Documentation forHybrid Cloud Observability Essentialsand Log Analyzer

Run external program variables in LA

The Run an external program rule actions allow you to set command line arguments for your executed program or script. As a parameter, you can use variables which will translate to a corresponding string before the program/script is executed.

List of available variables

General variable definition Description

${IpAddress} 

The IP address of the source device 

${DateTime}

The current date and time - String format MM/dd/yyyy hh:mm

${Date}

The current date - String format MM/dd/yyyy

${LongDate}

The current date - Example: "Tuesday, August 25, 2020"

${LongTime}

The current time - Example: 12:23:19 PM

${DayOfWeek}

The current day of the week - Example: "Tuesday"

${Year}

The current year

${Hour}

The current hour

${Minute}

The current minute

${Second}

The current second

${NodeID}

The node ID of the source device

${Message}

The message attached to this entry

${Hostname}

The node caption of the source device

${Level}

The severity level of the message

${SourceType}

The message source type (Syslog, Traps, WindowsEvents,VMwareEvents, FlatFiles)

${Vendor}

The vendor of the source device

${MachineType}

The machine type of the source device

Trap variable definition Description

${TrapType}

The message trap type

${TrapOid}

The corresponding trap oid to trap type

${Community}

The SNMP trap community string for message entry

${VarBindingNames}

Dot notation (see chapter below)

${VarBindingValues}

Dot notation (see chapter below)

Syslog variable definition Description

${FacilityName}

The Syslog facility name of this entry

Window event variable definition Description

${LogName}

The name of the Windows log

${ProviderName}

The source of the software that logs the event

${User}

The Windows username for the corresponding message. Can be "N/A"

${EventData}

Dot notation (see chapter below)

Log files variable definition Description

${Filename}

The name of the file to which the message belongs

Accessing fields using Dot notation

Dot notation is available for following fields:

  • EventData (Windows Events)

  • VarBindingNames (Traps) - Returns human readable (oid converted to its string represantation, values converted to times, ...) varbinding values

  • VarBindingValues (Traps) - Returns raw varbinding values

Variables from these mentioned fields can be accessed using RootField.name of the variable.

Examples:

Variable Example output

${EventData.SubjectDomainName}

WORKGROUP

${EventData.ProcessName}

C:\Windows\System32\services.exe

${VarBindingNames.sysUpTime}

42 days 0 hours 34 minutes 15,25 seconds

${VarBindingValues.1.3.6.1.2.1.1.3.0}

363085525

${VarBindingNames.snmpTrapEnterprise}

SNMPv2-SMI:enterprises.2854

${VarBindingValues.1.3.6.1.2.1.1.3.0}

1.3.6.1.4.1.2854