Defining notification content
The following sections describe the options on the Content tab of the Edit Notification dialog box.
Email actions
This section describes the options for both the AWS Email Host and the Email actions.
Common email fields applies to both the AWS Email Host and the Email actions.
SMTP fields applies to the Email action only.
Amazon SES fields applies to the AWS Email Host action only.
Common email fields
The fields in the following table are present in all email actions.
Field | Description |
Body Content Type | The email message format, HTML or plain text. |
Message (Subject) Format | The Subject line of the email message. The default value includes content variables. Best practice: Include the event severity variable ( |
Body Format | The body of the email message. The default value includes content variables. Best practice: To facilitate debugging, include variables for the name of the notification ( |
Clear Message (Subject) Format | The Subject line of the clearing email message. The default value includes content variables. Best practice: Include the clearing event severity variable ( |
Body Format | The body of the clearing email message. The default value includes content variables. Best practice: To facilitate debugging, include variables for the name of the notification ( |
Skip fails in TALES evaluation ? | Mark this check box to ensure that the email message is sent even if the TALES expressions included in the message do not resolve. |
From Address for Emails | The email address to use in the From line of the email message. |
SMTP fields
The following fields are present only for the Email action. Virtana Service Observability uses its own SMTP server to send email.
Warning
SMTP fields are remotely managed by Virtana. As a best practice, do not change these fields.
Field | Description |
|---|---|
SMTP Host | The hostname or IP of the Service Observability SMTP server. |
SMTP Port (usually 25) | The port on which an SMTP server is listening for email to send. |
Use TLS? | Mark this check box to encrypt emails. |
SMTP Username (blank for none) | The username of an account on the non-default SMTP server. |
SMTP Password (blank for none) | The password of the account on the non-default SMTP server. |
Amazon SES fields
The fields in the following table are present only for the AWS Email Host action.
Note
Both the sender and the recipients of emails sent through this action must be verified SES users in the target AWS region.
Field | Description |
|---|---|
AWS Account Name | The name of an authorized Amazon SES account. |
AWS Region | The AWS region to use. |
AWS Access Key | The ID of the authorized account's AWS access key. |
AWS Secret Key | The secret key of the authorized account's AWS access key. |
Command actions
Tip
Use the Command action sparingly. Frequent use can degrade the performance of the event processing service.
Field | Description |
Command Timeout (seconds) | The amount of time to wait for the command to return an exit value. |
Command | The shell command to run on a remote host, through an SSH connection. This field supports content variables. The connection information and the name of the target host must be present in the properties of the triggering event, and the host must accept incoming SSH connections. |
Clear Command | The shell command to run on a remote host, through an SSH connection, when a clearing event is received. This field supports content variables. The connection information and the name of the target host must be present in the properties of the clearing event, and the host must accept incoming SSH connections. |
Environment variables | Environment variables to pass to the shell that performs the command, if any. This field supports content variables. |
Page actions
Field | Description |
Message (Subject) Format | The Subject line of the message. The default value includes content variables. Best practice: Include the event severity variable ( |
Clear Message (Subject) Format | The Subject line of the clearing email message. The default value includes content variables. Best practice: Include the clearing event severity variable ( |
Syslog actions
Use the Syslog action to forward event information to a receiving syslog system.
Field | Description |
|---|---|
Syslog Host | The hostname or IP address of a |
Syslog Port (usually 514) | The port on which the |
Protocol | The network protocol to use, UDP or TCP. |
Syslog Facility | The |
SNMP Trap actions
Use these actions to forward event information to an SNMP network management station (NMS). The OIDs that are used in the SNMP traps that Collection Zone sends are defined in the Zenoss MIB.
SNMP Trap (v1/v2c) and SNMP Trap w/Impact
When the action is SNMP Trap w/Impact, additional OIDs are included.
Field | Description |
|---|---|
SNMP Trap Destination | The hostname or IP address of an SNMP NMS in your environment. |
SNMP Community | The SNMP trap community string to include. |
SNMP Version | The SNMP version to use. SNMPv1 ( |
SNMP Port | The port on which the NMS in your environment is listening for traps. The default is 162. |
SNMP Trap (v3)
Field | Description |
|---|---|
SNMP Trap Destination | The hostname or IP address of an SNMP NMS in your environment. |
SNMP Port (usually 162) | The port on which the NMS in your environment is listening for traps. The default is 162. |
Security Engine ID | The identifier of the authoritative SNMP engine. |
Context Engine ID | The identifier of the entity hosting the information. |
Context Name | The name of a specific context. |
Authentication Protocol | The authentication protocol to use. Valid values are |
Security Name | The name of the user when generating notifications. |
Security Passphrase | The security passphrase, if any. |
Privacy Protocol | The privacy protocol to use. Valid values are |
Privacy Passphrase | The privacy passphrase, if any. |
WinCommand actions
Field | Description |
|---|---|
Windows CMD Command | The standard CMD or PowerShell command to run on a remote host. This field supports content variables. The connection information and the name of the target host must be present in the properties of the triggering event, and the host must accept incoming connections. |
Clear Windows CMD Command | The standard CMD or PowerShell command to run on a remote host when a clearing event is received. This field supports content variables. The connection information and the name of the target host must be present in the properties of the clearing event, and the host must accept incoming connections. |
Notification content variables
The content of email and command notifications can include information from events in the following form:
'${objectname/objectattribute}'
Note
Do not escape event command messages and event summaries. For example, write this command as: ${evt/summary} (rather than echo '$evt/summary').
Object names can be evt, evtSummary, or urls; or for clearing event context, clearEvt and clearEventSummary. For each object name, the following lists show valid attributes (for example, '${evt/DevicePriority}' ):
Attributes of evt and clearEvt
Value | Description |
|---|---|
DevicePriority | value of the priority of the device |
agent | Typically the name of the daemon that generated the event. For example, an SNMP threshold event has zenperfsnmp as its agent. |
clearid | id of the event this clear event will clear |
component | component this event is related to |
count | how many times this event occurred |
created | when the event was created |
dedupid | dynamically generated fingerprint that allows the system to perform de-duplication on repeating events that share similar characteristics |
device | device this event is related to |
eventClass | class of this event |
eventClassKey | Free-form text field that is used as the first step in mapping an unknown event into an event class. |
eventGroup | Free-form text field that can be used to group similar types of events. This is primarily an extension point for customization. Currently not used in a standard system. |
eventKey | Free-form text field that allows another specificity key to be used to drive the de-duplication and auto-clearing correlation process. |
eventState | state of the event |
evid | unique id for the event |
facility | the syslog facility |
firstTime | First time that the event occurred. |
ipAddress | IP address |
lastTime | Most recent time that the event occurred. |
manager | value of manager |
message | a message communicated by the event |
ntevid | windows event id |
ownerid | owner id |
priority | syslog priority |
prodState | The production state of the device. |
severity | The integer that identifies the event severity level. |
severityString | The descriptive label that identifies the event severity level. |
stateChange | The last time that the event status changed. |
status | The status of the event. |
summary | A brief message summarizing the event. |
Attributes of eventSummary and clearEventSummary
Note
Some of the values in the following table are direct duplicates of evt attributes. For example, uuid -> evt.evid.
Value | Description |
|---|---|
uuid | evt.evid |
occurrence | evt.count |
status | evt.eventState |
first_seen_time | evt.firstTime |
status_change_time | evt.stateChange |
last_seen_time | evt.lastTime |
count | evt.count |
current_user_uuid | UUID of the user who acknowledged this event |
current_user_name | name of the user who acknowledged this event |
cleared_by_event_uuid | UUID of the event that cleared this event (for events with status == CLEARED) |
notes | event notes |
audit_log | event audit log |
update_time | last time a modification was made to the event |
created_time | evt.lastTime |
fingerprint | evt.dedupid |
event_class | evt.eventClass |
event_class_key | evt.eventClassKey |
event_class_mapping_uuid | If this event was matched by one of the configured event class mappings, it contains the UUID of that mapping rule. |
actor | event actor |
summary | evt.summary |
message | evt.message |
severity | evt.severity |
event_key | evt.eventKey |
event_group | evt.eventGroup |
agent | evt.agent |
syslog_priority | evt.priority |
syslog_facility | evt.facility |
nt_event_code | evt.ntevid |
monitor | evt.monitor |
tags | event tags |
Attributes of urls
Value | Description |
|---|---|
ackUrl | URL for acknowledging the event |
closeUrl | URL for closing the event |
reopenUrl | URL for reopening the event |
eventUrl | URL for viewing the event |
eventsUrl | URL for viewing events for the relevant device, or all events |
ZenPacks can define additional notification actions and can extend the context that is available to notifications to add objects or attributes.