...
| Event Property | Description | Example |
|---|---|---|
interface_description | The ifAlias (or Description) of the interface in question
| |
authority | The server name of the system that originated the event; Optional, only relevant for remotely/API-generated events. | |
location | The URI for this event at the originating server. Optional, only relevant for remotely/API-generated events. | |
duplicateof | list of Event IDs that this one is a duplicate of | |
nodes | lists nodes that caused this synthetic event | |
eventids | list of Event IDs that were involved in causing this synthetic event | |
| Unix time, until then the event is held back from processing for actions and policies | 1385079231 |
action_checked | Has the event been processed wrt. actions and policies? | 0 or 1 |
<scriptname>.output | If an event triggered a script action that is set to save, then the script output is stored in this property. | |
synthetic | whether this event was created by a correlation policy action, or because a watchdog expired | 0 or 1 |
watchdog | whether this is a watchdog expiration event | 0 or 1 |
notes | a list of originator- and time-tagged comments for this event (optional, supported in opEvents 2.0 and newer) | |
tag_<anything> | These enrichment tags are controlled by your action policy, and have no special meaning - with the exception of tag_kb_topican optional tag for KnowledgeBase Linking, supported , which controls linking to online sources (in opEvents 2.0.2 and newerup) |
Node vs. Host, and how opEvents handles inconsistent input data
...