Difference between revisions of "Pandora: Documentation en: Events"

From Pandora FMS Wiki
Jump to: navigation, search
(Generating Events from the Command Line by the 'pandora_revent' Command)
(Generating Events from the Command Line by the 'pandora_revent' Command)
Line 665: Line 665:
 
/pandora_revent.pl -p http://192.168.50.12/pandora_console/include/api.php -u pandora12,admin,pandora  
 
/pandora_revent.pl -p http://192.168.50.12/pandora_console/include/api.php -u pandora12,admin,pandora  
 
-create_event -name "Another nice event" -group 0 -type "system" -status 0 -severity 4
 
-create_event -name "Another nice event" -group 0 -type "system" -status 0 -severity 4
-user "davidv" -owner "admin" -source "Commandline" -comment "Prueba de comentario"
+
-user "davidv" -owner_user "admin" -source "Commandline" -comment "Prueba de comentario"
 
</pre>
 
</pre>
  

Revision as of 10:18, 2 October 2015

Go back to Pandora FMS documentation index

1 Events

1.1 Introduction

Pandora FMS utilizes an Event System to inform you about any relevant incidences regarding the monitored systems. Pandora FMS possesses an Event Visualizer in which everything is shown, e.g. if a monitor is down, if an alert has been fired, or if Pandora FMS itself has a specific problem.

This system allows and encourages teamwork, because events can be validated and deleted by numerous different users. In case of validating an incident, the user responsible for the validation is going to be shown.

All events are managed by clicking on 'Operation' and 'View Events'. Within this menu, the window shown below is going to appear:



Menu eventos.png



This is an example of the Event Visualizer:



Event list.png



The event itself is shown within the Event Visualizer. It's a descriptive text of the problem, the origin (agent) which generated it and the event's date. Sometimes there is some other data associated (e.g. the agent's module which generated the event, the group, the tags associated to the module, etc.). If we e.g. click on the eye-shaped icon, we're able to view all the event's details:



Detalle evento.png



By default, the events are shown by a specific and adaptable search window which is going to show the filtered information, e.g. a specific agent, looking for a word, etc. To do so, we're going to select the filter window by clicking on the filter section as shown below.



Filtro evento.png



As we can see here (although it's able to be modified within the setup options), Pandora FMS is going to show events which bear a maximum age of eight hours or less by default. It shows grouped events to you, but only those which weren't validated yet. A user which is e.g. allowed to access only one group, is only going to see the events related to this group.

There's also the possibility of saving a specific search and you're able to apply filters you've created before.

The Events are forming the core of a Monitoring System.

The operators which are going to see this screen are able to learn any information about the monitored system's current state (active events) and all its history (seeing all the validated events), without being forced to look at every single agent. They're also capable of browsing through global figures, data trees, names and visual screens.

The operators should see a "clean" event console which is only going to show the active problems by default. In this way, you won't have to create alerts. Just by looking on the screen, you're going to see everything that's going on at all times.

1.2 The Custom Events View

Since the release of Pandora FMS 5.0, you're able to customize the Event View. To custom the event view, please click on 'Administration' -> 'Manage Events' and 'Custom Events'.

The default fields you're going to encounter there are mentioned below.

  • Event name
  • Agent name
  • Status
  • Timestamp

The only thing you're required to do is to select the fields you want to have displayed within the 'Fields available' list and to move them by means of the arrows. If you've completed this task, please click on the 'Update' button.

If you click on the 'Default' button, you're able to see default event fields:



Custom events.png



1.3 Creating Event Filters

In order to create Event Filters, please click on 'Administration' and 'Manage Events'. You may create, remove and edit your filters within this window.



Filtros evento.png



If you click on the 'Create Filter' button, you're able to fill out the event fields as shown below.



Crear filtro evento.png Crear filtro evento2.png



1.4 Viewing Events

To be able to view any current event, please click on 'Operation' and 'View Events'. In the moment of viewing the events, please keep in mind that these Events hold a filter which is preconfigured in a way to show all unresolved incidents and those from the last 8 hours.

It's going to show you a list on which all the system's past events are shown.



Event list.png



The list of events holds conditioned information within the following columns:

Status: The event's status. The available states are the following: 'new', 'in process', 'validated' and 'not validated'.

Event Name: The field in which the event's name is going to be shown. Clicking on its name results in a filter which is going to show all events bearing the same name.

Agent Name: The field that shows the event-starting agent. Clicking on this field is going to lead you to the agent's main tab.

Timestamp: It shows the amount of time which went by since the event was received.


Actions:
Tic .png allows to validate an event.

Cross.png deletes the event.

Eye.png shows the event's details.


Box for selecting the Event

It allows to select the event for executing the deletion or multiple validation of the events.

1.5 Filtering Events

It's possible to filter within the event list in order to look for specific events contained on the 'Event View' page.

To filter events, please click on 'Operation' -> 'View Events' and 'Event Control Filter'.



Evento lista.png



It displays the default filter the moment you're opening the event list.



Filter+event.png



Advanced Options:



Events filter advanced.png



This is an explanation for the filters and their modes you're encountering there:

  • Group: The combo in which you're able to pick the agent's group which created the event.
  • Event Type: The combo in which you're able to pick the event's type. There are the following types:
    • Alert ceased
    • Alert fired
    • Manual alert validation
    • Alert recovered
    • Error
    • Monitor down
    • Monitor up
    • Recon host detected
    • System
    • Unknown
  • Severity: The combo in which you're able to pick the event's severity. The following options are available:
    • Critical
    • Informational
    • Maintenance
    • Normal
    • Warning
  • Event Status: The combo in which you're able to pick the event's state. There are the following options:
    • All events
    • Only pending
    • Only validated
  • Free search: The field which provides a free-text search.
  • Agent Search: The combo in which you're able to pick the agent's event origin.
  • Max hour old: The field in which the max. age is determined.
  • User Ack: The combo in which you're able to pick the users which have validated an event.
  • Repeated: The combo in which you're able to decide whether to show repeatedly occurring events or all events.
  • Events with following tags: The combo in which you're able to pick events which have tags assigned.
  • Events without following tags: The combo in which you're able to choose events which don't have an assigned tag.

There is an option named 'Block size for pagination' within the search fields in the 'Event Control' filter's menu in which you're able to determine the number of events displayed on each page when paginating.

You may save the filter or load another one by clicking on the 'Load Filter' icon.

1.6 Custom Columns within the Event List

You may define the list of columns which appear on the Event View if you're a Pandora FMS Administrator.

You can find the form by clicking on 'Events' -> 'Admin' where the custom columns tab is located. The form consists of two lists: The left list holds all available columns. You may add or remove columns by using the arrows.

Events custom columns.png

1.6.1 The Metaconsole

Within the metaconsole, you may save a distinct number of custom columns within each group.

Events custom columns metaconsole.png

1.7 Creating an Incident from an Event

In order to create an incident from an event, please click on 'Operation' and 'View Events'. Please click on the eye-shaped icon to obtain more information about the topic.



Event incident.png



By clicking on the eye-shaped button, a window will be opened. Please click on the 'Responses' tab as shown below.



Create incident.png



By selecting 'Custom Responses', you have several options at your disposal. You may create more options or modify existing ones by clicking on 'Administration' -> 'Manage Events' -> 'Events Filter' and 'Icon Event Responses'.



Event responses list.png



Creating Event Responses:



Create event responses.png



1.8 Validation / Status of one Event and Self Validation

An event is able to assume three different states: 'validated', 'not validated' and 'assigned' and is also able to hold three different criticities: 'normal', 'critical' and 'warning'. These are related to the monitor's different states within Pandora FMS which are mainly responsible for generating events.

As soon as an event is received by the system, it assumes the 'not validated' status by default. It's possible that it's been generated by a monitor, e.g. 'Disk space' in the moment of moving from 'normal' to the 'critical' status.

If the same agent's monitor moves back to 'normal' status without doing anything, we're automatically going to receive an information event about this within which we're going to have two events: One informing the disk was in 'critical' status and another one afterwards, informing us about the disk returning to 'normal' status.

If something like that happens, the system automatically validates the event the moment it receives information of this problem being solved. We call this 'Event Self Validation'. This only happens if the newly arrived event is one of the 'normal' type. However, it finds an event of the 'warning' or 'critical' type without validation.

Furthermore, an event which contains 'Extra IDs' is going to validate any previous event along with the same Extra ID. You may configure the 'Extra ID' whenever you're configuring an Event Action within Pandora FMS.



Configure extra id.png



1.9 Event Assignment

If we encounter an event, we also have the opportunity to validate it. Validation will cause the system to memorize the date and the user who's validated the event. It's also possible to write a comment, e.g. "We've revised the event and emptied some part of the hard drive on the server."



Event sample4.png



If you click on the 'Validate' button, the screen is going to be refreshed and the validated event 'disappears', because the Event View is only going to show the unvalidated or assigned events but not the validated ones by default.



Event sample5.png



If you refresh the event view again (thereby filtering and showing all events), you're going to see your validated event furnished with a green check icon on the left along with information of who has validated it at which time. It also may contain a descriptive text the validating person might have entered in this moment.

If you're validating an event, you also have the possibility to define it as 'in process' on the 'Responses' tab instead of validating:



Event sample6.png



You're also able to have an event 'stopped' or locked in a way that it doesn't self validate, but you still would be able to see it within the Event View as a pending event. It's going to 'group' the rest of events of the same type, but it won't self validate (see 'event grouping' for more information). The event is going to look similar to the one shown below.



Event sample7.png



1.10 Event Grouping

Under certain circumstances, some systems may generate a big amount of events. Pandora FMS lets you group these events to work in conjunction with them in a much more convenient way. The exact way in which event grouping works is going to be explained below.



Event grouping.png



  • Equal events from the same agent are shown as a single event.
  • This event's status will be 'in process' if any of the grouped events assumed the 'in process' status, 'normal' if any of the grouped events assumed the 'normal' state or 'validated' if all of the grouped events assumed the 'validated' status.
  • Events which assumed the 'in process' status are always shown - even if they're out of the filter's predefined time range.

If you're working with grouped events, the status changes work in the following way:

  • If you're 'validating' a grouped event, all of them are going to assume the 'validated' state (including those which are out of the filter's predefined time range).
  • If you're setting grouped events to the 'in process' status, only the most recent event is going to be set to the 'in process' status (in representation of the rest).

1.11 Deleting an Event

Another way of managing events is deleting those which aren't interesting any more. Please use the 'deleting events' option to do so. If you click on 'Operation' and 'View Events', there are two ways to delete an event from the event list:

Please click on the gray trash icon within the 'Action' column.



Gest62.png



Please select the events you intend to delete by clicking on the last column and click on the 'Delete selected' button.



Gest63.png



1.12 Other Ways of viewing Events

Beside the event's classic view which you may call up by clicking on 'Operation' and 'View Events', you're also able to pick public news channels such as 'Sliding Marquee' (a moving list on the top of the browser on a black screen).

1.12.1 RSS Events

Pandora FMS also has an RSS Event Provider in order for you to subscribe to it from your favorite news reader. To see the events within a news channel or RSS, please click on 'Operation' -> 'View Events' and 'RSS' and subscribe to it from the news reader.



Gest64.png



Template warning.png

To provide access to event RSS feed, you're required to configure which IPs are allowed to access it. To do so, please click on the field named 'IP list with API access' within 'Setup'.

 


1.12.2 Events in the Marquee

It shows the last events in a sliding text-line format. This option is intended to visualize the last events within a monitor like a text screen. You're able to easily customize the number of visualized events or the size, color and filter of the messages by modifying the code within the file named 'operation/events/events_marquee.php'.



Gest65.png



1.12.3 Sound Alerts

From version 3.2 and above, Pandora FMS is going to have a new way of communicating events to you. This new way is audible from the console. It's a lot easier to manage a system without having to always check Pandora's console. You will be able to hear the different tunes if an event occurs even if you are far from the computer (assumed you've attached some powerful loudspeakers). The tune is going to be played until the sound event pauses or if you press the 'OK' button.

The list of sound events which are going to generate the playing of a sound are:

  • An alert firing
  • A module changes to a 'warning' state.
  • A module changes to a 'critical' state.

It's also possible to filter the events by their groups.

1.12.3.1 Configuration

There are three types of events the alert sound is going to be attached to. You may configure any appropriate sound from Pandora's Console setup for each type of event.



Event sound.setup.screenshot.png



You're also able to hear the tune even from the setup page. Feel free to test it (if the browser is compatible to multimedia contents) by clicking on the 'Play' button which you're going to find on the right side of any event type.

1.12.3.2 Advanced Configuration

It's also possible to extend the list of sounds for all sound events. Please go to the Pandora Console Server and into the directory named '/var/www/pandora_console/'. You may paste your new sounds into the directory named 'include/sounds/' - but if you do, you're also required to consider several things achieving the right performance:

  • The file has to be in a 'WAV' format.
  • It's recommended to take the smallest possible file, because this file must be sent to the browser in order to be played within your browser's window.

There are several possibilities to achieve this:

    • Please select a sound file with only a few second's length for the main alert sound, because it's going to be played ad infinitum.
    • Please convert the sound to 'mono'.
    • Please change the sound's coding to '16bits signed' or less. We're going to lose quality but we're diminishing the file's size by doing this.
  • In order to create or edit sounds, we recommend to use tools as Audacity which is a multi platform open-source tool which is also very easy to use.

1.12.3.3 Use

The event sounds are asynchronously 'scanned' every 10 seconds. If an event is received, the preconfigured or default sound for this event is going to be replayed and the window is going to start flickering in red. This window is also going to be placed in foreground of all other opened windows, depending on its browser's and operating system's configuration.

To gain access to the sound events window, you're just required to go to the Pandora Console's left menu and to click on 'Operation' and 'View Events' there. Within the header's event window, please click on 'Sound Events'. It's going to show you a new window, which is a lot smaller than the others.



Event sound.png



This small window is going to be the one which manages all the sound events. It's recommended to leave it open in case any event is received. We have 3 different controls within the window:

  • Group: The group where we want to check the alerts. Please keep in mind that your user should have permissions for this group.
  • Type: The type of event to watch. You're able to check the events named 'fired alert', 'module changes to a critical state' and 'module changes to a warning state'. Within them, you may enable or disable either one or several by means of the check boxes.
  • Play Button: If the green arrow is shown, this button doesn't scan events (it's on pause). If you click on it, the event's surveillance gets enabled and the button changes to an orange one, holding a pause symbol. A normal use of this one is e.g. if you have to leave your working place and it's inconvenient for the events to be replayed while you aren't present.
  • OK Button: This red button bearing the word 'OK' is used to stop a replayed sound because an alarm has been fired. Please keep in mind that it doesn't enable neither alerts nor events or the event's surveillance. It's recommended to use the Pandora Console to do so. It's only intended for the sound, and it'll continue watching.



250px



1.12.4 Exporting Events to a CSV

It's possible to export the event list to a CSV file in order for the events to be processed by or incorporated into other applications.

In order to export the events to a CSV file, please click on 'Operation' -> 'View Events' and 'CSV File'.

1.12.5 Event Statistics

It's possible to gain access to the event's statistics by clicking on 'Operation' -> 'View Events' and 'Statistics'.



Gest66.png



1.12.6 Events rain

This view shows the 5 last events in a geeky way. The canvas size is recalculated every time the page is reloaded. You can double click the canvas to enter the fullscreen mode or click it to exit.



Matrix-events.png



1.13 Event Alerts and Event Correlation

From Pandora FMS versions 4.0 and above, it's possible to define alerts on events, that allows you to work by a completely new and much more flexible approach. This is an Enterprise feature.

In order to create new event alerts, please click on 'Administration' -> 'Event Alerts' and 'Create'.



Menu event alert.jpg



An event alert is composed of a number of different rules along with logical operators between them, e.g. 'AND', 'OR', 'XOR', 'NAND', 'NOR' and 'NXOR'.



Event alerts.png



In order to render the work with them a little easier, the event alert's configuration parameters are identical to the module alerts. A detailed explanation for all of them can be found here. There are only two specific parameters for event alerts:

  • Rule Evaluation Mode: There are two options: 'Pass' and 'Drop'. 'Pass' means that if an event is fulfilled by an alert, the alerts below are going to be evaluated. 'Drop' means that if an event is fulfilled by an alert, the alerts below are going to be stopped from being evaluated.
  • Group by: It allows you to group the rules by agent, module, alert or group. If a rule is e.g. configured for it, it's going to fire if we receive two critical events. If it's grouped by agent, two critical events are required to originate from the same agent. This feature is capable of getting switched off.

Each rule is configured to fire by a specific type of event. The alert will be fired if the condition of the logical equation, which is defined by the rules and its operators, is met.



Event rules.png



The rule's configuration parameters are the following:

  • Name: The name of the rule.
  • User comment: A free-text field intended for a comment.
  • Event: The regular expression that matches the event's text.
  • Window: The events which have been generated outside the defined time range are going to be rejected.
  • Count: The number of events which have to match the rule to fire the alert.
  • Agent: The regular expression which matches the agent's name which has generated the event.
  • Module: The regular expression that matches to the module's name which has generated the event.
  • Module Alerts: The regular expression that matches the alert's name which has generated the event.
  • Group: The group the agent belongs to.
  • Severity: The event severity.
  • Tag: The event's associated tags.
  • User: The event's associated user.
  • Event Type: The event's type.

We could e.g. configure a rule which wears a tag named 'System' and matches to the events generated by any module of any agent of the server group that is named 'cpu_load' in the moment the module moves to a 'critical' state:



Event rule config.png



Info.png

Given the high number of events the Pandora FMS Database is able to store, the server works on an event window which is defined in the 'pandora_server.conf' configuration file by a parameter named 'event_window'. The events which have been generated outside the specified time range are not going to be processed by the server. Within a rule, it doesn't make any sense to specify a time range wider than the one configured within the Server.

 


1.14 Generating Events from the Command Line by the 'pandora_revent' Command

(Available to Pandora FMS versions 5 and above)

By using the WEB API, you may interact with Pandora FMS from remote sites, even if you don't have a Database connection, Pandora FMS or an agent installed. You only require a special tool which you can find under:

/usr/share/pandora_server/util/pandora_revent.pl

This tool utilizes a remote HTTP or HTTPS connection to create or validate events under Pandora FMS. Please execute it without parameters to see it's syntax.

Pandora FMS Remote Event Tool Copyright (c) 2013 Artica ST
This program is Free Software, licensed under the terms of GPL License v2
You can download latest versions and documentation at http://www.pandorafms.org

Options to create event: 

	./pandora_revent.pl -p <path_to_consoleAPI> -u <credentials> -create_event <options> 

Where options:

	-u <credentials>			: API credentials separated by comma: <api_pass>,<user>,<pass>
	-name <event_name>			: Free text
	-group <id_group>			: Group ID (use 0 for 'all') 
	-agent					: Agent ID
	
Optional parameters:
	
	[-status <status>]			: 0 New, 1 Validated, 2 In process
	[-user <id_user>]			: User comment (use in combination with -comment option)
	[-type <event_type>]			: unknown, alert_fired, alert_recovered, alert_ceased
							  alert_manual_validation, system, error, new_agent
							  configuration_change, going_unknown, going_down_critical,
							  going_down_warning, going_up_normal
	[-severity <severity>] 		: 0 Maintance,
						  1 Informative,
						  2 Normal,
						  3 Warning,
						  4 Crit,
						  5 Minor,
						  6 Major
	[-am <id_agent_module>]		: ID Agent Module linked to event
	[-alert <id_alert_am>]			: ID Alert Module linked to event
	[-c_instructions <critical_instructions>]
	[-w_instructions <warning_instructions>]
	[-u_instructions <unknown_instructions>]
	[-user_comment <comment>]
	[-owner_user <owner event>]		: Use the login name, not the descriptive
	[-source <source>]			: (By default 'Pandora')
	[-tag <tags>]				: Tag (must exist in the system to be imported)
	[-custom_data <custom_data>]		: Custom data should be a base 64 encoded JSON document (>=6.0)
	[-server_id <server_id>]		: The pandora node server_id (>=6.0)

Example of event generation:

	./pandora_revent.pl -p http://localhost/pandora_console/include/api.php -u 1234,admin,pandora 
		-create_event -name "SampleEvent" -group 2 -agent 189 -status 0 -user "admin" -type "system" 
		-severity 3 -am 0 -alert 9 -c_instructions "Critical instructions" -w_instructions "Warning instructions" 
		-u_instructions "Unknown instructions" -source "Commandline" -tag "Tags"


Options to validate event: 

	./pandora_revent.pl -p <path_to_consoleAPI> -u <credentials> -validate_event <options> -id <id_event>

Sample of event validation: 

	./pandora_revent.pl -p http://localhost/pandora/include/api.php -u pot12,admin,pandora -validate_event -id 234

You're required to enable the API access and configure it first. To do so, please follow the below mentioned steps:

  • Please enable the API access for the IP (please use '*' for all IPs).
  • Please set an API password
  • Please use a regular user and password or define a specific API user for conducting the operation only.

In order to render the 'unknown', 'critical' or 'warning' instruction fields appear within the event details, the event type is required to consist of the types named 'going_unknown', 'going_down_critical' or 'going_down_warning'.

Examples:

/pandora_revent.pl -p http://192.168.50.12/pandora_console/include/api.php -u pandora12,admin,pandora 
-create_event -name "Another nice event" -group 0 -type "system" -status 0 -severity 4
-user "davidv" -owner_user "admin" -source "Commandline" -comment "Prueba de comentario"

1.15 To generate events from Command Line: The 'pandora_revent_create' Command

(Available from Pandora FMS versions 5 and above)

It comes with the same functionality as the 'pandora_revent' script with the exception of being able to validate events.

/usr/share/pandora_server/util/pandora_revent_create.pl

This tool utilizes a remote HTTP or HTTPS connection to create or validate events under Pandora FMS. Please execute it without parameters to learn it's syntax.

Pandora FMS Remote Event Tool Copyright (c) 2013 Artica ST
This program is Free Software, licensed under the terms of GPL License v2
You can download latest versions and documentation at http://www.pandorafms.org

Options to create the event: 

	./pandora_revent_create.pl -p <path_to_consoleAPI> -create event <options> 

Where options:

	-u <credentials>	
	-create_event 
	-name <event_name>        : Free text
	-group <id_group>         : Group ID (use 0 for 'all') 
	-type <event_type>        : unknown, alert_fired, alert_recovered, alert_ceased
	                            alert_manual_validation, system, error, new_agent
	                            configuration_change, going_unknown, going_down_critical,
	                            going_down_warning, going_up_normal
	
Optional parameters:
	
	[-agent <id_agent>]        : Set agent by ID
	[-agent_name <agent>]      : Set agent by name (Exact match!)
	[-user <id_user>]         : User comment (use in combination with -comment option)
	[-status <status>]        : 0 New, 1 Validated, 2 In process
	[-am <id_agent_module>]    : ID Agent Module linked to event
	[-module_name <module>]    : Name of the module linked to the event
	[-alert <id_alert_am>]     : ID Alert Module linked to event 
	[-criticity <criticity>]   : 0 Maintance, 1 Informative, 2 Normal, 
                                     3 Warning, 4 Crit, 5 Minor, 6 Major 
	
	[-comment <user_comment>] : Free text for comment
	[-tag <tags>]             : Tag (must exist in the system to be imported)
	[-source <source>]        : (By default 'Pandora')
	[-extra <id_extra>] 
	[-c_instructions <critical_instructions>] 
	[-w_instructions <warning_instructions>] 
	[-u_instructions <unknown_instructions>] 
	[-owner <owner_user>]     : Use the login name, not the descriptive 

Credential/API syntax: 

	<credentials>: API credentials separated by comma: <api_pass>,<user>,<pass>

Example of event generation:

	./pandora_revent_create.pl -p http://192.168.70.160/pandora_console/include/api.php -u pot12,admin,pandora 
	-create_event -name "Sample event executed from commandline" -group 2 -type "system" -agent 2 
	-user "admin" -status 0 -am 0 -alert 9 -criticity 3 -comment "User comments" -tag "tags" 
	-source "Commandline" -extra 3 -c_instructions "Critical instructions" 
	-w_instructions "Warning instructions" -u_instructions "Unknown instructions" -owner "other" 

You're required to enable the API access and configure it first. Please follow the below mentioned steps to do so.

  • Please enable the API access for the IP (please use '*' for all IPs)
  • Please set an API password
  • Please use a regular user and password or define a specific API user only for conducting the operations only.

In order to render the 'unknown', 'critical' or 'warning' instruction fields to appear within the event details, the event type is required to be one of the types named 'going_unknown', 'going_down_critical' or 'going_down_warning'.

Examples:

/pandora_revent_create.pl -p http://192.168.50.12/pandora_console/include/api.php -u pandora12,admin,pandora 
-create_event -name "Another nice event" -group 0 -type "system" -status 0 -criticity 4
-user "davidv" -owner "admin" -source "Commandline" -comment "Prueba de comentario"

1.16 Custom Fields within Events

Events with custom fields may be generated by the Pandora FMS CLI, e.g. an event generated by the following command:

perl pandora_manage.pl /etc/pandora/pandora_server.conf --create_event 'Custom event' system Firewalls 'localhost' 'module' 0 4  'admin'     '{"Location": "Office", "Priority": 42}'

Would look like the one shown below.

Event custom data.png

Go back to Pandora FMS Documentation Index