|
|
The Query Editor is available as a service in the Object Group Manager and Event Browser applications. It gives you the option to create object groups or browse events based on a query. The query is set up using a number of criteria which can be configured to match your requirements. You can choose to include or exclude devices or events (for example, include all events of major severity).
The Query Editor is split into tabbed sections. Different applications may use the Query Editor with different combinations of criteria, refer to "Event Browser," or "Object Group Manager," for more information. This section describes all possible criteria.
Step 1 Open the Query Editor.
Step 2 Scroll through the tabs to see the following options:
Four types of panels exist beneath the tabs:
Each of the tabs contains a criteria to be matched against system objects or events. The Query Editor is used to construct a query by including criteria relevant to the objects or events that are needed.
Step 3 Set the criteria in all of the tabbed windows as described in the "Severity Tab" section through the "Object Attribute Value Tab" section.
Step 4 From the File menu select Close or
press Ctrl + W or
click the Close icon 
from the tool bar.
A dialog box asking Save query changes? is displayed.
Step 5 Click Yes to save changes or No to cancel.
You can activate all query criteria selections. If you choose to activate all query criteria, however, and there is a criteria with no values set, that query will pass all of the objects or events which match the other set query criteria.
From the Edit menu in the Query Editor window, select Activate All or
click the Activate All icon 
from the tool bar. All of the tabbed sections are activated (they all become dark gray.)
You can deactivate all criteria selections. This reverts the query to an empty query and returns no results.
From the Edit menu on the Query Editor window, select Deactivate All or
click the Deactivate All icon 
from the tool bar. All of the tabbed sections are deactivated (they all become light gray.)
Click the Activate button if the tab is not active.
On tabs with two panels (Available Values and Selected Values), you can:
Step 1 Select the relevant entry in the Available Values list.
It becomes highlighted.
Step 2 Click the double right arrow button or double click the selected entry.
The selected entry appears in the Selected Values list.
On tabs with two panels (Available Values and Selected Values), you can:
Step 1 Select the relevant entry in the Selected Values list.
It becomes highlighted.
Step 2 Click the double left arrow button or double click the selected entry.
The selected entry is removed from the Selected Values list.
On tabs with two panels (Available Values and Selected Values), you can:
Step 1 Move all of the selected values from one list to the other by right clicking on an entry in the list.
Step 2 A pop up menu appears. Click on Select all. This highlights all entries in the list; or, click on Deselect to return a highlighted list to normal.
Step 3 Move the selected entries to the desired list.
The Query Editor gives you the option to configure queries to match your requirements. You can choose to include or exclude these criteria as outlined below.
The Severity tab is displayed by default and allows you to specify severity types as query criteria. The left panel displays Available Values; the right panel displays Selected Values.
One or more severities can be selected. To show objects with any severity that matches other set criteria, select no particular severity.
The Time window is accessed by selecting the Time tab.
The Time query allows you to specify the following:
Time---you set a start time and a finish time using the 24 hour notation. The times are inclusive. When the time query is selected, any event which occurs between the specified times and matches the other queries set is included. For example, if the times specified are From 09:00:00 To 11:00:00 and two events are reported, the first at 08:59:45, and the second at 09:01:35, only the second event would meet the time criteria specified.
From 09:00:00 To 08:59:59, all events reported match this time criteria.
Day---when the Day query is selected, any event which occurs between the specified days and matches the other criteria set is included. For example, if the days specified were From Monday To Thursday and two events are reported, the first on a Tuesday and the second on a Sunday, only the first event would meet the day criteria specified.
From Tuesday To Monday, all events reported match this Day criteria.
Date---when the Date query is selected, any event which occurs between the specified dates and matches the other criteria set is included. For example, if the dates specified were From May/18/1999 To May/25/1999 and two events are reported, the first on May/19/1999 and the second on May/26/1999, only the first event would meet the date criteria specified.
When the Time tab is not activated, all active events are shown that match the other query criteria, but will not query on time.
From 08:00:00 To 12:00:00, Day From Friday To Monday and Date From Mar/12/1999 To Apr/14/1999, all events reported between eight and twelve o'clock in the morning on any Friday, Saturday, Sunday, or Monday between the 12th of March and the 14th of April, meet the criteria set.
When a range is inactive, the displayed text is grayed out. When a range is active, the button next to it appears depressed and the text is displayed in black.
Step 1 Click the button next to Time.
The data entry boxes become active.
Step 2 Enter the start time in the data entry box under From.
Step 3 Enter the finish time in the data box under To.
Step 1 Click the button next to Day.
The drop down menus become active.
Step 2 Select the start day from the list under From.
Step 3 Select the finish day from the list under To.
Step 1 Click the button next to Date.
The data entry boxes become active.
Step 2 Enter the start date in the data entry box under From, using the format <Mmm>/<dd>/<yyyy> (month, day number, year number).
Dec or Apr).
Step 3 Enter the finish date in the data box under To, using the format
<Mmm>/<dd>/<yyyy> (month, day number, year number).
You can use this panel to query on the status of events. The available values are:
One or more status options can be selected. To show events in any state which match other set criteria, select no particular status.
Step 1 Select the relevant status to appear in the Selected Values list.
Step 2 Remove any status not required from the Selected Values list.
Step 3 Click the Event Status tab.
Source Domain is a unique name which represents the physical domain on the network that an event comes from. A Source Domain could be:
You can use this window to query on the Source Domain of an event. This allows you to specify source types as a query criteria. For example, the query can be set up to query for SNMP events generated by an SNMP device on the network.
The Source Domain window is accessed by clicking the Source Domain tab.
Step 1 Select the relevant Source Domains to appear in the Selected Values list.
Step 2 Remove any Source Domain not required from the Selected Values list.
Step 3 Click the Source Domain tab.
Management Domain is a sub-division within a Source Domain. For SNMPv1, it is the enterprise ID of the trap that generated the event. For SNMPv2/v3, it is the unique ID of the notification that generated the event.
The Management Domain is a string that looks like "1.3.6.4". It is defined by the vendor of the physical device and defined within the MIB.
For example, Company A could have a management domain of 1.3.6.1.4.1.285. This allows Company A to define its routers as Router 1 : 1.3.6.1.4.1.285.1.1 andRouter n : 1.3.6.1.4.1.285.n.1. You can use this to define a query to accept all of the routers (everything under .285) or individual routers (285.1.1).
The Mgmt Domain window is accessed by clicking the Mgmt Domain tab.
Step 1 Select the relevant Management Domains to appear in the Selected Values list.
Step 2 Remove any Management Domain not required from the Selected Values list.
Step 3 Click the Mgmt Domain tab.
The User tab allows you to specify user(s) as a query criteria. The left panel displays Available Values and always includes system and admin by default. Selected Values are shown in the right hand panel.
One or more users can be selected. In the Event Browser, this will query events that have been acknowledged or cleared by the user selected in the query.
The system user is created for the purpose of having a distinct value (in the UserId field, where applicable) for tasks that are automatically carried out by system processes (for example, clearing of alarms over a certain age).
The admin user is the application super-user and should not, in general, be used by someone for day-to-day tasks. Allowing filtering on this user enables this monitoring to be carried out.
The Event Class tab allows you to specify event classes as query criteria. The left panel displays Available Values and the left panel displays Selected Values.
One or more event classes can be selected. To show any event classes which match other set criteria, select no particular event class.
The Object Scope tab is used to define managed objects and scopes in the query. You can include ranges of objects by specifying a scope, or add individual objects. The Object Scope tab incorporates three options:
To add scopes to the query, proceed as follows
Step 1 Click the Add Scope button.
A view of the managed network, similar to the window shown in Figure 11-9 is displayed.
In the Hierarchy view, you have the option to set the following criteria:
Step 2 Select the start object you require with the correct criteria, then click Apply.
The view scope is shown on the Object Scope tab.
Step 3 You can remove a scope from the list by clicking on the scope and selecting Remove.
Step 4 Click the Object Scope tab.
To add objects to the query, proceed as follows:
Step 1 Click the Add Object button.
The Object Selector window, shown in Figure 11-10 is displayed.
Step 2 Select the object(s) you require, then click Apply.
The object(s) are shown on the Object Scope tab.
Step 3 Click the Object Scope tab.
In the Object Scope tab, select the object(s) you want to remove from the list, then click Remove.
You use this window to select one or more object classes to include in the query. The left panel displays Available Values and Selected Values are shown in the right hand panel.
You can use this window to select one or more object attributes to include in the query.
Step 1 The window comprises two lists:
Step 2 Click the Object Attribute Presence tab.
You can use this window to select one or more object attribute values to include in the query.
Step 1 The window comprises three lists:
Step 2 Click the Object Attribute Value tab.
Posted: Fri Jan 7 15:28:29 PST 2000
Copyright 2000©Cisco Systems Inc.
