Event Daemon Configuration

Core Horizon events are pre-loaded in the database and are essential for system operation. These events handle internal Horizon functionality such as node discovery, service monitoring, and alarm management.

Vendor-specific event definitions for third-party devices are available in ${OPENNMS_HOME}/etc/examples/events/. This directory contains event configuration files for hundreds of vendors including:

These files are provided as examples and can be uploaded to Horizon as needed for your environment. You only need to upload the event files relevant to the devices in your network.

Event definitions are organized into sources. Each source typically corresponds to a single event configuration file and contains one or more event definitions. Sources have the following properties:

When setting event severities, it is important to consider each event in the context of your infrastructure as a whole. Events whose severity is critical at the zoomed-in level of a single device may not merit a Critical severity in the zoomed-out view of your entire enterprise. Since an event with Critical severity can never have its alarms escalated, you should usually reserve this highest severity level for events that unequivocally indicate a truly critical impact to the business. Rock legend Nigel Tufnel offered some wisdom on the subject.

The order of event definitions within a file is important, as an incoming event is matched against them in order. It is possible, and often useful, to have several event definitions that could match variant forms of a given event; for example, based on the values of SNMP trap variable bindings.

Within each event configuration file, events are evaluated in the order they are defined. If your file contains catch-all event definitions (generic events that match a broad range of conditions), place them at the bottom of the file to ensure more specific definitions are matched first.

Single event configuration files can be uploaded directly. The file must be valid XML conforming to the event configuration schema. Each uploaded file becomes a separate event source in the database.

You can upload an entire folder of event configuration files at once. Each XML file in the folder is processed as a separate event source. This is useful when you need to add events for multiple vendors or device types simultaneously.

When uploading event files, Horizon checks for duplicate source names. If a source with the same name already exists:

To update an existing event source, you must first delete it and then re-upload.

The Horizon web interface provides a comprehensive event configuration management interface where you can:

The Event Configuration REST API (/api/v2/eventconf) provides programmatic access to all event management functions. API documentation is available via Swagger UI at http://<opennms-host>:8980/opennms/ui/index.html#/open-api.

Key operations include:

Use the opennms:show-event-config command to render the event definition for one or more event UEIs (matching a substring) to XML. This command is useful for displaying event definitions that may not be easily accessible on disk, or verifying that particular events were actually loaded.