Forwarding settings file
- Organization of this page
Format
# Forwarding setting block to-upper event-filter end-to : or to event-server-name event-filter end-to : # Forwarding-suppression setting block suppress identifier unit-time threshold check-count [destination] event-filter end-suppress |
Storage destination directory
- In Windows:
-
folder-specified-in-event-server-index-file\
shared-folder\jp1base\event\ (in a cluster system)
The default event server index file (index) is located at installation-folder\conf\event\servers\default\.
- In UNIX:
-
directory-specified-in-event-server-index-file\
shared-directory/event/ (in a cluster system)
The default event server index file (index) is located at /etc/opt/jp1base/conf/event/servers/default/.
Description
A forwarding settings file (forward) is a group of forwarding setting blocks that define which JP1 events will be forwarded to a specific event server. This file also specifies conditions for the suppression of event-forwarding by using a threshold.
Application of settings
The settings are applied when the event service starts or restarts, or the forwarding settings file is reloaded by executing the jevreload command. For details on the jevreload command, see jevreload in 15. Commands. When you restart the event service, you also need to restart services for which the event service is a prerequisite.
Definition details
The following conventions apply to entries in the forwarding settings file (forward).
-
The forwarding settings file (forward) is a text file in which each line is no more than 1,023 bytes.
-
Separate parameter keywords with a space (code 0x20) or a tab (code 0x09).
-
Do not insert a space or any other characters in front of the parameter name and hash mark (#) (code 0x23) at the start of a line.
-
A hash mark (#) (code 0x23) at the start of a line indicates a comment.
-
Letters are case sensitive.
Definition details of the forwarding setting block:
- to-upper
-
If the forwarding setting block is defined in the to-upper format, JP1 events are forwarded to a server at a higher level in the hierarchy defined in JP1/IM - Manager. A forwarding setting block is from to-upper to end-to.
- to event-server-name
-
If the forwarding setting block is defined in the to format, you can specify the destination event server name. event-server-name is case sensitive. You need to specify a remote event server name that is specified in the event server settings file (conf) in the local server. A forwarding setting block is from to to end-to.
- event-filter
-
Specify the conditions for the target JP1 events. For details on the description format of an event filter, see Event filter syntax.
Definition details of the forwarding-suppression setting block:
- suppress identifier unit-time threshold check-count [destination]
-
Specify conditions used for the threshold-based suppression of event-forwarding. A forwarding-suppression setting block (a condition for the suppression of event-forwarding) is from suppress to end-suppress.
Note that JP1 events that are subject to evaluation on each condition for the suppression of event-forwarding (suppress) are the JP1 events being filtered by the forwarding setting (to) that also have a matching destination and event filter specified.
- identifier
-
Specify a name for each condition for the suppression of event-forwarding with alphanumeric characters from 1 to 12 bytes. This information is used to identify a condition for the suppression of event-forwarding when starting or stopping the event forwarding suppression. Specify a unique character string within the event server.
- unit-time
-
Specify a time duration for which the threshold is evaluated in seconds from 1 to 3,600. The duration specified here will be used as a unit for check-count.
- threshold
-
Specify a number of JP1 events that determines an occurrence of large numbers of events with a value from 1 to 72,000. If the number of JP1 events that match suppression conditions (both destination and event filter) per unit-time is equal to or more than this threshold, the system determines that a large number of events has occurred.
- check-count
-
Specify the number of unit-times used to determine an occurrence or convergence of large numbers of events with a value from 1 to 3,000. If the number of events consecutively exceeds the threshold during a unit time the number of times specified here, the system determines that a large number of events has occurred, and starts event forwarding suppression. Similarly, if the number of events consecutively falls below the threshold during a unit time the number of times specified here, the system determines that a large number of events have converged, and stops the event forwarding suppression.
Note that you can set a different number for starting and stopping the event forwarding suppression by separating the values by a comma (,). For example, specifying 3,5 defines an occurrence condition of 3 times, and a convergence condition of 5 times. Specifying 3 defines occurrence and convergence conditions of 3 times.
- [destination]
-
Specify the name of a destination event server subject to the conditions for the suppression of event-forwarding. JP1 events that are forwarded to the event servers specified here are evaluated by the conditions for suppression of event-forwarding.
As a destination, specify one of the items below. If omitted, all the destination event servers are evaluated by the conditions for suppression of event-forwarding.
-
*
All the destination event servers are subject to the conditions for suppression of event-forwarding.
-
event-server-name
Specify the destination event server name that is subject to the condition for suppression of event-forwarding. event-server-name is case sensitive.
-
(upper)
The higher-level host defined in the configuration definition information is assumed as the destination event server name. If no higher-level host is defined in the configuration definition information, the corresponding condition for suppression of event-forwarding becomes invalid.
-
- event-filter
-
The same as the forwarding setting block.
Notes
-
In a forwarding settings file (forward), you can specify multiple forwarding setting blocks and forwarding-suppression setting blocks.
-
If you specify an event filter that contains Japanese characters in a forwarding settings file (forward), the encoding must be consistent with the locale settings (such as the LANG environment variable) specified for the system when the event service started. The JP1 event will not be forwarded unless this condition is met.
-
When JP1 events are forwarded through several routes, the destination event server might receive multiple instances of the same JP1 event. In this case, a duplication check is performed for the transferred JP1 event. The check examines the following conditions:
-
Whether the first JP1 event matches the source event server name.
-
- Whether the first JP1 event matches the serial number for the source event server.
-
- Whether the first JP1 event matches the registered time.
-
- Whether the registered reason is 4 (a forwarded event)
If all of these conditions are met, the JP1 event is considered to be a duplicate, and the second and subsequent events are not registered in the event database.
-
-
If multiple forwarding setting blocks (to to end-to) that have the same destination assigned are specified, forwarding processing is done in the order of event filter specified in each block. At the end, the forwarding processing is the same as the case when events are transferred with multiple event filters specified and connected with OR.
-
If multiple forwarding-suppression setting blocks (suppress to end-suppress) are specified, conditions for the suppression of event-forwarding (suppress) are evaluated in the following manner, to determine whether forwarding suppression is started or stopped:
-
Evaluation is performed on all the conditions for suppression of event-forwarding (suppress) that have a matching destination.
-
A JP1 event that was evaluated as a suppression target by one or more conditions for suppression of event-forwarding (suppress) that have the matching destination, is suppressed from being forwarded. Forwarding of those events is restarted when the JP1 event is evaluated as a non-suppression target by all the conditions for suppression of event-forwarding (suppress) that have the matching destination.
-
Definition examples
- Definition examples of a forwarding setting block
-
Shown below are examples of forwarding settings for forwarding JP1 events in the following system configuration.
Table 16‒9: Example of forwarding settings Host name
Role in configuration
jp1-svs1
Integrated manager
jp1-svs2
Submanager
jp1-sva1
JP1 site host
- Conditions
-
JP1 events are forwarded from jp1-sva1 to jp1-svs2 if any one of the following is true:
-
SEVERITY is set to Error
-
PRODUCT_NAME is set to /HITACHI/JP1/AJS, and SEVERITY is set to Warning or Notice
-
PRODUCT_NAME is set to /HITACHI/JP1/NT_LOGTRAP
JP1 events are forwarded from jp1-svs2 to jp1-svs1 if any one of the following is true:
-
SEVERITY is set to Error
-
PRODUCT_NAME is set to /HITACHI/JP1/AJS, and SEVERITY is set to Warning
-
PRODUCT_NAME is set to /HITACHI/JP1/NT_LOGTRAP, and SEVERITY is set to Warning
-
The flow of JP1 event transfers is shown below.
Figure 16‒4: Definition examples and flow of JP1 event transfers - Example of defining the forward file in jp1-svs1
#---------------------------------------------------------- # JP1/Base - Event Service Forwarding Setting #---------------------------------------------------------- # Event Server Name: jp1-svs1 # (Nothing)
- Example of defining the forward file in jp1-svs2
#----------------------------------------------------------- # JP1/Base - Event Service Forwarding Setting #----------------------------------------------------------- # Event Server Name : jp1-svs2 to jp1-svs1 E.SEVERITY IN Error OR E.PRODUCT_NAME IN /HITACHI/JP1/AJS E.SEVERITY IN Warning OR E.PRODUCT_NAME IN /HITACHI/JP1/NT_LOGTRAP E.SEVERITY IN Warning end-to
- Example of defining the forward file in jp1-sva1
#----------------------------------------------------------- # JP1/Base - Event Service Forwarding Setting #----------------------------------------------------------- # Event Server Name : jp1-sva1 to jp1-svs2 E.SEVERITY IN Error OR E.PRODUCT_NAME IN /HITACHI/JP1/AJS E.SEVERITY IN Warning Notice OR E.PRODUCT_NAME IN /HITACHI/JP1/NT_LOGTRAP end-to
- Definition examples of a forwarding-suppression setting block (condition for suppression of event-forwarding)
-
Shown below is a definition example of a forwarding-suppression setting block (condition for suppression of event-forwarding) matching the following conditions:
-
Monitored log file name of the JP1 event is /tmp/logfile1.
-
Destination of the JP1 event is a higher-level host defined in the configuration definition information.
-
Event forwarding is suppressed when, regarding 60 seconds as a unit time, a condition in which 900 or more JP1 events occur in a 60-second unit time occurs consecutively five times. The forwarding suppression is stopped when a condition in which 899 or less JP1 events occur in a 60-second unit time occurs consecutively five times.
suppress log1 60 900 5 (upper) E.OBJECT_NAME IN /tmp/logfile1 end-suppress
-