Inserting variables in the tcl, exec, and email actions

A right-click menu is available in these actions:

  • Tcl code field in the tcl action.
  • Command field in the exec action.
  • Subject and Message fields in the email action.

When you specify an exec, tcl, or email action, the text is scanned for the instance of these substitution characters:

  • %A (alert message)

    At runtime, this is replaced with the alert message.

  • %F (temporary file name)

    At runtime, this is replaced with the file name of a temporary file containing the alert message.

  • %G (group membership)

    At runtime, this is replaced with the alert`s group membership list or “none” when no group exists.

  • %N (alert name)

    At runtime, this is replaced with the alert`s name.

  • %R (current repeat count)

    At runtime, this is replaced with the current value of the repeat count, starting from zero, or “none”, when no repeat.

  • %V (current value)

    At runtime, this is replaced with the current source value, a keyed list of sources and values, or “n/a” when there is no available current value.

  • %P (all triggered processes in the current alert)

    At runtime, this is replaced with all processes that triggered the alert at the "process status" or "engine status" alert type.

    This is separated by a comma when there are multiple processes.

    This is replaced with “n/a” when there is no existing process and other alert types, except "process status" or "engine status".

  • %T (all triggered threads in the current alert)

    At runtime, this is replaced with all threads that triggered the alert at the "thread status" or "thread held" alert type.

    This is separated by a comma when there are multiple threads.

    This is replaced with “n/a” when there is no existing thread or other alert types except "thread status" or "thread held".

  • %p (process name of a thread-based (%t) alert that has triggered)

    At runtime, when the alert type is "process status" or "engine status", it is replaced with the process that meets the triggering conditions.

    When the alert status is "thread status" or "thread held", it is replaced with the process of the thread that triggered the alert.

    This is separated with a comma when there are multiple processes.

    This is replaced with "n/a” when there is no existing process or other alert types except "process status", "engine status", "thread status", or "thread held".

  • %t (triggered thread)

    At runtime, this is replaced with one thread that meets the triggering conditions at "thread status" or "thread held" alert types.

    This is separated with a comma when there are multiple threads

    This is replaced with “n/a” when there is no existing thread or any other alert type, except "thread status" or "thread held".

Note: These values are the values available for the sources when the alert is fired. Some of the values might not have been involved in causing the alert to fire.

Example

This example is about %P, %p, and is also valid for %T and %t.

For %P and %p, the alert type is "process status".

There are three processes P1, P2, and P3 configured in an alert.

If the Source Count is "any", then Comparing is "equal dead".

If P2 is "dead", then the alert is triggering. %P and %p are replaced with P2.

If P3 is "dead", then the alert is triggering again. %P is replaced with P2 and P3. %p is one of these two processes.

For %p, %T and %t, the alert type is "thread status". There are three processes, T1, T2, T3, configured in an alert and their processes are P1, P2, P3. If the Source Count is "any", then Comparing is "equal dead".

If T2 is "dead", then the alert is triggering. %T and %t are replaced with T2. %p is P2.

If T3 is "dead", then the alert is triggering again. %T is replaced with T2 and T3. %t is one of these two threads, if %t is replaced with T3, and %p is replaced with P3.