Event base event class

The Event (or EVENT) event class is the base class, which is the parent of all event classes.

The hidden slots are internal slots and cannot be changed.

Important

For the event slots that have the string or list of string data types, the character limit of the slot value is 32,766 bytes. If the value goes above this limit, the value is trimmed, which results in data loss. Refer to the _errors event slot on the Event Details page to understand the slot limit breach.

EVENT base class slots

Slot name	Slot display name	Type	Description	Hidden?
_arrival_time	Arrived	Long (Epoch milliseconds)	Time when the event is received by the Event Processing Service. If you do not specify a value for this slot, the current time is considered. This value can never be zero.	No
_ci_id	Host ID	String	CI id maintained for the association. Used for looking up topology information in the equivalent field external_ids in .	No
_entropy	Entropy Value	String	This slot is unused.	No
_errors	Errors	List of string	Internal slot	No
_identifier	ID	String	Unique ID of an event generated and stored internally. The following characters or a combination of these characters are allowed for this slot: Underscore (_) Hyphen (-) Period (.) Colon (:) At (@)	No
_impacted_service_key	Impacted Service Key	List of string	Internal slot Represents the list of impacted service keys present in. This slot associates a node from, which is not part of a service. However, the node is topologically connected to one or more nodes that are part of other services. This slot lists the keys of the other impacted service. For example: Node A is not part of any service Node B is part of Service B Node C is part of Service C Node A is topologically connected to Node B and Node C In this scenario, the keys for Service B and Service C are listed as the impacted service keys.	No
_impacted_service_name	Impacted Service Name	List of string	Internal slot Represents the list of impacted service names associated with nodes in . This slot associates a node from , which is not part of a service. However, the node is topologically connected to one or more nodes that are part of other services. This slot lists the service name of the other impacted service. For example: Node A is not part of any service Node B is part of Service B Node C is part of Service C Node A is topologically connected to Node B and Node C In this scenario, Service B and Service C are listed as the impacted service names.	No
_modified_time	Modified	Long (Epoch milliseconds)	Updated timestamp of the last modification of particular slots.	No
_node_id	Node ID	List of string	Internal slot Represents the list of host IDs present in . This slot associates the node and service details from to an event.	No
_node_impacted_service_key_mapping	Node Impacted Service Key Mapping	List of string	Internal slot Represents the mapping between the node and the impacted service keys.	No
_node_key	Node Key	List of string	Internal slot Represents the list of host keys present in . This slot associates the node and service details from to an event.	No
_node_service_mapping	Node Service Mapping	List of string	Internal slot Represents the list of node ID(s) associated with the service(s) in .	No
_node_service_key_mapping	Node Service Key Mapping	List of string	Internal slot Represents the list of node keys associated with the service(s) in	No
_notes	Notes	List of string	List of free text annotations (notes) added to the event.	Yes
_operations	Operation History	List of string	Internally updated based on event policies that were run.	Yes
_relationships	Relationships	Object	Contains information about correlated events such as the primary event count, secondary event count, and the relationship ID between the primary and secondary event.	No
_repeat_count	Repeated	Integer	Internal slot. If you update this slot by using one of the following methods, the event processing is impacted. Modify Event UI operation REST APIs Event policy	No
_service_id	Service ID	List of string	Internal slot Represents the list of service IDs present in . This slot associates the node and service details from to an event.	No
_service_key	Service Key	List of string	Internal slot Represents the list of service keys present in . This slot associates the node and service details from to an event.	No
_service_name	Service Name	List of string	Internal slot Represents the list of services associated to nodes in .	No
_signature	Signature	String	Unique identifier according to the event message and entity or host.	No
_tenant_id	Organization ID	String	Tenant ID stored internally.	No
_tenant_name	Organization	String	Tenant name; same as the tenant ID.	No
_unmapped_data	Unmapped Data	Object	Holds the map of the key values for _badslot_names and _badslot_values. Also holds the key values that are not defined in class mapping and are from the UNKNOWN class.	No
alias	Alias	List of string	Alias of the component that is related to the event. The alias value is enriched with a default value in the following format before the policy phases in event processing start. Default value: [BMC_ComputerSystem:<source_hostname>] To learn about event policy phases, see Event-policy-types-and-evaluation-order. You can change the default value by using advanced enrichment policies. To learn about advanced enrichment policies, see Advanced-time-based-and-dynamic-enrichment-policies.	No
category	Category	Enum (Category) Default: OPERATIONS_MANAGEMENT	High-level normalized category of the object that the event represents. This is based on appropriate Information and Technology Infrastructure Library (ITIL) core process. Possible categories are: SLA_MANAGEMENT CAPACITY_MANAGEMENT SERVICE_CONTINUITY_MANAGEMENT AVAILABILITY_MANAGEMENT INCIDENT_MANAGEMENT CONFIGURATION_MANAGEMENT RELEASE_MANAGEMENT PROBLEM_MANAGEMENT CHANGE_MANAGEMENT OPERATIONS_MANAGEMENT SECURITY_MANAGEMENT FINANCIAL_MANAGEMENT SERVICE_DESK_MANAGEMENT	No
cdmclass	CDM Class	String	The CDM class that is used for incident generation. Example cdmclass = BMC_SoftwareServer Populate this slot with the node kind in to look up nodes based on the node kind and enrich node details (node and service ids) in the event.	No
change_id	Change ID	String	Unique identifier of the change request that is raised in change management.	No
class	Class	String Default=CUSTOM	Class identifying the event.	No
componentalias	Component Alias	String	The component alias that is used for incident generation. Example: componentalias = Oracle Database Server:<hostname>:<domain>:<instancename> The value of this slot is enriched when the Predefined Enrichment Policy for Incident (out-of-the-box policy) executes. To learn about this policy, see Out-of-the-box-event-policies-and-templates. This slot is useful for the L2 use case. To learn about the L2 use case, see L2-use-case-Viewing-enriched-incident-details.	No
creation_time	Occurred	Long (Epoch milliseconds)	Time when the event was created by the event source. The event source can be PATROL Agent, a third-party event provider (event generated via the API), a Situation, or an Alarm. If creation_time is not set by the source, the event processing service sets it to the current system time which matches the _arrival_time.	No
details	Detailed Message	String	Detailed information about the event. Expands the information in the msg slot.	No
incident_id	Incident ID	String	Incident ID generated/associated with event	No
incident_company	Incident Company	String	Incident company, or the tenant name. Example "incident_company": "Calbro Services"	No
incident_sysid	Incident GUID	String	The system ID of the incident that is associated with the event.	No
instancename	CMDB Instance Name	String	The Configuration Management Database (CMDB) instance name that is used for incident generation. Example instancename = DB instance name	No
lifecycle_time	Lifecycle Time	Long	Internal slot	No
location	Location	String	Source of the event. The event source can be PATROL Agent or a third party event provider (event generated via the API).	No
model	Model	String	Internal slot	No
modelname	Model Name	String	The model name that is used for incident generation. Example modelname = Oracle Database server	No
msg	Message	String	Event summary (text description) in brief	No
priority	Priority	Enum (Priority) Default=PRIORITY_5	Records the original priority of the event upon insertion. Also, records current priority of the event. Values: PRIORITY_5 (lowest priority) PRIORITY_4 PRIORITY_3 PRIORITY_2 PRIORITY_1 (highest priority)	No
severity	Severity	Enum (Severity) Default=MINOR	Severity value of the event. Possible values are: UNKNOWN OK INFO WARNING MINOR MAJOR CRITICAL	No
significance	Significance	Enum (Weight)	Internal slot. Allows you to configure a service’s health to be marked Critical even if only a single, high-impact event occurs, by using the Advanced event enrichment policy. Here, you can configure a custom Significance value (ranging from 1 to 5) for specific events. The Significance slot allows you to assign a weight (1–5) to events based on their business or operational impact. When an event matches the conditions defined in the enrichment policy, the specified Significance value is applied to it. This value directly influences the service health score by multiplying the event’s base impact score. Example: Users want the service health score to degrade sharply when an issue occurs on a critical resource, such as a database server host running low on memory, even if it's a single event. To achieve this, Create an advanced event enrichment policy. Match events where: Host Type = Database server Metric = Available memory Threshold = Low Assign a high significance value, such as 5, to these events. A critical low-memory event from a database host normally contributes 10 points. With a significance of 5 and an event type multiplier of 2, the impact becomes: 10 (base score) x 2 (multiplier) x 5 (significance) = 100 This changes the service health score to 100, marking the service as Critical.	No
source_address	Host Address	String	IP address of the event source.	No
source_hostname	Host	String	Host name of the event source. Used for looking up topology information in the equivalent field, name/short_name in . The \ and \t characters are not supported in the host name.	No
source_identifier	Source Identifier	String	Unique identifier of the event source. The identifier can differ based on the type of event source. By default, for PATROL Agents, the event source is added in the format, agentHostName:Port. Furthermore, for alarms, the internally generated alarm ID is added.	No
source_port	Source Port	Integer	Port of the event provider.	No
sourceEntityType	sourceEntityType	String	Used for categorizing the event source entity. For example, the event source entity could be a network, application, and so on.	No
status	Status	Enum Default=OPEN	Status value of the event. Possible values are: OPEN ACK ASSIGNED CLOSED BLACKOUT	No
sub_category	Monitor Category	Enum Default=OTHER	Subcategory of the object the event represents based on the appropriate Information Technology Infrastructure Library (ITIL) core process. Possible values are: OTHER APPLICATION DATABASE NETWORK SYSTEM USER_TRANSACTIONS	No
tags	Tags	List of string	Represents a logical value to identify a group of events of a particular type.	No
user_assigned	Owner	String	Current user assigned to the event.	No

Event base event class

On this page