Events

In addition of collecting tabular performance data, habitat also has the ability to monitor data and files for patterns and thresholds, executing arbitrary jobs as a result. If the jobs generate additional logs, then it provides a complement for polled tabular data and is able to put these details into context.

It is also possible to use this mechanism to execute external processes, send email, pager or SMS messages or to carry out a specific set of data collection. In this way, habitat can change its job profile dependent on the statistical information it finds.

Event Queue

Events in habitat are used for creating jobs and are the culmination of watching data for patters, threshold crossing or direct injection.

When an event is raised by watching patterns or thresholds, it is appended to a single event queue. An event tracker job (using the clockwork method event) picks up new instructions and executes them. Once executed, the new state is stored so that events are not replayed if clockwork is restarted.

All job methods available in clockwork's job mechanism may also be used in event processing. See the event table format later in this document or the Administration manual for more details.

Watching Jobs

Data is watched by a set of tasks held in the clockwork job table. Each has a checking frequency and associates a set of named watch sources (see below) with a set of named patterns and if matched, their actions (see below).

The job method called by clockwork is pattern, which takes two arguments. This first is the patter-action route list, a route to a list of patterns and the second is the watch route, a route to a list of routes to watch.

When the pattern is matched and the embargo conditions allow, then an event is composed using information from the pattern-action table. This comprises a set of instructions

See the administration guide for more information.

Watched Sources

The sources that are watched are held in a simple list of routes, conventionally called watched,0 (fully rs:<hostname>.rs,watched,0). This table is normally made available in the choice tree under events->watched sources. Multiple named watch lists can exist, used only when referred to by a watching job. When ever a watch list is updated, it will be reread by the watching process without the need to restart clockwork.

Pattern-Action Data

A table of pattern-matching data is stored in a route conventionally called patact,0. This is made available under the choice tree events->pattern-action. Multiple named tables can exist, used only when they are referred to by a watching job. When ever a pattern-action table is updated, it will be reread by the watching process without the need to restart clockwork.

The table has the following columns:

Pattern	The regular expression to look for as a pattern, which should normally match a single line. Each match is considered an event.
Embargo time	The number of seconds that must elapse after the first event before another event may be raised of the same pattern from the same route.
Embargo count	The maximum number of identical pattern matches that can take place before another event is raised for that pattern and route.
Severity	How important is the event. One of: fatal, error, warning, info, diag, debug
Action method	The execution method of the event
Action arguments	The method specific arguments that aid in writing the event
Action message	The message template used to describe the event when it is sent on. It may contain special tokens of the form %<char> that describe other information about the event.

If the embargo time is reached, then the time is reset. If the embargo count is reached, then the count is reset.

The action message is used to form describing text, to be sent to the method and argument set. The methods are the same as those supported by the clockwork's job table.

Thresholds

Thresholds are not yet available.