Rules File Syntax

Rules File Syntax Definition

Notes on the Syntax Definition

fieldname

elementname

property

Numeric Operations

Switch Statement

Rules File Syntax

This appendix defines the syntax of the rules file language.

Rules File Syntax Definition

: alphachar = a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z

: number = 0|1|2|3|4|5|6|7|8|9

: stringliteral : "string of text"

: numliteral : integer¹ | real²

: regexp : stringliteral³

: name = alphachar {alphachar | number | _}⁴

: element-name = name

: field-name = name

: element : $element-name | $(element-name)

: field : @field-name | @(field-name)

: property : %property
: %ServerName
: %OMNIHOME
: %LogFile
: %HostName

: list-of-elements : {element} ...

: variable : element | field | property

: rulesfile : tabledef statement-list

: statements := [statement | ifstatement] ...

: expression :

| stringliteral

| variable

| string(numexpression)

| extract(expression, regexp)

| lookup(expression, tablename)

| expression + expression

tabledef :

| table tablename = stringliteral

| table tablename = {{stringliteral, stringliteral}

[ ,{stringliteral, stringliteral}]... }

: numexpression :

| int(expression)

| real(expression)

| numliteral

| numexpression + numexpression

| numexpression - numexpression

| numexpression * numexpression

| numexpression / numexpression

| numexpression & numexpression

| numexpression | numexpression

| numexpression ^ numexpression

| numexpression >> numexpression

| numexpression << numexpression

: statement :

variable = expression | numexpression

| remove(element)

| details(list-of-elements)

| discard

| recover

| upper(stringliteral)

| lower(stringliteral)

| length(stringliteral)

| ltrim(stringliteral)

| rtrim(stringliteral)

| substr(stringliteral, numliteral, numliteral)

| printable(stringliteral)

| service (expression, GOOD | BAD | MARGINAL)

: comparison :

| match(expression, expression)

| nmatch(expression, expression)

| regmatch(expression, regexp)

| exists(variable)

| numexpression == numexpression

| numexpression [ != | <> ] numexpression

| numexpression < numexpression

| numexpression > numexpression

| numexpression <= numexpression

| numexpression >= numexpression

| comparison and comparison

| comparison or comparison

| not comparison

: ifstatement :

if (comparison) {statements} [else [ifstatement | {statements}]]

: switch:

switch(expression)

{

| case "stringliteral":

rules

| ...

| default

rules

}

Notes on the Syntax Definition

fieldname

Is a reference to any field that exists in the alerts.status table, which makes up the core of the alert record.

elementname

Is a reference to any element which may have been attached to the event. These element names depend on which elements the Info Mediator developer adds.

Can reference and retrieve the value of any Info Mediator property. The subsequent named properties refer to internal variables which can be referenced. Properties and variables can not be modified within the rules file.

Numeric Operations

All variables are stored as strings, however, to aid numeric operations, these strings can be converted into numeric values so they can be compared and manipulated.

Switch Statement

The switch statement has the same syntax as C. You must supply a default label. No two case statements can have the same label. It does not support break/continue or fall through.

¹Integer value for example 1 12 262 1024
²Real value for example 1.1 12.02 262.56 1025.932 1.0 2.
³The stringliteral should define a UNIX regular expression
⁴Examples of legal names include Fred1, Data_base, fast4some, and not_4_some.

Table of Contents

Rules File Syntax