parameter
is
optional
and
wildcards
are
not
allowed.
The
value
of
this
parameter
is
used
to
compare
against
the
Object
Size
parameter
and
the
Object
Owner
parameter.
Numeric
Object
Names
(Objects)
One
or
more
fully-qualified
object
or
file
path
names.
For
example,
/mydir/myfile
for
Integrated
File
System
(IFS)
files,
or
/qsys.lib/mylib.lib/myfile.file
for
OS/400
QSYS
objects.
The
object
name
parameter
must
contain
at
least
one
value
and
can
contain
multiple
values
by
using
the
ampersand
(*)
or
question
mark
(?)
wildcard
characters.
String
list
Object
Owner
(ObjectOwner)
The
user
profile
name,
specified
by
zero
or
one.
The
Object
Owner
parameter
is
required
and
wildcards
are
not
allowed.
The
value
of
this
parameter
is
used
to
compare
against
the
Object
Size
parameter
(if
used).
Numeric
Object
size
(ObjectSize)
The
size
of
the
object,
specified
by
zero
or
one.
The
Object
Size
parameter
is
optional
and
wildcards
are
not
allowed.
The
value
of
this
parameter
is
used
to
compare
against
the
Object
Owner
parameter.
Numeric
Note:
If
a
file
or
object
is
not
found,
an
Object
Owner
Different
event
is
generated.
244
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Storage
Pools
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
and
logs
the
metrics
for
storage
pools.
This
resource
model
does
not
produce
events.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
No
Default
cycle
time
300
seconds
Internal
name
StoragePools400
Parameters
Yes
Thresholds
No
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Storage
Pools
resource
model.
Parameter
Description
Parameter
Type
Storage
Pool
Names
(StoragePools)
The
names
of
the
storage
pools.
The
format
for
storage
pool
names
can
be
a
maximum
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
The
names
are
system-defined
and
include
the
following:
v
BASE
v
INTERACT
v
MACHINE
v
SHRPOOL1
—
SHRPOOL60
v
SPOOL
String
list
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Chapter
4.
OS/400
resource
models
245
Resource
Context
Properties
StoragePool
Performance
activeToIneligibleTransitions
The
number
of
active
to
ineligible
transitions
activeToWaitTransitions
The
number
of
active
to
wait
transitions
activityLevel
The
activity
level
databaseFaults
The
number
of
database
faults
databasePages
The
number
of
database
pages
nonDatabaseFaults
The
number
of
non
database
faults
nonDatabasePages
The
number
of
non
database
pages
storagePoolName
The
name
of
the
storage
pool
totalSizeMBytes
The
total
size
waitToIneligibleTransitions
The
number
of
wait
to
ineligible
transitions
246
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Subsystem
Status
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
checks
the
status
of
a
list
of
subsystems
and
sends
an
event
if
there
is
a
subsystem
that
is
not
active.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
900
seconds
Internal
name
SubsystemStatus400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
Subsystem
Status
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
SubsystemNotActive
Subsystem
Not
Active
Warning
247
Subsystem
Not
Active
This
indication
is
sent
when
the
subsystem
is
not
active.
The
indication
contains
the
following
attribute:
sbsName
The
name
of
the
subsystem.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Chapter
4.
OS/400
resource
models
247
Setting
Default
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
Subsystem
Status
resource
model.
Parameter
Description
Parameter
Type
Subsystem
Names
(Subsystems)
The
list
of
subsystems
to
be
monitored.
The
parameter
format
is
as
follows:
library/name
library
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
name
Is
a
maximum
of
10
characters
and
can
contain
the
asterisk
(*)
or
question
mark
(?)
wildcard
characters.
String
list
248
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
System
Disk
Resources
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
system
disk
resources
for
system
and
ASP
utilization.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
900
seconds
Internal
name
SystemDiskResources400
Parameters
No
Thresholds
Yes
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
System
Disk
Resources
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
SystemASPUsedNearPeak
System
ASP
Used
Near
Peak
Guidelines
Warning
249
TotalAuxiliaryStorageReachedCapacity
Guidelines
Total
Auxiliary
Storage
Reached
Capacity
Guidelines
Warning
250
TotalAuxiliaryStorageReachedPeakCapacity
Guidelines
Total
Auxiliary
Storage
Reached
Peak
Capacity
Guidelines
Warning
251
System
ASP
Used
Near
Peak
Guidelines
This
indication
is
sent
when
the
system
ASP
is
nearing
its
peak
capacity
guidelines
for
percent
used.
The
percent
used
remains
above
the
threshold
value
for
several
hours.
Consider
adding
storage
to
the
system
ASP,
or
archiving
or
removing
objects
that
are
no
longer
needed.
The
indication
contains
the
following
attribute:
systemASPUsedPct
The
percent
value
of
used
System
ASP.
Chapter
4.
OS/400
resource
models
249
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
System
ASP
Used
Percent
Threshold
(SystemASPUsedPct
Threshold)
If
this
threshold
is
exceeded,
the
System
is
nearing
peak
capacity
guidelines.
90
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
4
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Total
Auxiliary
Storage
Reached
Capacity
Guidelines
This
indication
is
sent
when
the
total
auxiliary
storage
reaches
capacity
guidelines
for
percent
used.
The
percent
used
remains
above
the
threshold
value
for
several
hours.
Consider
adding
auxiliary
storage
to
the
system,
or
archiving
or
removing
objects
that
are
no
longer
needed.
The
indication
contains
the
following
attribute:
TotalAuxiliaryStorageAvailablePercent
The
percent
value
of
total
auxiliary
storage.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Total
Auxiliary
Storage
Available
Threshold
(TotalAuxiliaryStorage
AvailableThreshold)
If
this
threshold
is
exceeded,
the
total
auxiliary
storage
usage
reaches
capacity
guidelines.
20
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
2
Occurrences
30
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
250
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Total
Auxiliary
Storage
Reached
Peak
Capacity
Guidelines
This
indication
is
sent
when
the
total
auxiliary
storage
reaches
peak
capacity
guideline.
The
percent
used
remains
above
the
threshold
value
for
several
hours.
Add
auxiliary
storage
to
the
system,
or
archiving
or
removing
files
that
are
no
longer
needed.
The
indication
contains
the
following
attribute:
TotalAuxiliaryStorageAvailablePercent
The
percent
value
of
total
auxiliary
storage.
This
indication
is
dependent
on
the
following
threshold:
Threshold
Description
Default
Total
Auxiliary
Storage
Available
Peak
Threshold
(TotalAuxiliaryStorage
AvailablePeakThreshold)
If
this
threshold
is
exceeded,
the
total
auxiliary
storage
usage
reaches
peak
capacity
guidelines.
10
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
8
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Logging
The
following
table
shows
the
resource,
context
and
properties
for
which
data
can
be
logged:
Resource
Context
Properties
Disk
Utilization
spare
A
key
property
systemASPusedPct
The
percent
value
of
used
system
ASP
totalAuxiliaryStorageAvailablePercentage
The
percent
value
of
total
auxiliary
storage
Chapter
4.
OS/400
resource
models
251
System
Value
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
system
values,
it
sends
an
event
when
the
value
changes
from
its
desired
state.
This
resource
model
checks
to
ensure
the
system
value’s
value
is
equal
to
the
desired
value
in
each
cycle.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
43200
seconds
Internal
name
SystemValue400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
System
Value
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
SystemObjectMismatch
System
Object
Mismatch
Warning
252
System
Object
Mismatch
This
indication
is
sent
when
the
system
value
is
not
set
as
desired.
Investigate
why
the
system
value
changed
and
whether
it
should
be
changed
back
to
the
desired
value.
This
indication
contains
the
following
attributes:
expectedValue
The
desired
value.
systemValueName
The
name
of
the
system
value.
valueMetric
The
metric
of
the
value.
The
following
table
shows
the
default
settings
for
this
indication:
252
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
System
Value
resource
model.
Parameter
Description
Parameter
Type
System
Value
Names
(SystemValues)
The
System
Value
names
to
be
monitored.
The
full
System
Value
name
must
be
entered
with
no
wildcard
characters.
String
list
System
Value
Values
(SystemValueValues)
Values
to
be
used
to
verify
the
contents
of
a
specific
System
Value.
These
entries
must
be
in
the
same
order
as
their
respective
System
Value
name
parameters.
String
list
Chapter
4.
OS/400
resource
models
253
TCP
Interface
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
the
status
of
one
or
more
TCP
interfaces.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
600
seconds
Internal
name
TCPInterface400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
TCP
Interface
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TCPInterfaceNotActive
TCP
Interface
Not
Active
Warning
254
TCP
Interface
Not
Active
This
indication
is
sent
when
the
TCP
interface
is
not
active.
Investigate
why
the
interface
did
not
start
or
why
the
interface
ended.
The
indication
contains
the
following
attribute:
interfaceName
The
interface
name.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
254
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
TCP
Interface
resource
model.
Parameter
Description
Parameter
Type
TCP
IP
Interfaces
(TCPIPInterfaces)
The
list
of
TCP
IP
interfaces
to
be
monitored.
Each
address
can
be
an
IP
address
or
host
name,
for
example,
9.5.1.2
or
name.mycompany.com.
Wildcard
characters
are
not
allowed
in
this
parameter.
The
user
can
optionally
enter
the
number
of
seconds
to
delay
waiting
for
the
connection
to
respond
separated
by
a
the
comma
character
(,)
from
the
TCP
address.
If
the
number
of
seconds
is
not
entered,
the
default
wait
time
is
3
seconds,
as
shown
in
the
following
example:
127.0.0.1,3
String
list
Chapter
4.
OS/400
resource
models
255
TCP
Service
resource
model
Description
Resource
model
distribution
Distribute
this
resource
model
to
OS/400
endpoints.
This
resource
model
monitors
the
TCP
service.
The
following
table
shows
the
key
characteristics
of
this
resource
model:
Resource
model
at
a
glance
Built-in
actions
No
Category
OS/400
Clearing
events
Yes
Default
cycle
time
600
seconds
Internal
name
TCPService400
Parameters
Yes
Thresholds
No
Indications
and
events
The
following
table
lists
the
events
that
can
be
generated
by
the
TCP
Service
resource
model,
the
name
of
the
indication
from
which
each
event
is
generated,
the
default
severity
of
the
event,
and
where
you
can
find
a
detailed
description
of
the
indication:
Event
Indication
Severity
Page
TCPServiceNotActive
TCP
Service
Not
Active
Warning
256
TCP
Service
Not
Active
This
indication
is
sent
when
the
TCP
Service
is
not
active.
Investigate
why
the
service
did
not
start
or
why
the
interface
ended.
The
indication
contains
the
following
attribute:
serviceName
The
service
name.
The
following
table
shows
the
default
settings
for
this
indication:
Setting
Default
Clearing
Event
Yes
Holes
0
Occurrences
1
Send
indications
to
IBM
Tivoli
Business
Systems
Manager
No
Send
indications
to
IBM
Tivoli
Enterprise
Console
Yes
256
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Setting
Default
Severity
Warning
Parameters
The
following
table
lists
the
parameters
that
can
be
set
for
the
TCP
Service
resource
model.
Parameter
Description
Parameter
Type
TCP
IP
Services
(TCPIPServices)
One
or
more
pairs
of
TCP
addresses
and
service
names,
separated
by
a
comma.
The
TCP
address
can
be
an
IP
address
or
host
name.
For
example,
name.mycompany.com
or
9.5.1.2.
The
service
name
can
be
a
number,
such
as
a
port
number,
or
the
full
service
name.
No
wildcards
are
allowed
in
either
item.
String
list
Chapter
4.
OS/400
resource
models
257
258
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Appendix
A.
Windows
return
codes
for
built-in
actions
This
appendix
describes
the
return
codes
for
built-in
actions
for
resource
models
running
on
Windows-based
operating
systems.
The
following
table
lists
the
return
codes
by
category:
Return
Code
Category
See
Page
Common
to
all
built-in
actions
259
Built-in
actions
of
the
Event
Log
resource
model
only
260
Built-in
actions
of
the
Network
Interface
Card
resource
model
only
261
Built-in
actions
of
the
Service
resource
model
only
262
All
built-in
actions
The
return
codes
common
to
all
built-in
actions
are
as
follows:
RETURN
CODE
9
The
resource
model
does
not
implement
this
method.
RETURN
CODE
97
The
called
method
is
not
implemented
by
this
method
provider.
RETURN
CODE
98
It
was
not
possible
to
spawn
an
instance
of
the
output
parameters
of
the
called
method.
This
might
be
because
there
is
not
enough
memory.
RETURN
CODE
99
It
was
not
possible
to
get
the
definition
of
the
output
parameters
of
the
called
method.
259
Built-in
actions
of
the
event
log
resource
model
The
Event
Log
resource
model
contains
the
following
built-in
actions:
v
EnlargeIRPStackSize
action
v
DeleteRegistry
action
v
RaiseSessTimeOut
action
Enlarge
IRP
stack
size
action
The
return
codes
specific
to
the
EnlargeIRPStackSize
built-in
action
of
the
Event
Log
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
RETURN
CODE
1
An
error
occurred
while
accessing
the
system
registry.
RETURN
CODE
2
The
registry
key:
SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
IRPStackSize
was
not
updated
because
its
value
is
already
greater
than
the
suggested
value
of
12.
Delete
registry
action
The
return
codes
specific
to
the
DeleteRegistry
built-in
action
of
the
Event
Log
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
Raise
session
time
out
action
The
return
codes
specific
to
the
RaiseSessTimeOut
built-in
action
of
the
Event
Log
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
RETURN
CODE
1
The
registry
key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
SessTimeOut
was
not
updated
because
its
value
is
already
greater
than
the
maximum
suggested
value
of
70.
RETURN
CODE
2
The
registry
key:SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
SessTimeOut
was
not
found
in
the
registry,
it
was
created
and
its
value
was
set
to
55.
260
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Built-in
actions
of
the
network
interface
card
resource
model
The
Network
Interface
Card
resource
model
contains
the
following
built-in
actions:
v
AdjustInitWorkItems
action
v
AjustMaxWorkItems
action
Adjust
initial
work
items
action
The
return
codes
specific
to
the
AdjustInitWorkItems
built-in
action
of
the
Network
Interface
Card
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
RETURN
CODE
1
The
registry
key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Services\LanmanServer\Parameters\InitWorkItems
was
set
to
a
value
that
is
already
greater
than
the
suggested
value.
Adjust
maximum
work
items
action
The
return
codes
specific
to
the
AdjustMaxWorkItems
built-in
action
of
the
Network
Interface
Card
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
RETURN
CODE
1
The
registry
key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Services\LanmanServer\Parameters\MaxWorkItems
was
set
to
a
value
that
is
already
greater
than
the
suggested
value.
Appendix
A.
Windows
return
codes
for
built-in
actions
261
Built-in
actions
of
the
service
resource
model
The
Service
resource
model
contains
only
one
built-in
action,
the
RestartService
action.
Restart
service
action
The
return
codes
specific
to
the
RestartService
built-in
action
of
the
Service
resource
model
are
as
follows:
RETURN
CODE
0
The
action
was
successfully
executed.
RETURN
CODE
1
An
error
occurred
while
retrieving
the
input
parameters.
RETURN
CODE
2
Wrong
type
of
Input
Parameters.
RETURN
CODE
3
Unable
to
open
the
service
control
manager.
RETURN
CODE
4
Unable
to
open
the
service.
This
might
be
because
the
service
does
not
exist
on
the
target
machine.
RETURN
CODE
5
Unable
to
query
the
status
of
the
service.
RETURN
CODE
6
It
was
not
possible
to
start
the
service.
This
might
be
because
some
service
prerequisites
have
not
been
met.
RETURN
CODE
7
It
was
not
possible
to
start
the
service.
This
might
be
because
the
service
is
corrupted.
RETURN
CODE
8
It
was
not
possible
to
restart
the
service.
This
might
be
because
some
service
prerequisites
have
not
been
met.
262
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Appendix
B.
Windows
correlated
events
This
appendix
describes
all
correlated
events
and
the
indications
from
which
each
one
is
generated.
Correlated
events
are
only
generated
for
Windows
resource
models.
The
following
table
lists
the
correlated
events:
Correlated
Event
See
Page
Busy
Drive
from
High
Paging
264
Busy
Drive
from
Low
Avail
265
Congested
TCP
Network
266
Critically
Low
Disk
Space
267
Critical
Memory
Leak
268
Faulty
Disk
Subsystem
269
High
Disk
Read
Bytes
per
Second
270
High
Disk
Write
Bytes
per
Second
271
High
Drive
Transfer
Rate
272
High
Percent
Disk
Time
273
Possible
Disk
Fragmentation
274
Process
Hogging
CPU
275
Slow
Hard
Drive
276
263
Busy
drive
from
high
paging
The
TMW_BusyDriveFromPaging
indication
is
generated
from
the
following
indications:
v
TMW_HighLogicalPercentDiskTime
indication
from
the
Logical
Disk
resource
model
v
TMW_HighPaging
indication
from
the
Memory
resource
model
This
event
is
generated
when
it
is
determined
that
the
local
logical
disk
is
busy,
which
might
be
caused
by
excessive
hard-page
faulting.
TMW_BusyDriveFromPaging
contains
the
following
event
properties:
Disk
The
logical
disk
analyzed
PercentDiskTime
The
percentage
usage
of
the
logical
drive
PagesSec
The
number
of
pages
per
second
TotalAvail
The
total
of
available
memory
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
TotalCache
The
total
cache
size
in
bytes
Severity
The
default
value
is
warning
264
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Busy
drive
from
low
avail
The
TMW_BusyDriveFromLowAvail
indication
is
generated
from
the
following
indications:
v
TMW_LowAvailCausingManyProblems
indication
from
the
Memory
resource
model
v
TMW_HighLogicalPercentDiskTime
indication
from
the
Logical
Disk
resource
model
This
event
is
a
relatively
serious
event
because
it
indicates
not
only
that
the
local
disk
is
unusually
busy,
but
also
that
memory
is
low,
paging
is
high,
and
the
page
file
is
changing.
This
combination
will
ultimately
cause
a
core
dump
if
left
unchecked.
TMW_BusyDriveFromLowAvail
contains
the
following
event
properties:
Disk
The
logical
disk
analyzed
PercentDiskTime
The
percentage
usage
of
the
logical
drive
TotalAvail
The
total
of
available
memory
in
bytes
PageFaultsSec
The
current
value
for
page
faults
per
second
PagesSec
The
current
value
of
pages
per
second
CommittedBytes
The
current
total
of
committed
bytes
CommittedLimit
The
upper
limit
of
the
committed
bytes
Severity
The
default
value
is
critical
Appendix
B.
Windows
correlated
events
265
Congested
TCP
network
The
TMW_CongestedTCPNetwork
indication
is
generated
from
the
following
indications:
v
TMW_NICOverworked
indication
from
the
Network
Interface
Card
resource
model
v
TMW_SegmentsReXmit
indication
from
the
TCP/IP
resource
model
This
indicates
that
the
TCP/IP
network
segment
that
the
originating
machine
is
on
might
be
congested.
Congested
TCP
Network
is
generated
when
an
indication
of
an
overworked
Network
Interface
Card
and
a
high
amount
of
retransmitted
segments
are
sent.
TMW_CongestedTCPNetwork
contains
the
following
event
properties:
NetworkInterface
The
identity
of
network
interface
card
examined
SegmentsReXmitSec
The
number
of
segments
retransmitted
per
second
DGSec
The
number
of
datagrams
transmitted
per
second
SegmentsSec
The
number
of
segments
sent
per
second
FragsToDGRatio
Ratio
of
fragmented
datagrams
to
total
datagrams
OuputQueueLength
The
length
of
the
output
queue
NICBPS
The
bytes
per
second
transferred
through
the
network
interface
card
CurrentBandWidth
The
bandwidth
of
the
network
interface
card
Severity
The
default
value
is
warning
266
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Critically
low
disk
space
The
TMW_CriticallyLowDiskSpace
indication
is
generated
from
the
following
indications:
v
TMW_LowAvailCausingSoftPagePagefileResize
indication
from
the
Memory
resource
model
v
TMW_LowLogicalDiskSpace
indication
from
the
Logical
Disk
resource
model
This
indicates
that
disk
space
is
low,
and
it
might
soon
come
into
demand.
If
the
system
needs
additional
space
to
resize
a
pagefile,
and
the
logical
disk
where
the
pagefile
resides
is
low
on
space,
a
core
dump
can
occur.
TMW_CriticallyLowDiskSpace
contains
the
following
event
properties:
Disk
The
logical
disk
analyzed
PercentFreeSpace
The
percentage
amount
of
free
space
on
the
logical
drive
FreeMB
The
actual
size
of
free
space
on
the
logical
drive
in
Megabytes
CommittedBytes
The
current
total
of
Committed
Bytes
CommittedLimit
The
upper
limit
of
the
Committed
Bytes
TotalAvail
The
total
of
available
memory
in
bytes
PageFaultsSec
The
current
value
for
page
faults
per
second
Severity
The
default
value
is
critical
Appendix
B.
Windows
correlated
events
267
Critical
memory
leak
The
TMW_CriticalMemoryLeakInWS
indication
is
generated
from
the
following
indications:
v
TMW_MemoryLeakInPB
indication
from
the
Memory
resource
model
v
TMW_LowAvailHighWS
indication
from
the
Memory
resource
model
A
memory
leak
together
with
an
indication
of
low
available
memory
due
to
a
high
working
set
will
generate
this
event.
This
indicates
that
memory
is
low
and
will
soon
run
out.
TMW_CriticalMemoryLeakInWS
contains
the
following
event
properties:
LeakyProcess
The
process
with
the
memory
leak
IDLeakyProcess
The
numeric
ID
of
the
process
with
the
memory
leak
CurrentWorkingSet
The
current
working
set
of
the
process
CurrentPrivateBytes
The
current
private
bytes
of
the
process
TotalAvail
The
total
of
available
memory
in
bytes
TotalWorkingSet
The
total
working
set
size
in
bytes
TotalCache
The
total
cache
size
in
bytes
PercentAvail
The
percentage
of
available
memory
in
comparison
to
the
size
of
the
working
set
and
the
cache
PercentWS
The
percentage
of
working
set
memory
in
comparison
to
the
size
of
available
memory
and
the
cache
PercentCache
The
percentage
of
cache
memory
in
comparison
to
the
size
of
the
working
set
and
the
available
memory
IDHighWSProcess
The
numeric
ID
of
the
process
with
the
highest
working
set
NumProcesses
The
total
number
of
processes
HighWSProcess
The
working
set
of
the
process
with
the
highest
working
set
Severity
The
default
value
is
critical
268
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Faulty
disk
subsystem
The
TMW_FaultyDiskSubsystem
indication
is
generated
from
the
following
indications:
v
TMW_HighPhysicalPercentDiskTime
indication
from
the
Physical
Disk
resource
model
v
TMW_BusyHardware
indication
from
the
Processor
resource
model
v
TMW_HighLogicalPercentDiskTime
indication
from
the
Logical
Disk
resource
model
A
faulty
disk
subsystem
event
is
generated
when
a
disk
is
very
busy
both
in
terms
of
just
itself
and
how
busy
it
is
keeping
the
CPU.
Sometimes,
as
in
the
case
of
major
file
servers,
this
can
be
expected.
However,
for
most
machines,
an
extremely
busy
drive
over
an
extended
period
of
time
indicates
a
disk
or
controller
is
failing.
TMW_FaultyDiskSubsystem
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed
PhysicalDisk
The
physical
disk
analyzed
LogicalPercentDiskTime
The
percentage
usage
of
the
logical
drive
PhysicalPercentDiskTime
The
percentage
usage
of
the
physical
drive
Processor
The
identity
of
the
CPU
PercentProcessorTime
The
current
percentage
use
of
the
CPU
PercentInterruptTime
The
current
percentage
usage
of
the
CPU
as
it
handles
interrupt
requests
InterruptsSec
The
number
of
interrupts
per
second
that
are
passed
to
the
CPU
Severity
The
default
value
is
critical
Appendix
B.
Windows
correlated
events
269
High
disk
read
bytes
per
second
The
TMW_HighDiskReadBytesSec
indication
is
generated
from
the
following
indications:
v
TMW_HighPhysicalDiskReadBytesSec
indication
from
the
Physical
Disk
resource
model
v
TMW_HighLogicalDiskReadBytesSec
indication
from
the
Logical
Disk
resource
model
This
correlation
is
generated
when
a
high
read
bytes
per
second
is
indicated
in
both
the
logical
drive
and
the
physical
drive.
This
usually
indicates
that
bytes
per
second
read
from
the
physical
drive
is
high.
TMW_HighDiskReadBytesSec
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides
LogicalDiskReadBytes
The
number
of
bytes
read
per
second
on
the
logical
disk
PhysicalDiskReadBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
LogicalDiskReadSec
The
number
of
read
transactions
per
second
on
the
logical
disk
PhysicalDiskReadSec
The
number
of
read
transactions
per
second
on
the
physical
disk
LogicalPercentDiskRead
The
percentage
usage
of
the
logical
drive
during
a
read
operation
PhysicalPercentDiskRead
The
percentage
usage
of
the
physical
drive
during
a
read
operation
Severity
The
default
value
is
warning
270
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
disk
write
bytes
per
second
The
TMW_HighDiskWriteBytesSec
indication
is
generated
from
the
following
indications:
v
TMW_HighLogicalDiskWriteBytesSec
indication
from
the
Logical
Disk
resource
model
v
TMW_HighPhysicalDiskWriteBytesSec
indication
from
the
Physical
Disk
resource
model
This
correlation
is
generated
when
a
high
write
bytes
per
second
is
indicated
in
both
the
logical
drive
and
physical
drive.
This
usually
indicates
that
bytes
per
second
written
to
the
physical
drive
is
high.
TMW_HighDiskWriteBytesSec
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides
LogicalDiskWriteBytesSec
The
number
of
bytes
read
per
second
on
the
logical
disk
PhysicalDiskWriteBytesSec
The
number
of
bytes
read
per
second
on
the
physical
disk
LogicalDiskWriteSec
The
number
of
read
transaction
per
second
on
the
logical
disk
PhysicalDiskWriteSec
The
number
of
read
transaction
per
second
on
the
physical
disk
LogicalPercentDiskWrite
The
percentage
usage
of
the
logical
drive
during
a
write
operation
PhysicalPercentDiskWrite
The
percentage
usage
of
the
physical
drive
during
a
write
operation
Severity
The
default
value
is
warning
Appendix
B.
Windows
correlated
events
271
High
drive
transfer
rate
The
TMW_HighDriveXferRate
indication
is
generated
from
the
following
indications:
v
TMW_HighLogicalDiskXferRate
indication
from
the
Logical
Disk
resource
model
v
TMW_HighPhysicalDiskXferRate
indication
from
the
Physical
Disk
resource
model
This
correlation
is
generated
when
a
high
read
and
written
bytes
per
second
is
indicated
in
both
the
logical
drive
and
physical
drive.
This
usually
indicates
that
bytes
per
second
transferred
through
the
physical
drive
is
high.
TMW_HighDriveXferRate
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed.
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
LogicalDiskXfersSec
The
rate
of
bytes
transmitted
(read
or
write)
per
second
on
the
logical
disk.
PhysicalDiskXfersSec
The
rate
of
bytes
transmitted
(read
or
write)
per
second
on
the
physical
disk.
LogicalPercentDiskReadTime
The
percentage
usage
of
the
logical
drive
during
a
read
operation.
PhysicalPercentDiskReadTime
The
percentage
usage
of
the
physical
drive
during
a
read
operation.
Severity
The
default
value
is
warning.
272
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
High
percent
disk
time
The
TMW_HighPercentDiskTime
indication
is
generated
from
the
following
indications:
v
TMW_HighPhysicalPercentDiskTime
indication
from
the
Physical
Disk
resource
model
v
TMW_HighLogicalPercentDiskTime
indication
from
the
Logical
Disk
resource
model
This
correlation
is
generated
when
a
high
percentage
disk
time
is
indicated
in
both
the
logical
drive
and
physical
drive.
A
busy
physical
disk
is
the
most
likely
cause.
TMW_HighPercentDiskTime
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed.
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides.
LogicalPercentDiskTime
The
percentage
usage
of
the
logical
drive.
PhysicalPercentDiskTime
The
percentage
usage
of
the
physical
drive.
LogicalPercentReadTime
The
percentage
usage
of
the
logical
drive
during
a
read
operation.
PhysicalPercentReadTime
The
percentage
usage
of
the
physical
drive
during
a
read
operation.
LogicalPercentWriteTime
The
percentage
usage
of
the
logical
drive
during
a
write
operation.
PhysicalPercentWriteTime
The
percentage
usage
of
the
physical
drive
during
a
write
operation.
Severity
The
default
value
is
warning.
Appendix
B.
Windows
correlated
events
273
Possible
disk
fragmentation
The
TMW_PossibleFrag
indication
is
generated
from
the
following
indications:
v
TMW_LogicalPossibleFrag
indication
from
the
Logical
Disk
resource
model
v
TMW_PhysicalPossibleFrag
indication
from
the
Physical
Disk
resource
model
This
correlation
is
generated
when
a
possible
fragmentation
is
indicated
in
both
the
logical
drive
and
physical
drive.
It
signifies
that
there
is
possibly
some
fragmentation
on
the
physical
drive.
TMW_PossibleFrag
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed
PhysicalDisk
The
physical
disk
analyzed
LogicalPercentDiskTime
The
percentage
usage
of
the
logical
disk
PhysicalPercentDiskTime
The
percentage
usage
of
the
physical
disk
LogicalDiskBytesSec
The
transfer
rate
(both
read
and
write)
per
second
of
logical
disk
PhysicalDiskBytesSec
The
transfer
rate
(both
read
and
write)
per
second
of
physical
disk
Severity
The
default
value
is
minor
274
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Process
hogging
CPU
The
TMW_ProcessHoggingCPU
indication
is
generated
from
the
following
indications:
v
TMW_HighProcesses
indication
from
the
Processor
resource
model
v
TMW_ProcessHighCPU
indication
from
the
Process
resource
model
This
indication
is
generated
when
CPU
contains
a
high
percentage
utilization
and
one
or
more
processes
use
an
unusually
high
percentage
of
CPU.
TMW_ProcessHoggingCPU
contains
the
following
event
properties:
Process
The
name
of
the
active
process
with
the
highest
CPU
usage.
IDProcess
The
process
identity
(pid)
of
the
active
process
with
the
highest
CPU
usage.
Processor
The
CPU
examined.
PercentProcessorTime
The
total
percentage
usage
of
the
CPU.
PrcPercentUserTime
The
percentage
usage
of
the
CPU
used
by
the
process.
PrcPercentPriviledgedTime
The
percentage
privileged
time
of
the
CPU
used
by
the
process.
PrcPriorityBase
The
base
priority
of
the
process.
Severity
The
default
value
is
critical.
Appendix
B.
Windows
correlated
events
275
Slow
hard
drive
The
TMW_SlowHardDrive
indication
is
generated
from
the
following
indications:
v
TMW_SlowPhysicalDrive
indication
from
the
Physical
Disk
resource
model
v
TMW_SlowLogicalDrive
indication
from
the
Logical
Disk
resource
model
This
correlation
is
generated
when
a
slow
drive
is
indicated
in
both
the
logical
drive
and
the
physical
drive.
In
this
situation,
the
physical
hard
drive
is
possibly
too
slow.
TMW_SlowHardDrive
contains
the
following
event
properties:
LogicalDisk
The
logical
disk
analyzed
PhysicalDisk
The
physical
disk
on
which
the
logical
disk
resides
CurrentLogicalQLength
The
current
queue
length
for
the
logical
disk
CurrentPhysicalQLength
The
current
queue
length
for
the
physical
disk
PercentLogicalDiskTime
The
percentage
usage
of
the
logical
disk
PercentPhysicalDiskTime
The
percentage
usage
of
the
physical
disk
Severity
The
default
value
is
warning
276
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Notices
This
information
was
developed
for
products
and
services
offered
in
the
U.S.A.
IBM
may
not
offer
the
products,
services,
or
features
discussed
in
this
document
in
other
countries.
Consult
your
local
IBM
representative
for
information
on
the
products
and
services
currently
available
in
your
area.
Any
reference
to
an
IBM
product,
program,
or
service
is
not
intended
to
state
or
imply
that
only
that
IBM
product,
program,
or
service
may
be
used.
Any
functionally
equivalent
product,
program,
or
service
that
does
not
infringe
any
IBM
intellectual
property
right
may
be
used
instead.
However,
it
is
the
user’s
responsibility
to
evaluate
and
verify
the
operation
of
any
non-IBM
product,
program,
or
service.
IBM
may
have
patents
or
pending
patent
applications
covering
subject
matter
described
in
this
document.
The
furnishing
of
this
document
does
not
give
you
any
license
to
these
patents.You
can
send
license
inquiries,
in
writing,
to:
IBM
Director
of
Licensing
IBM
Corporation
North
Castle
Drive
Armonk,
NY
10504-1785
U.S.A.
For
license
inquiries
regarding
double-byte
(DBCS)
information,
contact
the
IBM
Intellectual
Property
Department
in
your
country
or
send
inquiries,
in
writing,
to:
IBM
World
Trade
Asia
Corporation
Licensing
2-31
Roppongi
3-chome,
Minato-ku
Tokyo
106,
Japan
The
following
paragraph
does
not
apply
to
the
United
Kingdom
or
any
other
country
where
such
provisions
are
inconsistent
with
local
law:
INTERNATIONAL
BUSINESS
MACHINES
CORPORATION
PROVIDES
THIS
PUBLICATION
″AS
IS″
WITHOUT
WARRANTY
OF
ANY
KIND,
EITHER
EXPRESS
OR
IMPLIED,
INCLUDING,
BUT
NOT
LIMITED
TO,
THE
IMPLIED
WARRANTIES
OF
NON-INFRINGEMENT,
MERCHANTABILITY
OR
FITNESS
FOR
A
PARTICULAR
PURPOSE.
Some
states
do
not
allow
disclaimer
of
express
or
implied
warranties
in
certain
transactions,
therefore,
this
statement
might
not
apply
to
you.
This
information
could
include
technical
inaccuracies
or
typographical
errors.
Changes
are
periodically
made
to
the
information
herein;
these
changes
will
be
incorporated
in
new
editions
of
the
publication.
IBM
may
make
improvements
and/or
changes
in
the
product(s)
and/or
the
program(s)
described
in
this
publication
at
any
time
without
notice.
Any
references
in
this
information
to
non-IBM
Web
sites
are
provided
for
convenience
only
and
do
not
in
any
manner
serve
as
an
endorsement
of
those
Web
sites.
The
materials
at
those
Web
sites
are
not
part
of
the
materials
for
this
IBM
product
and
use
of
those
Web
sites
is
at
your
own
risk.
277
IBM
may
use
or
distribute
any
of
the
information
you
supply
in
any
way
it
believes
appropriate
without
incurring
any
obligation
to
you.
Licensees
of
this
program
who
wish
to
have
information
about
it
for
the
purpose
of
enabling:
(i)
the
exchange
of
information
between
independently
created
programs
and
other
programs
(including
this
one)
and
(ii)
the
mutual
use
of
the
information
which
has
been
exchanged,
should
contact:
IBM
Corporation
2Z4A/101
11400
Burnet
Road
Austin,
TX
78758
U.S.A.
Such
information
may
be
available,
subject
to
appropriate
terms
and
conditions,
including
in
some
cases
payment
of
a
fee.
The
licensed
program
described
in
this
document
and
all
licensed
material
available
for
it
are
provided
by
IBM
under
terms
of
the
IBM
Customer
Agreement,
IBM
International
Program
License
Agreement
or
any
equivalent
agreement
between
us.
This
information
contains
examples
of
data
and
reports
used
in
daily
business
operations.
To
illustrate
them
as
completely
as
possible,
the
examples
include
the
names
of
individuals,
companies,
brands,
and
products.
All
of
these
names
are
fictitious
and
any
similarity
to
the
names
and
addresses
used
by
an
actual
business
enterprise
is
entirely
coincidental.
COPYRIGHT
LICENSE:
This
information
contains
sample
application
programs
in
source
language,
which
illustrate
programming
techniques
on
various
operating
platforms.
You
may
copy,
modify,
and
distribute
these
sample
programs
in
any
form
without
payment
to
IBM,
for
the
purposes
of
developing,
using,
marketing
or
distributing
application
programs
conforming
to
the
application
programming
interface
for
the
operating
platform
for
which
the
sample
programs
are
written.
These
examples
have
not
been
thoroughly
tested
under
all
conditions.
IBM,
therefore,
cannot
guarantee
or
imply
reliability,
serviceability,
or
function
of
these
programs.
You
may
copy,
modify,
and
distribute
these
sample
programs
in
any
form
without
payment
to
IBM
for
the
purposes
of
developing,
using,
marketing,
or
distributing
application
programs
conforming
to
IBM’s
application
programming
interfaces.
If
you
are
viewing
this
information
in
softcopy
form,
the
photographs
and
color
illustrations
might
not
appear.
278
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Trademarks
IBM,
the
IBM
logo,
AIX,
OS/390,
S/390,
OS/400,
iSeries,
Tivoli,
the
Tivoli
logo,
Tivoli
Enterprise,
IBM
Tivoli
Enterprise
Console,
and
Tivoli
Enterprise
Data
Warehouse
are
trademarks
or
registered
trademarks
of
International
Business
Machines
Corporation
in
the
United
States,
other
countries,
or
both.
Microsoft,
Windows,
and
Windows
NT
are
trademarks
of
Microsoft
Corporation
in
the
United
States,
other
countries,
or
both.
UNIX
is
a
registered
trademark
of
The
Open
Group
in
the
United
States
and
other
countries.
Java
and
all
Java-based
trademarks
and
logos
are
trademarks
or
registered
trademarks
of
Sun
Microsystems,
Inc.
in
the
United
States
and
other
countries.
Other
company,
product,
and
service
names
may
be
trademarks
or
service
marks
of
others.
Notices
279
280
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Glossary
A
Adapter
Configuration
Facility.
In
the
IBM
Tivoli
Enterprise
Console,
a
graphical
user
interface
that
enables
a
Tivoli
administrator
to
easily
configure
and
customize
event
adapters.
C
cache.
A
buffer
storage
that
contains
frequently
accessed
instructions
and
data;
it
is
used
to
reduce
access
time.
configuration
file.
A
file
that
specifies
the
characteristics
of
a
system
device
or
network.
D
data
view.
In
IBM
Tivoli
Monitoring,
a
way
of
displaying
data
in
the
Web
Health
Console.
database
browser.
In
IBM
Tivoli
Monitoring,
the
Web
Health
Console
component
that
provides
hierarchical
access
to
information
about
current
resource
problems.
This
information
can
come
from
any
endpoint
to
which
the
Web
Health
Console
has
access,
and
it
might
pertain
to
any
resource
model
installed
on
that
endpoint.
See
also
Web
Health
Console
and
resource
model.
default
policy.
In
a
Tivoli
environment,
a
set
of
resource
property
values
that
are
assigned
to
a
resource
when
the
resource
is
created.
defragmentation.
The
process
of
running
a
software
utility
to
rewrite
fragmented
data
to
contiguous
sectors
of
a
computer
storage
medium
to
improve
access
and
retrieval
time.
Desktop
Management
Task
Force
(DMTF).
An
alliance
of
computer
vendors
that
was
convened
to
define
streamlined
management
of
the
diverse
operating
systems
commonly
found
in
an
enterprise.
E
endpoint.
In
a
Tivoli
environment,
a
Tivoli
client
that
is
the
ultimate
recipient
for
any
type
of
Tivoli
operation.
event.
In
a
Tivoli
environment,
any
significant
change
in
the
state
of
a
system
resource,
network
resource,
or
network
application.
An
event
can
be
generated
for
a
problem,
for
the
resolution
of
a
problem,
or
for
the
successful
completion
of
a
task.
Examples
of
events
are
the
normal
starting
and
stopping
of
a
process,
the
abnormal
termination
of
a
process,
and
the
malfunctioning
of
a
server.
See
also
indication.
event
class.
In
the
IBM
Tivoli
Enterprise
Console,
a
classification
for
an
event
that
indicates
the
type
of
information
that
the
event
adapter
will
send
to
the
event
server.
F
fragmentation.
An
operating
system’s
process
of
writing
different
parts
of
a
file
to
discontiguous
sectors
on
a
computer
storage
medium
when
contiguous
space
that
is
large
enough
to
contain
the
entire
file
is
not
available.
When
data
is
thus
fragmented,
the
time
that
it
takes
to
access
the
data
can
increase
because
the
operating
system
must
search
different
tracks
for
information
that
should
be
in
one
location.
G
gateway.
In
a
Tivoli
environment,
software
running
on
a
managed
node
that
provides
all
communication
services
between
a
group
of
endpoints
and
the
rest
of
the
Tivoli
environment.
This
gateway
includes
the
multiplexed
distribution
(MDist)
function,
enabling
it
to
act
as
the
fanout
point
for
distributions
to
many
endpoints.
I
IBM
Tivoli
Enterprise
Console.
A
Tivoli
product
that
collects,
processes,
and
automatically
initiates
corrective
actions
for
system,
application,
network,
and
database
events;
it
is
the
central
control
point
for
events
from
all
sources.
The
IBM
Tivoli
Enterprise
Console
provides
a
centralized,
global
view
of
the
network
computing
environment;
it
uses
distributed
event
monitors
to
collect
information,
a
central
event
server
to
process
information,
and
distributed
event
consoles
to
present
information
to
system
administrators.
IBM
Tivoli
Monitoring.
A
Tivoli
application
that
applies
preconfigured,
automated
best
practices
to
the
automated
monitoring
of
essential
system
resources.
The
application
detects
bottlenecks
and
other
potential
problems
and
provides
for
the
automatic
recovery
from
critical
situations,
which
eliminates
the
need
for
system
administrators
to
manually
scan
through
extensive
performance
data.
The
application
also
integrates
seamlessly
with
other
Tivoli
Availability
solutions,
including
the
IBM
Tivoli
Business
Systems
Manager
281
and
the
IBM
Tivoli
Enterprise
Console.
Previously
called
Tivoli
Distributed
Monitoring
(Advanced
Edition).
indication.
An
entity
triggered
by
the
occurrence
of
a
problem
in
an
endpoint
relating
to
one
or
more
resources.
Indications
are
consolidated
into
events
within
the
endpoint
being
monitored.
See
also
event.
installation
repository
(IR).
In
Tivoli
Software
Installation
Service
(SIS),
the
directory
that
contains
reusable
installation
images
and
other
data
that
is
used
by
SIS.
M
managed
node.
In
a
Tivoli
environment,
any
managed
resource
on
which
the
Tivoli
Management
Framework
is
installed.
monitoring
collection.
In
IBM
Tivoli
Monitoring,
a
collection
of
predefined
monitors.
Several
monitoring
collections
are
packaged
with
IBM
Tivoli
Monitoring,
but
Tivoli
administrators
can
also
use
custom-developed
and
third-party
monitoring
collections.
See
also
custom
monitor.
O
object.
In
object-oriented
design
or
programming,
a
concrete
realization
of
a
class
that
consists
of
data
and
the
operations
associated
with
that
data.
P
policy
region.
In
a
Tivoli
environment,
a
group
of
managed
resources
that
share
one
or
more
common
policies.
Tivoli
administrators
use
policy
regions
to
model
the
management
and
organizational
structure
of
a
network
computing
environment.
The
administrators
can
group
similar
resources,
define
access
to
and
control
the
resources,
and
associate
rules
for
governing
the
resources.
policy
subregion.
In
a
Tivoli
environment,
a
policy
region
created
or
residing
in
another
policy
region.
When
a
policy
subregion
is
created,
it
initially
uses
the
resource
and
policy
properties
of
the
parent
policy
region.
The
Tivoli
administrator
can
later
change
or
customize
these
properties
to
reflect
the
specific
needs
and
differences
of
the
subregion.
profile.
In
a
Tivoli
environment,
a
container
for
application-specific
information
about
a
particular
type
of
resource.
A
Tivoli
application
specifies
the
template
for
its
profiles;
the
template
includes
information
about
the
resources
that
can
be
managed
by
that
Tivoli
application.
A
profile
is
created
in
the
context
of
a
profile
manager;
the
profile
manager
links
a
profile
to
the
Tivoli
resource
(for
example,
a
managed
node)
that
uses
the
information
contained
in
the
profile.
A
profile
does
not
have
any
direct
subscribers.
profile
manager.
In
a
Tivoli
environment,
a
container
for
profiles
that
links
the
profiles
to
a
set
of
resources,
called
subscribers.
Tivoli
administrators
use
profile
managers
to
organize
and
distribute
profiles.
A
profile
manager
is
created
in
the
context
of
a
policy
region
and
is
a
managed
resource
in
a
policy
region.
R
reference
model.
In
the
context
of
Tivoli
software,
the
model
configuration
for
a
system
or
set
of
systems
that
is
used
to
maintain
consistent
configurations
in
a
distributed
environment.
In
Tivoli
Inventory,
reference
models
are
created
in
the
configuration
repository.
resource.
In
IBM
Tivoli
Monitoring
context,
a
resource
is
anything
that
affects
the
operation
of
the
system
and
includes
physical
and
logical
disks,
CPUs,
memory,
printers,
as
well
as
the
processes
running,
services,
such
as
LanMan
and
the
Windows
event
log,
and
TCP/IP.
resource
model.
In
IBM
Tivoli
Monitoring,
the
logical
modeling
of
one
or
more
resources,
along
with
the
logic
on
which
cyclical
data
collection,
data
analysis,
and
monitoring
are
based.
Related
events
and
actions
are
triggered,
if
required.
For
any
resource
model,
users
can
specify
individual
thresholds
and
event
aggregation
rules.
See
also
event.
rule
base.
In
the
IBM
Tivoli
Enterprise
Console,
one
or
more
rule
sets
and
the
event
class
definitions
for
which
the
rules
are
written.
The
IBM
Tivoli
Enterprise
Console
uses
the
rule
base
in
managing
events.
An
organization
can
create
many
rule
bases,
with
each
rule
base
fulfilling
a
different
set
of
needs
for
network
computing
management.
S
Software
Installation
Service
(SIS).
A
Tivoli
product
that
provides
an
easy-to-use,
efficient
interface
for
installing
Tivoli
Enterprise™
software.
SIS
uses
Tivoli’s
MDist
technology
and
provides
automated
checking
for
prerequisite
software,
a
reusable
repository
of
installation
images,
and
both
graphical
and
command
line
interfaces
for
deploying
Tivoli
products
to
a
large
number
of
computers.
subscriber.
In
a
Tivoli
environment,
a
managed
node,
a
profile
manager,
an
endpoint,
or
another
Tivoli
client
that
is
subscribed
to
a
profile
manager.
Although
profiles
are
distributed
to
a
subscriber,
the
subscriber
might
or
might
not
be
the
final
destination
of
the
profile
distribution.
Glossary
282
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
T
task
library.
In
a
Tivoli
environment,
a
container
in
which
a
Tivoli
administrator
can
create
and
store
tasks
and
jobs.
threshold.
(1)
In
software
products,
a
value
that
defines
a
limit
for
a
monitored
condition.
(2)
In
IBM
Tivoli
Monitoring,
a
threshold
is
a
named
property
with
a
user-defined
value.
Typically,
the
value
specified
for
a
threshold
represents
a
significant
level
of
a
performance-related
entity,
which,
if
exceeded,
a
system
administrator
might
want
to
know
about.
Tivoli
Distributed
Monitoring.
Previous
name
of
Tivoli
Distributed
Monitoring
(Classic
Edition).
Tivoli
Distributed
Monitoring
(Advanced
Edition).
Previous
name
of
IBM
Tivoli
Monitoring.
Tivoli
Distributed
Monitoring
(Classic
Edition).
A
Tivoli
application
that
provides
distributed
monitors
for
monitoring
system
resources.
The
application
initiates
necessary
corrective
actions
and
informs
system
administrators
of
potential
problems.
These
monitors
can
be
centrally
configured
and
deployed
to
monitor
individual
machines.
The
application
also
integrates
seamlessly
with
other
Tivoli
Availability
solutions,
including
the
IBM
Tivoli
Enterprise
Console.
Previously
called
Tivoli
Distributed
Monitoring.
Tivoli
environment.
The
Tivoli
applications,
based
upon
the
Tivoli
Management
Framework,
that
are
installed
at
a
specific
customer
location
and
that
address
network
computing
management
issues
across
many
platforms.
In
a
Tivoli
environment,
a
system
administrator
can
distribute
software,
manage
user
configurations,
change
access
privileges,
automate
operations,
monitor
resources,
and
schedule
jobs.
Tivoli
management
agent.
In
the
Tivoli
environment,
an
agent
that
securely
performs
administrative
operations.
Tivoli
Management
Framework.
The
base
software
that
is
required
to
run
the
applications
in
the
Tivoli
product
suite.
This
software
infrastructure
enables
the
integration
of
systems
management
applications
from
Tivoli
Systems
Inc.
and
the
Tivoli
Partners.
In
a
Tivoli
environment,
the
Tivoli
Management
Framework
is
installed
on
every
client
and
server;
however,
the
TMR
server
is
the
only
server
that
holds
the
full
object
database.
Tivoli
management
region.
In
a
Tivoli
environment,
a
Tivoli
server
and
the
set
of
clients
that
it
serves.
An
organization
can
have
more
than
one
Tivoli
management
region.
A
Tivoli
management
region
addresses
the
physical
connectivity
of
resources
whereas
a
policy
region
addresses
the
logical
organization
of
resources.
W
Web
Health
Console.
In
IBM
Tivoli
Monitoring,
a
component
that
displays
real-time
and
historical
data
for
any
resource
model
at
any
endpoint.
Using
the
graphical
user
interface,
users
can
locate
individual
problems
associated
with
one
or
more
resources.
The
status
is
displayed
as
a
value
between
0
(representing
an
identified
problem,
that
is,
an
event)
and
100
(representing
no
recent
indications).
Users
can
select
views
of
resource
problems
as
tabular
data,
different
types
of
charts,
and
so
on.
Glossary
Glossary
283
Glossary
284
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Index
Aaccessibility
IBM
Tivoli
Monitoring
ix
account
not
valid
for
root
indication
188
account
not
valid
for
root
problem
187
actions,
built-in
(Windows)adjust
initial
work
items
70,
261
adjust
maximum
work
items
70,
261
common
259
delete
registry
260
delete
registry
key
shares
14
description
259
enlarge
IRP
stack
size
13,
260
Event
Log
resource
model
13,
260
Network
Interface
Card
resource
model
70,
261
Parametric
Services
resource
model
79
raise
session
timeout
14,
260
restart
service
124,
262
Services
Failing
Service
124
Services
resource
model
124,
262
Services
Stopped
Service
124
adjust
initial
work
items
action
70,
261
adjust
maximum
work
items
action
70,
261
adjust
work
items
indication
51
alternative
groups
parameter
194
alternative
owners
parameter
194
ASP
Disk
Mirroring
resource
modeldescription
199
indications
199
mirroring
not
active
indication
200
parameters
201
ASP
nearing
capacity
indication
203
ASP
overflow
indication
204
ASP
Utilizationresource
modeldescription
202
ASP
Utilization
resource
modelASP
nearing
capacity
indication
203
ASP
overflow
indication
204
indications
202
logging
205
parameters
205
available
disk
space
configuration
parameter
117
available
file
system
space
configuration
parameter
197
available
space
threshold
143,
146
BBasic
Average
CPU
Utilizationresource
modeldescription
206
Basic
Average
CPU
Utilization
resource
modelindications
206
Basic
CPU
Utilization
Guideline
Exceeded
indication
206
Basic
CPU
Utilization
GuidelineLong
Running
Exceeded
indication
207
Basic
CPU
Utilization
Peak
Exceeded
indication
208
Basic
CPU
Utilization
Peak
Long
Running
Exceeded
indication
209
Basic
CPU
Utilization
resource
modelBasic
CPU
Utilization
Guideline
Exceeded
indication
206
Basic
CPU
Utilization
Guideline
Long
Running
Exceeded
indication
207
Basic
CPU
Utilization
Peak
Exceeded
indication
208
Basic
CPU
Utilization
Peak
Long
Running
Exceeded
indication
209
logging
210
Basic
Interactive
CPU
Utilizationresource
modeldescription
211
Basic
Interactive
CPU
Utilization
Guideline
212
Basic
Interactive
CPU
Utilization
Guideline
Exceeded
indication
211
Basic
Interactive
CPU
Utilization
Peak
Exceeded
indication
213
Basic
Interactive
CPU
Utilization
Peak
Long
Running
214
Basic
Interactive
CPU
Utilization
resource
modelBasic
Interactive
CPU
Utilization
Guideline
Exceeded
indication
211
Basic
Interactive
CPU
Utilization
Guideline
Long
Running
Exceeded
indication
212
Basic
Interactive
CPU
Utilization
Peak
Exceeded
indication
213
Basic
Interactive
CPU
Utilization
Peak
Long
Running
Exceeded
indication
214
indications
211
logging
215
booksfeedback
vii
online
vii
ordering
vii
broadcast
frames
problem
48
browser
threshold
123
built-in
actions
(Windows)adjust
initial
work
items
261
adjust
maximum
work
items
261
common
259
delete
registry
260
description
259
enlarge
IRP
stack
size
260
Event
Log
resource
model
260
Network
Interface
Card
resource
model
261
raise
session
timeout
260
restart
service
262
built-in
actions
(Windows)
(continued)Services
resource
model
262
busy
drive
from
high
paging
correlated
event
264
busy
drive
from
low
avail
correlated
event
265
busy
hardware
indication
107
bytes
transferred
per
second
problem
15,
82
Ccache
problem
25
client
connectivity
problems
7
committed
bytes
problem
26
computers
parameter
73
Configuration
object
not
active
indication
217
Configuration
Objectsresource
modeldescription
217
Configuration
Objects
resource
modelConfiguration
object
not
active
indication
217
indications
217
parameters
218
congested
TCP
network
correlated
event
266
correlated
eventsbusy
drive
from
high
paging
264
busy
drive
from
low
avail
265
congested
TCP
network
266
critical
memory
leak
268
critically
low
disk
space
267
description
263
faulty
disk
subsystem
269
high
disk
read
bytes
per
second
270
high
disk
write
bytes
per
second
271
high
drive
transfer
rate
272
high
percent
drive
time
273
possible
disk
fragmentation
274
process
hogging
CPU
275
slow
hard
drive
276
CPU
cannot
keep
up
with
hardware
indication
108
CPU
resource
modeldescription
131
high
CPU
overload
indication
132
high
CPU
usage
by
system
indication
133
indications
131
logging
134
percentage
of
CPU
in
idle
threshold
132,
134
percentage
of
CPU
used
by
system
threshold
133,
134
thresholds
134
critical
memory
leak
correlated
event
268
critically
low
disk
space
correlated
event
267
285
Customer
Support
ix
DDatabase
CPU
Utilizationresource
modeldescription
219
Database
CPU
Utilization
Exceeded
indication
219
Database
CPU
Utilization
resource
modelDatabase
CPU
Utilization
Exceeded
219
indications
219
logging
220
defined
users
parameter
194
delete
registry
action
260
delete
registry
key
shares
action
14
detection
of
malfunctioning
devices
problem
7
directory
names,
notation
x
disk
fragmentation
(possible)
correlated
event
274
disk
space
problem
15
Distribution
Queuesresource
modeldescription
221
Distribution
Queues
resource
modelHigh
priority
distribution
queue
not
active
indication
221
indications
221
Normal
priority
distribution
queue
not
active
indication
222
parameters
222
DMXCpu
resource
model
131
DMXFile
resource
model
136
DMXFileSystem
resource
model
141
DMXMemory
resource
model
148
DMXNetworkInterface
resource
model
154
DMXNetworkRPCNFS
resource
model
164
DMXProcess
resource
model
178
DMXSecurity
resource
model
187
DMXSpp
resource
model
196
duplicate
account
indication
188
Eendpoint
name
6
enlarge
IRP
stack
size
action
13,
260
environment
variables,
notation
x
event
ID
11
indication
8
event
ID
15
indication
9
event
ID
2011
indication
9
event
ID
2511
indication
9
event
ID
3013
indication
11
event
ID
7023
indication
11
event
ID
9
indication
8
event
IDs
parameter
74
Event
Log
resource
modelactions
13
built-in
actions
260
client
connectivity
problems
7
delete
registry
action
260
delete
registry
key
shares
action
14
description
7,
131,
199
Event
Log
resource
model
(continued)detection
of
malfunctioning
devices
problem
7
enlarge
IRP
stack
size
action
13,
260
event
ID
11
indication
8
event
ID
15
indication
9
event
ID
2011
indication
9
event
ID
2511
indication
9
event
ID
3013
indication
11
event
ID
7023
indication
11
event
ID
9
indication
8
indication
properties
13
indications
7
problems
highlighted
7
raise
session
timeout
action
14,
260
server
connectivity
problems
7
thresholds
13
event
severity
parameter
74
EventLog
threshold
123
events,
correlated
(Windows)
263
excessive
page
faults
threshold
46
excessive
paging
threshold
30,
33,
46
Ffaulty
disk
subsystem
correlated
event
269
file
attributes
changed
indication
137
file
changed
indication
138
file
not
present
indication
139
File
resource
modeldescription
136
file
attributes
changed
indication
137
file
changed
indication
138
file
not
present
indication
139
file
to
be
checked
parameter
140,
146
ignored
file
system
parameter
146
indications
136
logging
140
parameters
140
File
System
resource
modelavailable
space
threshold
143,
146
description
141
fragmented
file
system
indication
142
indications
141
logging
146
low
percent
space
available
indication
143
low
percentage
of
available
I-nodes
indication
145
low
space
available
indication
143
parameters
146
percent
available
space
threshold
143,
146
percentage
of
available
I-nodes
threshold
145,
146
percentage
of
file
system
space
used
threshold
142,
146
percentage
of
I-nodes
used
threshold
142,
146
thresholds
146
file
to
be
checked
parameter
140,
146
files
to
be
monitored
parameter
194
filter
type
parameter
74
fragmented
data
problem
125
fragmented
file
system
indication
142
Hhandle
leaks
problem
101
hardware
keeping
CPU
busy
indication
109
high
bytes
per
second
threshold
24,
84,
85,
86,
87,
88,
89,
90
high
CPU
overload
indication
132
high
CPU
usage
by
system
indication
133
high
CPU
usage
indication
103,
104
high
CPU
usage
interrupt
threshold
107,
108,
109,
111,
112,
113
high
CPU
usage
problem
101,
105
high
CPU
usage
process
threshold
111,
112,
113
high
CPU
usage
threshold
107,
108,
109,
111,
112,
113
high
CPU
usage
user
privilege
threshold
113
high
current
commands
indication
53
high
current
commands
modifier
threshold
53,
59,
60,
62,
65,
69
high
current
percent
time
indication
92
high
disk
read
bytes
per
second
correlated
event
270
high
disk
write
bytes
per
second
correlated
event
271
high
drive
transfer
rate
correlated
event
272
high
duplicate
RPC
server
calls
indication
165
high
errored
out
ratio
threshold
54,
69
high
fragment
ratio
indication
126
high
fragment
ratio
threshold
126,
129
high
input
packets
in
error
indication
155
high
interrupts
per
second
threshold
107,
108,
109,
113
high
job
errors
indication
93
high
job
errors
per
day
indication
94
high
log-in
number
for
user
indication
188
high
network
traffic
indication
166
high
NFS
buffer
size
indication
166
high
NFS
server
get-attribute
operations
indication
168
high
NFS
server
read
operations
indication
169
high
NFS
server
readlink
operations
indication
170
high
NFS
server
write
operations
indication
171
high
not
ready
errors
indication
95
high
not
ready
errors
per
day
indication
96
high
number
of
zombie
processes
indication
179
high
out
of
paper
errors
indication
97
high
out
of
paper
errors
per
day
indication
98
high
output
packets
in
error
indication
156
high
output
queue
length
modifier
threshold
55,
56,
69
high
paging
indication
28
high
percent
broadcast
threshold
52,
60,
62,
64
286
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
high
percent
bytes
per
second
threshold
51,
53,
55,
56,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
percent
disk
time
indication
84
high
percent
drive
time
correlated
event
273
high
percent
usage
delta
indication
110
high
percent
usage
delta
threshold
110,
113
high
percent
usage
threshold
24,
84,
85,
86,
87,
88,
90
high
percent
utilization
threshold
51,
52,
53,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
percentage
disk
time
indication
17
high
percentage
packet
collisions
indication
157
high
ping
indication
127
High
priority
distribution
queue
not
active
indication
221
high
processes
indication
111
high
queue
length
threshold
21,
24,
84,
85,
86,
87,
88,
89,
90
high
read
bytes
per
second
indication
18
high
retransmitted
calls
indication
172
high
RPC
bad
calls
indication
173
high
segments
retransmitted
threshold
128,
129
high
timeouts
and
badxids
indication
174
high
transfer
rate
indication
19,
86
high
work
item
shortages
threshold
51,
57,
64,
67,
68,
69
high
write
bytes
per
second
indication
20,
87
HighCPUUsageUserPrivthreshold
113
History
Logresource
modeldescription
223
History
Log
resource
modelindications
223
List
of
jobs
not
empty
indication
223
parameters
224
host
name
6
IIBM
Tivoli
Monitoringaccessibility
ix
publication
library
vii
ignored
file
system
parameter
146
illegal
group
indication
190
illegal
owner
indication
190
indicationIntNotSupported
50,
155
indicationsOS/400
ASP
Disk
Mirroring
resource
model
199
ASP
nearing
capacity
203
ASP
overflow
204
ASP
Utilization
resource
model
202
Basic
Average
CPU
Utilization
resource
model
206
indications
(continued)OS/400
(continued)Basic
CPU
Utilization
Guideline
Exceeded
206
Basic
CPU
Utilization
Guideline
Long
Running
Exceeded
207
Basic
CPU
Utilization
Peak
Exceeded
208
Basic
CPU
Utilization
Peak
Long
Running
Exceeded
209
Basic
Interactive
CPU
Utilization
Guideline
Exceeded
211
Basic
Interactive
CPU
Utilization
Guideline
Long
Running
Exceeded
212
Basic
Interactive
CPU
Utilization
Peak
Exceeded
213
Basic
Interactive
CPU
Utilization
Peak
Long
Running
Exceeded
214
Basic
Interactive
CPU
Utilization
resource
model
211
Configuration
object
not
active
217
Configuration
Objects
resource
model
217
Database
CPU
Utilization
Exceeded
219
Database
CPU
Utilization
resource
model
219
Distribution
Queues
resource
model
221
High
priority
distribution
queue
not
active
221
History
Log
resource
model
223
Interactive
Feature
CPU
Utilization
Exceeded
225
Interactive
Feature
CPU
Utilization
resource
model
225
Job
Log
resource
model
227
Job
Log
Warning
Message
227
Job
Not
Active
233
Job
Queue
Not
Active
230
Job
Queue
Not
Assigned
231
Job
Queue
resource
model
230
Job
Status
resource
model
233
Last
Changed
Date
Different
242
List
of
jobs
not
empty
223
Management
Central
Critical
235
Management
Central
Events
resource
model
235
Management
Central
Harmless
236
Management
Central
Unknown
236
Management
Central
Warning
236
mirroring
not
active
200
Network
Attributes
Mismatch
238
Network
Attributes
resource
model
238
No
writers
started
for
output
queue
240
Normal
priority
distribution
queue
not
active
222
Object
Owner
Different
243
Object
Size
Exceeded
243
indications
(continued)OS/400
(continued)Output
queue
not
active
241
Output
Queues
resource
model
240
Parametric
Object
and
File
resource
model
242
Subsystem
Not
Active
247
Subsystem
Status
resource
model
247
System
ASP
Used
Near
Peak
Guidelines
249
System
Disk
Resources
resource
model
249
System
Object
Mismatch
252
System
Value
resource
model
252
TCP
Interface
Not
Active
254
TCP
Interface
resource
model
254
TCP
Service
Not
Active
256
TCP
Service
resource
model
256
Too
Many
Jobs
Queued
231
Total
Auxiliary
Storage
Reached
Capacity
Guidelines
250
Total
Auxiliary
Storage
Reached
Peak
Guidelines
251
UNIX
and
Linuxaccount
not
valid
for
root
188
CPU
resource
model
131
duplicate
account
188
file
attributes
changed
137
file
changed
138
file
not
present
139
File
resource
model
136
File
System
resource
model
141
fragmented
file
system
142
high
CPU
overload
132
high
CPU
usage
by
system
133
high
duplicate
RPC
server
calls
165
high
input
packets
in
error
155
high
log-in
number
for
user
188
high
network
traffic
166
high
NFS
buffer
size
166
high
NFS
server
get-attribute
operations
168
high
NFS
server
read
operations
169
high
NFS
server
readlink
operations
170
high
NFS
server
write
operations
171
high
number
of
zombie
processes
179
high
output
packets
in
error
156
high
percentage
packet
collisions
157
high
retransmitted
calls
172
high
RPC
bad
calls
173
high
timeouts
and
badxids
174
illegal
group
190
illegal
owner
190
interface
not
enabled
158
interface
not
operational
159
low
percent
space
available
143
low
percentage
of
available
I-nodes
145
low
space
available
143
Index
287
indications
(continued)UNIX
and
Linux
(continued)low
storage
space
149
low
swap
space
150
Memory
resource
model
148
Network
Interface
resource
model
154
Network
RPC-NFS
resource
model
164
nonexistent
file
191
null
password
191
process
consuming
high
CPU
180
process
killed
or
nonexistent
181
Process
resource
model
179
process
stopped
182
Security
resource
model
187
slow
network
175
suspect
supergroup
192
suspect
superuser
192
system
thrashing
151
unknown
interface
status
160
wrong
file
mode
193
Windowsadjust
work
items
51
busy
hardware
107
CPU
cannot
keep
up
with
hardware
108
event
ID
11
8
event
ID
15
9
event
ID
2011
9
event
ID
2511
9
event
ID
3013
11
event
ID
9
8
event
ID7023
11
Event
Log
resource
model
7
hardware
keeping
CPU
busy
109
high
current
commands
53
high
current
percent
time
92
high
fragment
ratio
126
high
job
errors
93
high
job
errors
per
day
94
high
not
ready
errors
95
high
not
ready
errors
per
day
96
high
out
of
paper
errors
97
high
out
of
paper
errors
per
day
98
high
paging
28
high
percent
disk
time
84
high
percent
usage
delta
110
high
percentage
disk
time
17
high
ping
127
high
processes
111
high
read
bytes
per
second
18
high
transfer
rate
19,
86
high
write
bytes
per
second
20,
87
logical
disk
possible
fragmentation
21
Logical
Disk
resource
model
16
low
available
memory
29
low
available
memory
causing
hard
paging
31
low
available
memory
causing
many
problems
32
low
available
memory
causing
soft
paging
and
pagefile
resizing
33
indications
(continued)Windows
(continued)low
available
memory
is
causing
excessive
soft
paging
30
low
available
memory
with
a
small
pagefile
36
low
available
memory
with
high
cache
37
low
copy
read
hits
38
low
data
map
hits
39
low
disk
space
22
memory
leak
in
private
bytes
42
memory
leak
in
system
drivers
44
Memory
resource
model
26
Network
Interface
Card
resource
model
49
pagefile
is
resizing
45
Parametric
Event
Log
resource
model
72
Parametric
Services
resource
model
76
Parametric
TCP/IP
Ports
resource
model
80
physical
disk
possible
fragmentation
88
Physical
Disk
resource
model
83
Printer
resource
model
91
process
handle
leak
102
process
high
CPU
103
Process
resource
model
102
processor
busy
112
Processor
resource
model
105
properties
13
redirector
affecting
server
57
redirector
overloaded
affecting
segment
60
segment
affecting
server
64
segments
ReXmit
128
services
failing
service
77,
120
Services
resource
model
120
services
stopped
service
78,
122
slow
logical
drive
23
slow
physical
drive
89
state
of
the
defined
port
80
TCP/IP
resource
model
125
Windows
event
logged
73
input
packets
in
error
threshold
155,
161
Interactive
Feature
CPU
Utilizationresource
modeldescription
225
Interactive
Feature
CPU
Utilization
Exceeded
indication
225
Interactive
Feature
CPU
Utilization
resource
modelindications
225
Interactive
Feature
CPU
Utilization
Exceeded
indication
225
logging
226
interface
not
enabled
indication
158
interface
not
operational
indication
159
IntNotSupported
indication
50,
155
ITM
Resource
Model
Reference
Guideabout
vii
contents
1
prerequisite
knowlege
vii
prerequisite
publications
viii
ITM
Resource
Model
Reference
Guide
(continued)related
publications
viii
target
audience
vii
Jjob
errors
per
day
threshold
94,
99
job
errors
threshold
93,
99
Job
Logresource
modeldescription
227
Job
Log
resource
modelindications
227
Job
Log
Warning
Message
indication
227
parameters
228
Job
Log
Warning
Message
indication
227
Job
Not
Active
indication
233
Job
Queueresource
modeldescription
230
Job
Queue
Not
Active
indication
230
Job
Queue
Not
Assigned
indication
231
Job
Queue
resource
modelindications
230
Job
Queue
Not
Active
indication
230
Job
Queue
Not
Assigned
indication
231
parameters
232
Too
Many
Jobs
Queued
indication
231
Job
Statusresource
modeldescription
233
Job
Status
resource
modelindications
233
Job
Not
Active
indication
233
parameters
234
Kkey
services
problem
119
LLanmanServer
threshold
123
LanmanWorkstation
threshold
123
Last
Changed
Date
Different
indication
242
List
of
jobs
not
empty
indication
223
log
file
type
parameter
74
loggingOS/400
ASP
Utilization
resource
model
205
Basic
CPU
Utilization
resource
model
210
Basic
Interactive
CPU
Utilization
resource
model
215
Database
CPU
Utilization
resource
model
220
Interactive
Feature
CPU
Utilization
resource
model
226
Storage
Pools
resource
model
245
288
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
logging
(continued)OS/400
(continued)System
Disk
Resources
resource
model
251
UNIX
and
LinuxCPU
resource
model
134
File
resource
model
140
File
System
resource
model
146
Memory
resource
model
152
Network
Interface
resource
model
162
Network
RPC-NFS
resource
model
177
Process
resource
model
185
Security
resource
model
194
Server
Performance
Prediction
resource
model
197
WindowsLogical
Disk
resource
model
24
Memory
resource
model
46
Network
Interface
Card
resource
model
70
Parametric
Services
resource
model
79
Parametric
TCP/IP
Ports
resource
model
81
Physical
Disk
resource
model
90
Printer
resource
model
100
Process
resource
model
104
Processor
resource
model
114
Server
Performance
Prediction
resource
model
117
TCP/IP
resource
model
129
logical
disk
possible
fragmentation
indication
21
Logical
Disk
resource
modelbytes
transferred
per
second
problem
15
description
15
disk
space
problem
15
high
bytes
per
second
threshold
24
high
percent
disk
time
indication
17
high
percent
usage
threshold
24
high
queue
length
threshold
21,
24
high
read
bytes
per
second
indication
18
high
transfer
rate
indication
19
high
write
bytes
per
second
indication
20
indications
16
logging
24
logical
disk
possible
fragmentation
indication
21
low
disk
space
indication
22
low
disk
space
threshold
24
percent
usage
problem
15
prerequisites
15
problems
highlighted
15
slow
logical
drive
indication
23
thresholds
24
logons
by
same
user
problem
187
low
available
memory
causing
hard
paging
indication
31
low
available
memory
causing
many
problems
indication
32
low
available
memory
causing
soft
paging
and
pagefile
resizing
indication
33
low
available
memory
indication
29
low
available
memory
is
causing
excessive
soft
paging
indication
30
low
available
memory
problem
26
low
available
memory
with
a
small
pagefile
indication
36
low
available
memory
with
high
cache
indication
37
low
cache
hits
percent
threshold
46
low
copy
read
hits
indication
38
low
data
map
hits
indication
39
low
disk
space
indication
22
low
disk
space
threshold
24
low
percent
space
available
indication
143
low
percentage
of
available
I-nodes
indication
145
low
segments
threshold
127,
129
low
space
available
indication
143
low
storage
space
indication
149
low
swap
space
indication
150
MManagement
Central
Critical
indication
235
Management
Central
Eventsresource
modeldescription
235
Management
Central
Events
resource
modelindications
235
Management
Central
Critical
indication
235
Management
Central
Harmless
indication
236
Management
Central
Unknown
indication
236
Management
Central
Warning
indication
236
Management
Central
Unknown
indication
236
Management
Central
Warning
indication
236
Management
CentralHarmless
indication
236
manualsfeedback
vii
online
vii
ordering
vii
maximum
handles
indication
102,
104
maximum
number
of
zombie
processes
threshold
179,
183
maximum
jobs
threshold
99
maximum
queues
threshold
99
maximum
processes
indication
102,
103,
104
Memory
(UNIX
and
Linux)
resource
modeldescription
148
indications
148
logging
152
low
storage
space
indication
149
low
swap
space
indication
150
Memory
(UNIX
and
Linux)
resource
model
(continued)memory
page-in
rate
threshold
151,
152
memory
page-out
rate
threshold
151,
152
percentage
of
available
swap
space
threshold
150,
152
percentage
of
available
virtual
storage
threshold
149,
152
system
thrashing
indication
151
thresholds
152
Memory
(Windows)
resource
modelcache
problem
25
committed
bytes
problem
26
description
25
excessive
page
faults
threshold
46
excessive
paging
threshold
30,
33,
46
high
paging
indication
28
indications
26
logging
46
low
available
memory
causing
hard
paging
indication
31
low
available
memory
causing
many
problems
indication
32
low
available
memory
causing
soft
paging
and
pagefile
resizing
indication
33
low
available
memory
indication
29
low
available
memory
is
causing
excessive
soft
paging
indication
30
low
available
memory
problem
26
low
available
memory
with
a
small
pagefile
indication
36
low
available
memory
with
high
cache
indication
37
low
cache
hits
percent
threshold
46
low
copy
read
hits
indication
38
low
data
map
hits
indication
39
memory
leak
in
private
bytes
indication
42
memory
leak
in
system
drivers
indication
44
memory
leaks
problem
26
minimum
available
bytes
threshold
46
minimum
committed
bytes
threshold
31,
46
pagefile
is
resizing
indication
45
paging
and
page
faulting
problem
26
problems
highlighted
25
thresholds
46
memory
leak
in
private
bytes
indication
42
memory
leak
in
system
drivers
indication
44
memory
leaks
problem
26
memory
page-in
rate
threshold
151,
152
memory
page-out
rate
threshold
151,
152
minimum
available
bytes
threshold
46
minimum
committed
bytes
threshold
31,
46
mirroring
not
active
indication
200
moderate
DG
threshold
127,
129
Mof
file
propertiesCPU
resource
model
134
Index
289
Mof
file
properties
(continued)File
resource
model
140
File
System
resource
model
147
Memory
resource
model
152
Network
Interface
resource
model
162
Process
resource
model
185
Security
resource
model
194
multiple
CPU
problems
105
NNetlogon
threshold
124
Network
Attributesresource
modeldescription
238
Network
Attributes
Mismatch
indication
238
Network
Attributes
resource
modelindications
238
Network
Attributes
Mismatch
indication
238
parameters
239
network
congestion
problem
125
network
interface
card
problem
48
Network
Interface
Card
resource
modelactions
70
adjust
initial
work
items
action
70,
261
adjust
maximum
work
items
action
70,
261
adjust
work
items
indication
51
broadcast
frames
problem
48
built-in
actions
261
description
48
high
current
commands
indication
53
high
current
commands
modifier
threshold
53,
59,
60,
62,
65,
69
high
errored
out
ratio
threshold
54,
69
high
output
queue
length
mod
threshold
55,
56,
69
high
percent
broadcast
threshold
52,
60,
62,
64
high
percent
bytes
per
second
threshold
51,
53,
55,
56,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
percent
utilization
threshold
51,
52,
53,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
work
item
shortages
threshold
51,
57,
64,
67,
68,
69
indications
49
logging
70
network
interface
card
problem
48
prerequisites
49
problems
highlighted
48
redirector
affecting
server
indication
57
redirector
overloaded
affecting
segment
indication
60
segment
affecting
server
indication
64
server
and
workstation
services
problem
48
thresholds
69
network
interface
configuration
parameter
117,
197
Network
Interface
resource
modeldescription
154
high
input
packets
in
error
indication
155,
156
high
percentage
packet
collisions
indication
157
indications
154
input
packets
in
error
threshold
155,
161
interface
not
enabled
indication
158
interface
not
operational
indication
159
logging
162
output
packets
in
error
threshold
156,
161
packet
collision
percentage
threshold
157,
161
parameters
162
SNMP
Community
Nameparameter
162,
197
thresholds
161
unknown
interface
status
indication
160
Network
RPC-NFS
resource
modeldescription
164
high
duplicate
RPC
server
calls
indication
165
high
network
traffic
indication
166
high
NFS
buffer
size
indication
166
high
NFS
server
get-attribute
operations
indication
168
high
NFS
server
read
operations
indication
169
high
NFS
server
readlink
operations
indication
170
high
NFS
server
write
operations
indication
171
high
retransmitted
calls
indication
172
high
RPC
bad
calls
indication
173
high
timeouts
and
badxids
indication
174
indications
164
logging
177
percentage
of
bad
RPC
calls
threshold
173,
176
percentage
of
client
RPC
badxids
threshold
174,
176
percentage
of
client
RPC
calls
in
time-out
threshold
174,
176
percentage
of
client
RPC
retransmissions
threshold
172,
176
percentage
of
NFS
server
getattr
operations
threshold
168,
176
percentage
of
NFS
server
read
operations
threshold
169,
176
percentage
of
NFS
server
readlink
operations
threshold
170,
176
percentage
of
NFS
server
write
operations
threshold
171,
176
percentage
of
server
RPC
duplicate
requests
threshold
165,
176
slow
network
indication
175
thresholds
176
NetworkInterfacesConf
parameter
117,
197
No
writers
started
for
output
queue
indication
240
nonexistent
file
indication
191
Normal
priority
distribution
queue
not
active
indication
222
not
ready
errors
per
day
threshold
96,
99
not
ready
errors
threshold
95,
99
notationenvironment
variables
x
path
names
x
typeface
x
NtLmSsp
threshold
124
null
password
indication
191
OObject
Owner
Different
indication
243
Object
Size
Exceeded
indication
243
obsoleteparameters
NetworkInterfacesConf
117
thresholdMaximum
Queues
99
thresholdsMaximum
Queues
99
MostPrintQueues
99
obsolete
indicationIntNotSupported
50,
155
obsolete
parameterNetworkInterfacesConf
117,
197
online
publications
ix
onventions
used
xi
ordering
publications
ix
out
of
paper
errors
per
day
threshold
98,
99
out
of
paper
errors
threshold
97,
99
output
packets
in
error
threshold
156,
161
Output
queue
not
active
indication
241
Output
Queuesresource
modeldescription
240
Output
Queues
resource
modelindications
240
No
writers
started
for
output
queue
indication
240
Output
queue
not
active
indication
241
parameters
241
Ppacket
collision
percentage
threshold
157,
161
paging
and
page
faulting
problem
26
parameterscommon
6
NetworkInterfacesConf
117,
197
obsoleteNetworkInterfacesConf
117
OS/400ASP
Disk
Mirroring
resource
model
201
290
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
parameters
(continued)OS/400
(continued)ASP
Utilization
resource
model
205
Configuration
Objects
resource
model
218
Distribution
Queues
resource
model
222
History
Log
resource
model
224
Job
Log
resource
model
228
Job
Queue
resource
model
232
Job
Status
resource
model
234
Network
Attributes
resource
model
239
Output
Queues
resource
model
241
Parametric
Object
and
File
resource
model
244
Storage
Pools
resource
model
245
Subsystem
Status
resource
model
248
System
Value
resource
model
253
TCP
Interface
resource
model
255
TCP
Service
resource
model
257
SNMP
Community
name
162
UNIX
and
Linuxalternative
groups
194
alternative
owners
194
available
file
system
space
configuration
197
defined
users
194
File
resource
model
140
File
System
resource
model
146
file
to
be
checked
140,
146
files
to
be
monitored
194
ignored
file
system
146
network
interface
configuration
197
Network
Interface
resource
model
162
Process
resource
model
183
Security
resource
model
194
Server
Performance
Prediction
resource
model
197
SNMP
Community
Name
162,
197
special
groups
194
special
users
194
Windowsavailable
disk
space
configuration
117
computers
73
event
IDs
74
event
severity
74
filter
type
74
log
file
type
74
network
interface
configuration
117
Parametric
Event
Log
resource
model
73
Parametric
Services
resource
model
79
Parametric
TCP/IP
Ports
resource
model
81
physical
disk
configuration
117
port
numbers
81
possible
state
of
a
port
81
parameters
(continued)Windows
(continued)Server
Performance
Prediction
resource
model
117
services
79
source
75
Windows
2000
logs
75
Parametric
Event
Log
resource
modelcomputers
parameter
73
description
72
event
IDs
parameter
74
event
severity
parameter
74
filter
type
parameter
74
indications
72
log
file
type
parameter
74
parameters
73
source
parameter
75
Windows
2000
logs
parameter
75
Windows
event
logged
indication
73
Parametric
Object
and
Fileresource
modeldescription
242
Parametric
Object
and
File
resource
modelindications
242
Last
Changed
Date
Different
indication
242
Object
Owner
Different
indication
243
Object
Size
Exceeded
indication
243
parameters
244
Parametric
Services
resource
modelactions
79
description
76
indications
76
logging
79
parameters
79
port
numbers
parameter
81
possible
state
of
a
port
parameter
81
services
failing
service
indication
77
services
parameter
79
services
stopped
service
indication
78
Parametric
TCP/IP
Ports
resource
modeldescription
80
indications
80
logging
81
parameters
81
prerequisites
80
state
of
the
defined
port
indication
80
path
names,
notation
x
percent
available
space
threshold
143,
146
percent
processor
threshold
92,
99
percent
processor
time
problem
91
percent
usage
problem
15,
82
percentage
of
available
I-nodes
threshold
145,
146
percentage
of
available
swap
space
threshold
150,
152
percentage
of
available
virtual
storage
threshold
149,
152
percentage
of
bad
RPC
calls
threshold
173,
176
percentage
of
client
RPC
badxids
threshold
174,
176
percentage
of
client
RPC
calls
in
time-out
threshold
174,
176
percentage
of
client
RPC
retransmissions
threshold
172,
176
percentage
of
CPU
in
idle
threshold
132,
134
percentage
of
CPU
used
by
system
threshold
133,
134
percentage
of
CPU
used
threshold
180,
183
percentage
of
file
system
space
used
threshold
142,
146
percentage
of
I-nodes
used
threshold
142,
146
percentage
of
NFS
server
getattr
operations
threshold
168,
176
percentage
of
NFS
server
read
operations
threshold
169,
176
percentage
of
NFS
server
readlink
operations
threshold
170,
176
percentage
of
NFS
server
write
operations
threshold
171,
176
percentage
of
server
RPC
duplicate
requests
threshold
165,
176
physical
disk
configuration
parameter
117
physical
disk
possible
fragmentation
indication
88
Physical
Disk
resource
modelbytes
transferred
per
second
problem
82
description
82
high
bytes
per
second
threshold
84,
85,
86,
87,
88,
89,
90
high
percent
disk
time
indication
84
high
percent
usage
threshold
84,
85,
86,
87,
88,
90
high
queue
length
threshold
84,
85,
86,
87,
88,
89,
90
high
transfer
rate
indication
86
high
write
bytes
per
second
indication
87
indications
83
logging
90
percent
usage
problem
82
physical
disk
possible
fragmentation
indication
88
prerequisites
82
problems
highlighted
82
slow
physical
drive
indication
89
thresholds
90
port
numbers
parameter
81
possible
disk
fragmentation
correlated
event
274
possible
state
of
a
port
parameter
81
prerequisitespublications
viii
Tivoli
product
knowledge
viii
WindowsLogical
Disk
resource
model
15
Network
Interface
Card
resource
model
49
Parametric
TCP/IP
Ports
resource
model
80
Physical
Disk
resource
model
82
Server
Performance
Prediction
resource
model
115
Index
291
prerequisites
(continued)Windows
(continued)TCP/IP
resource
model
125
prerequistessoftware
resource
models
(all)
1
resource
models
(OS/400)
2
resource
models
(UNIX
and
Linux)
2
resource
models
(Windows)
1
printer
errors
problem
91
Printer
resource
modeldescription
91
high
current
percent
time
indication
92
high
job
errors
indication
93
high
job
errors
per
day
indication
94
high
not
ready
errors
indication
95
high
not
ready
errors
per
day
indication
96
high
out
of
paper
errors
indication
97
high
out
of
paper
errors
per
day
indication
98
indications
91
job
errors
per
day
threshold
94,
99
job
errors
threshold
93,
99
logging
100
maximum
jobs
threshold
99
maximum
queues
threshold
99
not
ready
errors
per
day
threshold
96,
99
not
ready
errors
threshold
95,
99
out
of
paper
errors
per
day
threshold
98,
99
out
of
paper
errors
threshold
97,
99
percent
processor
threshold
92,
99
percent
processor
time
problem
91
printer
errors
problem
91
thresholds
99
problems
highlightedUNIX
and
Linuxaccount
not
valid
for
root
187
logons
by
same
user
187
process
is
stopped
or
killed
178
Process
resource
model
178
process
uses
too
much
CPU
time
178
property
changes
187
requested
process
does
not
exist
178
Security
resource
model
187
suspect
superuser
187
too
many
zombie
processes
in
the
system
178
Windowsbroadcast
frames
48
bytes
transferred
per
second
15,
82
cache
25
client
connectivity
problems
7
committed
bytes
26
detection
of
malfunctioning
devices
7
disk
space
15
fragmented
data
125
handle
leaks
101
problems
highlighted
(continued)Windows
(continued)high
CPU
usage
101,
105
key
services
119
low
available
memory
26
memory
leaks
26
multiple
CPU
problems
105
network
congestion
125
network
interface
card
48
paging
and
page
faulting
26
percent
processor
time
91
percent
usage
15,
82
printer
errors
91
server
and
workstation
services
48
server
connectivity
problems
7
unstable
services
119
Process
(UNIX
and
Linux)
resource
modeldescription
178
high
number
of
zombie
processes
indication
179
indications
179
logging
185
maximum
number
of
zombie
processes
threshold
179,
183
parameters
183
percentage
of
CPU
used
threshold
180,
183
problems
highlighted
178
process
consuming
high
CPU
indication
180
process
is
stopped
or
killed
problem
178
process
killed
or
nonexistent
indication
181
process
stopped
indication
182
process
uses
too
much
CPU
time
problem
178
requested
process
does
not
exist
problem
178
thresholds
183
too
many
zombie
processes
in
the
system
problem
178
Process
(Windows)
resource
modeldescription
101
handle
leaks
problem
101
high
CPU
usage
indication
103,
104
high
CPU
usage
problem
101
indications
102
logging
104
maximum
handles
indication
102,
104
maximum
processes
indication
102,
103,
104
problems
highlighted
101
process
handle
leak
indication
102
process
high
CPU
indication
103
thresholds
104
process
consuming
high
CPU
indication
180
process
handle
leak
indication
102
process
high
CPU
indication
103
process
hogging
CPU
correlated
event
275
process
is
stopped
or
killed
problem
178
process
killed
or
nonexistent
indication
181
process
stopped
indication
182
process
uses
too
much
CPU
time
problem
178
processor
busy
threshold
112
Processor
resource
modelbusy
hardware
indication
107
CPU
cannot
keep
up
with
hardware
indication
108
description
105
hardware
keeping
CPU
busy
indication
109
high
CPU
usage
interrupt
threshold
107,
108,
109,
111,
112,
113
high
CPU
usage
problem
105
high
CPU
usage
process
threshold
111,
112,
113
high
CPU
usage
threshold
107,
108,
109,
111,
112,
113
high
CPU
usage
user
privilege
threshold
113
high
interrupts
per
second
threshold
107,
108,
109,
113
high
percent
usage
delta
indication
110
high
percent
usage
delta
threshold
110,
113
high
processes
indication
111
indications
105
logging
114
multiple
CPU
problems
105
problems
highlighted
105
processor
busy
threshold
112
thresholds
113
total
CPUs
modifier
threshold
108,
109,
113
property
changes
problem
187
publicationsfeedback
vii
online
vii,
ix
ordering
vii,
ix
related
viii
Rraise
session
timeout
action
14,
260
redirector
affecting
server
indication
57
redirector
overloaded
affecting
segment
indication
60
requested
process
does
not
exist
problem
178
resource
modelsLinux
Event
Log
131
OS/400ASP
Disk
Mirroring
199
ASP
Utilization
202
Basic
Average
CPU
Utilization
206
Basic
Interactive
CPU
Utilization
211
Configuration
Objects
217
Database
CPU
Utilization
219
Distribution
Queues
221
Event
Log
199
292
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
resource
models
(continued)OS/400
(continued)History
Log
223
Interactive
Feature
CPU
Utilization
225
Job
Log
227
Job
Queue
230
Job
Status
233
Management
Central
Events
235
Network
Attributes
238
Output
Queues
240
Parametric
Object
and
File
242
Storage
Pools
245
Subsystem
Status
247
System
Disk
Resources
249
System
Value
252
TCP
Interface
254
TCP
Service
256
Solaris
onlyNetwork
RPC-NFS
-
164
UNIXEvent
Log
131
UNIX
and
LinuxCPU
131
File
136
File
System
141
Memory
148
Network
Interface
154
Network
RPC-NFS
164
Process
178
Security
187
Server
Performance
Prediction
196
WindowsEvent
Log
7
Logical
Disk
15
Memory
25
Network
Interface
Card
48
Parametric
Event
Log
72
Parametric
Services
76
Parametric
TCP/IP
Ports
80
Physical
Disk
82
Printer
91
Process
101
Processor
105
Server
Performance
Prediction
115
Services
119
TCP/IP
125
TMW_Spp
115
resource
models
(all)prerequisites
1
resource
models
(OS/400)prerequisites
2
resource
models
(UNIX
and
Linux)prerequisites
2
resource
models
(Windows)prerequisites
1
restart
service
action
124,
262
SSecurity
resource
modelaccount
not
valid
for
root
indication
188
account
not
valid
for
root
problem
187
Security
resource
model
(continued)alternative
groups
parameter
194
alternative
owners
parameter
194
defined
users
parameter
194
description
187
duplicate
account
indication
188
files
to
be
monitored
parameter
194
high
log-in
number
for
user
indication
188
illegal
group
indication
190
illegal
owner
indication
190
indications
187
logging
194
logons
by
same
user
problem
187
nonexistent
file
indication
191
null
password
indication
191
parameters
194
problems
highlighted
187
property
changes
problem
187
special
groups
parameter
194
special
users
parameter
194
suspect
supergroup
indication
192
suspect
superuser
indication
192
suspect
superuser
problem
187
wrong
file
mode
indication
193
segment
affecting
server
indication
64
segments
ReXmit
indication
128
server
and
workstation
services
problem
48
server
connectivity
problems
7
Server
Performance
Prediction
(UNIX
and
Linux)
resource
modelavailable
file
system
space
configuration
parameter
197
description
196
logging
197
network
interface
configuration
parameter
197
parameters
197
Server
Performance
Prediction
(Windows)
resource
model
115
available
disk
space
configuration
parameter
117
logging
117
network
interface
configuration
parameter
117
parameters
117
physical
disk
configuration
parameter
117
Server
Performance
Prediction
resource
modelprerequisites
115
services
failing
service
indication
77,
120
services
parameter
79
Services
resource
modelactions
124
browser
threshold
123
built-in
actions
262
description
119
EventLog
threshold
123
indications
120
key
services
problem
119
LanmanServer
threshold
123
LanmanWorkstation
threshold
123
Netlogon
threshold
124
NtLmSsp
threshold
124
problems
highlighted
119
Services
resource
model
(continued)restart
service
action
124,
262
services
failing
service
indication
120
services
stopped
service
indication
122
thresholds
123
Tivoli
endpoint
threshold
124
unstable
services
problem
119
services
stopped
service
indication
78,
122
slow
hard
drive
correlated
event
276
slow
logical
drive
indication
23
slow
network
indication
175
slow
physical
drive
indication
89
SNMPCommunity
Name
parameter
162,
197
SNMP
Community
Name
162
source
parameter
75
special
groups
parameter
194
special
users
parameter
194
state
of
the
defined
port
indication
80
Storage
Poolsresource
modeldescription
245
Storage
Pools
resource
modellogging
245
parameters
245
styletypeface
conventions
x
Subsystem
Not
Active
indication
247
Subsystem
resource
modelSubsystem
Not
Active
indication
247
Subsystem
Statusresource
modeldescription
247
Subsystem
Status
resource
modelindications
247
parameters
248
suspect
supergroup
indication
192
suspect
superuser
indication
192
suspect
superuser
problem
187
syntaxTivoli
command
xi
Tivoli
typeface
conventions
used
x
System
Disk
Resourcesresource
modeldescription
249
System
Disk
Resources
resource
modelindications
249
logging
251
System
ASP
Used
Near
Peak
Guidelines
indication
249
Total
Auxiliary
Storage
Reached
Capacity
indication
250
Total
Auxiliary
Storage
Reached
Peak
Capacity
Guidelines
indication
251
System
Object
Mismatch
indication
252
system
thrashing
indication
151
System
Valueresource
modeldescription
252
System
Value
resource
modelindications
252
parameters
253
System
Object
Mismatch
indication
252
Index
293
TTCP
Interfaceresource
modeldescription
254
TCP
Interface
Not
Active
indication
254
TCP
Interface
resource
modelindications
254
parameters
255
TCP
Interface
Not
Active
indication
254
TCP
Serviceresource
modeldescription
256
TCP
Service
Not
Active
indication
256
TCP
Service
resource
modelindications
256
parameters
257
TCP
Service
Not
Active
indication
256
TCP/IP
resource
modeldescription
125
fragmented
data
problem
125
high
fragment
ratio
indication
126
high
fragment
ratio
threshold
126,
129
high
ping
indication
127
high
segments
retransmitted
threshold
128,
129
indications
125
logging
129
low
segments
threshold
127,
129
moderate
DG
threshold
127,
129
network
congestion
problem
125
prerequisites
125
problems
highlighted
125
segments
ReXmitindication
128
thresholds
129
terminologyendpoint
name,
defined
6
host
name,
defined
6
thresholdobsolete
HighCPUUsageUserPriv
113
thresholdsobsolete
MostPrintQueues
99
UNIX
and
Linuxavailable
space
143,
146
CPU
resource
model
134
File
System
resource
model
146
input
packets
in
error
155,
161
maximum
number
of
zombie
processes
179,
183
memory
page-in
rate
151,
152
memory
page-out
rate
151,
152
Memory
resource
model
152
Network
Interface
resource
model
161
Network
RPC-NFS
resource
model
176
output
packets
in
error
156,
161
packet
collision
percentage
157,
161
percent
available
space
143,
146
percentage
of
available
I-nodes
145,
146
thresholds
(continued)UNIX
and
Linux
(continued)percentage
of
available
swap
space
150,
152
percentage
of
available
virtual
storage
149,
152
percentage
of
bad
RPC
calls
173,
176
percentage
of
client
RPC
badxids
174,
176
percentage
of
client
RPC
calls
in
time-out
174,
176
percentage
of
client
RPC
retransmissions
172,
176
percentage
of
CPU
in
idle
132,
134
percentage
of
CPU
used
180,
183
percentage
of
CPU
used
by
system
133,
134
percentage
of
file
system
space
used
142,
146
percentage
of
I-nodes
used
142,
146
percentage
of
NFS
server
getattr
operations
168,
176
percentage
of
NFS
server
read
operations
169,
176
percentage
of
NFS
server
readlink
operations
170,
176
percentage
of
NFS
server
write
operations
171,
176
percentage
of
server
RPC
duplicate
requests
165,
176
Process
resource
model
183
Windowsbrowser
123
Event
Log
resource
model
13
EventLog
123
excessive
page
faults
46
excessive
paging
30,
33,
46
high
bytes
per
second
24,
84,
85,
86,
87,
88,
89,
90
high
CPU
usage
103,
104,
107,
108,
109,
111,
112,
113
high
CPU
usage
interrupt
107,
108,
109,
111,
112,
113
high
CPU
usage
process
111,
112,
113
high
CPU
usage
user
privilege
113
high
current
commands
modifier
53,
59,
60,
62,
65,
69
high
errored
out
ratio
54,
69
high
fragment
ratio
126,
129
high
interrupts
per
second
107,
108,
109,
113
high
output
queue
length
modifier
55,
69
high
output
queuelength
modifier
56
high
percent
broadcast
52,
60,
62,
64
high
percent
bytes
per
second
51,
53,
55,
56,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
percent
usage
24,
84,
85,
86,
87,
88,
90
thresholds
(continued)Windows
(continued)high
percent
usage
delta
110,
113
high
percent
utilization
51,
52,
53,
57,
59,
60,
62,
64,
65,
67,
68,
69
high
queue
length
21,
24,
84,
85,
86,
87,
88,
89,
90
high
segments
retransmitted
128,
129
high
work
item
shortages
51,
57,
64,
67,
68,
69
job
errors
93,
99
job
errors
per
day
94,
99
LanmanServer
123
LanmanWorkstation
123
Logical
Disk
resource
model
24
low
cache
hits
percent
46
low
disk
space
24
low
segments
127,
129
maximum
handles
102,
104
maximum
jobs
99
maximum
queues
99
maximum
processes
102,
103,
104
memory
resource
model
46
minimum
available
bytes
46
minimum
committed
bytes
46
moderate
DG
127,
129
Netlogon
124
Network
Interface
Card
resource
model
69
not
ready
errors
95,
99
not
ready
errors
per
day
96,
99
NtLmSsp
124
out
of
paper
errors
97,
99
out
of
paper
errors
per
day
98,
99
percent
processor
92,
99
Physical
Disk
resource
model
90
Printer
resource
model
99
Process
resource
model
104
Processor
resource
model
113
Services
resource
model
123
TCP/IP
resource
model
129
Tivoli
endpoint
124
total
CPUs
modifier
108,
109,
113
Tivoli
command
syntax
xi
Tivoli
Customer
Support
ix
Tivoli
endpoint
threshold
124
TMW_EventLog
resource
model
7
TMW_LogicalDisk
resource
model
15
TMW_MemoryModel
resource
model
25
TMW_NetworkIntCard
resource
model
49
TMW_ParamEventLog
resource
model
72
TMW_ParamPorts
resource
model
80
TMW_ParamServices
resource
model
76
TMW_PhysicalDiskModel
resource
model
82
TMW_PrintModel
resource
model
91
TMW_Process
resource
model
101
TMW_Processor
resource
model
105
TMW_Services
resource
model
119
TMW_Spp
resource
model
115
TMW_TCPIP
resource
model
125
Too
Many
Jobs
Queued
indication
231
too
many
zombie
processes
in
the
system
problem
178
294
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
Total
Auxiliary
Storage
Reached
Capacity
indication
250
Total
Auxiliary
Storage
Reached
Peak
Capacity
Guidelines
indication
251
Total
Auxiliary
Storage
Reached
Peak
Guidelines
indication
249
total
CPUs
modifier
threshold
108,
109,
113
typefaceconventions
used
x
Uunknown
interface
status
indication
160
unstable
services
problem
119
Vvariables,
notation
for
x
WWindows
2000
logs
parameter
75
Windows
event
logged
indication
73
wrong
file
mode
indication
193
Index
295
296
IBM
Tivoli
Monitoring:
Resource
Model
Reference
Guide
���
SH19-4570-02