4.3.4 Contents of a correlation event generation history file
Information about the operating status and correlation processing of the correlation event generation function is logged to a correlation event generation history file. By referencing this file, you can check whether correlation events are being issued according to the defined correlation event generation conditions. For example, if a large number issue failures are being logged for a specific generation condition, it could be that the target JP1 events are an inappropriate combination, or the timeout period might be too short. When periodically reviewing the conditions, look at the correlation event generation history file as a reference. The file can be found in the following location:
- In Windows:
-
console-path\operation\evgen\egs_discrim{1|2|3}.log
- In UNIX:
-
/var/opt/jp1cons/operation/evgen/egs_discrim{1|2|3}.log
You can change the maximum size and number of correlation event generation history files. For details, see Correlation event generation environment definition file in Chapter 2. Definition Files in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference.
- Organization of this subsection
(1) Format of a correlation event generation history file
The format of a correlation event generation history file is as follows:
{+ | -}serial-number time processing-contents
The serial number is that of the correlation event issue log. The numbers run from 00000001 to 99999999, and then start again from 00000001. When the correlation event generation function is restarted, the serial numbers also start again from 00000001. The time is output in YYYY/MM/DD hh:mm:ss.SSS format (YYYY: year, MM: month, DD: day, hh: hour, mm: minute, ss.SSS: second).
Basically, a one-line log entry beginning with a plus sign (+) is output per processing. Where the entry spans multiple lines, the first line begins with a plus sign (+) and the continuation lines begin with a hyphen (-). The contents logged to the file are described next.
(2) Processing results logged to a correlation event generation history file
The following table describes the processing results logged to a correlation event generation history file.
|
No. |
Processing result |
Format |
Remarks |
|---|---|---|---|
|
1 |
The correlation event generation function is active. |
+Correlation event generation function : RUNNING -VERSION=version-of-correlation event-generation-definition-file -[generation-condition-name] -TARGET=filtering-condition-for-correlation-target-range -CON=event-condition -TIMEOUT=timeout-period -TYPE=event-correlation-type -SAME_ATTRIBUTE=duplicate-attribute-value-condition -CORRELATION_NUM=maximum-correlation-number -SUCCESS_EVENT=correlation-approval-event : |
The output items are the contents of the correlation event generation definition file being used. |
|
2 |
The correlation event generation function is inactive. |
+Correlation event generation function : STANDBY |
-- |
|
3 |
A JP1 event matching the event condition has been issued and correlation processing has started. |
+Generation start condition-name (correlation-number) JP1-event-information -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value : -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value |
correlation-number is for identifying the start of processing and the processing result (satisfied or unsatisfied) for each set of JP1 events when multiple sets are being correlated with one generation condition. |
|
4 |
The generation condition was satisfied. |
+Generation success condition-name (correlation-number) -JP1-event-information-1 -JP1-event-information-2 : -JP1-event-information-n -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value : -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value |
-- |
|
5 |
A correlation event has been issued. |
+Correlation event generation succeeded. condition-name (correlation-number) serial-number-in-event-database |
-- |
|
6 |
The generation condition was not satisfied. (Correlation processing has stopped.) |
+Generation fail condition-name (correlation-number) reason-for-failure -JP1-event-information-1 -JP1-event-information-2 : -JP1-event-information-n -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value : -SAME_ATTRIBUTE=same-attribute-name:same-attribute-value |
The reason why the generation condition was not satisfied is output as one of the following:
|
|
7 |
The correlation event generation definition has been updated. |
+Correlation event generation definition update -VERSION=version-of-correlation event-generation-definition-file -[generation-condition-name] -TARGET=filtering-condition-for-correlation-target-range -CON=event-condition -TIMEOUT=timeout-period -TYPE=event-correlation-type -SAME_ATTRIBUTE=duplicate-attribute-value-condition -CORRELATION_NUM=maximum-correlation-number -SUCCESS_EVENT=correlation-approval-event : |
The output items are the contents of the correlation event generation definition file being used. |
|
8 |
Output to the header at the following times:
|
JP1/IM - Central Console/Correlation Event Generation Service |
-- |
|
9 |
A JP1 event matching the event condition has been issued and correlation processing has started, but the JP1 event does not contain the attribute defined in the duplicate attribute value condition. |
+A JP1 event that matches the correlation event generation condition occurred, and the correlation event generation processing started, but the event attribute defined in that attribute value condition does not exist in the JP1 event. (condition-name (correlation-number) serial-number-in-event-database attribute-name) |
The attribute not present in the JP1 event being correlated is output to attribute-name at the left. |
|
10 |
A JP1 event was received after the number of JP1 event sets being correlated had reached the limit of 20,000 sets. |
+Generation fail condition-name (correlation-number) exceeded the threshold (20000) -JP1-event-information |
-- |
- Legend:
-
--: None
The item JP1-event-information in the table is output in the following format:
serial-number-in-event-database,event-ID,source-event-server-name,arrival-time,event-level
When the correlation event generation function starts or the correlation event generation history file is switched, the header information is output in the following format:
-------------------------------------------------------------
JP1/IM - Central Console/Correlation Event Generation Service
![[Figure]](GRAPHICS/CS031700.GIF)