Elements

The probe breaks event data down into tokens and parses them into elements. Elements are used to assign values to ObjectServer fields; the field values contain the event details in a form that the ObjectServer understands.

During installation of the probe, several rules files are installed in addition to the main message_bus.rules file. These files contain default rules for specific event sources that can be included in the main rules file. The following table lists these files and the format of their event sources.
Table 1. Additional rules files
Rules file Event source format
message_bus_cbe.rules

Common Base Event (CBE)

message_bus_netcool.rules

Netcool®

message_bus_wbe.rules

WebSphere® Business Event (WBE)

message_bus_wef.rules

WSDM Event Format (WEF)

The probe can create different elements based on the XSLT file of an event source. The following table describes the elements that the probe generates. Not all the elements described are generated for each event. The elements that the probe generates depend on the event type.

Table 2. Elements

Element name

Element description

$Acknowledged

This element indicates whether the alert has been acknowledged. Alerts can be acknowledged manually by a network operator or automatically by a correlation or workflow process.

$Agent

This element displays the agent information.

$AlertGroup

This element shows the descriptive name of the type of failure indicated by the alert.

$AlertKey

This element displays the descriptive key that indicates the managed object instance referenced by the alert.

$Class

This element identifies the class of the XML event source from which the alert was generated. The $Class controls the applicability of context-sensitive event list tools.

$Customer

This element displays the name of the customer affected by this alert.

$EventId

This element displays the ID of the event.

$ExpireTime

This element contains the number of seconds from the time an alert was last received by the ObjectServer (stored by the LastOccurence field) until it is cleared automatically. This element is used by the Netcool/OMNIbus Expire automation.

$ExtendedAttr

This element displays the extended attribute type of the managed entity. The probe groups the respective elements based on their parent-child relation; and then sorts all the elements in the parent and child sections by their associated values.

$FirstOccurrence

This element contains the time in seconds (from midnight Jan 1, 1970) when this alert was created or when polling started at the probe.

$Flash

This element indicates whether the option to make the event list flash is enabled.

$Grade

This element indicates the escalation status for the alert.

$Identifier

This element contains the identifier information of the alert.

$InternalLast

This element displays the time when the alert was at the ObjectServer.

$LastOccurrence

This element contains the time when this alert was last updated at the probe.

$LocalNodeAlias

This element displays the alias of the network entity indicated by the alert. For network devices or hosts, this is the logical (layer-3) address of the entity, or another logical address that enables direct communication with the XML event source. Use it in managed object instance identification.

$LocalPriObj

This element displays the primary object referenced by the alert.

$LocalRootObj

This element displays an object that is equivalent to the primary object referenced in the alarm. Use it in managed object instance identification.

$LocalSecObj

This element displays the secondary object referenced by the alert.

$NmosCauseType

This element displays the type of the cause that triggered the alert.

$NmosObjInst

This element shows the populated details of the alert.

$NmosSerial

This element displays the serial number of a suppressed alert.

$Node

This element identifies the managed entity from which the alert originated.

$NodeAlias

This element displays the alias of the node. For network devices or hosts, this should be the logical (layer-3) address of the entity. For IP devices or hosts, this should be the IP address.

$OwnerGID

This element displays the group identifier of the group that is assigned to handle this alert. The default is 0, which is the identifier for the public group.

$OwnerUID

This element shows the identifier of the user who is assigned to handle this alert. The default is 65534, which is the identifier for the nobody user.

$PhysicalCard

This element displays the card name or description indicated by the alert.

$PhysicalPort

This element displays the port number indicated by the alert.

$PhysicalSlot

This element displays the slot number indicated by the alert.

$Poll

This element displays the time (in seconds) the probe has polled for the alert.

$ProcessReq

This element indicates whether the alert should be processed by Netcool/OMNIbus.

$RemoteNodeAlias

This element displays the network address of the remote network entity. Use it in managed object instance identification.

$RemotePriObj

This element displays the primary object of a remote network entity referenced by an alarm. Use it in managed object instance identification.

$RemoteRootObj

This element displays an object that is equivalent to the remote entity's primary object referenced in the alarm. Use it in managed object instance identification.

$RemoteSecObj

This element displays the secondary object of a remote network entity referenced by an alarm. Use it in managed object instance identification.

$resync_event

This element indicates whether the current event was received by the probe during resynchronization of active alarms with the target system.

$ServerName

This element displays the name of the originating ObjectServer. The Gateway for Message Bus uses it to control propagation of alerts between ObjectServers..

$ServerSerial

This element displays the serial number of the alert on the originating ObjectServer.

$Service

This element displays the name of the service affected by this alert.

$Severity

This element indicates the severity level of the alert. It provides an indication of how the perceived capability of the managed object has been affected. The color of the alert in the event list is controlled by the severity value.

$StateChange

This element indicates the state change of the alert. It is an automatically maintained ObjectServer timestamp of the last insert or update of the alert from any XML event source.

$Summary

This element contains the summary information on the cause of the alert.

$SuppressEscl

This element displays the suppression level manually selected by operators from the event list.

$Tally

This element shows the number of times that the alert has occurred.

$TaskList

This element indicates whether an operator has added the alert to the Task List.

$Type

This element identifies the alert type.

$URL

This element displays an optional URL, which provides a link to additional information in the XML event source.

$X733CorrNotif

This element displays a listing of all notifications with which this notification is correlated.

$X733EventType

This element indicates the alert type.

$X733ProbableCause

This element the indicates probable cause of the alert.

$X733SpecificProb

This element indicates the probable cause of the alert.