Device Metrics & Events view

Use the Device Metrics & Events view to create reports about the event data for devices and monitor types. If you have the Show Unmapped events permission, you can also view unmapped events in the reports for this view.The Device Metrics & Events view contains the following folders and conditions:

Attribute

Field name

Description

Attribute Name

Displays name of the attribute.

Attribute Unit Name

Displays unit name of the attribute.

Attribute Unique Name

Displays unique name of the attribute.

Attribute ID

Unique identifier of an attribute.

Attribute StatusFlag field which displays status of the attribute. Indicates whether the device is Active or Deleted.
Attribute Deleted TimeDisplays the time when the attribute was deleted from the Report Engine database.

Custom dimension

Custom dimensions are multi-level filters that you can use to view the data of the parent filter. For example, if you use the Device - Monitor - Instance custom dimension, you can first filter devices. Based on the devices that you select, you can see the monitors for those devices. Based on the monitors that you select, you can see the instance names for those monitors.

The following custom dimensions are available out of the box:

  • Device - Monitor - Instance
  • Device - Monitor
  • Event Host Class - Host
  • Event Tool Class - Tool
  • Event Object Class - Object
  • Extended Slot Name - Value
  • Monitor - Attribute
  • BMC Infrastructure Management Server - Devices
  • Device - Monitor - Attribute
  • Device - Instance
  • Event Origin Class - Origin

Device

Field name

Description

BMC TrueSight Infrastructure Management Server Name

Displays the name of the BMC TrueSight Infrastructure Management Server.

Device Name

Displays the name of the host on which the event occurred.

Device IP Address

Displays the address of the host on which the event occurred.

Device Server Type

Displays type of the device (For example, Default, VM, and VC).

Device Type

Displays the type of a device (For example, Server, RemoteAgent, Router)

Device Description

Displays description about the device.

Device Status

Flag field which displays status of the device, indicates whether the device is Active or Deleted.

Device Unique Name

Displays the unique name of the device.

Device Full Name

Displays the full name of the device.

Parent Device Name

Displays the parent device name of the device.

Parent Device IP

Displays the parent device IP address of the device.

Device OS Name

Displays the Operating system name of the device.

Device OS Version

Displays the Operating system version of the device.

Device ID

Displays ID of the device.

Device MCUDID

Displays Machine Universal Descriptor ID of the device.

Device Discovered TimeDisplays the time when the device was discovered.
Device Deleted TimeDisplays the time when the device was deleted.
Device CMDB Parent Instance IDDisplays the device CMDB Parent Instance ID.
Device LocationDisplays the location of the device.
Device Department

Displays the department of the device.

Device building

Displays the building where the device is located.

Device Owner

Displays the owner of the device.

Device Tag StatusDisplays the device tag status.
Device Tags Deleted TimeDisplays the time that the device tags were deleted from the Report Engine database.
Device AttributeDisplays the device attribute.

Device Group

Field name

Description

Group Level 1

Displays the device name of the first level group.
Group Level 2Displays the device name of the second level group.
Group Level 3Displays the device name of the third level group.
Group Level 4Displays the device name of the fourth level group.
Group Leaf IDDisplays the ID of the last device in the group tree.
Group NameDisplays the name of the device group.
Group DescriptionDisplays the description of the device group.
Parent Group NameDisplays the name of the parent group.
Group StatusIndicates whether the group is active or deleted.
Group Deleted TimeDisplays the time when the group was deleted from the Report Engine database.

Event Custom Dimension

Field name

Description

Event Severity Bucket

The event severity bucket for CRITICAL, MAJOR, MINOR, and Other events.

Event Date Time

Field name

Description

Event Reception Date

Displays the date when the event occurred.

Event Incident DateDisplays the event incident report date.
Event Arrival DateDisplays the date when the event arrived at the BMC Impact Manager network at either an adapter or a cell.
Event Modification DateDisplays the date when the event was modified.
Event Local Reception DateDisplays the event local reception date.
Event Closed DateDisplays the date when the event was closed.

Event information

Field name

Description

Event ID

Unique Event Identifier.

Event Host

Displays the host associated with the event.

Event Host Class

Displays type of host. This field is important for implementing generic actions, such as rebooting a computer on which a problem has occurred. In the background, a generic action can be translated into a specific action based on this field.

Event Class

Displays Event Class. For example, Abnormality, Alarm.

Event Status

Display status of an event.

Event Severity

Indicates the seriousness of the event.

Event Priority

Determines which event requires action before the other.

Event Message

Displays a short description of the reason for the event.

Event Category

Displays category of an event.

Event Sub Category

Displays sub category of an event.

Event Owner

Displays the current user assigned to the event.

Event Location

Displays the location assigned to the event.

Application

Displays Event Application.

Origin Severity

Displays severity as given by the mc_origin slot.

Impact Manager Cell Address

Displays cell address of the impact manager monitoring the component.

Event Origin

Event management systems that is closest to the source of the event as possible. For example, if an event originates form an agent, is forwarded to HP OpenView IT / Operations, and is then received by BMC Impact Manager, the name of the agent would be the mc_origin, and the name of the HP ITO instance would be the mc_tool.

Event Origin Class

Identifies the event management system type.

Event Object

Displays sub-component of the host to which the event is related. For example, it could be the name of the disk on which the event is reporting the problem.

Event Object Class

Displays the class of an object. If the object class cannot be derived from the original event, it should be filled in during enrichment.

Event Parameter

Name of the metric or property that went into alarm or that triggered the event.

Event Parameter Value

Displays the parameter value.

Tool

Displays the tool_class value.

Tool Class

Displays a user-defined categorization of the tool reporting the event. For example, the tool_class value for an SNMP adapter could be SNMP. And the tool_class value for an NT Event Log Adapter might be NT_EVENT_LOG.

Tool Class Address

Displays the address of the tool reporting the event.

Event MC Service

Displays business service of the reporting event.

Extended Slot Name

Extended Event Slot Name that was created.

Extended Slot Value

Displays the Extended Event Slot Value.

Event Action Count

Number of actions performed on the event.

Event Repeat Count

Number of copies received from this event.

Event Duration

Elapsed time, in seconds from event creation to the time the event was closed.

Event Administrator

Identification of the user that last modified the event, as user@host or package:rulename.

Event AccountDisplays event account.
Event Object OwnerDisplays event owner.

Event MC Notification History

Displays event notification history.

Event MC Tool SevDisplays severity as provided by mc_tool.
Event Origin KeyUnique key that the originating tool uses to enumerate the event. In case of a two-layer implementation, mc_origin_key might have the same value as the mc_tool_key. 
Severity IDDisplays the system-generated unique ID for severity.
Priority IDDisplays the system-generated unique ID for priority.

Event Original Priority

Displays the original priority of the event before update.
Event Last Closed By ResponseDisplays the user who has closed the event.
Event Last Closed Response TimeDisplays the date and time when the event was closed.
Original Priority IN NumberDisplays the original priority IN number.

Event Measures

Field name

Description

Event Count

Displays the total number of events.

Event Notes

Field name

Description

Event Notes Guid

Displays the system generated unique ID for each note on the events.
Event Notes

The contents of this slot is implementation-dependent. Rules or users should not rely on a particular value in this slot.

Event Notes TimeDisplays the time when an event not has been written by the operator.
Event Notes OperatorDisplays the user who writes the notes on the event.

Event Operation

Field name

Description

Event Operation Guid

Displays the system generated unique ID for each operation

Event OperationThe slot that contains a list of operation history entries.
Event Operation TypeDisplays the type of operation that is performed on the event.
Event Operation TimeDisplays the time when an operation is performed on the event.
Event Operation ArgumentsDisplays the fourth value of the mc_operations slot.
Event Operation OperatorDisplays the name of the user who operated on the event.

Event Related Incidents

Field name

Description

Incident ID

Displays the incident unique ID.

Incident StatusDisplays the status of the incident.
Incident PriorityDisplays the priority of the incident.
Incident SubmitterDisplays the name of the user who created the incident.
Incident AsigneeDisplays the name of the user who assigned the incident.
Incident Date TimeDisplays the date and time when the incident was generated.
Incident ACK Event IDDisplays the ID of the event that acknowledged the incident.

Event Response Time

Field name

Description

First Operation Action

Displays the first operation that was performed when the event was created.
First Operation TimeDisplays the time when the first operation was performed when the event was created.
First Operation UserDisplays the name of the user who performed the first operation when the event was created.
Response Time Per OperationDisplays the response time for every operation in minutes.
First Operation Response TimeDisplays the first operation response time in minutes.

Event Status

Field name

Description

Event Status Guid

Displays the system generated unique ID of the event status.
Event History StatusDisplays the status value of the event.
Event Status Change TimeDisplays the time when the status of the event changed.
Event Status Change OperatorDisplays the name of the user who changed the status of the event.

Monitor Instance

Field name

Description

Monitor InstanceDisplays the name of the monitor instance.
Monitor Instance IDDisplays the unique identifier of the monitor instance.

Monitor Instance Status

Indicates whether the device is active or deleted.

Monitor Instance Full Name

Displays the full name of the instance.

Monitor Instance Full Name ID

Displays the unique identifier of the instance.

Parent Monitor InstanceDisplays the full name of the parent instance.
Parent Monitor Instance IDDisplays the unique identifier of the parent instance.

Monitor Instance Deleted Time

Displays the time when the monitor instance was deleted from the Report Engine database.

Monitor Type

Field name

Description

Monitor Type

Displays name of the monitor type.

Monitor Type Unique Name

Displays the unique name of the monitor type

Monitor Type ID

Displays the unique identifier of a monitor type.

Monitor StatusIndicates whether the device is active or deleted.
Monitor Deleted TimeDisplays the time when the monitor type was deleted from the Report Engine database.

Performance

Field name

Description

BMC TrueSight Infrastructure Management Server Name

Displays the name of the TrueSight Infrastructure Management server.

BMC TrueSight Infrastructure Management Server ID

Displays the ID of the TrueSight Infrastructure Management server.

Ext Rep Attribute Deleted TimeDisplays the time when the external report attribute was deleted from the Report Engine database.
Ext Rep Attribute Set NameDisplays the external report attribute set name.
Patrol Agent Name

Displays the name of the PATROL Agent.

Patrol Agent Port

Displays the port number of the PATROL Agent.

Timestamp

Displays the timestamp for the selected fields.

Hour

Displays the hourly date for the selected fields.

Day

Displays the daily date for the selected fields.

Week

Displays the weekly date for the selected fields.

Month

Displays the monthly date for the selected fields.

Quarter

Displays the quarterly date for the selected fields.

Year

Displays the yearly date for the selected fields.

Raw - ValueDisplays the raw value collected from the Patrol Agent.
Hour Sum ValueDisplays the hourly aggregated sum value.
Hour Count ValueDisplays the hourly count of data values for the selected interval.
Hour Min ValueDisplays the hourly minimum data value for the selected interval.
Hour Max ValueDisplays the hourly maximum data value for the selected interval.
Hour Average ValueDisplays the hourly average data value for the selected interval.
Day Sum ValueDisplays the daily sum of data values for the selected interval.
Day Count ValueDisplays the daily count of data values for the selected interval.
Day Min ValueDisplays the daily minimum data value for the selected interval.
Day Max ValueDisplays the daily maximum data value for the selected interval.
Day Average ValueDisplays the daily average value for the selected interval.

Rate Data

Field name

Description

FromTime

Displays hourly start date corresponding to rate data.

ToTime

Displays hourly end date corresponding to rate data.

Rate Avg Value

Displays average value corresponding to rate data.

Rate Min Value

Displays minimum value corresponding to rate data.

Rate Max Value

Displays maximum value corresponding to rate data.

Thresholds Absolute Global

Field name

Description

Severity

The severity of the event created. This is relevant for Abnormality thresholds. The severity can Minor, Major, or Critical. The Normal severity is filtered to be consistent with the TrueSight Operation Management Server Thresholds that are displayed in the user interface.

Threshold Instance IDThe unique identifier of the threshold instance.
Threshold

The range of values for which events are triggered. This range does not include the threshold.

Examples:

  • Above checked - An event is generated if data is continually greater than the threshold for the specified duration.
  • Below checked - An event is generated if data is continually lesser than the threshold for the specified duration.
Comparison

This is a reference point for comparison of the actual measurements with the defined threshold values. The supported operators for comparison are >, <, ==, >=, or <=. This is available only for the Absolute Global and Instance Thresholds. For example, if you select the >= operator for an attribute and set the threshold value to 90%, events are generated when the threshold value is greater than or equal to 90%.

Duration minutes

The duration (in minutes) of delay from when the threshold is violated to when an event is generated. The same duration is required to close an event, starting with the first data point where threshold is no longer violated.

Outside Baseline

The baseline to associate with the threshold. This helps to reduce false events associated with latest trends. For example, response time may be higher during peak time. In this case, associating
the response time with appropriate baseline covers any false event. If you select Auto baseline an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily, and All
Baselines.

Auto CloseIndicates whether the triggered event has been closed automatically, when it returns to normal state.
Predict

The boolean value that indicates whether predictive events have been generated.

Thresholds Absolute Instance

Field name

Description

Severity

The severity of the event created. This is not relevant for Abnormality thresholds. The severity can Minor, Major, or Critical. The Normal severity is filtered to be consistent with the TrueSight Operation Management Server Thresholds that are displayed in the user interface.

Threshold Instance ID

The unique identifier of the threshold instance.

Threshold

The range of values for which events are triggered. This range does not include the threshold.

Examples:

  • Above checked - An event is generated if data is continually greater than the threshold for the specified duration.
  • Below checked - An event is generated if data is continually lesser than the threshold for the specified duration.
Comparison

This is a reference point for comparison of the actual measurements with the defined threshold values. The supported operators for comparison are >, <, ==, >=, or <=. This is available only for the Absolute Global and Instance Thresholds. For example, if you select the >= operator for an attribute and set the threshold value to 90%, events are generated when the threshold value is greater than or equal to 90%.

Duration minutes

The duration (in minutes) of delay from when the threshold is violated to when an event is generated. The same duration is required to close an event, starting with the first data point where threshold is no longer violated.

Outside Baseline

The baseline to associate with the threshold. This helps to reduce false events associated with latest trends. For example, response time may be higher during peak time. In this case, associating
the response time with appropriate baseline covers any false event. If you select Auto baseline an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily, and All
Baselines.

Auto CloseIndicates whether the triggered event has been closed automatically, when it returns to normal state.
PredictThe boolean value that indicates whether predictive events have been generated.
Schedule IDThe unique ID of the schedule.
SLA IDThe unique SLA ID.

Thresholds Signature Global

Field Name

Description

Severity

Severity of the event created  (Abnormality thresholds). Filtered Normal severity to make consistent with TrueSight Infrastructure Management Server Thresholds UI.

Threshold Instance IDUnique identifier of the threshold instance.

Threshold

The range of values for which events are triggered. This range does not include the threshold. For example: Above checked - An event is generated if data is continually greater than the threshold for the
specified duration. Below checked - An event is generated if data is continually lesser than the threshold for the specified duration.

Above or Below

Reference point for the following parameters, Above High - Above the High baseline, Below Low - Below the Low baseline, Auto-baseline - an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily and All Baselines.

Duration minutes

The duration (in minutes) of delay from when the threshold is violated to when an event is generated. The same duration is required to close an event, starting with the first data point where threshold is no longer violated.

Outside Baseline

The baseline to associate with the threshold. This helps to reduce false events associated with latest trends. For example, response time may be higher during peak time. In this case, associating
the response time with appropriate baseline covers any false event. If you select Auto baseline an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily and All
Baselines.

Absolute Deviation

Deviation is a way of introducing tolerance into the baseline values. If there is a small change in baseline that is not significant for reporting purposes, deviation can be set to ignore this small change. For example, if baseline low value is 40, baseline high value is 100, and deviation is set to 2, then a signature event is generated when the average of all data values inside the threshold duration goes above 102 or below 38. The deviation value is additive (not multiplicative) and is given in the same units being measured by the particular monitor attribute (that is #,%, bytes, milliseconds, and so on). The default value for Absolute deviation is 5 units.

Percentage Deviation

Percent Deviation has the same meaning as the existing deviation field, except that the actual value of the deviation is expressed in terms of a percent of the baseline value (rather than an absolute value).The default value for percentage deviation is 5%.

Minimum Sampling Window

Define minimum window of time to keep raw data points that are considered for intelligent threshold computation. Data points outside this range are usually discarded.

Thresholds Signature Instance

Field name

Description

Severity

Severity of the event created  (Abnormality thresholds). Filtered Normal severity to make consistent with PATROL Agent Server Thresholds UI

Threshold Instance IDUnique identifier of the threshold instance.

Threshold

The range of values for which events are triggered. This range does not include the threshold. For example: Above checked - An event is generated if data is continually greater than the threshold for the specified duration. Below checked - An event is generated if data is continually lesser than the threshold for the specified duration.

Above or Below

Reference point for the following parameters, Above High - Above the High baseline, Below Low - Below the Low baseline, Auto-baseline - an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily and All Baselines.

Duration minutes

The duration (in minutes) of delay from when the threshold is violated to when an event is generated. The same duration is required to close an event, starting with the first data point where threshold is no longer violated.

Outside Baseline

The baseline to associate with the threshold. This helps to reduce false events associated with latest trends. For example, response time may be higher during peak time. In this case, associating the response time with appropriate baseline covers any false event. If you select Auto baseline an event is generated accordingly. Other options are Hourly, Daily, Weekly, Hourly and Daily and All Baselines.

Absolute Deviation

Deviation is a way of introducing tolerance into the baseline values. If there is a small change in baseline that is not significant for reporting purposes, deviation can be set to
ignore this small change. For example, if baseline low value is 40, baseline high value is 100, and deviation is set to 2, then a signature event is generated when the average of all data values inside the threshold duration goes above 102 or below 38. The deviation value is additive (not multiplicative) and is given in the same units being measured by the particular monitor attribute (that is #,%, bytes, milliseconds, and so on). The default value for Absolute deviation is 5 units.

Percentage Deviation

Percent Deviation has the same meaning as the existing deviation field, except that the actual value of the deviation is expressed in terms of a percent of the baseline value (rather than an absolute value).The default value for percentage deviation is 5%.

Minimum Sampling Window

Define minimum window of time to keep raw data points that are considered for intelligent threshold computation. Data points outside this range are usually discarded.

TSR user

Field name

Description

User Name

Name of the TrueSight Smart Reporting user.

Was this page helpful? Yes No Submitting... Thank you

Comments