Based on the policy you define (or the defaults), PEP can take one or more of the following actions:

PEP maintains connections with all running GUIs to allow the inter-operability between them. This includes:

Using this rules-based method, new events can be generated and complex relationships between events can be created. The policy engine supports the following elements:

Timers can be used to set up rules based on multiple occurrences of an event within a given time period. Portions of an event can be modified, as shown in the following example (this effectively creates a new event from an existing one, which can then be further dispatched).

All data logs go directly into the EMD. All event logs go through PEP for additional dispatching.

The following CLI command terminates the pep daemon:

kill -2 <pid#>

This command sends an interrupt to the pep daemon, allowing it to shut down gracefully.

The following CLI command invokes the pep daemon:

./pep &

This command starts the daemon in the background. If you have changed the pathname for the rules.txt file (from $ENLIGHTEN/contrib/
rules.txt), you need to use the following command instead:

./pep -f yourpathname/contrib/rules.txt &

where yourpathname shows the full pathname to the rules.txt file.

event.name

Data type: string

Testname that generated the event. Testname as described in Chapter 10 of the EnlightenDSM Reference Manual.

event.time

Data type: data/time

Time when event was generated in system local time

event.hostname

Data type: string

Name of the host that caused the event

event.severity

Data Type: constant

Severity level of the event. May evaluate by constant in either string or numeric representation.

event.description

Data type: string

Descriptive text string about the event. Consists of the following components:

“testname measured-value threshold-type threshold-value timestamp”

event.state

Data type: string

Threshold type such as:

For Timer events, event states have one of the following constants:

event.threshold

Data type: string

The value of the threshold against which the measured value was compared resulting in an alarm.

event.measurement

Data type: string

The value that resulted in the alarm.

event.totalValStr 

Data type: string

Represents the total measured value for certain tests. The following tests support total value.

event.appclass

Data type: constant

The application class which issued the event.

event.units

Data type: string

The unit type of the event as depicted in the Events Configure Window of the EnlightenDSM GUI.

Values such as:

event.application

Data type: constant

Application type that sent the event. Evaluate this to determine the type of operation that triggered the event

Events can be modified by assigning values or constants to their event properties. A typical scenario would be to increment the severity of an event based on the measured value contained in the event. Lets say we want a CPU Load alarm, which is configured as Error severity (level 4) and a High threshold of 50, to escalate to Severe if the CPU load goes above 75. A rule to this effect would look like this:

rule escalateCpuLoad
     if ( event.name == “cpu load” and event.measurement >= 75 )
     then
         event.severity = Severe
     endif
;

In the above example the event was configured to be event.severity=Error before it passed through PEP. As PEP inspects the actual measurement it changes the severity to the next severity level by using the constant Severe.

Any event property can be modified to effect a particular outcome of the event.

When evaluating and assigning values to variables and event properties using constants, do not enclose the constant key- word in quotes as in:

     If (event.severity = Error )
     then . . .

          or
timer.state = Set

The following are examples of valid integer declarations:

-1  32  42235523  09

The following are examples of invalid integer declarations:

+24  +2442533

The following are examples of valid floating point number declarations:

4.2   0.332   -.442  -2.44   -0.243   89.0

The following are examples of invalid floating point number declarations:

3.2e02  +5.2 

Strings are anything in quotes (““) except the quote character itself. All string data types in PEP support regular expression matching, including wildcard matching. The following are examples of valid string declarations:

“Hello There” 
“He said *” 
“123” 
“I can punctuate...,,,”

The following are examples of invalid string declarations:

“what “?”
“ No end in site
was”sup

PEP supports partial time and date declarations. You can use the keyword timeofday to read the system's local time. Add the designators PM/AM to specify absolute time designation. This is what the engine looks for to distinguish between relative and absolute time references.

Dates are declared in U.S. notations and assume the local time of the host system. The notation is as follows:

month day year OR
month year

It does not support the European or Asian date notation of:

day month year OR
year month day

A few different styles of notations and separators are supported. The following are examples of valid date/time declarations:

12/95   12-95   12/3/1990   12-3-90
timeofday
Dec 4, 1992
Wed 9:00 PM
3 am
12:24:31 AM
Tuesday

The following are examples of invalid date/time declarations:

12:30
1995/12/3
1:1
15/7/96

Timers are special data types that are an extension of the date/time data type. Timers support relative and absolute time specifications. Relative time is either hr:min:sec or min:sec. The following are examples of valid timer declarations:

0:30   1:00:00   1:00

Remember that timers support all date/time declarations as well. Timers can also be manipulated programmatically. They have two fields:

You can use identifiers to name variables, rules, and timers. They must begin with a letter and can contain letters, numbers, or underscores (`_'). The following are examples of valid identifiers:

a1234  bbc  ABC  A_1234

The following are examples of invalid identifiers:

1A  A-Z  bor%d 

As a general rule, you should use lowercase letters for identifiers, since constants start with uppercase letters. This will help avoid confusion between identifiers and constants.

You can use constants to compare event subfields and timer states to preset states. Constants are actually strings and integers that are hardwired to a certain state. All constants begin with an uppercase letter. The following is a list of constants and their appropriate uses:

Events have one of these five severity types:

Okay 
Info 
Severe 
Warning 
Error

Events have one of these seven application types:

EventAckOne 
EventAckAll 
EventDeletePool
EventMoveIcon 
EventChangeMap 
EventInit 
EventTimer

Events have one of these three application classes:

EventClass 
AdminClass 
CLIClass

Timers have one of these three states:

Set 
Expired 
Cleared

Variables can be either dynamic or static. All variables must be explicitly assigned and are implicitly typed:

variable static x = 2

This variable declares a static variable x of an integer type and assigns the value of 2 to it. The following are more examples of valid variable definitions:

variable static y = 4.2 + 44.2
variable cc = “Hello World”
variable backup_time = 10:30 pm
variable now = timeofday

The variable's domain is implicit where it is declared. Global variables are always defined before any rule declarations and are accessible in any rule. Local variables are always declared after the rule declaration and only accessible to the rule that declared it. Variables that are named the same as global ones will hide the globals and continue until they go out of the local scope.

You can use timers to set the time-in and time-out of events in PEP. Time-outs generate events themselves. Timer states are implicitly set to “CLEAR” and must be initialized explicitly using the start-up event:

timer backup = 4:30 am
timer april_fools = Apr 1
timer one_minute = 0:60
timer one_a_day = 24:00:00

Rules are declared with the key word rule and followed by a name using a valid identifier. Rules must have a body:

rule myrule
  variable static count = 0
  if ( event.severity > 0 )
  then
    increment count
  endif
;

The rule myrule uses a local static variable to count the number of events that have a positive severity.

Assignments are performed by using the equal sign (=).

     variable or event property  = expression

where

variable is one of any locally or globally declared variable. See the Variables section in this chapter.

event property is any event property described under the Event Properties section in this chapter.

expression is one of the following objects:

Integer - is a value of 2³¹ for signed integers and 2³² for unsigned integers.

Floating point value - PEP supports floating point values to two digits to the right of the decimal point.

String - Any alpha-numeric sequence enclosed in quotes (“ ”).

Variable - A valid variable type supported by PEP.

Constant - A valid constant supported by PEP. See Constants in the Event Properties section in this chapter. Constants are not enclosed in quotes.

Date/Time expression - Any date/time expression supported by PEP. See the Date/Time section in this chapter.

Event Property - Any event property described in the Event Properties section in this chapter.

Complex arithmetic operation - The following arithmetic expressions are supported:

+, -, / ,*, %

Increment - Increments a counter

Increment mycounter is the same as mycounter = mycounter + 1

Decrement - Decrements a counter

Decrement mycounter is the same as mycounter = mycounter - 1

String Conversions

Several event properties are string objects. Even though some of these properties have a numerical nature, such as event.threshold, PEP retrieves and processes them as string values because event properties have different meanings among the different types of tests.

Therefore, it is necessary to convert these string properties to integer when performing any type of value comparison or calculation. Using PEPs left-to-right evaluation of expressions, converting a string element to an integer involves proper ordering of the elements in the expression. The first element in the expression must be of integer type:

variable a = 1
variable b = event.threshold

newval = a * event.threshold

               or put more simply

newval = 1 * event.threshold

Absolute date/time comparisons compare only the common elements defined. For example, variables a, b, c, and d are set as follows:

variable a = 12/19/95
variable b = 2 pm

variable c = Tuesday
variable d = timeofday

Assume the current time is “Tuesday Dec 19, 1995 2:25pm”. Comparing variable a, b, or c to variable d would evaluate to true because each comparison only compares the common date/time components. However, comparing a to b, b to c, or a to c would result in a false comparison since none share common components. If we added an additional variable e,

variable e = 2:25 pm

comparing e to b would result in a true expression since the only common components are the hour and am/pm designator.

The “string to time” conversion is not supported at this time.

PEP supports simple queries. Use the following syntax:

host in pool abc_pool

This command searches the pool abc_pool recursively to see if the host is in that pool or its subpools.

This is useful when you set up your own pools and subpools. You can write a rule to check if an event came from a certain pool of hosts. For example, the following code fragment will check if an event came from the pool “important_pool”:

if ( event.hostname in pool “important_pool” )
then
  event -> mail “user”
endif

Implicit Conversions - PEP supports manipulating different data types by using implicit data type conversion. Unlike C, which converts to the highest data type, PEP converts based on left-to-right evaluations of expressions.

Integer and floating point comparisons

variable  a = 2
variable  c = 4.2
variable  i = 0

In this first expression, a + c is evaluated as an integer added to a float. Since the integer is the first expression, c is also converted to an integer. The temporary result is an integer with a value of 6, thus causing the if expression to evaluate to false.

if ( a + c > 6 )
then
  increment i
endif

In this second expression, c + a is evaluated as a float added to an integer. Since the float is the first expression, a is converted to a float. The temporary result is a float with a value of 6.2. This temporary float also causes the constant 6 in the if expression to promote to a float of 6.0, thus causing the if expression to evaluate to true.

if ( c + a > 6 )
then
  increment i
endif

You can make decisions by using an “if/then/else/endif” expression in conjunction with logical expressions (==, !=, <, >, <=, >=, and, or). An if expression must have a then and a terminating endif statements; the else branch is optional.

variable count = 0
variable myval = 1

if ( event.hostname == “a*” )
then
  increment count
  if ( count >= 2 and my_val < 3 )
  then
    increment myval
  else
    decrement myval
  endif
endif

Use the stopmatch command to stop a rule's execution. When PEP encounters a stopmatch command, it will “break out” of the program and discontinue execution until the next event occurs.