Welcome to docs.opsview.com


URL: /rest/event. This requires authentication. Requires VIEWALL or VIEWSOME permission.

  • GET - Returns event data for requested objects
  • POST, PUT, DELETE - Not implemented

An event is considered to be either:

  • A host or service changing state (eg, from OK to CRITICAL)
  • A host or service result during soft failures (eg, CRITICAL SOFT 1 to CRITICAL SOFT 2)
  • A host or service in a failure state where alert every failure is enabled
  • An acknowledgement
  • A downtime start
  • A downtime stop (or cancel)

Access control

VIEWALL allows all event data to be returned.

VIEWSOME allows event data to be returned for objects where permission has been granted for the service based on the access object selection.

Requesting event data

Example GET
Request URL /rest/event
    "list": [
            "eventid": "9373",
            "eventtype": "0",   // State change event
            "markdown": "0",
            "objectid": "194",
            "output": "OK - load average: 1.53, 1.73, 1.58",
            "servicename": "Check Loadavg",
            "state": "ok",
            "state_type": "hard",
            "time": "1248858348"
            "ack_author": "admin",
            "ack_comment": "Due to power failure",
            "eventid": "9372",
            "eventtype": "1",
            "objectid": "194",
            "servicename": "Check Loadavg",
            "state": "ok",
            "state_type": "hard",
            "time": "1248858348"
            "downtime_author": "admin",
            "downtime_comment": "Offline for repairs",
            "downtime_end": "1248860000",
            "downtime_start": "1248858348",
            "eventid": "9370",
            "eventtype": "2",    // Downtime start event, same for eventtype 3
            "markdown": "0",
            "objectid": "194",
            "output": "OK - load average: 1.53, 1.73, 1.58",
            "servicename": "Check Loadavg",
            "state": "ok",
            "state_type": "hard",
            "time": "1248858348"
    "summary": {
        "entries": "10",
        "filtered_maxeventid": "9373",
        "filtered_new_event_count": "2",
        "maxeventid": "9373",
        "page": "1",
        "pages": "85",
        "total_entries": "843"
cols Defines which columns of data to return. Acceptable values: hostname, time, objectid, servicename, state, state_type, output, eventid, host_group, host_group_id, markdown_filter. Note that some columns will always be returned. For multiple columns use: cols=state&cols=hostname.
startTime Filter by start time, eg '2011-11-01 18:43:22'. Time is based on the server's timezone.
endTime Filter by end time.
rows The number of rows to return.
page Which page of data to return.
sortby A JSON structure to describe the ordering of results. Defaults to '[{“col”:“time”,”order”:“desc”}]'.
host_state Host states to filter on. Can be repeated. Acceptable values: up, down, unreachable.
service_state Service states to filter on. Can be repeated. Acceptable values: ok, warning, critical, unknown.
host Host names to filter on. Can be repeated.
service Service names to filter on. Can be repeated.
state_type State type to filter on. Acceptable values: soft, hard.
host_group Host group to filter on. Can be anywhere in the hierarchy. Can be repeated.
keyword Keyword to filter on. Can be repeated.
htid Host template ID. Can be repeated.
bsid Business service ID. Can be repeated.
bcid Business component ID. Can be repeated.
search Search terms. Will search in host name, service name or output. Can be repeated to produce an AND effect.
saved_maxeventid If set with the value of the last max event id, an extra attribute will be in the result to signify the number of new events since the last max event id (based on the filtering parameters).
eventtype There are 4 types of events: 0 = state change event; 1 = acknowledgements event; 2 = downtime start event; 3 = downtime end event. If no eventtype is specified, only eventtype=0 is returned, otherwise specify multiple times to get different types added. This is available from Opsview 4.1.

The time, downtime_start and downtime_end parameters are the number of seconds since epoch, which by definition is in the UTC time zone.

Note that some fields are conditional and will only be displayed if appropriate.