Administer > Configure Incidents > Configure Syslog Message Incidents (ArcSight) > Syslog Message Configuration Form (ArcSight) > Configure Basic Settings for a Syslog Message Incident (ArcSight) > Valid Parameters for Configuring Incident Messages (Syslog Message) (ArcSight)

Valid Parameters for Configuring Incident Messages (Syslog Message) (ArcSight)

When configuring incident messages, consider using incident information as part of the message. NNMi provides the following parameter values. Use these parameters as variables when formatting an incident message.

Tip See the Using the Incident Form for more information about the parameter values.

Note NNMi stores varbind values as custom incident attributes (CIAs).

Tip If a value is not stored for a parameter, it is returned as “null”.

See Specify Your Incident Message Format (Syslog Message) (ArcSight) for more information about configuring messages.

Parameter strings are available for the following:

See the following tables to view the valid parameters for incidents generated from Custom Polled Instances.

  • Parameter strings for all incidents (Incident form attributes) (Click here for a list of choices.)

    Parameter Strings for all Incidents (Incident form attributes)
    Parameter String Description
    $category, $cat Value of the Category attribute in the Incident form.
    $count, $cnt Value representing the number of Custom Incident Attributes that appear in the Incident form.
    $family, $fam Value from the Family attribute in the Incident form.
    $firstOccurrenceTime, $fot  Value from the First Occurrence Time attribute in the incident form.
    $lastOccurrenceTime, $lot Value from the Last Occurrence Time attribute in the incident form.
    $lifecycleState, $lcs Value from the Lifecycle State attribute in the Incident form.
    $name Value of the Name attribute from the incident configuration.
    $nature, $nat Value from the Nature attribute in the Incident form.
    $origin, $ori Value from the Origin attribute in the Incident form.
    $originOccurrenceTime, $oot Value from the Origin Occurrence Time attribute in the incident form.
    $priority, $pri Value from the Priority attribute in the Incident form.
    $sev, $severity Value of the Severity attribute of the Incident form.

  • Parameter Strings for Node Source Objects (Node form attributes) (Click here for a list of choices.)

    Parameter Strings for Node Source Objects (Node form attributes)
    Parameter String Description
    $managementAddress, $mga Value from the Management Address attribute of the incident's source Node's form or SNMP Agent form.
    $otherSideOfConnectionManagementAddress, $oma If the incident's Source Node is part of a Layer 2 Connection, this attribute is the value of the Management Address of a node on the other side of the Layer 2 Connection.
    $sourceNodeLongName, $sln The fully-qualified DNS name as displayed in the Hostname attribute of the incident's source Node's form.
    $sourceNodeName, $snn Value from the Name attribute of the incident's source Node's form.
    $sysContact, $sct Value from the System Contact attribute of the incident's source Node form: General tab.
    $sysLocation, $slc Value from the System Location attribute of the incident's source Node form: General tab.

  • Parameter Strings for Interface Source Objects (Interface form attributes) (Click here for a list of choices.)

    Parameter Strings for Interface Source Objects (Interface form attributes)
    Parameter String Description
    $ifAlias, $ifa Value from the IfAlias attribute for the interface that is the incident's source object.
    $ifConfigDupSetting, $icd Configured Duplex Setting on the port associated with the interface that is the incident's source object.
    $ifDesc, $idc Value from the ifDesc attribute for the interface that is the incident's source object.
    $ifIndex, $idx Value from the ifIndex attribute for the interface that is the incident's source object.
    $ifIpAddr, $iia IP Address values associated with the interface that is the incident's source object.   If multiple IP addresses are associated with the interface, this parameter returns a comma-separated list.

    $ifName, $ifn

    		 Value from the ifName attribute for the interface that is the incident's source object.
    $ifPhysAddr, $ipa Value from the Physical Address attribute for the interface that is the incident's source object.
    $ifSpeed, $isp Value from the ifSpeed attribute for the interface that is the incident's souce object.
    $ifType, $itp Value from the ifType attribute for the interface that is the incident's souce object.

  • Parameter Strings for Layer 2 Connection Source Objects (Layer 2 Connection form attributes) (Click here for a list of choices.)

    Parameter Strings for Layer 2 Connection Source Objects (Layer 2 Connection form attributes)
    Parameter String Description
    $otherSideOfConnectionConfigDupSetting, $ocd If the incident's source Node is part of a Layer 2 Connection, this parameter contains the Configured Duplex Setting on the port associated with the interface on the other side of the connection.
    $otherSideOfConnectionIfAlias, $oia If the incident's Source Node is part of a Layer 2 Connection, this parameter is the value of the ifAlias of one of the interfaces on the other side of the Layer 2 Connection.
    $otherSideOfConnectionIfDesc, $odc If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifDescr attribute value for the interface on the other side of the Layer 2 Connection.
    $otherSideOfConnectionIfIndex, $odx If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifIndex attribute value for the interface on the other side of the connection.
    $otherSideOfConnectionIfName, $ofn If the incident's Source Node is part of a Layer 2 Connection, this parameter contains the ifName attribute value for the interface on the other side of the connection.

  • Parameter strings for VLAN Source Objects (VLAN form attributes) (Click here for a list of choices.)

    Parameter Strings for VLAN Source Objects (VLAN form attributes)
    Parameter String Description
    $impVlanIds, $ivi Value from the VLAN Id attribute associated with the interface that is the incident's source object. To access this information from an interface form, navigate to the VLAN Port tab and open the form for the VLAN of interest. If the interface is part of more than one VLAN, this parameter returns a comma-separated list.
    $impVlanNames, $ivn Value from the VLAN Name attribute associated with the interface that is the incident's source object. To access this information from an interface form, navigate to the VLAN Ports tab of the Interface form. If the interface is part of more than one VLAN, this parameter returns a comma-separated list.

  • Parameter Strings for all incidents (Additional information that is not visible in any form) (Click here for a list of choices.)

    Parameter Strings for all Incidents (Attributes not visible in any form)
    Parameter String Description
    $firstOccurrenceTimeMs, $fms Value from the First Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
    $lastOccurrenceTimeMs, $lms Value from the Last Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
    $oid Value of the unique object identifier (oid) for the incident configuration that originated from either an SNMP Trap, Syslog Message or Management Event.
    $otherSideOfConnection, $osc

    If the incident's Source Node is part of a Layer 2 Connection, this attribute is the following combination of values for the node and one of its interfaces on the other side of the Layer 2 Connection:

    The fully-qualified DNS name of the node appended with the interface Name in the following format: <fully-qualified DNS name>[interface_name]
    $originOccurrenceTimeMs $oms Value from the Origin Occurrence Time attribute in the incident form, converted to millseconds (measured since January 1, 1970, 00:00:00 GMT - Greenwich Mean Time).
    $sourceNodeUuid, $snu Universally Unique Object Identifier attribute value of the source node object for the incident (unique across all databases). This identifier distinguishes the source node object instance from all other node objects.
    $sourceObjectClass, $soc Value of the object class for the object you want to include. Use this parameter to request more details of a class of objects through a web service. Examples of object classes include: com.hp.ov.nms.model.core.Interface and com.hp.ov.nms.model.snmp.SnmpAgent.
    $sourceObjectName, $son Value from the Name attribute of the source object. For example, an interface object is named according to the MIB ifName. Each ifName varies according to the vendor's conventions. Using the name 4/1 as an example, 4 represents the board number and 1 represents the port number.
    $sourceObjectUuid, $sou Universally Unique Object Identifier attribute value of the source object for the incident (unique across all databases). This identifier distinguishes the source object instance from all other similar object instances.
    $uuid Universally Unique Object Identifier attribute value of the incident (unique across all databases). This identifier distinguishes the incident object instance from all other incident objects.

  • Information established in Custom Incident Attributes (Click here for a list of choices.)

     

    Parameter Strings for Attributes Established in Custom Incident Attributes
    Parameter String Description
    $<position _number>

    Value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, to indicate you want to use the varbind in position 1, enter: $1

    NNMi stores varbind values as Custom Incident Attributes. If you know the varbind position number, use this parameter.
    $<CIA_name> Value of the name that is used for the custom incident attribute. For example, $mycompany.mycia. NNMi provides CIA values for configuring Management Events.
    $<CIA_oid> Value of the object identifier for any custom incident attribute that originated as a varbind. For example, $.1.3.6.1.6.3.1.1.5.1. Use this parameter when you are not certain of a custom incident attribute (varbind) position number.
    $* Used to indicate you want all of the custom incident attribute values originating as varbinds, to be passed to the action configuration. Each varbind is returned in the following format: $<CIA_name>:<CIA_value> in which the custom incident attribute name appears followed by the custom incident attribute value.

  • Functions to generate values (Click here for a list of choices.)

    The function described in the following table replaces the specified numeric value with the associated text value stored in the CIA.

    The associated MIB must have been loaded using the nnmloadmib.ovpl command.

    Functions to Generate Values Within the Incident Message
    Function Description
    $oidtext($<position_number>)

    A <position_number> argument specifies the numeric value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, $oidtext($2).

    The position number you enter must represent a CIA that contains an Object Identifier (OID) value.

    NNMi returns the textual value of the OID for the CIA specified.

    Note the following:

    • If the MIB is not loaded, NNMi returns the numeric OID value.
    • If the OID has a MIB instance, the number representing the MIB instance is appended to the textual OID value.
    $oidtext($<CIA_oid>)

    The <CIA_oid> argument specifies the Object Identifier (OID) for any custom incident attribute that originated as a varbind. For example, $oidtext($.1.3.6.1.6.3.1.1.5.1.) Use this argument to the $oidtext() function when you are not certain of a custom incident attribute (varbind) position number.

    NNMi replaces the numeric value with the textual value of the OID you specify.

    Note the following:

    • If the MIB is not loaded, NNMi returns the numeric OID value.
    • If the OID has a MIB instance, the number representing the MIB instance is appended to the textual OID value.
    $text($<position_number>)

    The <position_number> argument specifies the numeric value of the custom incident attribute (CIA) position number for any CIA that originated from a varbind or was added by NNMi. For example, to indicate you want to use the varbind in position 1, enter: $1.

    NNMi replaces the numeric value with the text value stored in the CIA.

    Note: If a text value is not available, NNMi returns the numeric value.
    $text($<CIA_oid>)

    The <CIA_oid> argument specifies the object identifier for any custom incident attribute that originated as a varbind. For example, $.1.3.6.1.6.3.1.1.5.1. Use this argument to the $text function when you are not certain of a custom incident attribute (varbind) position number.

    NNMi replaces the numeric value with the text value stored in the CIA.

    If a text value is not available, NNMi returns the numeric value.

Send Help Center feedback