raw data is the data collected by a patrol agent and events are so to say text only information that is triggered by thresholds or other ways. so data is performance values collected
1 of 1 people found this helpful
No, they are not the same. Events are messages that are triggered by thresholds. In TSOM and BPPM, thresholds can be set at the PATROL agent or on the TSIM/BPPM server.
If the threshold is set at the PATROL agent, the agent will generate a PATROL event and send it to the integration service. From there, it is usually sent to the cell in the TSIM/BPPM server. If you see an event on the console and its class is "PATROL Event", you know it was triggered directly by the PATROL agent.
The thresholds on the PATROL agent are not "smart", i.e. they don't use the statistical baselines calculated by the TSIM/BPPM analytics engine. Therefore, we recommend only using PATROL thresholds for triggering up/down alerts, for example "process not running" or "no response to ping". For these kinds of alerts, the concept of "normal behavior" does not apply.
You use the "server thresholds" on the BPPM/TSOM server to generate events that take into account the baselines (i.e. the normal range of values of a metric). For these thresholds, the PATROL agent sends its numeric data, for example CPU Utilization or Disk I/O, to BPPM/TSIM. This data is the "raw" monitoring data generated by the agent. The TSIM /BPPM server analyzes this data and determines whether it has violated a server threshold and/or is outside of its normal range, e.g. "CPU utilization on server xyz is above its hourly baseline". These events are generated by the TSIM/BPPM server using the numeric data sent by the agent. They have a class of "ALARM".
Most customers use both agent thresholds and server thresholds. They use agent thresholds for up/down types of events and server thresholds for the kinds of data where it is useful to take into account the normal behavior of the metric. CPU utilization, Memory Usage, Paging Activity, Disk I/O and Network I/O are all examples of this kind of data.
Thank you Brendan for share the inforamtion.
So as per my understanding, IF we set the thresholds in server side, So
Patrol agent send raw data to ISN
And ISN send same RAW data to BPPM, Right?
So BPPM send the event information to ticketing tool?
If the above is correct, how they decide ISN and BPPM?
When you create package patrol agent package there you provide ISN details so that Patrol agent could communicate with ISN (which you have specified while creating package).
If you set global or instance threshold TSIM/BPPM itself generate events once threshold get breached. But if you set patrol threshold the Patrol agent will send data to ISN and events to remote cell which you might have installed with ISN or separately.
And yes BPPM/TSIM send event information to ticketing tool once you create propagation policy in admin console of TSIM/BPPM.
Could you confirm the below pints.
I have installed Patrol agent on SERVER3
and ISN in SERVER2
and BPPM/TSIM in SERVER1.
1)So what is flow from Server3 to Server1?
2)Is it RAW data or events information?
3)What information is contains in RAW data?
4)What information is contains in Event?
I have some confusion about RAW data and Event information.