Manuals / IBM / Computer Equipment / Network Router

IBM Enterprise Console manual tecadnt Command

Models: Enterprise Console

1 194

Download 194 pages 8.78 Kb

Page 149

Event Class	Default Severity

NT_Timeserv_Failed_3

NT_Timeserv_Failed_4

NT_Timeserv_Failed_5

NT_Timeserv_Failed_6

NT_License_Service_No_License_Available

NT_License_Service_Out_Of_Licenses

NT_Restore

NT_Backup

NT_Replicator_Did_Not_Send_Update

NT_Replicator_System_Error

NT_Replicator

NT_Tivoli_Courier

NT_Tivoli_TEC_Adapter

NT_Tivoli_TEC_Adapter_Error_Sending_Alert

NT_Sophos_Sweep

NT_SNMP

NT_Insight_Manager_Error

NT_Insight_Manager

NT_Privileged_Service_Called

NT_Trusted_Process_Logon_Success

NT_Logon_Successful

NT_Logon_Failure

NT_User_Logoff

NT_Log_Clear_Successful

NT_Account_Management_Success

NT_Group_Management_Change_Success

NT_Global_Group_Changed

NT_Local_Group_Member_Removed

NT_Account_Password_Change_Success

NT_Server_Start

NT_Application_Error

NT_Table_Reached_Maximum_Size

NT_Handle_Closed

NT_Object_Open

NT_Audit_Policy_Change

NT_Duplicate_Name	WARNING

tecad_nt Command

The Windows NT event log adapter includes the tecad_nt command, which enables you to start the adapter in non-service mode. The command description is on the following pages.

Chapter 11. Windows NT Event Log Adapter 137

Image 149

IBM Enterprise Console manual tecadnt Command

Contents

IBM Tivoli Enterprise Console Adapters GuideVersion GC32-0668-01Page IBM Tivoli Enterprise Console Adapters GuideVersion GC32-0668-01First Edition September Preface ContentsChapter 2. AS/400 Alert Adapter Chapter 1. Understanding Adaptersiv IBM Tivoli Enterprise Console Adapters Guide Appendix C. Class Definition vi IBM Tivoli Enterprise Console Adapters Guide What This Guide Contains PrefaceWho Should Read This Guide IBM Tivoli Enterprise Console Library PublicationsPrerequisite Publications Related PublicationsProviding Feedback about Publications Accessing Publications OnlineContacting Customer Support Conventions Used in this Guidebold Operating System-dependent Variables and PathsItalics MonospaceAdapter Overview Chapter 1. Understanding AdaptersHow Events Get Sent to the Event Server How Events Get to the Event Server From an EndpointThe TME adapters currently supported for an endpoint are the following How Events Get to the Event Server From a Non-TME Adapter Internationalization Support for EventsHow Events Get to the Event Server From a Managed Node Event Attributes Event InformationAttribute Name serverpath listofstrings Stores information describing the rule engines that an event hasv datereception v eventhandle v serverhandle Adapter FilesCache File File Location Configuration FileFile Format ExampleAdapterCdsFile=path AdapterErrorFile=pathBufEvtMaxSize BufEvtPathFilterMode FilterCachegetporttimeoutusec getporttimeoutsecondsgetporttotaltimeoutseconds getporttotaltimeoutusecServerPort ServerLocation1. Set FilterMode to IN Event FilteringTestMode 1. Set FilterMode to IN Event Buffer Filtering2. Set BufferEvents to YES BAROC FileExample Format File Rule FileExample ExampleExample Class Definition Statement Filemodulename errorlevel outputfile Error FileERROR UTILSKERNEL Initial FilesSELECT FETCHAdapter Startup Errors Troubleshooting AdaptersAll Adapters Managed Node Adapters22 IBM Tivoli Enterprise Console Adapters Guide Non-TME AdaptersAdapter Files Chapter 2. AS/400 Alert AdapterQSYS.LIB/QUSRSYS.LIB/CFGALERT.FILE/ALRCFG.MBR QSYS.LIB/QUSRSYS.LIB/CFGALERT.FILE/ALRCDS.MBR The CDS fileENDTECADP Configuration FileAdapterCdsFile BufEvtPathFETCH Statement Example SELECT Statement ExampleClass Definition Statement File KeywordsPERMANENT, TEMPORARY, or IMPENDING PROBLEM $HOSTNAME Configuring the AS/400 Alert Filters Default Alert Filter$ADAPTERHOSTSNANODE $ALERTCDPTCRTDTAQ DTAQlibrary/name TYPE*STD MAXLEN592 FORCE*NO SEQ*FIFO Integrating with an Existing Alert FilterStarting the Adapter STRTECADP AuthorizationSYNOPSIS DESCRIPTIONStopping the Adapter Context ENDTECADPComments AuthorizationENDTECADP EVTADPALERTADP ExamplesENDTECADP EVTADPMYCFG OPTION*CNTRLD DELAY60 Event Class Structure Events ListingDefault Event Event ClassSeverity Default EventEvent Class Alert Type Troubleshooting the AS/400 AdapterDefault Severity TCP/IP Considerations Logging Events in Test ModeStarting an AS/400 Adapter after an IPL Adding an Autostart Job to QSYSWRKQSECOFR Changing the AS/400 Startup ProgramMultiple AS/400 Alert Adapters To create the configuration file, perform the following steps Configuration FileContext POSTEMSGExamples 38 IBM Tivoli Enterprise Console Adapters GuideAdapter Files Chapter 3. AS/400 Message AdapterQSYS.LIB/QUSRSYS.LIB/CFGMSG.FILE/MSGCFG.MBR QSYS.LIB/QUSRSYS.LIB/CFGMSG.FILE/MSGCDS.MBR The CDS fileAdapterCdsFile Configuration FileJobDescription 40 IBM Tivoli Enterprise Console Adapters GuideClass Definition Statement File MAP Statement ExampleSELECT Statement Example FETCH Statement Example$ALERTOPTION $ADAPTERHOSTDEFER IMMED$MSGFILELIBRARY $MSGFILENAME$MSGLIBRARYUSED $MSGSEVERITY$SENDTIME $SENDPROGRAMNAME$SENDUSERPROFILE $SUBORIGINStarting the Adapter Authorization FlagsSTRTECADP CommentsChapter 3. AS/400 Message Adapter Stopping the AdapterENDTECADP EVTADPname *ALL OPTION*CNTRLD *IMMED DELAYseconds AuthorizationDELAYseconds ENDTECADPENDTECADP EVTADPSYSOPR ENDTECADP EVTADPMYAPP OPTION*CNTRLD DELAY60Examples Event Class Structure Events Listingsubsource hostnameLogging Events in Test Mode Troubleshooting the AS/400 AdapterTCP/IP Considerations WRKJOB JOBnameChanging the AS/400 Startup Program Starting an AS/400 Adapter after an IPLAdding an Autostart Job to QSYSWRK Multiple AS/400 Message Queues Using FTP to Execute AS/400 CommandsConfiguration File DONE RETURN CHGVAR VAR&CPYR VALUE&CPYR ENDPGM54 IBM Tivoli Enterprise Console Adapters Guide NetWare Log File Adapter Reference Information Chapter 4. NetWare Log File AdapterError File Adapter FilesConfiguration File Prefiltering NetWare EventsSource EventIdPollInterval Format FilePreFilter PreFilterModeEvent Class Structure Events Listingnwmsgversion nwmsgidalertclass alertlocus60 IBM Tivoli Enterprise Console Adapters Guide The following NetWare events are defined in the BAROC fileTECADNW4.NLM Flags tecadnw4.nlmDescription ExamplesTroubleshooting the NetWare Log File Adapter 64 IBM Tivoli Enterprise Console Adapters Guide OpenView Driver Chapter 5. OpenView AdapterReception of OpenView Messages Determining the OpenView NNM VersionEvent Correlation With NNM Incoming Messages Formatenterprise agent-addrChapter 5. OpenView Adapter Determining the OVsnmpEventOpen Filter ValueTesting Event Correlation With NNM Testing ToolsThis trace file is located in $OVLOG/ecs/ecs-instance#/ecsin.evt# Event Correlation ExampleAdapter Files Class Definition Statement File OpenView Event ExampleHPOVFilter=filter WellBehavedDaemonKeywords Object Identifier File$COMMUNITY $ENTERPRISEStarting and Stopping the Adapter LRF FileError File name object identifierEvent Class Structure Events Listingsource subsourceEvent Class Default SeverityOpenView Traps OpenView Traps SNMP Traps50462720 Warnings Node Marginal50790402 Troubleshooting the OpenView AdapterSegment Marginal 5079040378 IBM Tivoli Enterprise Console Adapters Guide Configuration File Chapter 6. OS/2 Adapterinstall.exe The adapter installation assist executable fileUnmatchLog Format FileStarting the Adapter Events Listing Stopping the AdapterEvent Class Structure source OS2 subsource OS2Troubleshooting the OS/2 Adapter Chapter 7. SNMP Adapter Server ConfigurationSNMP Driver Reception of SNMP MessagesConfiguration File SNMP Event ExampleClass Definition Statement File KeywordsObject Identifier File Error FileStarting and Stopping the Adapter $AGENTADDRWarm Start Cold StartStopping the Adapter Events ListingHost on which the adapter runs adapterhostforwardingagent Proxy agent that forwarded the event to the adapterEnterprise-specific Traps Rules ListingSNMP Traps Generic Traps v tecadsnmp.baroc v tecadsnmp.cds v tecadsnmp.oid Creating a New SNMP Trap EventBAROC File Changes 90 IBM Tivoli Enterprise Console Adapters Guide Agent-independent DataSYNTAX INTEGER 0..4294967295 ACCESS not-accessible Page Class Definition Statement File Changes Object Identifier File Changes Troubleshooting the SNMP Adapter94 IBM Tivoli Enterprise Console Adapters Guide c configurationfileExample Chapter 8. IBM Tivoli Enterprise Console GatewaysControlling Event Traffic at the Gateway 3. Calculate the value for the EventSendThreshold keyword Configuration File Worksheets and CalculationsUNIX Microsoft WindowsUNIX /etc/Tivoli/tec/cache@EventServer#region tec/gatewaycache@EventServer#tmr-centralWindows $DBDIR/cache.dat@EventServer#region on managed nodes $TIVOLIHOME/tec/$ACTYPE.cache@ EventServer#region on endpointsGatewayQueueSize GatewayTMEAckEnabledGatewaySendInterval MaxGWCacheSizeMegsThe default value is @EventServer Starting the Adapter Event Server ConfigurationChapter 9. UNIX Log File Adapter init.tecadlogfile -s start stop AdapterID Running Multiple UNIX Log File AdaptersStopping the Adapter logdefault.rls Configuration FileAdapter Files tecadlogfile.cfgFormat File Error FileClass Definition Statement File Events ListingEvent Class Default Severity106 IBM Tivoli Enterprise Console Adapters Guide Default SeverityEvent Class Event Class Default SeverityPrinterPaperOut PrinterTonerLow PrinterOffline PrinterOutputFull Default RulesPrinterPaperJam PrinterDoorOpen PrinterPaperOut PrinterTonerLow PrinterOffline PrinterOutputFullLogfileAmd LogfileCron LogfileOserv LogfileDateSet Troubleshooting the UNIX Log File AdapterRepeatedLoginFailure RepeatedLoginFailureFrom RootLoginSuccessFrom 110 IBM Tivoli Enterprise Console Adapters Guide Adapter Files Chapter 10. Windows Event Log Adaptertecinstlwin.cmd tecadwins.exeDEFAULT Configuration Filetecadwin.baroc HostnameIsAdapterHostPreFilterLog=lognameEventId=value EventType=valueSource=value NumEventsToCatchUpPreFilterMode SpaceReplacementWINEVENTLOGS PreFilterLog=ApplicationSource=re’TEC.*’EventId Prefiltering Windows Log EventsThe UPS service terminated with service-specific error Jan 15 150619 1998 0 Error N/A ServiceControlManager 7024 \Format File SourceApplicationEventsProcessed Registry VariablesApplicationEventsProcessedTimeStamp DirectoryEventsProcessedDNSEventsProcessed DirectoryEventsProcessedTimeStampDNSEventsProcessedTimeStamp FileReplicationEventsProcessedTECInstallPath Low Memory Registry VariablesSecurityEventsProcessedTimeStamp SystemEventsProcessed1. Select Create Administrators from the Administrators icon Adapter Administrator Roles for Windows3. Type in SYSTEM in the Set Login Names dialog Starting the Adaptersource NT Event Class Structuresubsource hostnameNTPrinterWasSet tecadwin Command SYNOPSIS tecadwinDESCRIPTION EXAMPLESTroubleshooting the Windows Event Log Adapter 126 IBM Tivoli Enterprise Console Adapters Guide Adapter Files Chapter 11. Windows NT Event Log AdapterThe error file Configuration FileDEFAULT tecadnt.errNumEventsToCatchUp HKEYLOCALMACHINE\SYSTEM\ CurrentControlSet\Services\ TECNTAdapter\PreFilterLog=lognameEventId=valueEventType=valueSource=value Chapter 11. Windows NT Event Log AdapterSpaceReplacement Prefiltering Windows NT Log EventsPreFilterMode 130 IBM Tivoli Enterprise Console Adapters GuideEventId Format FileSource EventTypeRegistry Variables Non-English Format FilesApplicationEventsProcessed 132 IBM Tivoli Enterprise Console Adapters GuideApplicationEventsProcessedTimeStamp TECInstallPathPollingInterval SecurityEventsProcessed1. Select Create Administrators from the Administrators icon Adapter Administrator Roles for Windows NT3. Type in SYSTEM in the Set Login Names dialog Low Memory Registry VariablesStopping the Adapter Starting the AdapterEvents Listing Event Class Structure136 IBM Tivoli Enterprise Console Adapters Guide Default SeverityEvent Class tecadnt Command tecadnt.exe -d -c ConfigFile -L none EventLog tecadntAuthorization none Arguments c ConfigFileTroubleshooting the Windows NT Event Log Adapter 140 IBM Tivoli Enterprise Console Adapters Guide Appendix A. Files Shipped with Adapters 142 IBM Tivoli Enterprise Console Adapters Guide Appendix A. Files Shipped with Adapters 144 IBM Tivoli Enterprise Console Adapters Guide Format File Location Appendix B. Format File Referencev %lengths Format Specificationsv %lengths Log File Examplev %lengths+ v %ton on su ’su su ’susucceeded for succeeded for Mappings Windows NT Examplestring constant DEFAULT keywordPRINTF statement LABEL keywordAdditional Mapping Considerations The following list describes how values were assigned Generating a New Class Definition Statement File for a TME Adapter Activating Changes Made with a Format FileNetWare log file UNIX log fileWindows NT event log Windows event logNetWare log file UNIX log fileOperators Appendix C. Class Definition Statement File ReferenceFile Format FETCH Class Definition Statement File DetailsSELECT Note AS/400 adapters do not support KEY parts in CDS files 1$TYPE=4 FETCH Statement1 ATTR=,$TYPE,VALUE=,4 MAP Statement MAPDEFAULT StatementExample nexpressionname objectidentifier Object Identifier to Name TranslationSELECT Class Definition Statement File Syntax Diagramskeydecl = KEY ’’ kop ’,’ vopval ’’ aop = ’=’ PREFIX SUFFIX EXISTS Page 164 IBM Tivoli Enterprise Console Adapters Guide Notices IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A Notices Trademarks168 IBM Tivoli Enterprise Console Adapters Guide Obsolete term for GlossaryPage 5, 6 Index Special characters10, 24 CDS file keywords continued Page files continued Page Page TCP/IP continued Page 180 IBM Tivoli Enterprise Console Adapters Guide Page GC32-0668-01 Program Number 5698-TEC Printed in U.S.A