Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
eptw Absent Member.
Absent Member.
508 views

Raw Event Details in Event Export to External System

Can raw event details be included in the XML file export when using "Export to External System" for a rule? I realize it's mostly correlated events, but was wondering if raw details could be included.

Labels (1)
Tags (3)
0 Likes
Reply
2 Replies
jason.ryan Absent Member.
Absent Member.

Re: Raw Event Details in Event Export to External System

Yes you can have exports include base events. Like you said, they will likely be mostly correlated events (depending on the rules), but it is possible. It does require a restart for the manager service, though.

SSH to the manager, go into the server.properties file under the manager home directory, and add the following:

perserve.baseevents=true

Restart the manger service and the exports should contain the base events. Hopefully this answered your question.

0 Likes
Reply
alex.rifman@att Absent Member.
Absent Member.

Re: Raw Event Details in Event Export to External System

Are you aware of any way to configure the number of levels that are exported?  Currently, it seems that only the Correlated event and the event(s) that made up the correlated event is exported.  However, in more elaborate correlations, I have multiple base/aggregated events making up one correlated event, which then gets correlated with other events.  In those cases, even when using "preserve.baseevents=true" only the top two levels of events are exported.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.