NEnetxms
Event Processing Policy

Get event processing policy rule

Changed on

Retrieve a single event processing policy rule by its GUID.

get/v1/event-processing-policy/rules/{rule-guid}

Request

  • Base URL
    http://127.0.0.1:8000
  • URL
    http://127.0.0.1:8000/v1/event-processing-policy/rules/{rule-guid}
  • Auth
    HTTP bearer

Path parameters

rule-guidstring uuid required

Rule GUID

Response

Rule retrieved successfully

guidstring uuid

Rule GUID. A new random GUID is generated on input if omitted.

ruleNumberinteger

1-based position of the rule in its chain (output only; ignored on input - array order is authoritative)

chainIdinteger

ID of the chain containing the rule, 0 for the main chain (output only; on input the rule belongs to the chain being updated)

chainCallsinteger[]

IDs of chains entered when the rule matches, in order. Calls are made after the rule's own actions; a call to a chain that is already active for the event is skipped and reported by the SYS_EPP_CHAIN_LOOP event.

flagsinteger

Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident

sourcesinteger[]

Source object IDs the rule matches (empty = match any source)

sourceExclusionsinteger[]

Source object IDs explicitly excluded from matching

eventsinteger[]

Event codes the rule matches (empty = match any event)

filterScriptstring

NXSL filter script source; rule matches only if the script returns true

alarmSeverityinteger

Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms

alarmKeystring

Alarm key template (supports macro expansion)

alarmMessagestring

Alarm message template (supports macro expansion)

alarmImpactstring

Alarm impact description template

alarmTimeoutinteger

Alarm timeout in seconds (0 = no timeout)

alarmTimeoutEventinteger

Event code generated when the alarm times out

alarmCategoriesinteger[]

Alarm category IDs assigned to the generated alarm

alarmCategoryScriptstring

Name of the library script returning alarm categories for the generated alarm (replaces alarmCategories when set)

rootCauseAnalysisScriptstring

Name of the library script used for root cause analysis

timerCancellationsstring[]

Timer keys to cancel when the rule matches

actionScriptstring

NXSL action script executed when the rule matches

pstorageSetActionsobject

Persistent storage entries to set (key/value pairs; values support macro expansion)

pstorageDeleteActionsstring[]

Persistent storage keys to delete

customAttributeSetActionsobject

Custom attributes to set on the source object (key/value pairs; values support macro expansion)

customAttributeDeleteActionsstring[]

Custom attribute names to delete from the source object

downtimeTagstring

Downtime tag used when starting or ending maintenance downtime

incidentDelayinteger

Delay in seconds before an incident is created (0 = immediate)

incidentTitlestring

Incident title template (empty = use alarm message)

incidentDescriptionstring

Incident description template

incidentAIAnalysisDepthinteger

Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)

incidentAIPromptstring

Custom AI analysis instructions for the incident

aiAgentInstructionsstring

Instructions for the AI agent when generating an alarm comment

commentsstring

Rule description

Changes

  • 3aeada4e28f8Revision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

  • 4e1f9580c5b0Revision changes
    • breaking

      the response property became nullable for the status