[Contents] [Prev] [Next] [Index] [Report an Error]

Capturing and Using Event Details

When an event script is triggered by an event policy, the initiating event policy forwards a set of event details to the triggered event script. These event details can be captured, evaluated and sent to log files as required.

Two types of event details are returned, triggered events and received events. Triggered events record the details of the event that triggered the policy. Received events record the details of events that happened before the triggering event. Event details are forwarded to the Event Script as XML in the following format:



<event-script-input>
     <trigger-event>
          <id>event id</id>
          <type>event type</type>
          <generation-time>time stamp</generation-time>
          <process>
               <name>process name</name>
               <pid>pid</pid>
          </process>
          <hostname>Hostname</hostname>
          <facility>Facility string</facility>
          <severity>Severity string</severity>
          <attribute-list>
               <attribute>
                    <name>Name of the attribute</name>
                    <value>Value of the attribute</value>
               </attribute>
               </attribute>
          </attribute-list>
     </trigger-events>
     <received-events>
     <received-event>
          <id>event id</id>
          <type>event type</type>
               <generation-time>time stamp</generation-time>
               <process>
                    <name>process name</name>
                    <pid>pid</pid>
               </process>
               <hostname>Hostname</hostname>
               <facility>Facility string</facility>
               <severity>Severity string</severity>
               <attribute-list>
                    <attribute>
                         <name>Name of the attribute</name>
                         <value>Value of the attribute</value>
                    </attribute>
                </attribute-list>
          </received-event>
     <received-events>
</event-script-input>

The section Limiting Event Script Output Based on a Specific Event Type shows one method for using event details.

[Contents] [Prev] [Next] [Index] [Report an Error]