From OpenNMS

Event substitution parameters are typically (but not limited to) used for SNMP traps that get converted into OpenNMS events and text in notifications. They provide a way to seeing information related to a particular instance of an event.

Trapd converts the varbinds in a trap to event parms when converting a trap to an event.

The list of elements in the eventconf.xml that can have a %element% or %parms[*]% in their value are:

• descr
• logmsg
• operinstruct
• autoaction
• operaction(/menu)
• tticket
• alarm-data

The list of elements that can occur as a NaV are :

• uei
• source
• nodeid
• time
• shorttime (shorter format time stamp)
• host
• interface
• snmphost
• service
• snmp
• id
• idtext
• version
• specific
• generic
• community
• severity
• operinstruct
• mouseovertext
• parm[values-all]
• parm[names-all]
• parm[name-#] from release 1.6.3
• parm[all]
• parm[]
• parm[##]
• parm[#]

Expansions are made so that:

•  %element% is replaced by the value of the element
• i.e a 'xxx %uei%' would expand to 'xxx <eventuei>'

•  %parm[values-all]% is replaced by a space-separated list of all parm values
• i.e a 'xxx %parm[values-all]%' would expand to 'xxx parmVal1 parmVal2 ..'

•  %parm[names-all]% is replaced by a space-separated list of all parm names
• i.e a 'xxx %parm[names-all]%' would expand to 'xxx parmName1 parmName2 ..'

•  %parm[name-#<num>]% is replaced by the name of parameter number 'num', if present
  • This expansion is available from release 1.6.3
  •  %parm[name-#<num><sep><token-num>]% is replaced by token number 'token-num' after tokenizing (splitting) the name of parameter number 'num' using the string 'sep' as the separator character
    • If 'token-num' is positive, it is interpreted as a one-based index from the beginning of the list of tokens
      • Example: for parameter 1 with name .1.3.6.1.4.1.5813.20.1.1 (enterprises.5813.20.1.1), you could extract the enterprise ID using %parm[name-#1.7]%
    • If 'token-num' is negative, it is interpreted as a one-based index from the end of the list of tokens
    • This is useful when dealing with SNMP traps whose varbind OIDs (which become parameter names) include an instance identifier
      • Example: for parameter 1 with name .1.3.6.1.2.1.2.2.1.8.10542 (ifOperStatus.10542), you could extract the ifIndex using %parm[name-#1.-1]%
  •  %parm[name-#<num><sep><token-num>:<count>]% is replaced by a run of 'count' tokens, starting at the specified 'token-num', with 'sep' reinserted between each pair of tokens
    • Again, 'token-num' may be positive or negative
    • If 'count' is omitted, tokens will be extracted until the end of the list of tokens is reached
    • Negative values of 'count' are allowed but the resulting behavior is undefined
      • Example: for parameter 1 with name .1.3.6.1.2.1.15.3.1.1.192.168.254.129 (bgpPeerAddress.192.168.254.129), you could extract the peer IP address using %parm[name-#1.-4:

•  %parm[all]% is replaced by a space-separated list of all parmName="parmValue"
  • i.e a 'xxx %parm[all]%' would expand to 'xxx parmName1="parmVal1" parmName2="parmVal2" ..'

•  %parm[<name>]% is replaced by the value of the parameter named 'name', if present
•  %parm[#<num>]% is replaced by the value of the parameter number 'num', if present

Note: If a '%<xx>%' does not have a value to be expanded to, it will not be part of the 'expanded' string

With OpenNMS 1.1, there is also:

nodelabel 

returns the nodelabel for the nodeid if present

interfaceresolve 

returns the DNS name of the IP address in the interface field, if present.

With OpenNMS 1.2, ifalias was added:

ifalias 

returns the value of the ifAlias for the snmp interface, if present. Looks up ifAlias by IP address, so do does not retrieve the ifAlias for non-IP interfaces.

With OpenNMS 1.5.92, %asset[fieldname]% was added. Replace "fieldname" with any valid field in the assets table and the value from that table for the particular nodeid referenced in the event will be returned. If the fieldname is invalid or there is no data, "Unknown" will be returned.