1.1 Event Distribution

July 7th, 2025

RBAC required: bear: Log and system monitoring

BEAR support three main types of application event logging:

• Native
  Always enabled an logs events at all severity levels.
• Syslog
  Events sent to Syslog for the defined severity levels. Note that ACHE comes with a Syslog configuration tool called TOOL which can in turn be used to forward Syslog events to a remote centralized Syslog host.
• Email
  Events sent to one or more defined email recipients for the defined severity levels.

These are not mutually exclusive. Events will always be logged to the BEAR event database but can additionally be logged to Syslog, email, or all three.

Event distribution is intended to notify specific recipients of abnormal application events. As such Syslog and email distribution targets do not log informational events. Distribution is primarily for the following severity levels:

• Warning
• Severe
• Critical
• Fatal

In addition, you can also change how the end users experience abnormal events by setting a redirect URL trigger. Most applications will have a suitable user facing method for dealing with abnormal events. However, you may want to override this with your own action. For example, if a critical event occurs, you could have these event severity automatically forward users to your internal IT support page for raising a service request.

1.1.1 Creating & Viewing a Custom Event Distribution Profiles

1. From the Admin Tools menu, select Event Distribution and activate the Distribution tab if not already active.

At this point, you can review the current settings or proceed to step 2 to make changes.

2. For one or more severity levels make changes to the profile by setting the Distribution type, Recipients (only applicable if Email is selected), and provide an optional end user facing URL to display.

3. Click Apply to activate the profile immediately.

1.1.2 Viewing the Event Dictionary

Each application has its own log events. Each event has the following attributes:

• Application package name
• Event number
• Class
• Severity
• Text

Event text might change without notice. For this reason, only the first four items listed above should be used for any automated event detection.

When logged the events contain additional fields to describe such things as:

• Timestamp
• User
• Client IP address
• Server hostname
• Source file
• Class and Method/Function

To view the event dictionary for any installed application, do the following:

1. From the Admin Tools menu, select Event Distribution and activate the Reference tab.

2. From the application dropdown menu, select the application and click Load.