3.12.2 Saving event information in the integrated monitoring database (CSV report)

The functionality for outputting event information from the integrated monitoring database is referred to as output of an event report.

Using this feature in JP1/IM, you can save information about the JP1 events registered in the integrated monitoring database as a CSV-formatted report. To output an event report, execute the jcoevtreport command. As a command option, you can specify what event information to output.

For the command syntax, see jcoevtreport in 1. Commands in the manual Job Management Partner 1/Integrated Management - Manager Command and Definition File Reference.

The following describes the range of information you can output in an event report, and the output format, items, and command options.

Organization of this subsection

(1) Information that can be output to an event report
(2) Image and format of an event report
(3) Items output to an event report
(4) Command options

(1) Information that can be output to an event report

You can output the following event information to an event report:

Time-specified event information

You can specify the arrival time of the JP1 events to be output.
Program-specific event information

You can specify particular items of program-specific information. If you do not specify any items, all items are output.
Information about events that match a filter condition

You can limit the JP1 events to be output using pass conditions or exclusion-conditions in a filter. For the items you can specify in a filter condition, see Table 3-18 Contents output to an event report.

You can specify a maximum of 50 filter conditions in one pass condition group or one exclusion-condition group. In a filter for extended attributes (program-specific information), however, you can specify a maximum of five filter conditions in one pass condition group or one exclusion-condition group.

To Page Top

(2) Image and format of an event report

When you specify the header option, header information is output to line 1, separated by commas.

In line 2 and subsequent lines, event information is output in the following order, separated by commas:

basic attribute, extended attributes (common information), IM attributes, extended attribute (program-specific information)

In the extended attribute (program-specific information), event information is output as follows, after the IM attributes:

number of program-specific extended attributes, attribute name, attribute value

If you do not specify output of extended attributes, the number of program-specific extended attributes appears as 0, and the attribute name and value are blank (nothing is entered).

To Page Top

(3) Items output to an event report

When you specify the header option, header information for the attribute name or item name is output to line 1 of the CSV file. By default, no headers are output.

Table 3‒18: Contents output to an event report
Attribute type	Item	Header information
Basic attribute	Serial number	The character string displayed in the window is output.
	Event ID	The character string displayed in the window is output.
	Source process ID	The character string displayed in the window is output.
	Registered time	Output in the following format: When the attribute value is the cumulative number of seconds from 1970/01/01 00:00:00 (GMT): The time is output in one of the following two formats according to the specification of the `-t` option of the `jcoevtreport` command: - When `ON` is specified in the `-t` option: Format `YYYYMMDDhhmmss` in the time zone of the `jcoevtreport` command. - When `OFF` is specified in the `-t` option: Cumnulative number of seconds from 1970/01/01 00:00:00 (GMT) When the attribute value is other than the above: The character string set as the attribute value is output.
	Arrived time
	Registered reason	Output in decimal format.
	Source user ID
	Source group ID
	Source user name	Output as a character string.
	Source group name
	Source host
	Destination event server name
	Source IP address	The IP address is output as a character string.
	Destination IP address	The IP address is output as a character string.
	Source serial number	The character string displayed in the window is output.
	Code set	Output as a character string.
	Message	The character strings displayed in the window are output.
Extended attribute (common information)	Event level	The character string is converted and output as follows: Emergency -> `Emergency` Alert -> `Alert` Critical -> `Critical` Error -> `Error` Warning -> `Warning` Normal -> `Normal` Information -> `Information` Debug -> `Debug` For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output.
	User name	The character string displayed in the window is output.
	Product name
	Object type
	Object name
	Root object type
	Root object name
	Object ID	Output as a character string.
	Occurrence	The character string displayed in the window is output.
	Start time	Output in either of the following formats: `YYYYMMDDhhmmss` Cumulative seconds from 1970/01/01 00:00:00 (GMT)
	End time
	Result code	Output as a character string.
	Event source host name	Output as a character string.
Extended attribute (program-specific information)	`E.xxxxx`	Output as a character string.
	Monitoring suppression ID (`E.JP1_IMSUPPRESS_ID`)	Output as a character string when suppression of repeated-event monitoring is used. This information indicates the serial number of the repeated event that caused the number of occurrences to reach or exceed the threshold.
	Repeated event condition name (`E.JP1_IMSUPPRESS_NAME`)	Output as a character string when the repeated-event monitoring suppression function is used. This information indicates the repeated event condition that determines whether the event is a repeated event.
	Monitoring suppression type (`E.JP1_IMSUPPRESS_TYPE`)	The type of monitoring suppression is output as indicated below. This information is output when the repeated-event monitoring suppression function is used. Display suppression -> 1 Action suppression -> 2 Display suppression and action suppression -> 3
IM attributes	Action type	The icons in the window are converted into character strings and output as follows: -> `Command` -> `Rule` -> `Command,Rule` (no icon) -> (blank)
	Action suppression	The icons in the window are converted into character strings and output as follows: -> `Execute` -> `Partially` `suppress` -> `Suppress` -> `Repeated` `event` (no icon) -> (blank)
	Severe event	Either of the following is output: If the JP1 event is not severe: Blank If the JP1 event is severe: `Severe` `Event`
	Correlation event	The icons in the window are converted into character strings and output as follows: -> `Complete-correlations` `event` -> `Incomplete-correlations` `event` (no icon) -> (blank)
	Original severity level	The icon is converted and output as follows: Emergency -> `Emergency` Alert -> `Alert` Critical -> `Critical` Error -> `Error` Warning -> `Warning` Normal -> `Normal` Information -> `Information` Debug -> `Debug` For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output.
	New severity level	The icon in the window is converted and output as follows: -> `Changed` (no icon) -> (blank)
	Response status	The icons in the window are converted into character strings and output as follows: -> `Processed` -> `Processing` -> `Held` (no icon) -> `Unprocessed`
	Summary status	The character strings displayed in the window are output.
	Severe event release	The following character string is output: If the severe event has not been released: Blank If the severe event has been released: `Released`
	Severe event deletion	The following character string is output: If the severe event has not been deleted: Blank If the severe event has been deleted: `Delete`
	Memo	The character strings displayed in the window are output.

To Page Top

(4) Command options

You can specify the following options in the jcoevtreport command to output maintenance information and to save the event report:

Export maintenance information

jcoevtreport -sys -s 20090101000000 -e 20090103000000 (This example outputs JP1 events that were registered in the integrated monitoring database between 2009/01/01 00:00:00 and 2009/01/03 00:00:00.)
Save events before deletion

jcoevtreport -save

These two options are explained next.

(a) Export maintenance information

When an error occurs in the integrated monitoring database, this option outputs information about all JP1 events registered between the output start time and end time to the event report.

The attribute name appears in the header part.

Because the purpose is to collect data for investigating a database error, you cannot specify what items to output or any filtering conditions.

(b) Save events before deletion

This option outputs an event report about JP1 events due for deletion to free up space in the integrated monitoring database.

With this option specified, the command outputs in CSV format all the JP1 events registered in the integrated monitoring database that have not previously been saved to an event report.

■ Warning before deletion of unsaved JP1 events

You can issue a deletion warning event (event ID: 3F52) when the ratio of JP1 events in the integrated monitoring database that have not been output to an event report (relative to the maximum size of the database) exceeds a set threshold for issuing a deletion warning event (by default, when the unsaved data exceeds 80% of the database capacity).

Specify the ratio of unsaved JP1 events in the -dbntcpos option of the jcoimdef command.

Specify the threshold for issuing a deletion warning event in the -dbntc option of the jcoimdef command.

For details, see jcoimdef in 1. Commands in the manual Job Management Partner 1/Integrated Management - Manager Command and Definition File Reference.

■ Display information about saving events before deletion in the standard output

You can specify an option to display information about saving events due for deletion. Set the -showsv option of the jcoevtreport command to display this information in the standard output.

This option lets you see how much free space will be required to save the events, and helps you adjust the timing for outputting an event report before the target events are deleted.

With this option specified, the following items can be displayed in the standard output:

Ratio of JP1 events that have not been output to an event report (relative to the maximum size of the integrated monitoring database)

The ratio of JP1 events in the integrated monitoring database that have not been output to an event report is shown as a percentage.
Data size of the JP1 events that have not been output to an event report

The data size of the JP1 events in the integrated monitoring database that have not been output to an event report is shown in megabytes.
Threshold for issuing a deletion warning event

If issue of a deletion warning event is specified, the threshold is shown as a percentage. If you specify OFF in the jcoimdef command's -dbntc option, a hyphen (-) is shown.

To Page Top