OVNM 5.3 - Operations Agent for NonStop Event Management Guide for UNIX

HP NonStop Event Management System 23
Consumer, Forwarding, and Printing Distributors
In general, you can initiate and terminate consumer, forwarding, and printing distributors as needed. When you
initiate a distributor, you can (in some cases, must) provide:
• The source of the event messages you want the distributor to process: the current primary or alternate
collector log files (on a local or remote node) or a specific log file.
• The destination of event messages selected by the distributor (a display device, an EMS collector on
another node, or a management application)
• The generation time stamp of the earliest event message you want the distributor to process (or none, if you
want only the most recent event messages)
• The filter or filters you want the distributor to use to select event messages to be send to the destination
• The burst detection and suppression (BDS) criteria you want the distributor to use
Not all option combinations are allowed and commonly used.
Compatibility Distributor ($Z0)
The compatibility distributor provides continuity between EMS and the prior console message mechanism and
allows message viewing during system load. $Z0 is the only mechanism for viewing messages during system
load.
Because its purpose is so specialized, the compatibility distributor is not initiated and controlled in the same way
as other types of distributors. You can configure the compatibility distributor only during system generation, and
only one compatibility distributor is allowed per system (node). The distributor can be stopped by the CDISTSTOP
option of the EMSCCTRL utility.
2-2-6 EMS Filters
Every EMS collector and distributor (except the compatibility distributor) can use one or more filters to determine
whether to forward specific event messages to their destinations. These filters can select messages in a way that
is as detailed and complex as you want. For example, you can design an alternate collector that filters out all
events of a certain type from its event log, a forwarding distributor that forwards only critical event messages, a
printing distributor that prints only action event messages, and a consumer distributor that returns only Pathway
event messages.
EMS collectors and distributors can use three types of filters.
Compiled Filters
You generate compiled filters from filter source statements contained in an EDIT file written in the Event
Management Service Filter (EMF) language. You then compile this filter specification to create the filter, which is
returned as an object file.
Filter Tables
Filter tables are EDIT files you load into a collector or distributor. These tables are automatically converted to an
object representation that is then evaluated for each event by a collector or distributor.
Burst Filters
Burst filters are filter tables that contain burst detection and suppression (BDS) configuration parameters. These
parameter directives are saved in an EDIT file, which the collector or distributor converts to a filter object like they
do for standard filter tables. When you add a burst filter to a collector or distributor, as a startup parameter or
through the SPI ADD command, all event bursts that conform to the BDS configuration parameter values in the
filter are suppressed.
Compared to compiled filters, filter tables (including burst filters) simplify the process of filter installation and
modification. You can use filter tables instead of or combined with compiled filters. Because a compile step is not
required, they are easier to maintain. Filter tables are especially useful when you need to filter events by
relatively simple criteria (for example, subsystem owner, subsystem ID, and event number) or when you need
frequent and fast online updates of filter contents.
To make a filter for a collector or distributor, create an EDIT file containing the filter language constructs that
express your selection criteria. For a compiled filter, you then use the filter-language compiler (EMF) to generate
an object file suitable for loading to the collector or distributor. After the filter specification is loaded, the collector
or distributor uses it to decide whether to pass each event message to its destination. The EMF compiler does not
compile filter tables and burst filters. The collector or distributor converts them when they are loaded.
HP NonStop Event Management System