11.2.2 Notes on event log trapping
- Organization of this subsection
(1) Notes on operation
The event server settings file (conf) includes the options parameter with KAJP1037-syslogoff and KAJP1037-hntroff by default when JP1/Base V12 is newly installed. However, the parameter is not set properly in the following cases: you restore the definition file from another version where these flags are not set, you install JP1/Base by overwriting another version where these flags are not set, or you delete these flags.This subsection describes notes and solutions for using the action definition file for event log trapping (ntevent.conf) and the forwarding setting file (forward) when KAJP1037-syslogoff and KAJP1037-hntroff are not specified.
Suppose that your system links with IM Configuration Management of JP1/IM or uses the configuration management functionality of JP1/Base, and the ntevent.conf and forward files are used with their initial settings. If forwarding of a JP1 event fails, the error message KAJP1037-E is output to the event log and converted to a JP1 event. The converted JP1 event is then transferred again, and another transfer failure occurs.To prevent the event transfer from looping, change the setting in the action definition file for event log trapping (ntevent.conf), so that the KAJP1037-E message will not be trapped. For details about settings example of ntevent.conf, see Action definition file for event log trapping (Windows only) in 16. Definition Files.
(2) Notes on using JP1/AJS Windows event-log monitoring jobs
If you wish to use a JP1/AJS Windows event-log monitoring job, you must first start the event log trapping service. JP1/AJS Windows event log monitoring jobs are executed under this JP1/Base function.
Set the event log trapping action definition file (ntevent.conf) so that it contains the condition for event monitoring by JP1/AJS. This condition is the logical product of the settings defined in JP1/AJS and the settings defined in the action definition file for event log trapping (ntevent.conf). For details on Windows event log monitoring jobs, see the JP1/Automatic Job Management System 3 System Design (Configuration) Guide, JP1/Automatic Job Management System 3 System Design (Work Tasks) Guide, and the JP1/Automatic Job Management System 3 Administration Guide.
(3) Notes on event logs forwarded from remote hosts
An event log trap cannot properly convert an event log entry generated by a remote machine to a JP1 event. To convert event log entries generated on a remote host, use an event log trap on the machine that generated the entry.
(4) Other notes
-
If the event log trapping functionality reads event log data that contains any of the 3rd or 4th level JIS characters, these characters are replaced with question marks ("?"), and registered as JP1 events.
-
The attribute of a JP1 event converted using the event log trap function has a value that is almost equal to the value displayed in the General tab of Event Viewer. However, the opcode (extended attribute A9) may differ from that displayed in the General tab of Event Viewer.