Overview
Whereas measurement data is collected on a regular schedule, event data can be generated at any time. RHQ is able to detect when events happen, filter them by severity or a regular expression match on the event data, display them within the UI display, and even alert on them.
Events are currently supported by the following resource types:
-
Linux Platform (syslog events)
-
Windows Platform (Windows events)
-
Apache Server (log files)
-
JBossAS Server (log files)
Concepts
The following are concepts that relate to the events subsystem.
Event Source
An EventSource is defined on a particular resource and refers to the origin of incoming events. These typically represent log files, but it could be used for such things as incoming SNMP traps or JMX notifications.
Event Severity
Each event has a severity associated with it, which are roughly oriented along the severities of the log4j framework. Severities in RHQ can be in the range of Debug, Info, Warn, Error, or Fatal.
Event History
The history view will allow you to see all events collected. You can filter by a single resource, a specific resource type, or any member of some group. It will display the origin of the event, the severity, and the details.
Event Details
While the history table will give a quick overview of the collected events. If you click any row in the table, you'll see full details about the event.
Here is an example of a failed event:
Clicking on the error text will open a modal dialog with the full text of the error:
Setting up Event Collection
Events come from various different places depending on the resource. Go to the resource that supports event collection and navigate to its Inventory>ConnectionSettings subtab. You will typically find a section titled "Event Logs" (or something similar). This is where you'll want to set up your event collection. It is in these settings where you will specify things like what file to look in for events and what severity of events you want to collect (that is, you usually have the option to ignore events unless they are at a severity level of WARN or ERROR).