Rules File Syntax

This appendix defines the syntax of the rules file language.

Rules File Syntax Definition

The following syntax is used to define alphabetic and numeric characters and string literal.

: alphachar = a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z

: number = 0|1|2|3|4|5|6|7|8|9

: stringliteral : "string of text"

The following syntax is used to define integers, real numbers, regular expressions, and alphanumeric strings. Note the following points regarding these data types:

An integer is defined as an integer value, for example 1, 12, 262, or 1024.
A real is defined as a real number, which can be a floating point number, for example, 1.1, 12.02, or 1.0.
A stringliteral value must define a UNIX regular expression.
A name value defines an alphanumeric string. Examples of legal names include Fred1, Data_base, fast4some, and not_4_some.

numliteral : integer | real

regexp : stringliteral

name = alphachar {alphachar | number | _}

element-name = name

field-name = name

element : $element-name | $(element-name)

field : @field-name | @(field-name)

property : %property

%ServerName

%OMNIHOME

%LogFile

%HostName

list-of-elements : {element} ...

variable : element | field | property

rulesfile : tabledef statement-list

statements := [statement | ifstatement] ...

expression :

: | stringliteral
: | variable
: | string(numexpression)
: | extract(expression, regexp)
: | lookup(expression, tablename)
: | expression + expression
: tabledef :
: | table tablename = stringliteral
: | table tablename = {{stringliteral, stringliteral}
: [ ,{stringliteral, stringliteral}]... }

numexpression :

: | int(expression)
: | real(expression)
: | numliteral
: | numexpression + numexpression
: | numexpression - numexpression
: | numexpression * numexpression
: | numexpression / numexpression
: | numexpression & numexpression
: | numexpression | numexpression
: | numexpression ^ numexpression
: | numexpression >> numexpression
: | numexpression << numexpression

statement :

: variable = expression | numexpression
: | remove(element)
: | details(list-of-elements)
: | discard
: | recover
: | upper(stringliteral)
: | lower(stringliteral)
: | length(stringliteral)
: | ltrim(stringliteral)
: | rtrim(stringliteral)
: | substr(stringliteral, numliteral, numliteral)
: | printable(stringliteral)
: | setlog([DEBUG | INFO | WARNING | ERROR | FATAL | numexpression])
: | log([DEBUG | INFO | WARNING | ERROR | FATAL | numexpression], expression)
: | service (expression, GOOD | BAD | MARGINAL)

comparison :

: | match(expression, expression)
: | nmatch(expression, expression)
: | regmatch(expression, regexp)
: | exists(variable)
: | numexpression == numexpression
: | numexpression [ != | <> ] numexpression
: | numexpression < numexpression
: | numexpression > numexpression
: | numexpression <= numexpression
: | numexpression >= numexpression
: | comparison and comparison
: | comparison or comparison
: | not comparison

ifstatement :

: if (comparison) {statements} [else [ifstatement | {statements}]]

switch:

: switch(expression)
: {
: | case "stringliteral":
: rules
: | ...
: | default
: rules
: }

Notes on the Syntax Definition

fieldname

Is a reference to any field that exists in the alerts.status table, which makes up the core of the alert record.

elementname

Is a reference to any element which may have been attached to the event. These element names depend on which elements the Info Mediator developer adds.

Can reference and retrieve the value of any Info Mediator property. The subsequent named properties refer to internal variables which can be referenced. Properties and variables can not be modified within the rules file.

Numeric Operations

All variables are stored as strings, however, to aid numeric operations, these strings can be converted into numeric values so they can be compared and manipulated.

Switch Statement

The switch statement has the same syntax as C. You must supply a default label. No two case statements can have the same label. It does not support break/continue or fall through.

Table of Contents

Rules File Syntax