Event Reports

In Operations Sentinel, the change in the value of an attribute is considered as an event. These attribute-value changes are reported in an event report. An event report is a data package that contains information about an object or about an event involving an object. It consists of a series of attribute-value pairs.

Attribute-Value Pairs

An attribute-value pair consists of the name of an attribute separated from its value by an equal sign (=):

attribute-name=attribute-value

where:

attribute-name

is the name of the attribute to which the value is applied. It is not case sensitive. It can include spaces.

Equal sign (=)

is the attribute-value pair assignment character. You can include spaces before and after the equal sign.

attribute-value

is the value to be assigned to the named attribute. It is case sensitive except for the TYPE, CLASS, and SEV attributes. It can include spaces.

Multiple Attribute-Value Pairs

A vertical line ( | ) separates successive attribute-value pairs in a series and is a required part of the syntax. You can include spaces before and after the vertical line.

attribute-name=attribute-value |
attribute-name = attribute-value |
attribute-name=attribute-value

Types of Event Reports

Operations Sentinel processes the following types of event reports:

Attribute change (AC) event reports are the most generic of the event reports. They allow you to change the value of one or more attributes within an object.
Alert (AL) event reports signal alert conditions to the rest of Operations Sentinel. They can raise, acknowledge, and clear alerts in Operations Sentinel. They can also cause external actions, such as paging, that are defined in the active alert policy.
Delete object (DE) event reports indicate that information about an object (identified by its class, system, and name) can be removed from Operations Sentinel.
Log (LG) event reports define messages to be written to the Operations Sentinel log of the object.
[OS 2200, MCP, UNIX]
Command (CO) event reports provide cross-system automation, allowing an event on one system to cause actions to be executed on other systems.
Message (ME) event reports provide the means to supply Windows console messages to Operations Sentinel. ME event reports might be submitted to the Operations Sentinel Event Server through any supported paths, such as API clients, spo_pipe, spo_event, and automation actions.

Attribute-Value Pairs Common to All Event Reports

All event reports begin with the following three attribute-value pairs:

TYPE=type | CLASS=object-class | INSTANCE=object-name

where:

type	One of the five types of event reports: attribute change (AC), alert (AL), command (CO), delete object (DE), or log (LG). type is not case sensitive.
object-class	Name of the object class and is not case sensitive.
object-name	Name of the object and is case sensitive.

An event report must include these three attribute-value pairs in the specified order. An event report can contain other attribute-value pairs that are specific to the object and the type of event report.