Table of Contents
- Getting Started
- Agent-Based Management
- Common Tasks
- Data Providers
- Directory Services
- Auditing
- Hosts
- Templates
- Template Properties
- Batch Update Templates
- Assign Templates
- Log Management Templates
- SCAP Compliance Monitor
- Active Directory User Monitor Templates
- File and Directory Monitor Templates
- Windows Monitor Templates
- Account Lockout Monitor Template
- Logon Monitor Template
- CPU Monitor Template
- Memory Monitor Template
- Disk Space Monitor Template
- SMART Monitor Template
- Process Monitor Template
- Service Monitor Template
- Performance Counter Monitor Template
- PowerShell Template
- Registry Value Monitor Template
- System Security Monitor Template
- Task Scheduler Template
- Clock Synchronization Template
- Defragment NTFS Disks Template
- Windows Audit Policy Monitor Template
- Windows Logon As Monitor Template
- Windows Update Template
- WMI Query Template
- Network and Application Monitor Templates
- Database Monitor Template
- Directory Service Monitor Template
- DNS Blacklist Monitor Template
- DNS Monitor Template
- Domain Expiration Monitor Template
- Network Speed Monitor Template
- Ping Monitor Template
- Database Table Reseed
- SQL Server Shrink and Backup Template
- SSH Shell
- TCP Port Scan Monitor Template
- Website Monitor Template
- Wake On LAN Template
- SSL Certificate Monitor Templates
- Email Monitor Templates
- SNMP Monitor Templates
- Windows Accounts Templates
- Monitors
- Reports
- Auto-Configurators
- Filters
- Actions
- Database Actions
- Desktop Actions
- Email Actions
- Event Log Actions
- Executable Actions
- File Actions
- IIS IP Address Restriction Actions
- Microsoft Teams Actions
- PowerShell Actions
- Report Actions
- Service Actions
- SMS Actions
- SNMP Trap Actions
- Syslog Actions
- Template Actions
- IIS IP Address Restriction Actions
- Action Variables
- Schedules
- Environment Variables
- Options
- SNMP
- SSH Shell
- Syslog
- Shared Views
- Active Directory User and Group Filters
- Assign Actions
- Assign Azure Audit Logs
- Assign Consolidated Logs
- Assign Directories
- Assign Disks
- Assign Event Logs
- Assign Files
- Assign Services
- Assign Shares
- Auto-Config Host Assignment Properties
- Define CSV and W3C Log Entry Columns
- Define Log Entry Columns
- Define Log Entry Columns with Regular Expressions
- Executable Status
- Executable Timeline
- Explicitly Assigned Logs
- File Explorer
- General Executable Properties
- Report Columns
- Report Date/Time Ranges
- Report Security Event Log Filters
- Select Folder or File
- Target Files and Sub-Directories
- Command Line Interface
- Server Configuration
- Agent Configuration
- Troubleshooting
- Terminology
Corner Bowl Server Manager
SIEM, IPS, Server Monitoring, Uptime Monitoring and Compliance Software
Action Variables
Action variable are used to inject variables when firing Actions. When applied, each variable is parsed out and replaced with the appropriate value. The available variables depend on the current functionality that is running.
General Variable Tags
| LOCALHOST | The host name of the computer where the software is installed. |
| MESSAGE | A detailed message. |
| NAME | The object's name. |
| OBJECT_TYPE | The type of Report. |
| HOST | The target host name(s). TEXT: comma delimited HTML: line feed delimited (<br/>) |
| IPv4 | The target IPv4 address(es). TEXT: comma delimited HTML: line feed delimited (<br/>) |
| IPv6 | The target IPv6 address(es). TEXT: comma delimited HTML: line feed delimited (<br/>) |
| LOG | The target log name. |
| DATE_RANGE | The time span to check (e.g. daily). |
| STATE | The object state (e.g. OK, Warning, Critical, Error). |
| STATE_IMG | The object state image (e.g. OK, Warning, Critical, Error). Applies to HTML output only. |
| TEMPLATE | The name of the Template (only applies to Monitors). |
| OBJECT_TYPE | The type of object (e.g. the type of Monitor or Report). |
| SHORT_MESSAGE | A short descriptive message. |
| MESSAGE | A detailed message. |
Date and Time Variables
| DATE | The current date formatted with the server's locale. |
| TIME | The current time formatted with the server's locale. |
| MONTH | The numeric day of the month. |
| DAY | The day of the month, from 01 to 31. |
| DAY_DDD | The abbreviated name of the day of the week. |
| DAY_DDDD | The full name of the day of the week. |
| MONTH | The month, from 01 to 12. |
| MONTH_MMM | The abbreviated name of the month. |
| MONTH_MMMM | The full name of the month. |
| YEAR | The year as a four-digit number. |
General Monitor Item Tags
Some functionality, such as disk space alerts, include arrays of items. When firing Actions for these Monitors item content may be customizable.
When firing text based Actions, such as text email (versus HTML email) or Message Box alerts, customize item content by wrapping the target Action variable tags within <ITEM> </ITEM> tags. For example, when firing a free disk space alert you can define the item variables to display like so:
<ITEM>\\{HOST}\{DISK} {FREE} {USED} {CAPACITY}</ITEM>
When firing HTML based Actions, such as HTML email (verses text email) or exporting to an HTML file, customize item content by wrapping the target Action variable tags within <ENTRY_ODD> </ENTRY_ODD> and <ENTRY_EVEN> </ENTRY_EVEN> tags. For more information see, HTML and Email Templates
| HOST | The target host name. |
| IPv4 | The target IPv4 address. |
| IPv6 | The target IPv6 address. |
| NAME | The name of the Monitor, Report or Auto Configurator (e.g. [HOSTNAME] ([TEMPLATE NAME])) |
| STATE | The item state (e.g. OK, Warning, Critical, Error). |
| MESSAGE SHORT_MESSAGE | A short descriptive message including the item name or key (e.g. C$). |
| ITEM_MESSAGE | A short descriptive message excluding the item name or key (e.g. C$). |
| TRIGGER_MESSAGE | When the object state is Warning, Critical or Error a short descriptive message, otherwise an empty string. |
| START_TIME | The time the Monitor item started. |
| END_TIME | The time the Monitor item completed. |
| DURATION | The total time required to complete. |
CPU Monitors
Summary Report item variable tags
| CPU_NAME | The CPU name. * HTML only. |
| CPU_ARCHITECTURE | The CPU architecture. * HTML only. |
| CPU_AVERAGE | The average CPU load across all CPUs/cores. * HTML only. |
| CPU_CLOCK_SPEED | The maximum CPU clock speed. * HTML only. |
| CPU_CORES | The number of CPU cores. * HTML only. |
| CPU_FREE | The average free CPU across all CPUs/cores. * HTML only. |
| CPU_MAXIMUM | The maximum CPU load of any CPU/core. * HTML only. |
| CPU_USED | The average CPU load across all CPUs/cores. * HTML only. |
| DATE_RANGE | The CPU history's date range. * HTML only. |
| CPU_BAR_IMG | Displays the last known CPU load in a horizontal bar gauge. * HTML only. |
| HISTORY_IMG | Displays the CPU load history chart. * HTML only. |
Defrag Monitors
Item variable tags
| DISK | The disk key (e.g. C$) |
Directory Cleaner Monitors
Item variable tags
| PATH | The full path of the target directory. |
| FILE_COUNT DIRECTORY_CLEANER_NUMBER_OF_FILES_DELETED | The number of files deleted. |
| SIZE DIRECTORY_CLEANER_SIZE_OF_FILES_DELETED | The total size of files deleted. |
| DIRECTORY_CLEANER_SIZE_OF_FILES_BEFORE | The size of directory prior to cleaning the directory. |
| DIRECTORY_CLEANER_SIZE_OF_FILES_AFTER | The size of the directory after cleaning the directory. |
| DIRECTORY_CLEANER_NUMBER_OF_FILES_BEFORE | The number of files prior to cleaning the directory. |
| DIRECTORY_CLEANER_NUMBER_OF_FILES_AFTER | The number of files after cleaning the directory. |
Directory Size Monitors
Item variable tags
| SIZE | The size of the disk. |
| USED_SPACE | The used disk space. |
| USED_SPACE_PERCENT | The percent of used disk space. |
| FREE_SPACE | The free disk space. |
| FREE_SPACE_PERCENT | The percent of free disk space. |
| PATH | The full path of the target directory. |
| DIRECTORY_SIZE | The size of the directory. |
| DIRECTORY_SIZE_PERCENT | The percent of disk space the directory is consuming. |
| FILE_COUNT | The number of files. |
| SUB_DIRECTORY_COUNT | The number of sub-directories. |
| LAST_KNOWN_USED_SPACE | The size of the directory when the Monitor was previously executed. |
| DELTA_SIZE | The change in directory size between Monitor executions. |
| DELTA_PERCENT | The percent change in directory size between Monitor executions. |
| THRESHOLD | The triggered threshold (e.g. 10 GBs). |
Summary Report item variable tags
| SIZE | The size of the disk. |
| USED_SPACE | The used disk space. |
| USED_SPACE_PERCENT | The percent of used disk space. |
| FREE_SPACE | The free disk space. |
| FREE_SPACE_PERCENT | The percent of free disk space. |
| NET_NAME | The network name of the disk (e.g. C$). |
| PATH | The full path of the target directory. |
| DIRECTORY_SIZE | The size of the directory. |
| DIRECTORY_SIZE_PERCENT | The percent of disk space the directory is consuming. |
| FILE_COUNT | The number of files. |
| SUB_DIRECTORY_COUNT | The number of sub-directories. |
| DATE_RANGE | The target date range. * HTML only. |
| CONSUMPTION_RATE_HOURLY | Given the target date range, the calculated hourly consumption rate. * HTML only. |
| CONSUMPTION_RATE_DAILY | Given the target date range, the calculated daily consumption rate. * HTML only. |
| CONSUMPTION_RATE_WEEKLY | Given the target date range, the calculated weekly consumption rate. * HTML only. |
| CONSUMPTION_RATE_MONTHLY | Given the target date range, the calculated monthly consumption rate. * HTML only. |
| CONSUMPTION_RATE_QUARTERLY | Given the target date range, the calculated quarterly consumption rate. * HTML only. |
| CONSUMPTION_RATE_YEARLY | Given the target date range, the calculated yearly consumption rate. * HTML only. |
Directory Size Watcher
| FILENAME | The full path and filename that was created. |
| FULLNAME | The full path and filename that was created. |
| PATH | The full path and filename that was created. |
| SIZE | The size of the file that was created |
| DATE | The date the file was created |
| TIME | The time the file was created |
Directory Watcher
| PATH | The full path of the target directory. |
| FILENAME | The full path and filename of the target file. |
| CHANGE_TYPE | The change type (e.g. Created, Deleted, Changed, or Renamed) |
| NEW_NAME | When a file is renamed, the new name of the file otherwise an empty string. |
Disk Space Monitors
Item variable tags
| DISK | The caption or if unavailable the network name of the disk (e.g. OS (C:)). |
| NET_NAME PATH (deprecated) | The network name of the disk (e.g. C$). |
| SIZE | The size of the disk. |
| USED_SPACE | The used disk space. |
| USED_SPACE_PERCENT | The percent of used disk space. |
| FREE_SPACE | The free disk space. |
| FREE_SPACE_PERCENT | The percent of free disk space. |
| LAST_KNOWN_USED_SPACE | The used disk space when the Monitor was previously executed. |
| DELTA_SIZE | The change in used disk space between Monitor executions. |
| DELTA_PERCENT | The percent change in used disk size between Monitor executions. |
| THRESHOLD | The triggered threshold (e.g. 10 GBs) |
Summary Report item variable tags
| SIZE | The size of the disk. |
| USED_SPACE | The used disk space. |
| USED_SPACE_PERCENT | The percent of used disk space. |
| FREE_SPACE | The free disk space. |
| FREE_SPACE_PERCENT | The percent of free disk space. |
| DATE_RANGE | The target date range. * HTML only. |
| CONSUMPTION_RATE_DAYS_REMAINING | Given the target date range, the calculated number of days until the disk is out of space. * HTML only. |
| CONSUMPTION_RATE_ESTIMATED_FULL_DATE | Given the target date range, the calculated date the disk will run out of space. * HTML only. |
| CONSUMPTION_RATE_HOURLY | Given the target date range, the calculated hourly consumption rate. * HTML only. |
| CONSUMPTION_RATE_DAILY | Given the target date range, the calculated daily consumption rate. * HTML only. |
| CONSUMPTION_RATE_WEEKLY | Given the target date range, the calculated weekly consumption rate. * HTML only. |
| CONSUMPTION_RATE_MONTHLY | Given the target date range, the calculated monthly consumption rate. * HTML only. |
| CONSUMPTION_RATE_QUARTERLY | Given the target date range, the calculated quarterly consumption rate. * HTML only. |
| CONSUMPTION_RATE_YEARLY | Given the target date range, the calculated yearly consumption rate. * HTML only. |
File Count Monitors
Item variable tags
| PATH | The full path of the target directory. |
| DIRECTORY_SIZE | The size of the directory. |
| FILE_COUNT | The number of files. |
| SUB_DIRECTORY_COUNT | The number of sub-directories. |
| LAST_KNOWN_FILE_COUNT | The number of files when the Monitor was previously executed. |
| THRESHOLD | The triggered threshold (e.g. 5000 files). |
File Size Monitors
Item variable tags
| MASK | The Template mask used to search for the file (e.g. \\SERVERNAME\c$\logs\*.txt). |
| LOG FULLNAME | The full path and filename. |
| NAME FILENAME | The filename. |
| PATH | The full path of the target directory. |
| FILE_SIZE | The size of the file. |
| DELTA_SIZE | The change in size between Monitor executions. |
| DELTA_PERCENT | The percent change in size between Monitor executions. |
| LAST_KNOWN_FILE_SIZE | The size of the file when the Monitor was previously executed. |
| THRESHOLD | The triggered threshold (e.g. > 10 GBs). |
Idle File Monitors
Item variable tags
| MASK | The Template mask used to search for the file (e.g. \\SERVERNAME\c$\logs\*.txt). |
| LOG FULLNAME | The full path and filename. |
| NAME FILENAME | The filename. |
| PATH | The full path of the target directory. |
| TIME_SPAN | The time span since the last file modification. |
Memory Monitors
Summary Report item variable tags
| MEMORY_USED | The average CPU load across all CPUs/cores. * HTML only. |
| MEMORY_FREE | The average CPU load across all CPUs/cores. * HTML only. |
| DATE_RANGE | The CPU history's date range. * HTML only. |
| BAR_IMG | Displays the last known memory load in a horizontal bar gauge. * HTML only. |
| HISTORY_IMG | Displays the memory load history chart. * HTML only. |
Performance Counter Monitors
Summary Report item variable tags
| VALUE | The performance counter value. * HTML only. |
| DATE_RANGE | The performance counter history's date range. * HTML only. |
| HISTORY_IMG | Displays the performance counter history chart. * HTML only. |
Ping Monitors
Summary Report item variable tags
| ROUND_TRIP_TIME | The ping response time. * HTML only. |
| DATE_RANGE | The ping history's date range. * HTML only. |
| HISTORY_IMG | Displays the ping history chart. * HTML only. |
SMART Monitors
Item variable tags
| DISK NET_NAME | The network name of the disk (e.g. C$). |
| SMART | The SMART status (e.g. OK, Degraded). |
Event Log Alerts
Header variable tags
| LOG | The name of the log (e.g. Application, System, Security). |
| FILTER | The applied filter name. |
| AD_USER | When firing an email alert for an Event Log entry that passes a Monitor's filter, the tag is replaced with the Active Directory assigned email address for the user listed within the USER column of the entry. If multiple entries pass the post consolidation filter the first entry that contains a non-null value within the USER column is used for the lookup. |
| USER | When firing an email alert for an Event Log entry that passes a Monitor's filter, the email address can be changed to the contents of the USER column within the entry. If multiple entries pass the filter the first entry that contains a non-null value within the USER column is used for the replacement. If the USER column contains a domain name, the domain name is removed. For example: If the Event Log entry USER column contains: LITTLEWATER\jdoe and the email address within the email Action is defined as: {USER}@CornerBowlSoftware.com the actual email address used is: jdoe@CornerBowlSoftware.com |
Item variable tags
| HOST | The host that generated the entry. * If an alias has been assigned to the host the alias is used in-place of the actual hostname. |
| IPv4 | The IPv4 address of the host that generated the entry. |
| IPv6 | The IPv6 address of the host that generated the entry. |
| DATE | The date the entry was generated. |
| TIME | The time the entry was generated. |
| LOG | The name of the log (e.g. Application, System, Security). |
| LEVEL | The Event Log entry level (e.g. Warning or Critical). * When forwarding entries the Syslog message priority is automatically set to each Event Log entry's level. |
| SOURCE | The entry source. |
| EVENT | The entry event ID. |
| CATEGORY | The entry category. |
| USER | The entry user. |
| MESSAGE | The entry message. |
| DATA | The entry data in hexadecimal format. |
| DATA_ASCII | The entry data in ASCII format. |
| DATA_UNICODE | The entry data in Unicode format. |
Entry Not Found Alert
Item variable tags
| MASK | The Template mask used to search for the file (e.g. \\SERVERNAME\c$\logs\*.txt). * Text Log Monitors only. |
| LOG | The name of the log (e.g. System, Syslog, myapp.log). |
| FILENAME | The full path and filename. |
| FILTER | The name of the filter that was applied. |
| DATE_RANGE | The threshold's time span (e.g. 2 Hours). |
| EXPECTED_COUNT | The expected number of entries per time span. |
| COUNT | The actual number of entries found during the time span. |
Event Log Consolidation
Item variable tags
| LOG | The name of the log (e.g. Application, System, Security). |
| DOWNLOADED_COUNT | The number of entries downloaded. |
| DUPLICATE_COUNT | The number of entries previously downloaded. This value is typically 1; however, if an application writes several entries to the Event Log at the same millisecond this value may be greater than 1. |
| FILTERED_COUNT | When a consolidation filter is assigned, the number of entries that passed the consolidation filter. |
| SAVED_COUNT | The number of entries saved to the Log Repository. |
| FROM | The oldest date to download. |
File Consolidation
Item variable tags
| PATH | The full path of the target directory. |
| FILE_COUNT_COPIED | The number of files copied. |
| FILE_SIZE_COPIED | The size of the files copied. |
| FILE_COUNT_DELETED | The number of files deleted. |
| FILE_SIZE_DELETED | The size of the files deleted. |
| DIRECTORY_SIZE | The size of the directory. |
Output directory tags
| DATE | The current date. |
| TIME | The current time. |
| PATH | The source path. * All special characters are replaced with an underscore. |
Output filename tags
| DATE | The current date. |
| TIME | The current time. |
| LOG FULLNAME | The full path to the source file. * All special characters are replaced with an underscore. |
| NAME FILENAME | The source filename. * All special characters are replaced with an underscore. |
| PATH | The source path. * All special characters are replaced with an underscore. |
Text Log Consolidation
| FILENAME | The target log's filename. |
| LOG | The target log's full path and filename. |
| MASK | The full path and filename or mask. |
| DOWNLOADED_COUNT | The number of entries downloaded. |
| FILTERED_COUNT | When a consolidation filter is assigned, the number of entries that passed the consolidation filter. |
| SAVED_COUNT | The number of entries saved to the Log Repository. |
| FROM | The position within the file data was read from. This value is typically the last known length. |
| SIZE | The size or length of the data read. |
SNMP Traps
Item variable tags
| OID | The object identifier. |
| NAME | The name or alias associated with the object identifier. |
| VALUE | The variable's value. |
| DATA_TYPE | The variable's data type. |