Documentation forLog Analyzer
Analyzing logs is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Essentials edition. Log Analyzer (LA) is also available in a standalone module.

Run external program variables in LA

The Run an external program rule actions allow you to set command line arguments for your executed program or script. As a parameter, you can use variables which will translate to a corresponding string before the program/script is executed.

List of available variables

General variable definition Description

${IpAddress} 

The IP address of the source device 

${DateTime}

The current date and time - String format MM/dd/yyyy hh:mm

${Date}

The current date - String format MM/dd/yyyy

${LongDate}

The current date - Example: "Tuesday, August 25, 2020"

${LongTime}

The current time - Example: 12:23:19 PM

${DayOfWeek}

The current day of the week - Example: "Tuesday"

${Year}

The current year

${Hour}

The current hour

${Minute}

The current minute

${Second}

The current second

${NodeID}

The node ID of the source device

${Message}

The message attached to this entry

${Hostname}

The node caption of the source device

${Level}

The severity level of the message

${SourceType}

The message source type (Syslog, Traps, WindowsEvents,VMwareEvents, FlatFiles)

${Vendor}

The vendor of the source device

${MachineType}

The machine type of the source device
Trap variable definition Description

${TrapType}

The message trap type

${TrapOid}

The corresponding trap oid to trap type

${Community}

The SNMP trap community string for message entry

${VarBindingNames}

Dot notation (see chapter below)

${VarBindingValues}

Dot notation (see chapter below)
Syslog variable definition Description

${FacilityName}

The Syslog facility name of this entry
Window event variable definition Description

${LogName}

The name of the Windows log

${ProviderName}

The source of the software that logs the event

${User}

The Windows username for the corresponding message. Can be "N/A"

${EventData}

Dot notation (see chapter below)
Log files variable definition Description

${Filename}

The name of the file to which the message belongs

Accessing fields using Dot notation

Dot notation is available for following fields:

  • EventData (Windows Events)

  • VarBindingNames (Traps) - Returns human readable (oid converted to its string represantation, values converted to times, ...) varbinding values

  • VarBindingValues (Traps) - Returns raw varbinding values

Variables from these mentioned fields can be accessed using RootField.name of the variable.

Examples:

Variable Example output

${EventData.SubjectDomainName}

WORKGROUP

${EventData.ProcessName}

C:\Windows\System32\services.exe

${VarBindingNames.sysUpTime}

42 days 0 hours 34 minutes 15,25 seconds

${VarBindingValues.1.3.6.1.2.1.1.3.0}

363085525

${VarBindingNames.snmpTrapEnterprise}

SNMPv2-SMI:enterprises.2854

${VarBindingValues.1.3.6.1.2.1.1.3.0}

1.3.6.1.4.1.2854