4.6.2 Event search conditions
The following conditions apply to event searches:
-
JP1/Base must be installed and the event service must be active on the host to be searched. (But the host does not need to be managed within a hierarchical system configuration.)
-
The host to be searched must be directly reachable from the JP1/IM manager.
To perform an event search, the JP1/IM - Manager (Central Console) to which you are logged in from JP1/IM - View connects directly to the host to be searched. The host must have a resolvable host name and be able to communicate. In particular, take care when searching for events in a firewall environment or when the host is connected to multiple LANs.
Sometimes a JP1 event might arrive from a host that cannot be searched (because it is not directly reachable). This occurs because events are not transferred directly from agent to manager, but are forwarded in stages from agent to base manager, and from base manager to integrated manager. Event transfer and event searches use different communication paths. An event search can only be conducted on a host that the manager can communicate with directly.
-
The JP1 events to be searched must still reside in the event database or integrated monitoring database.
If you specify the event database in the search conditions, JP1 events in the event database are searched. If you specify the integrated monitoring database in the search conditions, JP1 events in the integrated monitoring database are searched.
Each instance of JP1/Base has two event databases. When the maximum capacity (default 10 MB) of one event database is reached, the other event database is swapped in. At this point, the contents of the swapped-in event database are erased, and the erased JP1 events cannot be searched.
The information in the event database and integrated monitoring database takes the form of files that are overwritten in a wrap-around cycle. Old JP1 events that have been overwritten cannot be retrieved.
- Important
-
The time required for searching an event is proportional to the size of the event DB. If the capacity of the event DB reaches the maximum size, more than 30 minutes may be required for searching an event. By specifying [Arrived timeframe] as an event search condition, you may be able to shorten the time required for searching the event.