When creating and editing alerts, set the custom Trigger Message and Clear Message to include any custom variables you’d like to receive in your notifications. The Trigger Message will appear in the initial alert trigger notifications and the Clear Message will appear in the alert clear notifications.
You can craft these trigger and clear messages to be similar in nature, or they can contain completely different information depending on what you want to see. You are not limited by the type of trigger conditions in your alert as to what variables you can use in your message. For example, if your trigger conditions are around memory utilization, you can refer to the CPU utilization, device serial number, or the firmware version if desired.
Currently, we can only specify Collector, Device & VMware properties in the Trigger/Clear Message. Interface, Service & other properties will be available before Commercial Availability.
Examples
Trigger Message
Let’s use the device’s name, vendor and model in the trigger message to say the device has gone offline.
“The device $system.name ($system.vendor/$system.model) has gone offline.”
Let’s use the device’s name and serial number in the trigger message, along with the last update time of the memory, to say the device has exceeded the target memory utilization. We’ll also throw in the device’s current memory, CPU and storage values for more context.
“Device $system.name (SN - $system.serialNo) has exceeded 80% memory utilization as of $deviceWithStats.memory.lastUpdated (Memory/CPU/Storge: $deviceWithStats.memory.totalUtilizationAvg5Min / $deviceWithStats.cpu.totalUtilizationAvg5Min / $deviceWithStats.storage.totalUtilizationAvg5Min)“
Clear Message
Let’s use the device’s name, vendor and model in the clear message to say the device is now online.
“The device $system.name ($system.vendor/$system.model) is now online.”
Let’s use the last update time of the memory and the device’s name and serial number to say the device’s memory utilization has returned to normal.
“As of $deviceWithStats.memory.lastUpdated, the device $system.name (SN - $system.serialNo) has returned to normal memory utilization.“
How to enter variables
When you add a variable to an trigger message or clear message, you must enter it exactly as shown below including the '$'. If you enter the variable without the dollar sign, for example, you’ll receive the plain text of the variable (e.g., “system.operStatus”) rather than the appropriate dynamic value (e.g. “online”) in your alert notification.
Note: Typing the character '$' will show the list of notification variables that are available for the current alert type.
Collector
Variable Values | Description |
|---|---|
| Identifier of the collector. |
| hostname of the collector. |
| Current connection state of the collector |
| Current approval state of the collector. |
| Software build version of the collector. |
| Type of the collector. |
| OS version that the collector is running on. |
| The public IP address of the collector. |
| The private IP address of the collector. |
Device
Variable Values | Description |
|---|---|
| The name of the device. |
| Serial number of the system. |
| The manufacturer of the device. |
| The model of the device. |
| The deviceClass of the device. |
| The current operational status of the entity. |
| A description of the system. |
| The version of firmware or BIOS running on the system. |
| The version of the operating system or other system software. |
| $system.agentConnectionStatus | The current operational status of the entity based on endpoint agent data only. |
| $system.collectorConnectionStatus | The current operational status of the entity based on collector data only. |
| The previous version of the firmware or BIOS running on the system. |
| The previous version of the operating system or other system software. |
| The total utilization of CPUs aggregated over 5mn. |
| This timestamp indicates the time we last received the device CPU stats. |
| The total utilization of memory aggregated over 5mn. |
| The timestamp indicates the time we last received the memory stats. |
| The total utilization of storage aggregated over 5mn. |
| The timestamp indicates the time we last received the storage stats. |
| This is based on the ICMP response code and will determine if the host is unavailable or unreachable.
|
| This is the uptime for a device in days. |
Disk Partitions
Variable Values | Description |
|---|---|
| The name of the disk partition. |
| The storage utilization of the disk partition as a percentage of the total capacity, averaged over 5 minutes. |
| The storage utilization of the disk partition in GB, averaged over 5 minutes. |
$deviceWithStats.diskPartitionLoad.diskPartitionLoadAvg5min.gigabytesRemaining |
Printers Only
Variable Values | Description |
|---|---|
| The printer output tray is missing. |
| The printer input tray is missing. |
| The printer is jammed. |
| The printer is low on paper. |
| The printer is out of paper. |
UPS Only
Variable Values | Description |
|---|---|
| This is the current status of the UPS. |
| This is the capacity of the UPS. |
| This indicates if the UPS needs to be replaced. |
| This indicates the actual voltage of the UPS. |
| This indicates the input line voltage of the UPS. |
| This indicates the output voltage of the UPS. |
| This indicates the cause of the current line failure of the UPS. |
Firewalls Only
Variable Values | Description |
|---|---|
| This is the current session utilization of client VPN connections. |
| The number of VPN available sessions for a client. |
| The current VPN connection count for a client.
|
Services
Variable Values | Description |
|---|---|
| This indicates the name of the device that the cloud ping check is checking. |
| This is the IP address of the device that the cloud ping check is checking. |
| This is the aggregated failure rate of the device that the cloud ping check is checking. |
| This indicates the status of the service being monitored (on/off) |
$monitors.monitorStatus.deviceName | This is the device name of the device that is being monitored. Note: There is only a value if the service is associated with a device or interface e.g. Internet Connection Check. A cloud ping check based on a FQDN will have neither. |
$monitors.monitorStatus.interfaceName | This is the interface name that is being monitored. Note: There is only a value if the service is associated with a device or interface e.g. Internet Connection Check. A cloud ping check based on a FQDN will have neither. |
$monitors.packetLossAggregated | Aggregated Packet Loss that Internal Ping Check is checking. |
$monitors.avgRttAggregated | Average RTT (Round Trip Time) that Internal Ping Check is checking. |
$monitors.minRttAggregated | Minimum RTT (Round Trip Time) that Internal Ping Check is checking. |
$monitors.maxRttAggregated | Maximum RTT (Round Trip Time) that Internal Ping Check is checking. |
$monitors.target | This is the Specific target IP address that Internal Ping Check is checking. |
$monitors.deviceId | This is the ID of the device on which the above mentioned target IP resides (that the Internal Ping Check is checking). |
$monitors.deviceName | This is the name of the device on which the above mentioned target IP resides (that the Internal Ping Check is checking). |
Alert Insights Only
Alert Insights metrics are calculated using a rolling 30-day window. Each metric is evaluated against a baseline calculated as the average of the six preceding 30-day periods.
| Variable Values | Description |
| $aiSummary | Aurora alert insights summary (only available is Aurora is enabled) |
| $alertInsightsSummary | Alert insights summary (only available if Aurora is disabled) |
| $alertCountsBySeverity.currentEmergencyCount | Emergency alert count in the last 30 days |
| $alertCountsBySeverity.currentCriticalCount | Critical alert count in the last 30 days |
| $alertCountsBySeverity.currentWarningCount | Warning alert count in the last 30 days |
| $alertCountsBySeverity.currentInformationalCount | Informational alert count in the last 30 days |
| $alertCountsBySeverity.previousEmergencyCount | Previous 30 day (60 days ago) emergency alert count |
| $alertCountsBySeverity.previousCriticalCount | Previous 30 day (60 days ago) critical alert count |
| $alertCountsBySeverity.previousWarningCount | Previous 30 day (60 days ago) warning alert count |
| $alertCountsBySeverity.previousInformationalCount | Previous 30 day (60 days ago) informational alert count |
| $alertCountsBySeverity.emergencyCountPercentChange | Emergency alert volume deviation (%) - Percentage difference between the current and baseline count for emergency alerts |
| $alertCountsBySeverity.criticalCountPercentChange | Critical alert volume deviation (%) - Percentage difference between the current and baseline count for critical alerts
|
| $alertCountsBySeverity.warningCountPercentChange | Warning alert volume deviation (%) - Percentage difference between the current and baseline count for warning alerts
|
| $alertCountsBySeverity.informationalCountPercentChange | Informational alert volume deviation (%) - Percentage difference between the current and baseline count for informational alerts
|
| $alertCountsBySeverity.baselineAvgEmergency | Baseline emergency alert count |
| $alertCountsBySeverity.baselineAvgCritical | Baseline critical alert count |
| $alertCountsBySeverity.baselineAvgWarning | Baseline warning alert count |
| $alertCountsBySeverity.baselineAvgInformational | Baseline informational alert count |
| $noiseRatio | Ratio of noisy alerts to total alerts in the last 30 days |
| $noiseRatioBaseline | Baseline noise ratio |
| $openAlerts.openEmergencyCount | Open emergency alert count in the last 30 days
|
| $openAlerts.openCriticalCount | Open critical alert count in the last 30 days
|
| $openAlerts.openWarningCount | Open warning alert count in the last 30 days
|
| $openAlerts.openInformationalCount | Open informational alert count in the last 30 days |
| $openAlerts.totalOpenCount | Total open alerts count in the last 30 days |
| $openAlerts.baselineAvgOpenEmergency | Baseline open emergency alert count |
| $openAlerts.baselineAvgOpenCritical | Baseline open critical alert count |
| $openAlerts.baselineAvgOpenWarning | Baseline open warning alert count |
| $openAlerts.baselineAvgOpenInformational | Baseline open informational alert count
|
| $openAlerts.openEmergencyCountPercentChange | Open emergency alert volume deviation (%) - Percentage difference between the current and baseline count for open emergency alerts |
| $openAlerts.openCriticalCountPercentChange | Open critical alert volume deviation (%) - Percentage difference between the current and baseline count for open critical alerts |
| $openAlerts.openWarningCountPercentChange | Open warning alert volume deviation (%) - Percentage difference between the current and baseline count for open warning alerts |
| $openAlerts.openInformationalCountPercentChange | Open informational alert volume deviation (%) - Percentage difference between the current and baseline count for open informational alerts |
| $openAlerts.openCountPercentChange | Open alert volume deviation (%) - Percentage difference between the current and baseline count for open alerts |
| $openAlerts.baselineAvgOpenTotal | Baseline total open alert count |
| $reportDate | Alert insights report date |
| $resolutionTimesBySeverity.emergencyMedianResolutionMinutes | Median time, in minutes, to resolve emergency alerts in the last 30 days |
| $resolutionTimesBySeverity.criticalMedianResolutionMinutes | Median time, in minutes to resolve critical alerts in the last 30 days |
| $resolutionTimesBySeverity.warningMedianResolutionMinutes | Median time, in minutes, to resolve warning alerts in the last 30 days |
| $resolutionTimesBySeverity.informationalMedianResolutionMinutes | Median time, in minutes, to resolve informational alerts in the last 30 days |
| $resolutionTimesBySeverity.baselineAvgEmergencyMedianMinutes | Baseline emergency median resolution time (minutes) |
| $resolutionTimesBySeverity.baselineAvgCriticalMedianMinutes | Baseline critical median resolution time (minutes) |
| $resolutionTimesBySeverity.baselineAvgWarningMedianMinutes | Baseline warning median resolution time (minutes) |
| $resolutionTimesBySeverity.baselineAvgInformationalMedianMinutes | Baseline informational median resolution time (minutes) |
| $resolutionTimesBySeverity.emergencyResolutionTimeDeviationPercent | Emergency median resolution time deviation (%) - Percentage difference between the current and baseline median resolution time for emergency alerts |
| $resolutionTimesBySeverity.criticalResolutionTimeDeviationPercen | Critical median resolution time deviation (%) - Percentage difference between the current and baseline median resolution time for critical alerts |
| $resolutionTimesBySeverity.warningResolutionTimeDeviationPercent | Warning median resolution time deviation (%) - Percentage difference between the current and baseline median resolution time for warning alerts |
| $resolutionTimesBySeverity.informationalResolutionTimeDeviationPercent | Informational median resolution time deviation (%) - Percentage difference between the current and baseline median resolution time for informational alerts |
Interfaces
Variable Values | Description |
|---|---|
| Admin status for the interface |
| Operational status for the interface |
| The name of the interface |
| Description of the interface |
| Rx interface packet discard count |
| Tx interface packet discard count |
| Rx interface packet error count |
| Tx interface packet error count |
| Interface utilization |
| Total broadcast packet percentage |
| Total Packet Count |
| MAC address of the interface |
| The duplex mode of the interface |
| The negotiated speed of the interface |
| The interface type |
| IP address of the interface |
Windows Services
Variable Values | Description |
|---|---|
| The name of the Windows service. |
| The display name of the Windows service. |
| This is the start type for the Windows service. |
| This indicates whether the Windows service has started. |
| This indicates the current state of the Windows service. |
VMware
Variable Values | Description |
|---|---|
| The maximum memory used of a virtual machine. |
| The minimum memory used of a virtual machine. |
| The memory usage at startup of a virtual machine. |
| The memory allocated for the virtual machine. |
| The virtual machine connection status. |
| The number of snapshots for the virtual machine. |
| The timestamp the last snapshot was taken at. |
| Age of the Last Snapshot (in Days). |
| The power status of the virtual machine: online, offline. |
| The size of the latest snapshot (in Gigabytes). |
| The size of the snapshot previously taken (in Gigabytes). |
| The virtual CPU usage. |
| The virtual Disk usage. |
| The virtual Disk capacity. |
Components
Variable Values | Description |
|---|---|
| Component ID |
| Component status |
VPN Tunnels
Variable Values | Description |
|---|---|
| Local gateway IP of the VPN tunnel |
| Remote gatewway IP of the VPN tunnel |
| Name of the VPN tunnel |
| Status of the VPN tunnel |