Robot/CONSOLE has important resource and log monitoring features

In addition to message management, Robot/CONSOLE has important resource and log monitoring features that let you monitor jobs, job queues, subsystems, FTP requests, QHST messages, security audit log changes, and more. Based on this monitoring, Robot/CONSOLE can notify you or generate reports. This article explains how to use these special monitoring features.

Resource Monitoring
Robot/CONSOLE can check the status of your critical resources regularly. The RBCRSCMON monitor job runs in the RBTSLEEPER subsystem and automatically checks the status of resources that you set up using the Resource Maintenance panel. When it finds a resource that is NOT in the expected status, it sends a message to a virtual message queue, RBCRSCQ. Using Robot/CONSOLE, you can monitor the following resources:

• Controllers

• Device Descriptions

• Domino Servers

• FTP Servers

• HTTP Servers

• Jobs

• Job Queues

• Line Descriptions

• TCP/IP Servers

• Network Servers

• Objects

• Output Queues

• TCP/IP Ports

• Subsystems

• Servers

• System CPU %

• Network Interfaces

You specify the expected status of the resource and how often Robot/CONSOLE should check. Figure 1 shows an example of how you might set up monitoring for a job queue depth over 10. If the resource monitor job (RBCRSCMON) checks the status and finds more than 10 jobs in the job queue, it sends a message (message ID JBQ0003) to the virtual message queue (RBCRSCQ). You also need a message set to handle the message. Your message set can send a pop-up message, page you using Robot/ALERT, or take some other action by using OPerator Assistance Language (OPAL) code.

Log Monitoring
Robot/CONSOLE provides three types of log monitors: FTP, QHST, and Security Audit Journal.

1. FTP requests. This monitor looks for FTP requests from other systems. A special monitor job (RBCLOGFTP) monitors these events and sends a message to the virtual message queue (RBCLOGFTP). Robot/CONSOLE records the request, who made the request, and when the request was made. Robot/CONSOLE monitors for the following FTP requests: delete file, send file, receive file, rename file, and execute command.

2. System history log (QHST). Turn this monitor on to monitor messages sent to the system history log (QHST). A monitor job (RBCLOGHST) logs QHST messages to a virtual message queue (RBCLOGHST). To avoid message overload, set up a message set and message table to unconditionally suppress frequently occurring informational messages. To determine which messages to include in the message table, run the “Summarize QHST Messages” report (Figure 2). You can run this report from a command line using the following command:

RBTCONLIB/RBCSUMQHST

3. The Security Audit Journal. To monitor security audit journal entries, turn on the Security Audit Log. A monitor job (RBCLOGAUD) converts System i security audit journal entries into message IDs and sends them to a virtual message queue (RBCLOGAUD). You can capture any or all of the following QAUDLVL security audit journal entries: *SECURITY (changes in system values or user profiles), *AUTFAIL (failed sign-on attempts or access to objects), *SERVICE (catches attempts to sidestep security using Service Tools or APIs), and *SYSMGT (changes to system reply list entries, operational assistant functions, and so forth).

You turn log monitors on using the Log Monitoring Setup panel (Figure 3).

Reporting
All log and resource monitoring messages are recorded so you can print history reports quickly for SOX auditors. For example, to print all messages relating to FTP requests, run the Message History List report from the History Reports menu and specify the “Originating Center” as RBCLOGFTP. You can do the same for resource monitor messages (RBCRSCQ), security audit log messages (RBCLOGAUD), and QHST messages (RBCLOGHST).

Contributed by Jenny Dischinger, Technical Consultant

This entry was posted on Wednesday, August 22nd, 2007 at 8:32 am and is filed under Resource Monitoring, Robot/CONSOLE. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.