CORE_EVENT base event class

adapter_host

STRING

Name of the host where the adapter that sent the event is running

administrator

STRING

Identification of the user that last modified the event, as user@host or package:rulename

date

STRING

If empty, when entering the cell, it is set as textual format of data_reception, as defined with the parameter DateFormat

date_reception

INTEGER
representation = date

Timestamp as set by the source of the event

If not set by the source, on its arrival at a cell, its value is set to the value of incident_time. If there is no incident_time value, its value is set to the mc_arrival_time value.

duration

INTEGER
parse = no

Elapsed time, in seconds, from event creation to the time the event was closed

event_handle

INTEGER
parse = no

Event identifier in the local cell

mc_abstracted

LIST_OF INTEGER
parse = no

System reserved

mc_abstraction

LIST_OF INTEGER
parse = no

System reserved

mc_account

STRING

Identifies the account associated with the event

mc_acl

LIST OF STRING
parse = no

Controls write and execute access to events when read access is provided by the collector

mc_action_count

INTEGER

Number of actions performed on the event

mc_arrival_time

INTEGER
representation = date

Timestamp when the event arrived at the network at either an adapter or a cell

Its value is never zero (0).

mc_associations

LIST_OF STRING
parse = no

System reserved

mc_bad_slot_names

LIST_OF STRING

List with names of slots that could not be set when the event was reserved
This can be a non-existing slot or a slot with an invalid value.

mc_bad_slot_values

LIST_OF STRING

Corresponding values of the bad slots

mc_cause

INTEGER
parse = no

System reserved

mc_client_address

STRING
parse = no

Network address of the host where the adapter that sent the event is running

mc_collectors

LIST_OF STRING

System reserved

mc_date_modification

INTEGER
representation = date

Timestamp of last modification of certain slots
The slots are those included in mcell.modify.

mc_effects

LIST_OF INTEGER
parse = no

System reserved

mc_event_category

MC_EVENT_CATEGORY

High-level normalized category of the object the event represents based on an appropriate Information Technology Infrastructure Library (ITIL) core process. Possible categories are as follows:

• SLA_MANAGEMENT
• CAPACITY_MANAGEMENT
• SERVICE_CONTINUITY_MANAGEMENT
• AVAILABILITY_MANAGEMENT
• INCIDENT_MANAGEMENT
• CONFIGURATION_MANAGEMENT
• RELEASE_MANAGEMENT
• PROBLEM_MANAGEMENT
• CHANGE_MANAGEMENT
• OPERATIONS_MANAGEMENT
• SECURITY_MANAGEMENT
• FINANCIAL_MANAGEMENT

• SERVICE_DESK_MANAGEMENT

mc_event_model_version

STRING
Default = 1.1.00

Denotes the version of the event model that instantiates the event. The event model version is in the format major_version.minor_version.service_version required for compatibility purposes.

mc_event_relations

LIST_OF STRING
parse=no,
hidden=yes

A list of tuples is as follows:

• The first element of the tuple contains the relation type.

• The second element is the mc_ueid of the related event.
  
  This slot links a source event to one or more related events.

mc_event_subcategory

MC_EVENT_SUBCATEGORY
Default = OTHER

Subcategory of the object the event represents based on an appropriate Information Technology Infrastructure Library (ITIL) core process. Possible values are as follows:

• OTHER
• APPLICATION
• DATABASE
• NETWORK
• SYSTEM

• USER_TRANSACTIONS

mc_history

LIST_OF STRING

System reserved

mc_host

STRING

Fully qualified name of the host on which the problem occurred

mc_host_address

STRING

Network address corresponding to the mc_host slot

mc_host_class

STRING

Type of host

This field is important to implementing generic actions, such as rebooting a computer on which a problem has occurred. In the background, a generic action can be translated into a specific action based on this field.

INTEGER
hidden=yes

mc_incident_report_time

INTEGER
representation = date

Date and time when the event was reported (represented as a timestamp)
If there is a chain of reporters, the timestamp indicates the time when the event was reported to the first reporter.

mc_incident_time

INTEGER
representation = date

Timestamp corresponding to the time at which the incident causing the event occurred
Its value is zero (0) if the time unknown. This timestamp can be set by an adapter or a gateway.

mc_local_reception_time

INTEGER
representation = date

Timestamp when the event arrived in the local component

It is never zero (0).

mc_location

STRING

Location at which the managed object resides

mc_long_msg

STRING

Expands the information in msg

mc_modhist

LIST_OF STRING

System reserved. Contains the history during propagation of an event modification from one Cell to following Cells. Used to detect modification propagation loops.

mc_notes

LIST_OF STRING

List of free text annotations added to the event

The contents of this slot is implementation-dependent. Rules or users must not rely on a particular value in this slot.

mc_notification_history

LIST_OF STRING

Indicates the status of the event with respect to the notification system over time

mc_object

STRING

Sub-component of the host to which the event is related

For example, it could be the name of the disk on which the event is reporting the problem.

mc_object_class

STRING

Identifies the class of an object

If the object class cannot be derived from the original event, it must be filled in during enrichment.

mc_object_owner

STRING

Identifies the owner of the source component

mc_object_uri

STRING

Address used to cross-launch directly to the component

mc_operations

LIST_OF STRING

Slot containing a list of operation history entries

mc_origin

STRING

Event management system that is closest to the source of the event as possible

For example, if an event originates from an agent, is forwarded to HP OpenView IT/Operations, and is then received by the cell, the name of the agent would be the mc_origin, and the name of the HP ITO instance would be the mc_tool.

If this is only a two-layer implementation, mc_origin might have the same value as mc_tool.

mc_origin_class

STRING

Identifies the event management system type

This slot might have the same value as the mc_tool_class slot if this is only a two-layer implementation.

mc_origin_key

STRING

Unique key that the originating tool used to enumerate the event

If this is only a two-layer implementation, mc_origin_key might have the same value as the mc_tool_key.

mc_origin_sev

STRING

Severity as given by the mc_origin slot

If this is only a two-layer implementation, mc_origin_key might have the same value as mc_tool_sev.

mc_original_priority

MC_PRIORITY
parse=no

Records the original priority of the event upon insertion to the cell, which is needed to determine whether an event has been escalated or de-escalated

mc_original_sev

mc_original_severity

SEVERITY
parse=no

Records the original severity of the event to determine whether the event's severity has been modified

mc_owner

STRING

Current user assigned to the event

mc_parameter

STRING

Name of the metric or property that went into alarm or that triggered the event

mc_parameter_threshold

STRING

Threshold value that was crossed to cause the generation of the event

mc_parameter_unit

STRING

Unit description of the metric

mc_parameter_value

STRING

Actual value of the parameter

mc_priority

MC_PRIORITY
Default = PRIORITY_5

Current priority of the event. Following are the possible values:

• PRIORITY_5 (lowest priority)
• PRIORITY_4
• PRIORITY_3
• PRIORITY_2

• PRIORITY_1 (highest priority)
  
  When the value of the update_impacting_event_mc_priority slot of the SIM_KB_OPTIONS record is YES, the impact_priority slots of the root cause CIs are copied into the mc_priority slots of the impacting (causal) events, provided that their mc_priority and mc_original_priority slots have the value PRIORITY_5 (default). If the mc_priority or mc_original_priority slots have a value other than PRIORITY_5, when this event becomes an impact (causal) event, its mc_priority is not changed. This avoids interfering with other user rules and policies.
  
  When an event stops impacting the CI, the mc_priority slot of the event is reset to PRIORITY_5, provided that the mc_priority corresponds to the previous impact_priority.
  
  If the impact priority of a CI is modified, the mc_priority of its event is modified accordingly (provided that the mc_priority corresponds to the previous impact_priority).

mc_propagations

LIST_OF STRING
parse = no

System reserved

mc_relation_source

STRING

The mc_ueid of the source event to which this event is related

This slot links a related event to its source event.

mc_service

STRING

Service related to the event

mc_smc_id

STRING

Event is attached to the service impact management component with the specified identifier

mc_smc_impact

MC_SMC_IMPACT
Default = NOT_ELECTED

Indicates whether an event is elected, attached, or has an impact on a service impact management component

• NOT_ELECTED
• ELECTED
• NON_ELECTABLE
• ATTACHED

• IMPACTING
  
  When an event is attached to a CI its mc_smc_impact slot is set to ATTACHED or IMPACTING, if it is also an impacting (causal) event. When an impacting event is no longer impacting, its mc_smc_impact slot is automatically changed from IMPACTING to ATTACHED. When an event is detached its mc_smc_impactslot is changed to ELECTED.

mc_smc_priority

REAL
parse = no

Prioritizes events with respect to their impact on the service model

For every event attached to a service impact management component, the mc_smc_priority slot for the event is set to the raw_impact_status of the service impact management component if all of the following conditions hold true:

• The service impact management component is the root cause of an important component
• The event severity corresponds to the self_status of the service impact management component by using the BMC_SEVERITY_TO_STATUS table

• The self_status of the service impact management component is greater than or equal its status

mc_smc_type

STRING

Value is set to the class of the service impact management component to which the event is attached

mc_timeout

INTEGER

Event timeout in seconds

mc_tool

STRING

For BMC Event Management events, mc_tool represents any event that is within any value that can further distinguish where the event is coming from within an mc_tool_class value.

For example, for the NT Event Log Adapter, mc_tool could be the name of the log to which the incident was logged. If the mc_tool_class is a management tool (such as PATROL or ITO), then the mc_tool must be a string that enables an action on the event to initiate a communication in context with the mc_tool.
For BMC ProactiveNet events, mc_tool contains the fully qualified DNS name of the BMC ProactiveNet Server.

mc_tool_address

STRING

The network address of the Reporter

mc_tool_class

STRING

For BMC Event Management, mc_tool_class represents a user-defined categorization of the tool reporting the event.

For example, the mc_tool_class value for an SNMP adapter could be SNMP. And the mc_tool_class value for an NT Event Log Adapter might be NT_EVLOG.

For BMC ProactiveNet events, mc_tool_class contains the string PNET.

mc_tool_key

STRING

Unique key used by the sending tool to enumerate the event

mc_tool_rule

STRING

Name of the adapter or integration mapping rule that generated the event

mc_tool_sev

STRING

Severity as given by mc_tool

mc_tool_suggestion

STRING

The Reporter's suggested solution to the problem posed by the event. This is similar to expert advice information that other applications provide.

mc_tool_time

INTEGER
representation = date

Date and time (as a timestamp) when the event report was created. The ReportTime value must be read as using the time scale Coordinated Universal Time (UTC) unless a particular time zone or the value Z (Zulu time for UTC) is otherwise specified.

mc_tool_uri

STRING

The address used to cross-launch directly to the Reporter

mc_ueid

STRING

Universal event identifier

When an event is propagated, the receiving cell gets a new local identifier, event_handle, but the event keeps the old universal identifier mc_ueid.

msg

STRING

Text description of the event

repeat_count

INTEGER

Number of copies received from this event

severity

SEVERITY
Default = WARNING

Severity value of the event. Possible values are as follows:

• UNKNOWN
• OK
• INFO
• WARNING
• MINOR
• MAJOR

• CRITICAL

status

STATUS
Default = OPEN

Status value of the event. Possible values are as follows:

• OPEN
• ACK
• ASSIGNED
• CLOSED

• BLACKOUT