TIBCO Hawk Introduction

Overview of TIBCO components

2.1 Overview of TIBCO HAWK

TIB/Hawk Display is an application for viewing and managing TIB/Hawk objects on a network. You use TIB/Hawk Display to discover TIB/Hawk Agents that are running, and to create configuration objects such as rules and schedules that can be stored locally or on the network. TIB/Hawk Display also allows you to communicate with the microagents that respond to instructions or rules on each agent machine.

While monitoring or performing management tasks, TIB/Hawk Display communicates with TIB/Hawk Agents on your network. A TIB/Hawk Agent receives the alerts and uses a microagent to do the work.

Like other TIB/Hawk product components, TIB/Hawk Display is location-independent. One or more instances of the application can run on any machine on your network, and each can show the same view of objects and events. TIB/Hawk Display is also platform-independent, so an instance running on one platform can monitor the events on any other platform supported by TIB/Hawk.

2.2 TIB/HAWK Agents and Microagents

TIB/HAWK agent is a process that monitors activity on a particular machine by processing loaded rulebases. They send regular messages that broadcast their identity and active state. The TIB/Hawk Display application listens for TIB/Rendezvous messages from agents and maps the agents it has detected.

The agent makes use of the managed objects on its local machine using microagents. Microagents represent managed objects such as networks or applications. Each microagent consists of a set of methods to the agent that the agent uses to collect information and take action. A set of default microagents is included when you install TIB/Hawk software. These lists of microagents vary depending on the operating system and some standard microagents get installed in every platform.

2.3 Rulebases

A rulebase is a collection of rules that contain management logic. Several default rulebases get installed with TIB/Hawk software for general monitoring activities.

A rulebase can be loaded on a single agent, on a group of agents, or on every agent in the network. These rules monitor different parameters of an operation system and perform the tasks. The rules in a rulebase should be related to make the administration simpler. A particular application can be monitored by multiple rules in a rulebase each one issuing different alerts based on the test condition.     

3. TIB/HAWK Display

When you start TIB/HAWK display, the display would be in icon view in which the containers are displayed in standard icons. Then the network nodes are arranged in a tree of containers. By clicking the container in the left pane displays the items based on the subnet or location whichever we choose which can be done in preferences options in the right pane. When you start the HAWK display the agents container is empty initially which keeps discovering till all the nodes are found. Both the icons for the agents and discovered are green in color initially. You can have rulebases also in the containers display in the left pane. The repositories can also be included if we are maintaining them in our network. The color of the agents, discovered and rulebases change based on the alert messages or the heartbeat of the agents.

The icon color also changes based on the alerts found in each of the agent. By default an icon can have six different colors each color stating different meaning.

Default Color	Alert level meaning
Purple	The agent was discovered but currently no heartbeat message is being received. The lack of response could mean the agent is not running, the agent machine is down, or a network communication problem exists.
Red	At least one high-level alert is active.
Orange	At least one medium-level alert is active.
Yellow	At least one low-level alert is active.
Cyan	The agent is recovering. At least one alert was active within the last 30 minutes (default), but any active alerts were recently cleared or suspended.
Green	No alerts are in effect.

These alert level colors can also be changed in the Preferences dialog. Please refer TIBCO documentation for TIBCO HAWK to get the detailed explanation on how to change the preferences.

Each container icon is split horizontally into two equal sections. The upper section represents all the agents in the container, and is always in a single color. This color reflects the highest level of alert found on any agent. The lower section shows the distribution of each alert level on the network.

4.  Viewing Alert Messages

Alerts are messages an agent sends to TIB/Hawk Display when a specified test condition occurs. Alerts initiate from rulebases that enforce your monitoring logic. In TIB/HawkDisplay, the colors of each agent and container icon will show alert levels, and the Alert Display window shows alert details for a particular agent or all agents.

To view alert messages for an agent:

1. Arrange TIB/HawkDisplay so that the agent to view alerts for appears on the right.

2. Right-click on the agent icon and select “Show Alerts” from the menu.

The Alert Display window displays messages for the selected agent as below:

The Alert Display shows alert and notification messages. When a test with an Alert or some notifying action becomes true, TIB/Hawk Display receives the message unless advanced options delay it.

Each line in the Alert Display represents a single message published by a TIB/Hawk Agent. However, a single condition can generate multiple alert messages and other actions, depending on how the rule is designed in the rulebase.

To see the active alerts for which the action needs to be taken yet Active alerts radio button needs to be checked. To see the detailed information about any alert, you need to double click on any alert. After checking the alert detail, Done button needs to be clicked.

5.  Suspending Alert Messages

An alert message can be temporarily cleared manually by suspending an alert message to prevent it from interfering with other monitoring tasks. This suspension can be done if the alert is continuously interrupting other monitoring tasks and if the problem is being resolved. You need to provide the reason for suspending an alert which will be visible to everyone who is using the HAWK display.

To suspend an alert:

1.    Open the Alert Detail dialog by double-clicking the alert to suspend.

2.    Click the “Suspend Alert” button.

3.    Specify a suspension interval by selecting a value from the dropdown list or typing a different value. The default value is 60 minutes.

4.    Type a reason for suspension to communicate to other users in the Alert Detail dialog.

5.    Click “OK” button.

6. Clearing AlertMessages

Alerts are cleared when the alert condition, as defined by the rulebase, does not exist anymore. Alerts generated by tests on synchronous data sources, which deliver data at fixed intervals, are cleared by default at the first test repetition when the condition no longer holds. Alerts generated by tests on asynchronous data sources, which deliver data when it becomes available, are cleared by default when the test does not evaluate to true for 15 minutes. You can modify this default behavior using advanced test and action properties in the rule.