Monitoring

Users and user groups need specific permissions to work with different functions in Monitoring Automation. This enables the administrator to grant access only to the monitoring functionality for which the user or user group is responsible. Based on the permissions granted, some UI elements may be disabled or not shown.

Monitoring Automation facilitates simplified maintenance of management templates, aspects, and policy templates. It also enables the assignment of configuration elements to CIs and the deployment of monitoring configurations to monitored nodes. Permission to assign management templates, aspects, and policy templates to CIs is authorized separately from their creation, deletion, editing, and movement.

Administrators can also manage permissions for management templates and aspects separately from policy templates. Permission related to management templates, aspects, and their assignments is granted on the level of the configuration folder. Similarly, policy templates and their assignments are authorized through template groups. Policy templates can be in more than one template group. In this case, the highest permission takes precedence.

Some examples:

• To be able to restart all deployment jobs, you need full control access to the redeploy all functionality.
• To be able to edit parameter values of assignments of management templates or aspects you need tuning permission for the appropriate configuration folder.
• To view all policy templates, including those not in a template group, you need the view permission for all template groups.
• To create an assignment of a management template to a CI, you need full control permission on the configuration folder containing the management template, and access to an RTSM view containing the CI.
• To create an automatic assignment rule for a management template, you need full control permission for the configuration folder containing the management template, access to the RTSM view that will be linked to the rule, and permission to work with automatic assignment rules.

For more information on Monitoring Permissions, see Monitoring.

Permission to view a configuration element in Monitoring Automation enables you to see the complete artifact. This means, nested elements that you cannot access directly are visible in the context of the parent. For example, if you have permission to view an aspect, you will also see a list of all templates included in the aspect, regardless of the permission you have on the templates. However, if you do not have direct viewing permission for these listed templates, you will not be able to view them anywhere else.

Assignments that you create in Monitoring Automation are called direct assignments. Direct assignments can cause indirect assignments to be created in the background. For example, if you assign an aspect to a CI, indirect assignments to the node on which the CI is hosted are created for each of the templates that the aspect contains. Viewing rights for direct assignments are inherited by indirect assignments. For example, if you have permission to view the direct assignment of an aspect that includes a template, you will also be able to see the indirect assignment of the template, regardless of the rights you would usually have to view assignments of this template.

When changing nested elements, the permission needed relates directly to the element you are changing. To change the parent, you need permission on the parent element. To change the child, you need permission on the child element. Some examples:

• To be able to remove a child element from a parent, you need full control permission on the parent.
• To add a child to a parent element, you need full control permission on the parent and view permission on the child element.
• To edit a child element within a parent (create a new version), you need full control on the parent and full control on the child element.
• To change the version of a child element within a parent, you need full control on the parent and view permission on the child.

In the Assignments & Tuning screen, users with access to an RTSM view can assign management templates, aspects, and policy templates only to CIs presented through the views they are authorized to see.

However, in the Management Templates & Aspects and the Policy Templates screens, the constraints of RTSM views are not applied. Clicking List Assignments for Selected Item will provide a list of all existing assignments for the selected artifact (management template, aspect, or policy template). Clicking Assign and Deploy Item will produce a list of all candidate CIs based on their CI Type, regardless of the RTSM view permission the user has.

Therefore, users who are only allowed to work with a subset of CIs based on their RTSM view permission should only have permission to work with assignments of management templates, aspects, and policy templates. This will restrict the user's activity to the Assignments & Tuning screen and limit the available CIs to those presented in the RTSM view the user is authorized to see.

For example, user 1 and user 2 can both assign the same Oracle management template. User 1 gets his CIs from an RTSM view covering Oracle installations in Europe, and user 2 has permission on an RTSM view for the Americas. If user 1 has permission for the Management Templates & Aspects screen, when listing the existing assignments in that view he will also see the Oracle management template assignments user 2 has made, and vice-versa.

For more information on managing permissions, see Users, Groups, and Roles.