Policy Manager. User Guide. Document 5162

Transcription

1

2 Notice Copyright Notice Copyright 2004-present by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to: All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100-percent effective, we strongly recommend that you write protect the licensed software and verify (with an antivirus system with which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc., 273 Corporate Drive, Portsmouth, NH USA Phone: U.S. toll-free: Web site: Page 2

3 Contents Notice... 2 Preface... 6 Intended Audience... 6 Text Conventions... 6 Document Feedback... 7 Online Documents... 7 Overview... 8 Policies... 8 Policy Search Criteria... 8 Policy Settings... 9 Policy Rules... 9 Policies... 9 Policy Enforcement Configuration...10 Implementing Policies Prerequisites...11 XML Files...11 Pre-Defined Policies...12 Port Fault Management Policy...12 Policy Settings...12 Attributes...13 Device Fault Management Policy...13 Policy Settings...13 Attributes...14 General Management Policy...14 Policy Settings...14 Attributes...15 Polling/Communication Policy...15 Policy Settings...15 Attributes...16 Page 3

4 Alarm Thresholding Policy...17 Policy Settings...17 Attributes...17 Port Performance Thresholding Policy...17 Policy Settings...18 Attributes...18 Device Configuration Policy...18 Policy Settings...18 Attributes...19 Implementing a Pre-Defined Policy...20 Step 1: Copying XML Files to the PolicyMgmt Directory...20 Step 2: Checking Policy Enforcement...21 Step 3: Selecting the Pre-Defined Policy and Policy Settings...22 Step 4: Selecting the Pre-Defined Search Criteria...24 Step 5: Defining Policy Rules...25 Step 6: Enabling the Policy...27 Step 7: Enforcing Policies...28 Setting Up the Distributed Environment...29 Alarm Thresholding Policy Example...29 Defining Your Own Search Criteria...32 Search Criteria Syntax...33 Wildcards in Search Criteria...34 Specifying Multiple Attribute/Value Pairs...34 Specifying a Landscape to Search...35 Composite Policy Search Criteria...35 Searches Based on the Port s Link Type...35 Defining Your Own Policy Settings...37 Managing Policies Information View...38 Reacting to a Model Attribute Value Changes...39 Viewing Status...40 Enforced Policy Log Files...40 Page 4

5 Policy Data Loading Events/Alarms...40 Viewing Policies in OneClick...41 Policy Information...43 Model Information...44 Rule Information...46 Security...47 Troubleshooting Tips Default Rules...48 Distributed Mode...48 Switching Policy Distribution Modes...48 backup-data-on-reload...48 Index Page 5

6 Preface In This Section Intended Audience [page 6] Text Conventions [page 6] Document Feedback [page 7] Online Documents [page 7] Intended Audience This guide is intended for administrators who want to use SPECTRUM s to enforce network management policies. You should be familiar with XML before attempting to use SPECTRUM s. Text Conventions The following text conventions are used in this document: Element Convention Used Example Variables (The user supplies a value for the variable.) The directory where you installed SPECTRUM (The user supplies a value for the variable.) Courier and Italic in angle brackets (<>) <$SPECROOT> Type the following: DISPLAY=<workstation name>:0.0 export display Navigate to: <$SPECROOT>/app-defaults Solaris and Windows directory paths Unless otherwise noted, directory paths are common to both operating systems, with the exception that slashes (/) should be used in Solaris paths, and backslashes (\) should be used in Windows paths. <$SPECROOT>/app-defaults on Solaris is equivalent to <$SPECROOT>\app-defaults on Windows. On-screen text Courier The following line displays: path= /audit Page 6

7 Element Convention Used Example User-typed text Courier Type the following path name: C:\ABC\lib\db Cross-references References to SPECTRUM documents (title and number) Underlined and hypertextblue Italic See Document Feedback [page 7]. SPECTRUM Installation Guide (5136) Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Thank you for helping us improve our documentation. Online Documents SPECTRUM documents are available online at: Check this site for the latest updates and additions. Page 7

8 Overview SPECTRUM s uses SPECTRUM s multitude of configuration options to create network management policies which enforce network management practices appropriate for your network. These policies allow you to automatically configure how SPECTRUM behaves on a broad scale, greatly decreasing the administrative burden of network management. provides you with the ability to apply pre-defined network management policies across all device and port models in a distributed SpectroSERVER environment. It also allows you to add, remove, or modify the Policy configuration while the SpectroSERVER is running and have the changes applied immediately. SPECTRUM completely automates the enforcement of management policies in SPECTRUM, making it unnecessary for you to make manual updates as models are added or changed. Policies Policies are made up of a series of SPECTRUM attribute settings that, when applied to a defined set of models, allow SPECTRUM to consistently implement a network management configuration. For example, you might implement a Policy which defines how SPECTRUM manages alarm thresholds on all router port models. This Policy would be enforced on all existing router port models and would also be implemented on any newly created router port models. XML files are used to define the five required parts of a Policy: Policy Search Criteria, Policy Settings, Policy Rules, Policies, and Policy Enforcement Configuration. Policy Search Criteria Policy Search Criteria is made up of attribute ID/value pairs which identify a set of models. allows you to define your own search criteria and also provides a series of pre-defined search criteria for the most common types of searches. Examples of pre-defined Policy search criteria include: Routers, Switches, All Ports, etc. Pre-defined searches have been supplied that match just about every pre-defined search in Search Manager. Page 8

9 Policy Settings Policy Settings are used to define the model attributes and attribute values that should be maintained by a Policy. allows you to define your own Policy Settings but also provides a series of pre-defined Policy Settings. Examples of pre-defined Policy Settings include Passive Port Monitoring, Poll Unconnected Ports, Maintenance Mode, 10 Minute Polling, and Disable Redundancy. Policy Rules A single Policy Search Criteria and a single Policy Setting are combined to create a Policy Rule. There are three different types of Policy Rules that can be defined: device rules, port rules, and device-port rules. Device rules can apply to any device in the landscape. Port rules can apply to any port in the landscape. Device-port rules can be applied to certain ports on certain devices. Device-port rules are very powerful in that they are currently the only way in which SPECTRUM allows you to search and apply settings to certain ports on certain devices. Policies One or more rules can be combined to create a Policy. A Policy is used to define a group of related attributes maintained by a set of Policy Rules. You can think of a Policy as a set of prioritized Policy Rules. Policy Rules are place in priority order in case a model matches more than one of the Policy Rules in the same Policy. A model adopts the settings of the first Rule whose search criteria is matched. It stops evaluating the Rules within a Policy as soon as the first match is made. For example, the provides a pre-defined Policy called the Interface Thresholding Policy. Using this Policy, you can administer the threshold values for interface performance alarming: Load, Packet Rate, Error Rate, and Discard Rate. The Policy contains a prioritized list of Policy Rules for how to set these attributes for various models in the landscape. If a model matches more than one Rule in the Policy, the first Policy Rule in the prioritized list is implemented. You could configure the first rule to say, For all inter-switch link ports, set up these attributes this way. Perhaps the second rule says, For all router ports, set up these attributes that way. Then, there may be a default rule to set up these attributes for any model that does not match any of the previous rules. Page 9

10 Policy Enforcement Configuration Policy Enforcement Configuration allows you to turn Policy Enforcement on or off. It also allows you to configure several parameters that control how Policies are implemented and managed. Page 10

11 Implementing Policies This section gives instructions on how to customize and implement policies. In This Section Prerequisites [page 11] XML Files [page 11] Pre-Defined Policies [page 12] Implementing a Pre-Defined Policy [page 20] Setting Up the Distributed Environment [page 29] Alarm Thresholding Policy Example [page 29] Defining Your Own Search Criteria [page 32] Defining Your Own Policy Settings [page 37] Prerequisites You should be familiar with XML terminology and syntax before attempting to use SPECTRUM s. XML Files uses a series of XML files to define and enforce policies. These files are found in the <$SPECROOT>/PolicyMgmt/Spectrum directory. policy-search-criteria-spectrum.xml: This file contains a predefined set of policy search criteria that can be used in conjunction with Policy Settings to build Policy Rules. This file should not be edited and may be overwritten by subsequent SPECTRUM installations. policy-search-criteria.xml: If the Policy search criteria in the policy-search-criteria-spectrum.xml file does not meet your needs, you can use this file to define new search criteria. policy-settings-spectrum.xml: This file contains a pre-defined set of Policy Settings that can be used in conjunction with Policy search criteria (from either policy-search-criteria-spectrum.xml or policy- Page 11

12 search-criteria.xml) to build Policy Rules. This file should not be edited and may be overwritten by subsequent SPECTRUM installations. policy-settings.xml: If the pre-defined Policy Settings do not meet your needs, you can use this file to define your own Policy Settings. policy-settings-templates.xml: This file contains all of the predefined settings from the policy-settings-spectrum.xml file. It can be used to copy and paste Policy Settings into the policy-settings.xml file where they can be customized. policy-rules.xml: This file is used to combine search criteria and Policy Settings to create Policy Rules. policies.xml: This file is used to combine a series of Policy Rules to create a Policy. policy-enforcement-configuration.xml: This file is used to turn Policy enforcement on and off and to set up other options. Pre-Defined Policies provides a series of pre-defined policies in the policies.xml file. Each Policy has a group of related Policy Settings located in the policy-settings-spectrum.xml file. Each Policy Setting configures the Policy-related SPECTRUM attributes in a different way. You choose the Policy Setting which matches the way you would like to implement your network management. Each pre-defined Policy and its related Policy Settings and attributes are explained below. Port Fault Management Policy The Port Fault Management Policy is used to maintain all port-level attributes related to fault management. Policy Settings There are four pre-defined Policy Settings for this Policy. Passive Port Monitoring - This setting enables port status monitoring using only passive means. SPECTRUM will listen for Link down traps and generate alarms when needed. This is the most efficient, but least reliable means of port status monitoring. These are the default SPECTRUM settings. Page 12

13 Live Pipes - This setting enables port status monitoring using Live Pipes. This means that SPECTRUM actively polls the status of ports involved in modeled connections. You will see colored pipes in all applications displaying the status of the connection. Trap-based monitoring is also enabled for expedited fault detection. Poll Unconnected Ports - This setting enables port status monitoring for ports whose connectivity is not modeled in SPECTRUM. This means that SPECTRUM will actively poll the status of the port. Trap-based monitoring is also enabled for expedited fault detection. Disabled Port Monitoring/No Alarms - This setting disables all port status monitoring methods and prevent any related alarms from being generated. Attributes The attributes listed in Table 1 are used in the Port Fault Management Policy. Table 1: Port Fault Management Policy Attributes Attribute Name Attribute ID Description PollPortStatus 0x1280a Controls status polling of a port whose connectivity is not modeled. ok_to_poll 0x11dd8 Used to make the pipe associated with this port live. The status of the port will be polled AlarmOnLinkDownTrap 0x11fc2 Determines how SPECTRUM handles a Link Down trap on this particular port. AssertLinkDownAlarm 0x12957 Determines if SPECTRUM should generate a yellow alarm on the device model when a link down trap is received for this port GeneratePortStatusAlarms 0x12a54 Used to tell SPECTRUM that a port status alarm should never be generated on this port. Device Fault Management Policy The Device Fault Management Policy is used to maintain all device-level attributes related to fault management. Policy Settings There is one pre-defined Policy Setting for this Policy. Page 13

14 No Invalid DLCI Alarms - This setting prevents SPECTRUM from generating red alarms on DLCI ports that have an invalid state. Invalid DLCIs will have a brown condition instead of a red condition. Attributes The attributes listed in Table 2 are used in the Device Fault Management Policy. Table 2: Device Fault Management Attributes Attribute Name Attribute ID Description PollPortStatus 0x12809 Device-level control over the polling of port status for ports whose connectivity is not modeled. support_icmp 0x11d3d Determines if SPECTRUM should attempt to contact a device via ICMP when SNMP contact is lost. AlarmOnInvalidDLCIs 0x129ee Determines if SPECTRUM should generate red alarms on DCLI ports that have an invalid state. If this is set to FALSE, invalid DLCIs will have a brown condition instead of red. General Management Policy The General Management Policy is used to maintain all device-level attributes related to general network management. Policy Settings Note: Some attributes in these Policy Settings do not have pre-defined values. This means that by default a value setting is not enforced on these attributes. However, you can create your own settings for such attributes if they are necessary for your individual management needs. See Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22] for instructions. There are two pre-defined Policy Settings for this Policy. Maintenance Mode - This setting puts a model into Maintenance Mode and management of this model is suspended. The model will have a brown condition, no events or alarms will be generated on the model. No SNMP requests will be sent to the agent. Page 14

15 No Events Generated - This setting suspends event and alarm generation on the model. SNMP requests are sent to the agent. Attributes The attributes listed in Table 3 are used in the General Management Policy. Table 3: General Management Policy Attributes Attribute Name Attribute ID Description ismanaged 0x1295d Controls SPECTRUM s management of this model. When this is set to FALSE, SPECTRUM suspends management. IsEventCreation Enabled 0x129f8 Prevents SPECTRUM from generating events on the model, but SNMP/ICMP communication is allowed. Criticality 0x1290c Determines the relative significance of this device or port model. This value is used in determining the impact severity of a Contact Lost alarm. Any numeric value is supported. DisableTrapEvents 0x11cd0 Determines if SPECTRUM should escalate a trap into an event on a particular port model. ContactStatus EventSwitch 0x11a56 Determines if SPECTRUM should generate events when the Contact_Status of a device changes. Polling/Communication Policy The Polling/Communication Policy is used to maintain all device and port attributes related to polling and communication with an SNMP agent. Policy Settings There are four pre-defined Policy Settings for this Policy. Note: Some attributes in these Policy Settings do not have pre-defined values. This means that by default a value setting is not enforced on these attributes. However, you can create your own settings for such attributes if they are necessary for your individual management needs. See Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22] for instructions. Page 15

16 No Logging - Model statistics are not logged for the model. 1 Minute Polling - The model is polled every 60 seconds. 5 Minute Polling - The model is polled every 300 seconds. 10 Minute Polling - The model is polled every 600 seconds. Attributes The attributes listed in Table 4 are used in the Polling/Communication Policy. Table 4: Polling/Communication Policy Attributes Attribute Name Attribute ID Description PollingStatus 0x1154f Determines if SPECTRUM should poll the specified attributes of the model. Polling_Interval 0x10071 Controls how often SPECTRUM polls this model. Poll_Log_Ratio 0x10072 Controls how often model statistics should be logged. The actual interval is determined by multiplying the Polling_Interval by the Poll_Log_Ratio. TimeOut 0x110c4 Determines how long SPECTRUM waits to receive an SNMP response before sending a retry. TryCount 0x110c5 Determines how many times SPECTRUM should attempt an SNMP get request before failing. Community_Name 0x10024 The SNMP password used in communicating with a device s SNMP agent. CommunityName ForSNMPSets 0x11a7f The SNMP password used when performing an SNMP set. If this attribute is not filled in for a model, SPECTRUM will use the value of Community_Name. Throttling 0x11f79 Controls whether or not SPECTRUM should restrict the amount of outstanding SNMP requests sent to a device. This helps to alleviate problems involving SNMP agents that cannot handle large amounts of SNMP requests. Throttle_Count 0x11f39 Determines how many outstanding SNMP requests are allowed when throttling is enabled for a device. Agent_Port 0x10023 Controls the port number used when communicating with a device s SNMP agent. Message_Size 0x1197b Determines the largest packet size (in bytes) that SPECTRUM is allowed to send to a device s SNMP agent. Page 16

17 Alarm Thresholding Policy The Alarm Thresholding Policy contains all attributes that are related to rollup condition and significance levels. Policy Settings The pre-defined Policy Setting for this Policy is a template (Alarm Thresholding Settings Template). You can use this template to create your own settings for the attributes managed by this Policy. See Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22] for instructions. Attributes The attributes listed in Table 5 are used in the Alarm Thresholding Policy. Table 5: Alarm Thresholding Policy Attributes Attribute Name Attribute ID Description Value_When_Yellow 0x1000c The model inherits this significance level when its condition is yellow. Value_When_Orange 0x1000d The model inherits this significance level when its condition is orange. Value_When_Red 0x1000e The model inherits this significance level when its condition is red. Yellow_Threshold 0x10010 The model s rollup condition will be yellow when its composite condition is greater than or equal to this value. Orange_Threshold 0x10011 The model s rollup condition will be orange when its composite condition is greater than or equal to this value. Red_Threshold 0x10012 The model s rollup condition will be red when its composite condition is greater than or equal to this value. Port Performance Thresholding Policy The Port Performance Thresholding Policy contains all attributes related to calculating and alarming on port performance. Page 17

18 Policy Settings The pre-defined Policy Setting for this Policy is a template (Port Performance Thresholdings Settings Template). You can use this template to create your own settings for the attributes managed by this Policy. See Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22] for instructions. Attributes The attributes listed in Table 6 are used in the Port Performance Thresholding Policy. Table 6: Port Performance Thresholding Policy Attributes Attribute Name Attribute ID Description SET_LEVEL_LD 0x1294b When a port s load is greater than or equal to this value, an alarm is generated. RESET_LEVEL_LD 0x1294f When a port s load falls below this value, the alarm is cleared. SET_LEVEL_PR 0x1294c When a port s packet rate is greater than or equal to this value, an alarm is generated. RESET_LEVEL_PR 0x12950 When a port s packet rate falls below this value, the alarm is cleared. SET_LEVEL_ERR 0x1294d When a port s error rate is greater than or equal to this value, an alarm is generated. RESET_LEVEL_ERR 0x12951 When a port s error rate falls below this value, the alarm is cleared. SET_LEVEL_DIS 0x1294e When a port s discard rate is greater than or equal to this value, an alarm is generated. RESET_LEVEL_DIS 0x12952 When a port s discard rate falls below this value, the alarm is cleared. Device Configuration Policy The Device Configuration Policy contains all attributes related to how SPECTRUM automatically configures a device. Policy Settings There is one pre-defined Policy Setting for this Policy. Page 18

19 Note: Some attributes in these Policy Settings do not have pre-defined values. This means that by default a value setting is not enforced on these attributes. However, you can create your own settings for such attributes if they are necessary for your individual management needs. See Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22] for instructions. Disable Redundancy - SPECTRUM will not update the model when the primary address is not accessible even if a list of preferred redundant addresses exists. Attributes The attributes listed in Table 7 are used in the Device Configuration Policy. Table 7: Device Configuration Policy Attributes Attribute Name Attribute ID Description RedundancyEnabled 0x11d2c SPECTRUM will update the model when the primary address is not accessible and a list of redundant preferred addresses exist. Rdnd_CheckGenAlarms 0x11dd6 When this value is set to TRUE, SPECTRUM will generate alarms when redundancy intelligence updates the network address. If_IsAutoCnfgActive 0x11dd4 Determines if SPECTRUM should automatically update its modeling of a device s interfaces when a change is detected. Create_Sub_Interfaces 0x11f3c If this device supports RFC1573, this setting determines if SPECTRUM should model logical interfaces for this device. CheckForReconfiguration 0x11d25 Setting this option to TRUE causes SPECTRUM to remodel the device s interfaces whenever the device sends LINK UP or LINK DOWN trap. DeviceDiscAfterReconfig 0x11d27 Determines if SPECTRUM should update its knowledge of connections off a device s interfaces after a reconfiguration occurs. IsMovable 0x11a80 Setting this to TRUE allows SPECTRUM to relocate the device model to a different topological location as part of the Autodiscovery process. Page 19

20 Attribute Name Attribute ID Description IfModelNameOption 0x12a1e Device-level control over the naming convention for interface models. The attribute ID specified is used to determine what suffix is appended to the interface model s model name. Valid attribute IDs include: 0x11f7e (ifalias), 0x1134b (ifdescr), 0x11f6f (ifname), 0x11348 (ifindex). Disposable_Precedence 0x114e2 Determines the modeling precedence given to this device. If a duplicate device is created with a higher precedence, the device model with the lower precedence will automatically be destroyed. Implementing a Pre-Defined Policy Step 1: Copying XML Files to the PolicyMgmt Directory If you are creating policies for the first time, you must make a copy of all of the user-customizable XML files and move them into the <$SPECROOT>/ PolicyMgmt directory. Procedure 1. Select the following files from the <$SPECROOT>/PolicyMgmt/Spectrum directory: policy-search-criteria.xml policy-settings.xml policy-rules.xml policies.xml policy-enforcement-configuration.xml 2. Copy these files and paste the copies into the <$SPECROOT>/ PolicyMgmt directory. If you are modifying existing policies or are creating additional new policies, you must rename your running configuration files and modify them. Procedure 1. Go the Information View [page 38] and click the Export Current Running Config button. This will create a copy of the five XML files with your current settings. These Page 20

21 files are placed in the <$SPECROOT>/PolicyMgmt directory and named <file_name>.xml.current. All files will have the same time stamp. 2. Remove the.current portion of the filename from each of the files. Use the files to make your modifications or additions. Step 2: Checking Policy Enforcement The policy-enforcement-config.xml file is used to define general Policy enforcement options. After completing Step 1: Copying XML Files to the PolicyMgmt Directory [page 20], this file should be located in the <$SPECROOT>/PolicyMgmt directory. In order for SPECTRUM s to operate, the policyenforcement-mode must be set to ENABLED. By default it is set to DISABLED. The following procedure explains how to change this value. Procedure 1. Open the <$SPECROOT>/PolicyMgMt/policy-enforcement-config.xml file using a text editor. 2. Find the following tag <policy-enforcement-mode mode=disabled> 3. Change DISABLED to enabled. <policy-enforcement-mode mode=enabled> 4. Save and close the file. Note: When the Policy Enforcement Mode is set to enabled, SPECTRUM prevents any client from changing any model attribute whose value is being enforced by a Policy. If you try to modify one of these locked model attributes, you will see a message similar to: Update failed for the following attributes: Attribute 0x The attribute is locked by a user policy, 0x d The following additional options can also be set in the policyenforcement-config.xml file. You should review each of the settings to make sure they meet your needs. Page 21

22 policy-reenforcement-interval (default = 24 hours) If there are any external attributes specified in the Policy search criteria, the policy-reenforcement-interval controls how often SPECTRUM reapplies Policy Settings. The units for the interval are in hours. When this is set to 0 (zero), SPECTRUM will not re-apply Policy Settings periodically, rather they will only be re-applied when a model attribute used as Policy search criteria changes. The policy-reenforcement-interval essentially causes SPECTRUM to poll external attributes used in Policy search criteria to check to see if they have changed. If there are no external attributes listed in any search criteria, SPECTRUM will not perform Policy reenforcement other than when an attribute changes. randomize-first-reenforcement (default = TRUE) The randomize-first-reenforcement setting is used to tell SPECTRUM to randomize the first Policy reenforcement timer so that the workload will be evenly distributed across the entire interval. backup-data-on-reload (default = TRUE) The backup-data-on-reload setting controls whether or not SPECTRUM stores previously-running Policy configurations in the PolicyMgmt/Backup directory. New backup files are created whenever the policies for this landscape are being reloaded. Only the previous five configurations are saved. When a configuration is being saved, the oldest set of files is automatically deleted. generate-policies-enforced-events (default = TRUE) The generate-policies-enforced-events setting controls whether or not SPECTRUM generates events on models whenever policies are being enforced. Every model on which policies are being enforced will have an event generated containing a detailed summary of the results. Step 3: Selecting the Pre-Defined Policy and Policy Settings SPECTRUM provides a series of pre-defined policies for you to use. Each of these pre-defined policies has one or more related Policy Settings that can be configured. A Policy Setting specifies values for attributes, which relate to the SPECTRUM functionality managed by the Policy. The following example shows the Passive Port Monitoring Policy Setting which can be used with the Port Fault Management Policy. <policy-settings name="passive Port Monitoring"> Page 22

23 <set-attr-value id="0x1280a" value="false" /> <set-attr-value id="0x11dd8" value="false" /> <set-attr-value id="0x11fc2" value="1" /> <set-attr-value id="0x12957" value="true" /> <set-attr-value id="0x12a54" value="true" /> </policy-settings> Procedure 1. Choose the pre-defined Policy that you would like to implement. See Pre- Defined Policies [page 12] for a complete listing. 2. Open the <$SPECROOT>/PolicyMgmt/Spectrum/policy-settings-spectrum.xml file and find the Policy Settings that relate to the Policy you have chosen (see Pre-Defined Policies [page 12]). 3. If the Policy Setting has all of the attribute values defined to meet your needs, copy down the name of the attribute setting and close the policy-settingsspectrum.xml file. 4. If you want to insert your own values for one or more of the attributes in the Policy Setting or if the Policy Setting available is a template, you will need to make these modifications in the <$SPECROOT>/PolicyMgmt/policy-settings.xml file. Some Policy Settings may include <set-attr-val> tags that do not specify a value. For example: <set-attr-value id="0x12345" value="" /> If a Policy Setting has attributes that are not assigned a value, those attributes are maintained the way they normally would be by SPECTRUM. However, you can set a value for these attributes. To do this: a. Select the entire Policy Setting and copy it. The Policy Setting begins with the opening of the policy-settings tag (<policy-settings name = policy name >) and ends when the tag is closed (</policy-settings>). b. Paste the Policy Setting in to the policy-settings.xml file located in the <$SPECROOT>/PolicyMgmt directory. If there is no policy-settings.xml file in this directory, see Step 1: Copying XML Files to the PolicyMgmt Directory [page 20]. The root element of the policy-settings.xml file is the <policysettings-definitions> element. Be sure to paste the Policy Setting after the opening tag and before the closing tag of this root element. c. Make the appropriate attribute value customizations. Page 23

24 d. Change the name of the Policy in the opening of the policy-settings tag (<policy-settings name = policy name >). You are free to choose any string value for this name. It is recommended that you choose something that relates to the settings you have configured. e. Note the name of the Policy Setting. f. Save and close the policy-settings.xml file. Step 4: Selecting the Pre-Defined Search Criteria You must now select the appropriate pre-defined search criteria. This search criteria must find all of the models to which you want to apply the Policy Settings selected in Step 3: Selecting the Pre-Defined Policy and Policy Settings [page 22]. Searches criteria contain attribute/value pairs and/or other searches. For example the pre-defined search for Pingables has the following syntax: <policy-search-criteria name="pingables"> <attr-match match-type="equal-to" id="0x10000" value="pingable" /> </policy-search-criteria> All models whose Modeltype_Name (0x10000) attribute is equal to Pingable are found with this search. The End Nodes or Pingables search is defined by two other searches. This is called a composite search. <policy-search-criteria name="end Nodes or Pingables"> <or> <policy-search-criteria-name name="end Nodes" /> <policy-search-criteria-name name="pingables" /> </or> </policy-search-criteria> All models found by the End Nodes Search or the Pingables search will be contained in the result set of the End Nodes or Pingables search. Procedure To select a pre-defined search criteria: 1. Open the <$SPECROOT>/PolicyMgmt/Spectrum/policy-searchcriteria-spectrum.xml file. Page 24

25 2. Find the appropriate search criteria and note the name of the search(es). The name of the search is always defined by the name attribute of the policy-search-criteria tag. For example, the value of the name attribute in this policy-search-criteria tag is Pingables. <policy-search-criteria name="pingables"> Note that in order to specify certain ports on certain types of devices, you must use more than one pre-defined search. For example if you wanted to specify all Router port models, you would need to use both the Routers and the All Ports search. You can use these searches in combination to create a device-port rule. See Step 5: Defining Policy Rules [page 25] for more information. Each search is explained in detail in the policy-search-criteriaspectrum.xml file. 3. Close the policy-search-criteria-spectrum.xml. If you do not find a pre-defined search that meets your needs or need to apply a search to specific landscapes, you can do so using the instructions found in Defining Your Own Search Criteria [page 32]. Step 5: Defining Policy Rules A single Policy search criteria definition and a single Policy Setting definition are combined to make a unique Policy rule. By combining the search criteria and the Policy Setting, you specify that SPECTRUM should enforce the Policy Settings on the models found by the search criteria. There are three different types of Policy Rules you can define: device rules, port rules, and device-port rules. The existence of device or port search criteria implies which type of Policy rule is used. If only device criteria are specified in the search, the rule is a device rule that can be applied to any device in the landscape. If only port criteria are specified in the search, the rule is a port rule that can be applied to any port in the landscape. If both device and port criteria are specified in the search, the rule is a device-port rule. These types of rules can only be applied to ports that are part of any device matching the device criteria. A rule that does not have any Policy search criteria specified is considered a default Policy rule. Default Policy Rules are used to implement attribute settings on all models that do not match the search criteria specified in the other rules contained in the Policy. See Step 6: Enabling the Policy [page 27] for more information. Page 25

26 You define a series of Policy Rules to make up a Policy. For example, your Port Fault Management Policy may implement the Passive Port Monitoring Policy Setting on all Switch ports and the Live Pipes Policy Setting on all Router ports. The Switches and All Ports search criteria will be combined with the Passive Port Monitoring Policy Setting to create a Policy rule, and the Routers and All Ports search criteria will be combined with the Live Pipes Policy Setting to create a second Policy rule. These Policy Rules are combined to create the Port Fault Management Policy. See Step 6: Enabling the Policy [page 27] for more information. Procedure To define a new Policy rule: 1. Using a text editor, open the policy-rules.xml file that has been copied in the <$SPECROOT>/PolicyMgmt directory. See Step 1: Copying XML Files to the PolicyMgmt Directory [page 20] if you do not have the policy-rules.xml file copied into this directory. 2. The root element for the policy-rules.xml file is the <policy-rulesdefinition> element. Any Policy definitions must be nested within this element. 3. Depending on the type of Policy Rule you are trying to create, use the appropriate syntax from the list below to define a new Policy rule: device-port rule <policy-rule name="policy name" > <device-policy-search-criteria-name name="search name" /> <port-policy-search-criteria-name name="search name" /> <policy-settings-name name="setting name" /> </policy-rule> device rule <policy-rule name="policy name" > <device-policy-search-criteria-name name="search name" /> <policy-settings-name name="setting name" /> </policy-rule> port rule <policy-rule name="policy name" > <port-policy-search-criteria-name name="search name" /> <policy-settings-name name="setting name" /> </policy-rule> Page 26

27 where policy name is the name you have chosen for this Policy. search name is the name of a pre-defined search from the policysearch-criteria-spectrum.xml file (see Step 4: Selecting the Pre-Defined Search Criteria [page 24]). The search name can also be the name of a user-defined search. See Defining Your Own Search Criteria [page 32] for instructions. setting name is the name of a pre-defined Policy Setting from the policy-settings-spectrum.xml file. The setting name can also be the name of a user-defined setting. See Defining Your Own Policy Settings [page 37] for instructions. 4. Repeat steps 1-3 for each Policy rule necessary to create your Policy. 5. Save and close the policy-rules.xml file Step 6: Enabling the Policy A Policy combines a series of Policy Rules that specify Policy Settings on a defined set of models. Policy rule priority is determined by the order that rules are listed in the Policy definition. SPECTRUM will not apply more than one Rule in a Policy to the same model. If a model matches the search criteria found in more than one Rule in the same Policy, the first rule that applies to the model is used. The model stops evaluating the rules in the policy as soon as the first match is made. WARNING! You cannot have multiple policies managing the same set of attributes. If a Policy manages a certain attribute, that attribute cannot be managed by any other Policy. Procedure To enable a Policy: 1. Using a text editor, open the policies.xml file that has been copied in the <$SPECROOT>/PolicyMgmt directory. See Step 1: Copying XML Files to the PolicyMgmt Directory [page 20] if you do not have the policy-rules.xml file copied into this directory. 2. The root element for the policy.xml file is the <policy-definitions> element. Any Policy definitions must be nested within this element. Page 27

28 3. Find the <Policy> tag that includes the Policy name of the Policy you are working with. See Pre-Defined Policies [page 12] for a listing of all Policy names. 4. Use the following syntax to define the Policy, adding all of the rules that you have defined in Step 5: Defining Policy Rules [page 25]: <policy name="text name"> <policy-rule-name name="text name" /> <policy-rule-name name="text name" /> <policy-rule-name name="text name" /> <default-policy-rule-name name="text name" /> </policy> where text name is the name of the Policy rule that you would like to use. Note that you can define as many Policy Rules within a Policy as you need. It is not necessary to have a default Policy rule. 5. Save and close the policy.xml file Step 7: Enforcing Policies You must make the SpectroSERVER aware of your new policies in order for them to be enforced. Procedure 1. Open the Information View [page 38] in SpectroGRAPH or open the Configuration section in a OneClick client (see Model Information [page 44]). 2. If you are working in a distributed SpectroSERVER environment, select Distributed from the Policy Distribution Mode pull down menu. Otherwise, select Stand Alone. WARNING! When in distributed mode, all SpectroSERVERs must be running the same version of SPECTRUM. 3. Click the Reload Policies Now button. This will cause SPECTRUM to parse and begin enforcing the new policies. If running in Distributed mode, this will also propagate the new Policy data to all other landscapes running in Distributed mode. 4. If no errors occur, all enabled policies are implemented on all of the appropriate models. Any new models created will be evaluated and Page 28

29 any appropriate policies will be enforced. See Viewing Status [page 40] for information on errors. 5. Once the Policies are successfully being enforced, SPECTRUM will rename the five XML files in the <$SPECROOT>/PolicyMgmt directory to <file_name>.applied. xml. When the SpectroSERVER is started, SPECTRUM enforces the last Policy configuration that you have loaded. It does not parse any XML files. If you want to load new policies you must use the Reload Policies Now button. If enabled, Policy enforcement will begin immediately. When you make changes to a Policy, and then load that Policy for SPECTRUM to begin enforcing, SPECTRUM stops enforcing the old Policy and starts enforcing the new Policy. SPECTRUM does not attempt to reset attributes to default values. You can use default Policy Rules to do this if necessary. See Step 5: Defining Policy Rules [page 25] for more information. Setting Up the Distributed Environment Before attempting to enforce policies in a distributed environment, make sure that the environment is set up properly. 1. Put each machine in the other s.hostrc file. 2. Elect a main Location Server, and point each of the other landscape's Location Server to the main Location Server. 3. Make sure the same user models exist in all landscapes. 4. Verify that all landscapes can communicate with each other. 5. All landscapes default to Distributed mode. Follow the instructions in Step 7: Enforcing Policies [page 28] to start Policy enforcement. For detailed instructions on setting up a distributed SpectroSERVER environment, see the Distributed SpectroSERVER (2770) guide. Alarm Thresholding Policy Example This example shows you how to set up the Alarm Thresholding Policy for devices on your network. This example will create three separate alarm threshold Policy Settings: one which will be applied to routers, one which will be applied to switches, and one which will be applied to all other device models. Page 29

30 Table 8 shows the attributes used in this example. Table 8: Attribute Names Attribute ID 0x1000c 0x1000d 0x1000e 0x x x10012 Attribute Name Value_When_Yellow Value_When_Orange Value_When Red Yellow_Threshold Orange_Threshold Red_Threshold 1. If this is the first Policy to be set up, it is necessary to copy all of the appropriate xml files into the PolicyMgmt directory. Select the following files from the <$SPECROOT>/PolicyMgmt/Spectrum directory and copy them into the <$SPECROOT>/PolicyMgmt directory. policy-search-criteria.xml policy-settings.xml policy-rules.xml policies.xml policy-enforcement-configuration.xml 2. Open the policy-enforcement-configuration.xml file and find the following tag <policy-enforcement-mode mode=disabled> 3. Change DISABLED to ENABLED. <policy-enforcement-mode mode=enabled> 4. Save and close the file. 5. Open the <$SPECROOT>/PolicyMgmt/Spectrum/policy-settings-templates.xml file. 6. Find the Policy Setting named Alarm Thresholding Settings Template. 7. Copy the entire Policy Setting (shown below) and paste it into the <$SPECROOT>/PolicyMgmt/policy-settings.xml file three times. Be sure that you paste it after the opening and before the closing of the root tag. Page 30

31 <policy-settings name="alarm Thresholding Settings Template"> <set-attr-value id="0x1000c" value="" /> <set-attr-value id="0x1000d" value="" /> <set-attr-value id="0x1000e" value="" /> <set-attr-value id="0x10010" value="" /> <set-attr-value id="0x10011" value="" /> <set-attr-value id="0x10012" value="" /> </policy-settings> 8. Modify the Policy Settings as follows: <policy-settings name="alarm Thresholding Switches"> <set-attr-value id="0x1000c" value="1" /> <set-attr-value id="0x1000d" value="2" /> <set-attr-value id="0x1000e" value="3" /> <set-attr-value id="0x10010" value="3" /> <set-attr-value id="0x10011" value="4" /> <set-attr-value id="0x10012" value="5" /> </policy-settings> <policy-settings name="alarm Thresholding Routers"> <set-attr-value id="0x1000c" value="2" /> <set-attr-value id="0x1000d" value="3" /> <set-attr-value id="0x1000e" value="4" /> <set-attr-value id="0x10010" value="4" /> <set-attr-value id="0x10011" value="6" /> <set-attr-value id="0x10012" value="8" /> </policy-settings> <policy-settings name="alarm Thresholding Other"> <set-attr-value id="0x1000c" value="3" /> <set-attr-value id="0x1000d" value="4" /> <set-attr-value id="0x1000e" value="5" /> <set-attr-value id="0x10010" value="6" /> <set-attr-value id="0x10011" value="8" /> <set-attr-value id="0x10012" value="10" /> </policy-settings> 9. Save and close the policy-settings.xml file. 10. Open the <$SPECROOT>/PolicyMgmt/Spectrum/policy-search-criteriaspectrum.xml file and note the names of the searches which find routers and switches: Routers Switches Page 31

32 11. Close the <$SPECROOT>/PolicyMgmt/Spectrum/policy-search-criteriaspectrum.xml file. 12. Open the <$SPECROOT>/PolicyMgmt/policy-rules.xml file and create the following three Policy Rules. <policy-rule name="router Alarm Threshold Rule" > <device-policy-search-criteria-name name="routers"/> <policy-settings-name name="alarm Thresholding Routers"/> </policy-rule> <policy-rule name="switch Alarm Threshold Rule" > <device-policy-search-criteria-name name="switches"/> <policy-settings-name name="alarm Thresholding Switches"/> </policy-rule> <policy-rule name="default Alarm Threshold Rule" > <policy-settings-name name="alarm Thresholding Other"/> </policy-rule> 13. Save and close the policy-rules.xml file. 14. Open the <$SPECROOT>/PolicyMgmt/policies.xml file. 15. Find the <policy name="alarm Thresholding Policy" > tag. 16. Replace this tag with the following text: <policy name="alarm Thresholding Policy"> <policy-rule-name name="router Alarm Threshold Rule"/> <policy-rule-name name="switch Alarm Threshold Rule"/> <default-policy-rule-name name="default Alarm Threshold Rule"/> </policy> 17. Save and close the policy.xml file 18. Use SpectroGRAPH or OneClick to enforce the Policy changes you have made. See Step 7: Enforcing Policies [page 28]. Defining Your Own Search Criteria If you find that the pre-defined Policy search criteria in the policy-search-criteriasettings.xml file do not meet your needs, it is possible to define your own search criteria. You must define this search criteria in the policy-search-criteria.xml file located in <$SPECROOT>/PolicyMgmt directory. If this file is not located in the PolicyMgmt directory, see Step 1: Copying XML Files to the PolicyMgmt Directory [page 20]. Page 32

33 Search Criteria Syntax Each search criteria definition is used to find matching device models or port models by specifying attribute ID/value pairs. In addition, a match type is specified to tell SPECTRUM how to evaluate the attribute value specified. You specify the type of match to perform based on the database type of the attribute. The following XML tags are used to specify a Policy criteria definition: <policy-search-criteria name="text name"> <attr-match match-type="equal-to" id="0x12345" value="xxx" /> </policy-search-criteria> Page 33

34 Supported attribute match-type operations for each data type are as follows: Table 9: Data Types and Match-Type Operations Data Types BOOLEAN INT, ENUM, REAL, DATE, TIME_TICKS, COUNTER, GAUGE, MODEL_HANDLE, MTYPE_HANDLE, REL_HANDLE, LSCPE_HANDLE, ATTR_ID, OBJECT_ID IP_ADDR, AGENT_ID TEXT_STRING, OCTET_STRING Supported Attribute Type Matches equal-to, not-equal-to equal-to, not-equal-to, less-than, less-than-or-equal-to, greaterthan, greater-than-or-equal-to equal-to, not-equal-to, less-than, less-than-or-equal-to, greaterthan, greater-than-or-equal-to, wildcard-match equal-to, not-equal-to, contains, does-not-contain, wildcard-match Wildcards in Search Criteria If a string or IP address attribute is specified, the value may contain wildcards, for example, "Serial*:*" or "*.*.*.20". In this case, the wildcard-match match-type is specified. Specifying Multiple Attribute/Value Pairs If multiple attribute/value pairs are specified, they are logically AND'ed or OR'ed together using <and> or <or> tags so a device must match all or any of the values to match the criteria definition. <policy-search-criteria name="text name"> <and> <attr-match match-type="equal-to" id="0x12345" value="xxx" /> <attr-match match-type="greater-than" id="0x12345" value="xxx" /> </and> </policy-search-criteria> <policy-search-criteria name="text name"> <or> <attr-match match-type="not-equal-to" id="0x12345" value="xxx" /> <attr-match match-type="contains" id="0x12345" value="xxx" /> Page 34

35 </or> </policy-search-criteria> Specifying a Landscape to Search SPECTRUM supports per-landscape policies. You can create different policies that apply to different landscapes by using the <lscpematch> tag with the syntax shown below. > <policy-search-criteria name="text name"> <attr-match match-type="equal-to" id="0x12345" value="xxx" / <lscpe-match match-type="equal-to" lscpe-id="0x400000" /> </policy-search-criteria> This tag can be used in any Policy search criteria definition. Composite Policy Search Criteria Composite Policy search criteria are supported. This means that you can create a Policy search criteria, and specify its name in another criteria definition using the <policy-search-criteria-name> tag. When creating composite Policy search criteria, all searches must be of the same type, i.e. either device or port search criteria, and the Boolean operators <and> or <or> tags must be supplied. For example: <policy-search-criteria name="text name"> <or> <attr-match match-type="equal-to" id="0x12345" value="xxx" /> <policy-search-criteria-name name="text name" /> <policy-search-criteria-name name="text name" /> </or> </policy-search-criteria> Searches Based on the Port s Link Type It is possible to set up a search which will find models based on the type of link a port is connected with, i.e. inter-switch link, end-station link, etc. this is done using the port model s NetworkLinkType, which describes the type of link the port is involved in. The NetworkLinkType attribute has been added to all port models to make Policy management easier. Page 35

36 There are six possible values for this attribute: UNKNOWN_LINK = 0 ROUTER_LINK = 1 SWITCH_LINK = 2 SHARED_ACCESS_LINK = 3 END_STATION_LINK = 4 WIDE_AREA_LINK = 5 SPECTRUM assigns the link type based on the following logic: Router -> Router = Router Link Router -> Brouter = Router Link Router -> Bridge = Router Link Router -> Hub = Router Link Router -> Node = Router Link Brouter -> Brouter = Switch Link Brouter -> Hub = Shared Access Link Brouter -> Node = End Station Link Bridge -> Bridge = Switch Link Bridge -> Hub = Shared Access Link Bridge -> Node = End Station Link Hub -> Hub = Shared Access Link Hub -> Node = End Station Link Any port connected to a WA_Link = Wide Area Link The default value is Unknown Link. Page 36

37 Defining Your Own Policy Settings If using the pre-defined Policy Settings in the policy-settingsspectrum.xml file does not meet your needs, you can define your own Policy Settings. Policy Settings use the following syntax to define what model attributes should be maintained by a Policy rule and the values for each attribute. Multiple attribute/value pairs can be specified in a single definition. <policy-settings name="text name"> <set-attr-value id="0x12345" value="xxx" /> <set-attr-value id="0x12345" value="xxx" /> </policy-settings> All user defined Policy Settings must be placed in the <$SPECROOT>/ PolicyMgmt/policy-settings.xml file. Note that the only attributes that can be used in a Policy Setting are those attributes that have already been specified in other Policy Settings. For a complete list, see Policies [page 8]. In addition, note that an attribute cannot be used in multiple policies. Page 37

38 Managing Policies This section describes how the SPECTRUM operates when it is running. In This Section Information View [page 38] Reacting to a Model Attribute Value Changes [page 39] Viewing Status [page 40] Viewing Policies in OneClick [page 41] Security [page 47] Information View The Information view (see Figure 1) allows you to make configuration changes and perform certain tasks. You can access this view from the SpectroGRAPH by clicking on the VNM model and selecting Configuration from the View Icon-Sub Views menu. The following functionality is available. This functionality is also available in the OneClick interface. See Viewing Policies in OneClick [page 41] for more information. Policy Distribution Mode This setting controls whether this landscape should act distributively or stand-alone. The values for this setting are therefore Distributed or Stand Alone and the default value is Distributed. When Distributed mode is selected, this landscape will propagate Policy XML changes to all distributed SpectroSERVERs that are also listening in Distributed mode. When a remote landscape running in Distributed mode detects a change in the Policy XML data, it will load it automatically. When Stand Alone mode is selected, this landscape will only recognize and enforce the Policy configuration as defined in the XML files in the local SPECTRUM installation area. Reload Policies Now When you click this button, SPECTRUM parses and reloads the Policy data defined in the XML configuration files. All Policy changes are recognized and enforced. If Distributed mode is selected, this landscape will also Page 38

39 propagate all Policy XML data to all remote landscapes running in Distributed mode. Export Current Running Config When you click this button, SPECTRUM copies the currently running Policy configuration to XML files located in the <$SPECROOT>/PolicyMgmt directory. They are named <file_name>.current.xml. Figure 1: Information View Reacting to a Model Attribute Value Changes While SPECTRUM is enforcing the policies, a model s attribute value, which is used to match it against a Policy, may change. When it does, SPECTRUM checks to see if the model still matches the same Policy rule or another Policy rule with a higher priority. If there is a higher priority Policy rule match, SPECTRUM will apply the new Policy rule. If it matches the same rule, then nothing is done. If the model no longer matches any Policy Rules, SPECTRUM will apply the Policy s default Policy rule (if one has been specified). See Step 5: Defining Policy Rules [page 25] for more information on default Policy Rules. Page 39

40 Viewing Status There are several ways to evaluate the status of the activity. Enforced Policy Log Files When a Policy is enforced on a model, a log file is created that includes a detailed summary of the results, including attribute ID, attribute name, attribute value, and whether or not the value could be written to the model. A new log file is created in the PolicymMgmt/Logs directory each time policies are reloaded. The file name used for the log files is PolicyOutputLog.<datetime>, where <datetime> is the date and time that the Policy was enforced. Policy Manger will save the five most recent log files and will automatically delete the oldest log file as a new one is written. Policy Data Loading Events/Alarms SPECTRUM generates an event every time new Policy data is being loaded from either the local XML files, or from another distributed landscape. When parsing errors occur, a red alarm is generated in the PolicyManager model. When this occurs, the old Policy configuration is still in effect, and the new configuration is disregarded. If the errors occurred on a landscape running in Distributed mode, the Policy data is not distributed to any other landscapes. Typical causes for this alarm include: Syntax errors in the XML configuration files. Invalid attribute values specified for Policy search criteria or settings. The needed XML configuration files do not exist in the PolicyMgmt directory. You can examine the event associated with the alarm for details on the parsing errors. You can examine the <$SPECROOT>/SS/VNM.OUT file for details on other types of errors. Once all necessary XML file changes are made, this alarm will automatically be cleared if the Policy data is loaded successfully. The event code for the Policy Data Load Error event is 0x4ad0001. The event code for the Policy Data Load Success event is 0x4ad0002. The alarm code for the Policy Data Load Error alarm is 0x4ad0001. Page 40

41 Viewing Policies in OneClick If you are operating a OneClick client and have used the SPECTRUM Policy Manager to enforce policies, you are able to view and load Policies from the OneClick Console. From the Locater tab in the OneClick Navigation panel (Figure 2), open the Policy Searches node. There are three searches available: All Policies, All s, and All Rules. From the Explorer tab in the OneClick Navigation panel (Figure 3), open the node. All currently enforced Policies are listed. If you open an individual Policy node, all Policy Rules for that Policy are listed. Details about the node selected in the Navigation panel appear in the Content and Component Details panel. These details are explained in the following sections: Policy Information [page 43] Model Information [page 44] Rule Information [page 46] For more information on using OneClick, see the OneClick Console User Guide (5130). Figure 2: OneClick Locater Tab Page 41

42 Figure 3: OneClick Explorer Tab Page 42

43 Policy Information If you select a Policy from the Navigation panel, the Contents and Component Detail panels are updated with information about Policy Manager Policies, as shown in Figure 4. Figure 4: All Policies The Contents panel lists information on all Polices currently being enforced. Note: If you are working from the Explorer tab, you must choose the List tab in the Contents panel to get this list. In the Component Details panel information is displayed on the Policy selected in the Contents panel. You can view each of the rules associated with the Policy in the Associated Rules list. Page 43

44 Model Information If you select from the Navigation panel, the Contents and Component Detail panels are updated with information about the Policy Manager model, as shown in Figure 5. Figure 5: All s The Contents panel lists information on all models. Note: If you are working from the Explorer tab, you must choose the List tab in the Contents panel to get this list. In the Component Details panel displays information on the Policy Manager model selected in the Contents panel. Page 44

45 The Configuration section has three available operations: the Reload button, the Export button, and the Distribution Mode selection. These operations are identical to those available in the SpectroGRAPH s Policy Manager Information View [page 38]. The Distribution Mode setting controls whether this landscape should act distributively or stand-alone. The values for this setting are therefore Distributed or Stand Alone and the default value is Distributed. When Distributed mode is selected, this landscape will propagate Policy XML changes to all distributed SpectroSERVERs that are also listening in Distributed mode. When a remote landscape running in Distributed mode detects a change in the Policy XML data, it will load it automatically. When Stand Alone mode is selected, this landscape will only recognize and enforce the Policy configuration as defined in the XML files in the local SPECTRUM installation area. When you click the Reload button, SPECTRUM parses and reloads the Policy data defined in the XML configuration files. All Policy changes are recognized and enforced. If Distributed mode is selected, this landscape will also propagate all Policy XML data to all remote landscapes running in Distributed mode. When you click the Export button, SPECTRUM copies the currently running Policy configuration to XML files located in the <$SPECROOT>/PolicyMgmt directory. They are named <file_name>.current.xml. You can view a list of Policies currently being enforced by the Policy Manager in the Policy List section. Page 45

46 Rule Information If you select a Policy Rule from the Navigation panel, the Contents and Component Detail panels are updated with information about all Rules available in your environment, as shown in Figure 6. Figure 6: All Rules The Contents panel lists all of the currently enforced Rules. Note: If you are working from the Explorer tab, you must choose the List tab in the Contents panel to get this list. Page 46