Page tree
Skip to end of metadata
Go to start of metadata

Event groups are sets of events that are organized in meaningful groups for better manageability.

Best Practice

  • To mitigate performance impact, observe the following guidelines:
    • Do not create more than five levels in an event group hierarchy.
    • At any hierarchical level, create a maximum of 25 event groups.
    • Ensure that the total number of event groups is equal to or less than 50.
  • When creating an event group, avoid complex pattern-matching conditions on slot contents and use narrowly-defined classes rather than complex Where clauses.

To create an event group

  1. Log on to the TrueSight console.
  2. In the navigation pane, expand Monitoring and select Events
  3. In the Events page, click the View event groups icon
  4. In the Event Groups page, click the main action menu and select Create Event Group.
  5. Specify a name for the event group.
  6. Select a parent for the event group:
    1. Click Select Parent Group.  

    2. Navigate through the hierarchy of event groups and select the event group that you want to set as parent and click OK.

      Note

      By default, Event Groups is the root or topmost level of event group.

  7. Specify the filtering criteria for the event group:
    1. From the Class list, select the type of event.
    2. Select the event attributes and comparison operators that are listed in Slots.

    Note

    Filtering criteria that are associated with the parent event group are already applied to the child event group. The inherited criteria is displayed in gray color.


    For more information about event classes and slots, see  How event classes are structured  .

     For information about comparison operators, click here.

    Comparison operators

    OperatorDescriptionSlot types
    ==Events are listed only if the slot value matches the comparison value.

    Enum, String, Number, List of String

    !=Events are listed only if the slot value does not match the comparison value.Enum, String, Number, List of String
    >Events are listed only if the slot value is greater than the comparison value.Enum, String, Number
    <Events are listed only if the slot value is less than the comparison value.Enum, String, Number
    >=Events are listed only if the slot value is greater than or equal to the comparison value.Enum, String, Number
    <=Events are listed only if the slot value is less than or equal to the comparison value.Enum, String, Number
    Has prefixEvents are listed only if the slot value starts with the comparison value.String, Number
    Has suffixEvents are listed only if the slot value ends with the comparison value.String, Number
    ContainsEvents are listed only if the slot value contains the comparison value.String, Number, List of String
    WithinEvents are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.String, Number, List of String
    Contains one ofEvents are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.String, Number, List of String
    OutsideEvents are listed only if the slot value does not match with any of the comma-separated list of comparison values.String, Number
    Matches

    Events are listed only if the slot value contains the comparison value.

    You can provide the following parameters in addition to the comparison value:
    %d - decimal integer number
    %f - floating point real number
    %c - single character
    %s - string value

    Consider the following example values in the message slot of eight events:

    Event 1Memory Consumption - 10 MB – on machine clm-dev-008700
    Event 2CPU utilization 85.35% – on machine clm-dev-007890
    Event 3Memory Consumption - 5 MB – on machine clm-dev-108781
    Event 4CPU utilization 75.95% – on machine clm-dev-087654
    Event 5Memory Consumption – 894  MB – on machine clm-dev-54657
    Event 6CPU utilization 68.45% – on machine clm-dev-37878
    Event 7Consumption of storage space is high on vm-dev-45 machine
    Event 8Utilization taking higher trend

    When you use the matches operator for the message slot:

    • Message matches Consumption – %d
      Events 1, 3, and 5 are displayed, as the following criteria matches:
      Consumption as a constant and an integer variable listed after Consumption.
    • Message matches machine %s
      Events 1, 2, 3, 4, 5, and 6 are displayed as the following criteria matches:
      machine as a constant and a string variable listed after machine.
    String, List of String

    Subclass of

    Events are listed only if they are a subclass or child class of the provided class.Class
    Superclass ofEvents are listed only if they are a super-class or parent class of the provided class.Class

    Note

    • The search is not case sensitive, except for the List of String slot type. For example, an event with slot value "London" is listed when you specify "london" or "London" for an "==" operator.
    • For operations on strings like ">" or "<", the ASCII values of strings are used for comparison.
      For example, if you use the operator ">" when the Message slot has “cell started” and the comparison string is “b”, this event is listed. If the comparison string is “d”, this event is not listed.
    • The slot type number includes integers, floating point, and real numbers.

  8. Click OK

    If you select the topmost level of the event groups, Event Groups, as a parent, it is displayed as [None] in the event group's tile. 


To modify an event group

  1. Log on to TrueSight console.
  2. In the navigation pane, expand Monitoring and select Events. The Events page is displayed
  3. Click the View event groups icon . The Event Groups page is displayed.
  4. From the action menu of the event group that you want to modify, select Edit.

    The Edit Event Group page is displayed.

  5. Modify the event group properties.

    Note:

    If you are editing the properties of a child event group, you cannot modify the filtering criteria that is inherited from the parent. The inherited criteria is displayed in gray color. 

     

  6. Click OK. The Event Groups page is displayed.
  7. Verify the modifications for the event group.

To delete an event group

  1. Log on to TrueSight console.
  2. In the navigation pane, expand Monitoring and select Events. The Event Groups page is displayed.
  3. Click the View event groups icon . The Event Groups page is displayed.
  4. From the action menu of the event group that you want to remove, select Delete.

Note:

When you delete an event group, its child event groups are also deleted.

Where to go from here

Using event groups