Event field format for event collection

Event Management requires all events to use a standard form, regardless of how they arrive at the instance.

Table 1. Event fields
Name Description
em_event.source Mandatory. The event monitoring software that generated the event, such as SolarWinds or SCOM. This field has a maximum length of 100. It is formerly known as event_class.
em_event.node Recommended. The node name, fully qualified domain name (FQDN), IP address, or MAC address that is associated with the event, such as IBM-ASSET. This field has a maximum length of 100.
em_event.type Optional. The pre-defined event type, such as high CPU, which is used to identify an event record. This field has a maximum length of 100.
em_event.resource Recommended. The node resource that is relevant to the event. For example, Disk C, CPU-1, the name of a process, or service. This field has a maximum length of 100.
em_event.event_class Mandatory for alerts to be created automatically if the em_event.node field is not specified. The value for the em_event.event_class field originates from either the source generating the events, or by event rule. The name of the machine or software that generated the event. For example, SolarWinds on The corresponding field display name is Source Instance.
em_event.ci_type Recommended. A JSON string that represents a configuration item. For example, {"name":"SAP ORA01","type":"Oracle"}. The CI identifier that generated the event appears in the Additional information field. This field has a maximum length of 1000.
em_event.message_key Recommended. The event unique identifier to identify multiple events that relate to the same alert. If this value is empty, it is generated from the Source, Node, Type, and Resource field values. This field has a maximum length of 1024.
em_event.severity Mandatory. The severity of the event. The options are typically interpreted as follows:
  • Critical: Immediate action is required. The resource is either not functional or critical problems are imminent.
  • Major: Major functionality is severely impaired or performance has significantly degraded.
  • Minor: Partial, non-critical loss of functionality or performance degradation occurred.
  • Warning: Attention is required, even though the resource is still functional.
  • Clear: No action is required. An alert is not created from this event. Existing alerts are closed.
  • Info: An alert is created. The resource is still functional.
em_event.time_of_event Mandatory. The time that the event occurred in the source system. This field is a GlideDateTime field in UTC or GMT format. This field has a maximum length of 40.
em_event.state The current processing state of the event:
  • Ready: The event has been received and is waiting to be processed.
  • Queued: The event is queued by the event processor job.
  • Processed: The event was successfully processed.
  • Error: A failure occurred while processing the event. For example, the event collection method or event Severity is blank.
  • Ignored: This value is not in use.
em_event.alert If an alert was created as a result of the event, this field contains the unique ID that is generated by Event Management to identify the alert.
em_event.description Mandatory. A reason for event generation. Shows additional details about an issue. For example, a server stack trace or details from a monitoring tool. This field has a maximum length of 4000.
em_event.additional_info Optional. A JSON string that gives additional information about the event. For example, {"evtComponent":"Microsoft-Windows-WindowsUpdateClient","evtMessage":"Installation Failure: Windows failed. Error 0x80070490"} This information can be used for third-party integration or other post-alert processing.
em_event.resolution_state Optional. The event state from the event source is either Closed or empty. The Closed event state closes corresponding alerts. If the field is empty, the resolution on corresponding alerts is still pending.