IBM Enterprise Console, Manual

Page: 120 / 194

Event Class Default Severity
NFS_No_Response WARNING
NIS_No_Response WARNING
Server_OK HARMLESS
NFS_OK HARMLESS
NIS_OK HARMLESS
Default Rules
The UNIX log file adapter has a set of default rules that can be installed to
enhance event server operation. Rules can enable the server to perform functions
such as deleting events and sending e-mail to alert administrators of an unresolved
problem. The rules are contained in the log_default.rls file and perform the
following functions:
v
Duplicate events of the following classes are filtered out and the first event
repeat count is incremented:
– Printer_Paper_Out
– Printer_Toner_Low
– Printer_Offline
– Printer_Output_Full
– Printer_Paper_Jam
– Printer_Door_Open
v
Printer assistance can be called for when a printer condition persists for a period
of time greater than 90 seconds. If any of the following conditions persist for
that period of time, an e-mail message is sent to the e-mail alias tec_print in
order to request assistance with the printer condition. (The tec_print alias must
be added to the e-mail alias file before the messages can be delivered.)
– Printer_Paper_Out
– Printer_Toner_Low
– Printer_Offline
– Printer_Output_Full
– Printer_Paper_Jam
– Printer_Door_Open
v
When a printer condition is cleared, the event server automatically closes the
event that indicated a problem. If e-mail was sent out notifying the
administrators of the printer problem, the server sends e-mail indicating the
condition has cleared up.
v
The Su_Success and Su_Failure events indicate that a user attempted to use the
su
command. If a Su_Success event is received within 90 seconds of the
Su_Failure event, the server assumes that the Su_Failure was a mistake and
downgrades the event to HARMLESS and closes the Su_Failure event. The
rules ensure that these two events are related by checking that they occurred on
the same host, the user attempting this was the same, and the user that they
were trying to change to was the same.
v
Some of the log file events are relevant for a short amount of time. The
administrators also do not want to be burdened with closing these events
manually. A rule is provided that closes the following event classes after one
108
IBM Tivoli Enterprise Console: Adapters Guide