Default mapping of situation events to IBM Tivoli Enterprise Console events

IBM Tivoli Monitoring > Version 6.3 Fix Pack 2 > Administrator's Guide > Situation event integration with Tivoli Enterprise Console
IBM Tivoli Monitoring, Version 6.3 Fix Pack 2

Default mapping of situation events to IBM Tivoli Enterprise Console events

This section provides information about attribute mapping of situation events to IBM Tivoli Enterprise Console events. You can use this mapping information when you forward a situation event to the IBM Tivoli Enterprise Console and you want to write correlation rules in the IBM Tivoli Enterprise Console.
The situation event forwarder generates a IBM Tivoli Enterprise Console event with an event class based on the attribute group associated with the situation. When the situation event is forwarded to the event server the associated generated event class inherits event class attribute definitions (either directly or indirectly) from the parent: Omegamon_Base class. Because IBM Tivoli Enterprise Console uses hierarchical event classes, use the Omegamon_Base parent class when you want to write a rule for all situation events that you forward to the event server.
Omegamon_Base is described as follows:
Omegamon_Base ISA EVENT   
DEFINES {
     cms_hostname: STRING;
     cms_port: STRING;
     integration_type: STRING;
     master_reset_flag: STRING;
     appl_label:STRING;
     situation_name: STRING;
     situation_origin: STRING;
     situation_displayitem: STRING;
     situation_time: STRING;
     situation_status: STRING;
     situation_eventdata: STRING;
    situation_type: STRING;
    situation_thrunode: STRING;
     situation_group: STRING;
     situation_fullname: STRING;   }; END;  
In specialized cases where a situation event is mapped into an existing IBM Tivoli Enterprise Console event class and the event hierarchy cannot be modified (Omegamon_Base cannot be added to the hierarchy) it is important that the slots from Omegamon_Base be included in the existing event class or in a class somewhere in the hierarchy. This mechanism is not preferred because it does not allow a rule to recognize the presence of Omegamon_Base in the event hierarchy.
As part of the generic mapping for these situations, the IBM Tivoli Monitoring event forwarder assigns associated values for attributed defined in the event class attributes when forwarding an event to the Tivoli Enterprise Console event server. In addition to these event class attributes, values are assigned to the following attributes inherited from the EVENT class, if available: source, hostname, fqhostname, origin, sub_origin, adapter_host, origin, severity, and message attributes that are inherited from the base EVENT class.

IBM Tivoli Enterprise Console event class attributes

Event class attributes Values and meaning
adapter_host Base EVENT class attribute. Same as hostname (see below). This is application-specific data related to the event, if any.
appl_label Reserved for future use.
cms_hostname TCP/IP host name of the Tivoli Enterprise Monitoring Server that forwards the event.
cms_port The monitoring server port on which the web service is listening.
fqhostname Base EVENT class attribute that contains the fully qualified hostname, if available.
hostname Base EVENT class attribute that contains the TCP/IP hostname of the managed system where the event originates, if available.
integration_type Indicator to help IBM Tivoli Enterprise Console performance.

N for a new event, the first time the event is raised

U for update event, subsequent event status changes

master_reset_flag Master reset indicator set for master reset events. Value is NULL for all other events:

R for Tivoli Enterprise Monitoring Server recycle master_reset

S for hotstandby master_reset

msg Base EVENT class attribute that contains the situation name and formula.
origin Base EVENT class attribute contained in the TCP/IP address of the managed system where the event originates, if available. The address is in dotted-decimal format.
severity Base EVENT class attribute that contains the resolved severity.
situation_displayitem Display item of associated situation, if available.
situation_eventdata Raw situation event data starting from the second event data row, if any. Event data attributes are in key-value pair format. The event data can be truncated because the Event Integration Facility imposes a 2 KB size limit.
situation_group One or more situation group names (up to 5) that the situation is a member of.
situation_fullname Displayed name of the associated situation.
situation_name Unique identifier given to the situation.
situation_origin Managed system name where the situation event originated. It has the same value as sub_source.
situation_status Current status of the situation event.
situation_time Timestamp of the situation event.
situation_type Situation event typeS for sampled event; P for pure event.
situation_thrunode Reserved for future use.
source Base EVENT class attribute that contains ITM
sub_origin Base EVENT class attribute. This is the same as the managed system name for the associated situation_displayitem, if any.
sub_source Base EVENT class attribute that contains the origin managed system name for the associated situation.

Expand a generic event message situation description
The message slot gives you a descriptive way of looking at an event in the IBM Tivoli Enterprise Console.

Generic mapping for agent specific slots
Generic mapping identifies the target event class based on information out of a situation that is triggered and forwarded to the event server.

Assign severity for Tivoli Enterprise Console events
The severity of a Tivoli Enterprise Console event associated with a situation is assigned automatically from the situation name or you can set a severity in the Tivoli Enterprise Portal Situation editor.

Localize message slots
Edit the KMS_OMTEC_GLOBALIZATION_LOC variable to enable globalization of the EIF event message slots that get mapped to alert summaries by the Tivoli Enterprise Console event server.

Situation event statuses and IBM Tivoli Enterprise Console event generation
This topic describes the meaning of the situation event statuses and the setting of the common slots in the generated IBM Tivoli Enterprise Console event.

Parent topic:
Situation event integration with Tivoli Enterprise Console

+
Search Tips | Advanced Search

Event class attributes	Values and meaning
adapter_host	Base EVENT class attribute. Same as hostname (see below). This is application-specific data related to the event, if any.
appl_label	Reserved for future use.
cms_hostname	TCP/IP host name of the Tivoli Enterprise Monitoring Server that forwards the event.
cms_port	The monitoring server port on which the web service is listening.
fqhostname	Base EVENT class attribute that contains the fully qualified hostname, if available.
hostname	Base EVENT class attribute that contains the TCP/IP hostname of the managed system where the event originates, if available.
integration_type	Indicator to help IBM Tivoli Enterprise Console performance. N for a new event, the first time the event is raised U for update event, subsequent event status changes
master_reset_flag	Master reset indicator set for master reset events. Value is NULL for all other events: R for Tivoli Enterprise Monitoring Server recycle master_reset S for hotstandby master_reset
msg	Base EVENT class attribute that contains the situation name and formula.
origin	Base EVENT class attribute contained in the TCP/IP address of the managed system where the event originates, if available. The address is in dotted-decimal format.
severity	Base EVENT class attribute that contains the resolved severity.
situation_displayitem	Display item of associated situation, if available.
situation_eventdata	Raw situation event data starting from the second event data row, if any. Event data attributes are in key-value pair format. The event data can be truncated because the Event Integration Facility imposes a 2 KB size limit.
situation_group	One or more situation group names (up to 5) that the situation is a member of.
situation_fullname	Displayed name of the associated situation.
situation_name	Unique identifier given to the situation.
situation_origin	Managed system name where the situation event originated. It has the same value as sub_source.
situation_status	Current status of the situation event.
situation_time	Timestamp of the situation event.
situation_type	Situation event typeS for sampled event; P for pure event.
situation_thrunode	Reserved for future use.
source	Base EVENT class attribute that contains ITM
sub_origin	Base EVENT class attribute. This is the same as the managed system name for the associated situation_displayitem, if any.
sub_source	Base EVENT class attribute that contains the origin managed system name for the associated situation.