Run Book Variables

Download this manual as a PDF file

This appendix defines the different variables you can use when creating an action policy.

Use the following menu options to navigate the SL1 user interface:

  • To view a pop-out list of menu options, click the menu icon ().
  • To view a page containing all of the menu options, click the Advanced menu icon ().

This appendix covers the following topics:

Run Book Variables

You can include variables when creating an action policy. These variables are listed in the table below.

  • In an action policy of type Send an Email Notification, you can include one or more of these variables in the fields Email Subject and Email Body.
  • In an action policy of type Send an SNMP Trap, you can include one or more of these variables in the Trap OID field, Varbind OID field, and the Varbind Value field.
  • In an action policy of type Create a New Ticket, you can include one or more of these variables in the Description field or the Note field of the related Ticket Template.
  • In an action policy of type Send an SNMP Set, you can include one or more of these variables in the SNMP OID field and the SNMP Value field.
  • In an action policy of type Run A Snippet, you can access variables from the global dictionary EM7_VALUES.
  • In a policy of type Execute an SQL Query, you can include one or more of these variables in the SQL Query field.

Variable

Source

Description

%A Account Username
%N Action Automation action name
%g Asset Asset serial
%h Asset Device ID associated with the asset
%i (lowercase "eye") Asset Asset Location
%k Asset Asset Room
%K Asset

Asset Floor

%P Asset Asset plate
%p Asset Asset panel
%q Asset Asset zone
%Q Asset Asset punch
%U Asset Asset rack
%u Asset Asset shelf
%v Asset Asset tag
%w Asset Asset model
%W Asset Asset make
%m Automation Automation policy note
%n Automation Automation policy name
%F Dynamic Alert Alert ID for a Dynamic Application Alert
%I (uppercase "eye") Dynamic Alert For events with a source of "dynamic", this variable contains the index value from SNMP. For events with a source of "syslog" or "trap", this variable contains the value that matches the Identifier Pattern field in the event definition.
%T Dynamic Alert Value returned by the Threshold function in a Dynamic Application Alert.
%V Dynamic Alert Value returned by the Result function in a Dynamic Application Alert.
%L Dynamic Alert Value returned by the label variable in a Dynamic Application Alert.
%a Entity IP address
%_category_id Entity Device category ID associated with the entity in the event.
%_category_name Entity Device category name associated with the entity in the event.
%_class_id Entity Device class ID associated with the entity in the event.
%_class_name Entity Device class description associated with the entity in the event.

%_parent_id

Entity

For component devices, the device ID of the parent device.

%_parent_name

Entity

For component devices, the name of the parent device.

%_root_id

Entity

For component devices, the device ID of the root device.

%_root_name

Entity

For component devices, the name of the root device.

%1 (one) Event

Entity type. Possible values are:

  • 0. Organization
  • 1. Device
  • 2. Asset
  • 4. IP Network
  • 5. Interface
  • 6. Vendor
  • 7. Account
  • 8. Virtual Interface
  • 9. Device Group
  • 10. IT Service
  • 11. Ticket
%2 Event

Sub-entity type.

Possible values for organizations are:

  • 9. News feed

Possible values for devices are:

  • 1. CPU
  • 2. Disk
  • 3. File System
  • 4. Memory
  • 5. Swap
  • 6. Component
  • 7. Interface
  • 9. Process
  • 10. Port
  • 11. Service
  • 12. Content
  • 13. Email
%4 Event Text string of the user name that cleared the event.
%5 Event Date/time when event was deleted.
%6 Event Date/time when event became active.
%7 Event

Event severity (1-5), for compatibility with previous versions of SL1. 1=critical, 2=major, 3=minor, 4=notify, 5=healthy.

NOTE: When referring to an event, %7 represents severity (for previous versions of SL1). When referring to a ticket, %7 represents the subject line of an email used to create a ticket.

%c Event Event counter
%d Event Date/time when last event occurred.
%D Event Date/time of first event occurrence.
%e Event Event ID
%H Event URL link to event
%M Event Event message
%s Event severity (0 - 4). 0=healthy, 1=notify, 2=minor, 3=major, 4=critical.
%S Event Severity (HEALTHY - CRITICAL)
%_user_note Event Current note about the event that is displayed on the Events page.
%x Event Entity ID
%X Event Entity name
%y Event Sub-entity ID
%Y Event Sub-entity name
%Z Event Event source (Syslog - Group)
%z Event Event source (1 - 8)
%_ext_ticket_ref Event For events associated with an external Ticket ID, this variable contains the external Ticket ID.
%3 Event Policy Event policy ID
%E Event Policy External ID from event policy
%f Event Policy Specifies whether event is stateful, that is, has an associated event that will clear the current event. 1 (one)=stateful; 0 (zero)=not stateful.
%G Event Policy External Category
%R Event Policy Event policy cause/action text
%_event_policy_name Event Policy Name of the event policy that triggered the event.
%B Organization Organization billing ID
%b Organization Impacted organization
%C Organization Organization CRM ID
%o (lowercase "oh") Organization Organization ID
%O (uppercase "oh") Organization Organization name
%r System Unique ID / name for the current SL1 system
%7 Ticket

Subject of email used to create a ticket. If you specify this variable in a ticket template, SL1 will use the subject line of the email in the ticket description or note text when SL1 creates the ticket.

NOTE: When referring to a ticket, %7 represents the subject line of an Email used to create a ticket. When referring to an event, %7 represents severity (for previous versions of SL1).

%t Ticket Ticket ID
%J Ticket Description field from the SL1 ticket.