6.8.1 Search method
This subsection explains the method for searching for JP1 events.
When you enable the integrated monitoring database, you can select the search object from the event database and the integrated monitoring database. For details about how to set up the integrated monitoring database, see 1.4.2 Setting up the integrated monitoring database (for Windows) or 2.4.2 Setting up the integrated monitoring database (for UNIX) in the JP1/Integrated Management 2 - Manager Configuration Guide.
- Organization of this subsection
(1) Search procedure
To search for JP1 events:
-
To use the attribute value of a JP1 event displayed in the events list as the search condition, select a JP1 event from the events list in the Event Console window.
-
In the Event Console window, choose View and then Search Events. Alternatively, on the Search Events page of the Event Console window, click the Search Events button.
The Event Search Conditions window opens.
-
In the Event Search Conditions window, specify search conditions.
In the Event Search Conditions window, specify the following items:
-
Specify the search object
When you use the integrated monitoring database, Search object is displayed in the Event Search Conditions window, and you can select either the integrated monitoring database or the event database. If you are not using the integrated monitoring database, the item Search object is not displayed. JP1 events in the event database are searched.
-
Enter the search host
Enter the search object host name (event server name) in Search host.
By default, the name of the connected host is specified.
If you are using the integrated monitoring database and you select the integrated monitoring database in Search object, the item Search host becomes inactive.
The address of the specified host name is resolved inside the manager. Therefore, specify a host name that can be resolved inside the manager.
In an environment protected by a firewall, exercise special care when searching for events using a viewer that is outside the firewall, since a single host IP address might appear differently when seen from outside or inside the firewall. If you use a viewer that is outside the firewall and you specify an IP address to search for events, specify an IP address that can be resolved inside the manager.
Specify an IP address also when you are connecting to an agent that is connected to multiple LANs via an NIC of a host other than the representative host.
-
Specify a search direction
Specify the direction in which to search the integrated monitoring database or the event database.
Specify either Past direction or Future direction as the event search direction. The default is Past direction.
For details, see 6.8.1(2) Event search direction.
-
Specify a condition group
To differentiate between various event search conditions, names are assigned to condition groups.
You can specify multiple condition groups, and condition groups are ORed.
To specify condition groups, you must first click the Show List button to show the List area.
Adding a condition group: Clicking the Add button adds undefined name conditions-group-n (where n is a number).
Copying a condition group: Selecting a condition group and clicking the Copy button adds condition-group-name-selected-for-copying.
Deleting a condition group: Selecting a condition group and clicking the Delete button deletes the selected condition group.
Renaming a condition group: Selecting a condition group displays the name of the selected condition group in Condition group name. Editing this name and moving the focus changes the name of the condition group.
-
Set up a condition (detailed settings of each condition group)
Set up a pass condition or exclusion-condition for the JP1 events to be searched for.
You can set up a condition by combining multiple conditions, and the conditions are ANDed.
The items you can specify differ depending on the specified search item.
If the search object is the event database, the items you can specify are as follows: Event source host name#1, registered host name, event level, object type, object name, root object type, root object name, occurrence, user name, message, product name, event ID, start time, end time, registered time, arrival time, response status, action#2, and program-specific extended attribute.
If the search object is the integrated monitoring database, the items you can specify are as follows: Event source host name#1, registered host name, event level, object type, object name, root object type, root object name, occurrence, user name, message, product name, event ID, start time, end time, registered time, arrival time, response status, action#2, program-specific extended attribute, memo#3, new severity level#4, original severity level#4, new display message#5, changed display message#5, repeated events#6, and suppressed event ID#6.
#1: You can specify this item if source host mapping is enabled.
#2: If linkage with JP1/IM - Rule Operation is enabled, you can specify the action type as a search condition.
#3: You can specify this item if the memo function is enabled.
#4: You can specify this item if the severity changing function is enabled.
#5: You can specify this item if the display message change function is enabled.
#6: You can specify this item if the repeated event monitoring suppression function is enabled.
To commit the attribute value of the JP1 event selected in the Event Console window to the condition list, click the Read From Selected Event button.
If the repeated event monitoring suppression function is enabled, the Read Suppressed Event ID From Selected Event button appears. To apply the suppressed event ID of the repeated event selected in the Event Console window, click the Read Suppressed Event ID From Selected Event button. Because all repeated events consolidated in a single consolidation event have the same suppressed event ID, use this button to filter those repeated events, which have the same suppressed event ID as the selected repeated event.
You can use a regular expression to specify the following: Event source host name, registered host name, object type, object name, root object type, root object name, occurrence, user name, message, product name, program-specific extended attribute, memo, suppressed event ID, and changed display message. For details about using a regular expression to specify search conditions, see 6.8.1(3) Using regular expressions to specify search conditions.
-
-
Click OK.
When the Search Events page opens and the search begins, Searching is displayed on the page tab. Events matching the search condition are sequentially displayed on the Search Events page of the Event Console window as search results.
To cancel the event search, click the Cancel Search button. You can halt the search if you executed an event search with an incorrect search condition, or if you have found the event you wanted to acquire.
(2) Event search direction
By specifying a search direction, you can search a range that satisfies a condition. In the Preferences window, you can change the number of events that can be acquired from a single search. By clicking the Search for Next Event button on the Search Events page of the Event Console window, you can acquire and display the events that could not be acquired in a single search.
When you specify Past direction for the event search direction, a search is executed beginning with the latest JP1 event registered in the integrated monitoring database or the event database (events are acquired from the latest event toward earlier events). When you specify Past direction and execute a search, events are acquired starting with the latest one, and these events are then displayed chronologically (in order of earliest to latest). Clicking the Search for Next Event button displays the next set of events, acquired with the Search for Next Event button, above the events that have already been displayed. Note that events are always displayed chronologically starting with the earlier ones (that is, events acquired earlier are displayed above events acquired later).
When you specify Future direction for the event search direction, a search is executed beginning with the earliest JP1 event registered in the integrated monitoring database or the event database (events are acquired from the earliest event towards later events). When you specify Future direction and execute a search, events are acquired starting with the earliest one. Clicking the Search for Next Event button displays the next set of events, acquired with the Search for Next Event button, below the events that have already been displayed.
See the examples in 6.8.2 Displaying the search results to confirm the behavior of the event search operation.
(3) Using regular expressions to specify search conditions
You can specify a regular expression in the search conditions specified in the Event Search Conditions window. You can specify a regular expression for the following: Event source host name, registered host name, object type, object name, root object type, root object name, occurrence, user name, message, product name, program-specific extended attribute, memo, suppressed event ID, and changed display message.
To specify a regular expression as a search condition in the Event Search Conditions window, specify a regular expression as a search condition in the Conditions text box, and then select Regular expression from the list box on the right side. To specify a regular expression for a program-specific extended attribute, use the Event Search Detailed Conditions (Program-Specific Information in Extended Attribute) window.
The types of regular expressions that can be used depend on the settings of JP1/Base at the search target host. For details, see the description about regular expressions in the chapter on installation and setup in the JP1/Base User's Guide.