Parameter types for Event Adapters

Integer > 0

events

5

Used only if ReadsPerEngine = 1; defines the maximum number of events each adapter generates per poll cycle.

If ReadsPerEngine = 1, records are read until the number of events created equals the value of the EventsPerPoll parameter. Otherwise, the maximum reads per engine per poll cycle is set by the value of the ReadsPerEngine parameter.

Integer > 0

sec

5

Sleep interval during which all adapters are idle

Integer > 0

reads

5

Defines the maximum number of reads each adapter performs per poll cycle. 

If ReadsPerEngine = 1, records are read until the number of events created equals the value of the EventsPerPoll parameter. Otherwise, ReadsPerEngine equals the maximum reads per engine per poll cycle.

File name

None

mcxa.trace

Name of the trace file 

If the name does not contain a path, the trace file is saved to the default trace file directory, installationDirectory\pw\server\tmp\Adapters.

Integer > 0

None

10

Maximum number of renamed trace files that are kept in the trace file directory 

When the number of files exceeds the specified limit, the oldest trace file is deleted. 

To expand the amount of saved trace information, increase the value of one of the following parameters:

• TraceSizeMax (default = 1,000,000)
• TraceFileCount (default = 10)

Integer (0-6)

None

3

Valid values are as follows:

• 0 - Disables all traces
• 1 - Header messages
• 2 - Fatal messages
• 3 - Major errors
• 4 - Minor errors
• 5 - Normal output
• 6 - Verbose output

Integer >= 0

byte

1,000,000

Maximum trace file size 

When the adapter detects that the maximum size is reached, the trace file is closed and renamed mcxa0.trace.

Integer > 0

none

10

Frequency, in number of messages logged, at which the adapter checks the size of the trace file. 

A trace file is archived when it exceeds the size specified with the TraceSizeMax parameter.

Perl module name

Name of the adapter 

This parameter is required. Default values are as follows:

• Engine = MA::ELogfile for any log file management, including UNIX syslog
• Engine = MA::ESnmpTrap for SNMP trap management
• Engine = MA::EEventLog for Perl EventLog for Windows management

The IP Adapter definitions vary slightly, with the inclusion of Adapter:: in the path:

• Engine = MA::Adapter::TcpClient
• Engine = MA::Adapter::TcpServer
• Engine = MA::Adapter::Telnet
• Engine = MA::Adapter::UdpClient
• Engine = MA::Adapter::UdpServer

File name

Map file name 

The map file must be located in the installationDirectory\pw\server\etc directory. Full paths are not accepted. 

Default map name values depend on the adapter type. Default map names are listed in Default MAP files.

File name

Name of a Perl script or Perl module that contains user-defined functions to be used inside the .map file 

The use of this parameter is now deprecated. Use the REQUIRE directive, described in REQUIRE directive, from inside the .map file.

Bool (0-1 )

Indicates whether incoming events that do not match a CLASS described in the map file are mapped to the DEFAULT class 

Valid values:

• 0 - Events are dropped. (This is the default.)
• 1 - Events are mapped to the DEFAULT class.

Cell name

Name of the cell to which events processed by the adapter are sent 

The cell parameters can be found in installationDirectory\pw\server\etc\mcell.dir. 
ServerName can contain the names of several cells, separated by colons, such as Cell1:Cell2:Cell3:.... Events are sent to these cells according to their numerical order. For more information, see mposter and msend.

If ServerName is not defined, events are formatted in BAROC and sent to the standard output.

Recovery time interval, specified in minutes 

Unless ELResendAll is set to 1, an adapter processes events that arrived in the log for the time it was stopped. ELRecoveryIntervalMin prevents processing of old events if the adapter has been stopped for some time. That is, the adapter will process the events that are younger than ELRecoveryIntervalMin. 

Default: 1440 minutes (1 day)

A string that contains the names, separated by a colons, of the event logs the user does not want to read, such as System, Application, or Security

File name

None

Standard input

Full path to the monitored log file 

LogFile supports a single file name. Use several adapter instances to monitor several log files.

Regex

None

\s+

A regular expression, often a character such as " , ", that delimits the attributes of an event when LogRegExpr is empty

Integer > 0

None

10

Number of events after which the log position is saved to disk 

The position file is flushed after the number of incoming log entries reaches the number specified with LogFlushPosPeriod.

Bool (0 - 1)

None

0

Indicates whether to keep or drop empty events or events only constituted by blanks 

Valid values:

• 0 - Drop events.
• 1 - Keep events.

Integer > 0

None

10

Maximum number of log files when log rotation is enabled 

For example, if LogMaxCount=5, <logfile>0--4 are saved. <logfile>i is always newer than <logfile>i+1. If LogMaxCount=-1, all log files are kept.

Integer > 0

Byte

1,000,000

Maximum size of log file, in bytes 

When the LogMaxSize value is reached, the log file is rotated. For more information, see the LogRotate parameter on Specific parameter. If LogRotate=0, LogMaxSize is not used.

String

None

Empty

(UNIX only) name of the process receiving the kill-HUPcommand 

LogProcessName is not used if LogSupportKillHUP=0. See LogSupportKillHUP on Specific parameters.

Bool (0 - 1)

None

0

Indicates whether the whole log file is read the first time the adapter starts 

Valid values:

• 0 - Is not read
• 1 - Is read

Bool (0 - 1)

None

1

Indicates whether an adapter that detects that a log file has changed opens a new log file from the beginning or the end Valid values: 
0 - Opens from the end 
1 - Opens from the beginning

Regex

None

\n

Regular expression, often a simple character or string, that delimits two events.

LogRegExpr 

Regex

None

Empty

Contains a regular expression, in Perl 5 style, used to match an event 

The pattern variables $1, $2, and so on are saved in$<logVarPrefix>1, $<logvarPrefix>2, and so on, and are declared in the INPUT_VARIABLES section of the .map file. 

$<logVarPrefix>0 contains the whole pattern. $completecontains the whole string between two LogRecordSeparator parameters. 

If the regular expression matches the whole string between two LogRecordSeparator parameters, both $complete and$<logVarprefix>0, contain the whole event. 

If LogRegExpr is empty ( logRegExpr="" ),LogFieldSeparator is used instead.

Bool (0 - 1)

None

1

Indicates whether matching with the LogRegExpr parameter is performed globally 

Matching is global when you use the /g modifier of a Perl regular expression. In this case, the pattern is applied as many times as possible to the string. Each time the pattern matches, it is stored in $<logvarPrefix><n> variables, as explained in LogRegExpr on Specific parameters. For example, if LogRegExpr="\w+" and LogRegExprGlobal=1, every word of the event is stored in $<logvarPrefix><n>variables ( n>=1 ).

LogRememberPos 

Bool (0 - 1)

None

0

Indicates whether the adapter persistently remembers the position of the last log entry 

Valid values:

• 0 - Does not remember position
• 1 - Remembers position

LogRotate 

Bool (0 - 1)

None

0

Indicates whether a new log file is created when the size of the log file surpasses the value of the LogMaxSize parameter 

If a new log file is created, the old logfile is renamed or deleted, depending on the value of LogMaxCount. If the old log file is kept, it becomes <logfile>0[eventadapter90trial:.<ext>], <logfile>0[eventadapter90trial:.<ext>] becomes <logfile>1[eventadapter90trial:.<ext>],... and <logfile><logMaxCount>[eventadapter90trial:.<ext>] is deleted if the value ofLogMaxCount is different from -1.

Bool (0 - 1)

None

1

Indicates whether the part of the log file that has not been consumed is considered as being appended to the beginning of the newer log file, when the log file is replaced 

Valid values:

• 0 - Not appended
• 1 - Appended

Integer > 5

sec

15

Indicates whether the adapter regularly performs the stat command to check whether the log file exists, to check its i-node on UNIX platforms, or to check whether its size has not decreased on Windows platforms

LogSupportKillHUP 

Bool (0 - 1)

None

0

(UNIX only) If LogSupportKillHUP=1, a kill -HUP command is launched on LogProcessName at each rotation of the log file. Note that if LogSupportKillHUP=0 and LogRotate=1, it is important to ensure that the process that generates the events can detect the rotation.

String

None

"varlog"

Prefix of the input variables that corresponds to the matching of the event variables $<logVarPrefix>0 to$<logVarPrevix><n>, where <n> is the maximum number of matches. 

The prefix must be defined in the INPUT_VARIABLES section of the .map file. Alternatively, the notation$<logVarPrefix>0-i can be used to match any arbitrarily long list of patterns.

File name

Name of the .dat file that contains information used to translate incoming traps If the parameter value is a relative path, the file must be located in the installationDirectory\pw\server\etc directory. The .dat file is an enhanced version of the old .oid file. It can contain additional information to map enumerations and to extract indexes. This file contains the results of the output of the cell's mib2map tool. Do not attempt to create this file manually. 

Default: mcsnmptrapd.dat

Bool (0-1 )

Starts and stops index extraction, mainly for performance purposes By default, the indexes, such as the suffixed dotted numbers of the object identifiers (OIDs), are extracted and stored in the special $idxinput variable. $idx is a reference on a list of lists. 

Valid values:

• 0 - Starts
• 1 - Stops

IP address

Specifies which interface to use on a computer with two or more interface cards

File name

Name of the file containing translations from SNMP OIDs to strings 

If the parameter value is a relative path, the file must be located in the installationDirectory\pw\server\etc directory. The use of SnmpOIDFile is now obsolete. Use the complete SnmpDatFile parameter instead. 

Default: mcsnmptrapd.oid

Integer > 0

Port of the UDP SNMP server 

Default: 162

Integer > 0

Initial value of the buffer that receives SNMP traps 
\ Default: 8192 Use the SnmpTrapLength parameter default setting. If you must modify it, be aware that an MC_ADAPTER_ERROR will occur if the SnmpTrapLength value is smaller than the actual size of the trap.