The NMIS Event Log is a realtime update of what NMIS see's is happening with devices being managed. By default the NMIS event log has this name, /usr/local/nmis8/logs/event.log
Event Log Output
The raw event log looks like this, a log entry exists when a Notification Policy has resulted in sending an email.
1360614047,nmisdev,Node Down,Major,,Ping failed 1360614109,nmisdev,Node Up,Normal,,Ping failed Time=00:01:03 1360618812,nmisdev,Service Down,Warning,port80, 1360619117,nmisdev,Service Up,Normal,port80, Time=00:05:05 1360624525,meatball,Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64 Threshold=95 1360624539,meatball,email to keiths@opmantek.com Esc0 Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64 Threshold=95 1360626325,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=19.10 Threshold=60 Time=00:30:00 1360626330,meatball,email to keiths@opmantek.com UP Notify,Normal,Dialer1,Value=19.10 Threshold=60 Time=00:30:00
Event Log Contents
The fields which are included in each event are described here.
| Event Log Data | Description |
|---|---|
| time | The UNIX time of the event |
| node | The node name which NMIS knows the node by |
| event | The name of the event, possible values at present are listed in this article NMIS Event List. |
| level | The event level, possible values are:
|
| element | The specific element of the node experiencing this problem. This will be an interface, service name, disk or processor ID, etc. |
| details | Other details about the event, like threshold values, time event was active |
Poller Event Log
When viewing the Poller_Event_Log, you are viewing syslog events from NMIS poller servers sending events in by syslog. The end of the line incluse the sending server with a ":: servername" appended to the end.
 12-Feb-2013 09:15:25 meatball Proactive Interface Input Utilisation Fatal Dialer1 Value=127.64 Threshold=95 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 09:15:25 meatball Proactive Interface Input Utilisation Fatal ATM0.1-aal5 layer Value=126.42 Threshold=95 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Closed Normal ATM0.1-aal5 layer Value=9.63 Threshold=60 Time=00:15:00 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Closed Normal Dialer1 Value=9.66 Threshold=60 Time=00:15:00 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Warning Dialer1 Value=61.86 Threshold=60 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Warning ATM0.1-aal5 layer Value=61.96 Threshold=60 :: nmisdev64.dev.opmantek.com |
| 12-Feb-2013 06:40:24 meatball Proactive Interface Output Utilisation Closed Normal ATM0.1-aal5 layer Value=44.55 Threshold=60 Time=00:04:55 :: nmisdev64.dev.opmantek.com |
The raw poller log file will look like this:
Feb 12 07:00:29 localhost nmis.pl[24461]: NMIS_Event::nmisdev64.dev.opmantek.com::1360615519,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=9.66, Threshold=60 Time=00:15:00 Feb 12 07:00:29 localhost nmis.pl[24461]: NMIS_Event::nmisdev64.dev.opmantek.com::1360615519,meatball,Proactive Interface Input Utilisation Closed,Normal,ATM0.1-aal5 layer,Value=9.63, Threshold=60 Time=00:15:00 Feb 12 07:40:26 localhost nmis.pl[25222]: NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Down,Warning,port80, Feb 12 07:45:29 localhost nmis.pl[25326]: NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Up,Normal,port80, Time=00:05:05 Feb 12 09:15:39 localhost nmis.pl[27058]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation,Fatal,ATM0.1-aal5 layer,Value=126.42, Threshold=95 Feb 12 09:15:39 localhost nmis.pl[27058]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64, Threshold=95 Feb 12 09:45:31 localhost nmis.pl[27678]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=19.10, Threshold=60 Time=00:30:00 Feb 12 09:45:31 localhost nmis.pl[27678]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation Closed,Normal,ATM0.1-aal5 layer,Value=18.97, Threshold=60 Time=00:30:01
The first part of the lins is added by syslog "Feb 12 07:00:29 localhost nmis.pl[24461]:"
The rest of the line "NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Up,Normal,port80, Time=00:05:05" is a normal NMIS Event log entry, with "NMIS_Event::servername::" appended to the front of the log entry.