Hawk

Slowdowns and sudden outages are very critical to every business nowadays. Businesses cannot afford to have any delays in their operations that may cause financial losses. Constant system monitoring is needed to prevent and predict any possible failures and downtimes. This is why TIBCO developed a software that has the capability to monitor and manage not only the systems and applications but the network statistics as well. What is TIBCO HAWK? TIBCO Hawk is a network monitoring and management software for distributed systems and applications in the enterprise. It is designed using the concept of an independent smart agent that runs on each node in the network to monitor local conditions, so there is no need for a centralized monitoring console or frequent pooling across the network that can consume more bandwidth or cause network traffic. One of the advantages of using TIBCO Hawk is that it uses less bandwidth while monitoring every machine in the network. It is because TIBCO Hawk distributes the monitoring load to each machine that has locally installed Hawk agents in order to conserve system resources and network bandwidth. The system administrator has now the capability to monitor the operating system, the application parameters and behaviors of each machine in the network using only less bandwidth. Another great advantage of TIBCO Hawk is that, in case of network failure, the Hawk agents will continue to perform local tasks because each agent operates independently from the other. One of the benefits of using TIBCO Hawk is that it reduces sudden or unexpected system outages and slowdowns. TIBCO Hawk has this capability to automatically repair failures and slowdowns within seconds of detection and it also allows problems to be found and fixed before any slowdowns and failures can occur. TIBCO Hawk system architecture. There are two major components that make up the TIBCO Hawk System: the Agents and the Console Applications. Agents reside on each computer in the network and perform monitoring and managing duties. It uses rulebases as a monitoring policy and microagents to extract monitoring information and to carry-out specified tasks. The Console Applications, on the other hand, can be further divided into three subcomponents: the TIBCO Hawk Display that provides the interface to monitor and manage agent behavior in your network, the Event Service that records and logs all the activities of the agent, and the bridges to other management systems. Features of TIBCO Hawk Display The TIBCO Hawk Display is a local window for all the activities in the network, which provides a graphical user interface used for viewing active agents in the network. It displays container icons that are created for each agent and arranged in clusters. These agent icons are, by default, clustered according to subnets. It also allows you to customize container icons and to convey added information that can be useful for your monitoring. Menus and dialogs are provided for you to create, modify and distribute rulebases to any agent present in the network. You can also invoke a microagent method that allows you to view the results immediately. Features of TIBCO Hawk Event Service The TIBCO Hawk Event Service does not only record the activity of TIBCO Hawk agents but it also logs and subscribes to all TIBCO Hawk system events such as agent activation and expiration, microagent and rulebase changes, alerts and clears. The external applications must be saved on a data file in order for them to access the logs. If ever there is an expired or non-communicating agent in the network, the Event Service provides the use of a usersupplied script to notify the system administrator. How does TIBCO Hawk agent operates? The Hawk agent uses microagents as an object to represent and interact with the managed

object in your local machine. Then, the agent loads the rulebases as monitoring policies to monitor your system or your applications. It uses RV Messaging to communicate with the microagents, and uses EMS or RV messaging to communicate with other agents, Event Service and Hawk Display. It also communicates using instances of TIBCO Hawk Display but it works independently with the Display and other agents. What is the difference between the Hawk Microagent(HMA) and Application Microagents? HMA or Hawk Microagents are default microagents residing on your local machine to monitor system's health and statistics. HMA can be a platform-specific or platformindependent microagent. It means that every platform has its own specific microagent or it has microagents that are default to any platform. The Application Microagents, on the other hand, are microagents that are specifically created or coded to monitor the application statistics. Only those applications that use AMI are dynamically discovered by the Hawk System and represented by microagents that enables those applications to be managed and monitored. What is AMI or Application Management Interface? Application Management Interface (AMI) is a gateway between the external applications and Hawk System that uses RV Messaging to communicate. It is used as a protocol in instrumenting an application with a management interface that allows the application to be monitored and controlled by exposing internal application methods to the TIBCO Hawk system. TIBCO Hawk Agents operate by loading rulebases. So, what are rulebases? Rulebase refers to a collection of rules that controls the monitoring conducted by the agents, which can be created or modified using the rulebase editor in the TIBCO HAWK Display. It uses a microagent method as a data source to create one or more tests. These tests use If/else construct to check the conditions and includes action if the condition evaluates to true. An action, can be sending an alert or notification messages, execute an OS command, creating post condition, or invoking another microgent method. What are Alert Messages? Alert messages originate from a rulebase that implements the monitoring policy or logic. When a specified condition occurs, the agent publishes an alert message to the TIBCO Hawk Display and presents it by colors to show the severity of the alert. It uses colors such as red for high alert, orange for medium alert, yellow for low alert, cyan if it's recovering, green if it's ok and purple for no heartbeat. These colors are default to the Hawk Display but it also allows you to change them based on your own preference. You can also suspend an alert message that will be temporarily neutralized to prevent it from interfering with other monitoring tasks. If ever a condition ceases, these alerts will be cleared or removed in the Display. What is a rulebase scheduling? Rulebase scheduling allows you to create a schedule that defines when a rulebase, rule, test or action is active or not. These schedules can be imposed on the rulebase to control the monitoring activity and performing corrective tasks. You can define and assign a schedule using the TIBCO Hawk Display, which must be saved on a file so that it can be assigned later on to one or more agents and can be applied to any rulebase objects. In creating a schedule, you can also specify inclusion and exclusion periods. For example, you can set a rulebase to be activated only during office hours and be deactivated during holidays. For the inclusion period, you can use Mondays to Fridays from 8 AM to 5PM and for the exclusion period you can include holidays such as Christmas and New Year. What are the Hawk Group operations? There are three Hawk Group operations: the Network Query, Network Query with test and Network Action. These group operations allow you to detect and solve problems in the

network. If you want to research and test on how to build rules, these Hawk Group operations can be used as an interactive tool. Network Query, from the name itself, queries one or more agents in the network to detect the location where such specified condition exists. It is such a powerful feature that allows you to communicate with multiple TIBCO Hawk agents at one time. As an individual agent, you can ask or query multiple agents in your network. The Network Query with test, on the other hand, is where you apply a test based on the results of the network query. You can use these tests to filter the result set, but these tests are optional and only one test per query is allowed. Lastly, the Network Action specifies an action to be performed on any agent in the network but you can only specify an action one at a time. Both the Network query and Network Action allow you to combine common and identical tasks which can be executed in a single operation and can be performed on each agent in the network. What are the monitoring best practices? Using TIBCO Hawk, you can have these practices to achieve an efficient and effective way of monitoring your system and your applications.

•

Create a rulebase based on the process existence. This is to check or test whether there are not enough or too many process instances that are running or you can use this rulebase to automatically restart a failed process.

•

Creating a rulebase that monitors the process resource utilization. This is to make sure that the use of the resources such as the memory and the CPU don't get too big overtime, which might affect the system's performance.Create a rulebase for your LogFile or Event Log Monitoring. Through this, you can make or define another rule based on the entries of those activities logged on which you'll be able to perform necessary actions.

•

Checking for the existence of an Application Microagent also needs to be monitored. This is useful in a situation where you want to detect if the application that you are monitoring is not responding or not communicating with the agents.

After studying and configuring TIBCO Hawk System, you will see that it is such a powerful monitoring tool. It can help system administrator to guarantee and improve software performance and availability. With the solutions provided by TIBCO Hawk, monitoring can now be implemented in the network without worrying much of the use of the bandwidth and the network traffic.