Default event field mappings

Event Management provides default event field mappings for commonly used system monitoring tools. The Event Mapping Pairs from event field mappings format the incoming event data for Event Management.

You can view the default event field mappings and mapping pairs by navigating to Event Management > Event Field Mappings and double-clicking Name. The default event field mappings that are available for the following event sources:
  • enterprises.20006.1.5
  • enterprises.20006.1.7
  • HPOMWIN
  • Microsoft Operations Manager
  • netappDataFabricManager
  • oraEM4Traps
  • SNMPv2 Generic Trap
  • SolarWinds
  • Trap From Enterprise 9
  • vmwVC
  • whatsup-whatsupState

HP Operations Manager

For HP Operations Manager, the following default event field mappings are active by default in the HPOMWIN Source category.

Table 1. Default HP Operations Manager event field mappings
Event field mapping name Description
HPOMWIN-hpomSeverity Maps the source hpomSeverity field to the event severity.

NetApp DataFabric Manager

For NetApp DataFabric Manager, the following default event field mappings are active by default in the netappDataFabricManager Source category.

Table 2. Default NetApp DataFabric Manager event field mappings
Event field mapping name Description
netappDataFabricManager-dfmEventSeverity Maps the source dfmEventSeverity field to the event severity.

NetDiscover

For NetDiscover, the following default event field mappings are active by default in the enterprises.20006.1.5 and enterprises.20006.1.7 Source categories.

Table 3. Default Net Discover event field mappings
Event field mapping name Description
enterprises.20006.1.5-trap_severity Maps the source trap_severity field to the event severity.
enterprises.20006.1.7-trap_severity Maps the source trap_severity field to the event severity.

Microsoft Operations Manager

For Microsoft Operations Manager, the following default event field mappings are active by default in the mom Source category.

Table 4. Default Microsoft Operations Manager event field mappings
Event field mapping name Description
mom-momSeverity Maps the source momSeverity field to the event severity.

Oracle

For Oracle, the following default event field mappings are active by default in the oraEM4Traps Source category.

Table 5. Default Oracle event field mappings
Event field mapping name Description
oraEM4Traps-oraEM4AlertSeverity Maps the source oraEM4AlertSeverity field to the event severity.

SNMP Traps

For SNMP Traps, the following default event field mappings are active by default in the SNMPv2 Generic Trap Source category.

Table 6. Default SNMP Traps event field mappings
Event field mapping name Description
ifOperStatus Maps the source ifOperStatus field to the ifOperStatus.
ifAdminStatus Maps the source ifAdminStatus field to the ifAdminStatus.

SolarWinds

For SolarWinds, the following default event field mappings are active by default in the SolarWinds Source category.

Table 7. Default SolarWinds event field mappings
Event field mapping name Description
solarwinds-icon-severity Maps the source icon field to the event severity.
solarwinds-Availability-severity Maps the source Availability field to the event severity.
solarwinds-ComponentStatus-severity Maps the source ComponentStatus field to the event severity.
solarwinds-Status-severity Maps the source Status field to the event severity.
solarwinds-type Maps the source eventType field to the event type.

Trap from Enterprise 9

For Trap from Enterprise 9, the following default event field mappings are active by default in various Source categories.

Table 8. Default Trap from Enterprise 9 event field mappings
Event field mapping name Description
mnState (mnState category) Maps the source mnState field to the mnState.
tslineSesType (tslineSesType category) Maps the source tslineSesType field to the tslineSesType.
cisco.snmpTrapOID (snmpTrapOID category) Maps the source snmpTrapOID field to the snmpTrapOID.
ciscoFlashCopyStatus (ciscoFlashCopyStatus category) Maps the source ciscoFlashCopyStatus field to the ciscoFlashCopyStatus.
tcpConnState (tcpConnState category) Maps the source tcpConnState field to the tcpConnState.

VMware VCenter

For VMware VCenter, the following default event field mappings are active by default in the vmwVpxdNewStatus Source category.

Table 9. Default VMware VCenter event field mappings
Event field mapping name Description
vmwVC-vmwVpxdNewStatus Maps the source vmwVpxdNewStatus field to the event severity.

WhatsApp

For WhatsApp, the following default event field mappings are active by default in the whatsup Source category.

Table 10. Default WhatsApp event field mappings
Event field mapping name Description
whatsup-whatsupState Maps the source whatsupState field to the event severity.