IBM Enterprise Console manual Default Rules, PrinterPaperJam PrinterDoorOpen

Event Class

NFS_No_Response

NIS_No_Response

Server_OK

NFS_OK

NIS_OK

Default Severity

WARNING

WARNING

HARMLESS

HARMLESS

HARMLESS

Default Rules

The UNIX log file adapter has a set of default rules that can be installed to enhance event server operation. Rules can enable the server to perform functions such as deleting events and sending e-mail to alert administrators of an unresolved problem. The rules are contained in the log_default.rls file and perform the following functions:

vDuplicate events of the following classes are filtered out and the first event repeat count is incremented:

–Printer_Paper_Out

–Printer_Toner_Low

–Printer_Offline

–Printer_Output_Full

–Printer_Paper_Jam

–Printer_Door_Open

vPrinter assistance can be called for when a printer condition persists for a period of time greater than 90 seconds. If any of the following conditions persist for that period of time, an e-mail message is sent to the e-mail alias tec_print in order to request assistance with the printer condition. (The tec_print alias must be added to the e-mail alias file before the messages can be delivered.)

–Printer_Paper_Out

–Printer_Toner_Low

–Printer_Offline

–Printer_Output_Full

–Printer_Paper_Jam

–Printer_Door_Open

vWhen a printer condition is cleared, the event server automatically closes the event that indicated a problem. If e-mail was sent out notifying the administrators of the printer problem, the server sends e-mail indicating the condition has cleared up.

vThe Su_Success and Su_Failure events indicate that a user attempted to use the su command. If a Su_Success event is received within 90 seconds of the Su_Failure event, the server assumes that the Su_Failure was a mistake and downgrades the event to HARMLESS and closes the Su_Failure event. The rules ensure that these two events are related by checking that they occurred on the same host, the user attempting this was the same, and the user that they were trying to change to was the same.

vSome of the log file events are relevant for a short amount of time. The administrators also do not want to be burdened with closing these events manually. A rule is provided that closes the following event classes after one

108IBM Tivoli Enterprise Console: Adapters Guide