For question 1)
In my experience working with ITOM systems, eventTime would refer to the timestamp of the event, i.e. when the ITOM platform noticed something occured that can be called an event.
In contract, timeOccurred would be when the initial conditions occurred. For example, if you have a monitoring platform that performs 5 minute polling of a device and requires two subsequent failed polls in order to generate a down event, in this scenario, I would expect (though happy for TMForum team to verify) that timeOccurred would represent the first instance that something was noticed, i.e. first failed poll, whilst eventTime is the timestamp of the resulting event which would only occur after two failed poll intervals.
For question 2)
In an ITOM environment I would expect
- reportingSystem would refer to the monitoring tool that has generated the event.
- source would refer to the actual device that has cause the event, e.g. a network device
- title would be a short description of the event e.g. "Device Down"
That would be my expectations for this API though having read the specification, there seems to be a reasonable amount assumed knowledge for ITOM systems.
------------------------------
Ryan Ruckley
SingTel Optus
------------------------------
Original Message:
Sent: Apr 08, 2021 01:40
From: Anu Aulakh
Subject: TMF688 - Event API - schema definition
Hi there,
Had some questions regarding the semantics of the event schema in TMF688:
1) What is difference between eventTime and timeOcurred? From the user guide it is unclear:
2) reportingSystem, source and title semantics are unclear. What are they describing in relation to the event?
3) Do event attributes have a placeholder for API name? If not, it would be useful to introduce apiName attribute to signify what api request the event is pertinent to. This would help with formulating queries at topic and hub level.
Thanks, Anu
------------------------------
Anu Aulakh
Telstra Corporation
------------------------------