Table of Contents
Advertisement
Icon
Name
Event Source
Server
9.4.1 Component Status Indicators
Indicators are used to represent various states as follows:
Component Status Indicators
Table 9-5
Icon
Name
Stopped
Running
Warning
Error
Reporter Time is
Skewed
Debug
Unknown
To set an attribute filter for displaying components:
1 In the Sentinel Control Center, click Source Management in the menu bar and select Live View
or Scratch Pad.
2 Click the Attribute Filter frame.
3 Specify the Search and Limit to criteria.
4 Select the Running or Stopped check box to specify the status of the components.
To hide components based on type:
1 In the Sentinel Control Center, click Event Source Management in the menu bar and select Live
View or Scratch Pad.
2 Click the Attribute Filter frame.
Description
The event source represents the actual source of data for Sentinel.
Unlike other components this is not a plug-in, but is a container for
metadata, including runtime configuration, about the event source.
In some cases a single event source could represent many real
sources of event data, for example if multiple devices are writing to
a single file.
Description
Indicates that the component is stopped.
Indicates that the component is running.
Indicates that a warning is associated with the component. At this
time, this warning indicator is primarily used to show when the
configured state and actual state of a component differ, that is, a
component is configured to be running, but the actual state of the
component is stopped.
Indicates that an error is associated with the component. See the
individual component's status display for details about the error.
Indicates when the time of a component differs from the main
server's time. The difference is greater than a predefined time
threshold.
Indicates that the component is in Debug mode. Only a Collector can
be in Debug mode.
This indicator is displayed when the status of the object in the ESM
panel is not yet known.
Event Source Management 185
Advertisement
Table of Contents
