4.15.2 Saving event information in the integrated monitoring database (CSV report)
The functionality for outputting event information from the integrated monitoring database is referred to as output of an event report.
Using this feature in JP1/IM, you can save information about the JP1 events registered in the integrated monitoring database as a CSV-formatted report. To output an event report, execute the jcoevtreport command. As a command option, you can specify what event information to output.
For the command syntax, see jcoevtreport in Chapter 1. Commands in the JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.
The following describes the range of information you can output in an event report, and the output format, items, and command options.
- Organization of this subsection
(1) Information that can be output to an event report
You can output the following event information to an event report:
-
Time-specified event information
You can specify the arrival time of the JP1 events to be output.
-
Program-specific event information
You can specify particular items of program-specific information. If you do not specify any items, all items are output.
-
Information about events that match a filter condition
You can limit the JP1 events to be output using pass conditions or exclusion-conditions in a filter. For the items you can specify in a filter condition, see Table 4-22 Contents output to an event report.
You can specify a maximum of 50 filter conditions in one pass condition group or one exclusion-condition group. In a filter for extended attributes (program-specific information), however, you can specify a maximum of five filter conditions in one pass condition group or one exclusion-condition group.
(2) Image and format of an event report
If you specify the header option during CSV output, CSV header items are output to line 1, separated by commas.
In line 2 and subsequent lines, event information is output in the following order, separated by commas:
basic-attribute, extended-attributes-(common-information), IM-attributes, extended-attribute (program-specific-information)
For the extended attributes (program-specific information), the output format depends on whether program-specific extended attributes are defined in the definition file for extended event attributes (extended file).
If some of the program-specific extended attributes are defined in the definition file for extended event attributes (extended file) and some are not, the defined program-specific extended attributes are output first, and then the undefined program-specific extended attributes are output.
When multiple program-specific extended attributes are defined in the definition file for extended event attributes (extended file), the attributes are output in the order they are defined.
If you specify program-specific extended attributes in the environment definition file for event report output (evtreport.conf), the program-specific extended attributes defined in the definition file for extended event attributes (extended file) are output in the same format as for the program-specific extended attributes that are not defined in the definition file for extended event attributes (extended file).
If you do not specify program-specific extended attributes for items that are to be output to event reports, the number of program-specific extended attributes appears as 0, and the attribute name and value are blank (nothing is entered).
(3) Items output to an event report
When you specify the header option, header information for the attribute name or item name is output to line 1 of the CSV file. For the extended attributes (program-specific information) defined in the definition file for extended event attributes (extended file), the defined item names are output as headers.
By default, no headers are output.
Attribute type |
Item |
Header information |
---|---|---|
Basic attribute |
Serial number |
The character string displayed in the window is output. |
Event ID |
The character string displayed in the window is output. |
|
Source process ID |
The character string displayed in the window is output. |
|
Registered time |
Output in the following format:
|
|
Arrived time |
||
Registered reason |
Output in decimal format. |
|
Source user ID |
||
Source group ID |
||
Source user name |
Output as a character string. |
|
Source group name |
||
Source host |
||
Destination event server name |
||
Source IP address |
The IP address is output as a character string. |
|
Destination IP address |
||
Source serial number |
The character string displayed in the window is output. |
|
Code set |
Output as a character string. |
|
Message |
The character strings displayed in the window are output. |
|
Extended attribute (common information) |
Event level |
The character string is converted and output as follows:
For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output. |
User name |
The character string displayed in the window is output. |
|
Product name |
||
Object type |
||
Object name |
||
Root object type |
||
Root object name |
||
Object ID |
Output as a character string. |
|
Occurrence |
The character string displayed in the window is output. |
|
Start time |
Output in either of the following formats:
|
|
End time |
||
Result code |
Output as a character string. |
|
Event source host name |
||
IM attributes |
Action type |
The icons in the window are converted into character strings and output as follows:
(no icon) -> blank |
Action |
The icons in the window are converted into character strings and output as follows:
(no icon) -> (blank) |
|
Severe event |
Either of the following is output: If the JP1 event is not severe: Blank If the JP1 event is severe: Severe Event |
|
Correlation event |
The icons in the window are converted into character strings and output as follows:
(no icon) -> (blank) |
|
Original severity level |
The icon is converted and output as follows:
For all other event levels, the character string displayed in the window is output as is. The severity color coding and icons are not output. |
|
New severity level |
The icon in the window is converted and output as follows:
(no icon) -> (blank) |
|
Response status |
The icons in the window are converted into character strings and output as follows:
(no icon) -> Unprocessed |
|
Severe event release |
The following character string is output: If the severe event has not been released: Blank If the severe event has been released: Released |
|
Severe event deletion |
The following character string is output: If the severe event has not been deleted: Blank If the severe event has been deleted: Delete |
|
Memo |
The character strings displayed in the window are output. |
|
Message (after change) |
The character strings displayed in the window are output as is. |
|
Display message change |
The icons in the window are converted into character strings and output as follows:
(no icon) -> (blank) |
|
Display message change definition |
The character strings displayed in the window are output as is. |
|
Response-waiting event |
The icon in the window is converted and output as follows:
(no icon) -> (blank) |
|
Extended attribute reserved by the system (program-specific information) |
Relation Event serial number (E.JP1_GENERATE_SOURCE_SEQNO) |
The serial numbers of relation events are listed in the following format, separated with spaces (Δ): serial-number-1Δserial-number-2Δ...Δserial-number-n (n is a number between 1 and 100) |
Correlation event generation condition name (E.JP1_GENERATE_NAME) |
Output as a character string. This item is the name of a correlation event generation condition that is satisfied. |
|
Suppressed event ID (E.JP1_IMSUPPRESS_ID) |
Output as a character string. This item is output when the repeated-event monitoring suppression function is used. This item is the serial number (unique number in the event database) of a repeated event that occurs more frequently than the threshold. |
|
Repeated event condition name (E.JP1_IMSUPPRESS_NAME) |
Output as a character string. This item is output when the repeated-event monitoring suppression function is used. This item is the name of a repeated event condition that determined that the event was a repeated-event. |
|
Monitoring ID (E.JP1_TRAP_ID) |
Output as a character string. This item is the log file trap ID. |
|
Monitoring target name (E.JP1_TRAP_NAME) |
Output as a character string. This item is the log file trap name. |
|
Common exclude conditions group ID (E.JP1_IMCOMEXCLUDE_ID) |
Output as a character string. This item is the ID of the common exclusion-conditions group that caused the exclusion. |
|
Common exclude conditions group name (E.JP1_IMCOMEXCLUDE_NAME) |
Output as a character string. This item is the condition name of the common exclusion-conditions group that caused the exclusion. |
|
Common exclude conditions group target-for-exclusion (E.JP1_IMCOMEXCLUDE_TARGET) |
Output the following character string indicating the exclusion target of common exclusion-conditions: When an event is excluded from automated-action execution -> action |
|
Extended attribute (program-specific information) |
E.xxxxxxx |
Output as a character string. |
Number of program-specific extended attributes |
The total number of program-specific extended attributes that are not specified in the definition file for extended event attributes (extended file) will be output. |
|
Program-specific extended attribute |
All names and values of program-specific extended attributes that are not specified in the definition file for extended event attributes (extended file) are output. |
(4) Command options
You can specify the following options in the jcoevtreport command to output maintenance information and to save the event report:
-
Export maintenance information
jcoevtreport -sys -s 20090101000000 -e 20090103000000 (This example outputs JP1 events that were registered in the integrated monitoring database between 2009/01/01 00:00:00 and 2009/01/03 00:00:00.)
-
Save events before deletion
jcoevtreport -save
These two options are explained next.
(a) Export maintenance information
When an error occurs in the integrated monitoring database, this option outputs information about all JP1 events registered between the output start time and end time to the event report.
The attribute name appears in the header part.
Because the purpose is to collect data for investigating a database error, you cannot specify what items to output or any filtering conditions.
(b) Save events before deletion
This option outputs an event report about JP1 events due for deletion to free up space in the integrated monitoring database.
With this option specified, the command outputs in CSV format all the JP1 events registered in the integrated monitoring database that have not previously been saved to an event report.
■ Warning before deletion of unsaved JP1 events
You can issue a deletion warning event (event ID: 3F52) when the ratio of JP1 events in the integrated monitoring database that have not been output to an event report (relative to the maximum number of entries in the database) exceeds a set threshold for issuing a deletion warning event (by default, when the unsaved data exceeds 80% of the database capacity).
Specify the ratio of unsaved JP1 events in the -dbntcpos option of the jcoimdef command.
Specify the threshold for issuing a deletion warning event in the -dbntc option of the jcoimdef command.
For details, see jcoimdef in Chapter 1. Commands in the JP1/Integrated Management 3 - Manager Command, Definition File and API Reference.
■ Display information about saving events before deletion in the standard output
You can specify an option to display information about saving events due for deletion. Set the -showsv option of the jcoevtreport command to display this information in the standard output.
This option lets you see how much free space will be required to save the events, and helps you adjust the timing for outputting an event report before the target events are deleted.
With this option specified, the following items can be displayed in the standard output:
-
Ratio of JP1 events that have not been output to an event report (relative to the maximum number of entries in the integrated monitoring database)
The ratio of JP1 events in the integrated monitoring database that have not been output to an event report is shown as a percentage.
-
Data size of the JP1 events that have not been output to an event report
The data size of the JP1 events in the integrated monitoring database that have not been output to an event report is shown in megabytes.
-
Threshold for issuing a deletion warning event
If issue of a deletion warning event is specified, the threshold is shown as a percentage. If you specify OFF in the jcoimdef command's -dbntc option, a hyphen (-) is shown.