The NOTIFY_EVENT is generated based on the LOGErrorLvl event. If the
event were not generated, there would be no related NOTIFY_EVENT. The
is based on PKM for Event Management Recovery action executed based on
Command defined for the Standard Event 11 generated when LOGErrorLvl goes
If you are feeding into BPPM you should see one event, if not which event do you want to keep, and what and how are you feeding your patrol events?
Sent from my iPhone
1 of 1 people found this helpful
If memory serves me right the LOGErrorLvl event triggers the notify event.
Changing the thresholds for LOGErrorLvl would leave you without any event so it is Both or none…
Hi Jonathan Coop,
I want to keep the alerts:
"NOTIFY_EVENT Message: <the message that I have configured>"
But now I'm a bit confuse about the answers, everyone says different things...
On the PATROL side, LOGErrorLvl is the base event off which the NOTIFY_EVENT
is generated if you're using
PKM for Event Management. There is no way to prevent the LOGErrorLvl event
from being generated. Without
this event, there would be no associated NOTIFY_EVENT.
If you're using a Notification Server, only the NOTIFY_EVENTS are forwarded
to the Notification Server. So if
you use the Notification Server to integrate with BPPM, only the
NOTIFY_EVENTS will be forwarded to the
Impact Manager Cell.
With newer versions of PatrolAgent and direct integration (i.e. not going
through BII4P), there may be some
filtering that can be used to send only NOTIFY_EVENT events.
I hope this helps.
I have the same question and the answers below do not seem to answer the question.
Where is the "Alarm #2 of global parameter 'LOGErrorLvl' triggered on <Log Instance name>" event being generated?
LOGErrorLvl is a parameter in PKM for Log Management (I think it’s in LOGMON.km). This parameter is used to generate the Alarm or Warning when a string is found in a monitored log file matches the pattern that’s contained in the monitoring definition. Let me know if you need more clarification. Essentially, the way PKM for Log Management works is to look for a defined pattern and if it’s found, set LOGErrorLvl to Alarm or Warning based on the definition.
I hope this helps.
Garland, Thanks for the input on the Log KM but that is not the issue here.
The issue is that I was seeing two events within BPPM. I believe now that one the events I am seeing 'NOTIFY_EVENT' is being generated by the Event management KM running on the patrol agent. The second alert looks to be the actual event coming from the patrol agent?
Let me try to explain:
One of the things that exists inside each PATROL Event Classe is a “Notification Command”. I’m pretty sure this mechanism has been in existence since the beginning of PATROL time, certainly since I started working with PATROL in 1996. I believe the intent was to provide a mechanism to execute code to provide an actual notification (i.e. send an e-mail, page, etc…) or even execute code to address an issue (similar to a recovery action). PKM for Event Management leverages this mechanism in order to deliver Notifications and perform PKM for Event Management Recovery actions. A block of PSL code has been inserted into the “Notification Command” for each and every event class for which PKM for Event Management Notification Commands and Recovery Actions should be executed. This is essentially the interface between PKM for Event Management and the PatrolAgent and it’s the basis for all of the good stuff the PKM for Event Management is able to accomplish.
In your case, PKM for Log Management initiates a Standard Event 11 (parameter crosses a defined threshold) for LOGErrorLvl. When this happens, the Standard Event 11 notification command is executed, which results in the NOTIFY_EVENT. This happens because a PKM for Event Management rule in pconfig is configured to generate a Notification for LOGErrorLvl.
If you take a look in StdEvents.ctg (I think you can do it with a text editor but it’s ugly, using a PATROL Classic Developer Console is easier to look at), you’ll see the PSL code that I mentioned above.
To the best of my knowledge, there is nothing that documents this. It’s just the way it works.
I hope this helps.
Garland, Thanks again, and we are too old hands at this and I do have a lot of the same understanding of the product that you do. You are trying and are going above and beyond here and thank you. I understand PSL very well as I have one routine that is 12 pages. We are on the same page, but you covered a number of bases that I did not.
I thought you asked where the NOTIFY_EVENT comes from. I tried to answer that. Maybe I misunderstood your question.
I’ll take another stab at this. I believe the two events are:
NOTIFY_EVENT comes from PKM for Event management
PATROL Alert is the Standard Event 11 for LOGErrorLvl. This event causes PKM for Event Management to generate the NOTIFY_EVENT.
If that’s not what you’re asking, then I don’t have any idea what you’re looking for.
We are on the same page Garland.