Novell SENTINEL 6.1 SP2 - 02-2010 User Manual page 415

Options
Event Forwarding mode
Configuring the Rule to Forward Events to Another System
The Sentinel Log Manager is installed with a rule that forwards events to another sentinel
system.The rule is called Forward Events to Another Sentinel System. By default, the Forward
Events To Another Sentinel System rule is configured to filter out internal system events and events
with severity greater than three. This rule filters the following three types of system events:
Audit (A)

Performance (P)

Internal (I)

You can also change the conditions of the rule to filter more events or remove conditions to filter
fewer events.
Novell recommends that you configure the rule to forward only those events that you want to store
on the Sentinel system for more in-depth reporting and analysis.
Activating the Rule to Forward Events to Another Sentinel System
The Forward Events To Another Sentinel System rule is installed with Log Manager, but it is in the
inactive (off) state. To forward the system events to another Sentinel system, the rule must be
activated, and the Sentinel Link Integrator settings must be configured.
1 Log in to the Log Manager Web interface as an administrator.
Description
Select one of the following options to specify the Event
Forwarding Mode:

Forward Events Immediately: Select this option to
forward the events immediately to the receiver.

Scheduled Event Forwarding: Select this option to
schedule event forwarding. You can specify Time Of Day
and Duration (in minutes) for each day of the week. The
valid format for Time Of Day is hh:[mm] [am|pm]. The
duration must be between 1 and 1440 minutes.
If you do not specify time or duration for any of the days in
the week, the schedule is considered to be 24 hours a day,
seven days a week. It is equivalent to the Forward Events
Immediately option.

Queue Events Only (do not forward): Select this option
to stop forwarding events to the receiver system. However,
the integrator stores events it receives in its queue unless
the queue has a size limit and has reached its capacity.
This mode is useful if the receiver is down for maintenance
or any network problems persist in communicating with the
receiver system that might not be fixed immediately. In
such situations, rather than continually trying to forward
events, you can select this option to temporarily stop
forwarding messages. After the problems are resolved, you
can re-enable event forwarding by selecting the Forward
Events Immediately or Scheduled Events Forwarding
options.
Sentinel Link Solution 415