Event Management tracks individual events to manage external systems. These events are notifications from monitoring tools indicating occurrences of interest, like log messages, warnings, or errors. Event Management gathers events from external sources and stores them in the Event [em_event] table, offering a list of raw incoming events.

Before you begin

Role required: evt_mgmt_admin, evt_mgmt_operator, evt_mgmt_user, or evt_mgmt_integration
Note: Ensure that you do not change the Classification field value in event [em_event] tables, either manually, by script, or by event rule.

About this task

The event monitoring tool generates the values of the source and resource fields. Event Management implementers can define event types and register nodes to help uniquely identify incoming events and create alerts for the specific needs of the enterprise. Event Management uses this information to determine whether to create an alert or update an existing one.

An event source may generate duplicate events with the same identifying information. For events with the same identifying information, Event Management uses the time interval between events to determine whether the events represent an existing issue or new issue.

Additional fields should be included in the Additional information field of the event. Do not add additional fields to an event by adding a custom field to the event [em_event] table. For more information about how to include additional fields in events, see Custom alert fields.

Note: Avoid writing business rules for event [em_event] tables, as they can result in performance degradation.

Procedure

  1. Navigate to All > Event Management > All Events.
    The All Events list displays the following columns.
    Table 1. All Events list
    ColumnDescriptionPopulated by
    Time of event The time that the event occurred, in the network node time zone. External event monitoring tool
    Source Event monitoring software that generated the event, such as SolarWinds or SCOM. Maximum length: 100 characters. External event monitoring tool
    Description Reason for event generation. Shows extra details about an issue. For example, a server stack trace or details from a monitoring tool. Maximum length: 4000 characters. External event monitoring tool
    Node Node name, fully qualified domain name (FQDN), IP address, or MAC address that is associated with the event, such as IBM-ASSET. Maximum length: 100 characters. External event monitoring tool
    Type The metric type to which the event is related, such as Disk or CPU, which is used to identify an event record from which alerts are created. Maximum length: 100 characters. External event monitoring tool
    Resource Node resource that is relevant to the event. For example, Disk C, CPU-1, the name of a process, or service. Maximum length: 100 characters. External event monitoring tool
    Metric Name Unique name that describes which metrics are collected and for which this alert has been created. External event monitoring tool
    Message Key Unique event identifier to identify multiple events that relate to the same alert. If this value is empty, it is generated from the Source, Node, Type, Resource, and Metric Name field values. Maximum length: 1024 characters. External event monitoring tool
    State
    The status of the event:
    • Ready: Event has been received and is waiting to be processed.
    • Queued: Event is queued by the event processor job.
    • Processed: Event was successfully processed.
    • Error: Failure occurred while processing the event. For example, the event collection method or event Severity is blank.
    • Ignored: Value is not in use.
    		 Event
    Severity
    Mandatory. The options are typically interpreted as follows:
    • Critical: Immediate action is required. The resource is either not functional or critical problems are imminent.
    • Major: Major functionality is severely impaired or performance has degraded.
    • Minor: Partial, non-critical loss of functionality or performance degradation occurred.
    • Warning: Attention is required, even though the resource is still functional.
    • OK: An alert is created. The resource is still functional.
    • Clear: No action is required. An alert is not created from this event. Existing alerts are closed.
    		 Event
    Alert If an alert was created as a result of the event, this field contains the unique ID that Event Management generates to identify the alert. A matching event rule or event field mapping
  2. To review a single event, click the required row in the Time of event column.
  3. To review the event rules that processed the event, in the Related Links section click Check process of event.
    For further ways to see which event rules were applied to the event, you can display the Event rule and Processing Notes fields in the Events list.

    Optional event rule columns to show event rules

    Table 2. Optional event fields to display the applied event rule
    Column Description
    Matching Event rule The event rule that matches the current event rule definitions. This information is primarily used to create event rule recommendations for events that currently are not covered by rules. If event rules have been modified, this information can be retrieved from the Processing Notes field, described below.
    Note: This field does not show the history of event rules that were applied to the event.
    Processing Notes Information related to the binding to CI type and the event rules that were applied to the event.
  4. To create an event rule for an event that is not associated with an event rule:
    1. Click the event.

      The event opens in the Event form.

      Event Management manage event
    2. Click Create Event Rule.
      The fields of the new Event rule are populated with data from the event. You can use the event information, for example, when composing fields for alerts.