Manuals / IBM / Computer Equipment / Network Router

IBM Enterprise Console manual Event Class Structure, source NT, subsource, hostname, NTBase

Models: Enterprise Console

1 194

Download 194 pages 8.78 Kb

Page 133

Event Class Structure

Event classes are defined hierarchically, with child classes inheriting attribute value defaults from the parent. The Windows event classes follow a simple hierarchy.

The adapter fills in the following attribute default values. The attributes are used in event group filters.

source NT
sub_source
NT
hostname
hostname where the event originated
The following events are defined in BAROC file:

Event Class	Severity

NT_Base

NT_Base_Event

NT_Diskfull	WARNING

NT_Share_Dir_Missing	WARNING

NT_Service_Start	WARNING

NT_Service_Stop	WARNING

NT_Out_Of_Paper	WARNING

NT_Printer_Out_Of_Paper	WARNING

NT_Low_Virtual_Memory	WARNING

NT_Security_Db_Not_In_Sync	WARNING

NT_Registry_Bad_DB	WARNING

NT_NCNB_Error	WARNING

NT_Parity_Error	WARNING

NT_Power_Failure	WARNING

NT_Thread_Create_Fail	WARNING

NT_Semaph_Create_Fail	WARNING

NT_Monitor_Start	WARNING

NT_TCPService_Fail

NT_Master_Browser_Conflict

NT_Document_Print_Success

NT_Document_Print_Deleted

NT_Internal_Error_In_The_DHCP_Server

NT_Performance_Alert

NT_Capacity_Alert

NT_Performance_Monitor

NT_Trustee_Relationship_Failed

NT_Service_Started

NT_Service_Terminated

NT_Printer_Error

Chapter 10. Windows Event Log Adapter 121

Image 133

IBM Enterprise Console manual Event Class Structure, source NT, subsource, hostname, NTBase

Contents

IBM Tivoli Enterprise Console Adapters GuideVersion GC32-0668-01Page IBM Tivoli Enterprise Console Adapters GuideVersion GC32-0668-01First Edition September Preface ContentsChapter 2. AS/400 Alert Adapter Chapter 1. Understanding Adaptersiv IBM Tivoli Enterprise Console Adapters Guide Appendix C. Class Definition vi IBM Tivoli Enterprise Console Adapters Guide Who Should Read This Guide PrefaceWhat This Guide Contains IBM Tivoli Enterprise Console Library PublicationsPrerequisite Publications Related PublicationsProviding Feedback about Publications Accessing Publications OnlineContacting Customer Support Conventions Used in this Guidebold Operating System-dependent Variables and PathsItalics MonospaceAdapter Overview Chapter 1. Understanding AdaptersHow Events Get Sent to the Event Server How Events Get to the Event Server From an EndpointThe TME adapters currently supported for an endpoint are the following How Events Get to the Event Server From a Managed Node Internationalization Support for EventsHow Events Get to the Event Server From a Non-TME Adapter Event Attributes Event InformationAttribute Name serverpath listofstrings Stores information describing the rule engines that an event hasv datereception v eventhandle v serverhandle Adapter FilesCache File File Location Configuration FileFile Format ExampleAdapterCdsFile=path AdapterErrorFile=pathBufEvtMaxSize BufEvtPathFilterMode FilterCachegetporttimeoutusec getporttimeoutsecondsgetporttotaltimeoutseconds getporttotaltimeoutusecServerPort ServerLocationTestMode Event Filtering1. Set FilterMode to IN 1. Set FilterMode to IN Event Buffer FilteringExample BAROC File2. Set BufferEvents to YES Format File Rule FileExample ExampleExample Class Definition Statement Filemodulename errorlevel outputfile Error FileERROR UTILSKERNEL Initial FilesSELECT FETCHAdapter Startup Errors Troubleshooting AdaptersAll Adapters Managed Node Adapters22 IBM Tivoli Enterprise Console Adapters Guide Non-TME AdaptersAdapter Files Chapter 2. AS/400 Alert AdapterQSYS.LIB/QUSRSYS.LIB/CFGALERT.FILE/ALRCFG.MBR QSYS.LIB/QUSRSYS.LIB/CFGALERT.FILE/ALRCDS.MBR The CDS fileENDTECADP Configuration FileAdapterCdsFile BufEvtPathFETCH Statement Example SELECT Statement ExampleClass Definition Statement File KeywordsPERMANENT, TEMPORARY, or IMPENDING PROBLEM $HOSTNAME Configuring the AS/400 Alert Filters Default Alert Filter$ADAPTERHOSTSNANODE $ALERTCDPTStarting the Adapter Integrating with an Existing Alert FilterCRTDTAQ DTAQlibrary/name TYPE*STD MAXLEN592 FORCE*NO SEQ*FIFO STRTECADP AuthorizationSYNOPSIS DESCRIPTIONStopping the Adapter Context ENDTECADPComments AuthorizationENDTECADP EVTADPMYCFG OPTION*CNTRLD DELAY60 ExamplesENDTECADP EVTADPALERTADP Event Class Structure Events ListingDefault Event Event ClassEvent Class Default EventSeverity Default Severity Troubleshooting the AS/400 AdapterAlert Type TCP/IP Considerations Logging Events in Test ModeStarting an AS/400 Adapter after an IPL Adding an Autostart Job to QSYSWRKMultiple AS/400 Alert Adapters Changing the AS/400 Startup ProgramQSECOFR To create the configuration file, perform the following steps Configuration FileContext POSTEMSGExamples 38 IBM Tivoli Enterprise Console Adapters GuideAdapter Files Chapter 3. AS/400 Message AdapterQSYS.LIB/QUSRSYS.LIB/CFGMSG.FILE/MSGCFG.MBR QSYS.LIB/QUSRSYS.LIB/CFGMSG.FILE/MSGCDS.MBR The CDS fileAdapterCdsFile Configuration FileJobDescription 40 IBM Tivoli Enterprise Console Adapters GuideClass Definition Statement File MAP Statement ExampleSELECT Statement Example FETCH Statement Example$ALERTOPTION $ADAPTERHOSTDEFER IMMED$MSGFILELIBRARY $MSGFILENAME$MSGLIBRARYUSED $MSGSEVERITY$SENDTIME $SENDPROGRAMNAME$SENDUSERPROFILE $SUBORIGINStarting the Adapter Authorization FlagsSTRTECADP CommentsChapter 3. AS/400 Message Adapter Stopping the AdapterENDTECADP EVTADPname *ALL OPTION*CNTRLD *IMMED DELAYseconds AuthorizationDELAYseconds ENDTECADPExamples ENDTECADP EVTADPMYAPP OPTION*CNTRLD DELAY60ENDTECADP EVTADPSYSOPR Event Class Structure Events Listingsubsource hostnameLogging Events in Test Mode Troubleshooting the AS/400 AdapterTCP/IP Considerations WRKJOB JOBnameAdding an Autostart Job to QSYSWRK Starting an AS/400 Adapter after an IPLChanging the AS/400 Startup Program Multiple AS/400 Message Queues Using FTP to Execute AS/400 CommandsConfiguration File DONE RETURN CHGVAR VAR&CPYR VALUE&CPYR ENDPGM54 IBM Tivoli Enterprise Console Adapters Guide NetWare Log File Adapter Reference Information Chapter 4. NetWare Log File AdapterError File Adapter FilesConfiguration File Prefiltering NetWare EventsSource EventIdPollInterval Format FilePreFilter PreFilterModeEvent Class Structure Events Listingnwmsgversion nwmsgidalertclass alertlocus60 IBM Tivoli Enterprise Console Adapters Guide The following NetWare events are defined in the BAROC fileTECADNW4.NLM Flags tecadnw4.nlmDescription ExamplesTroubleshooting the NetWare Log File Adapter 64 IBM Tivoli Enterprise Console Adapters Guide OpenView Driver Chapter 5. OpenView AdapterReception of OpenView Messages Determining the OpenView NNM VersionEvent Correlation With NNM Incoming Messages Formatenterprise agent-addrChapter 5. OpenView Adapter Determining the OVsnmpEventOpen Filter ValueTesting Event Correlation With NNM Testing ToolsThis trace file is located in $OVLOG/ecs/ecs-instance#/ecsin.evt# Event Correlation ExampleAdapter Files Class Definition Statement File OpenView Event ExampleHPOVFilter=filter WellBehavedDaemonKeywords Object Identifier File$COMMUNITY $ENTERPRISEStarting and Stopping the Adapter LRF FileError File name object identifierEvent Class Structure Events Listingsource subsourceEvent Class Default SeverityOpenView Traps OpenView Traps SNMP Traps50462720 Warnings Node Marginal50790402 Troubleshooting the OpenView AdapterSegment Marginal 5079040378 IBM Tivoli Enterprise Console Adapters Guide Configuration File Chapter 6. OS/2 Adapterinstall.exe The adapter installation assist executable fileStarting the Adapter Format FileUnmatchLog Events Listing Stopping the AdapterEvent Class Structure source OS2 subsource OS2Troubleshooting the OS/2 Adapter Chapter 7. SNMP Adapter Server ConfigurationSNMP Driver Reception of SNMP MessagesConfiguration File SNMP Event ExampleClass Definition Statement File KeywordsObject Identifier File Error FileStarting and Stopping the Adapter $AGENTADDRWarm Start Cold StartStopping the Adapter Events ListingHost on which the adapter runs adapterhostforwardingagent Proxy agent that forwarded the event to the adapterSNMP Traps Generic Traps Rules ListingEnterprise-specific Traps BAROC File Changes Creating a New SNMP Trap Eventv tecadsnmp.baroc v tecadsnmp.cds v tecadsnmp.oid SYNTAX INTEGER 0..4294967295 ACCESS not-accessible Agent-independent Data90 IBM Tivoli Enterprise Console Adapters Guide Page Class Definition Statement File Changes Object Identifier File Changes Troubleshooting the SNMP Adapter94 IBM Tivoli Enterprise Console Adapters Guide c configurationfileControlling Event Traffic at the Gateway Chapter 8. IBM Tivoli Enterprise Console GatewaysExample 3. Calculate the value for the EventSendThreshold keyword Configuration File Worksheets and CalculationsUNIX Microsoft WindowsUNIX /etc/Tivoli/tec/cache@EventServer#region tec/gatewaycache@EventServer#tmr-centralWindows $DBDIR/cache.dat@EventServer#region on managed nodes $TIVOLIHOME/tec/$ACTYPE.cache@ EventServer#region on endpointsGatewayQueueSize GatewayTMEAckEnabledGatewaySendInterval MaxGWCacheSizeMegsThe default value is @EventServer Chapter 9. UNIX Log File Adapter Event Server ConfigurationStarting the Adapter Stopping the Adapter Running Multiple UNIX Log File Adaptersinit.tecadlogfile -s start stop AdapterID logdefault.rls Configuration FileAdapter Files tecadlogfile.cfgFormat File Error FileClass Definition Statement File Events ListingEvent Class Default SeverityEvent Class Default Severity106 IBM Tivoli Enterprise Console Adapters Guide Event Class Default SeverityPrinterPaperOut PrinterTonerLow PrinterOffline PrinterOutputFull Default RulesPrinterPaperJam PrinterDoorOpen PrinterPaperOut PrinterTonerLow PrinterOffline PrinterOutputFullRepeatedLoginFailure RepeatedLoginFailureFrom RootLoginSuccessFrom Troubleshooting the UNIX Log File AdapterLogfileAmd LogfileCron LogfileOserv LogfileDateSet 110 IBM Tivoli Enterprise Console Adapters Guide Adapter Files Chapter 10. Windows Event Log Adaptertecinstlwin.cmd tecadwins.exeDEFAULT Configuration Filetecadwin.baroc HostnameIsAdapterHostPreFilterLog=lognameEventId=value EventType=valueSource=value NumEventsToCatchUpPreFilterMode SpaceReplacementWINEVENTLOGS PreFilterLog=ApplicationSource=re’TEC.*’EventId Prefiltering Windows Log EventsThe UPS service terminated with service-specific error Jan 15 150619 1998 0 Error N/A ServiceControlManager 7024 \Format File SourceApplicationEventsProcessed Registry VariablesApplicationEventsProcessedTimeStamp DirectoryEventsProcessedDNSEventsProcessed DirectoryEventsProcessedTimeStampDNSEventsProcessedTimeStamp FileReplicationEventsProcessedTECInstallPath Low Memory Registry VariablesSecurityEventsProcessedTimeStamp SystemEventsProcessed1. Select Create Administrators from the Administrators icon Adapter Administrator Roles for Windows3. Type in SYSTEM in the Set Login Names dialog Starting the Adaptersource NT Event Class Structuresubsource hostnameNTPrinterWasSet tecadwin Command SYNOPSIS tecadwinDESCRIPTION EXAMPLESTroubleshooting the Windows Event Log Adapter 126 IBM Tivoli Enterprise Console Adapters Guide Adapter Files Chapter 11. Windows NT Event Log AdapterThe error file Configuration FileDEFAULT tecadnt.errNumEventsToCatchUp HKEYLOCALMACHINE\SYSTEM\ CurrentControlSet\Services\ TECNTAdapter\PreFilterLog=lognameEventId=valueEventType=valueSource=value Chapter 11. Windows NT Event Log AdapterSpaceReplacement Prefiltering Windows NT Log EventsPreFilterMode 130 IBM Tivoli Enterprise Console Adapters GuideEventId Format FileSource EventTypeRegistry Variables Non-English Format FilesApplicationEventsProcessed 132 IBM Tivoli Enterprise Console Adapters GuideApplicationEventsProcessedTimeStamp TECInstallPathPollingInterval SecurityEventsProcessed1. Select Create Administrators from the Administrators icon Adapter Administrator Roles for Windows NT3. Type in SYSTEM in the Set Login Names dialog Low Memory Registry VariablesStopping the Adapter Starting the AdapterEvents Listing Event Class StructureEvent Class Default Severity136 IBM Tivoli Enterprise Console Adapters Guide tecadnt Command tecadnt.exe -d -c ConfigFile -L none EventLog tecadntAuthorization none Arguments c ConfigFileTroubleshooting the Windows NT Event Log Adapter 140 IBM Tivoli Enterprise Console Adapters Guide Appendix A. Files Shipped with Adapters 142 IBM Tivoli Enterprise Console Adapters Guide Appendix A. Files Shipped with Adapters 144 IBM Tivoli Enterprise Console Adapters Guide Format File Location Appendix B. Format File Referencev %lengths Format Specificationsv %lengths Log File Examplev %lengths+ v %tsucceeded for succeeded for su ’su su ’suon on Mappings Windows NT Examplestring constant DEFAULT keywordPRINTF statement LABEL keywordAdditional Mapping Considerations The following list describes how values were assigned Generating a New Class Definition Statement File for a TME Adapter Activating Changes Made with a Format FileNetWare log file UNIX log fileWindows NT event log Windows event logNetWare log file UNIX log fileFile Format Appendix C. Class Definition Statement File ReferenceOperators SELECT Class Definition Statement File DetailsFETCH Note AS/400 adapters do not support KEY parts in CDS files 1 ATTR=,$TYPE,VALUE=,4 FETCH Statement1$TYPE=4 MAP Statement MAPDEFAULT StatementExample nexpressionname objectidentifier Object Identifier to Name TranslationSELECT Class Definition Statement File Syntax Diagramskeydecl = KEY ’’ kop ’,’ vopval ’’ aop = ’=’ PREFIX SUFFIX EXISTS Page 164 IBM Tivoli Enterprise Console Adapters Guide Notices IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A Notices Trademarks168 IBM Tivoli Enterprise Console Adapters Guide Obsolete term for GlossaryPage 5, 6 Index Special characters10, 24 CDS file keywords continued Page files continued Page Page TCP/IP continued Page 180 IBM Tivoli Enterprise Console Adapters Guide Page GC32-0668-01 Program Number 5698-TEC Printed in U.S.A