4.19.5 Inheriting event information when a command is executed

For the following items related to command execution, you can specify the variables for the JP1 event information displayed in the Event Console window:

Target host
Command
Environment variable file

This function is called the event information inheritance function.

When this function is used, you do not have to directly enter, for the command argument, the event ID or message of the JP1 event for which investigation or handling is required. These pieces of event information can be specified for the command argument as variables.

Figure 4‒110: Operation example when the event information inheritance function is used

Organization of this subsection

(1) Specifiable event inheritance information
(2) Specifying variables
(3) Specifying events to be inherited
(4) Preview of the command to be executed

(1) Specifiable event inheritance information

The event information inheritance function allows all JP1 events displayed in JP1/IM - View except dummy events (events that are not registered in the event database) to be inherited. Information in multiple events cannot be inherited at one time.

The JP1 events shown below can be inherited. These JP1 events are JP1 events issued by a JP1 series product such as JP1/IM - MO, JP1 events issued by a user program, or correlation events.

JP1 events registered in the event database of the manager to which JP1/IM - View is logged in, or in the integrated monitoring database
JP1 events registered in the event database on an agent host

The table below describes the specifiable variable names and inherited event information for each event attribute type. The legend of the tables below is as follows:

Legend:

--: Not applicable.

Δ: Space

Table 4‒32: Variable names and inherited event information (Basic attributes of JP1 events)
No.	Event attribute	Variable	Inherited event information
1	--	`EVBASE`	A value obtained after the entire basic information of an event is converted to the following format: `event-ID`Δ`event-source-user-name`Δ`event-source-user-ID`Δ`event-source-group-name`Δ`event-source-group-ID`Δ`event-source-event-server-name`Δ`event-source-process-ID`Δ`event-registration-date-month-and-year`Δ`event-registration-time`Δ`event-source-host-IP-address` If no value is set, the value is replaced with a null character.
2	`B.ID` `B.IDEXT`	`EVID`	A value obtained after the event ID is converted to the `basic-code:extended-code` format. Basic codes and extended codes are 8-digit hexadecimal numbers (uppercase letters are used for A to F). Preceding zeros are omitted from the ID. For example, if the extended code is `00000000`, `EVID` is `basic-code:0`.
3	`B.ID`	`EVIDBASE`	A value obtained after the event ID is converted to the basic code format. `EVIDBASE` is an 8-digit hexadecimal number (upper letters are used for A to F), and preceding zeros are omitted from the ID.
4	`B.TIME`	`EVDATE`	A value obtained after the registration time is converted to the `yyyy/mm/dd` format. Conversion is for the time zone set for JP1/IM - View.
5	`B.TIME`	`EVTIME`	A value obtained after the registration time is converted to the `hh:mm:ss` format. Conversion is for the time zone set for JP1/IM - View.
6	`B.PROCESSID`	`EVPID`	A value for the event source process ID
7	`B.USERID`	`EVUSRID`	A value for the user ID of the event source process
8	`B.GROUPID`	`EVGRPID`	A value for the group ID of the event source process
9	`B.USERNAME`	`EVUSR`	A value for the event source user name
10	`B.GROUPNAME`	`EVGRP`	A value for the event source group name
11	`B.SOURCESERVER`	`EVHOST`	A value for the event source host name
12	`B.SOURCEIPADDR`	`EVIPADDR`	A character string for the event source IP address in IPv4 address format or IPv6 address format^#
13	`B.SEQNO`	`EVSEQNO`	A value for the serial number in the event database
14	`B.ARRIVEDTIME`	`EVARVDATE`	A value obtained after the arrived time is converted to the `yyyy/mm/dd` format.
15	`B.ARRIVEDTIME`	`EVARVTIME`	A value obtained after the arrived time is converted to the `hh:mm:ss` format.
16	`B.SOURCESEQNO`	`EVSRCNO`	A value for the serial number in the source event database
17	`B.MESSAGE`	`EVMSG`	A value for the message. If the applicable attribute does not exist, the value is replaced with a null character.

IPv4 address format

In this format, each 8 bits of a 32-bit address is delimited by periods (.), and is output as decimal numbers (from 0 to 255).

Example: 0.64.128.255
IPv6 address format

In this format, each 16 bits of a128-bit address is delimited by colons (:), and is output as hexadecimal numbers (from 0000 to ffff).

Example: 0011:2233:4455:6677:8899:aabb:ccdd:eeff

Table 4‒33: Variable names and inherited event information (extended attributes of JP1 events (common information))
No.	Event attribute	Variable	Inherited event information
1	`E.SEVERITY`	`EVSEV`	A value for the event level^#1 `Emergency`, `Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, `Debug`, or a value set for the event level
2	`E.USER_NAME`	`EVUSNAM`	A value for the user name^#1
`3`	`E.OBJECT_TYPE`	`EVOBTYP`	A value for the object type^#1
4	`E.OBJECT_NAME`	`EVOBNAM`	A value for the object name^#1
5	`E.ROOT_OBJECT_TYPE`	`EVROBTYP`	A value for the root object type^#1
6	`E.ROOT_OBJECT_NAME`	`EVROBNAM`	A value for the root object name^#1
7	`E.PRODUCT_NAME`	`EV"PRODUCT_NAME"`	A value for the product name^#2
8	`E.OBJECT_ID`	`EV"OBJECT_ID"`	A value for the object ID^#2
9	`E.OCCURRENCE`	`EV"OCCURRENCE"`	A value for the occurrence^#2
10	`E.START_TIME`	`EV"START_TIME"`	A value for the start time^#2
11	`E.END_TIME`	`EV"END_TIME"`	A value for the end time^#2
12	`E.RESULT_CODE`	`EV"RESULT_CODE"`	A value for the result code^#2
13	`E.JP1_SOURCEHOST`	`EV"JP1_SOURCEHOST"`	A value for the event source host name^#2
14	--	`EV"extended-attribute-name"`^#1	A value specified with the extended attribute name.^#2 For details about information contained in attributes, see the manual for each JP1 event source product.

#1: If the applicable attribute does not exist, the value is replaced with a null character.
#2: If the applicable attribute does not exist, the value is replaced with the character string for the variable.

Table 4‒34: Variable names and inherited event information (others)
No.	Event attribute	Variable	Inherited event information
1	--	`EV"@JP1IM_ACTTYPE"`	A value indicating the action type `0`: Not subject to the action. `1`: Command `2`: Rule `3`: Command and rule
2	--	`EV"@JP1IM_ACTCONTROL"`	A value indicating whether the event is subject to the action `0`: Not subject to the action. `1`: Executed. `2`: Suppressed. `3`: Partially suppressed.
3	--	`EV"@JP1IM_SEVERE"`	A value indicating whether the event is a severe event `0`: Not a severe event `1`: A severe event
4	--	`EV"@JP1IM_CORRELATE"`	A value indicating whether the event is a correlation event `0`: Not a correlation event `1`: A correlation approval event `2`: A correlation failure event
5	--	`EV"@JP1IM_RESPONSE"`	A value indicating whether the event is a response-waiting event `0`: Not a response-waiting event `1`: A response-waiting event
6	--	`EV"@JP1IM_ORIGINAL_SEVERITY"`	A value for the event level (before changing the event level)^# (`Emergency`, `Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, `Debug`, or a value set for the event level) This attribute is set only when the severity changing function is enabled.
7	--	`EV"@JP1IM_CHANGE_SEVERITY"`	A value indicating whether an event level has been changed `0`: Not changed. `1`: Changed.
8	--	`EV"@JP1IM_DEALT"`	A value indicating the handling status `0`: Not handled. `1`: Handled. `2`: Processing. `3`: Pending.
9	--	`EV"@JP1IM_RELEASE"`	A value indicating whether a severe event has been released `0`: Not released. `1`: Released.
10	--	`EV"@JP1IM_DISMISSED"`	A value indicating whether a severe event has been deleted `0`: Not deleted. `1`: Deleted.
11	--	`EV"@JP1IM_MEMO"`	A value for memo information^#
12	--	`EV"@JP1IM_DISPLAY_MESSAGE"`	Value of message (after change) This attribute is set only when the display message change function is enabled.
13	--	`EV"@JP1IM_CHANGE_MESSAGE"`	Value indicating whether the display message has been changed `0`: The message has not been changed. `1`: The message has been changed. This attribute is set only when the display message change function is enabled.
14	--	`ACTHOST`	A value for the manager host name

#: If no applicable attribute exists, the value is replaced with the character string for the variable.

For details about the event inheritance information that can be specified for automated action, see 6.3.4 Inherited event information.

To Page Top

(2) Specifying variables

The command execution function inherits event information through variables. JP1/IM - View converts the variables into JP1 event information, and then executes the command. Note that variables are case sensitive.

The following describes how to specify variables and the character strings resulting from the conversion.

Specify variables in the $variable-name format. If only $ is specified, it is regarded as a variable, but is not converted. If you want to specify $ as a character, place the escape character \ before $. For details about the character strings that can be specified, see 4.19.5(1) Specifiable event inheritance information.

The following table gives examples of specifications and the conversion results when server01 is set for the event source host name.

No.	Specification format	Conversion result
1	`ping $EVHOST`	`ping server01`
2	`/\$EVHOST`	`/$EVHOST`

If you place an alphanumeric character or underscore (_) immediately after the variable, the variable cannot be correctly converted. In such case, enclose the variable name with curly brackets ({}).

The following table gives examples of specifications and the conversion results when 100 is set for the event ID ($EVIDBASE) and ABC is set for the extended attribute EX ($EV"EX").

No.	Specification format	Conversion result
1	`$EVIDBASE abc`	`100 abc`
2	`$EVIDBASEabc`	`$EVIDBASEabc`^#
3	`${EVIDBASE}abc`	`100abc`
4	`$EVIDBASE_abc`	`$EVIDBASE_abc`^#
5	`${EVIDBASE}_abc`	`100_abc`
6	`$EV"EX" abc`	`ABC`
7	`$EV"EX"abc`	`ABCabc`

#:: When the command is specified on the command line and executed on a UNIX host, the variable is regarded as an environment variable of the OS during command execution, and then treated as a null character.

The following control characters contained in the character information to be converted are converted to spaces (0x20).

Control characters that are converted to spaces: 0x01 to 0x1F (excluding tabs (0x09)), and 0x7F

For example, if a message acquired by specifying $EVMSG contains a linefeed code (0x0A), the linefeed code (0x0A) is converted to a space (0x20).

Important

If \ is specified immediate before $, $ is treated as a character. However, if you want to specify a variable subsequent to \, such as in a file path, \ is converted and is not treated as a character string. You can avoid this by performing the following:

When specifying it in the execution command:

Create a batch file in which a variable is specified for the argument. Specify the command line in which \ is used in the batch file.

Example of specification of an execution command:

- Execution command: AppTest.bat $ACTHOST

- Batch file: application.exe c:\work\%1\result.txt

In this example, the conversion result of $ACTHOST is set for %1.

When using a variable in a file path:

Add a prefix to the variable.

The following shows examples when IM-VIEW is set for EV"PRODUCT_NAME":

Example when the variable cannot be converted:

- Example specification: C:\$EV"PRODUCT_NAME"

- Conversion result: C:$EV"PRODUCT_NAME"

In this example, EV"PRODUCT_NAME" cannot be converted because \$ is specified.

Example when the variable can be converted:

- Example specification: C:\pre_$EV"PRODUCT_NAME"

- Conversion result: C:\pre_IM-VIEW

In this example, EV"PRODUCT_NAME" can be converted because pre_ is added before the variable.

Important: When an attribute value is inherited, a character the OS treats as a special meaning can be converted into another character string. This behavior is the same as when a command is executed by an automated action. For details about conversion of a special character, see the description in Notes about specifying variables in Automated action definition file (actdef.conf) in Chapter 2. Definition Files in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference. Also, specific ASCII characters are converted to other characters according to the settings in the configuration file for converting information. For details about the configuration file for converting information, see Configuration file for converting information (event_info_replace.conf) in Chapter 2. Definition Files in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference.

You can specify a URL-encoded or Base64 encoded value of a JP1 event in the contents of the command to be executed. You cannot specify such an encoded value for the execution target host name or in the environment variable file.

Specify the value in the following format:

$variable-name$encoding-type

The following table lists and describes the encoding types and specification formats that can be specified when event information is inherited.

Table 4‒35: Encoding types and specification formats that can be specified when event information is inherited
No.	Encoding type	Specification format	Description
1	URL encoding	`$variable-name$URLENC`	The event information to be inherited is URL encoded as a UTF-8 character string. The resulting character string is passed to the execution command. Specification example 1: `C:\WebBrowser.exe http://host/site?id=$EVMSG$URLENC` Specification example 2: `C:\WebBrowser.exe http://host/site?p1=${EVMSG$URLENC}_$EVPID`
1	URL encoding	`${variable-name$URLENC}`
2	Base64 encoding	`$variable-name$ENC`	The event information to be inherited is Base64 encoded. The resulting character string is passed to the execution command. Specification example 1: `C:\UP\View.exe $EV"USER" $EV"PASS"$ENC` Specification example 2: `C:\UP\View.exe $EV"USER" ${EV"PASS"$ENC}_$EVPID`
2	Base64 encoding	`${variable-name$ENC}`
3	Both the Base64 encoding and URL encoding	`$variable-name$ENC$URLENC`	The event information to be inherited is Base64 encoded, and then URL encoded. The resulting character string is passed to the execution command. Specification example 1: `C:\WebBrowser.exe http://host/site?pass=$EV"PASS"$ENC$URLENC` Specification example 2: `C:\WebBrowser.exe http://host/site?pass=${EV"PASS"$ENC$URLENC}_$EVPID`
3	Both the Base64 encoding and URL encoding	`${variable-name$ENC$URLENC}`
4	No encoding	`$variable-name`	Neither URL encoding nor the Base64 encoding is performed. The event information to be inherited is passed to the execution command as it is. For details, see the tables in 4.19.5(1) Specifiable event inheritance information. Specification example 1: `C:\WebBrowser.exe http://host/site?id=$EVIDBASE` Specification example 2: `C:\WebBrowser.exe http://host/site?p1=${EVIDBASE}_$EVPID`
4	No encoding	`${variable-name}`

Important

If you place an alphanumeric character or underscore (_) immediately after the encoding type, enclose variable-name$encoding-type with curly brackets ({}).

Also, in the following cases, $variable-name$encoding-type or ${variable-name$encoding-type} is regarded as a character string, and is not converted:

No event corresponding to variable-name exists.
The specification format is incorrect.

The following table gives some specification formats and conversion results.

Table 4‒36: Examples of the formats specifying encoding and conversion results
No.	Specification format	Conversion result	Description
1	`$EVMSG$URLENC`	`ABC%40DEF`	`$EVMSG` is `ABC@DEF`.
2	`$EVMSG$ENC`	`QUJDREVGRw==`	`$EVMSG` is `ABCDEFG`.
3	`$EVMSG$ENC$URLENC`	`QUJDREVGRw%3D%3D`	`$EVMSG` is `ABCDEFG`.
4	`$HOGE$URLENC`	`$HOGE$URLENC`	`$HOGE` is an invalid variable.
5	`${EV"A0"$URLENC}abc`	`${EV"A0"$URLENC}abc`	Attribute `EV"A0"` does not exist.
6	`$EVMSG$URL`	`ABCDEFG$URL`	`$EVMSG` is `ABCDEFG`. `$URL` is an invalid variable.
7	`${EVMSG$URL}abc`	`${EVMSG$URL}abc`	`$EVMSG` is `ABCDEFG`. `$URL` is an invalid variable.
8	`$EVMSG$ENC\$URLENC`	`QUJDREVGRw==$URLENC`	`$EVMSG` is `ABCDEFG`. Base64 encoded by `$ENC`. `\` is escaped by the specification of `\$`.
9	`$EVMSG\$URLENC`	`ABC@DEF$URLENC`	`$EVMSG` is `ABC@DEF`. `\` is escaped by the specification of `\$`.
10	`$EVMSG$URLENC`	Null character	`$EVMSG` is a null character.

To Page Top

(3) Specifying events to be inherited

The following table describes operations by which you can specify the JP1 events to be inherited by the command to be executed.

Table 4‒37: Windows, menus, and buttons that can inherit event information
No.	Window type	Window name	Starting the Execute Command window^#1	Event to be inherited
1	Event list	Event Console	Menu>View>Execute Command (Event Inheritance)	JP1 events selected on the following pages in the Event Console window: Monitor Events Severe Events Search Events Response-waiting event
2			Menu>Options>Execute Command^#2
3			Toolbar>Execute Command button^#2
4			Pop-up menu>Execute Command (Event Inheritance)
5		Related Events (Summary)	Pop-up menu>Execute Command (Event Inheritance)	JP1 events selected in the following tables in the Related Events (Summary) window: Display Items Related Events
6		Related Events (Correlation)	Pop-up menu>Execute Command (Event Inheritance)	JP1 events selected in the following tables in the Related Events (Correlation) window: Display Items Related Events
7	Event details	Event Details	Execute Command button	JP1 events displayed in the window. However, event information for dummy events cannot be inherited.
8		Edit Event Details
9		Event Details>Related Events (Summary)
10		Edit Event Details>Related Events (Summary)
11		Event Details>Related Events (Correlation)
12		Edit Event Details>Related Events (Correlation)

#1:

If the selected event meets any of the conditions below, the Execute Command (Event Inheritance) menu item becomes unavailable, and cannot be selected. Also, for a dummy event, the Execute Command button in the Event Details window becomes unavailable, and cannot be clicked.

- There is no JP1 event.

- Multiple JP1 events are selected.

- A dummy event is selected.

#2:

If the Execute Command window is already displayed, it becomes the foreground (active) window.

The specified event is displayed in the Execute Command window. The display items (attributes) for the displayed JP1 events are the same as the display items (attributes) for the event list in the Event Console window. For details about the display items (attributes), see 4.19.5(1) Specifiable event inheritance information.

When the Execute Command window is displayed, if you specify a JP1 event again so that the event is inherited by the Execute Command window, the displayed JP1 events are changed. If the display items are changed in the Preferences window, the attribute values displayed in the Execute Command window are also changed.

If you open the Execute Command window after clicking a menu or button for which event information cannot be inherited, the events to be inherited cannot be displayed. In that case, the Inherit event information check box in the Execute Command window is not selected, and the event information is displayed as a blank.

To Page Top

(4) Preview of the command to be executed

When event information is inherited, the Preview Command Execution Content window is displayed before command execution. The Preview Command Execution Content window displays the contents of the command to be executed after its variables are replaced with event information.

The contents of the command displayed in the Preview Command Execution Content window can be modified, and you can execute the modified command. If the size of the command contents exceeds its upper limit after the variables are replaced with event information, the Preview Command Execution Content window displays the contents from which the excess information was truncated. After a part of the contents are truncated, you can also check the contents before being truncated.

For details about the Preview Command Execution Content window, see 3.41 Preview Command Execution Content window in the manual JP1/Integrated Management 2 - Manager GUI Reference.

Note that the value before the variables are replaced (the value displayed in the Execute Command window) is saved as a history item. The value displayed or edited in the Preview Command Execution Content window is not saved as a history item.

To Page Top