Customizing an event to forward to an EIF receiver

Complete these steps to customize how events for the current threshold are mapped to forwarded events:

1. If the Threshold Manager is not open, click System Configuration > Threshold Manager.
2. Click the Data Source Type list box and select the data type that you want to work with.
3. If this is a new threshold, click New; otherwise, select a threshold and click Edit.
4. To customize how events for this threshold are mapped to forwarded events, ensure that EIF Forwarder is set to Yes, click EIF Slot Customization, and take one of the following steps:
   • EIF Base Slots: To customize the base slot, select the radio button for msg and click Edit.
   • EIF Custom Slots: To add a custom slot, click Add; to edit a custom slot, select the radio button for the slot and click Edit.
   The Edit Slot or Add Slot window opens.
5. Complete the fields to customize the slot values:

   Field	Description	Restriction
   Slot name	The name of the EIF custom slot, which must begin with a character.	The EIF base slot is msg and cannot be changed.
   Slot type	The type of EIF custom slot: String Type or Number Type.	The EIF base slot is String Type and cannot be changed.
   Subtype	The value that is assigned to the slot, which corresponds to the slot type: Mapped Attribute enables the Mapped attribute field for adding the value of the selected attribute at the time the event occurred Literal Value enables the Literal value field for adding text to the message template Literal Value + Mapped Attribute enables the Literal value and Mapped attribute fields for adding text and attribute values to the message template, and enables the Add button for adding multiple text or attribute values (or both). A space is added after each literal value or attribute. Typical usage for the EIF base slot msg, is to specify a Literal Value + Mapped Attribute for the message template.	A Number Type slot can use only Mapped Attribute.
   Add	If you want to send multiple literal values or attribute values in the forwarded message, click Add to add another set of Literal value and Mapped attribute fields. Each time you select Add, these fields are added to the panel. To remove a set of Literal value and Mapped attribute fields, clear both fields before clicking OK.  See Example.	Enabled only when Subtype is Literal Value + Mapped Attribute. Maximum of 6 sets of Literal value and Mapped attribute fields. If you're not able to see the fields you added, use the browser zoom out feature (Ctrl -) to shrink the layout to fit the dialog box.
   Literal value	The text to include in the message template. For example, a literal value of Memory utilization is high at with the mapped attribute %Memory Utilization, is shown in the Event Manager user interface as Memory Utilization is high at 97.3%. The message template consists of fixed message text and variable substitution references, or symbols. The symbol refers to common or event slot data or a special reference to the threshold formula. Common slots are those slots that are included in all forwarded events, such as threshold_name; event slots are those slots that are specific to the threshold msg.	Disabled when Subtype is Mapped Attribute.
   Mapped attribute	The attribute whose value you want to add to the message template. The attributes available are from the data set that was selected for the threshold. For example, for a threshold that monitors for high processor time, you might want to map the user time percentage attribute.	Maximum of 6 Mapped attribute fields. Disabled when Subtype is Literal Value. When the Slot type is Number Type, only numeric attributes are available.
   Multiplier	The multiplier is the value that is defined after you customize the original mapped attribute number value by a multiplier: slot value = attribute1 * n. For example, if you want to convert minutes to seconds in the EIF event, you would specify a multiplier of 60. The multiplier value can be a fraction, expressed as a decimal, such as 0.5 or 5.4.	Enabled only for numeric attributes (Slot type is Number Type).

   After you click OK to close the window, the EIF Slot Customization window lists the slot name and whether it is customized.
6. After you are finished editing the EIF base slot or adding, deleting, or editing EIF custom slots for the threshold, click OK.
7. After you are finished editing the threshold, click Save.
   For more information, see Threshold Manager.

Example

The Linux_BP_ProcHighCpu_Critical threshold tests for CPU consumption of 95% or higher. To add the Busy CPU percentage, the process command name, and the process ID to the summary message (contained in the msg slot), the msg slot was customized with three sets of Literal value and Mapped attribute fields:

The message template looks like this:

CPU percentage is Busy_CPU_Pct for process Process_Command_Name and PID Process_ID

And the resulting message viewed in the Event Manager might look like this:

CPU percentage is 97 for process large.exe and PID 9876

You can also add the Literal value and Mapped attribute fields and leave one field empty. For example, to append "for review" to the message template, click Add and enter for review for Literal value.

The message template now looks like this:

CPU percentage is Busy_CPU_Pct for process Process_Command_Name and PID Process_ID for review

And the resulting message viewed in the Event Manager might look like this:

CPU percentage is 96 for process big.exe and PID 5432 for review