Introduction

opCharts Enterprise Services processes syslog, SNMP Traps, NMIS Enterprise Services into a common format for further processing. This process is called normalisation.

The following tables represents the standard properties of normalised Enterprise Services - but as Enterprise Service properties are pretty much infinitely adaptable and extensible (e.g. from custom parser rules or Enterprise Service action policies), the tables cannot be exhaustive.

Standard Properties

Enterprise Service Property	Description	Example
id	A globally unique Enterprise Service ID
`time`	Unix time of the Enterprise Service (seconds since 1970).	1385076573
`date`	The Enterprise Service time in human readable format Note: This Property has been deprecated	2013-11-11T13:39:41
`node`	The name of the node in question. Normally the same as the NMIS node name.
`host`	The DNS hostname or IP address of the node in question, as extracted from the input data. See section on Node vs. Host below for details.
`Enterprise Service`	Name of the Enterprise Service	Node Down, Node Up
`element`	What element of the node the Enterprise Service refers to. Optional, but always present if `state` and `stateful` are present.	FastEthernet1, Neighbor 1.2.4.5
`state`	Is the state good or bad, up or down. Optional, but always present if `state` and `stateful` are present.	up/down, open/closed, etc
`stateful`	Name of the stateful object. Optional, but always present if `state` and `element` are present.	Node, Interface, OSPF Neighbor
`details`	Other Enterprise Service details
`type`	Where did the Enterprise Service originate?	cisco_syslog, trap, NMIS, (remote) API
`escalate`	Has the Enterprise Service been marked for escalation? This is set if an action policy sets the Enterprise Service up for escalation, and cleared once the Enterprise Service is acknowledged.	0 or 1
`priority`	opEnterprise Services priority level, see opEnterprise Services priority levels vs. NMIS and Syslog levels	0 to 10, inclusive
`level`	nearest NMIS severity level, computed from `priority` (only in opEnterprise Services 2.2 and newer)	Normal to Fatal
`acknowledged`	Has the Enterprise Service been acknowledged?	0 or 1
`flap`	Is this Enterprise Service a flap?	0 or 1
action_required	Should the GUI show the Enterprise Service as open? Only present in opEnterprise Services versions up to (and including) 2.0.3.	0 or 1
planned_outage	opEnterprise Services looks up the node in the NMIS planned outage system and sets the value of planned_outage (default value) to be true or false if a planned outage is scheduled or not. Scheduled Outages or Maintenance Windows Only available in opEnterprise Services versions 4.1.1 and newer, Release Notes: opEnterprise Services 4.1.1	true or false

Optional but Common Properties

In addition to those a number of properties are optional and created only under certain conditions:

Enterprise Service Property	Description	Example

Enterprise Service Property	Description	Example
Enterprise Service Property	Description	Example
`interface_description`	The ifAlias (or Description) of the interface in question only available with opEnterprise Services versions 2.0 and newer, only for interface-related stateful Enterprise Services (i.e. element is an interface), and only if the node was refreshed or imported from NMIS with opEnterprise Services 2.0 or newer
`authority`	The server name of the system that originated the Enterprise Service; Optional, only relevant for remotely/API-generated Enterprise Services, but plays an important role for reorder protection of stateful Enterprise Services.
`location`	The URI for this Enterprise Service at the originating server. Optional, only relevant for remotely/API-generated Enterprise Services.
`duplicateof`	List of Enterprise Service IDs that this one is a duplicate of. Only present when programmable suppression rules affected this Enterprise Service.
`nodes`	lists nodes that caused this synthetic Enterprise Service. Only present if this is a synthetic Enterprise Service.
`Enterprise Serviceids`	List of Enterprise Service IDs that were involved in causing this synthetic Enterprise Service. (Only in opEnterprise Services versions 2.0.3 to 2.2.1 this is also set for relationships between Enterprise Services, e.g. for auto-acknowledged Enterprise Services the up Enterprise Service lists the down Enterprise Service's id here and vice versa.)
`stateful_Enterprise Serviceids`	List of Enterprise Service IDs that are related to this stateful Enterprise Service, e.g. the preceding down Enterprise Service if this one is an up Enterprise Service and vice versa. Only present in opEnterprise Services versions 2.4 and newer, and only if this Enterprise Service is stateful.
`delayedaction`	Unix time, until then the Enterprise Service is held back from processing for actions and policies	1385079231
`action_checked`	Has the Enterprise Service been processed wrt. actions and policies?	0 or 1
`script.<scriptname>` `script.<scriptname>_time`	If an Enterprise Service triggered a script action that is set to save output, then the script output (and the script's execution time) is stored in these properties.
`synthetic`	whether this Enterprise Service was created by a correlation policy action, or because a watchdog expired	0 or 1
triggerof	Deprecated as of opEnterprise Services 2.4, see trigger_Enterprise Serviceids for replacement. Enterprise Service ID of the synthetic Enterprise Service that this Enterprise Service was a trigger for. Only present in opEnterprise Services versions 2.0.4 to 2.2.1, and only if a correlation policy action identified this Enterprise Service as a trigger. If multiple policies apply, only the last trigger is stored.
`trigger_Enterprise Serviceids`	List of synthetic Enterprise Service IDs that this one is a trigger of. Only in opEnterprise Services 2.4 and newer, and only if one or more correlation policy actions have identified this Enterprise Service as a trigger.
`watchdog`	Whether this is a watchdog expiration Enterprise Service	0 or 1
`escalation_age`	If the Enterprise Service is or was subject to escalation, then this property indicates the Enterprise Service's most recent escalation threshold. Note that this property is not cleared when the Enterprise Service is acknowledged and escalation terminates.	60, 900 etc.
`escalation_policy`	If the Enterprise Service is or was subject to escalation, then this property lists the Enterprise Service's most recently active escalation policy name. Like the previous property, this one persists after escalation terminates.
`notes`	a list of originator- and time-tagged comments for this Enterprise Service (optional, supported in opEnterprise Services 2.0 and newer)
`tag_`<anything>	These enrichment tags are controlled by your action policy, and have no special meaning - with the exception of `tag_kb_topic`, which controls linking to online sources (in opEnterprise Services 2.0.2 and up), - and `tag_servicePriority`, which is shown with the Enterprise Service priority if present (only in opEnterprise Services 2.0.4 and up)
status_history	A structured record of changes and activities related to the Enterprise Service.
nodeinfo	A deep structure for copied node properties on Enterprise Service creation

Additional Enterprise Service properties to capture additional Enterprise Service data

opEnterprise Services works on an Enterprise Service, the Enterprise Service can be thought of as a document and all the contents of that document move through opEnterprise Services together, additional properties are added and updated during Enterprise Service processing. It is also not only possible but strongly encouraged to add additional properties as the richer the Enterprise Service, the more useful it will be during processing, obviously the data captured should be relevant and useful.

Enterprise Service Properties

Introduction

Standard Properties

Optional but Common Properties

Additional Enterprise Service properties to capture additional Enterprise Service data