An attribute name in a CBE event is converted to an attribute name in a Enterprise Console event according to the rows in table 1. Attribute names that are not available in table 1 are not mapped to a Enterprise Console event:
CBE event attribute |
Enterprise Console event attribute |
---|---|
CLASS |
|
msg |
msg |
severity |
|
date |
|
repeat_count |
|
source |
|
sub_source |
|
|
|
globalInstanceId (if defined in the active rule base) |
|
|
Not mapped |
Table 1. Mapping of attributes between CBE and Enterprise Console event format
The following sections explain in details how each attribute is mapped from the CBE event to a Enterprise Console event:
Mapped to the CLASS attribute. If there is no extensionName in the CBE event, then the CLASS attribute is set to EVENT, which is the default value for TEC event classes.
Note:
If both the msg attribute and the msgId field of the msgDataElement attribute are set in the CBE event, the Enterprise Console msg attribute is set with a concatenation of these two fields, resulting in a value with the following structure: msgId: msg
If only the msg attribute is set in the CBE event, it is copied directly to the Enterprise Console event msg attribute.
The Enterprise Console event severity slot is an optional slot and can be represented by a numeric value or by one of the predefined keywords: UNKNOWN, HARMLESS, WARNING, MINOR, CRITICAL and FATAL. The severity will be mapped as follows:
If the CBE severity matches the enumerated list then the Enterprise Console event severity slot will be set to the CBE severity numeric value.
If there is no severity enumeration match then the following mapping will occur. Note, this mapping works best if the default Enterprise Console severities have not been changed. However, custom severities can be defined in addition to the default Enterprise Console severities.
Mapped directly to the Enterprise Console event repeat_count slot.
The Enterprise Console event date slot is optional. It usually follows the pattern "MMM dd HH:mm:ss yyyy".The value will be created from the CBE creationTime pattern "yyyy-MM-dd'T'HH:mm:ss".
Note:
The sourceComponentId is a complex CBE attribute, which means it contains other internal attributes. Its internal attributes are mapped to attributes in the Enterprise Console event according to the following table:
CBE attribute |
Enterprise Console attribute |
---|---|
sourceComponentId.component |
source (the value is not set if the CBE attribute contains an empty string or the value "N/A") |
sourceComponentId.subcomponent |
sub_source (the value is not set if the CBE attribute contains an empty string or the value "N/A") |
sourceComponentId.location |
fqhostname (the value is only set if sourceComponentId.locationType is "FQHostname") |
sourceComponentId.location |
hostname (the value is only set if sourceComponentId.locationType is "Hostname") |
sourceComponentId.location |
origin (the value is only set if sourceComponentId.locationType is "Devicename") |
Table 2. Mapping of sourceComponentId attribute from a CBE event to a Enterprise Console event
Note:
If present in the type for the event class in the rule base, this field is copied from the CBE event to the Enterprise Console event.