Hitachi

JP1 Version 12 JP1/Integrated Management 2 - Manager Command, Definition File and API Reference

7.2.1 Event

This section describes json objects for events.

Organization of this subsection

(1) Event information object

Description

An object that contains event information

Format
{
    "sid":"JP1-event-SID",
    "value": [
        "event-attribute-name":"event-attribute-value",...
    ],
    "title": [
        "event-attribute-name":"display-name-of-the-event-attribute",...
    ],
    "type": [
        "event-attribute-name":"type-of-the-event-attribute",...
    ],
    "monitor": [
        information-for-calling-the-monitor-window-of-the-linked-product-that-issued-an-event
    ]
}
Members

The following table describes the members of this object.

Table 7‒13: Members of the event information object

No.

Member

Data type

Description

1

sid

string

Specifies the JP1 event SID that identifies the event uniquely. The format as follows:

_JP1IM_manager-host-name/_JP1IMSEQNO_serial-number-in-the-integrated-monitoring-database/_JP1IMEVBSEQNO_serial-number-in-the-event-database

2

value

Object[]

Returns an array of pairs of event attributes and their values. If an attribute is not contained in the event, a string with the size of 0 bytes is returned as the attribute value.

The format of the list of event attributes and the attribute values returned by the value parameter is equivalent to that of values in the database, except for the time type event attribute#1 and IP-address event attribute#2.

Event attributes of type time are returned in the ISO 8601 extended format (YYYY-MM-DDThh:mm:ssTZD).

When the event search API is run, this member returns event attributes that are specified with the attrs parameter.

When the event detailed information acquisition API is run, this member returns event attributes according to the settings in the definition file for extended event attributes.

3

title

Object[]

Returns the list of event attributes and their display names.

This member is returned when the event detailed information acquisition API is run. For details, see 5.6.2 Event detailed information acquisition.

4

type#3

Object[]

Returns the list of event attribute names and attribute types.

This member is returned when the event detailed information acquisition API is run. For details, see 5.6.2 Event detailed information acquisition.

5

monitor

Object[]

Returns the information for calling the monitor window of the linked product that issued an event, if the event search API or event detailed information acquisition API is executed. For details, see 7.2.1(2) Object of the information for calling the monitor window of the linked product that issued an event.
#1

Time type event attributes are the registered timeframe (B.TIME), arrived timeframe (B.ARRIVEDTIME), start timeframe (E.START_TIME), and end timeframe (E.END_TIME). Those attributes are output in the ISO 8601 extended format (YYYY-MM-DDThh:mm:ssTZD). However, if E.START_TIME and E.END_TIME are non-numeric, less than 0, or equal to or greater than 2,147,483,648, they are output in string format.

#2

The event attribute of IP address type refers to the source IP address (B.SOURCEIPADDR) and the destination IP address (B.DESTIPADDR).

#3

The following table describes the attribute names and values returned by the type member:

No.

type

Description

Event attribute and relevant returned type

1

None

String

The GUI is displayed in single-line text format.

Control characters (such as a line feed code) are replaced with space characters.

Attributes that are not text, html, or date

2

text

String

The GUI is displayed in multi-line text format (with the <pre> tag).

  • Message (B.MESSAGE)

  • Post-change message (E.@JP1IM_DISPLAY_MESSAGE)

  • Memo (E.@JP1IM_MEMO)

  • Guide message in text format (E.@JP1IM_GUIDE)

3

html

HTML document

The GUI is displayed in HTML format (with the <iframe> tag).

  • Guide message in HTML format (E.@JP1IM_GUIDE)

4

date

String in ISO8601 format (2004-04-01T12:00+09:00) converted from date data.

The GUI is displayed after the date is converted into the value in the timezone of the client (through new Date (value)).

Attribute of which either of the following is defined by the attr statement of the definition file for extended event attributes:

  • type="elapsed_time/date_format:CLIENT"

  • "elapsed_time_in_milli/date_format:CLIENT"

In a JP1/IM event, it corresponds to the following attributes:

  • Registered timeframe (B.TIME)

  • Arrived timeframe (B.ARRIVEDTIME)

  • Start timeframe (E.START_TIME)

  • End timeframe (E.END_TIME)

For details on the definition file for extended event attributes, see Definition file for extended event attributes in Chapter 2. Definition Files.

Important

In the REST API, the event attribute of a guide message is returned as an IM attribute (E.@JP1IM_GUIDE). The display name is shown as "ガイド" in Japanese and as Guide in English.

Event attributes of the consolidation start event

If the consolidateEvent request parameter of the event search API is set to true, the event attributes shown in the table below are set for the consolidation start event. They are not set for any event other than the consolidation start event. In addition, the event attributes of the consolidation start event are not output by the jcoevtreport command.

Table 7‒14: Event attributes of the consolidation start event

No.

Attribute

Description

1

E.@JP1IM_CONSOLIDATION

Indicates whether the event is the consolidation start event.

  • 1: consolidation start event

2

E.@JP1IM_CONSOLIDATION_STATUS

Indicates the status of the consolidation start event.

  • 10: Normal/Resolved

  • 20: Warning/Notice/Information/Debug

  • 30: Error

  • 40: Emergency/Alert/Critical

3

E.@JP1IM_CONSOLIDATION_SEVERE_MIXED

Indicates whether the consolidation event contains a mix of severe and non-severe events.

  • 0: Not mixed

  • 1: Mixed

4

E.@JP1IM_CONSOLIDATION_DEALT_MIXED

Indicates whether event statuses of the consolidation event are mixed.

  • 0: Not mixed

  • 1: Mixed

5

E.@JP1IM_CONSOLIDATION_ACTCONTROL_MIXED

Indicates whether statuses of automatic actions of the consolidation event are mixed.

  • 0: Not mixed

  • 1: Mixed

To Page Top

(2) Object of the information for calling the monitor window of the linked product that issued an event

Description

Is an object that represents the information for calling the monitor window of the linked product.

Format
{
   "url":"URL-of-the-window-of-the-linked-product"
}
Members

The following table describes the members of this object.

Table 7‒15: Member of the object of the information for calling the monitor window of the linked product that issued an event

No.

Member

Data type

Description

1

url

string

URL of the window of the linked product

To Page Top

(3) Event search condition object

Description

This object contains event search conditions. An event is determined to match an event search condition object if the event does not match any of the exclusion condition groups and matches at least one of the pass condition groups.

Format
{
   "include":[pass-condition-group,...],
   "exclude":[exclusion-condition-group,...]
}
Format of a pass or exclusion condition group

Specify an array of a pass or exclusion condition group. Specified event conditions are joined with the AND operator.

[
{ "key":"event-attribute-name","ope":"comparison-condition","val":"operand" },...
]
Members

The following table describes the members of this object.

Table 7‒16: Members of the event search condition object

No.

Member

Data type

Description

1

include

Object[]

Specify 0 to 5 pass condition groups for event search.

A pass condition group can contain 0 to 50 event conditions. For event conditions for extended attributes (specific information), a pass condition group can contain up to 5 conditions.

2

exclude

Object[]

Specify 0 to 5 exclusion condition groups for event search.

An exclusion condition group can contain 0 to 50 event conditions. For event conditions for extended attributes (specific information), an exclusion condition group can contain up to 5 conditions.

3

key

string

Specify the name of an event attribute that you want to compare. To specify a basic attribute, prefix the name with B.. To specify an extended attribute (common information or specific information), prefix the name with E.. This member is case-sensitive.

For the event attributes that are specifiable, see the Attribute column in Table 7-16 Combination of acceptble attribute names and comparison keywords.

4

ope

string

Specify a comparison operator for the event attribute specified with key. As a comparison operator, you can specify one of the following values: BEGIN (begins with), IN (matches), NOTIN (does not match), SUBSTR (includes), NOTSUBSTR (does not include), REGEX (regular expression), and TRANGE (date and time). This member is case-sensitive.

The comparison conditions that can be specified for each event attribute are the same as those in the Acceptable comparison keyword column in Table 7-16 Combination of specifiable attribute names and comparison keywords.

For details on the comparison conditions for the time type event attributes#, see Table 7-17 Comparison conditions for time type event attributes and Table 7-18 List of time type event attributes.

5

val

The value depends on key.

Specify a value (operand) to be compared against the value of the event attribute specified with key.

This member is case-sensitive. When multiple operands are allowed, specify them as an array of operands. When multiple operands are specified, the OR condition is used. However, when a regular expression is specified as a comparison keyword, the specification of multiple operands is not allowed.

Even if the operand accepts multiple specifications, an empty array or an array with null specified for an element cannot be specified.

When a half-width space character, a tab character, a line feed/carriage return character (CR or LF), or a percent sign (%) is used to specify an operand, it must be written as follows:

  • Half-width space character (0x20): %20

  • Tab character (0x09): %09

  • Line feed code (LF) (0x0a): %0a

  • Carriage return code (CR) (0x0d): %0d

  • Percent sign (%) (0x25): %25

You can specify a maximum of 4,096 bytes of operands per event condition and per event condition block (total length in bytes of all operands that are specified in the event condition block).

The comparison values (operands) that can be specified for each event attribute are the same as those in the Operand column in Table 7-16 Combination of acceptble attribute names and comparison keywords.

Specify an array of operands if multiple operands are allowed.
#

Time type event attributes are the registered timeframe (B.TIME), arrived timeframe (B.ARRIVEDTIME), start timeframe (E.START_TIME), and end timeframe (E.END_TIME).

Table 7‒17: Combination of acceptable attribute names and comparison keywords

No.

Type

Attribute

Data type

Acceptable comparison keyword

Operand

1

Basic attribute

Event ID

(B.ID)

Numeric

  • Match

  • Does not match

Multiple values are allowed. The maximum number of values you can specify is 100.

Values must be specified in hexadecimal notation. The letters are case insensitive. However, letters in a regular expression are case sensitive.

The acceptable range is from 0 to 7FFFFFFF.

2

Registered reason

(B.REASON)

Numeric

  • Match

  • Does not match

Multiple values are allowed. The maximum number of values you can specify is 100.

3

Source process ID

(B.PROCESSID)

Numeric

  • Match

  • Does not match

Multiple values are allowed. The maximum number of values you can specify is 100.

The acceptable range is from -2147483648 to 2147483647.

4

Source user ID

(B.USERID)

Numeric

  • Match

  • Does not match

Multiple values are allowed. The maximum number of values you can specify is 100.

The acceptable range is from -2147483648 to 2147483647.

5

Source group ID

(B.GROUPID)

Numeric

6

Source user name

(B.USERNAME)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

7

Source group name

(B.GROUPNAME)

String

8

Source event server name

(B.SOURCESERVER)

String

9

Destination event server name

(B.DESTSERVER)

String

10

Message

(B.MESSAGE)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

11

Registered timeframe

(B.TIME)

Time

  • Time

Specify the start date and time and end date and time of a period.

A match occurs if the start data and time <= time <= end date and time is true.

12

Arrived timeframe

(B.ARRIVEDTIME)

Time

  • Time

13

Extended attribute (common information)

Event level

(E.SEVERITY)

String

  • Match

Multiple values are allowed. Note that one level can be specified only once.

Acceptable values: Emergency, Alert, Critical, Error, Warning, Notice, Information, and Debug.

14

User name

(E.USER_NAME)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

15

Product name

(E.PRODUCT_NAME)

String

16

Object type

(E.OBJECT_TYPE)

String

17

Object name

(E.OBJECT_NAME)

String

18

Root object type

(E.ROOT_OBJECT_TYPE)

String

19

Root object name

(E.ROOT_OBJECT_NAME)

String

20

Object ID

(E.OBJECT_ID)

String

21

Occurrence

(E.OCCURRENCE)

String

22

Start timeframe

(E.START_TIME)

String

  • Time

Specify the start date and time and end date and time of a period.

A match occurs if the start data and time <= time <= end date and time is true.

23

End time

(E.END_TIME)

String

  • Time

24

Result code

(E.RESULT_CODE)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

25

Event source host name

(E.JP1_SOURCEHOST)

String

26

Extended attribute (specific information)

E.*attribute

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

An attribute name must begin with an uppercase alphabetical letter and be composed of uppercase alphabetical letters, numbers, and underscores (_). The maximum length is 32 bytes.

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

27

IM attribute

Action type

(E.@JP1IM_ACTTYPE)

Numeric

  • Match

  • Does not match

  • The following numeric values can be specified:

    0: Not subject to an action

    1: Command

    2: Rule

    3: Command and rule

  • Multiple values are allowed.

28

Action suppression

(E.@JP1IM_ACTCONTROL)

Numeric

  • The following numeric values can be specified:

    0: Not subject to an action

    1: Execution

    2: Suppression

    3: Partial suppression

  • Multiple values are allowed.

29

Severe event

(E.@JP1IM_SEVERE)

Numeric

  • The following numeric values can be specified:

    0: Not a severe event

    1: Severe event

  • Multiple values are allowed.

30

Correlation event

(E.@JP1IM_CORRELATE)

Numeric

  • The following numeric values can be specified:

    0: Not a correlation event

    1: Correlation approval event

    2: Correlation failure event

  • Multiple values are allowed.

31

Response-waiting event

(E.@JP1IM_RESPONSE)

Numeric

  • The following numeric values can be specified:

    0: Not a response waiting event

    1: Response waiting event

  • Multiple values are allowed.

32

Original severity level

(E.@JP1IM_ORIGINAL_SEVERITY)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. However, if a regular expression is used, only one value is allowed.

33

New severity level

(E.@JP1IM_CHANGE_SEVERITY)

Numeric

  • Match

  • Does not match

  • The following numeric values can be specified:

    0: No new severity level exists

    1: New severity level exists

  • Multiple values are allowed.

34

Event status

(E.@JP1IM_DEALT)

Numeric

  • The following numeric values can be specified:

    0: Unprocessed

    1: Processed

    2: Processing

    3: Held

  • Multiple values are allowed.

35

Severe event released

(E.@JP1IM_RELEASE)

Numeric

  • The following numeric values can be specified:

    0: No severe events are released

    1: Severe events are released

  • Multiple values are allowed.

36

Severe event deleted

(E.@JP1IM_DISMISSED)

Numeric

  • The following numeric values can be specified:

    0: No severe events are deleted

    1: Severe events are deleted

  • Multiple values are allowed.

37

Memo

(E.@JP1IM_MEMO)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

38

Changed display message (E.@JP1IM_DISPLAY_MESSAGE)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

39

New display message (E.@JP1IM_CHANGE_MESSAGE)

Numeric

  • Match

  • Does not match

The acceptable range is from -2147483648 to 2147483647.

40

Display message change definition name (E.@JP1IM_CHANGE_MESSAGE_NAME)

String

  • First characters

  • Match

  • Does not match

  • Is contained

  • Is not contained

  • Regular expression

Multiple values are allowed. The maximum number of values you can specify is 100. For Regular expression, however, only one regular expression is allowed.

Legend:

None: Cannot be compared.

--: N/A

Table 7‒18: Comparison conditions for time type event attributes

No.

Comparison keyword

Data type

Description

1

Time

(TRANGE)

Specify the start date and time and end date and time.

A JP1 event attribute (time type) is determined to satisfy an event condition when the attribute value falls in a range specified with the operands (start date and time and end date and time).

The operands must be specified in the ISO 8601 extended format.

Time range to be specified

Start date and time <= Attribute value <= End date and time

Time format

YYYY-MM-DDThh:mm:ssTZD

Example

To specify a range from March 1 to March 31, 2018:

{"key":"B.TIME","ope":"TRANGE","val": ["2018-03-01T00:00:00+09:00", "2018-03-31T00:00:00+09:00"]}
Table 7‒19: List of time type event attributes

No.

Type

Attribute

Data type

Acceptable comparison keyword

Operand

1

Basic attribute

Registered timeframe

(B.TIME)

Time

Time

The operand can be specified in the same way as shown in Table 7-17 Comparison conditions for time type event attributes.

2

Arrived timeframe

(B.ARRIVEDTIME)

Time

Time

3

Extended attribute

Start timeframe

(E.START_TIME)

Time

Time

4

End timeframe

(E.END_TIME)

Time

To Page Top

Copyright (C) 2019, 2021, Hitachi, Ltd.

Copyright (C) 2019, 2021, Hitachi Solutions, Ltd.