...
Event Property | Description | Example |
eventid | A globally unique Event ID | |
| Unix time of the event (seconds since 1970). With decimal seconds. | 1385076573 |
|
Note: This Property has been deprecated | 2013 |
| The name of the node in question. Normally the same as the NMIS node name. | |
| The DNS hostname or IP address of the node in question, as extracted from the input data. | |
| Name of the event | Node Down, Node Up |
| What element of the node the event refers to. | FastEthernet1, Neighbor 1.2.4.5 |
| Is the state good or bad, up or down. | up/down, open/closed, etc |
| Name of the stateful object. | Node, Interface, OSPF Neighbor |
| Other event details | |
| Where did the event originate? | cisco_syslog, trap, NMIS, (remote) API |
| Has the event been marked for escalation? | 0 or 1 |
priority | opEvents priority level, see opEvents priority levels vs. NMIS and Syslog levels | 0 to 10, inclusive |
level | nearest NMIS severity level, computed from priority (only in opEvents 2.2 and newer) | Normal to Fatal |
| Has the event been acknowledged? | 0 or 1 |
| Is this event a flap? | 0 or 1 |
| action_required | Should the GUI show the event as open? Only present in opEvents versions up to (and including) 2.0.3. | 0 or 1 |
| planned_outage | opEvents looks up the node in the NMIS planned outage system and sets the value of planned_outage (default value) to be true or false if a planned outage is scheduled or not. Scheduled Outages or Maintenance Windows Only available in opEvents versions 4.1.1 and newer, Release Notes: opEvents 4.1.1 | true or false |
...
opEvents works on an event, the event can be thought of as a document and all the contents of that document move through opEvents together, additional properties are added and updated during event processing. It is also not only possible but strongly encouraged to add additional properties as the richer the event, the more useful it will be during processing, obviously the data captured should be relevant and useful. This is easily done during event parsing and a variable is created by including a new variable name in the capture statement, see more details in opEvents EventParserRules - Adding Rules For SNMP Traps and Syslog Messages.
During event processing by EventActions, you can tag events with the tag function, and use it for event processing and conditions. If an event is tagged like this:
...