Notification Content Variables

Within the body of your email, page, and command notifications, you can specify information about the current event, in the form:


Object names may be evt, evtSummary, or urls; or for clearing event context, clearEvt and clearEventSummary. For each object name, the following lists show valid attributes (for example, '${evt/DevicePriority}'):

evt/ and clearEvt/
Value Description
DevicePriority value of the priority of the device
agent Typically the name of the daemon that generated the event. For example, an SNMP threshold event has zenperfsnmp as its agent.
clearid id of the event this clear event will clear
component component this event is related to
count how many times this event occurred
created when the event was created
dedupid dynamically generated fingerprint that allows the system to perform de-duplication on repeating events that share similar characteristics
device device this event is related to
eventClass class of this event
eventClassKey Free-form text field that is used as the first step in mapping an unknown event into an event class.
eventGroup Free-form text field that can be used to group similar types of events. This is primarily an extension point for customization. Currently not used in a standard system.
eventKey Free-form text field that allows another specificity key to be used to drive the de-duplication and auto-clearing correlation process.
eventState state of the event
evid unique id for the event
facility the syslog facility
firstTime UTC Time. First time that the event occurred.
ipAddress IP address
lastTime UTC time. Most recent time that the event occurred.
manager value of manager
message a message communicated by the event
ntevid windows event id
ownerid ownerid
priority syslog priority
prodState production state of the device
severity the severity of the event expressed as a number (0, 1, 2, 3, 4, or 5)
severityString the severity of the event expressed as a string (Clear, Debug, Info, Warning, Error, or Critical)
stateChange last time that the event status changed
status the status of the event
summary a short message summarizing the event
eventSummary/ and clearEventSummary/
Value Description
uuid evt.evid
occurrence evt.count
status evt.eventState
first_seen_time evt.firstTime
status_change_time evt.stateChange
last_seen_time evt.lastTime
count evt.count
current_user_uuid UUID of the user who acknowledged this event
current_user_name name of the user who acknowledged this event.
cleared_by_event_uuid the UUID of the event that cleared this event (for events with status == CLEARED).
notes event notes
audit_log event audit log
update_time last time a modification was made to the event
created_time evt.lastTime
fingerprint evt.dedupid
event_class evt.eventClass
event_class_key evt.eventClassKey
event_class_mapping_uuid If this event was matched by one of the configured event class mappings, it contains the UUID of that mapping rule.
actor event actor
summary evt.summary
message evt.message
severity evt.severity
event_key evt.eventKey
event_group evt.eventGroup
agent evt.agent
syslog_priority evt.priority
syslog_facility evt.facility
nt_event_code evt.ntevid
monitor evt.monitor
tags event tags
Value Description
ackUrl URL for acknowledging the event
closeUrl URL for closing the event
reopenUrl URL for reopening the event
eventUrl URL for viewing the event
eventsUrl URL for viewing events for the relevant device, or all events

ZenPacks also can define additional notification actions, and can extend the context available to notifications to add additional objects or attributes.