Job Management Partner 1/Base User's Guide

1.5.2 Converting Windows event logs

The following figure shows how the event log trapping function converts Windows event log entries into JP1 events and registers them in an event database.

Note

This functionality does not support the event types introduced in Windows Vista and Windows Server 2008.

Figure 1-17 Overview of Windows event log conversion to JP1 event registration

To use an event log trap, create an action definition file for event log trapping (ntevent.conf) and then specify the conditions for the log data you want to convert into JP1 events. If the event service is started first, and then the event log trapping service is started, an event log trap is generated and the event log is monitored. All event logs that match the monitoring conditions are converted into JP1 events, which are then registered in the event database. All JP1 events converted from the Windows event log are assigned an event ID of 00003A71. The severity corresponds to the type of event log data before they are converted to JP1 events.

By default, the event service is set to start automatically when the system is started, but the event log trapping service does not restart automatically. To start and end the event log trapping service automatically, set it up so that the event log trapping service starts after the event service starts. Use the startup control to do this.

By using the action definition file for event log trapping (ntevent.conf), you can set an event log trap so that it reattempts to connect to the event service if a connection cannot be established when the event log trapping starts or when event log data is trapped.

Trapped event log messages can be registered as JP1 events up to 1,023 bytes. If a message exceeds this limit, the message is truncated from the 1,024th byte when the message is converted into a JP1 event. For details on the JP1 event attributes, see 15.3(7) Details about event ID 00003A71.

Organization of this subsection

(1) Start and end of monitoring

(1) Start and end of monitoring

Event log entries generated between the start and end of the event log trapping service are immediately converted into JP1 events if they match the monitoring conditions. The event log is monitored at set intervals to catch any event log that might be missed if a temporary error occurs. The default is 10 seconds. You can change this interval in the action definition file for event log trapping (ntevent.conf).

[Contents][Back][Next]

[Trademarks]