Interpreting Event Service Data Files

When running, the Event Service records:

All alerts generated and cleared by TIBCO Hawk agents across the network, as well as changes in agent alert level (represented as icon colors in TIBCO Hawk Console)
All instances of agent activation and expiration
Add and remove operations for microagents and rulebases

It records these events in data files named Event.dat, located in the directory defined in the -datadir agent startup option. Data files contain event monitoring information, while separate log files named Event.log record the state of the Event Service itself.

The TIBCO Hawk Event Service creates rolling data files using the same mechanism as TIBCO Hawk log files. It also uses the same default values for file location, number and size.

Sample Alert Message

The following entry shows a sample alert message logged in an Event Service data file:

ALERT_RECEIVED : alert={ agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-id=58, rulebase=Mail, alert-state=75, alert-text=%processor time  >= 25, time-received=Thu Sep 24 09:03:56 EDT 1998 } ## Thu Sep 24 09:03:56 EDT 1998 ##

The dns field has a value of none unless an agent domain is specified. The alert-id field is a numeric identifier for the alert that is unique across host-name and dns combinations. If a single condition generates multiple alerts, the alert messages have the same alert-id value.

Agent State Change Entries

Event Service data files contain the following types of entries for agent state changes:

AGENT_ALIVE : agent={ host-name=ultrahawk1, dns=none, host-ip=160.101.246.16, network-ip=160.101.246.0 }, alert-state=75, ## Sat Dec 18 11:40:36 EST 1999 ##
ALERT_CLEARED : agent={ host-name=protege, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 } alert-id=35, reason=test evaluated to FALSE, ## Thu Sep 24 09:04:03 EDT 1998 ##
AGENT_STATE_CHANGE : agent={ host-name=cricket, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, new-alert-state=0, ## Thu Sep 24 09:04:27 EDT 1998 ##
AGENT_REINITIALIZED : agent={ host-name=jaguar, dns=none, host-ip=123.123.123.123, network-ip=123.123.123.0 }, alert-state=75, ## Thu Sep 24 09:06:09 EDT 1998 ##

In agent entries, alert levels are represented numerically. To find the text equivalent, use the following table to translate the value of the alert-state field:

Numeric Representations of Alert Levels in Event.dat Files

Numeric Value

Alert Level

0

Notification

25

Low

50

Medium

75

High

Microagent and Rulebase Event Entries

Event Service data files contain the following types of entries for microagent and rulebase events:

MICROAGENT_ADDED : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.Network, at Sat Dec 18 11:50:38 EST 1999
MICROAGENT_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, MicroAgentID=COM.TIBCO.hawk.hma.FileSystem, at Sat Dec 18 11:50:36 EST 1999
RULEBASE_ADDED : AgentID={ host-name=pchawk1, dns=none, host-ip=160.101.246.11, network-ip=160.101.246.0 }, rulebase=cricket, state=75, at Sat Dec 18 11:50:36 EST 1999
RULEBASE_REMOVE : AgentID={ host-name=boxter, dns=none, host-ip=160.101.246.18, network-ip=160.101.246.0 }, rulebase=System, at Sat Dec 18 11:50:36 EST 1999