Previous Topic: Normalized and Raw Event TypesNext Topic: Run an Event Search


Event Data Sources

Event data sources are connectors that are feeding events into the Event Store on each connector system. The available data sources are listed under Data Source in the Events tab of the Event Policy dialog. If a connector appears under Data Source, then you can run a search and deploy policy on its events. The data sources can be any of the following:

Connectors

Each CA Catalyst connector reporting to the SA Manager appears as an individual data source. Individual connector data sources display in the following format: connectorname_domainserver@connectorserver.

connectorname

Defines the common name of the connector, such as Sample Connector.

domainserver

Defines the host name of the system where the integrated domain manager is installed.

connectorserver

Defines the host name of the system where the connector is installed.

Connectors with multiple instances configured on the same system have a separate entry for each instance.

Event connector sources

The sources that are provided by the Event connector, such as the Windows Event Log and CA NSM Event Management, appear separately from one another in the following format: adaptor_connectorserver@connectorserver.

adaptor

Defines the name of the Event connector source, such as MS-Syslog (Windows Event Log).

Mid-tier connector

The Mid-tier connector is automatically installed on the SA Manager and displays in the following format: Event Management MidTier Connector_SAManagerserver@connectorserver. All events are routed through the Mid-tier connector before appearing as alerts on the Operations Console. Search on the Mid-tier connector to search on events from all sources, and deploy event policies on the Mid-tier connector to perform actions on events from all sources.

Select a data source to view its details in the Details tab and automatically scope the Event Search tab to search on that source only. When you deploy a policy on a data source, the policy appears underneath that data source entry.

The data sources display depending on the status of the CA SAM Event Management service and the connector as follows: