Netreo Incident Macros

Updated on 05 Aug 2024
5 Minutes to read

Print
Share
Dark
Light
PDF

Article summary

Did you find this summary helpful?

Thank you for your feedback

The following macros are available for use in Netreo alert notifications and actions.

Macros marked with an asterisk (*) are not available for host-down alerts.

Macro	Description
`{ALERTLIST}`	Returns a comma-separated list of email addresses and webhook base URIs to which alert notifications or webhooks associated with this incident were sent. This macro respects the NOTIFY HOURS settings for action group methods and will filter the returned list accordingly each time it is called (i.e., on renotification). Only email addresses and URIs that were sent an alert notification or webhook will be included in the list.
`{ALERTDESCRIPTION}`	Returns the long name/description of the service check whose alarm opened the incident (e.g. Main Website). Likely a duplicate of `{SERVICEDESC}`. (Requires an associated service check.)
`{APPLICATIONDESC}`	Returns the description of the application generating this alert. (Requires an associated WebART or EmailART check.)
`{APPLICATIONSTATE}`	Returns the health state of the application generating this alert at the time of incident creation. (Requires an associated WebART or EmailART check.)
`{CATEGORYNAME}`	Returns the name of the category the associated host is assigned to.
`{CURRVALUE}`	Returns the value of the monitored statistic at the time of incident creation. (Requires an associated threshold check.)
`{DATE}`	Returns a date stamp relative to the server when a message containing this macro was sent (format: `2000-10-13`).
`{DATETIME}`	Returns a date/time stamp relative to the server when a message containing this macro was sent (format: `Wed Oct 15 11:25:26 -0700 2003`).
`{DEVICE_DOCUMENTATION}`	Returns device information and reference contacts configured for the host to which the incident is associated. (Note: This macro has an alternate form outlined below this table.)
`{HOSTADDRESS}`	Returns the IP address of the host to which the incident is associated.
`{HOSTALIAS}`	Synonymous with `{HOSTNAME}`, preserved for legacy reasons.
`{HOSTNAME}`	Returns the device name of the host to which the incident is associated.
`{HOSTNOTE}`	Returns the specific device note associated with the host to which the incident is associated.
`{HOSTSTATE}`	Returns the current state of the host ("UP", "DOWN", "UNREACHABLE", "DISABLED", "DELETED") to which the incident is associated. This macro will not populate for incidents caused by threshold checks, since a successfully collected statistic value infers that the host is UP.
`{INCIDENTID}`	Returns the unique identifier for the associated incident, which stays constant until recovery.
`{INCIDENTTIME}`	Returns the creation time stamp of the associated incident (format `Wed Jan 19 16:20:48 2022`).
`{INCIDENTTIMET}`	Returns the creation time stamp of the associated incident in epoch time (format `1719600882`).
`{INCIDENT_URL}`	Returns a web link directly to this incident when sent via email. Requires administrator to set up the Netreo host name in system preferences before it will function.
`{LOGGINGMESSAGES}`	Returns a newline-separated list of log messages associated with a logging rule threshold check that has exceeded its CRITICAL setting. (Requires an associated logging rule-based threshold check.)
`{NOTIFICATIONNUMBER}`	Returns the number of alert notifications sent for the associated incident.
`{NOTIFICATIONTYPE}`	Returns the identification of the type of alert notification sent. Service check incidents (WebART service checks included) - PROBLEM Host availability check incidents - PROBLEM Threshold check incidents (WebARTthreshold checks included) - CRITICAL (If alerting on warning is enabled - WARNING) Anomaly check incidents - CRITICAL Configuration change incidents - CONFIG_CHANGE Any incident closure - RECOVERY Any incident acknowledged - ACKNOWLEDGEMENT Any incident unacknowledged - UNACKNOWLEDGEMENT
`{OUTPUT}`	Returns the text output from the associated service check (e.g. `FTP ok -1 second response time`). For service notifications and event handlers, this will contain the text output from the service check. For host alert notifications and event handlers, this will contain the text output from the host availability check.
`{RENOTIFY}`	Returns text output of NEW if this is the first alert notification for this incident, or UPDATE if not.
`{SERVERNAME}`	Returns the hostname of the server the alert notification was sent from (i.e. the Netreo host).
`{SERVICEDESC}` *	Returns the long name/description of the service check whose alarm opened the incident (e.g. Main Website). Likely a duplicate of `{ALERTDESCRIPTION}`. (Requires an associated service check.)
`{SERVICENOTE}` *	Returns the specific note associated with the service check whose alarm opened the incident, if applicable. (Requires an associated service check.)
`{SERVICESTATE}` *	Returns the current status of the service check whose alarm opened the incident (WARNING, UNKNOWN, CRITICAL, or OK). (Requires an associated service check.)
`{SHORTDATETIME}`	Returns a date/time stamp relative to the server when a message containing this macro was sent (format: `2000-10-13 00:30:28`).
`{SITEDETAIL}`	Returns the name and address of the site the related host is assigned to.
`{SITEGEOLAT}`	Returns the geographic latitude of the site to which the managed device responsible for the primary alarm of the incident is assigned. (format: `44.08761)`
`{SITEGEOLONG}`	Returns the geographic longitude of the site to which the managed device responsible for the primary alarm of the incident is assigned. (format: `-111.22028`)
`{SITENAME}`	Returns the name of the site to which the related host is assigned.
`{SITESTATUS}`	Returns the current site status of a site (UP, IMPAIRED, ON BACKUP, or DOWN).
`{STRATEGICGROUP}`	Returns the names of the strategic groups the related device is assigned to.
`{STATISTICALGROUP}`	Returns the statistical group to which the primary alarm for the incident belongs (CPU, Memory, Latency, etc.)
`{SUBJ}`	Returns the contents of the "Subject" line of the associated alert notification. Good for displaying the subject line of an incident alert notification in another alerting/ticketing system. This macro is only for use in action group webhook methods.
`{THRESHOLD}`	Returns the description of the threshold check whose alarm opened this incident. (Requires an associated threshold check.)
`{THRESHVALUE}`	Returns the configured critical threshold value at the time of incident creation. (Requires an associated threshold check.)
`{TIME}`	Returns a timestamp relative to the server when a message containing this macro was sent (format: `00:30:28`).
`{TIMEGMT}`	Returns a time stamp showing GMT time when a message containing this macro was sent (format: `00:30:28`).
`{TIMET}`	Returns a timestamp in "time_t" format (seconds since the UNIX epoch) relative to the server when a message containing this macro was sent.
`{UID}`	Returns the Netreo `root_id` (a unique identifier) of the managed device, WebART check, or EmailART check associated with the incident.
`{UNIT}`	Returns the unit type of a collected performance metric (e.g., %, B, S, Pckts, etc). Remember that the values of metric types such as bytes (B), bits (b), and seconds are returned as their base values and not processed into their final exponent display values as seen in dashboards and reports (e.g., megabytes (MB), megabits (Mb), milliseconds, etc.).

Device Documentation Attributes
The {DEVICE_DOCUMENTATION} macro may be used in an alternate form as a function to call specific user-created device attributes for the device referenced by an incident rather than its usual device information and reference contacts. These user-created attributes are in the form of key/value pairs configured on the Device Administration page of that device.

To retrieve a device attribute, use the {DEVICE_DOCUMENTATION} macro function in the following form:

{get_device_doc_value("{DEVICE_DOCUMENTATION}","KEY")}

Replace "KEY" with the name of the user-created device attribute in the Attributes table of the device (be sure to use double quotes for both the macro name and the key name). Netreo will then replace the entire function with the attribute's name, followed by a colon, followed by the attribute's value, in the format: "name: value". This form of the macro is particularly useful for alert notification templates.

Was this article helpful?

What's Next

Managed Device