Caching events

Edit online

When an event is monitored, the last event for a condition is saved in the LastEvent dynamic attribute of the condition. When caching events is enabled (default), the last event of a condition for each monitored resource is kept in memory by the event response resource manager (ERRM).

Use runact command actions to retrieve the cached events. Descriptions of valid class and resource actions follow:
StatLastEvent
Class action. Displays whether caching is enabled (Status = 1) and how many events are currently saved in the cached. It has no parameters.
QueryLastEvent
Class action. Displays all of the events cached for a particular condition resource since the last time the ERRM subsystem was started. It has no parameters. The output of the action is zero or more structured data values in the form of the LastEvent attribute, one for each saved event.
ResetLastEvent
Class action. Removes events from the caches based on their ages (Age=nn). Saved events older than this age will be removed from the event cache. For example, Age=0 removes all cached events. Age=30 removes all saved events older than 30 days from the event cache.
QueryLastEvent
Resource action. Displays all of the cached events for the selection string specified since the last time the ERRM subsystem was started. It has no parameters. The output of the action is 0 or more structured data values in the form of the LastEvent attribute, one for each saved event.
Sample output of a StatLastEvent class action follows: 

> runact -c IBM.Condition StatLastEvent
Resource Class Action Response for StatLastEvent
sd_element 1:
         Status    = 1
         NumEvents = 400
Sample output of a QueryLastEvent class action follows: 

> runact -c IBM.Condition
QueryLastEvent 
Resource Class Action Response for QueryLastEvent
sd_element 1:
         Occurred        = 1
         ErrNum          = 0
         ErrMsg          = ""
         EventFlag       = 6
         EventTimeSec    = 1218641530
         EventTimeUsec   = 507957
         RsrcHndl        = "0x6009 0xffff 0x180031ae
                            0xe300b8db 0x10bee2df 0x33b20837"
         NodeName        = "c175n06.ppd.pok.ibm.com"
         NumAttrs        = 3
         NumAttrsEvtExpr = 1
         AttrArray       = 11
         ACT_RSP_ELE_11  = "PercentTotUsed"
         ACT_RSP_ELE_12  = 2
         ACT_RSP_ELE_13  = 78
         ACT_RSP_ELE_14  = "Name"
         ACT_RSP_ELE_15  = 8
         ACT_RSP_ELE_16  = "/tmp"
         ACT_RSP_ELE_17  = "NodeNameList"
         ACT_RSP_ELE_18  = 19
         ACT_RSP_ELE_19  = {"c175n06.ppd.pok.ibm.com"}
         ACT_RSP_ELE_20  = 
         ACT_RSP_ELE_21  = 
         ACT_RSP_ELE_22  = 
         ACT_RSP_ELE_23  = 
         ACT_RSP_ELE_24  = 
         ACT_RSP_ELE_25  = 
         ACT_RSP_ELE_26  =
sd_element 2:
         Occurred        = 1
         ErrNum          = 0
         ErrMsg          = ""
         EventFlags      = 1
         EventTimeSec    = 1218641546
         EventTimeUsec   = 371254
         RsrcHndl        = "0x606d 0xffff 0x180031ae
                            0xe300b8db 0x10e9791a 0xc2218e62"
         NodeName        = "c175n06.ppd.pok.ibm.com"
         NumAttrs        = 3
         NumAttrsEvtExpr = 1
         AttrArray       = 11
         ACT_RSP_ELE_11  = "StateSDArray"
         ACT_RSP_ELE_12  = 22
         ACT_RSP_ELE_13  = 20
         ACT_RSP_ELE_14  = "Name"
         ACT_RSP_ELE_15  = 8
         ACT_RSP_ELE_16  = "IBM.Ray01"
         ACT_RSP_ELE_17  = "NodeNameList"
         ACT_RSP_ELE_18  = 19
         ACT_RSP_ELE_19  = {"c175n06.ppd.pok.ibm.com"}
         ACT_RSP_ELE_20  = 2
         ACT_RSP_ELE_21  = 23
         ACT_RSP_ELE_22  = 25
         ACT_RSP_ELE_23  = 1
         ACT_RSP_ELE_24  = -30396368
         ACT_RSP_ELE_25  = 1
         ACT_RSP_ELE_26  = -30396368
Sample output of a QueryLastEvent resource action using the name of a condition follows: 

> runact -s "Name=='/tmp space used'" IBM.Condition QueryLastEvent
Resource Action Response for QueryLastEvent
sd_element 1:
         Occurred        = 1
         ErrNum          = 0
         ErrMsg          = ""
         EventFlags      = 6
         EventTimeSec    = 1218641530
         EventTimeUsec   = 507957
         RsrcHndl        = "0x6009 0xffff 0x180031ae
                            0xe300b8db 0x10bee2df 0x33b20837"
         NodeName        = "c175n06.ppd.pok.ibm.com"
         NumAttrs        = 3
         NumAttrsEvtExpr = 1
         AttrArray       = 11
         ACT_RSP_ELE_11  = "PercentTotUsed"
         ACT_RSP_ELE_12  = 2
         ACT_RSP_ELE_13  = 78
         ACT_RSP_ELE_14  = "Name"
         ACT_RSP_ELE_15  = 8
         ACT_RSP_ELE_16  = "/tmp"
         ACT_RSP_ELE_17  = "NodeNameList"
         ACT_RSP_ELE_18  = 19
         ACT_RSP_ELE_19  = {"c175n06.ppd.pok.ibm.com"}

The event information displayed in the preceding QueryLastEvent action output contains structured data (SD) elements. Each SD element describes a cached event and is based on the event notification structure described in the RSCT: RMC Programming Guide. In the event notification and in the action output, there is a list of attributes and their values that are returned within the event notification. In the action output, the attributes and their values are found in the element fields named ACT_RSP_ELE_nn. The NumAttrs field has the number of attributes in the event. The NumAttrsEvtExpr field indicates how many of the attributes are in the event expression, starting with the first attribute. The AttrArray field indicates the field number of where the attribute array starts.

Each attribute in the attribute list has at least three fields to describe it. First, there is the name of the attribute (PercentTotUsed). Second is its data type (2=CT_INT32). The data types are described in the RSCT: RMC Programming Guide. The third field contains the value of the attribute (78). Depending on the data type of the attribute, there may be more fields or pointers to other fields. If the attribute data type indicates SD type, instead of an attribute value, the third field is a pointer to the field that begins the description of this structured data. Those fields will contain first the number of elements in the structured data followed by the structured data elements. Similarly, if the attribute data type indicates SD array type, instead of an attribute value, the third field is a pointer to the field that begins the description of this structured data array. Those fields will contain the number of elements in the SD array and the fields that point to each SD.

Use the following file to turn off event caching:

/var/ct/cfg/mc.EReventcache

If the file exists and contains ENABLE=1, ERRM will save the last event for each monitored resource. The events will be saved also if the file is not found. If the file exists and contains ENABLE=0, the events will not be saved. This text may be preceded by white space but it must not contain any embedded spaces.

To manage the cache, when an event is triggered, ERRM saves the event in its cache based on the condition and the resource for which it is reported. The cache has, at most, one event per condition or resource. If an event is generated and there already is a cached event for this condition and resource, the event replaces the cached event. The cached events are lost if the ERRM is restarted or if the ResetLastEvent action is run.