EHS configuration and variables

Complex rules can be configured to match log events as the trigger for EHS.

When a log event is generated in SR OS, it is subject to discard using suppression and throttling (config>log>event-control) before it is evaluated as a trigger for EHS, according to the following.

• EHS does not trigger on log events that are suppressed through config>log>event-control.

• EHS does not trigger on log events that are throttled by the logger.

EHS is triggered on log events that are dropped by user-configured log filters assigned to individual logs (config>log>filter). The EHS event trigger logic occurs before the distribution of log event streams into individual logs.

The parameters from the log event are passed into the triggered EHS CLI script or Python application. For CLI scripts, the parameters are passed as individual dynamic variables (for example, $eventid). For Python applications, see the details in the following sections. The parameters are composed of:

• common event parameters
• event specific parameters

The common event parameters are:

• appid
• eventid
• severity
• gentime (in UTC)
• timestamp (in seconds, available within a Python application only)

The event specific parameters depend on the log event. See the show log event-parameters command or information in the state log log-events context in MD-CLI for the parameters of a particular log event.