Welcome to docs.opsview.com

REST API: Event

URL: /rest/event. This requires authentication. Requires VIEWALL or VIEWSOME permission

  • GET - returns event data for requested objects
  • POST, PUT, DELETE - not implemented

An event is considered to be either:

  • a host or service changing state (eg, from OK to CRITICAL)
  • a host or service result during soft failures (eg, CRITICAL SOFT 1 to CRITICAL SOFT 2)
  • a host or service in a failure state where alert every failure is enabled
  • an acknowledgement
  • a downtime start
  • a downtime stop (or cancel)

Note: The last three were added into trunk on 2012-06-18.

Access Control

VIEWALL allows all event data to be returned.

VIEWSOME allows event data to be returned for objects where permission has been granted for the service based on the access object selection.

Requesting Event Data

Parameters:

  • cols - defines which columns of data to return. Acceptable values: hostname, time, objectid, servicename, state, state_type, output, eventid, host_group, host_group_id, markdown_filter. Note that some columns will always be returned. For multiple columns use: cols=state&cols=hostname
  • startTime - filter by start time, eg '2011-11-01 18:43:22'. Time is based on the server's timezone
  • endTime - filter by end time
  • rows - the number of rows to return
  • page - which page of data to return
  • sortby - a json structure to describe the ordering of results. Defaults to '[{“col”:“time”,”order”:“desc”}]'
  • host_state - host states to filter on. Can be repeated. Acceptable values: up, down, unreachable
  • service_state - service states to filter on. Can be repeated. Acceptable values: ok, warning, critical, unknown
  • host - host names to filter on. Can be repeated
  • service - service names to filter on. Can be repeated
  • state_type - state type to filter on. Acceptable values: soft, hard
  • host_group - host group to filter on. Can be anywhere in the hierarchy. Can be repeated
  • keyword - keyword to filter on. Can be repeated
  • search - search terms. Will search in host name, service name or output. Can be repeated to produce an AND effect
  • saved_maxeventid - if set with the value of the last max event id, an extra attribute will be in the result to signify the number of new events since the last max event id (based on the filtering parameters)
  • eventtype - there are 4 types of events: 0 = state change event; 1 = acknowledgements event; 2 = downtime start event; 3 = downtime end event. If no eventtype is specified, only eventtype=0 is returned, otherwise specify multiple times to get different types added. This was committed into trunk 2012-06-18.

Example response:

{
   "list" : [
      {  
         "eventid" : "9373",
         "eventtype" : "0",   # State change event
         "markdown" : "0",   
         "objectid" : "194",
         "output" : "OK - load average: 1.53, 1.73, 1.58",
         "servicename" : "Check Loadavg",
         "state" : "ok",
         "state_type" : "hard",
         "time" : "1248858348"
      },
      {  
         "ack_author" : "admin",
         "ack_comment" : "Due to power failure",
         "eventid" : "9372",
         "eventtype" : "1",
         "objectid" : "194",
         "servicename" : "Check Loadavg",
         "state" : "ok",
         "state_type" : "hard",
         "time" : "1248858348",
      },
      {  
         "downtime_author" : "admin",
         "downtime_comment" : "Offline for repairs",
         "downtime_end" : "1248860000",
         "downtime_start" : "1248858348",
         "eventid" : "9370",
         "eventtype" : "2",   # Downtime start event. Same for eventtype=3
         "markdown" : "0",   
         "objectid" : "194",
         "output" : "OK - load average: 1.53, 1.73, 1.58",
         "servicename" : "Check Loadavg",
         "state" : "ok",
         "state_type" : "hard",
         "time" : "1248858348",
      },
      ...
  ],
  "summary" : {
      "entries" : "10",
      "filtered_maxeventid" : "9373",
      "filtered_new_event_count" : "2",
      "maxeventid" : "9373",
      "page" : "1",
      "pages" : "85",
      "total_entries" : "843"
   }
}     

The time, downtime_start and downtime_end parameters are the number of seconds since epoch which by definition is in the UTC time zone.

Note that some fields are conditional and will only be displayed if appropriate.

Navigation
Print/export
Toolbox