Appendix A. IBM Tivoli Enterprise Console event mapping

Each event class corresponds to an attribute group in the IBM Tivoli Enterprise Console. For a description of the event slots for each event class, see the lists in this appendix. For more information about mapping attribute groups to event classes, see the IBM Tivoli Monitoring Administrator's Guide.

Generic event mapping provides useful event class and attribute information for situations that do not have specific event mapping defined. BAROC files are found on the Tivoli Enterprise Monitoring Server in the installation directory in TECLIB (that is, install_dir/cms/TECLIB for Windows® systems and install_dir/tables/TEMS_hostname/TECLIB for UNIX® systems). IBM Tivoli Enterprise Console event synchronization provides a collection of ready-to-use rule sets that you can deploy with minimal configuration. Be sure to install IBM Tivoli Enterprise Console event synchronization to access the correct Sentry.baroc, which is automatically included during base configuration of IBM Tivoli Enterprise Console rules if you indicate that you want to use an existing rulebase. See the IBM Tivoli Monitoring Installation and Setup Guide for details.

Each of the event classes is a child of KB2_Base and is defined in the kb2.baroc file. The KB2_Base event class can be used for generic rules processing for any event from the Blue Medora Agent for Symantec Endpoint Protection.

For events generated by situations in the Availability attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_AVAILABILITY class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• application_component: STRING

• name: STRING

• name_enum: STRING

• kb2_status: INTEGER

• kb2_status_enum: STRING

• full_name: STRING

• full_name_enum: STRING

• type: INTEGER

• type_enum: STRING

• virtual_size: INTEGER

• page_faults_per_sec: INTEGER

• working_set_size: INTEGER

• thread_count: INTEGER

• pid: INTEGER

• percent_privileged_time: INTEGER

• percent_user_mode_time: INTEGER

• percent_processor_time: INTEGER

• command_line: STRING

• command_line_enum: STRING

• functionality_test_status: INTEGER

• functionality_test_status_enum: STRING

• functionality_test_message: STRING

For events generated by situations in the Definition Version attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_DEFINITION_VERSION class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• definition_date: STRING

• definition_revision: INTEGER

• definition_age_in_days: INTEGER

For events generated by situations in the Event Log attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_EVENT_LOG class. This class contains the following slots:

• node: STRING

• log_name: STRING

• event_source: STRING

• event_type: INTEGER

• event_type_enum: STRING

• event_id: INTEGER

• event_category: STRING

• message: STRING

• time_generated: STRING

For events generated by situations in the Log attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_LOG class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• original_event_timestamp: STRING

• event_year: INTEGER

• event_month: INTEGER

• event_day: INTEGER

• event_hour: INTEGER

• event_minutes: INTEGER

• event_seconds: INTEGER

• event_number: INTEGER

• category_number: INTEGER

• logger: INTEGER

• computerid: STRING

• username: STRING

• virus_name: STRING

• virus_location: STRING

• primary_action_configuration: INTEGER

• secondary_action_configuration: INTEGER

• action_taken: INTEGER

• virus_type: INTEGER

• flags: INTEGER

• description: STRING

• scanid: INTEGER

• new_ext: STRING

• group_id: INTEGER

• event_data: STRING

• quarantined_file_id: STRING

• virus_id: STRING

• quarantine_forward_status: INTEGER

• access: INTEGER

• snd_status: STRING

• compressed: INTEGER

• depth: STRING

• still_infected: STRING

• definition_info: STRING

• definition_sequence_number: STRING

• clean_info: INTEGER

• delete_info: INTEGER

• backup_id: STRING

• parent: STRING

• guid: STRING

• client_group: STRING

• address: STRING

• domain_name: STRING

• nt_domain: STRING

• mac_address: STRING

• version: STRING

• remote_machine: STRING

• remote_machine_ip: STRING

• primary_action_status: INTEGER

• secondary_action_status: INTEGER

• license_feature_name: STRING

• license_feature_version: STRING

• license_serial_number: STRING

• license_fulfillment_id: STRING

• license_start_date: STRING

• license_expiration_date: STRING

• license_lifecycle: STRING

• license_seats_total: STRING

• license_seats: STRING

• error_code: STRING

• license_seats_delta: STRING

• kb2_status: INTEGER

• domain_guid: STRING

• log_session_guid: STRING

• vbin_session_id: STRING

• login_domain: STRING

• remainder_of_record: STRING

For events generated by situations in the Performance Object Status attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_PERFORMANCE_OBJECT_STATUS class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• query_name: STRING

• object_name: STRING

• object_type: INTEGER

• object_type_enum: STRING

• object_status: INTEGER

• object_status_enum: STRING

• error_code: INTEGER

• error_code_enum: STRING

• last_collection_start: STRING

• last_collection_start_enum: STRING

• last_collection_finished: STRING

• last_collection_finished_enum: STRING

• last_collection_duration: REAL

• average_collection_duration: REAL

• average_collection_duration_enum: STRING

• refresh_interval: INTEGER

• number_of_collections: INTEGER

• cache_hits: INTEGER

• cache_misses: INTEGER

• cache_hit_percent: REAL

• intervals_skipped: INTEGER

For events generated by situations in the Take Action Status attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_TAKE_ACTION_STATUS class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• action_name: STRING

• action_status: INTEGER

• action_status_enum: STRING

• action_app_return_code: INTEGER

• action_message: STRING

• action_instance: STRING

• action_results: STRING

• action_command: STRING

• action_node: STRING

• action_subnode: STRING

• action_id: INTEGER

• action_type: INTEGER

• action_type_enum: STRING

• action_owner: STRING

For events generated by situations in the Thread Pool Status attribute group, Tivoli Enterprise Console events are sent using the ITM_KB2_THREAD_POOL_STATUS class. This class contains the following slots:

• node: STRING

• timestamp: STRING

• thread_pool_size: INTEGER

• thread_pool_size_enum: STRING

• thread_pool_max_size: INTEGER

• thread_pool_max_size_enum: STRING

• thread_pool_active_threads: INTEGER

• thread_pool_active_threads_enum: STRING

• thread_pool_avg_active_threads: REAL

• thread_pool_avg_active_threads_enum: STRING

• thread_pool_min_active_threads: INTEGER

• thread_pool_min_active_threads_enum: STRING

• thread_pool_max_active_threads: INTEGER

• thread_pool_max_active_threads_enum: STRING

• thread_pool_queue_length: INTEGER

• thread_pool_queue_length_enum: STRING

• thread_pool_avg_queue_length: REAL

• thread_pool_avg_queue_length_enum: STRING

• thread_pool_min_queue_length: INTEGER

• thread_pool_min_queue_length_enum: STRING

• thread_pool_max_queue_length: INTEGER

• thread_pool_max_queue_length_enum: STRING

• thread_pool_avg_job_wait: REAL

• thread_pool_avg_job_wait_enum: STRING

• thread_pool_total_jobs: INTEGER

• thread_pool_total_jobs_enum: STRING