Event collection from BMC TrueSight

The MID WebService Event Collector enables you to collect JSON formatted event messages sent from BMC TrueSight Operations Management (TrueSight), previously known as BMC ProactiveNet Performance Management (BPPM), utilizing event stream notification capabilities.

Before you begin

Ensure that you:
Role required: evt_mgmt_admin

About this task

JSON formatted event messages are sent from BMC TrueSight. The MID Server transforms the collected event messages by parsing them using the TransformEvents_bmcTrueSight script include.

The collection of JSON formatted event messages is described in this procedure using basic authentication. For more information about supported authentication methods, see Configure the MID Web Server extension.

Procedure

  1. In BMC TrueSight, set the MID WebService Event Collector as the target for BMC TrueSight notification, using these parameters:
    Parameter Description
    MID WEB SERVER EXTENSION IP IP address of the MID Web Server Extension.
    MID WEB SERVER EXTENSION PORT Listening port of the MID Web Server Extension.
    MID WEB SERVER EXTENSION USER Username for the MID Web Server Extension.
    MID WEB SERVER EXTENSION PASSWORD Password of the user of the MID Web Server Extension. However, encode the password in BASE64. For example, if the MID Web Server Extension password is admin, in this case use YWRtaW4= as the password for MID WEB SERVER EXTENSION PASSWORD.

    To determine the BASE64 value, you can use the utility at this website: https://www.base64encode.org/

    TrueSightserverHost Name of the BMC TrueSight server.
    TrueSightserver PORT Number of the BMC TrueSight port.
  2. In the URL and message body, replace the parameters with the values in the preceding table and connect to BMC TrueSight. Use the BMC Publish-Subscribe REST approach to create a stream event subscription and send event messages in JSON format.
    http://<TrueSightserverHost>:<TrueSightserver PORT>/bppmws/api/stream/subscribe?dataType=event

    Example, showing the message body.

    {
        "subscriptionName": "Prod_Critical_events",
        "criteria": [
            {
                "resourceType": "cell",
                "condition": "name EQUALS \"pncell_server1\"",
                "criteria": [
                    {
                        "resourceType": "event",
                        "condition": "severity NOT_EQUALS \"TEST\""
                    }
                ]
            }
        ],
        "destination": {
            "type": "REST",
            "url": "http://<<MID SERVER EXTENSION IP>>:<<MID WEBSERVER EXTENSION PORT>>/api/mid/em/TransformEvents_bmcTrueSight"
            "username": "<<WEB SERVER EXTENSION USER>>",
        "password": "<<WEB SERVER EXTENSION PASSWORD>>"    }
    }
    

Result

The http://{MID_Server_IP}:{MID_Web_Server_Port}/api/mid/em/TransformEvents_bmcTrueSight URL is used instead of the http://{MID_Server_IP}:{MID_Web_Server_Port}/api/mid/em/inbound_event?Transform={Transform_script_name} URL because in this case the Transform parameter cannot be used.

Table 1. Example of mapping event messages to event fields in the Event (em_event) table
Event field Event message
node mc_host
type mc_object_class
metric_name mc_parameter
resource mc_object
severity severity
time_of_event date_reception
description msg