Event data and severity mapping
Select how much event data the Send events to Syslog server event action includes in the forwarded messages. The severity level is always included in the forwarded message. Use the severity mapping information to determine how the severity level of the stored message on the syslog server corresponds to the severity level of the original IBM® Flex System Manager event.
Event data
Specify how much event data are included in messages forwarded to the syslog server by selecting either Main event data or All event data.- Main event data
- Main event data includes the following data:
- The management node IP address or host name
- The event ID
- The event message
- The name of the resource that generated the event
- The severity level of the event
- The localized date and time that represent when the event occurred
- The category of the event (Alert or Resolution)
- The fully qualified representation of the event type
- The component category
- The component instance
- The condition type
- The condition value
- All event data
- All event data includes the same data as main event data plus
the following data:
- The time zone of the management node
- The source application, which is IBM Flex System Manager
- The version of IBM Flex System Manager
- The name of the resource that sent the event, which might be different from the source value when the event is forwarded or transmitted through an intermediate system
- The unique ID of the event sender
- The unique ID of the event
- Any additional details, as available
Severity mapping
The Send events to Syslog server event action maps received IBM Flex System Manager events of a given severity to a corresponding syslog severity level. The result of this mapping is that the event in the IBM Flex System Manager log has a different severity level than event in the syslog server log. Use the following table to determine how the severity levels of IBM Flex System Manager events correspond to severity levels of the corresponding events in the syslog server log.
| Severity of an IBM Flex System Manager event | Severity of the corresponding event sent to the syslog server | ||
|---|---|---|---|
| 0 | Fatal: The source of the event caused the program to fail; resolve before restarting the program | 1 | Alert: Take action immediately |
| 1 | Critical: The source of the event might cause the program to fail; resolve immediately. | 2 | Critical: Critical condition |
| 2 | Minor: The application that issued the event assigned a severity level that indicates that the source of the event should not cause immediate program failure; resolve | 3 | Error: Error condition |
| 3 | Warning: The source of the event might not be problematic but warrants investigation. | 4 | Warning: Warning condition |
| 4 | Harmless. The event was generated only for informational purposes. Most events of this severity do not indicate potential problems. | 5 | Notice: Normal but significant condition |
| 5 | Unknown. The application that generated the event did not assign a severity level; however, these events might indicate potential problems. | 6 | Informational: Informational message |
Additional information
IBM i message events have several keywords listed such as Message type and Message severity. The following table lists the possible values and meanings for the Message type keyword.
| Value | Message Type |
|---|---|
| 01 | Completion |
| 02 | Diagnostic |
| 04 | Informational |
| 05 | Inquiry |
| 06 | Sender's copy |
| 08 | Request |
| 10 | Request with prompting |
| 14 | Notify, exception already handled |
| 15 | Escape, exception already handled |
| 16 | Notify, exception not handled |
| 17 | Escape, exception not handled |
| 21 | Reply, not checked for validity |
| 22 | Reply, checked for validity |
| 23 | Reply, message default used |
| 24 | Reply, system default used |
| 25 | Reply, from system reply list |
| 26 | Reply, from exit program |
The Message severity is the value of the severity code which is a number from 0 to 99. The Message severity is much like the severity of a message on the Severity page in the Event Filter Builder window, except on the Severity page the severity is a mapping of the number to a keyword.
Severity
IBM Flex
System Manager maps the message event. Messages of type inquiry are
WARNING.
All other types of message are mapped based on the severity of the messages.
if msg severity < 10 then HARMLESS
else msg severity < 20 then WARNING
else msg severity < 30 then MINOR
else msg severity < 80 then CRITICAL
else msg severity is FATAL
