Novell® Audit provides several variables that can be used to return specific information from an event. Variables are constructed by specifying an $ character, followed by a two-character code representing the variable format (F) and event field value (V). For example:
$FV
The event field variable (V) references a specific field within a logged event. The format variable (F) determines how the data from the event field is displayed. Using these two variables, you can call specific information from an event and manage how it is displayed.
For example, event field R returns the IP address of the Platform Agent. Using different format variables, the IP address appears as follows:
$XR returns 1B043982
$NR returns 453261698
$iR returns 130.57.4.27
The following tables list the event_field and format variables.
IMPORTANT: Event variables are case sensitive and all variable strings must be preceded by a dollar sign ($).
Variable |
Event Field |
O |
Component
|
I |
Event ID
|
G |
Group ID
|
L |
Log Level (Severity)
|
R |
IP Address
|
C |
Client Time Stamp
|
A |
Server Time Stamp
|
S |
Text1 To use the $S variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.
|
T |
Text2 To use the $T variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.
|
F |
Text3 To use the $F variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.
|
1 |
Value1
|
2 |
Value2
|
3 |
Value 3
|
M |
Mime hint
|
U |
Target
|
V |
Target Type
|
Y |
Subtarget
|
B |
Originator
|
H |
Originator Type
|
X |
Data Size
|
D |
Data
|
SE |
Description This variable returns the value of the Notification object's Description field. The value is unique in that it is not provided by the logging application, but by the Notification object that directed the event to the current Channel driver. The Notification object's description is sent with the event to the Channel driver. For more information on a Notification object's Description field, see Notification Filter or Heartbeat Notification. |
IMPORTANT: Format variables are case sensitive and all variable strings must be preceded by a dollar sign ($).
Variable |
Format |
Description |
T |
Local Time |
Displays the time in the format defined on the local computer (UTC localized).
|
D |
Local Date |
Displays the date in the format defined on the local computer (UTC localized).
|
N |
Numeric Format |
Displays the current value in standard numeric format (32-bit unsigned).
|
n |
Signed Numeric Format |
Displays the current value in standard numeric format (32-bit signed). However, if the value is greater than 2 billion, it is displayed as a negative number.
|
S |
String Format |
Displays string values. IMPORTANT: This format variable can only be used with the O (Component), S (Text1), T (Text2), F (Text3), D (data), B (Originator), U (Target), and SE (Description) event variables.
|
X |
Hexadecimal Format |
Displays the current value in hexadecimal format.
|
R |
RFC822 |
Displays the current value in RFC822 format. This variable is used to format time and date values. RFC822 is the Internet standard format for electronic mail message headers. All time values are expressed in UTC.
|
r |
RFC822 local |
Displays the current value in RFC822 format; however, the time and date values are expressed in local time rather than UTC.
|
I |
IPv4 internet Address (network order) |
Displays the current value as an IP address. This variable assumes the value is in network byte order. By default, Novell Audit stores IP address values in network byte order.
|
i |
IPv4 Internet Address (host order) |
Displays the current value as an IP address. This variable assumes the value is in host byte order.
|
B |
Boolean Yes/No |
If the value of the field is 0, this variable returns No. If the value is not 0, this variable returns Yes.
|
b |
Boolean True/False |
If the value of the field is 0, this variable returns False. If the value is not 0, this variable returns True.
|
A trademark symbol (®, , etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.