1. Home
  2. Netreo Incident Macros

Netreo Incident Macros

The following macros are available for use in Netreo alert notifications and actions.

Macros marked with an asterisk (*) are not available for host-down alerts.

Macro Description
{ALERTLIST} Returns a comma-separated list of email addresses and webhook base URIs to which alert notifications or webhooks associated with this incident were sent. This macro respects the NOTIFY HOURS settings for actions and will filter the returned list accordingly each time it is called (i.e. on renotification). Only email addresses and URIs that were sent an alert notification or webhook will be included in the list.
{ALERTDESCRIPTION} Returns the long name/description of the service check whose alarm opened the incident (e.g. Main Website). Likely a duplicate of {SERVICEDESC}. (Requires an associated service check.)
{APPLICATIONDESC} Returns the description of the application generating this alert. (Requires an associated WebART or email check.)
{APPLICATIONSTATE} Returns the health state of the application generating this alert at the time of incident creation. (Requires an associated WebART or email check.)
{CATEGORYNAME} Returns the name of the category the associated host is assigned to.
{CURRVALUE} Returns the value of the monitored statistic at the time of incident creation. (Requires an associated threshold check.)
{DATE} Returns a date stamp relative to server when a message containing this macro was sent (format: 2000-10-13).
{DATETIME} Returns a date/time stamp relative to server when a message containing this macro was sent (format: Wed Oct 15 11:25:26 -0700 2003).
{DEVICE_DOCUMENTATION} Returns device information and reference contacts configured for the host to which the incident is associated.
{HOSTADDRESS} Returns the IP address of the host to which the incident is associated.
{HOSTALIAS} Synonymous with {HOSTNAME}, preserved for legacy reasons.
{HOSTNAME} Returns the device name of the host to which the incident is associated.
{HOSTNOTE} Returns the specific device note associated with the host to which the incident is associated.
{HOSTSTATE} Returns the current state of the host (“UP”, “DOWN”, or “UNREACHABLE”) to which the incident is associated. This macro will not populate for incidents caused by threshold checks, since a successfully collected statistic value infers that the host is UP.
{INCIDENTID} Returns the unique identifier for the associated incident, which stays constant until recovery.
{INCIDENTTIME} Returns the creation timestamp of the associated incident.
{INCIDENT_URL} Returns a web link directly to this incident when sent via email. Requires administrator to set up the Netreo host name in system preferences before it will function.
{LOGGINGMESSAGES} Returns a newline separated list of log messages associated with a logging rule threshold check that has exceeded its CRITICAL setting. (Requires an associated logging rule-based threshold check.)
{NOTIFICATIONNUMBER} Returns the number of alert notifications sent for the associated incident.
{NOTIFICATIONTYPE} Returns the identification of the type of alert notification sent (PROBLEM, RECOVERY or ACKNOWLEDGEMENT).
{OUTPUT} Returns the text output from the associated service or host check (e.g. FTP ok -1 second response time). For service notifications and event handlers, this will contain the text output from the service check. For host alert notifications and event handlers, this will contain the text output from the host check.
{PRIORITY} Returns the priority setting of the associated incident as a string number value (1, 2, 3, etc.).
{RENOTIFY} Returns text output of NEW if this is the first alert notification for this incident, or UPDATE if not.
{SERVERNAME} Returns the hostname of the server the alert notification was sent from (i.e. the Netreo host).
{SERVICEDESC} * Returns the long name/description of the service check whose alarm opened the incident (e.g. Main Website). Likely a duplicate of {ALERTDESCRIPTION}. (Requires an associated service check.)
{SERVICENOTE} * Returns the specific note associated with the service check whose alarm opened the incident, if applicable. (Requires an associated service check.)
{SERVICESTATE} * Returns the current status of the service check whose alarm opened the incident (WARNING, UNKNOWN, CRITICAL or OK). (Requires an associated service check.)
{SHORTDATETIME} Returns a date/time stamp relative to the server when a message containing this macro was sent (format: 2000-10-13 00:30:28).
{SITEDETAIL} Returns the name and address of the site the related host is assigned to.
{SITENAME} Returns the name of the site the related host is assigned to.
{STRATEGICGROUP} Returns the names of the strategic groups the related device is assigned to.
{SUBJ} Returns the contents of the “Subject” line of the associated alert notification. Good for displaying the subject line of an incident alert notification in another alerting/ticketing system. This macro is only for use in webhooks.
{THRESHOLD} Returns the description of the threshold check whose alarm opened this incident. (Requires an associated threshold check.)
{THRESHVALUE} Returns the configured critical threshold value at the time of incident creation. (Requires an associated threshold check.)
{TIME} Returns a timestamp relative to the server when a message containing this macro was sent (format: 00:30:28).
{TIMEGMT} Returns a time stamp showing GMT time when a message containing this macro was sent (format: 00:30:28).
{TIMET} Returns a timestamp in “time_t” format (seconds since the UNIX epoch) relative to the server when a message containing this macro was sent.