A Practical Approach to WBEM[s]CIM Management

Indications

Figure 8.3 illustrates the top level of the Indication class hierarchy. CIM_Indication is a very generic class and is defined with the ABSTRACT qualifier meaning that instances of it cannot be created; it is simply a superclass for all indications. It has three subclasses:

1. CIM_ClassIndication , used to describe events arising from the manipulation of classes: their creation, deletion, and modification. In this case, the CIM server itself effectively acts as the Indication Provider, creating the Indication when a class is manipulated.

2. CIM_InstIndication , used to describe events arising from the manipulation of instances. As with CIM_ClassIndication , this includes their creation, deletion and modification but also includes the invocation of a method on them. Again, the WBEM server acts as the Indication Provider. A listener could be set up to receive indications related to class and instance manipulation by subscribing to CIM_InstIndications and CIM_ClassIndications and, perhaps, create a log file as part of a security trace.

3. CIM_ProcessIndication, used for all "external" events ”events not raised because of the manipulation of the model. In principle, this type of indication is not actually required because all externally occurring events could be mapped to an operation in the model (creation of an instance, for example). In practice, most event handling does occur through CIM_ProcessIndication because this class forms a superset with most of the standard properties required for an alarm notification: see Figure 8.3. This type of Indication was designed to allow an alarm detected deep in an operating system or telecommunications stack and possibly not associated directly with any CIM object to be signalled as easily as possible.

Figure 8.3: The Indication Classes

The subclasses of CIM_ProcessIndication as illustrated in Figure 8.3 are:

• CIM_SNMPTrapIndication . This is a concrete (i.e., nonabstract) class to which SNMP traps ^[1] may be mapped. The class may be used as a simple encapsulation of the SNMP trap, in which case, in order to interpret it, the receiver will need access to the managed object's Management Information Base (MIB). To avoid the need for propagating the MIB, a better (but perhaps longer- term ) solution might be to model the managed object in CIM. The fields from the SNMP trap are mapped into the properties of the CIM_SNMPTrapIndication: see Table 8.1 for some of the mappings.

  Table 8.1: Some SNMP to CIM_SNMPTrapIndication Mappings

  SNMP	CIM	Description
  Enterprise	Enterprise	Describes the type of entity generating the trap
  Generic-Trap	GenericTrap	Describes the type of trap (e.g. authentication failure, link up, link down)
  Specific-Trap	SpecificTrap	Identifies the precise trap
  Time-Stamp	TimeStamp	Time at which the trap was generated relative to the last reset of the device

• CIM_AlertIndication . This is also a concrete (i.e., nonabstract) class and is the preferred superclass for operational alarms and events arising other than from SNMP. Many of the properties of the CIM_AlertIndication mirror similar properties defined in standard X.733 (Systems Management: Alarm Reporting Function) from the International Telecommunication Union (ITU-T). Table 8.2 gives some of the relationships between X.733 and the properties of CIM_AlertIndication .

  Table 8.2: Some X.733 to CIM_AlertIndication Mappings

  X.733	CIM_AlertIndication	Note
  Additional Text	Description
  Event Type	AlertType	Defines type of alert, e.g., security alert, environmental alert, processing error.
  Perceived Severity	PerceivedSeverity	Defines importance of the alarm, e.g., Informational, Warning, Minor, Major, Critical, Fatal.
  Probable Cause	ProbableCause	Origin of the alarm, e.g., Bandwidth reduction (showing the telecommunications origin of X.733), Connection Establishment Error, Application Subsystem Failure, Toxic Leak Detected.
  TrendIndication	Trending	Estimate of whether this situation is getting worse or better.

• CIM_J2eeNotification . This is a concrete class into which "Java 2 Enterprise Edition" (J2EE) alarms may be mapped. J2EE is an initiative by Sun Microsystems for the management of Web Services.

^[1] A "trap" is SNMP-speak for an indication; see RFC1157.