- Solutions
-
- File Server: Ransomware Protection
- File Server: File Copy
- File Server: Audit File Access
- File Server: Storage growth reporting
- Licensing/Pricing
- Contact
Variables
A number of the actions accept variables to alter their output. The messaging actions ( E-mail, Message Box, Network Message, Pager Alert, and SMS Message) can all accept variables in their message template. In addition, the executable actions (Execute Script and Start Application) can also accept variables to change the action at run time.
Replacement Variables
The variables below can be inserted into the action or the message template as shown. The one exception is the Execute Script action -- in that case, the starting and ending $ are not used.
Variable Modifications
Most variables support replacement and truncation using this format:
| $Details['a','b']$ | replace character 'a' with character 'b' in the value of Details before using it as a replacement value. |
| $Details["abc","xyz"]$ | replace string "abc" with "xyz" in the Details's value before using it as a replacement value. |
| $Details[50]$ | Truncate the value to 50 characters before the replacement |
Note that these can also be combined such as:
| $Details['"',' '][60]$ | Replace quote characters with a single space, and truncate to 60 characters |
| $Details['!','~']["\r\n",""][70]$ | Replace pipe characters with tilde characters, remove newline combinations, and truncate to 70 characters |
General Variables
The following variables are always available. Please note that variables are case sensitive.| Variable | Meaning |
|---|---|
| $AlertCharts$ | This value will be replaced with charts if any are available for the alert. This variable only works with Email Actions. |
| $AlertID$ | A unique integer that represents this particular alert. |
| $CustomProp(propName)$ | The value for a custom property for the target monitor, computer or containing group. Empty if the property is not defined. See below for more details. |
| $Date$ | Current date in string format |
| $Details$ | Text describing the result of the monitor. This is what most other actions display/report. If you want the Details value to be on a single line, use $Details_Single_Line$ |
| $Details_Single_Line$ | The Details variable with everything on one line (line breaks removed) |
| $Details_Single_Line(x)$ | The first X characters of the Details variable. Useful for trimming the value to a specific length. |
| $Group$ | The group that contains the computer where the monitor detected the issue |
| $GroupPath$ | The full group path (ie Group1\Group2\Group3) that contains the computer where the monitor detected the issue |
| $Machine$ | The computer where the monitor detected the issue |
| $MachineIP$ | The IP address of the computer where the monitor detected the issue. Defaults to 0.0.0.0 if the value can't be determined. |
| $MachineID$ | ID of the computer involved. Defaults to 0 if the value can't be determined. |
| $MachineAlias$ | The aliased computer name (if an alias was entered, otherwise the same as Machine above) |
| $MonitorTitle$ | Title of the reporting monitor |
| $MonitorMsg$ | Custom message text from the originating monitor. This can be set in the monitor's Advanced Monitor Options |
| $NL$ | New Line character |
| $ProdVer$ | Current version of this program |
| $MonitorType$ | The type of monitor that detected the issue. This is the same text as you see in the list when choosing to create a new monitor. |
| $Status$ | Status of the monitor. (See table below for possible values.) |
| $StatusText$ | A cleaner version of Status. See table below for possible values (note that some values are rarely seen). |
| $Time$ | Current time in string format |
| $TimeInError$ | Amount of time that a monitor is or was in error. Ex: "Was in error for 1h 2m 3s" |
| $WinDir$ | WINDOWS directory for the target computer |
| Status | Status Text | Meaning |
|---|---|---|
| msOK | OK | Monitor is OK |
| msALERT | Alert | Monitor is in alert state because of what it found |
| msALERT_GREEN | Alert (Green) | The monitor is in Alert state, but has been configured to remain green anyway. |
| msALERT_RED | Alert (Red) | The monitor is in Alert state, but has been configured to turn red. |
| msSUPPRESSED_ALERT | Suppressed Alert | The monitor is in Alert state, but actions are being suppressed via Alert Suppression settings. |
| msUNACKNOWLEDGED | Unacknowledged Alerts | OK state, except there are unacknowledged errors and Error Acknowledgement is enabled |
| msERROR | Internal Error | The product is not functioning correctly. This is not usually a monitor status, but used for global problem broadcasts. |
| msSUPPRESSED_ERROR | Suppressed Error | The monitor is in ERROR state, but Alert Suppression settings are keeping it from firing actions. |
| msCANTMONITOR | Can't Run! | The monitor is unable to perform its function, possibly because of lack of rights or access. |
| msDISABLED | Disabled | The monitor is currently disabled |
| msRUNNING | Running | Monitor is currently running. |
| msINIT | Scheduled | All monitors are set to this status when the service first starts |
| msPAUSING | Initial Pause | If the monitoring service is set to wait at startup (via Settings), the monitors will use this status |
| msUNLICENSED | Not Enough Licenses | Set if more servers are being monitored than licenses allow |
| msSKIPPINGACTIONS | Skipping Actions | If alerts should not be fired at startup, as specified in Settings |
| msCANTMONITORNOW | Monitor Busy | Usually happens if a monitor is contrained and has to wait a little longer before it can run. Not an error. |
| msTRAINING | Training Period | The monitor is collecting data for automatic training purposes, and will not alert. |
| msMAINTENANCE | Server Maintenance | The server is in maintenance mode, so the monitor will not run |
| msWRONG_EDITION | Wrong Product Edition | This monitor is not supported with the installed license. |
| msEXCLUSION_PERIOD | Exclusion Period | The monitor is configured not allowed to run at this time. |
| msDEPENDENCY_NOT_MET | Dependency Not Met | Monitor dependencies are not met, so this monitor will not run. |
| msSERVER_DISABLED | Server Disabled | The server is disabled, so the monitors will not run. |
| msOWNING_SATELLITE_DISCONNECTED | Satellite Disconnected | The satellite that runs this monitor has not reported in, so the monitor status is unknown |
Custom Properties
Custom Properties can be used as expansion variables by using them in this form:
$CustomProp(propertyName)$Row Variables
In addition to the values that are always available, the following values are available depending on which monitor type is sending the alert. The additional information is reported in rows for those monitors that can report information on a number of items (such as a list of changed files and directories). The number in parenthesis (the x) should therefore be replaced with a 1 for the first row of results, 2 for the second, etc. (Example: $Item(1)$, $Item(2)$, $State(1)$...).NOTE: Is is possible to not have any extra row data, especially in the emergency alert cases shown above.
| Monitors | Row Variables |
|---|---|
| Actions Scheduler | $Item(x)$ - Unused $State(x)$ - OK or PROBLEM |
| Active Directory Login Monitor | $CurrentValue(x)$ - User involved with the event (if applicable) $ID(x)$ - ID of the Event $Item(x)$ - The category for the event $ItemType(x)$ - A constant value always equal to 'Category' $State(x)$ - OK or PROBLEM |
| Bandwidth Monitor | $CurrentValue(x)$ - The current bandwidth usage value $Facility(x)$ - Port description $Item(x)$ - Port alias $ItemType(x)$ - One of: 'Bytes', 'Errors', 'Discards', 'Multicasts', 'Broadcasts', 'Unicasts', or 'NotUnicasts' $LimitValue(x)$ - Configured bandwidth threshold for the port $State(x)$ - OK or PROBLEM |
| Calculated Status | $Item(x)$ - Unused $State(x)$ - OK or PROBLEM |
| Citrix Monitor | $CurrentValue(x)$ - Number of ms for the the Connection or Login to happen. Equals -1 on error $Item(x)$ - The server being probe $ItemType(x)$ - Constant value always equal to 'Connection' or 'Login' $LimitValue(x)$ - Configured threshold seconds for login to complete $State(x)$ - OK or PROBLEM |
| Database Monitor | $CurrentValue(x)$ - Current value $Item(x)$ - The database being checked $ItemType(x)$ - Statistic being checked. One of: DBINDEX_SIZE, LOGSIZE, TOTALSIZE, FILEOVERLIMIT, LOGOVERLIMIT, RECOVERYCHANGED $LimitValue(x)$ - Configured threshold $State(x)$ - OK or PROBLEM |
| Database Server Monitor | $CurrentValue(x)$ - N/A $Description(x)$ - Constant value equal to 'CREATED', 'DELETED', 'CHANGED' or 'DOWN'. $Item(x)$ - Database name $ItemType(x)$ - Constant value equal to 'DATABASE' $LimitValue(x)$ - N/A $State(x)$ - OK or PROBLEM |
| Directory Quota Monitor | $CurrentValue(x)$ - Directory size in MB $Item(x)$ - Directory being checked $ItemType(x)$ - Constant value always equal to 'Directory' $LimitValue(x)$ - Configured threshold directory size in MB $State(x)$ - OK or PROBLEM |
| Disk Space Monitor | $CurrentValue(x)$ - Number of free MB on the drive $Item(x)$ - The drive whose free disk space is being checked $ItemType(x)$ - Constant value equal to 'Disk', or 'Error' $LimitValue(x)$ - Configured threshold (could be in % or an absolute size and unit) $State(x)$ - OK or PROBLEM |
| DNS Monitor | $CurrentValue(x)$ - The resolved result $Item(x)$ - The hostname or IP address being resolved $ItemType(x)$ - Constant value always equal to 'Host' $State(x)$ - OK or PROBLEM |
| Dynamic Server List | $CurrentValue(x)$ - "ADDED" or "REMOVED" $Item(x)$ - IP address of the computer/device $ItemType(x)$ - Constant value of "DEVICE" $LimitValue(x)$ - DNS name if it can be determined $State(x)$ - OK or PROBLEM |
| Email Monitor | $ID(x)$ - Email message-ID field $Item(x)$ - Email address being monitored $ItemType(x)$ - 'BODY' or 'SUBJECT' depending on what was matched $State(x)$ - OK or PROBLEM |
| Esensor EM01B Monitor | $CurrentValue(x)$ - The value of the measured item $Item(x)$ - Constant value always equal to 'EM01b Temperature', 'EM01b Humidity', or 'EM01b Luminescence'. $ItemType(x)$ - Constant value always equal to 'EM01b Temperature', 'EM01b Humidity', or 'EM01b Luminescence'. $LimitValue(x)$ - Configured threshold for the item $State(x)$ - OK or PROBLEM |
| Event Log Monitor | $CurrentValue(x)$ - Time of the log item in the Event Log, as a string $Extra1(x)$ - Content of the log item $Extra2(x)$ - Event ID of the log item $Item(x)$ - The Event Log Source that produced the log item $ItemType(x)$ - Constant value always equal to 'Source' $State(x)$ - OK or PROBLEM |
| Event Validator | $CurrentValue(x)$ - Time of the log item in the Event Log, as a string $Extra1(x)$ - Content of the log item $Extra2(x)$ - Event ID of the log item $Item(x)$ - The Event Log Source that produced the log item $ItemType(x)$ - Constant value always equal to 'Source' $State(x)$ - OK or PROBLEM |
| Execute Script | $Item(x)$ - Unused $State(x)$ - OK or PROBLEM |
| File & Directory Change Monitor (CIFS) | $CurrentValue(x)$ - Type of change that occurred. One of: 'Created', 'Deleted', or 'Changed'. $Item(x)$ - File or directory path that changed $ItemType(x)$ - Constant value always equal to 'File' or 'Directory' $State(x)$ - OK or PROBLEM |
| File Age Monitor | $CurrentValue(x)$ - Age of the file in minutes $Extra1(x)$ - File path (file & directory) that is too old $Item(x)$ - File name (not path) that is too old $ItemType(x)$ - Constant value always equal to 'File' $State(x)$ - OK or PROBLEM |
| File/Directory Size Monitor | $CurrentValue(x)$ - Current size of the file/directory $Item(x)$ - The directory or file that has grown beyond the threshold $ItemType(x)$ - Constant value always equal to 'Directory' or 'File' $LimitValue(x)$ - Threshold for the file/directory before firing actions $State(x)$ - OK or PROBLEM |
| FTP Server Monitor | $Item(x)$ - The ftp server being monitored $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM |
| Hardware Monitor | $CurrentValue(x)$ - Current status value $Item(x)$ - The sensor name that is in error, or change, or was added or removed $ItemType(x)$ - Constant value always equal to 'Added', 'Removed', 'Changed' or 'Sensor' $State(x)$ - OK or PROBLEM |
| Inventory Alerter | $CurrentValue(x)$ - Current property value $Extra1(x)$ - Comparison operation $Item(x)$ - Property name $ItemType(x)$ - Constant value always set to 'Property' $LimitValue(x)$ - Value the property is compared against $State(x)$ - OK or PROBLEM |
| Inventory Collector | $CurrentValue(x)$ - Not Set $Item(x)$ - Not Set $ItemType(x)$ - Not Set $LimitValue(x)$ - Not Set $State(x)$ - OK or PROBLEM |
| Log File Monitor | $Extra1(x)$ - Content of the matching log line(s) $Item(x)$ - The Log File that produced the log item $ItemType(x)$ - Constant value always equal to 'File' $State(x)$ - OK or PROBLEM |
| Mail Server Monitor | $Item(x)$ - The mail server being monitored $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM |
| Network Scanner | $CurrentValue(x)$ - IP address $Item(x)$ - IP address of the new computer/device that was found $ItemType(x)$ - Constant value of "DEVICE" $LimitValue(x)$ - DNS name if it can be determined $State(x)$ - OK or PROBLEM |
| Performance Monitor | $CurrentValue(x)$ - Current value of the counter, or the process % CPU usage $Extra1(x)$ - PID if item is 'Process' $Item(x)$ - The complete path of the performance counter, or the process name as seen in Perfmon $ItemType(x)$ - Constant value always equal to 'Counter' or 'Process' $LimitValue(x)$ - Configured counter threshold value as specified in the monitor $State(x)$ - OK or PROBLEM |
| Ping Monitor | $CurrentValue(x)$ - Time the ping took to return (could possibly be empty depending on settings) $Item(x)$ - The host name/IP address of the server/device being pinged $ItemType(x)$ - Constant value always equal to 'Server' $LimitValue(x)$ - Maximum time the ping is allowed to take before alerting $State(x)$ - OK or PROBLEM |
| Plugin Monitor | $CurrentValue(x)$ - Return code from the plugin, or a performance value $Item(x)$ - "Command", or a performance value's name returned from the plugin $ItemType(x)$ - Constant set to "ReturnCode" or "PerformanceValue" $LimitValue(x)$ - Warning threshold for a PerformanceValue if specified $State(x)$ - OK or PROBLEM |
| Process Monitor | $CurrentValue(x)$ - Either 'Up' or 'Down' $Item(x)$ - The process name being checked $ItemType(x)$ - Constant value always equal to 'Process' $LimitValue(x)$ - Configured threshold value as specified in the monitor $State(x)$ - OK or PROBLEM |
| Server Temperature Monitor | $CurrentValue(x)$ - Current temperature $Item(x)$ - Probe Number $ItemType(x)$ - Constant value always equal to 'Temperature' $LimitValue(x)$ - Threshold temperature $State(x)$ - OK or PROBLEM |
| Service Monitor | $CurrentValue(x)$ - One of three values: 'Up', 'Down', or '?' if the status can't be determined $Extra1(x)$ - The display name of the service being checked $Extra2(x)$ - Reason for the alert. Can be 'Status', 'Start-type-changed', 'Added' or 'Deleted' $Item(x)$ - The system name for the service being checked $ItemType(x)$ - Constant value always equal to 'Service' $State(x)$ - OK or PROBLEM |
| SNMP Monitor | $CurrentValue(x)$ - The current value of the object $Item(x)$ - The name of the SNMP object being queried $ItemType(x)$ - Constant value always equal to 'Object' $LimitValue(x)$ - Configured threshold for the object $State(x)$ - OK or PROBLEM |
| SNMP Trap Monitor | $CurrentValue(x)$ - The current value of the object $Extra1(x)$ - Trap OID or the ErrorIndex.ErrorStatus values for an Inform (this value will be the same for all rows) $Item(x)$ - The name of the SNMP object being reported on $ItemType(x)$ - Constant value always equal to 'Trap' or 'Inform' $State(x)$ - OK or PROBLEM |
| Syslog Monitor | $CurrentValue(x)$ - Message content of the log item $Extra1(x)$ - Severity numeric constant $Extra2(x)$ - Facility numeric constant $Item(x)$ - Hostname that the event came from $ItemType(x)$ - Constant always equal to 'Log' $State(x)$ - OK or PROBLEM |
| Task Scheduler | $CurrentValue(x)$ - /The current Last Run Result value, or ENABLED or DISABLED $Item(x)$ - The name of the Scheduled Task, including path $ItemType(x)$ - Constant value equal to one of: ENABLE-CHANGE, LAST-RUN-RESULT-CHANGE, LAST-RUN-RESULT, or MISSING $LimitValue(x)$ - The task's previous Last Run Result value for the STATUS-CHANGE state $State(x)$ - OK or PROBLEM |
| TCP Port Monitor | $Extra1(x)$ - Port that is being monitored $Item(x)$ - The server being monitored $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM |
| Web Page Monitor | $CurrentValue(x)$ - Time the page took to return $Item(x)$ - The URL being monitored $ItemType(x)$ - Constant value always equal to 'URL' $LimitValue(x)$ - Maximum time the page was allowed to take before alerting $State(x)$ - OK or PROBLEM |