Event Manager Events

An Event Manager event is a binary package of data that contains a set of standard data items, including a name, a timestamp, and information about the poster. An event may contain variable data, which is named and supplied by the poster. For example, an event reporting the failure of a device may hold variables containing the path name and type of the device. Events are created and posted by an posting client, and distributed to other clients by the daemon. The receiving process extracts and processes the information contained in the event.

Although the logger captures posted events and stores them in a system log file, you can easily capture your own set of events and store them in your own file for later analysis. You use the evmwatch monitoring utility, or reconfigure the logger to capture your own events.

An event is an indication that some important event has occurred - an action has been taken, some condition has been met, or it is time to confirm that an application is still operational. A particular event may be important to the administrator or to some other class of system user. A system event can also be significant to the following system entities:

Entities interested in events must be part of the local system.

When a system component has important event to report, it makes the information available through an event channel. The event channel is a facility used to publish or retrieve event information. Following are examples of event channels:

An event management system is an active event channel and it provides services for distributing, storing, and retrieving event information.

Other than the Event Manager, the operating system supports a few other mechanisms through which system components can report event and status information. The system logger, syslog is a familiar example of event management system. It provides simple event distribution facilities for other components to use, and its daemon actively manages the event information it receives. By contrast, the cron daemon’s log file, /var/adm/cron/log, is an example of a passive event mechanism. The cron daemon writes new event information to the end of its file, and takes no special action to notify interested entities when it does so.

Event Manager Event Model

Figure 1-2 “Event Model” shows a graphical representation of an event. The Event Contents box shows items, such as the process identifier (PID) and the name of the host system on which the event was generated that may be included in the event. The Event Actions box shows some of the possible actions performed on any event.

Figure 1-2 Event Model

The Event Manager includes command-line utilities that recognize the format of the event. You can use these command-line utilities to perform basic operations at the command prompt or in shell scripts. However, you cannot view an event directly with a text viewer (for example, more ) because an event is a package of binary data. You can use commands to perform the following actions:

• Retrieve events from storage, sort them into a preferred order, and format them for display

• Watch for new events being posted

• Post new events

The command-line utilities are designed to be used together in pipelines. For example, you may pipe a set of events from a file in to the sort utility, pipe the output in to the formatting utility, pipe the output of that command in to the more command, or redirect it to a file. The Chapter 2 “Using Event Manager” provides examples of using commands to monitor and review event activity.

After the event file is converted to text form, you can use other standard utilities to analyze it. For example, you may display just the event names, and then pipe the display into the sort -u and wc -l commands to determine how many different types of events are in the file.