CIM: If I have an event that does not describe a relationship between two systems, should I use src_host or dest_host for the host field?

[FritzWittwer_ol]

in case I have an event which does not describe a relation between two systems, e.g. the size of an Oracle table space or a filesystem size, should I use src_host or dest_host (or the other src/dest fields) for the host field in this events?

I never did find a clear statement in the documentation regarding these fields.

[FritzWittwer_ol]

Clarification:
The cim model for inventory defines:

1. dest : The system where the data originated, the source of the event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.
2. src_ip The IP address for the system from which the data originates.

This is confusing, and to me it is not clear on how to use this fields, if i have an event from a host which describes just something on this hosts, like a table space, a filesystem, the serial number of this host and so on. It will have a host field, must I propagate this host field into src_host or dest_host. From my standpoint it would always be src_host (or src_ip, src_bunit and so on) and have no dst_* fields.

[gcusello]

Hi FritzWittwer,
Sorry but I don't understand you need:
in host field there is the hostname of the system that produced the acquired logs;
why are you speaking of two systems? if the acquired logs are logs from a proxy or a web server, you could have other fields like src or dest, but host field it's always the same;
So could you share more information?
Bye.
Giuseppe

[gcusello]

Hi FritzWittwer,
I think that you should maintain in your events the host field to know where the events lived.
And then understand how to use the other fields in your monitoring.
Bye.
Giuseppe