TEC Task Library - Event_Query

Queries the event repository and shows event details in the output of the task's results.

Perform the following steps to configure the task:

  1. Select Event_Query from the TEC Tasks list in the Task Execution dialog box. The configuration options for the task are displayed in the right pane.
  2. In the right pane, navigate through following fields and type or select values to use as selection criteria to match events in the query. All of the options let you manually enter text, including the asterisk (*) wildcard character to specify the values for an attribute. If you manually enter multiple values for an option, separate each with a comma. Some of the options also provide a push button to display a scrolling list from which to select one or more values.
    Match Class
    The event class.
    Match Status
    The event status.
    Match Severity
    The severity of an event.
    Match Hostname
    The name of the system on which an event occurred.
    Match Source
    The source of an event; for example, LOGFILE is the source name for events generated by the UNIX logfile adapter.
    Match SubSource
    A further categorization of source.
    Match Origin
    The protocol address or host name of the source system.
    Match SubOrigin
    A further categorization of origin.
    Match Message
    The message text of the event. When specifying more than one message, enclose the entire value for the Match Message text box with one type of quote (for example, double quotes), and enclose each individual message within a different type of quote (for example, single quotes) separated by a comma. For example:
    "'msg text1','msgtext2'"

    To specify all messages, use the * wildcard character.

    Starting Date and Time
    The starting date and time specifies to query events received from this point to the present. To enter a starting point, use the following format:
    mon dd hh:mm:ss yyyy

    For example, Jan 01 00:01:01 2001.

    To query all events, enter the * wildcard character.

  3. Click the Ascending or Descending radio button to specify the sort order of output results. Ascending lists the oldest event first. Descending lists the most recent event first.
  4. By default, all base event attributes are displayed in the output from the task. (Indicated by the * wildcard character in the read-only text box adjacent to the Attributes button.) To specify a particular set of base event attributes to show in the output, press the Attributes button. Select the appropriate attributes; then, press the OK button. The selected attributes are displayed in the read-only text box adjacent to the Attributes button.

Assumptions and Prerequisites

Authorization Required

RIM_view, super, senior, admin, user

Command-Line (CLI) Execution

This task can be executed from the command line.

See Also