Set event log rule conditions properties

This tab lets you specify an entry in the Windows event log that causes the rule to carry out the actions that are associated with the rule. If the policy finds an event log entry that matches what you specify here, the actions that you specify in the action tab are carried out.

• Rule Description: Type a description that will help you remember what this rule does. This description is visible in the rules list.
• Computer, Source, Category, Type, Event ID, Format, Description: In these text boxes, indicate the content of these event log fields that you want this rule to match. Note that you can start the event viewer with a button at the bottom of the window if you want to copy data from the event log.
  • Node names

    If you only want to match event log entries from a specific node, type the FQDN, the primary node name, or the IP address in the Computer field. Give multiple entries with the OR operator (for example, celery.veg.com|broccoli.veg.com) or leave the field blank for all nodes. You can also use the variable <$OPC_MGMTSV>.

  • Pattern matching

    Pattern matching may be used in the Description field. The match patterns may not contain newline characters. If you need to match a multi-line pattern, use the special character <*> to match any carriage return/linefeed characters.

    You can also use pattern matching in the Source field, but you must first enable this on the nodes that you want to use it on.

    To enable pattern matching in the Source field, set the parameter OPC_COND_EVT_LOG_SRC_PAT to TRUE. You can do this in the following ways:

    • Set the parameter in a node info policy and deploy it to the nodes. (See Node Info Policy Type.)
    • Set the parameter in the HTTPS agent installation defaults in the eaagt namespace. (See Configure HTTPS agent installation defaults.)
    • Set the parameter locally in the eaagt namespace on the node. (See ovconfchg.)
    • Set the parameter the eaagt namespace on the node from the management server. (See ovconfpar.)
  • Policies generated from existing HP Operations Manager for UNIX templates

    Policies generated from existing HP Operations Manager for UNIX templates have a combined Event ID and Description text box. You can convert to two text box format by selecting Use combined format for event ID and description and then saving the policy and re-opening. Note that you must re-type the information in the two new boxes.

Parts of the matched string can be built into the message displayed in the message browser by defining variables. For more information about variables see, Pattern-matching and variables

Set Event Log Rule Conditions

1. Right-click the policy and select All Tasks Edit...
2. Select Rules.
3. Select the rule to which you want to modify the conditions.
4. Select Modify.
5. Select Condition and choose the conditions for this rule.