For question 1)
In my experience working with ITOM systems, eventTime would refer to the timestamp of the event, i.e. when the ITOM platform noticed something occured that can be called an event.
In contract, timeOccurred would be when the initial conditions occurred. For example, if you have a monitoring platform that performs 5 minute polling of a device and requires two subsequent failed polls in order to generate a down event, in this scenario, I would expect (though happy for TMForum team to verify) that timeOccurred would represent the first instance that something was noticed, i.e. first failed poll, whilst eventTime is the timestamp of the resulting event which would only occur after two failed poll intervals.
For question 2)
In an ITOM environment I would expect
- reportingSystem would refer to the monitoring tool that has generated the event.
- source would refer to the actual device that has cause the event, e.g. a network device
- title would be a short description of the event e.g. "Device Down"
That would be my expectations for this API though having read the specification, there seems to be a reasonable amount assumed knowledge for ITOM systems.
------------------------------
Ryan Ruckley
SingTel Optus
------------------------------