dfm event list -q differs from what is shown in the GUI

[JGPSHNTAP]

So, i'm just curious as why i don't see all the events when i dump dfm event list -q.  When I open up the GUI dashboard and click events, I see events that aren't listed in dfm event list -q

The reason why this is important to me is because i'm doing event based acknowledgement and deletion based on dates and the GUI is throwing me off.  The CLI loks fine,

Any comments would be great.

[arunchak]

HI,

In GUI Events page, by default filters are added for current and non current event types and the event severity column. Can you clear those filters and check.

Thanks,

  Arun

[adaikkap]

Hi 

   Instead use the events report.

linux-t5gs:~ # dfm report | grep -i events-

   events-current-report     Report of all the current unresolved events with warning or above severity

  events-all-report         Report of all events with warning or above severity

  events-warning            show current warning or worse events

  events-error              show current error or worse events

  events-critical           show current critical or worse events

  events-emergency          show current emergency events

  events-unack              show unacknowledged events

  events-perf               show current performance events

  events-config-changes     show current configuration changed locally events

  events-history            show all historic events

  events-history-deleted    show all deleted historic events

  events-history-acked      show all acknowledged historic events

  events-history-perf       show all historic performance events

linux-t5gs:~ #

Regards

adai

[JGPSHNTAP]

Adai,

Ok, that's show all the events... Now i will re-write the code to do the autoacknowledgement based on event report.  

So, basically, i'm writing powershell command to purge all events older than 7 days.  Now the frustrating part is that you guys don't put the year for current year, so I have to create a date based object to handle this.

Any chance on adding current year?

[adaikkap]

Hi

   The current behaviour is not going to change. BTW you can also use the dfm event detail <eventid> |grep -i eventtimestamp to get the year as well.

linux-t5gs:~ # dfm event detail 276 | grep -i eventTimestamp

eventTimestamp                    2013-07-17 06:11:10.000000

linux-t5gs:~ #

Regards

adai

[JGPSHNTAP]

Adai,

The issue is that isn't scalable for the solution i'm looking for.  So, what i need to do is your take your report, and create a date based object to do purging from.

I have to get you involved with powershell man.. It's the ticket.. 🙂

[adaikkap]

Hi,

Based on the value set for eventpurgeinterval,during upgrade or restores to version 5.2 event older than the value of the option are purged.

Regards

adai

[JGPSHNTAP]

Oh, that's great news... I just installed that in our DEV environment.  So, maybe I don't need this custom switch after all

[JGPSHNTAP]

Adai - That option

eventspurgeinterval - it's set to 4 weeks.   But that's not working in our production environment.  What does that actually do, b/c If I do a dfm report events, I still see the data from April.   

So what exactly does that option do

[adaikkap]

If you had upgraded to 5.2 with value of 4 weeks and all events older than 4 weeks would have been purged. But post upgrade, it starts accumulating. The behaviour is changing the upcoming release, similar to what happens during upgrade.

Regards

adai