Correlation Action Definition; Correlation Engine Configuration; Correlation Engine Is Running - Novell SENTINEL 6.1 SP2 - 02-2010 User Manual

B.9.1 Correlation Action Definition
Correlation Engine - Correlation Action Definition
Table B-72
Tag
Severity
Event Name
Resource
SubResource
Message
B.9.2 Correlation Engine Configuration
Correlation Engine - Correlation Engine Configuration
Table B-73
Tag Value
Severity
Event Name New/Update/Remove
Resource Correlation
SubResource CorrEngineConfig
Message Correlation Engine ID: <ID> Name: <name> Active: {2}
B.9.3 Correlation Engine is Running
The correlation engine process can be idled by the user. Its running state determines whether the
active process is processing events or not. The process starts in the idle (stopped) state and waits to
retrieve its configuration from the database. This event is sent when the engine changes state from
stopped to running.
Correlation Engine - Correlation Engine is Running
Table B-74
Tag
Severity
Event Name
Resource
SubResource
Message
Value
New/Update/Remove
Correlation
CorrelationActionDefinition
Action Name: <name> with Id: <ID>
Value
1
EngineRunning
CorrelationEngine
CorrelationEngine
Correlation Engine is processing events.
System Events for Sentinel 493