Events Supported by Event Monitoring

Function Description

SecMaster has interconnected with Cloud Eye. You can view event related to SecMaster on the Cloud Eye console. Event monitoring provides event data reporting, query, and alarm reporting. You can create alarm rules for both system events and cloud events. Cloud Eye will generate an alarm for you once an event occurs. Cloud Eye is a multi-dimensional monitoring platform provided by Huawei Cloud for a wide range of cloud resources. With Cloud Eye, you can learn about the resource usage and service running status on the cloud, receive alarms in a timely manner, and respond quickly to exceptions to keep your cloud services stable.

As a cloud security operations platform, SecMaster can access security alerts of other cloud services and display alerts by alert type and level. SecMaster can accurately monitor threats and attacks on the cloud in real time and detect security alert incidents in your assets. You can define and schedule threat alert notifications to learn about threats and risks in a timely manner. The notification items you can define include threat list, alert type, and risk severity. This feature helps you learn about your security status in a timely manner.

For details about how to enable and configure Cloud Eye, see Enabling Cloud Eye.

Namespaces

SYS.SecMaster

Monitored Events

**Table 1** Event list
Event Name	Event ID	Event Severity	Description	Handling Suggestion	Event Impact
Dedicated engine creation failed.	createEngineFailed	Major	The underlying resources are insufficient.	Submit a service ticket to request adequate resources from the O&M personnel and try again.	Dedicated engines cannot be created.
Dedicated engines became abnormally.	engineException	Critical	The traffic is too heavy or there are malicious workflows or plug-ins.	Check the executions of plug-ins and workflows to see if they are using too many resources. Check the instance monitoring information to see whether there is a sharp instance increase.	Instances cannot be executed.
Playbook instance execution failed.	playbookInstanceExecFailed	Minor	Playbooks or workflows were incorrectly configured.	Check the instance monitoring information to find the cause of the failure, and modify the playbook and workflow configuration.	None
Playbook instance increased sharply.	playbookInstanceIncreaseSharply	Minor	Playbooks or workflows were incorrectly configured.	Check the instance monitoring information to find the cause of the sharp increase, and modify the playbook and workflow configuration.	None
Log messages increased sharply.	logIncrease	Major	The upstream service suddenly generates a large number of logs.	Check whether the upstream service is normal.	None
Log messages decreased sharply.	logsDecrease	Major	Logs generated by the upstream service suddenly decrease.	Check whether upstream services are normal.	None