IBM Enterprise Console - Manual (Page 147)

Starting the Adapter
By default, the adapter is always started when Windows NT is started. If you are
using the Windows NT service version of the Windows NT event log adapter, you
can use the Windows NT tools to operate the adapter. For example, you can start
and stop the adapter using Windows NT Control Panel Services. You can also
manually start the adapter from the command line with the following command:
net start TECNTAdapter
Note: The endpoint adapter is automatically started as a step in the adapter
installation process when the adapter configuration profile (ACP) is
distributed using the Adapter Configuration Facility (ACF).
Stopping the Adapter
You can manually stop the adapter from the command line with the following
command:
net stop TECNTAdapter
Note: The endpoint adapter can be automatically stopped by distributing an ACP
that has the adapter start command removed from the after-file-distribution
actions. See the IBM Tivoli Enterprise Console User’s Guide for additional
information.
Events Listing
The following table shows the class names and severities of all events defined for
the Windows NT event log adapter. You can use it to get a sense of how Windows
NT events are mapped to IBM Tivoli Enterprise Console events and to determine if
you want to make any changes. The events are defined in the BAROC file.
See the IBM Tivoli Enterprise Console Rule Builder’s Guide for more information
about customizing the BAROC file.
Event Class Structure
Event classes are defined hierarchically, with child classes inheriting attribute value
defaults from the parent. The Windows NT event classes follow a simple hierarchy.
The adapter fills in the following attribute default values. The attributes are used
in event group filters.
source NT
sub_source
NT
hostname
hostname where the event originated
The following events are defined in BAROC file:
Event Class Default Severity
NT_Base
NT_Base_Event
NT_Diskfull WARNING
Chapter 11. Windows NT Event Log Adapter 135