Data forwarding

To send notifications about all new critical audit events

Event class : audit, Severity : critical

To send notifications about all new warranty events

Event code : FQXXOWA

To send notifications about all new events except warranty and license events

Event code !: FQXXOWA,FQXXOLS

To send notifications about all new events for which a service ticket was created:

Serviceability : serviceable

Test the connection to the forwarder destination by clicking Test Connection in the Data Forwarder wizard. During the test-connection process, XClarity One imports and validates the certificate chain from the forwarder destination. After the certificate is validated, XClarity One sends a sample event to the forwarder destination.

Click Data forwarding in the context menu of the Settings view, click the Add icon () on the Trust store panel, and then follow instructions in the wizard.

Email

You can forward event data to email addresses for one or more users in the organization. You cannot forward event data to external users.

New events that match the selected criteria are forwarded via email every hour. The emails are sent from the specified mail sender with the subject “Buffered Event Forwarding.”

Events are listed in tabular format, one row per event. Up to 3,000 events can be sent in a single email. If more 3,000 events were raised during the last hour, multiple emails are sent.

Syslog

When using XClarity One on premises, you can forward event data to a central log server, where native tools can be used to monitor syslog data.

New events that match the selected criteria are forwarded over the network to the central log server as soon as the events are raised.

Event data is forwarded as plain text using the following format by default.

eventID=[[EventID]] eventCode=[[EventCode]] timestamp=[[EventTimestamp]] severity=[[EventSeverity]] class=[[EventClass]] description=[[Description]] message=[[EventMessage]] action=[[UserAction]] deviceName=[[DeviceName]] deviceIP=[[DeviceIPAddress]] deviceSerialNum=[[DeviceSerialNumber]] serviceability=[[EventServiceability]] hubIP=[[HubIPAddress]] sourceType=[[SourceType]] username=[[Username]]

All words between double square brackets are the variables that are replaced with actual values when an event is forwarded.

eventID=207223 eventCode=FQXHMDI0119I timestamp=2026-02-02T08:27:17.551Z severity=informational class=audit description=The unmanagement of the server has been requested by user. message=User hazel@acme.com started unmanagement of server with UUID E1C6AC7A254941A9BBE476B7176A82BC (IP: 192.0.2.13) action=none deviceName=Server-C deviceIP=192.0.2.127 deviceSerialNum=176A82BC serviceability=none hubIP=192.0.2.15 sourceType=server username=hazel@acme.com

Web service

For XClarity One portal in the cloud, you can forward event data to external REST web services hosted on cloud, such as ServiceNow Cloud. Direct communication with web services that are not in the cloud are not permitted. If your cloud-based web service is not supported, open a service ticket using the Submit an eTicket webpage.

For XClarity One on premises, you can forward event data to only ServiceNow Cloud. Other REST web services are not supported.

New events that match the selected criteria are forwarded over the network to the web service as soon as the events are raised, using the HTTPS protocol. Port 443 is used by default.

{
   "id": 3395,
   "action": "new",
   "category": "drives",
   "description": "When a hardware event is detected by the Lenovo XClarity Controller on the 
                  server, the Lenovo XClarity Controller writes that event in the system-event
                  log on the server.",
   "eventClass": "service",
   "eventCode": "FQXSPSD0001L",
   "flags": [],
   "fruType": "drives",
   "manager": {
      "id": "B0018518B16549398A088862CAF1F705",
      "ipAddress": "10.241.36.230",
      "name": "DEV HUB 2757",
      "type": "XClarity Management Hub"
   },
   "message": "Drive Drive 0 in the enclosure has been disabled due to a detected fault.",
   "messageArgs": [ "Drive 0" ],
   "service": "serviceable",
   "severity": "critical",
   "source": {
      "id": "AE9FBDFA62F911E988453A68DD01A3F7-B0018518B16549398A088862CAF1F705",
      "groups": [],
      "name": "J100CVZW",
      "type": "server"
   },
   "targetResource": {
      "id": "AE9FBDFA62F911E988453A68DD01A3F7-B0018518B16549398A088862CAF1F705",
      "groups": [],
      "name": "J100CVZW",
      "type": "server"
   },
   "timestamp": "2025-02-18T12:32:06.419Z",
   "userAction": "Complete the following steps until the problem is solved: \n1) Reboot the system 
                  and confirm that the drive is still in failed state.\n2) Collect Service Data 
                  log.\n3) Contact Lenovo Support.",
   "_links": {
      "rel": "self",
      "uri": "/api/v1/monitoring/events/3395"
   }
}