Previous section.

Systems Management; Event Management Service (XEMS)
Copyright © 1997 The Open Group

Data Formats

The XEMS data structure section is divided into several sub-sections according to the usage of the data structures. Following is a brief description of each of the data structure sub-sections.

The data structure section first defines some generic types that will be used throughout the definition of XEMS. Some of these types define standard C data types and some machine dependant types so that implementations of XEMS can define them to be machine dependent. There are also some other non-scalar types that are use to standardize use of items such as timestamp, and character strings.

Event attributes are used in several other data structures in XEMS, such as the event data structure as well as the event type schema data structure, and the attribute list data structure. Event attributes contain an attribute name as well as a self defining value which has a format and a value.

The XEMS Event structure contains a fixed header, and a variable size array of event attributes. The header contains fields that identify the event and its type, the event origin, what severity the event is, as well as a place for the Event Service to put the received time as well as the time the event was delivered to an interested consumer. An additional field has been added to mark the priority of an event.

The event type data structures allow the construction of event type schemas.

Event filters are constitute in XEMS using the event filter data structures. These structures allow building filters by first constructing event expressions that contain attribute names, operators, and attribute values. Expressions are then collected into expression lists which then become event filters. There is also a structure for event filter name lists which are used to define consumer filter groups and to return lists of filters from the event filter database.

The consumer and supplier data structures are used to return information about consumers and suppliers from XEMS.

There is also an attribute list data structure which allows getting and setting attributes in XEMS. The actual values of the attributes are not defined in the specification.

The event list data structure allows management of undelivered events. A list of undelivered events can be returned in an event list.

The ems_handle is an opaque data type which is used in calls to XEMS routines. An ems_handle represents a connection to an Event Service on a particular host. When calling XEMS routines, one of the XEMS registration routines is called to unitize the handle, and it is used in all subsequent calls to XEMS routines that want to affect the Event Service on that host.

Generic Data Types

This data structure section first defines some generic types that are used throughout the definition of XEMS.

Scalar Types

XEMS defines generic C data types which can be defined per implementation. These types correspond to standard data types1.
typedef unsigned_char ems_boolean; // 1 byte #define ems_false false #define ems_true true typedef unsigned char ems_byte; // 1 byte typedef unsigned char ems_char; // 1 byte typedef signed char ems_small_int; // 1 byte typedef unsigned char ems_usmall_int; // 1 byte typedef short int ems_short_int; // 2 bytes typedef unsigned short int ems_ushort_int; // 2 bytes typedef long int ems_long_int; // 4 bytes typedef unsigned long int ems_ulong_int; // 4 bytes struct ems_hyper_int_rep_s_t { ems_long_int high; ems_ulong_int low; } ems_hyper_int; struct ems_uhyper_int_rep_s_t { ems_ulong_int high; ems_ulong_int low; } ems_uhyper_int; typedef float ems_short_float; // 4 bytes typedef double ems_long_float; // 8 bytes


Strings are used throughout the XEMS data structures, and as parameters in the API.
typedef char * ems_string_t;

Unique Identifier

ems_uuid_t is a data structure which contains a unique identifier which is used to uniquely identify different objects in XEMS.
typedef struct uuid_t { ems_ulong_int time_low; ems_ushort_int time_mid; ems_ushort_int time_hi_and_version; ems_usmall_int clock_seq_hi_and_reserved; ems_usmall_int clock_seq_low; ems_byte node[6]; } ems_uuid_t;

Time Stamp

The XEMS time structure contains a timestamp represented in Coordinated Universal Time (UTC). This is a 128-bit binary number. It is often referred to as a binary timestamp.
typedef struct utc { ems_byte char_array[16]; } ems_utc_t;

Error Status

The XEMS error status is used to return status to callers of XEMS routines to indicate whether the call succeeded or not. The meanings of the error status values can be found in a later section (See Status Codes ).
typedef ems_ulong_int ems_error_t;

Event Type

XEMS event types are used to classify events.
typedef ems_uuid_t ems_event_type_t;

Delivery Type

XEMS delivery model.
typedef enum { ems_delivery_push = 0, ems_delivery_pull } ems_delivery_t;

Security Object

EMS security objects. These security objects are defined in Overview of the Event Management Service .
typedef enum { ems_secobj_server = 0, ems_secobj_eventtypes, ems_secobj_filters, ems_secobj_consumers, ems_secobj_suppliers, ems_secobj_eventtype, ems_secobj_filter } ems_secobjtype_t; typedef struct { ems_secobjtype_t secobjtype; ems_string_t name; ems_uuid_t uuid; } ems_secobj_t;

Permissions Attributes

EMS permission attributes.
typedef struct { ems_usmall_int control; ems_usmall_int delete; ems_usmall_int insert; ems_usmall_int read; ems_usmall_int write; ems_usmall_int execute; } ems_secperm_t;


EMS subject.
typedef struct { ems_string_t name; ems_uuid_t uuid; } ems_secsubj_t;


EMS principal.
typedef struct { ems_ushort_int len; ems_byte * principal; } ems_secprin_t;

Event Attributes

Event Attribute Types

The event attribute type is used to specify the data type of an event attribute. The attribute type specifies what format the data is in the event attribute value union (ems_attr_value_t()). All event attribute types are defined as:
typedef ems_ushort_int ems_attr_type_t;

An event attribute type can be one of the following:

Attribute Type Data Type
ems_c_attr_small_int ems_small_int
ems_c_attr_short_int ems_short_int
ems_c_attr_long_int ems_long_int
ems_c_attr_hyper_int ems_hyper_int
ems_c_attr_usmall_int ems_usmall_int
ems_c_attr_ushort_int ems_ushort_int
ems_c_attr_ulong_int ems_ulong_int
ems_c_attr_uhyper_int ems_uhyper_int
ems_c_attr_short_float ems_short_float
ems_c_attr_long_float ems_long_float
ems_c_attr_boolean ems_boolean
ems_c_attr_uuid ems_uuid_t
ems_c_attr_utc ems_utc_t
ems_c_attr_severity ems_severity_t
ems_c_attr_byte_string ems_byte *
ems_c_attr_char_string ems_char *
ems_c_attr_bytes see structure

Table: Event Attribute Type Specifiers
Byte strings and character strings are terminated with a 0 (zero) byte.

The actual attribute format type values are:

#define ems_c_attr_small_int (0) #define ems_c_attr_short_int (1) #define ems_c_attr_long_int (2) #define ems_c_attr_hyper_int (3) #define ems_c_attr_usmall_int (4) #define ems_c_attr_ushort_int (5) #define ems_c_attr_ulong_int (6) #define ems_c_attr_uhyper_int (7) #define ems_c_attr_short_float (8) #define ems_c_attr_long_float (9) #define ems_c_attr_boolean (10) #define ems_c_attr_uuid (11) #define ems_c_attr_utc (12) #define ems_c_attr_severity (13) #define ems_c_attr_byte_string (15) #define ems_c_attr_char_string (16) #define ems_c_attr_bytes (17)

Event Attribute Values

The event attribute value union is a self defining data structure which has an attribute type specifier (format) which tells what type of data is in the union, and then appropriate union members (tagged_union.<format_specific_field_name>) to hold the value of the data specified.
typedef struct ems_bytes_s_t { ems_ulong_int size; ems_byte *data; } ems_bytes_t; typedef struct { ems_attr_type_t format; union { /* case(s): ems_c_attr_small_int */ ems_small_int small_int; /* case(s): ems_c_attr_short_int */ ems_short_int short_int; /* case(s): ems_c_attr_long_int */ ems_long_int long_int; /* case(s): ems_c_attr_hyper_int */ ems_hyper_int hyper_int; /* case(s): ems_c_attr_usmall_int */ ems_usmall_int usmall_int; /* case(s): ems_c_attr_ushort_int */ ems_ushort_int ushort_int; /* case(s): ems_c_attr_ulong_int */ ems_ulong_int ulong_int; /* case(s): ems_c_attr_uhyper_int */ ems_uhyper_int uhyper_int; /* case(s): ems_c_attr_short_float */ ems_short_float short_float; /* case(s): ems_c_attr_long_float */ ems_long_float long_float; /* case(s): ems_c_attr_boolean */ ems_boolean bool; /* case(s): ems_c_attr_uuid */ ems_uuid_t uuid; /* case(s): ems_c_attr_utc */ ems_utc_t *utc; /* case(s): ems_c_attr_severity */ ems_severity_t severity; /* case(s): ems_c_attr_byte_string */ ems_byte *byte_string; /* case(s): ems_c_attr_char_string */ char *char_string; /* case(s): ems_c_attr_bytes */ ems_bytes_t bytes; } tagged_union; } ems_attr_value_t;

Event Attribute

Event attributes contain an event attribute name/value pair which define an event attribute. Event attributes are used in events to provide self defining data as part of an event. Event attributes are also used in event type schema's to define the contents of an event of specific event type. The name field specifies the attribute name, and the value field contains the value and format of an event attribute.
typedef struct ems_attribute_s_t { ems_string_t name; ems_attr_value_t value; } ems_attribute_t;

Event Structure

Event Identifier

An event identifier uniquely identifies a given event. Each event has both an event type which is unique to all events of this type, and an event id which is unique to a specific event.
typedef struct ems_eventid_s_t { ems_event_type_t type; ems_uuid_t id; } ems_eventid_t;

Event Type

An event type specifies the unique id for a given event type.

Event Type Event Type Name
ems_c_generic_type Generic

Table: Default Event Types

Events of type Generic, do not have event type schemas associated with them, and can only be filtered by expressions with header attributes in them (see Event Header Attributes ).

Network Name

A network name identifies the network name of a given host machine. The name service specifies which name service recognizes the given network name.
typedef enum { ems_ns_other, ems_ns_dns, ems_ns_dce, ems_ns_x500, ems_ns_nis, ems_ns_sna } ems_nameservice_t;

The ems_netaddr_t structure specifies the actual network name. It can be interpreted according to the name service specified. Structure ems_octet_t defines an 8-bit field. len specifies how many 8-bit quantities there are in name.

typedef char ems_octet_t; typedef struct ems_netaddr_s_t { ems_ulong_int len; ems_octet_t name[1]; } ems_netaddr_t;

The ems_netname_t consists of service which specifies which name service recognizes the name specified by netaddr.

typedef struct ems_netname_s_t { ems_nameservice_t service; ems_netaddr_t *netaddr; } ems_netname_t;

For a DCE hostname, the following example will set the ems_netname_t structure:

static char * dce_hostname = "/.:/hosts/"; ems_netname_t netname; netname.service = ems_ns_dce; netname.netaddr->len = strlen( dce_hostname )+1; netname.netaddr->name = (char *)malloc( netname.netaddr->len ); strcpy( netname.netaddr->name, dce_hostname );

Event Origin

The event origin specifies where the event originated (that is, the supplier). The origin specifies the netname of the host where the supplier is running, the name of the supplier, descname, and supplier process identification ( pid, uid, gid). These values may not be meaningful for all hosts.
typedef struct ems_origin_s_t { ems_netname_t netname; ems_string_t descname; ems_ulong_int pid; ems_ulong_int uid; ems_ulong_int gid; } ems_origin_t;

Event Severity

The event severity specifies the severity of the event.
typedef enum { ems_sev_info, ems_sev_fatal, ems_sev_error, ems_sev_warning, ems_sev_notice, ems_sev_notice_verbose, ems_sev_debug } ems_severity_t;

Event Priority

The event priority specifies the priority of the event.
typedef ems_ulong_int ems_priority_t;

Event Header

The event header describes the fixed part of the event data structure. The header contains the eventid, the origin of the event, the severity along with the time the event was both received at XEMS, and delivered to the consumer.
typedef struct ems_hdr_s_t { ems_eventid_t eventid; ems_origin_t origin; ems_severity_t severity; ems_utc_t received; ems_utc_t delivered; ems_priority_t priority; } ems_hdr_t;

A set of filter attributes are provided for event header filtering. The following names can be used for the filter attribute in an event filter expressions.

Attribute Name Attribute Type ems_c_attr_uuid
eventid.type ems_c_attr_uuid
origin.netname.service ems_c_attr_ulong
origin.netname.netaddr ems_c_attr_bytes
origin.descname ems_c_attr_char_string ems_c_attr_ulong
origin.uid ems_c_attr_ulong
origin.gid ems_c_attr_ulong
severity ems_c_attr_severity
received ems_c_attr_utc
received.tod ems_c_attr_char_string
received.mday ems_c_attr_ushort_int
received.year ems_c_attr_ushort_int
received.wday ems_c_attr_ushort_int
received.yday ems_c_attr_ushort_int

Table: Event Header Attributes


The ems_event_t structure contains a fixed part, the event header, and a variable part, the event data items. Each data item is a self-defining value which contains an attribute type, and attribute data. Count specifies how many data items are in the event.
typedef struct ems_event_s_t { ems_hdr_t header; ems_ulong_int count; ems_attribute_t item[1]; } ems_event_t;

Event Types

The XEMS Event Type structures are used to define the XEMS Event types.

Event Type Schema

The event type schema is used to define an event type. It consists of an event type id, type, a name field which specifies the name of the event type, and a list of event type attributes describing the format of this event type. Size specifies the number of attributes in an event type. The event type schemas only specifies the fixed part of an event. An event can have as many unnamed attributes following the list of attributes specified here.
typedef struct ems_event_schema_s_t { ems_event_type_t type; ems_string_t name; ems_long_int size; ems_attribute_t attribute[1]; } ems_event_schema_t;

Event Type List

The event type list contains a list of size event type schemas.
typedef ems_event_schema_t *ems_schema_ptr_t; typedef struct ems_event_type_list_s_t { ems_long_int size; ems_schema_ptr_t schema[1]; } ems_event_type_list_t;

Event Filters

The event filter data structures allow the definition of both event filters, and event filter lists.

Attribute Operators

Attribute operators define the boolean operation to perform on the attribute name, and the attribute value in the event filter expression. The attribute operator type is defined as:
typedef ems_ushort_int ems_attr_op_t;

Attribute Operator Description of Attribute Operator
ems_c_attr_op_eq TRUE if attr_name equal (==) to attr_value
ems_c_attr_op_gt TRUE if attr_name greater than (>
ems_c_attr_op_lt TRUE if attr_name less than (<
ems_c_attr_op_ge TRUE if attr_name greater than or equal (>
ems_c_attr_op_le TRUE if attr_name greater than or equal (<
ems_c_attr_op_ne TRUE if attr_name not equal (<
ems_c_attr_op_bitand TRUE if attr_name bitwise anded with attr_value is greater than 0
ems_c_attr_op_substr TRUE if attr_name contains the string value specified by attr_value

Table: Attribute Operators

The actual values of the operators are:

#define ems_c_attr_op_eq (0) #define ems_c_attr_op_gt (1) #define ems_c_attr_op_lt (2) #define ems_c_attr_op_ge (3) #define ems_c_attr_op_le (4) #define ems_c_attr_op_ne (5) #define ems_c_attr_op_bitand (6) #define ems_c_attr_op_substr (7)

Event Filter Grammar

The event filter grammar specifies which grammar the event filter is using to specify a filter expression. Support for the default grammar is required.
typedef unsigned16 ems_filter_grammar_t; const ems_filter_grammar_t ems_c_fg_default = 0; const ems_filter_grammar_t ems_c_fg_OQL = 1; const ems_filter_grammar_t ems_c_fg_other = 2;

OQL stands for Object Query Language.

Default Event Filter Grammar

The default event filter grammar expression structure contains the elements of an event filter expression using the default filter grammar. These elements are used to build an event filter. Event filter expressions using the default grammar contain an attribute name, operator, value triplet ( attr_name, attr_operator, attr_value) which defines a boolean filter expression.
typedef struct ems_default_fg_s_t { ems_string_t attr_name; ems_attr_op_t attr_operator; ems_attr_value_t attr_value; } ems_default_fg_t;

Event Filter Expression

The event filter expression structure contains an event filter expression. This structure is a tagged union whose type (or tag) defines which grammar the filter expression is using, and that value is the filter expression itself.
typedef struct ems_filter_exp_s_t { ems_filter_grammar_t grammar; union { /* case: ems_c_fg_default */ ems_default_fg_t def_filter; /* case: ems_c_fg_OQL */ ems_string_t oql_filter; /* case: ems_c_fg_other */ ems_string_t other_filter; } tagged_union; } ems_filter_exp_t;

Event Filter Expression List

An event filter expression list groups a list of filter expressions together in a list to form an anded filter expression used in defining an event filter.
typedef struct ems_filter_exp_list_s_t { ems_long_int size; ems_filter_exp_t filter_exps[1]; } ems_filter_exp_list_t;

Event Filter

An event filter specifies a series of event filter expressions that will be anded together to perform a filter operation. The event filter contains a name ( filter_name) and a list of filter expressions ( event_exp_list).

Filters with event type of generic, can only have filter expressions with header attribute names in them (see Event Header Attributes ).

typedef struct ems_filter_s_t { ems_string_t filter_name; ems_event_type_t type; ems_filter_exp_list_t filter_exp_list; } ems_filter_t;

Event Filter Name List

An event filter list contains a list of size event_filter_names;
typedef struct ems_filtername_list_s_t { ems_long_int size; ems_string_t filter_names[1]; } ems_filtername_list_t;

Event Filter List

The event filter list structure contains a list of size filters.
typedef ems_filter_t *ems_filter_ptr_t; typedef struct ems_filter_list_s_t { ems_long_int size; ems_filter_ptr_t filter[1]; } ems_filter_list_t;

Consumer Data Structures


The consumer data structure defines an ems consumer. Each consumer has a name, a hostname where the consumer is running, and a uuid unique to that consumer.
typedef struct ems_consumer_s_t { ems_string_t name; ems_netname_t *hostname; ems_uuid_t uuid; ems_delivery_t type; } ems_consumer_t;

Consumer List

The consumer list structure contains a list of size consumer entries.
typedef struct ems_consumer_list_s_t { ems_long_list size; ems_consumer_t consumer[1]; } ems_consumer_list_t;

Event Handler

The consumer provides a set of event handler functions in the ems_consumer_start method. These routines are callbacks. They are associated with hosts and event filter groups through the ems_push_consumer_register method.
typedef void (*ems_handler)(void * arg, ems_event_t * event, ems_error_t * error);

Supplier Data Structures

Supplier Event Handler

The supplier may provide a handler function (the ems_push_supplier_register_handler() method. This routine is a callback. It is called each time the number of consumers of the event type changes. This allows the supplier to gauge the need to create and send events to the XEMS.
typedef void (*ems_supplier_count_handler_t)(ems_event_type_t type, ems_long_int count, ems_error_t * error);


The supplier data structure defines an ems supplier. Each supplier has a name, a hostname where the supplier is running, and a uuid unique to that supplier.
typedef struct ems_supplier_s_t { ems_string_t name; ems_netname_t *hostname; ems_uuid_t uuid; ems_delivery_t type; } ems_supplier_t;

Supplier List

The supplier list structure contains a list of size supplier entries.
typedef struct ems_supplier_list_s_t { ems_long_int size; ems_supplier_t supplier[1]; } ems_supplier_list_t;

Attribute and Event list

Attribute List

The attribute list data structure defines a list of attributes associated with an event service. An attribute list consists of a size attr entries that each represent an event service attribute. Event attributes are implementation dependent.
typedef struct ems_attrlist_s_t { ems_long_int size; ems_attribute_t attr[1]; } ems_attrlist_t;

Event List

The event list data structure contains a list of events. It is used to return the list of undelivered events. An event list consists of size event entries where each event entry is a pointer to an event.
typedef ems_event_t *ems_event_ptr_t; typedef struct ems_event_list_s_t { ems_long_int size; ems_event_ptr_t event[1]; } ems_event_list_t;

Event Service Handle

An ems_handle represents a connection to an Event Service on a particular host. When calling XEMS routines, one of the XEMS registration routines is called to initialize the handle, and it is used in all subsequent calls to a routines that want to affect the Event Service on that host.

Event Service Handle

ems_handle_t is a pointer to an opaque data structure which contains information used to allow users of XEMS to connect to the Event Service. The actual contents of the data structure are implementation dependant.
typedef void *ems_handle_t;

Status Codes

All XEMS routines return status codes which contain values which indicate whether the call to that routine was successful or not.

Rather than list the specific status codes for each routine, the following summary lists all the status codes and their meanings.


Consumer with this name is already registered.


Consumer already started.


Consumer not started.


The listed filters could not be returned because the filter database is empty.


The event type to be added already exists.


The specified event type was not found.


The given filter name already exists.


The filter cannot be deleted because it is currently in use.


The requested filter does not exist.


The event service to forward to is not available.


The hostname introduces a loop condition, where XEMS would be forwarding events to itself.


Caller does not have sufficient permission to perform operation.


The schema for the event type is not valid.


The input parameters specifies an invalid filter.


The handle parameter is not valid.


The name parameter contains invalid characters.


No consumers are registered.


Tried to pull an event of a specified type, but there are no events to pull.


There are no undelivered events.


An XEMS handle cannot be allocated.


No suppliers are registered.


There was no type list in the function invocation.




Tried to unregister a consumer that was not registered.


Tried to unregister a supplier that was not registered.


Unsupported nameservice on host name.


The underlying transport is responsible for the data representation changes between clients and servers.

Why not acquire a nicely bound hard copy?
Click here to return to the publication details or order a copy of this publication.

Contents Next section Index