Creating event groups

Event groups are sets of events that are organized in meaningful groups for better manageability.

Related topics

Managing-event-groups-from-the-TrueSight-console

Using-event-groups-to-filter-events

Getting-started-with-event-groups

Monitoring-and-managing-events-from-the-TrueSight-console

Creating-dynamic-event-groups

Best practice

  • To mitigate performance impact, observe the following guidelines:
    • Do not create more than five levels in an event group hierarchy.
    • At any hierarchical level, create a maximum of 25 event groups.
    • Ensure that the total number of event groups is equal to or less than 50.
  • When creating an event group, avoid complex pattern-matching conditions on slot contents and use narrowly-defined classes rather than complex Where clauses.

To create an event group

The following video (3:16) explains how to create an event group.

 icon_play.png https://www.youtube.com/embed/NafuVWbxgw4?rel=0

Perform the following actions to create an event group:

  1. Log on to the TrueSight console.
  2. In the navigation pane, expand Monitoring and select Events. 
  3. In the Events page, click the View event groups icon eventgroup.png. 
  4. In the Event Groups page, click the main action menu and select Create Event Group.
    eg_create.PNG
  5. Specify a name for the event group.
  6. Select a parent for the event group. By default, Event Groups is the root or topmost level of event group.
    1. Click Select Parent Group.  
    2. Navigate through the hierarchy of event groups and select the event group that you want to set as parent and click OK.

  7. Select the Table View if you want to associate the table view with this event group. By default, the Basic Information table view is associated. 

    Note

    User defined table views cannot be associated with the event groups. 

  8. Specify the filtering criteria for the event group:

    1. From the Class list, select the type of event.
    2. Select the event attributes and comparison operators that are listed in Slots.

    Note

    Filtering criteria that are associated with the parent event group are already applied to the child event group. The inherited criteria is displayed in gray color.

    eventgroup_create.PNG

    NoteFor some event attributes, the internal names are displayed. For example, error_message, error_val.If you want to view the display name for an event attribute, you need to add the attribute to the en.json file:1. Open the en.json file from the  <installationDirectory>\TrueSightPServer\truesightpserver\modules\tomcat\webapps\infraApp\WEB-INF\classes folder.2. Go to the end of the file and add a comma after the last line of code and press ENTER.3. Add information for the event attribute in the following format: eventView.slot.<CLASS_NAME>.<SLOT_NAME>=<SLOT_DISPLAY_NAME>where, CLASS_NAME = Event class name of your event attribute (slot)SLOT_NAME = Internal name of the event attribute that is currently displayedSLOT_DISPLAY_NAME = Name of the event attribute that you want to replace the internal name with4. Repeat the earlier step for all the event attributes that you want to add.5. Restart the Presentation Server.


    For more information about event classes and slots, see How event classes are structured .

    For information about comparison operators, click here.

    Comparison operators

    Operator

    Description

    Slot types

    ==

    Events are listed only if the slot value matches the comparison value.

    Enum, String, Number, List of String

    !=

    Events are listed only if the slot value does not match the comparison value.

    Enum, String, Number, List of String

    >

    Events are listed only if the slot value is greater than the comparison value.

    Enum, String, Number

    <

    Events are listed only if the slot value is less than the comparison value.

    Enum, String, Number

    >=

    Events are listed only if the slot value is greater than or equal to the comparison value.

    Enum, String, Number

    <=

    Events are listed only if the slot value is less than or equal to the comparison value.

    Enum, String, Number

    Has prefix

    Events are listed only if the slot value starts with the comparison value.

    String, Number

    Has suffix

    Events are listed only if the slot value ends with the comparison value.

    String, Number

    Contains

    Events are listed only if the slot value contains the comparison value.

    String, Number, List of String

    Within

    Events are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.

    String, Number

    Contains one of

    Events are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.

    String, Number

    Outside

    Events are listed only if the slot value does not match with any of the comma-separated list of comparison values.

    String, Number

    Matches

    Events are listed only if the slot value contains the comparison value.

    You can provide the following parameters in addition to the comparison value:
    %d - decimal integer number
    %f - floating point real number
    %c - single character
    %s - string value

    Consider the following example values in the message slot of eight events:

    Event 1

    Memory Consumption - 10 MB – on machine clm-dev-008700

    Event 2

    CPU utilization 85.35% – on machine clm-dev-007890

    Event 3

    Memory Consumption - 5 MB – on machine clm-dev-108781

    Event 4

    CPU utilization 75.95% – on machine clm-dev-087654

    Event 5

    Memory Consumption – 894  MB – on machine clm-dev-54657

    Event 6

    CPU utilization 68.45% – on machine clm-dev-37878

    Event 7

    Consumption of storage space is high on vm-dev-45 machine

    Event 8

    Utilization taking higher trend

    When you use the matches operator for the message slot:

    • Message matches Consumption – %d
      Events 1, 3, and 5 are displayed, as the following criteria matches:
      Consumption as a constant and an integer variable listed after Consumption.
    • Message matches machine %s
      Events 1, 2, 3, 4, 5, and 6 are displayed as the following criteria matches:
      machine as a constant and a string variable listed after machine.

    String, List of String

    Subclass of

    Events are listed only if they are a subclass or child class of the provided class.

    Class

    Superclass of

    Events are listed only if they are a super-class or parent class of the provided class.

    Class

  9. Click OK. 
    eventgroup_tiles.png

    If you select the topmost level of the event groups, Event Groups, as a parent, it is displayed as [None] in the event group's tile. 


To modify, view, or delete an event group

To modify, view, or delete an event group, see Managing-event-groups-from-the-TrueSight-console.

Where to go from here

Using-event-groups-to-filter-events

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*