Hitachi

Job Management Partner 1 Version 10 Job Management Partner 1/Integrated Management - Manager Overview and System Design Guide

3.2.6 Defining filter conditions

The conditions of the event acquisition filter, event receiver filter, severe events filter, view filter, and the filter that can be defined for event search can be either exclusion-conditions or pass conditions. Exclusion-conditions are a set of conditions for JP1 events that you do not want to display (acquire). Pass conditions are a set of conditions for JP1 events that you do want to display (acquire). As a separate class of conditions, there are also common exclusion-conditions, which allow you to disable or apply a condition group in an event acquisition filter. Filter conditions apply in the following order of precedence: common exclusion-conditions, exclusion-conditions, and pass conditions.

You can define a combination of common exclusion-conditions, exclusion-conditions, or pass conditions in a condition group. A condition group contains one or more conditions, and is satisfied when all the defined conditions are satisfied. That is, the conditions in a filter are related by an AND condition.

When a filter consists of exclusion-conditions and pass conditions, combined into multiple condition groups of either type, those JP1 events matching the conditions in one of the exclusion-condition groups are filtered out, and those JP1 events matching the conditions in one of the pass condition groups pass through the filter and are transferred to the higher-level control (see Figure 3-10 Filters provided by JP1/IM and JP1/Base (when not using the integrated monitoring database) and Figure 3-11 Filters provided by JP1/IM and JP1/Base (when using the integrated monitoring database)). That is, the condition groups of exclusion-conditions or pass conditions are related by an OR condition.

The following figure shows how a filter works.

Figure 3‒12: Event transfer through a filter to higher-level control

[Figure]

Except for the JP1/Base forwarding filter, you define filter conditions in JP1/IM - View.

Organization of this subsection

(1) Common exclusion-conditions (event acquisition filter only)

Common exclusion-conditions form part of an event acquisition filter and consist of a group of conditions for filtering out JP1 events. You can apply or disable each group. In maintenance mode, for example, you can set a common-exclusion-condition group to temporarily filter out JP1 events issued by the host you are working on, without having to change the pass conditions or exclusion-conditions in the event acquisition filter. If you have defined multiple event acquisition filters, and switch among them as required, the common exclusion-conditions you set apply to whichever filter is in force.

Of the conditions defined in an event acquisition filter, common exclusion-conditions take precedence over exclusion-conditions, which take precedence over pass conditions.

There are two types of operation modes for common exclusion-conditions: basic mode and extended mode. You can execute the jcochcefmode command to switch between basic mode and extended mode. In extended mode, you can filter events by Registered time, Arrived time, Start time, End time, Event source host name, and other items. You can also filter the event conditions by specifying the date and time, or execute the jcochfilter command to switch whether to enable or disable each group of conditions. However, for regular expressions, you can use only the extended regular expressions. After you switch to extended mode, you can return to basic mode. For details about basic mode and extended mode, see 3.2.6(1)(a) Difference between basic mode and extended mode of common exclusion-conditions. This manual describes information common to basic mode and extended mode if not otherwise specified.

For details about how to define common exclusion-conditions and how to switch the operation modes, see 4.2.4(3) Setting common exclusion-conditions in the Job Management Partner 1/Integrated Management - Manager Configuration Guide.

The following figure shows the relationships among the common exclusion-conditions, exclusion-conditions, and pass conditions in event acquisition filters.

Figure 3‒13: Relationships among the filter conditions in event acquisition filters

[Figure]

You can also use additional common exclusion-conditions. You can define additional common exclusion-conditions by using monitored JP1 events while the system is operating. You can use additional common exclusion-conditions only when common exclusion-conditions are in extended mode. For details about additional common exclusion-conditions, see 3.2.6(1)(c) Additional common exclusion-conditions.

The following shows the difference between common exclusion-conditions and additional common exclusion-conditions:

For smoother operations, you can use common exclusion-conditions and additional common exclusion-conditions as follows as the situation demands:

The total number of common exclusion-conditions and additional common exclusion-conditions must be 1,024 or fewer, and the total size must be 10 MB or smaller.

(a) Difference between basic mode and extended mode of common exclusion-conditions

The following table compares what you can do when common exclusion-conditions are switched into extended mode with what you can do when common exclusion-conditions are in basic mode. Common exclusion-conditions operate in basic mode by default and after JP1/IM - Manager is installed.

Table 3‒4: Comparision between what you can do with basic mode and extended mode of common exclusion-conditions

What you can do with common exclusion-conditions

Basic mode

Extended mode

Filter events by Registered time and Arrived time

N

Y

Filter events by Start time and End time

N

Y

Filter events by Event source host name

N

Y

Filter events by Extended attribute

N

Y

Compare events by using JP1-specific regular expressions or basic regular expressions

Y

N

Compare events by using extended regular expressions

Y

Y

Define a group of conditions for each agent host

N

Y

Set whether to activate or deactivate common exclusion-conditions for each group of common exclusion-conditions

Y

Y

Add a group of common exclusion-conditions you want to activate or deactivate

N

Y

Specify a period of time for which a group of conditions is applied

N

Y

Write comments

N

Y

Set additional common exclusion-conditions based on the JP1 events occurring while the system is operating

N

Y
Legend:

Y: Available

N: Not available

The following table describes the difference between basic mode and extended mode of common exclusion-conditions.

Table 3‒5: Difference between basic mode and extended mode of common exclusion-conditions

Item

Basic mode

Extended mode

Attributes of event conditions

Basic attributes:

  • Event ID (B.ID)

  • Source host (B.SOURCESERVER)

  • Message (B.MESSAGE)

Basic attributes:

  • Event ID (B.ID)

  • Registered reason (B.REASON)

  • Source process ID (B.PROCESSID)

  • Registered time (B.TIME)

  • Arrived time (B.ARRIVEDTIME)

  • Source user ID(B.USERID)

  • Source group (B.GROUPID)

  • Source user name (B.USERNAME)

  • Source group name (B.GROUPNAME)

  • Source host (B.SOURCESERVER)

  • Source IP address (B.SOURCEIPADDR)

  • Message (B.MESSAGE)

Common extended attributes:

  • Event level (E.SEVERITY)

  • User name (E.USER_NAME)

  • Product name (E.PRODUCT_NAME)

  • Object type (E.OBJECT_TYPE)

  • Object name (E.OBJECT_NAME)

  • Root object type (E.ROOT_OBJECT_TYPE)

  • Root object name (E.ROOT_OBJECT_NAME)

  • Occurrence (E.OCCURRENCE)

Common extended attributes:

  • Event level (E.SEVERITY)

  • User name (E.USER_NAME)

  • Product name (E.PRODUCT_NAME)

  • Object type (E.OBJECT_TYPE)

  • Object name (E.OBJECT_NAME)

  • Root object type (E.ROOT_OBJECT_TYPE)

  • Root object name (E.ROOT_OBJECT_NAME)

  • Object ID (E.OBJECT_ID)

  • Occurrence (E.OCCURRENCE)

  • Start time (E.START_TIME)

  • End time (E.END_TIME)

  • Result code (E.RESULT_CODE)

  • Event source host name (E.JP1_SOURCEHOST)

Extended attribute

Cannot be defined.
Extended attribute

Can be defined.

Comparison types of event conditions#

  • Match

  • Does not match

  • First characters

  • Is contained

  • Is not contained

  • Regular expression

  • Match

  • Does not match

  • First characters

  • Is contained

  • Is not contained

  • Regular expression

  • Time

Regular expressions

  • JP1-specific regular expressions

  • Basic regular expressions

  • Extended regular expressions

Extended regular expressions

Maximum number of common exclusion-conditions groups that can be defined

30 groups (filter length: 64 kilobytes or shorter)

1,024 groups (Filter length: 10 megabytes or shorter)

Contents of definition

  • Common exclusion-conditions group ID

  • Common exclusion-conditions group name

  • Event conditions

  • Common exclusion-conditions group ID

  • Common exclusion-conditions group name

  • Event conditions

  • Comment

  • Conditions Apply Period

Method of activating or deactivating common exclusion-conditions

  • System Environment Settings window

  • -e option in the jcochfilter command

  • System Environment Settings window

  • -e, -on, and -off options in the jcochfilter command

Applicable period

--

On the Conditions Apply Period page in the Common Exclusion-Condition Settings (Extended) window, you can set the applicable period.

Setting method

Common Exclusion-Conditions Settings window

  • Common Exclusion-Condition-Settings (Extended) window

  • Common exclusion-conditions extended definition file and the -ef option in the jcochfilter command

Legend:

--: Not applicable.

#: Comparison types of event conditions differ depending on the selected attribute. For details, see the following:

  • For basic mode:

    2.15 Common Exclusion-Conditions Settings window in the manual Job Management Partner 1/Integrated Management - Manager GUI Reference.

  • For extended mode:

    2.16 Common Exclusion-Condition Settings (Extended) window in the manual Job Management Partner 1/Integrated Management - Manager GUI Reference.

(b) Applicable period (when common exclusion-conditions are in extended mode)

By changing the mode of common exclusion-conditions of the event acquisition filter to extended mode, you can specify the applicable period of the conditions for excluding JP1 events. During the applicable period, you can specify a period, day of the week, and time zone. If you specify the applicable period, only the JP1 events generated within the applicable period are excluded by the common exclusion-conditions in extended mode.

For example, when the maintenance time for a monitored host is fixed to a certain time, you can specify the applicable period to exclude JP1 events that would occur on the host during the maintenance conducted at certain date and time or at a certain day of the week, or to disable conditions groups by restricting the period.

The following example applies common exclusion-conditions in extended mode from 9:00 on Sunday to 9:00 on the next Monday during July 8 in 2011 to September 10 in 2011, according to the maintenance schedule for the monitored host.

Figure 3‒14: Common exclusion-conditions in extended mode

[Figure]

The time is set according to the time zone designed for the machine on which JP1/IM - Manager is running.

Thus, specifying the applicable period might enable JP1 event filtering without the need of changing conditions groups, or activating or deactivating the common exclusion-conditions. JP1 events that occurred during the applicable period is determined by comparing the Arrived time (B.ARRIVEDTIME) of the JP1 event. Note that you can specify the applicable period for each conditions group. To use the applicable period, common exclusion-conditions groups must be enabled.

You can specify the applicable period on the Conditions Apply Period page in the Common Exclusion-Condition Settings (Extended) window. For details about the Common Exclusion-Condition Settings (Extended) window, see 2.16 Common Exclusion-Condition Settings (Extended) window in the manual Job Management Partner 1/Integrated Management - Manager GUI Reference.

(c) Additional common exclusion-conditions

The additional common exclusion-conditions are used by defining the monitored JP1 events during system operations. Selecting a JP1 event in the Event Console window or Related Events window sets an additional common exclusion-condition.

To use the additional common exclusion-conditions, you must have the JP1_Console_Admin permission. Also, you must switch the common exclusion-conditions into extended mode. You can define the additional common exclusion-conditions for the following JP1 events:

  • JP1 events registered in the event database of a manager host to which JP1 JP1/IM - View logged in, or in the integrated monitoring database

  • JP1 events registered in the event database of agent hosts

You can set the additional common exclusion-conditions in the Common Exclusion-Condition Settings (Extended) window, which can be displayed as follows:

  • In the Event Console window, select a JP1 event, and select View>Exclude by Common Exclusion-Conditions.

  • In the Event Console window, select a JP1 event, and from the pop-up menu displayed by right-clicking, select Exclude by Common Exclusion-Conditions.

  • In the Related Events window, select a JP1 event, and from the pop-up menu displayed by right-clicking, select Exclude by Common Exclusion-Conditions.

The attribute name and value of the selected JP1 event are displayed and are automatically input as event conditions. The common exclusion-conditions group name and comments are also input and automatically displayed. For details about this window, see 2.16 Common Exclusion-Condition Settings (Extended) window in the manual Job Management Partner 1/Integrated Management - Manager GUI Reference. Note that the window cannot be displayed when you are using the Web page version of JP1/IM - View. For details about the event attribute names that can be specified for event conditions, see Common-exclusion-conditions display item definition file (common_exclude_filter_attr_list.conf) in 2. Definition Files in the manual Job Management Partner 1/Integrated Management - Manager Command and Definition File Reference.

The defined additional common exclusion-conditions can be edited, deleted, or changed into common exclusion-conditions in the Event Acquisition Conditions List window.

For details about this window, see 2.14 Event Acquisition Conditions List window in the manual Job Management Partner 1/Integrated Management - Manager GUI Reference.

For details about how to set additional common exclusion-conditions, see 5.1.14 Excluding JP1 events from monitoring by setting additional common exclusion-conditions in the Job Management Partner 1/Integrated Management - Manager Administration Guide.

Important note

JP1 events set for common exclusion-conditions are excluded from the event monitoring targets. The excluded events are no longer displayed in the event list in the Event Console window. When you set common exclusion-conditions, carefully check the settings for event conditions. If you execute the jcochfilter command with the -ef option specified to apply the extended definitions of common exclusion-conditions, all the defined common exclusion-conditions are replaced. All the definitions of additional common exclusion-conditions that were added during event monitoring will be lost, so be careful.

To Page Top

(2) Exclusion-conditions

Exclusion-conditions filter out events. JP1 events that match any one of the defined condition groups do not pass through the filter. Exclusion-conditions take precedence over pass conditions. To define exclusion-conditions, JP1/Base version 09-00 or later is required on the JP1/IM - Manager host.

You can define exclusion-conditions in an event acquisition filter, event receiver filter, severe events filter, view filter, and in event searches.

To Page Top

(3) Pass conditions

Pass conditions display (acquire) events. JP1 events that match any one of the defined condition groups pass through the filter.

You can define pass conditions in an event acquisition filter, event receiver filter, severe events filter, view filter, and in event searches.

To Page Top

Trademarks

All Rights Reserved. Copyright (C) 2012, 2014, Hitachi, Ltd.