The following table lists available event attributes.
| Attribute | Description |
|---|---|
| agent | Collector name from which the event came (such as zensyslog or zentrap). |
| component | Component of the associated device, if applicable. (Examples: eth0, httpd.) |
| count | Number of times this event has been seen. |
| dedupid | Key used to correlate duplicate events. By default, this is: device, component, eventClass, eventKey, severity. |
| device | ID of the associated device, if applicable. |
| DeviceClass | Device class from device context. |
| DeviceGroups | Device systems from device context, separated by |. |
| eventClass | Event class associated with this device. If not specified, may be added by the rule process. If this fails, then will be /Unknown. |
| eventClassKey | Key by which rules processing begins. Often equal to component. |
| eventGroup | Logical group of event source (such as syslog, ping, or nteventlog). |
| eventKey | Primary criteria for mapping events into event classes. Use if a component needs further de-duplication specification. |
| eventState | State of event. 0 = new, 1 = acknowledged, 2 = suppressed. |
| evid | Unique ID for the event. |
| facility | syslog facility, if this is a syslog event. |
| firstTime | UNIX timestamp when event is received. |
| ipAddress | IP Address of the associated device, if applicable. |
| lastTime | Last time this event was seen and its count incremented. |
| Location | Device location from device context. |
| manager | Fully qualified domain name of the collector from which this event came. |
| message | Full message text. |
| ntevid | nt event ID, if this is an nt eventlog event. |
| priority | syslog priority, if this is a syslog event. |
| prodState | prodState of the device context. |
| severity | One of 0 (Clear), 1 (Debug), 2 (Info), 3 (Warning), 4 (Error) or 5 (Critical). |
| stateChange | Time the MySQLrecord for this event was last modified. |
| summary | Text description of the event. Limited to 150 characters. |
| suppid | ID of the event that suppressed this event. |
| Systems | Device systems from device context, separated by |. |
zProperties and Custom Properties
zProperties and custom properties also are available for devices, and use the same syntax as shown in the previous sections.
