Help banner

Event Variables

Novell® Audit provides several variables that can be used to return specific information from an event. Variables are constructed by specifying an $ character, followed by a two-character code representing the variable format (F) and event field value (V). For example:

$FV

The event field variable (V) references a specific field within a logged event. The format variable (F) determines how the data from the event field is displayed. Using these two variables, you can call specific information from an event and manage how it is displayed.

For example, event field R returns the IP address of the Platform Agent. Using different format variables, the IP address appears as follows:

$XR returns 1B043982

$NR returns 453261698

$iR returns 130.57.4.27

The following tables list the event_field and format variables.

 

Event Field Variables

IMPORTANT: Event variables are case sensitive and all variable strings must be preceded by a dollar sign ($).

Variable

Event Field

O

Component

 

I

Event ID

 

G

Group ID

 

L

Log Level (Severity)

 

R

IP Address

 

C

Client Time Stamp

 

A

Server Time Stamp

 

S

Text1

To use the $S variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.

 

T

Text2

To use the $T variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.

 

F

Text3

To use the $F variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Configuration.

 

1

Value1

 

2

Value2

 

3

Value 3

 

M

Mime hint

 

U

Target

 

V

Target Type

 

Y

Subtarget

 

B

Originator

 

H

Originator Type

 

X

Data Size

 

D

Data

 

SE

Description

This variable returns the value of the Notification object's Description field. The value is unique in that it is not provided by the logging application, but by the Notification object that directed the event to the current Channel driver. The Notification object's description is sent with the event to the Channel driver. For more information on a Notification object's Description field, see Notification Filter or Heartbeat Notification.

 

Format Variables

IMPORTANT: Format variables are case sensitive and all variable strings must be preceded by a dollar sign ($).

Variable

Format

Description

T

Local Time

Displays the time in the format defined on the local computer (UTC localized).

 

D

Local Date

Displays the date in the format defined on the local computer (UTC localized).

 

N

Numeric Format

Displays the current value in standard numeric format (32-bit unsigned).

 

n

Signed Numeric Format

Displays the current value in standard numeric format (32-bit signed). However, if the value is greater than 2 billion, it is displayed as a negative number.

 

S

String Format

Displays string values.

IMPORTANT: This format variable can only be used with the O (Component), S (Text1), T (Text2), F (Text3), D (data), B (Originator), U (Target), and SE (Description) event variables.

 

X

Hexadecimal Format

Displays the current value in hexadecimal format.

 

R

RFC822

Displays the current value in RFC822 format. This variable is used to format time and date values.

RFC822 is the Internet standard format for electronic mail message headers. All time values are expressed in UTC.

 

r

RFC822 local

Displays the current value in RFC822 format; however, the time and date values are expressed in local time rather than UTC.

 

I

IPv4 internet Address (network order)

Displays the current value as an IP address. This variable assumes the value is in network byte order.

By default, Novell Audit stores IP address values in network byte order.

 

i

IPv4 Internet Address (host order)

Displays the current value as an IP address. This variable assumes the value is in host byte order.

 

B

Boolean Yes/No

If the value of the field is 0, this variable returns No. If the value is not 0, this variable returns Yes.

 

b

Boolean True/False

If the value of the field is 0, this variable returns False. If the value is not 0, this variable returns True.

 

Related Topics

Event Structure

Novell Audit Help

A trademark symbol (®, ™, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.

Close