Tivoli EIF

Supported versions	Type	Authentication Type
7, 8	Agent	Org Bearer Token

IBM’s Tivoli Event Integration Facility (EIF) is a toolkit that expands the types of events and system information that you can monitor. You can use it to develop your own adapters, which are tailored to your environment.

Use this integration to start sending monitoring events from Tivoli EIF to BigPanda.

Open Integration Manager

The Open Integration Manager is available for use with Tivoli. For more information, see the Open Integration Manager documentation.

Payload size

Alert payloads must be 6MB or smaller. Larger payloads will fail to process with BigPanda. We recommend reviewing your configurations to ensure that only actionable, useful information is being sent to BigPanda.

Install the Integration

Install the integration by following these steps:

Multiple Agent Plugins

Running multiple agent plugins at the same time (i.e. listener and rawalertstransfer) will create a race condition with the local filesystem queue.

In this case, create a subdirectory for each plugin within the queue directory, and adjust the queue path in both the bp_listener.json and bigpanda.conf configuration files.

$ mkdir -p /var/lib/bigpanda/queue/listener /var/lib/bigpanda/dlq/listener

$ sudo bigpanda-config --add listener --app-key <your app key> --listener_queue_directory /var/lib/bigpanda/queue/listener --listener_dlq_directory /var/lib/bigpanda/dlq/listener

Configuring Timestamps

BigPanda requires the timestamp to be in epoch format. The bigpanda-listener service converts the human readable time, that is received from Tivoli EIF as the situation_time, into epoch format. The timestamp received does not include a timezone, so the bigpanda-listener service extracts the timezone in one of the following methods:

Configured in the bp_listener.json configuration file.
Set as an environment variable named TZ.
Resolved via the /etc/localtime symlink on the server.
Resolved via the /etc/timezone file on the server.

All timezone must be an IANA compliant timezone identifier. If the timezone lookup fails, a log entry is made and the current local timestamp is generated. If the timestamp received is in epoch format, timestamp conversion is skipped and the original timestamp is used.

Troubleshoot the Integration

If the bigpanda-listener service does not start, you can view the journal logs to get a more detailed explanation of the error. To view these logs, use the following command in the terminal:

journalctl -u bigpanda-listener

Uninstall the Integration

Deleting an integration requires that you remove the integration in both the integrated system and BigPanda. We recommend that you first uninstall the integration on the integrated system to prevent traffic from being sent and rejected by BigPanda, since the app key will not exist once you delete the integration in BigPanda.

Caution during replacement

When replacing an existing integration with a new tool or system, we recommend configuring the new integration first to ensure no data is lost.

Deactivate Inbound Integration

If you want to stop sending data to BigPanda but don’t want to delete your integration, you can temporarily deactivate it.

To deactivate an inbound integration:

In BigPanda, navigate to the Integrations tab and select the desired integration from the list. This will open integration details on the right side of the window.
At the top of the integration details, click the Active/Inactive toggle next to the application name to change the status of the integration.

In the integrations list, inactive integrations will be marked with a gray bar.

Alert resolution for inactive integrations

Any active alerts belonging to an inactive integration must be manually resolved or they will stay in the system until the auto-resolve window is reached.

Stop Sending Data to BigPanda

Within the integrated system, disable any settings that send data to BigPanda.

Each system requires specific changes to disable the integration with BigPanda. For example, you must delete the topic in CloudWatch, and you must disable the alert channel in New Relic. To determine the changes for your integrated system, reference the relevant documentation or contact BigPanda support.

Manually resolve any open alerts sent from the integration to remove the associated incidents from your incident feed. These incidents will not automatically resolve without an ok status from the original sending integration.

Delete the Integration in BigPanda

Take the following steps to delete the integration from BigPanda:

In BigPanda, navigate to the Integrations tab and select the desired integration from the list.
In the integration details on the right of the page, click the trash icon, then confirm you want to delete the integration. The integration will be removed immediately.

️Automatic alert resolution for deleted integrations

All active alerts from the integration will be resolved after deletion.

Data removal

This procedure does not remove any data from the integrated system.

Install the Integration with Debian or Ubuntu

The BigPanda agent is a low-footprint utility installed on the master host of your monitoring tool. It consumes alerts from the tool in real-time and then transmits them to BigPanda via TLS-encrypted HTTP calls.

Python Compatibility

To use the Open Integration Manager for Agent-based integrations, Python version>= 3.8.0 and an Agent version >= 10.2 are required.

Prerequisites

python >= 3.8 and python-pip3 should be installed prior to installing the bigpanda-agent package.

Ensure python3 is installed with the following command:
```
$ sudo apt install -y python3
```
Verify the install with the following commands:
```
$ python3 --version
$ pip3 --version
```

Note: If pip3 was not installed as a dependency, it can be installed with sudo apt install -y python3-pip.

Note: Access to JFrog, pypi, and yum repositories are required to install all dependencies.

Install the BigPanda Agent on Debian or Ubuntu

Connect to the host where your server is installed, and install the BigPanda agent package.

Ensure packages are installed prior to downloading the BigPanda agent package:
```
$ sudo apt update && sudo apt install -y gnupg2 curl lsb-release
```

Add the BigPanda repository and download the OpenPGP key:

    $ echo deb https://bigpandaio.jfrog.io/artifactory/int-deb `lsb_release -c -s` main | sudo tee /etc/apt/sources.list.d/bigpanda.list
    $ curl -sL https://bigpandaio.jfrog.io/artifactory/api/security/keypair/bigpanda/public | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/bigpanda.gpg > /dev/null

The --dearmor option is for unpacking input from an OpenPGP ASCII armored key.
Since apt-key is marked to be deprecated on future releases of Debian or Ubuntu, it is preferred to manage keyring files in trusted.gpg.d instead.

Note: apt-key can still be used in place of OpenPGP, but it is less secure.

$ curl -sL https://bigpandaio.jfrog.io/artifactory/api/security/keypair/bigpanda/public | sudo apt-key add -

Update the repo list and install the BigPanda agent package.
```
$ sudo apt update
$ sudo apt install -y bigpanda-agent
```
Note: For the OIM, bigpanda-agent v10.0.0+ is required.

Troubleshooting:

Error:

E: The method driver /usr/lib/apt/methods/https could not be found.
N: Is the package apt-transport-https installed?

Solution:

$ sudo ln -sf /usr/lib/apt/methods/http /usr/lib/apt/methods/https
$ sudo apt install -y apt-transport-https
$ sudo apt update

Install the bp_listener package

The bp_listener package is hosted in JFrog and can be installed via pip.

Install the bp_listener package as a global python3 package:
```
$ sudo pip3 install --extra-index-url https://bigpandaio.jfrog.io/artifactory/api/pypi/int-pypi/simple bp_listener
```
Note: Global installation is required to work correctly with the BigPanda Agent Configurator.
You can verify the bp_listener package has been installed into the global site-packages:
```
$ sudo pip3 show bp_listener
```

Configure the BigPanda Agent

Generate the agent's configuration file:

$ sudo bigpanda-config --init --token <Your Org Bearer Token>
$ sudo bigpanda-config --add listener --app-key <Your App Key>

Configuration

Update the configuration file as needed before starting the bigpanda-listener service:
```
$ sudo vim /etc/bigpanda/listener/bp_listener.json
```
You have the following configuration options:
- bp.queue: The BigPanda queue the agent is configured to use.
- bp.logfile: The log file path for bp_listener.
- listener.port: The port the listener will listen on.
- listener.host: The host ip the listener will bind to.
- listener.timeout: The timeout in seconds for the socket to stay open.
- listener.source_timezone: The IANA compliant timezone identifier.
- listener.timestamp_key: The key in the payload that contains the timestamp.
- listener.timestamp_format: The format of the timestamp in the payload.
- listener.inbound_queue_size: The socket queue for inbound connections, uses up server resources.
- listener.max_threads: The maximum number of threads to use for processing events.
- log.level: The log level for bp_listener.
- log.verbose: Boolean switch to log verbose output.
- log.log_count: The number of log files to keep.

Start the BigPanda Listener service

Start the Bigpanda Listener service by running the following command:
```
$ sudo systemctl start bigpanda-listener
```
Verify the service is running with the following command:
```
$ systemctl status bigpanda-listener
```

Testing the BigPanda Listener Service

The client.py script is used to test the functionality of the server, and is located within the bp_listener python package in the installed python3 site-packages/ directory.

The following command will list the location of the bp_listener package:

$ sudo pip3 show bp_listener

The client.py script contains a default payload that is sent to the bigpanda-listener service. A json file can be used to submit a custom payload in place of the default.

To run the client.py script, use the following command:

$ python3 /path/to/bp_listener/test_client/client.py

Example Use:

usage: client.py [-h] [-s SERVER] [-p PORT] [-f FILE]

Client to send test payloads to BP Listener.

options:
  -h, --help                    show this help message and exit
  -s SERVER, --server SERVER    Server address the listener is configured to listen on (default: 127.0.0.1)
  -p PORT, --port PORT          Port the listener is configured to listen on (default: 4011)
  -f FILE, --file FILE          Optional JSON file to send as payload (default: None)
  -r RAW, --raw RAW             Optional TXT file containing a raw EIF type message (default: None)

Start the BigPanda Agent

$ sudo service bigpanda start

Success

You should be able to see all your active alerts from this integration in the Incidents tab.

In this section: