Event-source-host mapping definition file (user_hostmap.conf)

Organization of this page

Format
File
Storage directory
Description
When the definitions are applied
Information that is specified
Example definition

Format

[DESC_VERSION=version-information]
#Comment
def definition-name-1
    cnd
        event-condition
    end-cnd
    source_attr attribute-name
end-def
def definition-name-2
    cnd
        event-condition
    end-cnd
    source_attr attribute-name
end-def

To Page Top

File

user_hostmap.conf (Event-source-host mapping definition file)

user_hostmap.conf.model (model file for the event-source-host mapping definition file)

To Page Top

Storage directory

In Windows

For a physical host:: Console-path\conf\hostmap\
For a logical host:: shared-folder\jp1cons\conf\hostmap\

In UNIX

For a physical host:: /etc/opt/jp1cons/conf/hostmap/
For a logical host:: shared-directory/jp1cons/conf/hostmap/

To Page Top

Description

This file defines the conditions and the mapping source for a JP1 event to which the event source host is mapped by using the event source host mapping function. The maximum size of the event-source-host mapping definition file is 17 megabytes.

The event source host mapping function maps the event source host for the JP1 event that matches the event condition according to the definition in this file.

To Page Top

When the definitions are applied

The definition takes effect when the event source host mapping function is enabled and either of the following conditions is satisfied:

JP1/IM is running
The jco_spmd_reload command is executed

To Page Top

Information that is specified

DESC_VERSION=version-information

Specify 1, which is the file version of the event-source-host mapping definition file. Specify DESC_VERSION on the first line of the definition file (the first line in the file that is not a null line or a comment line). If there is no file version on the first line, 1 is assumed as the file version.

# comment

Provides an explanation of the event-source-host mapping definition file.

def to end-def

These parameters mark the start and end of the mapping definition block. The block from def to end-def can be omitted.

After def comes the definition name of the event source host mapping definition. If you specify defΔdefinition-1Δdefinition-2Δ, then Δdefinition-1Δdefinition-2Δ are treated as the definition names (Δ indicates a single-byte space).

Each definition name must be unique within the event-source-host mapping definition file. The length of a character string is from 1 to 50 bytes.

Permitted characters are all characters other than control characters.

The control characters are ASCII 0x00 to 0x1F and 0x7F to 0x9F.

cnd to end-cnd

These parameters mark the start and the end of the block that specifies conditions for the JP1 events to be mapped. You must specify one event condition block in a mapping definition block. The event condition block cannot be omitted. If a received JP1 event satisfies multiple event conditions, the definition block closest to the beginning of the event-source-host mapping definition file takes precedence. Tabs and spaces before and after the cnd and end-cnd parameters are ignored.

event-condition

Specifies conditions for the JP1 event to be mapped. You can specify from 1 to 256 event conditions for each event condition block. Event conditions are connected with the AND condition. Specify an event condition in the following format:

attribute-name comparison-keyword operand

attribute-name

Specifies the name of the attribute you want to compare. To specify a basic attribute, prefix the name with B.. To specify an extended attribute (common information or user-specific information), prefix the name with E.. The attribute name is case sensitive.

The following table lists and describes the combinations of attribute names and comparison keywords and the operands that can be specified.

Table 2‒6: Combinations of attribute names and comparison keywords and the operands that can be specified
No.	Item	Attribute name	Comparison keyword	Operand
1	Event ID	`B.ID`	`Match` `Do not match`	A maximum of 100 event IDs can be specified. Specify event IDs in hexadecimal notation. Event IDs are not case sensitive. The permitted range is from `0` to `7FFFFFFF`.
2	Reason for registration	`B.REASON`	`Match` `Do not match`	A maximum of 100 reasons can be specified.
3	Source process ID	`B.PROCESSID`	`Match` `Do not match`	A maximum of 100 source process IDs can be specified. The permitted range is from `-2,147,483,648` to `2,147,483,647`.
4	Source user ID	`B.USERID`	`Match` `Do not match`	A maximum of 100 source user IDs can be specified. The permitted range is from -2,147,483,648 to 2,147,483,647.
5	Source group ID	`B.GROUPID`	`Match` `Do not match`	A maximum of 100 source group IDs can be specified. The permitted range is from -2,147,483,648 to 2,147,483,647.
6	Source user name	`B.USERNAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 source user names can be specified. However, if a regular expression is used, only one source user name is allowed.
7	Source group name	`B.GROUPNAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 source group names can be specified. However, if a regular expression is used, only one source group name is allowed.
8	Event-issuing server name (source host)^#	`B.SOURCESERVER`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 event-issuing server names can be specified. However, if a regular expression is used, only one event-issuing server name is allowed.
9	Target event server name^#	`B.DESTSERVER`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 target event server names can be specified. However, if a regular expression is used, only one target event server name is allowed.
10	Message	`B.MESSAGE`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 messages can be specified. However, if a regular expression is used, only one message is allowed.
11	Event level	`E.SEVERITY`	`Match`	Multiple event levels can be specified. If multiple event levels are specified, the same event level cannot be specified twice. However, if a regular expression is used, only one event level is allowed. The following values can be specified: `Emergency`, `Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, or `Debug`
12	User name	`E.USER_NAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 user names can be specified. However, if a regular expression is used, only one user name is allowed.
13	Product name	`E.PRODUCT_NAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 product names can be specified. However, if a regular expression is used, only one product name is allowed.
14	Object type	`E.OBJECT_TYPE`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 object types can be specified. However, if a regular expression is used, only one object type is allowed.
15	Object name	`E.OBJECT_NAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 object names can be specified. However, if a regular expression is used, only one object name is allowed.
16	Root object type	`E.ROOT_OBJECT_TYPE`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 root object types can be specified. However, if a regular expression is used, only one root object type is allowed.
17	Root object name	`E.ROOT_OBJECT_NAME`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 root object names can be specified. However, if a regular expression is used, only one root object name is allowed.
18	Object ID	`E.OBJECT_ID`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 object IDs can be specified. However, if a regular expression is used, only one object ID is allowed.
19	Occurrence	`E.OCCURRENCE`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 occurrences can be specified. However, if a regular expression is used, only one occurrence is allowed.
20	Return code	`E.RESULT_CODE`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	A maximum of 100 return codes can be specified. However, if a regular expression is used, only one return code is allowed.
21	Program-specific extended attribute	`E.xxxxxxx`	`First characters` `Match` `Do not match` `Is contained` `Is not contained` `Regular expression`	For the attribute name, you can specify a character string with a maximum of 32 bytes that begins with an uppercase letter and consists of uppercase letters, numeric characters, and the underscore (`_`). A maximum of 100 program-specific extended attributes can be specified. However, if a regular expression is used, only one program-specific extended attribute is allowed.

#

If the integrated monitoring database and the IM Configuration Management database are enabled, and the comparison keyword is Match or Do not match, the business group name can be specified in a path format.

If the integrated monitoring database and the IM Configuration Management database are disabled, and a comparison keyword other than Match or Do not match is selected, a business group name specified in a path format is treated as a host name.

If the -ignorecasehost option of the jcoimdef command is set to ON and a comparison keyword other than Regular expression is selected, the character string is no longer case sensitive.

comparison-keyword

Specifies BEGIN (begins with), IN (matches), NOTIN (does not match), SUBSTR (includes), NOTSUBSTR (does not include), or REGEX (regular expression) as the comparison keyword. The comparison keyword is case sensitive.

operand

Specifies a character string as the value that is to be compared with the attribute value specified for the comparison keyword. The operand is case sensitive.

If you specify two or more operands, separate them by one or more consecutive spaces or tabs. The OR condition is applied to the specified operands. Note that if a regular expression is specified, only one operand is allowed.

If you want to a space or a tab as part of an operand, use the format shown in the following table.

No.	Value to be specified	How to specify
1	Tab (`0x09`)	`%09`
2	Space (`0x20`)	`%20`
3	`%` (`0x25`)	`%25`
4	CR (`0x0d`)	`%0d`
5	LF (`0x0a`)	`%0a`

During maximum value checking of the definition format, %20 and %25 are each treated as a single character. The following shows an example of defining ID matches 100 and 200, which selects multiple operands:

B.IDΔINΔ100Δ200

Legend: Δ indicates a single-byte space (0x20)

You can specify a maximum of 4,096 bytes of operands per event condition and per event condition block (total length in bytes of all operands that are specified in the event condition block).

source_attr

Specifies the attribute value of the mapping source. For source_attr, you can specify a value that stores the event source host name. This parameter cannot be omitted. Specify the source_attr in the following format:

source_attr mapping-source-attribute-value

You can specify an attribute name or a variable name for the mapping source attribute value. If you specify an attribute name, all information related to the attribute value is stored. If you specify a variable name, part of an attribute value is extracted (partial extraction) and stored.

The attribute you can specify for the mapping source attribute value is an extended attribute (program-specific information). Extended attributes (program-specific information) are attributes that are not included in the common information described in Table 3-2 List of common information provided by extended attributes. You can specify $EVENV1 to $EVENV9 for the variable name.

To Page Top

Example definition

The following example shows how to set the host name (AGENT_A) contained in a message as the event source host name when the event ID is 100, the event level is Warning, and the message is An error with error code 1111 occurred on the AGENT_A host. (where AGENT_A is a host name):

DESC_VERSION=1
#Maps the host name in the message to the event source host name.
def event-source-host-mapping-1
    cnd
        B.ID IN 100
        E.SEVERITY IN Warning
        B.MESSAGE REGEX An error occurred on the host ([a-zA-Z0-9\-_]+) with error code 1111.
    end-cnd
    source_attr $EVENV1
end-def

To Page Top