Safeguard Management Programming Manual (G06.29+, H06.08+, J06.03+)

Event Management
Safeguard Management Programming Manual—422086-028
8-2
Event-Message Filters
•
Events related to the operation of a process, such as when it is started, when it is
terminated, or when its backup takes over
•
Events that report errors in creating, opening or accessing a file or process
•
Events that report changes to the Safeguard configuration attributes
•
Events that report the details of audit file switches and audit state changes as well
as impending critical audit states
Event-Message Filters
EMS provides the capability of creating programs called filters, which allow
applications to select particular event messages from among those reported. Filters
select messages to be returned to an application by examining the values of tokens in
the messages. For example, to select only event messages reported by the Safeguard
subsystem, a filter would examine the token that contains the subsystem ID of the
issuing subsystem and report only messages containing the Safeguard subsystem ID.
Any of the tokens in an event message can be used for selecting the event messages
to be returned to an application. You can create filters that return only critical event
messages, all event messages associated with a particular device, or all event
messages with a certain event number. The following example illustrates a simple filter
that can be used to select critical Safeguard event messages that have a particular
object as their subject.
The example is based on these assumptions:
•
All Safeguard definitions used in the filter have been loaded into TACL before
compilation.
•
All tokens and subsystems that you have created have been defined and loaded
before compilation.
•
All subsystem IDs that are not initialized in the filter have been initialized by other
means.
For more information about filters, see the EMS Manual.
Example
FILTER critical^SAFEGUARD/SAFEGUARD^msgs
(SSID(subsys^ssid,object^name) REQUIRED);
BEGIN
IF ZSPI^TKN^SSID = SSID(ZSFG^VAL^SSID) THEN
-- This is a SAFEGUARD event message.
IF ZEMS^TKN^EMPHASIS = [ZSPI^VAL^TRUE] THEN
-- This is a critical event message.
IF ZEMS^TKN^LDEVNAME = object^name THEN
-- This message is about the object.
PASS