6.3.4 Inherited event information

When defining an automated action, by using a variable you can specify information about the JP1 event that triggers the action as inherited event information. Inherited event information can be specified for the following items:

Target host
Execution user name
Environment variable file
Action

JP1 event attribute values are inherited to automated actions when those values are handed from the event base service to the automatic action service.

The following table lists the inherited event information you can specify.

Table 6‒7: Variables that can be specified in an action definition
Attribute	Variable name	Inherited event information
Basic attribute	`EVBASE`	Basic event information
	`EVID`	Event ID (`basic-code:extended-code`) Event ID as a character string in the format `basic-code:extended-code`.
	`EVIDBASE`	Event ID (`basic-code`) Event ID as a character string in the format `basic-code`.
	`EVDATE`	Date when the event was registered (`YYYY/MM/DD`) Registered time as a character string in the format `YYYY/MM/DD`.
	`EVTIME`	Time when the event was registered (`hh:mm:ss`) Registered time as a character string in the format `hh:mm:ss`.
	`EVPID`	ID of the process that issued the event Value of the source process ID.
	`EVUSRID`	User ID of the process that issued the event Value of the source user ID.
	`EVGRPID`	Group ID of the process that issued the event Value of the source group ID.
	`EVUSR`	User name of the process that issued the event Value of the source user name.
	`EVGRP`	Group name of the process that issued the event Value of the source group name.
	`EVHOST`	Host name of the server that issued the event Value that depends on the `HOSTINEVENT` parameter value in the automated action environment definition file: - `remote`: Name of the server that issued the event - `local`: Host name obtained from the IP address of the server that issued the event
	`EVIPADDR`	IP address of the server that issued the event Character string indicating the source IP address in IPv4 address format or IPv6 address format. <IPv4 address format> In this format, each 8 bits of a 32-bit address is delimited by periods (`.`), and is output as decimal numbers (from 0 to 255). Example: 0.64.128.255 <IPv6 address format> In this format, each 16 bits of a128-bit address is delimited by colons (`:`), and is output as hexadecimal numbers (from 0000 to ffff). Example: 0011:2233:4455:6677:8899:aabb:ccdd:eeff
	`EVSEQNO`	Serial number in the event database Value of the serial number.
	`EVARVDATE`	Date when the event arrived (`YYYY/MM/DD`) Arrived time as a character string in the format `YYYY/MM/DD`.
	`EVARVTIME`	Time when the event arrived (`hh:mm:ss`) Arrived time as a character string in the format `hh:mm:ss`.
	`EVSRCNO`	Serial number in the source event database Value of the source serial number.
	`EVMSG`	Message Text of the message.
	`EVDETAIL`	Detailed information about the event Event details as character strings in the format `Info-1`Δ`Info-2`Δ...`Info-n`Δ (where Δ represents a space).
Extended attribute	`EVSEV`	Event level in the extended event information (`Emergency`, `Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, or `Debug`) Value of the event level.
	`EVUSNAM`	User name Value of the user name.
	`EVOBTYP`	Object type Value of the object type.
	`EVOBNAM`	Object name Value of the object name.
	`EVROBTYP`	Root object type Value of the root object type.
	`EVROBNAM`	Root object name Value of the root object name.
	`EV"PRODUCT_NAME"`	Product name Value of the product name.
	`EV"OBJECT_ID"`	Object ID Value of the object ID.
	`EV"OCCURRENCE"`	Occurrence Value of the occurrence.
	`EV"START_TIME"`	Start time Value of the start time.
	`EV"END_TIME"`	End time Value of the end time.
	`EV"RESULT_CODE"`	Result code Value of the result code.
	`EV"JP1_SOURCEHOST"`	Source host name Value of the source host name.
	`EV` `extended-attribute-name`	User-specified extended attribute Value of the attribute specified in the extended attribute name.
Other	`EV"@JP1IM_CORRELATE"`	Correlation event Value indicating whether the event is a correlation event. - 0: Not a correlation event - 1: A correlation approval event - 2: A correlation failure event
	`EV"@JP1IM_ORIGINAL_SEVERITY"`	Severity of extended event attributes (before changing the event level) (`Emergency`, `Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, `Debug`, or a value set for the event level) This attribute is set only when the severity changing function is enabled.
	`EV"@JP1IM_CHANGE_SEVERITY"`	Severity changing A value indicating whether an event level has been changed. - 0: Not changed. - 1: Changed.
	`EV"@JP1IM_DISPLAY_MESSAGE"`	Value of the message (after change) This attribute is set only when the display message change function is enabled.
	`EV"@JP1IM_CHANGE_MESSAGE"`	Display message change Value indicating whether the display message has been changed; this attribute is set only when the display message change function is enabled: - 0: The message has not been changed. - 1: The message has been changed.
	`ACTHOST`	Host name of the manager that requested execution of the action Manager host name.
	`EVENV1` to `EVENV9`	Data extracted by specifying "( )" in a regular expression in an action execution condition Can be specified only when extended regular expressions are used on the manager.

Organization of this subsection

(1) Specification method
(2) Encoding of event inheritance information
(3) Converting inherited event information

(1) Specification method

Inherited event information is specified using a variable. Specify the variable in the form $variable-name. To specify a dollar sign as a character, type a backslash (\) before the dollar sign (\$).

The following control characters contained in the character information to be converted are converted to single-byte spaces (0x20).

Control characters that are converted to single-byte spaces: 0x01 to 0x1F (excluding tabs (0x09)), and 0x7F

To Page Top

(2) Encoding of event inheritance information

For Action in the action-related items, you can URL encode or Base64 encode the event inheritance information values.

The specification format is $variable-name$encoding-type. To specify a single-byte alphanumeric character or an underscore (_) immediately after encoding-type, use the format ${variable-name$encoding-type}. If you want to treat a dollar sign ($) as a character, specify the escape character (\) immediately before the $.

In the following cases, $variable-name$encoding-type and ${variable-name$encoding-type} will be interpreted as character strings and will not be converted:

There is no event that corresponds to variable-name.
The specification format is invalid.

The following table describes the encoding types for event inheritance information and the specification formats.

Table 6‒8: Encoding types for event inheritance information and specification formats
No.	Encoding type	Specification format	Description
1	URL encoding	`$variable-name$URLENC`	The event inheritance information value is URL encoded as a UTF-8 character string.
1	URL encoding	`${variable-name$URLENC}`
2	Base64 encoding	`$variable-name$ENC`	The event inheritance information value is Base64 encoded.
2	Base64 encoding	`${variable-name$ENC}`	The event inheritance information value is Base64 encoded.
3	Both Base64 encoding and URL encoding	`$variable-name$ENC$URLENC`	The event inheritance information value is Base64 encoded and then is URL encoded.
3	Both Base64 encoding and URL encoding	`${variable-name$ENC$URLENC}`
4	No encoding is performed	`$variable-name`	Neither URL encoding nor Base64 encoding is performed.
4	No encoding is performed	`${variable-name}`	Neither URL encoding nor Base64 encoding is performed.

Note that encoding of inheritance information cannot be used in the automated action definition file (for compatibility).

To Page Top

(3) Converting inherited event information

You can convert special ASCII characters included in inherited event information into a different character string.

This functionality allows you to convert characters in event information that have a special meaning in the OS into different characters. For example, if the JP1 event information specified by a variable contains characters that have a special meaning in commands, such as a double quotation mark (") or a single quotation mark ('), the command might not be interpreted correctly. We recommend that you use the configuration file for converting information to convert such characters.

Specify the special characters and the characters they are to be converted into using a configuration file for converting information. For details about this file, see Configuration file for converting information (event_info_replace.conf) in Chapter 2. Definition Files in the manual JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.

To Page Top