Interpreting Event Service Data Files

•

All alerts generated and cleared by TIBCO Hawk agents across the network, as well as changes in agent alert level (represented as icon colors in TIBCO Hawk WebConsole)

It records these events in data files named Event.dat, located in the directory defined in the -datadir agent startup option. Data files contain event monitoring information, while separate log files named Event.log record the state of the Event Service itself.

The TIBCO Hawk Event Service creates rolling data files using the same mechanism as TIBCO Hawk log files. It also uses the same default values for file location, number and size.

The following entry shows a sample alert message logged in an Event Service data file:

ALERT_RECEIVED : alert={ agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-id=58, rulebase=Mail, alert-state=75, alert-text=%processor time >= 25, time-received=Thu Sep 24 09:03:56 EDT 1998 } ## Thu Sep 24 09:03:56 EDT 1998 ##

The dns field has a value of none unless an agent domain is specified. The alert-id field is a numeric identifier for the alert that is unique across host-name and dns combinations. If a single condition generates multiple alerts, the alert messages have the same alert-id value.

Event Service data files contain the following types of entries for agent state changes:

AGENT_ALIVE : agent={ host-name=ultrahawk1, dns=none, host-ip=160.101.246.16, network-ip=160.101.246.0 }, alert-state=75, ## Sat Dec 18 11:40:36 EST 1999 ##

ALERT_CLEARED : agent={ host-name=protege, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 } alert-id=35, reason=test evaluated to FALSE, ## Thu Sep 24 09:04:03 EDT 1998 ##

AGENT_STATE_CHANGE : agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, new-alert-state=0, ## Thu Sep 24 09:04:27 EDT 1998 ##

AGENT_REINITIALIZED : agent={ host-name=jaguar, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-state=75, ## Thu Sep 24 09:06:09 EDT 1998 ##

In agent entries, alert levels are represented numerically. To find the text equivalent, use the following table to translate the value of the alert-state field:

Table 2 Numeric Representations of Alert Levels in Event.dat Files
Numeric Value	Alert Level
0	Notification
25	Low
50	Medium
75	High

Event Service data files contain the following types of entries for microagent and rulebase events:

MICROAGENT_ADDED : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.Network, at Sat Dec 18 11:50:38 EST 1999

MICROAGENT_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.FileSystem, at Sat Dec 18 11:50:36 EST 1999

RULEBASE_ADDED : AgentID={ host-name=pchawk1, dns=none, host-ip=160.101.246.11, network-ip=160.101.246.0 }, rulebase=cricket, state=75, at Sat Dec 18 11:50:36 EST 1999

RULEBASE_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, rulebase=System, at Sat Dec 18 11:50:36 EST 1999