Structure of the Event Log Template 

Definition

By default, all event sources (Sources) of the Application, System, and Security event logs are monitored when monitoring the Microsoft Windows event log (see Event Log Monitoring with CCMS Agents). By specifying one or more event log templates, you can restrict the monitoring to selected event logs or event sources instead, and also deviate from the default alert values for the events.

You specify these event log templates as values of the parameter EventLogMon in the SAPCCMSR-INI configuration file of the CCMS agents:

EventLogMon <complete file path of the event log template>

SAPCCMSR.INI can contain multiple entries of this type, which point to multiple event log templates.

Structure

Monitored Event Logs

In the event log template, first specify which event log (Application, System, or Security) you want to monitor.

EVENTLOG_TEMPLATE

Keyword for the agents; this opens the configuration area for the event log monitoring

EVENTLOG_NAME=[Application, System, Security]      (required parameter)

Name of the event log that is to be monitored

MTE_NAME="<Name of the node, maximum of 40 characters>"

Name of the monitoring attribute in the Alert Monitor (optional parameter) If you are using event log monitoring with the CCMS agent SAPCCM4X, you need to choose a name other than Security for the Security event log.

MTE_CLASS="<MTE class>"                                                  (Default: CCMSEventLogCL)

MTE class of the monitoring object that monitors the events of the above event log

Monitored Event Sources and Assignment of the Alert Colors

You can specify which events from the event log specified in EVENTLOG_NAME are to be reported in the monitoring infrastructure by specifying the desired event source in SOURCE_<x>. When doing this, enter a number <x> for each desired event source in the parameter suffix of the following parameters. Start with the number 0. In this way, you can set the desired alert colors individually for the events of each source, depending on the event type.

SOURCE_<x>=[event source,<ALL>]                 (Default: <ALL>)

Event source from the event log specified in EVENTLOG_NAME; in this way, you can have only events from certain event sources monitored; if the name of the event source contains a space, place the name in quotation marks.

INFO_<x>=[GREEN, YELLOW, RED, INACTIVE]                  (Default: GREEN)

Alert color that is to be assigned to events of the event type Information of the above event log from the event source defined by SOURCE_<x>.

WARNING_<x>=[GREEN, YELLOW, RED, INACTIVE]            (Default: YELLOW)

Alert color that is to be assigned to events of the event type Warning of the above event log from the event source defined by SOURCE_<x>.

ERROR_<x>=[GREEN, YELLOW, RED, INACTIVE]                (Default: RED)

Alert color that is to be assigned to events of the event type Error of the above event log from the event source defined by SOURCE_<x>.

SUCCAUDIT_<x>=[GREEN, YELLOW, RED, INACTIVE]        (Default: GREEN)

Alert color that is to be assigned to events of the event type Success Audit of the above event log from the event source defined by SOURCE_<x>.

FAILAUDIT_<x>=[GREEN, YELLOW, RED, INACTIVE]        (Default: RED)

Alert color that is to be assigned to events of the event type Failure Audit of the above event log from the event source defined by SOURCE_<x>.

●      Note that you must end the file with a period (.).

●      There must not be any spaces before or after an equal sign (=).

●      If parameters are required, this is highlighted. All other parameters are optional.

Example

You want to monitor in only the following event sources in the System event log:

●     Automatic Updates

●     Service Control Manager

Events from the event sources Automatic Updates should never trigger an alert, regardless of the type of event, but should rather always be reported as a green message. To do this, set the following entries in the configuration file SAPCCMSR.INI:

EventLogMon On
EventLogMon C:\usr\sap\prfclog\sapccmsr\evtmon_appl.ini

The event log template evtmon_appl.ini would have the following content:

EVENTLOG_TEMPLATE
EVENTLOG_NAME=System
MTE_CLASS=EventLogSystem

SOURCE_0="Automatic Updates"
INFO_0=GREEN
WARNING_0=GREEN
ERROR_0=GREEN
SUCCAUDIT_0=GREEN
FAILAUDIT_0=GREEN

SOURCE_1="Service Control Manager"
INFO_1=GREEN
WARNING_1= YELLOW
ERROR_1=RED
SUCCAUDIT_1=GREEN
FAILAUDIT_1=RED
.

 CCMS Agents, Advanced Functions of the CCMS Agents start page