4.15.2 Saving event information in the integrated monitoring database (CSV report)

The functionality for outputting event information from the integrated monitoring database is referred to as output of an event report.

Using this feature in JP1/IM, you can save information about the JP1 events registered in the integrated monitoring database as a CSV-formatted report. To output an event report, execute the jcoevtreport command. As a command option, you can specify what event information to output.

For the command syntax, see jcoevtreport in Chapter 1. Commands in the manual JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.

The following describes the range of information you can output in an event report, and the output format, items, and command options.

Organization of this subsection

(1) Information that can be output to an event report
(2) Image and format of an event report
(3) Items output to an event report
(4) Command options

(1) Information that can be output to an event report

You can output the following event information to an event report:

Time-specified event information

You can specify the arrival time of the JP1 events to be output.
Program-specific event information

You can specify particular items of program-specific information. If you do not specify any items, all items are output.
Information about events that match a filter condition

You can limit the JP1 events to be output using pass conditions or exclusion-conditions in a filter. For the items you can specify in a filter condition, see Table 4-22 Contents output to an event report.

You can specify a maximum of 50 filter conditions in one pass condition group or one exclusion-condition group. In a filter for extended attributes (program-specific information), however, you can specify a maximum of five filter conditions in one pass condition group or one exclusion-condition group.

To Page Top

(2) Image and format of an event report

If you specify the header option during CSV output, CSV header items are output to line 1, separated by commas.

In line 2 and subsequent lines, event information is output in the following order, separated by commas:

basic-attribute, extended-attributes-(common-information), IM-attributes, extended-attribute (program-specific-information)

For the extended attributes (program-specific information), the output format depends on whether program-specific extended attributes are defined in the definition file for extended event attributes (extended file).

[Figure]

If some of the program-specific extended attributes are defined in the definition file for extended event attributes (extended file) and some are not, the defined program-specific extended attributes are output first, and then the undefined program-specific extended attributes are output.

When multiple program-specific extended attributes are defined in the definition file for extended event attributes (extended file), the attributes are output in the order they are defined.

If you specify program-specific extended attributes in the environment definition file for event report output (evtreport.conf), the program-specific extended attributes defined in the definition file for extended event attributes (extended file) are output in the same format as for the program-specific extended attributes that are not defined in the definition file for extended event attributes (extended file).

If you do not specify program-specific extended attributes for items that are to be output to event reports, the number of program-specific extended attributes appears as 0, and the attribute name and value are blank (nothing is entered).

To Page Top

(3) Items output to an event report

When you specify the header option, header information for the attribute name or item name is output to line 1 of the CSV file. For the extended attributes (program-specific information) defined in the definition file for extended event attributes (extended file), the defined item names are output as headers.

By default, no headers are output.

Table 4‒22: Contents output to an event report
Attribute type	Item	Header information
Basic attribute	Serial number	The character string displayed in the window is output.
	Event ID	The character string displayed in the window is output.
	Source process ID	The character string displayed in the window is output.
	Registered time	Output in the following format: When the attribute value is the cumulative number of seconds from 1970/01/01 00:00:00 (GMT): The time is output in one of the following two formats according to the specification of the `-t` option of the `jcoevtreport` command: - When `ON` is specified in the `-t` option: Format `YYYYMMDDhhmmss` in the time zone of the `jcoevtreport` command. - When `OFF` is specified in the `-t` option: Cumulative number of seconds from 1970/01/01 00:00:00 (GMT) When the attribute value is other than the above: The character string set as the attribute value is output.
	Arrived time
	Registered reason	Output in decimal format.
	Source user ID
	Source group ID
	Source user name	Output as a character string.
	Source group name
	Source host
	Destination event server name
	Source IP address	The IP address is output as a character string.
	Destination IP address	The IP address is output as a character string.
	Source serial number	The character string displayed in the window is output.
	Code set	Output as a character string.
	Message	The character strings displayed in the window are output.
Extended attribute (common information)	Event level	The character string is converted and output as follows: Emergency -> `Emergency` Alert -> `Alert` Critical -> `Critical` Error -> `Error` Warning -> `Warning` Normal -> `Normal` Information -> `Information` Debug -> `Debug` For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output.
	User name	The character string displayed in the window is output.
	Product name
	Object type
	Object name
	Root object type
	Root object name
	Object ID	Output as a character string.
	Occurrence	The character string displayed in the window is output.
	Start time	Output in either of the following formats: `YYYYMMDDhhmmss` Cumulative seconds from 1970/01/01 00:00:00 (GMT)
	End time
	Result code	Output as a character string.
	Event source host name	Output as a character string.
IM attributes	Action type	The icons in the window are converted into character strings and output as follows: -> `Command` -> `Rule` -> Command (no icon) -> blank
	Action	The icons in the window are converted into character strings and output as follows: -> `Execute` -> `Partially` `suppress` -> `Suppress` -> `Repeated` `event` (no icon) -> (blank)
	Severe event	Either of the following is output: If the JP1 event is not severe: Blank If the JP1 event is severe: `Severe` `Event`
	Correlation event	The icons in the window are converted into character strings and output as follows: -> `Complete-correlations` `event` -> `Incomplete-correlations` `event` (no icon) -> (blank)
	Original severity level	The icon is converted and output as follows: Emergency -> `Emergency` Alert -> `Alert` Critical -> `Critical` Error -> `Error` Warning -> `Warning` Normal -> `Normal` Information -> `Information` Debug -> `Debug` For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output.
	New severity level	The icon in the window is converted and output as follows: -> `Changed` (no icon) -> (blank)
	Response status	The icons in the window are converted into character strings and output as follows: -> `Processed` -> `Processing` -> `Held` (no icon) -> `Unprocessed`
	Severe event release	The following character string is output: If the severe event has not been released: Blank If the severe event has been released: `Released`
	Severe event deletion	The following character string is output: If the severe event has not been deleted: Blank If the severe event has been deleted: `Delete`
	Memo	The character strings displayed in the window are output.
	Message (after change)	The character strings displayed in the window are output as is.
	Display message change	The icons in the window are converted into character strings and output as follows: `->` Changed (no icon) `->` (blank)
	Display message change definition	The character strings displayed in the window are output as is.
	Response-waiting event	The icon in the window is converted and output as follows: `->` Response-waiting event (no icon) `->` (blank)
Extended attribute reserved by the system (program-specific information)	Relation Event serial number (`E.JP1_GENERATE_SOURCE_SEQNO`)	The serial numbers of relation events are listed in the following format, separated with spaces (Δ): `serial-number-1`Δ`serial-number-2`Δ...Δ`serial-number-n` (`n` is a number between 1 and 100)
	Correlation event generation condition name (`E.JP1_GENERATE_NAME`)	Output as a character string. This item is the name of a correlation event generation condition that is satisfied.
	Suppressed event ID (`E.JP1_IMSUPPRESS_ID`)	Output as a character string. This item is output when the repeated-event monitoring suppression function is used. This item is the serial number (unique number in the event database) of a repeated event that occurs more frequently than the threshold.
	Repeated event condition name (`E.JP1_IMSUPPRESS_NAME`)	Output as a character string. This item is output when the repeated-event monitoring suppression function is used. This item is the name of a repeated event condition that determined that the event was a repeated-event.
	Monitoring ID (`E.JP1_TRAP_ID`)	Output as a character string. This item is the log file trap ID.
	Monitoring target name (`E.JP1_TRAP_NAME`)	Output as a character string. This item is the log file trap name.
	Common exclude conditions group ID (`E.JP1_IMCOMEXCLUDE_ID`)	Output as a character string. This item is the ID of the common exclusion-conditions group that caused the exclusion.
	Common exclude conditions group name (`E.JP1_IMCOMEXCLUDE_NAME`)	Output as a character string. This item is the condition name of the common exclusion-conditions group that caused the exclusion.
	Common exclude conditions group target-for-exclusion (`E.JP1_IMCOMEXCLUDE_TARGET`)	Output the following character string indicating the exclusion target of common exclusion-conditions: When an event is excluded from automated-action execution -> `action`
Extended attribute (program-specific information)	`E.xxxxxxx`	Output as a character string.
	Number of program-specific extended attributes	The total number of program-specific extended attributes that are not specified in the definition file for extended event attributes (extended file) will be output.
	Program-specific extended attribute	All names and values of program-specific extended attributes that are not specified in the definition file for extended event attributes (extended file) are output.

To Page Top

(4) Command options

You can specify the following options in the jcoevtreport command to output maintenance information and to save the event report:

Export maintenance information

jcoevtreport -sys -s 20090101000000 -e 20090103000000 (This example outputs JP1 events that were registered in the integrated monitoring database between 2009/01/01 00:00:00 and 2009/01/03 00:00:00.)
Save events before deletion

jcoevtreport -save

These two options are explained next.

(a) Export maintenance information

When an error occurs in the integrated monitoring database, this option outputs information about all JP1 events registered between the output start time and end time to the event report.

The attribute name appears in the header part.

Because the purpose is to collect data for investigating a database error, you cannot specify what items to output or any filtering conditions.

(b) Save events before deletion

This option outputs an event report about JP1 events due for deletion to free up space in the integrated monitoring database.

With this option specified, the command outputs in CSV format all the JP1 events registered in the integrated monitoring database that have not previously been saved to an event report.

■ Warning before deletion of unsaved JP1 events

You can issue a deletion warning event (event ID: 3F52) when the ratio of JP1 events in the integrated monitoring database that have not been output to an event report (relative to the maximum number of entries in the database) exceeds a set threshold for issuing a deletion warning event (by default, when the unsaved data exceeds 80% of the database capacity).

Specify the ratio of unsaved JP1 events in the -dbntcpos option of the jcoimdef command.

Specify the threshold for issuing a deletion warning event in the -dbntc option of the jcoimdef command.

For details, see jcoimdef in Chapter 1. Commands in the manual JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.

■ Display information about saving events before deletion in the standard output

You can specify an option to display information about saving events due for deletion. Set the -showsv option of the jcoevtreport command to display this information in the standard output.

This option lets you see how much free space will be required to save the events, and helps you adjust the timing for outputting an event report before the target events are deleted.

With this option specified, the following items can be displayed in the standard output:

Ratio of JP1 events that have not been output to an event report (relative to the maximum number of entries in the integrated monitoring database)

The ratio of JP1 events in the integrated monitoring database that have not been output to an event report is shown as a percentage.
Data size of the JP1 events that have not been output to an event report

The data size of the JP1 events in the integrated monitoring database that have not been output to an event report is shown in megabytes.
Threshold for issuing a deletion warning event

If issue of a deletion warning event is specified, the threshold is shown as a percentage. If you specify OFF in the jcoimdef command's -dbntc option, a hyphen (-) is shown.

To Page Top