11.2.1 Procedures for setting up event log trapping

(1) Starting the event log trapping function

The following describes the procedure for starting the event log trapping function:

To change the settings:

1. Edit the action definition file for event log trapping (ntevent.conf).

2. Start the event-log trapping service.

   From the Control Panel, open the Services dialog box and start the JP1/Base EventlogTrap service.

Notes

• If the event server is inactive and no connection retry setting has been entered in the action definition file, the server will fail to start.

• If no action definition file for event log trapping (ntevent.conf) exists, or if the file is invalid, the service will fail to start and this information will be output to the event log and integrated trace log.

• By default, if an invalid log type or a malformed regular expression is specified in a filter in the action definition file for event log trapping (ntevent.conf), that filter is deemed invalid but the service will start and reload settings successfully. Alternatively, you can specify that service startup and reloading of settings should fail when a filter condition is invalid. For details, see the filter-check-level parameter of Action definition file for event log trapping (Windows only) in 16. Definition Files.

• Event log entries are monitored starting from the time the trapping service starts. Entries before the service starts cannot be monitored.

• When restarting the Windows event log service, also restart the event log trap service.

To Page Top

(2) Changing a setting while a trap is active

To change the settings:

1. Edit the action definition file for event log trapping (ntevent.conf).

2. Apply the settings.

   If you changed the server parameter:

   Restart the event-log trapping service.

   If you changed a parameter other than server:

   Do not stop the event-log trapping service. Instead, execute the jeveltreload command to apply the changes.

To Page Top

(3) Check the settings

To check the action definition information of the active event log trap, execute the following command. The execution result will be displayed on screen in the format of the action definition file for log file trapping (ntevent.conf).

jbsgetopinfo -o evttrap

For details on the jbsgetopinfo command, see jbsgetopinfo in 15. Commands.

To Page Top

(4) Stopping the event log trapping function

To stop event log trapping, stop the event-log trapping service. From the Control Panel, open the Services dialog box and stop the JP1/Base EventlogTrap service.

Notes

When the OS is shut down, the Windows event log service sometimes stops before the event log trapping function of JP1/Base. If this happens, conversion of the data received by the event log trapping function might fail, and the event log might either be converted to a JP1 event when it should not be, or not converted to a JP1 event when it should be. This problem does not occur if the event log trapping service is stopped before the OS is shut down.

To Page Top

(5) Starting the event log trapping function automatically

Upon restarting the system, active event log traps stop and are not restarted automatically. If you want to start an event log trap automatically after the system is restarted, use the JP1/Base startup control to automatically start event log trapping.

In the start sequence definition file (JP1SVPRM.DAT), delete the hash mark (#) at the beginning of the following parameter lines:

#[Jp1BaseEventlogTrap]
#Name=JP1/BaseEventlogTrap
#ServiceName=JP1_Base_EventlogTrap

For details on the start sequence definition file, see Start sequence definition file (Windows only) in 16. Definition Files.

To Page Top