Description of the NMIS Event Log

Owned by Keith Sinclair (Deactivated)
Last updated: Jun 09, 2021 by Josune Cordoba (Unlicensed)
2 min read

The NMIS Event Log is a realtime update of what NMIS see's is happening with devices being managed.  By default the NMIS event log has this name, /usr/local/nmis8/logs/event.log

Event Log Output

The raw event log looks like this, a log entry exists when a Notification Policy has resulted in sending an email.

1360614047,nmisdev,Node Down,Major,,Ping failed
1360614109,nmisdev,Node Up,Normal,,Ping failed Time=00:01:03
1360618812,nmisdev,Service Down,Warning,port80,
1360619117,nmisdev,Service Up,Normal,port80, Time=00:05:05
1360624525,meatball,Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64 Threshold=95
1360624539,meatball,email to keiths@opmantek.com Esc0 Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64 Threshold=95
1360626325,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=19.10 Threshold=60 Time=00:30:00
1360626330,meatball,email to keiths@opmantek.com UP Notify,Normal,Dialer1,Value=19.10 Threshold=60 Time=00:30:00

Event Log Contents

The fields which are included in each event are described here.

Event Log DataDescription
timeThe UNIX time of the event
nodeThe node name which NMIS knows the node by
eventThe name of the event, possible values at present are listed in this article NMIS Event List.
level

The event level, possible values are:

  • Fatal
  • Critical
  • Major
  • Minor
  • Warning
  • Error
  • Normal
  • Unknown
elementThe specific element of the node experiencing this problem. This will be an interface, service name, disk or processor ID, etc.
detailsOther details about the event, like threshold values, time event was active

Poller Event Log

When viewing the Poller_Event_Log, you are viewing syslog events from NMIS poller servers sending events in by syslog.  The end of the line incluse the sending server with a ":: servername" appended to the end.

NMIS 12-Feb-2013 09:15:25 meatball Proactive Interface Input Utilisation Fatal Dialer1 Value=127.64 Threshold=95 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 09:15:25 meatball Proactive Interface Input Utilisation Fatal ATM0.1-aal5 layer Value=126.42 Threshold=95 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 07:40:12 nmisdev Service Up Normal port80 Time=00:05:05 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 07:40:12 nmisdev Service Down Warning port80 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Closed Normal ATM0.1-aal5 layer Value=9.63 Threshold=60 Time=00:15:00 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Closed Normal Dialer1 Value=9.66 Threshold=60 Time=00:15:00 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:50:11 nmisdev Service Up Normal port80 Time=00:05:03 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:50:11 nmisdev Service Down Warning port80 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Warning Dialer1 Value=61.86 Threshold=60 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:45:19 meatball Proactive Interface Input Utilisation Warning ATM0.1-aal5 layer Value=61.96 Threshold=60 :: nmisdev64.dev.opmantek.com
NMIS 12-Feb-2013 06:40:24 meatball Proactive Interface Output Utilisation Closed Normal ATM0.1-aal5 layer Value=44.55 Threshold=60 Time=00:04:55 :: nmisdev64.dev.opmantek.com

The raw poller log file will look like this:

Feb 12 07:00:29 localhost nmis.pl[24461]: NMIS_Event::nmisdev64.dev.opmantek.com::1360615519,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=9.66, Threshold=60 Time=00:15:00
Feb 12 07:00:29 localhost nmis.pl[24461]: NMIS_Event::nmisdev64.dev.opmantek.com::1360615519,meatball,Proactive Interface Input Utilisation Closed,Normal,ATM0.1-aal5 layer,Value=9.63, Threshold=60 Time=00:15:00
Feb 12 07:40:26 localhost nmis.pl[25222]: NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Down,Warning,port80,
Feb 12 07:45:29 localhost nmis.pl[25326]: NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Up,Normal,port80, Time=00:05:05
Feb 12 09:15:39 localhost nmis.pl[27058]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation,Fatal,ATM0.1-aal5 layer,Value=126.42, Threshold=95
Feb 12 09:15:39 localhost nmis.pl[27058]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation,Fatal,Dialer1,Value=127.64, Threshold=95
Feb 12 09:45:31 localhost nmis.pl[27678]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation Closed,Normal,Dialer1,Value=19.10, Threshold=60 Time=00:30:00
Feb 12 09:45:31 localhost nmis.pl[27678]: NMIS_Event::nmisdev64.dev.opmantek.com::1360624525,meatball,Proactive Interface Input Utilisation Closed,Normal,ATM0.1-aal5 layer,Value=18.97, Threshold=60 Time=00:30:01

The first part of the lins is added by syslog "Feb 12 07:00:29 localhost nmis.pl[24461]:"

The rest of the line "NMIS_Event::nmisdev64.dev.opmantek.com::1360618812,nmisdev,Service Up,Normal,port80, Time=00:05:05" is a normal NMIS Event log entry, with "NMIS_Event::servername::" appended to the front of the log entry.