WhatsUp Gold User's Guide v8.0 - Adding Events to the Events Library

Adding Events to the Events Library

To see what events are available for use, go to Configure->Events Library. The Events Library displays all available event types you can use. To add an event, select the desired event type and click New.

You can also do the following from this dialog:

Click Edit, if you want to edit an event. (First select the event you want to edit.) You can also double-click the desired event to edit it.

Note: To edit an SNMP trap that is defined in your traps.txt file, you must first change the Display Name and click OK. Then you can select your new trap and make edits to it. Or, you can directly edit the traps.txt file with a text editor.

Click Delete, if you want to delete an event. (First select the event you want to delete.)

Note: Any events you define are stored in the Event subdirectory where WhatsUp Gold is installed.

Defining an SNMP Trap Event

From the Events Library, select SNMP traps, and click New.

Display Name. Enter a unique name for this event.

Enterprise/OID. Use the browse button to select the desired object identifier (OID) from the Enterprise section of the MIB. This is the SNMP enterprise identifier in the trap, which is used for unique identification of traps for a particular application. If you specify the OID in this field, then an incoming trap will match this rule only if the trap enterprise field begins with the OID that you have specified. If you are unsure of the OID to use, or don't care to be specific, you can leave this field blank and it will be ignored. NOTE: This is grayed out unless the Generic Type is "6-EnterpriseSpecific".

Generic Type (Major). Each trap has a generic type number. The Generic types are 0-coldStart, 1-warmStart, 2-linkDown, 3-linkUp, 4-authenticationFailure, 5-egpNeighborLoss, 6-enterpriseSpecific. This number is part of the rule that determines the matching criteria for an incoming trap. NOTE: The definitions of 0 through 6 are not WhatsUp Gold definitions, but come from the SNMP specifications.

Specific Type (Minor). This can have an integer value from 0 to 2147483647. When this field is to be matched, the Generic Type must be always enterprise specific. If you want to ignore this field, select "Any".

You can click the Add button and this will take you to the Expression Editor where you can enter an expression that will be used to filter the traps that you receive. If a trap's payload matches this expression, the trap will be reported to WhatsUp Gold. After creating the message, clicking OK will insert that string into the Payload box.

Note: To learn more on the use of the Expression Editor, begin reading with "Script Syntax".

You can Edit, or Remove a message by selecting it and clicking the appropriate button.

NOTE: There are two buttons on the right side of this dialog (in the Auto Fill section).

Browse. The browse button launches the WhatsUp Gold SNMP Trap Log Viewer (as if you had selected Logs->SNMP Trap Log). This allows you to find a line from an event you want to use. You can select this, right-click, and click Copy.
Paste. The paste button allows you to paste (from the SNMP Trap Log) your copied information into this WhatsUp Gold SNMP Trap event. This button remains grayed unless WhatsUp Gold detects the contents in the clipboard as relevant data that was copied from the SNMP Trap log.

Defining a Syslog Event

From the Events Library, select Syslog, and click New.

Display Name. Enter a unique name for this event.

To create a filter, click the Add button. This takes you to the Expression Editor where you can enter an expression that will be used to filter the Syslog events that you receive. If the Syslog event matches this expression, the Syslog event will be reported to WhatsUp Gold. After creating the message, clicking OK will insert that string into this message box.

You can Edit, or Remove a message by selecting it and clicking the appropriate button.

NOTE: There are two buttons on the right side of this dialog.

Browse. The browse button launches the WhatsUp Gold Syslog Log Viewer (as if you had selected Logs->Syslog Log). This allows you to find a line from an event you want to use. You can select this, right-click, and click Copy.
Paste. The paste button allows you to paste (from the Syslog Log) your copied information into this WhatsUp Gold Syslog Event. This button remains grayed unless WhatsUp Gold detects the contents in the clipboard as relevant data the Syslog log copies there.

Defining a Windows Log Event

From the Events Library, select Windows Log, and click New.

Display Name. Enter a unique name for this event.

Source. This is the service or program that logs the event and generates the description below.

Type. Use the list box to select the desired type. NOTE: There are five types of messages predefined by Windows, including Error, Warning, Information, Success Audit and Failure Audit. You can choose one of these types, or "Any" if you do not want to specify a specific type.

Event ID. This is the event number used to identify the specific event.

Description. This is a list of regular expressions to match. Only logged descriptions which match these expressions will be converted to events. This will help filter down log events to a manageable load, and avoid generating a huge number of unnecessary notifications. There is no sequencing in this box, so the order the descriptions appear is not important.

Note: To add a new description, click the Add button. This takes you to the Expression Editor where you can create your desired expression. After creating the expression, you should test your expression. Once the expression is what you want it to be, click OK and this will insert that string into this Description box.

You can Edit, or Remove a description by selecting it and clicking the appropriate button.

There are two buttons on this dialog (in the Auto Fill section).

Browse. The browse button launches the Event Viewer application. This allows you to find an event you want to use. Double-click the desired event to see the properties dialog, and depending on your Operating System, you can select this event and click Copy. Click Help and to learn about the different Operating Systems.
Paste. The paste button allows you to paste (from the Event Viewer) your copied information into this WhatsUp Gold Windows Event Log. This button remains grayed unless WhatsUp Gold detects the contents in the clipboard as relevant data copied from the Event Viewer.

Ipswitch, Inc.
http://www.ipswitch.com


©Ipswitch 2003