The section provides an overview of how events are initially installed and stored in the database and later updated based on changes in the Event Manager.

Event storage

When the Tealeaf system is initially installed, the provided set of event definitions are loaded and stored in the TL_SYSTEM database. Subsequent additions or changes to the event definitions are managed through a series of interconnected tables in the database.

In addition to the event data, the TL_SYSTEM database contains dimensional data that you configure and enable for capture and storage.

The Event Manager queries through the Search Server for this data. Search Server interacts with the database through the Data Service.

• Search Server provides event definitions to individual canisters for runtime evaluation.
• The Data Service is typically hosted on the Portal Server.

Event Manager access

Tealeaf provides the Event Admin group in cxImpact to enable access. Adding any user to this group enables that user to access the Event Manager.

Note: Access to the Event Manager is considered an administration-level privilege.

Specifically, access to the Event Manager is determined by the menu profile for the user. If the user is a member of a group that has access to the Configure > Event Manager menu option, the user can access the Event Manager and perform all actions in it.

If a user belongs to any group that has access to a specific menu item, the user can access the menu item, regardless of the evaluation of the other groups' menu profiles.

Canister loading of event definitions

Each canister queries its Search Server for the event definitions. Search Server retrieves them through the Data Service from the database.

The Canister compares the checksum of the event definitions with the checksum of its last load. If a difference is detected, the event definitions changed. The old definitions are saved to a BAK file, and the new event definitions overwrite the old file.

The canister then compiles the event definition XML for use. If the event definitions fail to compile, a validation error is generated and the previous set of validated event definitions is used.

Upon successful compile, all Canister processes are signaled to reload the event definitions.

Enable the audit logs for events

Through the Portal, you can also enable audit logging, which tracks changes that are made through the Event Manager to the data created in it. These audit logs are reported in the Tealeaf status report.

1. Log in to the Portal as an administrator.
2. Navigate to Portal Management.
3. Click Logs.
4. Click Status Audit Log.
5. Under the Event Manager node, select the user events to audit in the logs.

Searching system logs

Logs for the Event Manager are written to the Data Service logs. These logs can be retrieved through the Portal.

Complete the following steps to search the system logs for events.

1. Log in to the Portal as an administrator.
2. Navigate to Portal Management.
3. Click Logs.
4. Click Data Service.
5. Search for the string: event.