Enterprise Service Properties

Introduction

opCharts Enterprise Services processes syslog, SNMP Traps, NMIS Enterprise Services into a common format for further processing. This process is called normalisation.  

The following tables represents the standard properties of normalised Enterprise Services - but as Enterprise Service properties are pretty much infinitely adaptable and extensible (e.g. from custom parser rules or Enterprise Service action policies), the tables cannot be exhaustive.

Standard Properties

Enterprise Service Property

Description

Example

id

A globally unique Enterprise Service ID


time

Unix time of the Enterprise Service (seconds since 1970).

1385076573

date

The Enterprise Service time in human readable format

Note: This Property has been deprecated

2013-11-11T13:39:41

node

The name of the node in question. Normally the same as the NMIS node name.


host

The DNS hostname or IP address of the node in question, as extracted from the input data.
See section on Node vs. Host below for details.


Enterprise Service

Name of the Enterprise Service

Node Down, Node Up

element

What element of the node the Enterprise Service refers to.
Optional, but always present if state and stateful are present.

FastEthernet1, Neighbor 1.2.4.5

state

Is the state good or bad, up or down.
Optional, but always present if state and stateful are present.

up/down, open/closed, etc

stateful

Name of the stateful object.
Optional, but always present if state and element are present.

Node, Interface, OSPF Neighbor

details

Other Enterprise Service details


type

Where did the Enterprise Service originate?

cisco_syslog, trap, NMIS, (remote) API

escalate

Has the Enterprise Service been marked for escalation?
This is set if an action policy sets the Enterprise Service up for escalation,
and cleared once the Enterprise Service is acknowledged.

0 or 1
priorityopEnterprise Services priority level, see opEnterprise Services priority levels vs. NMIS and Syslog levels0 to 10, inclusive
levelnearest NMIS severity level, computed from priority (only in opEnterprise Services 2.2 and newer)Normal to Fatal

acknowledged

Has the Enterprise Service been acknowledged?

0 or 1

flap

Is this Enterprise Service a flap?

0 or 1

action_requiredShould the GUI show the Enterprise Service as open?
Only present in opEnterprise Services versions up to (and including) 2.0.3.
0 or 1
planned_outage

opEnterprise Services looks up the node in the NMIS planned outage system and sets the value of planned_outage (default value)  to be true or false if a planned outage is scheduled or not.

Scheduled Outages or Maintenance Windows

Only available in opEnterprise Services versions 4.1.1 and newer, Release Notes: opEnterprise Services 4.1.1

true or false

Optional but Common Properties

In addition to those a number of properties are optional and created only under certain conditions:


Enterprise Service Property

Description

Example

Enterprise Service Property

Description

Example

interface_descriptionThe ifAlias (or Description) of the interface in question
  • only available with opEnterprise Services versions 2.0 and newer,
  • only for interface-related stateful Enterprise Services (i.e. element is an interface), 
  • and only if the node was refreshed or imported from NMIS with opEnterprise Services  2.0 or newer

authorityThe server name of the system that originated the Enterprise Service;
Optional, only relevant for remotely/API-generated Enterprise Services,
but plays an important role for reorder protection of stateful Enterprise Services.

locationThe URI for this Enterprise Service at the originating server.
Optional, only relevant for remotely/API-generated Enterprise Services.

duplicateofList of Enterprise Service IDs that this one is a duplicate of.
Only present when programmable suppression rules affected this Enterprise Service.

nodeslists nodes that caused this synthetic Enterprise Service. Only present if this is a synthetic Enterprise Service.
Enterprise ServiceidsList of Enterprise Service IDs that were involved in causing this synthetic Enterprise Service.
(Only in opEnterprise Services versions 2.0.3 to 2.2.1 this is also set for relationships between Enterprise Services,
e.g. for auto-acknowledged Enterprise Services the up Enterprise Service lists the down Enterprise Service's id here and vice versa.)

stateful_Enterprise ServiceidsList of Enterprise Service IDs that are related to this stateful Enterprise Service,
e.g. the preceding down Enterprise Service if this one is an up Enterprise Service and vice versa.
Only present in opEnterprise Services versions 2.4 and newer, and only if this Enterprise Service is stateful.

delayedaction

Unix time, until then the Enterprise Service is held back from processing for actions and policies1385079231
action_checkedHas the Enterprise Service been processed wrt. actions and policies?0 or 1
script.<scriptname>
script.<scriptname>_time
If an Enterprise Service triggered a script action that is set to save output,
then the script output (and the script's execution time) is stored in these properties.

syntheticwhether this Enterprise Service was created by a correlation policy action,
or because a watchdog expired
0 or 1
triggerof

Deprecated as of opEnterprise Services 2.4, see trigger_Enterprise Serviceids for replacement.

Enterprise Service ID of the synthetic Enterprise Service that this Enterprise Service was a trigger for.
Only present in opEnterprise Services versions 2.0.4 to 2.2.1, and only if a correlation policy action
identified this Enterprise Service as a trigger. If multiple policies apply, only the last trigger is stored.


trigger_Enterprise ServiceidsList of synthetic Enterprise Service IDs that this one is a trigger of.
Only in opEnterprise Services 2.4 and newer, and only if one or more correlation policy actions have identified this Enterprise Service as a trigger.

watchdogWhether this is a watchdog expiration Enterprise Service0 or 1
escalation_ageIf the Enterprise Service is or was subject to escalation, then this property indicates the
Enterprise Service's most recent escalation threshold. Note that this property is not cleared when
the Enterprise Service is acknowledged and escalation terminates.
60, 900 etc.
escalation_policyIf the Enterprise Service is or was subject to escalation, then this property lists the
Enterprise Service's most recently active escalation policy name.
Like the previous property, this one persists after escalation terminates.

notesa list of originator- and time-tagged comments for this Enterprise Service
(optional, supported in opEnterprise Services 2.0 and newer)

tag_<anything>These enrichment tags are controlled by your action policy, and have no special meaning
- with the exception of tag_kb_topic, which controls linking to online sources
(in opEnterprise Services 2.0.2 and up),
- and tag_servicePriority, which is shown with the Enterprise Service priority if present
(only in opEnterprise Services 2.0.4 and up)

status_historyA structured record of changes and activities related to the Enterprise Service.
nodeinfoA deep structure for copied node properties on Enterprise Service creation


Additional Enterprise Service properties to capture additional Enterprise Service data

opEnterprise Services works on an Enterprise Service, the Enterprise Service can be thought of as a document and all the contents of that document move through opEnterprise Services together, additional properties are added and updated during Enterprise Service processing.  It is also not only possible but strongly encouraged to add additional properties as the richer the Enterprise Service, the more useful it will be during processing, obviously the data captured should be relevant and useful.