![]() |
![]() |
Subject: | Event summary vs Event message and the Core Admin guide discussion |
Author: | Larry Virden |
Posted: | 2016-05-02 10:32 |
I am reading page 107 and 108 of the Admin guide, which discusses what happens with the summary and message guide. The discussion is confusing.
So, first, the discussion states that the summary field is 255 character long and the message field is 4096 characters long.
So far, so good.
Then the explanation of what happens when something is missing occurs.
If the summary is present, and the message is not, then the summary is copied to the message. That makes sense.
But the disscusiongoes on to say thatonly 128 characters will be coped to themessage contents. That's odd - there's plenty of room.
Next, if the summary is missing, and the message is not, then the message is copied to the summary. That makes sense.
But the discussion says that the message likewise will be truncated at 128 characters. And while I don't understand the 128 characters, it makes sense that it would be truncated somewhere.
The last point says that if both fields are present, even though no data is copied, the summary field will be truncated. I don't understand the purpose of making a field 255 characters if the information is going to be truncated in two of the three cases mentioned. Just make the field smaller. Any why not truncate the summary field first,in the case where the summary field has data and the message does not That would match behavior in the other cases.
The real puzzle comes next. The text says:
As a result, data loss is possible only if the message or summary content exceeds 65535 characters, or if both fields
are present and the summary content exceeds 128 characters.
1. Data loss is possible if either field exceeds 128 characters.
2. 65535 is not a number that is mentioned previously, and is many times larger than the larger of the two fields.
So, is there something missing in the discussion that would give relevance to the 64k number
And is there some reason why data loss is said to occur only if both fields are present -
Subject: | Sorry but I think that pages |
Author: | Jane Curry |
Posted: | 2016-05-06 12:55 |
Sorry but I think that pages 107 and 108 of the 5.1.1 Admin guide is complete dingos kidneys!
I believe the code that actually handles this is processing.py in $ZENHOME/Products/ZenEvents/events2. It is the CheckInputPipe method that checks the summary and message fields. Fundamentally, in the database, message is define as VARCHAR(4096) and summary is defined as VARCHAR(255). processing.py says that:
if summary exists and message doesn't then summary is copied to message
If message exists but summary doesn't then the first 255 chars of message are copied to summary.
Where all that 128 character stuff comes from, I haven't a clue and don't believe it.
Cheers,
Jane
Email: jane.curry@skills-1st.co.uk Web: https://www.skills-1st.co.uk
< |
Previous get the "user" value in Windows Event Details |
Next Zenoss Core 5 user role question |
> |