Netcool Suite Overview –

OMNIbus
Impact
WebGUI
 IBM TIVOLI NETCOOL OVERVIEW

Netcool Architecture
 IBM TIVOLI NETCOOL OVERVIEW

3
Netcool is the brand name given to the product line of Micromuse, which was acquired by IBM
around the year 2006. Netcool with its suite of products are dominant in the Fault and Performance
Management space. The main advantage of Netcool product line is that they can manage devices on
multivendor, multiprotocol networks.

The list of important products from Netcool are:

 OMNIbus
 Precision/ITNM
 Webtop/WebGUI
 Impact
 Proviso
 RAD / TBSM
 Reporter
 XSMs
 IBM TIVOLI NETCOOL OVERVIEW

4
Netcool OMNIbus
Omnibus is the heart of Netcool Suite and is the core behind IBM Micromuse's Fault
Management solution
 IBM TIVOLI NETCOOL OVERVIEW

5
Netcool OMNIbus Components
 IBM TIVOLI NETCOOL OVERVIEW

6
Netcool OMNIbus
Netcool/OMNIbus is based on a three-tier, client/server architecture and is a core application
of the product suite. Netcool/OMNIbus consists of four components: Netcool/OMNIbus
Probes, the Netcool/ OMNIbus ObjectServer, Netcool/OMNIbus Desktops, and
Netcool/OMNIbus Gateways.

Probes collect event information from existing network management systems, as well as event
messages from network devices, computing systems, applications or legacy systems. The
Probes then normalize and feed this event data into the ObjectServer, an object-oriented,
memory-resident active database.

At the ObjectServer, the event data is de-duplicated, correlated and associated with other
event data. By manipulating the data in the ObjectServer through the Desktops, users can
design customized views of event data to monitor segments of the network or services that
span the entire network.

Gateways permit data to be shared between multiple ObjectServers for load balancing or fail-
over facilities, exported to common relational database management systems (Oracle or
Sybase) for historical service level views, or integrated with other applications such as
Remedy's helpdesk application.
 IBM TIVOLI NETCOOL OVERVIEW

7
Probes
Probes are the first tier of Netcool's three-tier architecture. Probes are primarily passive
software interfaces that collect network event data (including messaged network data such as
faults, alerts, and traps) from elements on the network or from domain-based network
management systems.

These Probes can collect information presented from either management platforms and
devices (e.g., HP OpenView, Cabletron SPECTRUM, Cisco StrataView Plus, and Newbridge
46020) and standard protocols such as screen oriented ASCII character streams, application
log files (e.g., syslog) TL1, SMNP, or any other method of management information
provision. They recognize Management Information Base ("MIB") information from
switches and routers from leading vendors, including Nortel, Cabletron, Cisco, 3Com and
N.E.T.

Probes use rules and lookup tables to categorize and add information to events. As a result,
network data collected by the Probes is normalized into a common alert format and then
passed to the ObjectServer.
 IBM TIVOLI NETCOOL OVERVIEW

8
ObjectServer
The ObjectServer, which is the second tier of Netcool's three-tier architecture, is a real-time,
object-oriented, memory-resident, active database which stores and manages the collected
network events.

The ObjectServer consolidates, associates and de-duplicates normalized data from the Probes,
converting events, such as faults and alarms, into event objects that can be easily manipulated
to create associations and filters.

The active components of the ObjectServer include its de-duplication capability and its ability
to correlate event objects with other event objects, make decisions on information, automate
operator responses and facilitate problem resolution.
The ObjectServer, which has been designed and optimized for handling large volumes of
events messages, can process hundreds of alarms per second and can collect data from
multiple Probes concurrently.

The ObjectServer architecture also permits multiple authenticated users to view all the events
throughout the enterprise. In addition, since one network fault can impact several locations in
a distributed environment and can therefore trigger multiple events, the ObjectServer is
designed to automatically de-duplicate repeated events so that network operators can easily
identify the root cause.

We believe that the ObjectServer architecture provides us with a competitive advantage in

both the speed with which it collects network events and the ability to associate event
information with the services it manages.
 IBM TIVOLI NETCOOL OVERVIEW

9
ObjectServer (Contd.)

The ObjectServer is key to the entire Netcool suite. OMNIbus is the key Netcool component and
the ObjectServer is key to OMNIbus.

The ObjectServer is a memory resident database, which makes it extremely fast and able to cope
with far more events per second than it would otherwise be able to. It uses a subset of SQL which
is referred to as ObjectServer SQL.

Generally, data is inserted into the ObjectServer by Probes and is viewed through WebTop or
OMNIbus Event Lists.

Once data is in the ObjectServer, it can be manipulated by Tools and Automations. Tools and
Automations are, in their simplest form, pre-created SQL statements which are run either
manually by a user (in the case of Tools) or automatically when certain criteria are met (in the
case of Automations).

Tools and Automations can also insert and delete data from the ObjectServer and they can both
run command line actions as well as SQL statements.

The ObjectServer manages two key features of OMNIbus, Correlation and De-Duplication.
 IBM TIVOLI NETCOOL OVERVIEW

10
Netcool OMNIbus default ports
 4100 - TCP/IP – Object server [NCOMS] connection port.
 4200 – Process Control (NCO_PA)
 4300 – Gateway (NCO_GATE)
 4400 - Proxy Server (NCO_PROXY)

The IDUC Ports will be assigned automatically, we don't have to specify them.
On your Firewall, you need to open the ports mentioned in $OMNIHOME/etc/omni.dat (if
Unix machine) and Server's Editor (if Windows machine).

Also you need to open the below mentioned default ports On the Firewall:
 4100 - Sybase communication (TCP)
 6969 - IDUC (UDP)
 27000 - flexlm licensing port
 1534 - Elan license server (UDP)
IMPACT OVERVIEW
 IBM TIVOLI NETCOOL OVERVIEW

12
Introduction

Netcool/Impact allows Solutions to be created which satisfy Customer Objectives.

Netcool/Impact is enterprise and network management software that automates the support of business-critical functions. The software
helps enrich events with business context, provides an integrated view of data from multiple sources in context and enables automations.

Tivoli Netcool Impact includes the following features and benefits :

 Collects and injects contextual details into events, incidents and problems.

 Correlates and displays information from multiple sources to enable operations to make quick decisions or take action.

 Initiates or automates action based on the current state of events and logical policies.
 IBM TIVOLI NETCOOL OVERVIEW

13
Introduction
Netcool Impact provides the ability to add ‘context’ to the original OMNIbus event. Existing databases and application
Impact Server via Data Source Adaptors (DSA).

Policies within Impact use the original OMNIbus event information – fed to Impact via a gateway process (Event Read
information with data from the tables within these databases/applications

 Event Enrichment
Event enrichment is the most common use of Impact. Using the data from the external databases/applications we can
OMNIbus event with this data where necessary.

 Event Suppression
With the correct data in external provisioning applications Impact can enable events to be suppressed from the Oper
via a filter where necessary.
IBM TIVOLI NETCOOL OVERVIEW

14
 IBM TIVOLI NETCOOL OVERVIEW

15
Netcool Impact Components
A Netcool/Impact deployment consists of the Impact Server, Name Server, and the GUI Server.

Impact Server :

 The Impact Server is responsible for managing the data model, running services, and policies that make up your Netcool/Impac
implementation, and runs the policies in real time in response to events that occur in your environment.

 An IBM Tivoli Netcool/Impact server has a runnable subcomponent called the JRExec server that you can use to run external
commands, scripts, and applications from within a policy.

 The Impact Server runs as an application instance inside a JavaTM application server, by default the embedded version of WebSp
Application Server. The application server is deployed automatically as part of the Netcool/Impact installation
 IBM TIVOLI NETCOOL OVERVIEW

16
GUI Server
 The GUI Server is responsible for generating the dynamic web- based user interface of Netcool/Impact.

 The IBM Tivoli Netcool/Impact GUI server is the component that is responsible for managing the IBM Tivoli Netcool/Impact GUI.

 The GUI server brokers HTTP requests from users’ Web browsers and returns the graphical ser interface views that you use to wo
with IBM Tivoli Netcool/Impact data models services and policies. Only administrators have a need to access the GUI.

 The GUI server has a subcomponent called the IBM Tivoli Netcool/Impact nameserver that provides application registry functiona
for IBM Tivoli Netcool/Impact components. IBM Tivoli Netcool/Impact components use the nameserver to locate and establish conne
to each other. The IBM Tivoli Netcool/Impact server also uses the name server for server clustering.
 IBM TIVOLI NETCOOL OVERVIEW

17
Data Models

 Data source
A data source is an element of an IBM Tivoli Netcool/Impact data model that represents an external source of data (for
relational database). Each database must be defined as a separate data sources.

 Data type
A data type is an element of an IBM Tivoli Netcool/Impact data model that represents a set of data stored in a data sou
table or view in a relational database). Each distinct table must be defined as a separate data type.

 Data item
A data item is an element of a IBM Tivoli Netcool/Impact data model that represents an actual unit of data stored in a d
example, a row in relational database table).
 IBM TIVOLI NETCOOL OVERVIEW

18
Data Source Adaptors

Data Source Adaptors (DSAs) are software components that IBM Tivoli Netcool/Impact uses to communicate with external data sources.
The Object Server DSA is a required component for IBM Tivoli Netcool/Impact.

 Policies
A policy contains a set of statements written in the Impact policy language, or IPL. Each statement is an instruction that describes a task t
perform when certain events or status conditions occur in your environment.

As Impact policies has access to all fields from the original OMNIbus event, they can change the field values where necessary enhancing
adding more context, enabling more informed decisions and enhancing their Event Management process.

Instructions can be for high-level tasks or low-level tasks. A single implementation of Tivoli Netcool/Impact can have any number of
associated policies.
WEBGUI OVERVIEW
 IBM TIVOLI NETCOOL OVERVIEW

20
WEBGUI/Desktops
The Desktop, the third tier in Netcool's three-tier architecture, is an integrated suite of software tools designed for use by opera
administrators to create filters, customize views of network event data, monitor several services simultaneously, and automatic
service problems.
Network operators can quickly build filters by responding to simple onscreen queries about user preferences. They can also ass
events with services through the use of simple "drag-and-drop" technology that automatically creates the Boolean logic and SQ
to retrieve the data from the ObjectServer. In this way, non-programmers can manipulate the data in the ObjectServer to custo
views of event data.

In addition, each operator can use Desktops to resolve element problems directly or automate responses to common network
when critical thresholds are reached. Operators can use Desktops to monitor services through EventLists, the EventList Console
ObjectiveView.

The EventList presents a configurable spreadsheet-like view of the de-duplicated faults and acts as the primary interface throug
operators access problem resolution tools. The EventList Console depicts a concise view of the EventLists for several services w
ObjectiveView provides a graphical view of the network or services that depend upon it.
Administrators can use Desktops to configure the ObjectServer and the operator's desktop environments. Desktops run on mul
computing platforms, including UNIX/ Motif, Microsoft Windows NT, or Web browsers via Java applications.
 IBM TIVOLI NETCOOL OVERVIEW

21
Netcool WEBGUI

Netcool Webtop/WebGUI is a web-based application that

processes network event information and presents the data
output to the users so that they can monitor events in their
netcool environment.

Events data is published from one or more data sources in real

time so that the operatives can view pages that display this
information in a web browser.

Netcool/Webtop extends the event visualization and

management capabilities of Netcool/OMNIbus by being both
highly configurable and remotely accessible through internet.

Netcool/Weptop can simultaneously connect to one or more

Object Server, and centralize this information in one page view.

The end users can view all relevant alerts by examining different
AELs, LELs and Table view for each data source.
 IBM TIVOLI NETCOOL OVERVIEW

22
WEBGUI Users, Groups, Roles
 IBM TIVOLI NETCOOL OVERVIEW

23
WEBGUI Roles
Roles must be assigned to users so that the users can view data and execute functions. The user roles for the Web GUI are as follows:
 
 ncw_user
The role gives a user access to the event management functions of the Web GUI. In addition to this role, the user must also have the nc_admin
role, netcool_rw role or the netcool_ro role; these roles control whether the user has administrative access, read-write access or read only
access to these functions.
 ncw_admin
This role gives a user access to administrative functions of the Web GUI. A user with this role also requires the ncw_user role.

This role gives a user read-write access to Web GUI event management functions. Users with this role have access to AEL tools and can change
event data. A user with this role also requires the ncw_user role.
 netcool_ro
This roles gives a user read-only access to Web GUI event management functions. Users with this role can access the AEL and view events, but
cannot run AEL tools or change event data. A user with this role also requires the ncw_user role.
 ncw_dashboard_editor
This role gives a user access to the portlet preferences of the Event Dashboard portlet. Read-only users can also have this role.
 IBM TIVOLI NETCOOL OVERVIEW

24
Active Event List (AEL)
Availability Events Active Event List (AEL)
The Active Event List (AEL) is an interactive table that displays network alert data from an ObjectServer. Use the AEL to monitor alert data
and manage information relating to faults in your network.
Severity // Indicates the alert severity level in Netcool
0 (Green) = Clear ; 1 (Purple) = Intermediate; 2 (Light Blue) = Warning;
3 (Yellow) = Minor; 4 (Orange) = Major; 5 (Red) = Critical
THANK YOU