Exec

Wed May 27 04:16:48 EDT 2009

This handler executes a command on the server. The command may contain substitution variables. If your command is a shell script, then you need to explicitly execute the shell, and then pass your script to that shell. For example: /bin/sh -c "echo %SUMMARY% > /tmp/%ELEMENT%.txt" This is because your script is not really an executable program; it is just interpreted as such by a shell.

Your command can reference any variables parsed by your rule tree. Just surround variable names with percent characters. They will be substituted for their values at run-time.

You can also access alert fields as predefined variables, but only for the handler types that have an alert in their context. The following handler types do not have an alert in their context: messageParsed, preProcessMessage, postProcessMessage However, these types can still reference any of your parsed variables.

You can use the following pre-defined variables in your command. Note that any time-related variables return the number of milliseconds since 1970 (universal time).

%GATEWAY%
%ELEMENT%
%SUMMARY%
%PRIORITY%
%COUNT%
%TIME_NOW% (The current time)
%TIME_INIT% (The time of the first event)
%TIME_VALID% (The time of validation)
%RULE_NODE% (The path name of the alert's rule node)
%ONUS% (The name of the onus user, if any)

To simplify your command format, it may be easier to reference some data from the environment of your command. The following environmental variables are available to your executed command:

ALERT_GATEWAY
ALERT_ELEMENT
ALERT_SUMMARY
ALERT_PRIORITY
ALERT_COUNT
ALERT_TIME_NOW
ALERT_TIME_INIT
ALERT_TIME_VALID
ALERT_RULE_NODE
ALERT_ONUS