...
- First, opEvents extracts the prospective nodes' host name from the input data.
The parser normally extracts ahost
property from the input, which may be an FQDN, DNS short name or IP address.
(The parser may also set the finalnode
property, but that's not recommended and our example parsing rules don't contain such operations.)
In case of the NMIS event log being the source, only the NMIS node name is available and is used as host name for all subsequent steps. - opEvents now looks for the one node that is identified by this hostname/address etc.
This is done by looking in a cache of associations between FQDNs, shortnames and IP addresses that opEvents maintains.
If this succeeds, then the node's name is set as the event'snode
property and the procedure is finished. - If no matching association is found, then the DNS is used to find potential intermediate associations.
Thehost
property is resolved via the DNS, forward to IP address if it was a hostname, or reverse to FQDN if it was an IP address. - If this intermediate step resulted in something that is associated with a known node, then that node is used and the intermediate info is added to the cache.
(There are also some internal safeguards to reduce the number of DNS requests opEvents might perform.) - If none of this worked, then the original raw, untranslatable,
host
property is used as a new node's name.
In opEvents 2.0.4 and newer, the configuration optionopevents_auto_create_nodes
controls the behaviour in this situation: if set to false, the event is skipped.
If set to true (or not present), then a new node record is created. (Older versions of opEvents always created new but somewhat incomplete node records in this case.)
...
- An event's
event.node
property will always identify the node that is associated with the event. - The event's
event.host
property is set from the raw inputs, and is very often not the same as a known node'snode.host
property, nor is it guaranteed to exist.
The only thing guaranteed aboutevent.host
is that at the time of the event creation it was somehow, possibly even just temporarily, associated with the node in question.
For NMIS eventlog as source theevent.host
is always the NMIS node name. - The opEvents dashboard and event-centric pages all show the
event.node
property as primary id, and theevent.host
property as supplementary information. - Editing a node's
host
oraddresses
properties in the Edit Nodes GUI does not affect any existing events; it just sets up association info for finding the right node for future events.