- Solutions
-
- File Server: Ransomware Protection
- File Server: File Copy
- File Server: Audit File Access
- File Server: Storage growth reporting
- Licensing/Pricing
- Contact
Variables
A number of the actions accept variables to alter their output. The messaging actions ( E-mail, Message Box, Network Message, Pager Alert, and SMS Message) can all accept variables in their message template. In addition, the executable actions (Execute Script and Start Application) can also accept variables to change the action at run time.
Replacement Variables
The variables below can be inserted into the action or the message template as shown. The one exception is the Execute Script action -- in that case, the starting and ending $ are not used.
Variable Modifications
Most variables support replacement and truncation using this format:
| $Details['a','b']$ | replace character 'a' with character 'b' in the value of Details before using it as a replacement value. |
| $Details["abc","xyz"]$ | replace string "abc" with "xyz" in the Details's value before using it as a replacement value. |
| $Details[50]$ | Truncate the value to 50 characters before the replacement |
Note that these can also be combined such as:
| $Details['"',' '][60]$ | Replace quote characters with a single space, and truncate to 60 characters |
| $Details['!','~']["\r\n",""][70]$ | Replace pipe characters with tilde characters, remove newline combinations, and truncate to 70 characters |
General Variables
The following variables are always available. Please note that variables are case sensitive.| Variable | Meaning |
|---|---|
| $AlertCharts$ | This value will be replaced with charts if any are available for the alert. This variable only works with Email Actions. |
| $AlertID$ | A unique integer that represents this particular alert. |
| $CustomProp(propName)$ | The value for a custom property for the target monitor, computer or containing group. Empty if the property is not defined. See below for more details. |
| $Date$ | Current date in string format |
| $Details$ | Text describing the result of the monitor. This is what most other actions display/report. If you want the Details value to be on a single line, use $Details_Single_Line$ |
| $Details_Single_Line$ | The Details variable with everything on one line (line breaks removed) |
| $Details_Single_Line(x)$ | The first X characters of the Details variable. Useful for trimming the value to a specific length. |
| $Group$ | The group that contains the computer where the monitor detected the issue |
| $GroupPath$ | The full group path (ie Group1\Group2\Group3) that contains the computer where the monitor detected the issue |
| $Machine$ | The computer where the monitor detected the issue |
| $MachineIP$ | The IP address of the computer where the monitor detected the issue. Defaults to 0.0.0.0 if the value can't be determined. |
| $MachineID$ | ID of the computer involved. Defaults to 0 if the value can't be determined. |
| $MachineAlias$ | The aliased computer name (if an alias was entered, otherwise the same as Machine above) |
| $MonitorTitle$ | Title of the reporting monitor |
| $MonitorMsg$ | Custom message text from the originating monitor. This can be set in the monitor's Advanced Monitor Options |
| $NL$ | New Line character |
| $ProdVer$ | Current version of this program |
| $MonitorType$ | The type of monitor that detected the issue. This is the same text as you see in the list when choosing to create a new monitor. |
| $Status$ | Status of the monitor. (See table below for possible values.) |
| $StatusText$ | A cleaner version of Status. See table below for possible values (note that some values are rarely seen). |
| $Time$ | Current time in string format |
| $TimeInError$ | Amount of time that a monitor is or was in error. Ex: "Was in error for 1h 2m 3s" |
| $WinDir$ | WINDOWS directory for the target computer |
| Status | Status Text | Meaning |
|---|---|---|
| msOK | OK | Monitor is OK |
| msALERT | Alert | Monitor is in alert state because of what it found |
| msALERT_GREEN | Alert (Green) | The monitor is in Alert state, but has been configured to remain green anyway. |
| msALERT_RED | Alert (Red) | The monitor is in Alert state, but has been configured to turn red. |
| msSUPPRESSED_ALERT | Suppressed Alert | The monitor is in Alert state, but actions are being suppressed via Alert Suppression settings. |
| msUNACKNOWLEDGED | Unacknowledged Alerts | OK state, except there are unacknowledged errors and Error Acknowledgement is enabled |
| msERROR | Internal Error | The product is not functioning correctly. This is not usually a monitor status, but used for global problem broadcasts. |
| msSUPPRESSED_ERROR | Suppressed Error | The monitor is in ERROR state, but Alert Suppression settings are keeping it from firing actions. |
| msCANTMONITOR | Can't Run! | The monitor is unable to perform its function, possibly because of lack of rights or access. |
| msDISABLED | Disabled | The monitor is currently disabled |
| msRUNNING | Running | Monitor is currently running. |
| msINIT | Scheduled | All monitors are set to this status when the service first starts |
| msPAUSING | Initial Pause | If the monitoring service is set to wait at startup (via Settings), the monitors will use this status |
| msUNLICENSED | Not Enough Licenses | Set if more servers are being monitored than licenses allow |
| msSKIPPINGACTIONS | Skipping Actions | If alerts should not be fired at startup, as specified in Settings |
| msCANTMONITORNOW | Monitor Busy | Usually happens if a monitor is contrained and has to wait a little longer before it can run. Not an error. |
| msTRAINING | Training Period | The monitor is collecting data for automatic training purposes, and will not alert. |
| msMAINTENANCE | Server Maintenance | The server is in maintenance mode, so the monitor will not run |
| msWRONG_EDITION | Wrong Product Edition | This monitor is not supported with the installed license. |
| msEXCLUSION_PERIOD | Exclusion Period | The monitor is configured not allowed to run at this time. |
| msDEPENDENCY_NOT_MET | Dependency Not Met | Monitor dependencies are not met, so this monitor will not run. |
| msSERVER_DISABLED | Server Disabled | The server is disabled, so the monitors will not run. |
| msOWNING_SATELLITE_DISCONNECTED | Satellite Disconnected | The satellite that runs this monitor has not reported in, so the monitor status is unknown |
Custom Properties
Custom Properties can be used as expansion variables by using them in this form:
$CustomProp(propertyName)$Row Variables
In addition to the values that are always available, the following values are available depending on which monitor type is sending the alert. The additional information is reported in rows for those monitors that can report information on a number of items (such as a list of changed files and directories). The number in parenthesis (the x) should therefore be replaced with a 1 for the first row of results, 2 for the second, etc. (Example: $Item(1)$, $Item(2)$, $State(1)$...).NOTE: Is is possible to not have any extra row data, especially in the emergency alert cases shown above.
| Monitors | Row Variables |
|---|---|
| Actions Scheduler | $Item(x)$ - Unused $State(x)$ - OK or PROBLEM |
| Drive Sight | $CurrentValue(x)$ - Always set to 'LOADED' $Item(x)$ - Drive Letter $ItemType(x)$ - CDROM or DRIVE $State(x)$ - OK or PROBLEM |
| Dynamic Server List | $CurrentValue(x)$ - "ADDED" or "REMOVED" $Item(x)$ - IP address of the computer/device $ItemType(x)$ - Constant value of "DEVICE" $LimitValue(x)$ - DNS name if it can be determined $State(x)$ - OK or PROBLEM |
| File Sight Monitor | $CurrentValue(x)$ - Type of change that occurred. Possible values: 'Created', 'Wrote', 'Read', 'Deleted', 'Moved', 'Renamed', 'Audit Changed', 'Permissions Changed', 'Owner Changed', 'Group Changed', 'Failed to Create', 'Failed to Write', 'Failed to Read', 'Failed to Delete', 'Failed to Move', 'Failed to Rename', 'Failed to Change Audit', 'Failed to Change Permissions', 'Failed to Change Owner', 'Failed to Change Group' 'OVERLIMIT_READ' 'OVERLIMIT_WRITE' 'OVERLIMIT_DELETE' 'OVERLIMIT_RENAME' $Extra1(x)$ - Name of the user that triggered the alert $Extra2(x)$ - Name of the application (if available) used to make the change, or empty if a User Activity Alert $Item(x)$ - File or directory path that was accessed, or the User that is being alerted on for User Activity Alerts $ItemType(x)$ - Constant value always equal to 'File', 'Directory' or 'User' $LimitValue(x)$ - The IP address of the requesting user, or N/A if it cannot be determined $State(x)$ - OK or PROBLEM |
| Inventory Collector | $CurrentValue(x)$ - Not Set $Item(x)$ - Not Set $ItemType(x)$ - Not Set $LimitValue(x)$ - Not Set $State(x)$ - OK or PROBLEM |