|
When configuring a response action, the text used as part of that action
can either be the standard narrative automatically generated internally
by ServerAssist, or custom text that replaces this standard text.
Custom text can contain keywords which are substituted for key information
about the incident to which they pertain. A substitution keywords is indicated
by surrounding it with % characters.
For example, if the custom subject text for an e-mail response action
was set to 'Event %ID% for %SOURCE%', and an e-mail response was generated for an
event with a source of 'Example App' and an event ID of 12345, the e-mail
would be sent with a subject of 'Event 12345 for Example App'.
Different substitutions are available depending on the incident for which
a response is being generated.
All Monitored Incidents
| |
%NAME% |
System name |
| |
%DATE% |
Date |
| |
%TIME% |
Time |
| |
%TYPE% |
Incident type (Key Indicator, Event Log, Service, Performance Item, Network Device, SNMP Trap, Security Update,
Availability, File Server, Mail Server, Database Server, Web Server or Mail Infrastructure)
|
| |
%SUBJECT% |
Standard incident subject |
| |
%FULL_DETAILS% |
Standard incident narrative |
| |
%SHORT_DETAILS% |
Shorter incident narrative |
| |
%DATA_TAG% |
Opaque data for active response processing |
Event Log Monitoring
| |
%TYPE% |
Event type (Information, Warning,
Error, Audit Success or Audit Failure) |
| |
%LOG% |
Log name |
| |
%SOURCE% |
Source |
| |
%CATEGORY% |
Category |
| |
%ID% |
Event ID |
| |
%USER% |
User |
| |
%DETAILS% |
Details |
Performance Item Monitoring
| |
%ITEM% |
Performance item name |
| |
%LABEL% |
Performance item label |
| |
%LEVEL% |
Threshold level (Normal, Warning,
Critical, Within, Below or Above) |
| |
%VALUE% |
Performance item value |
Service Monitoring
| |
%ID% |
Service identifier |
| |
%NAME% |
Service name |
Network Device Monitoring
| |
%ADDRESS% |
Device address |
| |
%RESULT% |
'Ping' result (Respond or Fail) |
SNMP Trap Monitoring
| |
%OID% |
OID of the enterprise that generated the trap |
| |
%AGENT% |
IP address of the agent that generated the trap,
taken from the received SNMP PDU |
| |
%SOURCE% |
IP address of the agent that generated the trap,
taken from the network transport |
| |
%TYPE% |
Generic trap type |
| |
%ID% |
Specific trap |
| |
%COMMUNITY% |
Community string |
| |
%TIMESTAMP% |
Timestamp (in timeticks) of the trap, relative
to an epoch on the generating system, rather than an absolute time
|
Availability Monitoring
| |
%SYSTEM% |
Name of the system |
| |
%RESULT% |
Result of the availability test (Available or Unavailable) |
Database Server Monitoring
| |
%RESULT% |
Result of the snapshot comparison (Snapshot Match or Snapshot Not Match) |
Web Server Monitoring
| |
%RESULT% |
Tesult of the page comparison (Content Match, Content
Not Match, Fragment Present or Fragment Missing) |
| |
%DIFFERENCE% |
Analysis of the page content differences. |
Mail Infrastructure Monitoring
| |
%RESULT% |
Result of the message delivery attempt (Message Delivered or Message Not Delivered) |
|
