EHS configuration and variables

Complex rules can be configured to match log events as the trigger for EHS.

When a log event is generated in SR OS, it is subject to discard using suppression and throttling (config>log>event-control) before it is evaluated as a trigger for EHS, according to the following.

• EHS does not trigger on log events that are suppressed through config>log>event-control.

• EHS does not trigger on log events that are throttled by the logger.

EHS is triggered on log events that are dropped by user-configured log filters assigned to individual logs (config>log>filter). The EHS event trigger logic occurs before the distribution of log event streams into individual logs.

Varbinds are variable bindings that represent the variable number of values included in a log event.

The common parameters and varbinds for a triggering log event are passed into the triggered EHS CLI script or Python application and can be used within that script or application as passed-in (dynamic) variables. Passed-in (dynamic) variables are split into the following groups:

• Group one

  Common event parameters, as follows:

  • appid

    The name of the application that generated the event.

  • eventid

    The event ID of the application.

  • severity

    The severity level of the event.

  • subject

    The subject or affected object of the event.

  • gentime

    The formatted time the even was generated (in UTC).

  • timestamp

    The timestamp when the event was generated, in seconds (available within a Python application only).

• Group two

  Variable parameters (varbinds), depending on the event. These are provided in different ways, depending on whether a CLI script or a Python application is triggered.