Interpreting Event Service Data Files
When running, the Event Service records:
• | All alerts generated and cleared by TIBCO Hawk agents across the network, as well as changes in agent alert level (represented as icon colors in TIBCO Hawk Console) |
• | All instances of agent activation and expiration |
• | Add and remove operations for microagents and rulebases |
It records these events in data files named Event.dat
, located in the directory defined in the -datadir
agent startup option. Data files contain event monitoring information, while separate log files named Event.log
record the state of the Event Service itself.
The TIBCO Hawk Event Service creates rolling data files using the same mechanism as TIBCO Hawk log files. It also uses the same default values for file location, number and size.
Sample Alert Message
The following entry shows a sample alert message logged in an Event Service data file:
ALERT_RECEIVED : alert={ agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-id=58, rulebase=Mail, alert-state=75, alert-text=%processor time >= 25, time-received=Thu Sep 24 09:03:56 EDT 1998 } ## Thu Sep 24 09:03:56 EDT 1998 ##
The dns
field has a value of none
unless an agent domain is specified. The alert-id
field is a numeric identifier for the alert that is unique across host-name
and dns
combinations. If a single condition generates multiple alerts, the alert messages have the same alert-id
value.
Agent State Change Entries
Event Service data files contain the following types of entries for agent state changes:
AGENT_ALIVE : agent={ host-name=ultrahawk1, dns=none, host-ip=160.101.246.16, network-ip=160.101.246.0 }, alert-state=75, ## Sat Dec 18 11:40:36 EST 1999 ##
ALERT_CLEARED : agent={ host-name=protege, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 } alert-id=35, reason=test evaluated to FALSE, ## Thu Sep 24 09:04:03 EDT 1998 ##
AGENT_STATE_CHANGE : agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, new-alert-state=0, ## Thu Sep 24 09:04:27 EDT 1998 ##
AGENT_REINITIALIZED : agent={ host-name=jaguar, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-state=75, ## Thu Sep 24 09:06:09 EDT 1998 ##
In agent entries, alert levels are represented numerically. To find the text equivalent, use the following table to translate the value of the alert-state
field:
Numeric Value |
Alert Level |
0 |
Notification |
25 |
Low |
50 |
Medium |
75 |
High |
Microagent and Rulebase Event Entries
Event Service data files contain the following types of entries for microagent and rulebase events:
MICROAGENT_ADDED : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.Network, at Sat Dec 18 11:50:38 EST 1999
MICROAGENT_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.FileSystem, at Sat Dec 18 11:50:36 EST 1999
RULEBASE_ADDED : AgentID={ host-name=pchawk1, dns=none, host-ip=160.101.246.11, network-ip=160.101.246.0 }, rulebase=cricket, state=75, at Sat Dec 18 11:50:36 EST 1999
RULEBASE_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, rulebase=System, at Sat Dec 18 11:50:36 EST 1999