EventSentry Best Practices

Variables in EventSentry are an extremely useful tool to make configuring EventSentry, especially in larger installations, easier. EventSentry distinguishes between two different types of variables:

 

•Runtime Variables

•(Configurable) Variables

 

Using configurable variables for example, you can have emails sent to different recipients based on the group a computer is a member of. But many other similar applications are possible, including:

 

•Send emails to different recipients based on the group membership of a computer, without having to create more than one SMTP target

•Consolidate data to different databases based on the group membership of a computer, without having to create more than one ODBC target

•Use a different SMTP server based on the group membership of a computer

 

Runtime Variables

Runtime Variables are variables that are automatically created by EventSentry which can then be used in various configuration objects, such as notifications and filters. A good example for a runtime variable is the $HOSTNAME variable. This variable automatically resolves to the current NetBIOS host name when used. The most common application for this variable is an email notification, where the $HOSTNAME variable is used to use the computer name as the sender of an email. The screenshot below illustrates this even better:

 

 

In the above example, the sender name and sender email fields use the $HOSTNAME variable, whereas the subject field uses the $EVENTID, $EVENTSOURCE and other event record related fields. But you can also use runtime variables with other features, for example with the event log backup feature. There, you can use the $YEAR, $MONTH, $DAY, $HOUR, ... variables in the filename to make sure that you always have a unique event log backup file name.

 

For a full list of supported variables see http://www.netikus.net/software/eventsentry/configvariablesdetails.htm.

 

Regular Variables

Regular variables are different since they are defined by you and can be customized on a per-group level.

 

Let's take a common scenario: You are monitoring 50 servers, which are assigned to a number of different groups, and would like to configure an email notification. However, instead of assigning the same email recipient(s) to all servers, you would like to have emails sent from servers in the Database group sent to the DBA, and emails sent from servers in the Web Servers group sent to the web developer and so forth.

 

So, instead of setting up different notifications with different filter packages, you can make your life at lot easier by creating a variable for the email recipients. Here is what we would like to accomplish:

 

 

1. Define a new variable called EMAILRECIPIENTS (or whichever name you prefer). You can define variables through Tools->Variables or by right-clicking the Computer Groups container. When you define a variable, you will also set the default value of it. This is important, since this default value will be automatically used if the value is not overwritten on a group-level. In our scenario, we'd simply use admin@yourcorp.com as the default value.

 

2. Right-click a group and select Set Variables ... to override the value of the variable. In our scenario, we would right-click the Database Servers Group, select "Set Variables ..." and double-click the EMAILRECIPIENTS value. You will notice that the default value of the variable is set to its initial value. Now, simply enter the group-value "dba@yourcorp.com,admin@yourcorp.com" and click OK. Repeat these steps for the other groups as well.

 

3. Now we are ready to use the variable in the actual email notification, so click your email target and replace the Recipients field with the name of the variable - $EMAILRECIPIENTS. Remember that variables always start with a $ sign to indicate that what you are entering is a variable.

 

Variables can be used in most (but not all) fields, but check the documentation at http://www.netikus.net/software/eventsentry/configvariablesdetails.htm to see in which fields a variable is supported.