- Solutions
-
- File Server: Ransomware Protection
- File Server: File Copy
- File Server: Audit File Access
- File Server: Storage growth reporting
- Licensing/Pricing
- Contact
Variables
A number of the actions accept variables to alter their output. The messaging actions ( E-mail, Message Box, Network Message, Pager Alert, and SMS Message) can all accept variables in their message template. In addition, the executable actions (Execute Script and Start Application) can also accept variables to change the action at run time.
Replacement Variables
The variables below can be inserted into the action or the message template as shown. The one exception is the Execute Script action -- in that case, the starting and ending $ are not used.
Variable Modifications
Most variables support replacement and truncation using this format:
| $Details['a','b']$ | replace character 'a' with character 'b' in the value of Details before using it as a replacement value. |
| $Details["abc","xyz"]$ | replace string "abc" with "xyz" in the Details's value before using it as a replacement value. |
| $Details[50]$ | Truncate the value to 50 characters before the replacement |
Note that these can also be combined such as:
| $Details['"',' '][60]$ | Replace quote characters with a single space, and truncate to 60 characters |
| $Details['!','~']["\r\n",""][70]$ | Replace pipe characters with tilde characters, remove newline combinations, and truncate to 70 characters |
General Variables
The following variables are always available. Please note that variables are case sensitive.| Variable | Meaning |
|---|---|
| $AlertCharts$ | This value will be replaced with charts if any are available for the alert. This variable only works with Email Actions. |
| $AlertID$ | A unique integer that represents this particular alert. |
| $CustomProp(propName)$ | The value for a custom property for the target monitor, computer or containing group. Empty if the property is not defined. See below for more details. |
| $Date$ | Current date in string format |
| $Details$ | Text describing the result of the monitor. This is what most other actions display/report. If you want the Details value to be on a single line, use $Details_Single_Line$ |
| $Details_Single_Line$ | The Details variable with everything on one line (line breaks removed) |
| $Details_Single_Line(x)$ | The first X characters of the Details variable. Useful for trimming the value to a specific length. |
| $Group$ | The group that contains the computer where the monitor detected the issue |
| $GroupPath$ | The full group path (ie Group1\Group2\Group3) that contains the computer where the monitor detected the issue |
| $Machine$ | The computer where the monitor detected the issue |
| $MachineIP$ | The IP address of the computer where the monitor detected the issue. Defaults to 0.0.0.0 if the value can't be determined. |
| $MachineID$ | ID of the computer involved. Defaults to 0 if the value can't be determined. |
| $MachineAlias$ | The aliased computer name (if an alias was entered, otherwise the same as Machine above) |
| $MonitorTitle$ | Title of the reporting monitor |
| $MonitorMsg$ | Custom message text from the originating monitor. This can be set in the monitor's Advanced Monitor Options |
| $NL$ | New Line character |
| $ProdVer$ | Current version of this program |
| $MonitorType$ | The type of monitor that detected the issue. This is the same text as you see in the list when choosing to create a new monitor. |
| $Status$ | Status of the monitor. (See table below for possible values.) |
| $StatusText$ | A cleaner version of Status. See table below for possible values (note that some values are rarely seen). |
| $Time$ | Current time in string format |
| $TimeInError$ | Amount of time that a monitor is or was in error. Ex: "Was in error for 1h 2m 3s" |
| $WinDir$ | WINDOWS directory for the target computer |
| Status | Status Text | Meaning |
|---|---|---|
| msOK | OK | Monitor is OK |
| msALERT | Alert | Monitor is in alert state because of what it found |
| msALERT_GREEN | Alert (Green) | The monitor is in Alert state, but has been configured to remain green anyway. |
| msALERT_RED | Alert (Red) | The monitor is in Alert state, but has been configured to turn red. |
| msSUPPRESSED_ALERT | Suppressed Alert | The monitor is in Alert state, but actions are being suppressed via Alert Suppression settings. |
| msUNACKNOWLEDGED | Unacknowledged Alerts | OK state, except there are unacknowledged errors and Error Acknowledgement is enabled |
| msERROR | Internal Error | The product is not functioning correctly. This is not usually a monitor status, but used for global problem broadcasts. |
| msSUPPRESSED_ERROR | Suppressed Error | The monitor is in ERROR state, but Alert Suppression settings are keeping it from firing actions. |
| msCANTMONITOR | Can't Run! | The monitor is unable to perform its function, possibly because of lack of rights or access. |
| msDISABLED | Disabled | The monitor is currently disabled |
| msRUNNING | Running | Monitor is currently running. |
| msINIT | Scheduled | All monitors are set to this status when the service first starts |
| msPAUSING | Initial Pause | If the monitoring service is set to wait at startup (via Settings), the monitors will use this status |
| msUNLICENSED | Not Enough Licenses | Set if more servers are being monitored than licenses allow |
| msSKIPPINGACTIONS | Skipping Actions | If alerts should not be fired at startup, as specified in Settings |
| msCANTMONITORNOW | Monitor Busy | Usually happens if a monitor is contrained and has to wait a little longer before it can run. Not an error. |
| msTRAINING | Training Period | The monitor is collecting data for automatic training purposes, and will not alert. |
| msMAINTENANCE | Server Maintenance | The server is in maintenance mode, so the monitor will not run |
| msWRONG_EDITION | Wrong Product Edition | This monitor is not supported with the installed license. |
| msEXCLUSION_PERIOD | Exclusion Period | The monitor is configured not allowed to run at this time. |
| msDEPENDENCY_NOT_MET | Dependency Not Met | Monitor dependencies are not met, so this monitor will not run. |
| msSERVER_DISABLED | Server Disabled | The server is disabled, so the monitors will not run. |
| msOWNING_SATELLITE_DISCONNECTED | Satellite Disconnected | The satellite that runs this monitor has not reported in, so the monitor status is unknown |
Custom Properties
Custom Properties can be used as expansion variables by using them in this form:
$CustomProp(propertyName)$Row Variables
In addition to the values that are always available, the following values are available depending on which monitor type is sending the alert. The additional information is reported in rows for those monitors that can report information on a number of items (such as a list of changed files and directories). The number in parenthesis (the x) should therefore be replaced with a 1 for the first row of results, 2 for the second, etc.Example: $Item(1)$, $ItemType(2)$, $State(1)$
You can also use a negative number to retrieve the variable for the value in the list that caused the monitor to fire actions (i.e. where ItemState is set to PROBLEM). -1 is the first error item, -2 is the second error item, etc.
Example: $Item(-1)$, $ItemState(-2)$
NOTE: Is is possible to not have any extra row data, especially in the emergency alert cases shown above.
| Monitors | Row Variables |
|---|---|
| Actions Scheduler | $Item(x)$ - Unused $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Active Directory Login Monitor | $CurrentValue(x)$ - User involved with the event (if applicable) $ID(x)$ - ID of the Event $Item(x)$ - The category for the event $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - A constant value always equal to 'Category' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Bandwidth Monitor | $CurrentValue(x)$ - The current bandwidth usage value $Facility(x)$ - Port description $Item(x)$ - Port alias $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - One of: 'Bytes', 'Errors', 'Discards', 'Multicasts', 'Broadcasts', 'Unicasts', or 'NotUnicasts' $LimitValue(x)$ - Configured bandwidth threshold for the port $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Calculated Status | $Item(x)$ - Unused $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Citrix Monitor | $CurrentValue(x)$ - Number of ms for the the Connection or Login to happen. Equals -1 on error $Item(x)$ - The server being probe $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Connection' or 'Login' $LimitValue(x)$ - Configured threshold seconds for login to complete $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Database Monitor | $CurrentValue(x)$ - Current value $Item(x)$ - The database being checked $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Statistic being checked. One of: DBINDEX_SIZE, LOGSIZE, TOTALSIZE, FILEOVERLIMIT, LOGOVERLIMIT, RECOVERYCHANGED $LimitValue(x)$ - Configured threshold $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Database Server Monitor | $CurrentValue(x)$ - N/A $Description(x)$ - Constant value equal to 'CREATED', 'DELETED', 'CHANGED' or 'DOWN'. $Item(x)$ - Database name $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value equal to 'DATABASE' $LimitValue(x)$ - N/A $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Directory Quota Monitor | $CurrentValue(x)$ - Directory size in MB $Item(x)$ - Directory being checked $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Directory' $LimitValue(x)$ - Configured threshold directory size in MB $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Disk Space Monitor | $CurrentValue(x)$ - Number of free MB on the drive $Item(x)$ - The drive whose free disk space is being checked $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value equal to 'Disk', or 'Error' $LimitValue(x)$ - Configured threshold (could be in % or an absolute size and unit) $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| DNS Monitor | $CurrentValue(x)$ - The resolved result $Item(x)$ - The hostname or IP address being resolved $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Host' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Dynamic Server List | $CurrentValue(x)$ - "ADDED" or "REMOVED" $Item(x)$ - IP address of the computer/device $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value of "DEVICE" $LimitValue(x)$ - DNS name if it can be determined $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Email Monitor | $ID(x)$ - Email message-ID field $Item(x)$ - Email address being monitored $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - 'BODY' or 'SUBJECT' depending on what was matched $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Esensor EM01B Monitor | $CurrentValue(x)$ - The value of the measured item $Item(x)$ - Constant value always equal to 'EM01b Temperature', 'EM01b Humidity', or 'EM01b Luminescence'. $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'EM01b Temperature', 'EM01b Humidity', or 'EM01b Luminescence'. $LimitValue(x)$ - Configured threshold for the item $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Event Log Monitor | $CurrentValue(x)$ - Time of the log item in the Event Log, as a string $Extra1(x)$ - Content of the log item $Extra2(x)$ - Event ID of the log item $Item(x)$ - The Event Log Source that produced the log item $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Source' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Event Validator | $CurrentValue(x)$ - Time of the log item in the Event Log, as a string $Extra1(x)$ - Content of the log item $Extra2(x)$ - Event ID of the log item $Item(x)$ - The Event Log Source that produced the log item $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Source' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Execute Script | $Item(x)$ - Unused $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| File & Directory Change Monitor (CIFS) | $CurrentValue(x)$ - Type of change that occurred. One of: 'Created', 'Deleted', or 'Changed'. $Item(x)$ - File or directory path that changed $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'File' or 'Directory' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| File Age Monitor | $CurrentValue(x)$ - Age of the file in minutes $Extra1(x)$ - File path (file & directory) that is too old $Item(x)$ - File name (not path) that is too old $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'File' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| File/Directory Size Monitor | $CurrentValue(x)$ - Current size of the file/directory $Item(x)$ - The directory or file that has grown beyond the threshold $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Directory' or 'File' $LimitValue(x)$ - Threshold for the file/directory before firing actions $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| FTP Server Monitor | $Item(x)$ - The ftp server being monitored $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Hardware Monitor | $CurrentValue(x)$ - Current status value $Item(x)$ - The sensor name that is in error, or change, or was added or removed $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Added', 'Removed', 'Changed' or 'Sensor' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Inventory Alerter | $CurrentValue(x)$ - Current property value $Extra1(x)$ - Comparison operation $Item(x)$ - Property name $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always set to 'Property' $LimitValue(x)$ - Value the property is compared against $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Inventory Collector | $CurrentValue(x)$ - Not Set $Item(x)$ - Not Set $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Not Set $LimitValue(x)$ - Not Set $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Log File Monitor | $Extra1(x)$ - Content of the matching log line(s) $Item(x)$ - The Log File that produced the log item $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'File' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Mail Server Monitor | $Item(x)$ - The mail server being monitored $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Network Scanner | $CurrentValue(x)$ - IP address $Item(x)$ - IP address of the new computer/device that was found $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value of "DEVICE" $LimitValue(x)$ - DNS name if it can be determined $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Performance Monitor | $CurrentValue(x)$ - Current value of the counter, or the process % CPU usage $Extra1(x)$ - PID if item is 'Process' $Item(x)$ - The complete path of the performance counter, or the process name as seen in Perfmon $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Counter' or 'Process' $LimitValue(x)$ - Configured counter threshold value as specified in the monitor $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Ping Monitor | $CurrentValue(x)$ - Time the ping took to return (could possibly be empty depending on settings) $Item(x)$ - The host name/IP address of the server/device being pinged $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Server' $LimitValue(x)$ - Maximum time the ping is allowed to take before alerting $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Plugin Monitor | $CurrentValue(x)$ - Return code from the plugin, or a performance value $Item(x)$ - "Command", or a performance value's name returned from the plugin $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant set to "ReturnCode" or "PerformanceValue" $LimitValue(x)$ - Warning threshold for a PerformanceValue if specified $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Process Monitor | $CurrentValue(x)$ - Either 'Up' or 'Down' $Item(x)$ - The process name being checked $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Process' $LimitValue(x)$ - Configured threshold value as specified in the monitor $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Server Temperature Monitor | $CurrentValue(x)$ - Current temperature $Item(x)$ - Probe Number $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Temperature' $LimitValue(x)$ - Threshold temperature $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Service Monitor | $CurrentValue(x)$ - One of three values: 'Up', 'Down', or '?' if the status can't be determined $Extra1(x)$ - The display name of the service being checked $Extra2(x)$ - Reason for the alert. Can be 'Status', 'Start-type-changed', 'Added' or 'Deleted' $Item(x)$ - The system name for the service being checked $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Service' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| SNMP Monitor | $CurrentValue(x)$ - The current value of the object $Item(x)$ - The name of the SNMP object being queried $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Object' $LimitValue(x)$ - Configured threshold for the object $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| SNMP Trap Monitor | $CurrentValue(x)$ - The current value of the object $Extra1(x)$ - Trap OID or the ErrorIndex.ErrorStatus values for an Inform (this value will be the same for all rows) $Item(x)$ - The name of the SNMP object being reported on $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Trap' or 'Inform' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Syslog Monitor | $CurrentValue(x)$ - Message content of the log item $Extra1(x)$ - Severity numeric constant $Extra2(x)$ - Facility numeric constant $Item(x)$ - Hostname that the event came from $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant always equal to 'Log' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Task Scheduler | $CurrentValue(x)$ - /The current Last Run Result value, or ENABLED or DISABLED $Item(x)$ - The name of the Scheduled Task, including path $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value equal to one of: ENABLE-CHANGE, LAST-RUN-RESULT-CHANGE, LAST-RUN-RESULT, or MISSING $LimitValue(x)$ - The task's previous Last Run Result value for the STATUS-CHANGE state $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| TCP Port Monitor | $Extra1(x)$ - Port that is being monitored $Item(x)$ - The server being monitored $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'Server' $State(x)$ - OK or PROBLEM to represent the status of the monitor |
| Web Page Monitor | $CurrentValue(x)$ - Time the page took to return $Item(x)$ - The URL being monitored $ItemState(x)$ - OK or PROBLEM to indicate if this row caused the monitor to fire alerts $ItemType(x)$ - Constant value always equal to 'URL' $LimitValue(x)$ - Maximum time the page was allowed to take before alerting $State(x)$ - OK or PROBLEM to represent the status of the monitor |