Configure Solace Event Module

  1. Stop RTView by executing the SolacePubSubMonitor\bin\stop_servers.bat/sh script.

  2. Open the RTView Configuration Application, select Solace (in the navigation tree)>DATA COLLECTION tab and toggle ON Event Module (toggle is blue when enabled).

    cui_solace_eventModuleEnable.gif

  3. Scroll down to see Solace Event Module options that become available.

    cui_solace_eventModuleOptions.gif

  4. Select event.log or system.log for the Source to match the settings on your broker and enter the address.

  5. Optionally enter the Max Memory for the Solace Event Module application and select the Units (MB or GB). Note that this must not be set to a value smaller than 512M or to a value higher than the resources allocated for your JVM.

  6. The Solace Event Module generates alerts based on incoming Syslog events as defined by Solace. See Solace Event Module Caches and Alerts for more information. Under Event Module Alert Filters you can optionally filter which Syslog events will generate alerts.

    7. Click cui_solace_eventModOpenSampFilters.gif to choose from a list of sample filters or enter your own. Filters must use XPath 1.0 expressions that return a boolean value. Multiple expressions can be separated by commas. For example, you might choose to filter out alerts based on severity or scope using the Do not generate alerts from these syslog events filter. Exceptions to the rules for filtering out should be entered in Allow these syslog events to generate alerts.

  7. Solace events are stored in the SolEventModuleEvents cache. See The SolEventModuleAlerts Cache for more information. Under Event Module Event Cache Filters you can optionally filter which syslog events are sent to the SolEventModuleEvents cache. To do so:

    8. Click cui_solace_eventModOpenSampFilters00001.gif to choose from a list of sample filters or enter your own. Filters must use XPath 1.0 expressions that return a boolean value. Multiple expressions can be separated by commas. For example, you might choose to filter out events based on severity or scope using the Do not cache these syslog events filter. Exceptions to the rules for filtering out should entered into the Cache these syslog events.

  8. Some alerts generated by the Solace Event Module are cleared based on another event. Others do not have a corresponding clear event. Under Event Module Alerts you can optionally set the amount of time to wait, in seconds, before clearing a not clearable alert. The default is 86400.

  9. Some alerts generated by the Solace Event Module are cleared based on another event. Under Event Module Duration you can optionally set the amount of time, in seconds, after an event that generates a clearable alert is received to wait for the corresponding clear event before generating the alert. If the corresponding clear event is received during this time, no alert is generated. The default is 30.

  10. Save and Restart Server to save and apply your changes.

Solace Event Module Caches and Alerts

The Syslog events from the Solace Event Module are stored in the SolEventModuleEvents cache and displayed in the Solution Package for Solace/Syslog Events display.

This cache keeps history and can optionally be stored to the history database by the Historian.  You can adjust the history settings in the RTView Configuration Application using the following fields in the Solace>DATA-STORAGE tab:

Size>History Rows – sets the maximum number of rows to keep in memory for this cache

Duration>Expire Time For Solace Event Module Events – the time (in seconds) between updates to expire rows in this cache

Duration>Delete Time For Solace Event Module Events – the time (in seconds) between updates to delete rows in this cache

History Storage>Syslog Events – toggle to true to have the Historian store this cache to the History database

The SolEventModuleAlerts Cache

The Solace Event Module generates alerts based on incoming Syslog events. The definitions of which Syslog events generate which alerts were provided by Solace. Events and alerts are scoped to SYSTEM, VPN and CLIENT. Some alerts are clearable. In this case, a syslog message generates an alert and another syslog message clears the alert.

Other alerts are not clearable. In this case, a syslog message generates the alert, but there is no corresponding syslog message to clear it. In this case, the alert automatically clears in RTView after 24 hours.

The SolacePubSubMonitor\rtvapm\solmon\soleventmodule\config\events\event_details.json file lists all events that generate alerts. The SolacePubSubMonitor\solmon\soleventmodule\config\events\event_correlation.json file lists the raising and clearing events for all clearable alerts. These files must not be modified, but used for reference only.

Alert events from the Solace Event Module are stored in the SolEventModuleAlerts cache.

This cache is not visible in displays, nor does it store history. It is used solely to generate the three alerts described below.

Alert events are deleted from this cache within 2 minutes of the alert being cleared. These alert events are cleared in 2 ways:

  • Clearable alerts are cleared when the clearing event is received by the Solace Event Module.

  • Non-clearable alerts are cleared after 24 hours. This time can be adjusted in the Configuration Application under Solace>DATA-COLLECTION>Solace Event Module Alerts>Clear Time. The value is in seconds.

The following RTView alerts are generated from the SolEventModuleAlerts cache:

SolEventModuleBrokerAlert – This alert is generated for rows in the SolEventModuleAlerts where Scope=SYSTEM. In Enterprise Monitor, this alert is mapped to the SOLACE-MSGROUTER CIType.

SolEventModuleVpnAlert - This alert is generated for rows in the SolEventModuleAlerts where Scope=VPN. In Enterprise Monitor, this alert is mapped to the SOLACE-VPN CIType.

SolEventModuleClientAlert - This alert is generated for rows in the SolEventModuleAlerts where Scope=CLIENT. In Enterprise Monitor, this alert is mapped to the SOLACE-CLIENT CIType.

When notifying on alerts using the Java Command option, you can get additional information about the SolEventModule alerts as follows:

  1. Edit projects\custom\src\com\sl\rtvapm\custom\RtvApmCommandHandler.java      to uncomment the if statement that calls getEventModuleInfo at the end of the outputAlertNotification method and also uncomment the getEventModuleInfo method.

  2. Edit projects\custom\src\make_all.bat or make_all.sh to add RTVAPM_HOME/ rtvapm/solmon/lib/rtvapm_solmon.jar to the CP.

  3. Run make_all.bat or make_all.sh to rebuild the jar.

  4. In the RTView Configuration Application, configure your alert notifications to execute a Java command (which will generate a message in the data server log file for each alert notification). For SolEventModule alerts, there will be a second message containing the information from the corresponding row in the SolEventModuleAlerts cache.