HostMonitor provides different ways (30 methods!) to respond to failed services. Audio and visual notifications can alert people near the machine. E-mail and pager notifications can be used to inform a wider range of remote operators. Some of the actions HostMonitor can take will try to recover from a failure automatically without human intervention.

Each test can be set up with an individual action profile, and each action profile may contain a number of alert actions that can be launched in a predefined order depending on the test results. Action can be launched by HostMonitor or by RMA.
Here is a list of available actions to kick off in response to a problem:

Show message Play sound Record HM log Generate reports Execute external program Send message to pager (TAP protocol) Send message to pager (SNPP protocol) Send message to beeper (numeric pager) Send SMS (GSM) Send SMS (SMPP/IP) Send e-mail Send message to ICQ Send message to Jabber Stop service Start service Restart service

Remote reboot Local reboot Log Event SQL Query HTTP request Send data to TCP/UDP port Syslog SNMP Set SNMP Trap Dial-up to network Disconnect dial-up connection Repeat test Change test interval Execute HMS script

To work with action profiles you can use the Action Profiles dialog. To bring up this dialog use menu Profiles->Action profiles in HostMonitor's main window or appropriate buttons in the Test Properties dialogs.

In the upper part of the dialog you can see a list of Action Profiles and buttons (New, Copy, Rename, Delete) that allow you to modify this list. Each of the Action Profile has 2 sets of actions: «Bad» actions and «Good» actions. The sets of actions and buttons for modifying these actions (Add/Edit/Del) you can find in the lower part of the dialog.

You have to understand difference between actions profile and actions: each test has link to one (only one) of the action profiles, and each of the action profiles may contain a number of actions that can be launched in a predefined order depending on the test results.


Assume action profile has been assigned to the test. In this case every time after test is done and log file was updated HostMonitor performs actions that are assigned in the related list: it uses list of "Good" actions if test has "Good" status, and uses list of "Bad" actions if test has "Bad" status. To determine which actions from the list should be executed and which should not, HostMonitor uses 3 properties that each "standard" action has:

• Start when [N] consecutive Bad/Good results occur - this parameter determines when to execute the action
• Repeat - defines the number of repeats of the action if the status of the test was not changed
• Time restriction - defines time restriction for an action execution

For example you want to monitor some important service. In case the service does not respond you want to send an e-mail message to the network administrator and restart the service. If that does not help, "Reboot remote system" action must be executed. If the functionality of the services restored, you want to send a message about this happy event to the administrator. To implement this behavior, create an action profile with four actions (3 "Bad" actions and 1 "Good" action):

1. "Bad" action: send e-mail
   Condition to start action: standard mode
   Start when: 1 consecutive "bad" result occur
   Retries: 1
   
2. "Bad" action: restart service
   Condition to start action: standard mode
   Start when: 1 consecutive "bad" result occur
   Retries: 1
3. "Bad" action: remote reboot
   Condition to start action: standard mode
   Start when: 2 consecutive "bad" results occur
   Retries: 1
4. "Good" action: send e-mail
   Condition to start action: standard mode
   Start when: 1 consecutive "good" result occur
   Retries: 1

If you do not specify an action profile for a test, HostMonitor will simply perform check and write down a record to the log file (if the logging is enabled). Also you can disable action profiles execution for all tests, to do so mark "Disable alert reactions" option on Behavior page in the Options dialog.

Note: In the HostMonitor terminology, "Bad" status means one of the following: - "No answer"; - "Bad"; - "Bad contents". "Warning" test items considered as "bad" if "Treat Warning as Bad" option is enabled. Also for a test with the option "Tread Unknown status as Bad" the following statuses considered as bad: - "Unknown host" - "Unknown" Similarly, "Good" status means either: - "Host is alive" - "Ok"

You can modify existing demo profiles or create any number of your own profiles.

To manipulate with the list of profiles use 4 buttons above listbox with profiles list:

New	Create new profile
Copy	Copy selected profile. This command is convenient if you want to use an existing profile and just slightly change it.
Rename	Change profile's name. You can rename profiles without having to worry that the program will loose the link to an action profile; HostMonitor uses internal IDs that are unique and non-changeable throughout the lifetime of an object.
Delete	Remove selected profile

Note: "Sort by" popup menu allows you to sort profiles by name or by creation time. "Columns" popup menu allows the changing of the number of columns (1,2 or 3) for the list of profiles.

To modify each action profile use buttons located on bottom line of the dialog:

Add	Allow you to add new action into profile
Edit	Bring up Action Properties dialog for editing parameters of the selected action
Delete	Remove selected action

Action properties are defined in the Action Properties dialog. Some properties are common across all action types. However, each type of action has a set of parameters that are specific to the action type. Let's have a look at the common properties first (these parameters located in the upper half of the Action Properties dialog):

Action name
The name of the action; HostMonitor auto populates this field with a suggested name based on the type of action; you can change that name to whatever name you want.

Execute by
Actions can be performed by HostMonitor or by Remote Monitoring Agent (RMA). "Execute by" option allows you to specify how and where action should be performed. You may select from the list one of the items:

Test Performer	action will be executed by the same application that had performed the test (test that triggered alert reaction). What this means? As you know test can be performed by HostMonitor or RMA. It is a usual situation when some tests performed by HostMonitor, while other tests performed by various agents. Single action profile is assigned to many different tests is usual as well. If some test fails and triggers alert reaction, action with "Test Performer" option specified will be executed by the same module (HostMonitor or RMA) that was specified for test execution. So, if HostMonitor performed the test, alert action will be executed by HostMonitor as well. If agent performed the test, action will be executed by the same agent.
HostMonitor	action will be executed by HostMonitor
Specific RMA	action will be executed by specific agent. You may select an agent from drop down list or click on a button (to the right of the field) to manage agent list. Note: if specified RMA was linked with backup RMA and test was performed by that backup agent then action will be executed by the same backup agent.

Please note: not every action can be performed by agent. E.g. RMA does not support "Send e-mail", "Send message to pager" and some other actions. To read about agent's configuration and functionality, please, refer to RMA section of the manual.

Quick Log: store action results
This option allows you to disable "Quick Log" recording for non-important actions, like "Play sound" action. Note: this option does not effect "system log" processing; HostMonitor will record action results into system log file depending on options specified on System Log page in the Options dialog.

Condition to start action
There are 3 different types of starting condition:

1. standard mode
   Standard actions are those actions that are performed by HostMonitor after a test had returned specified result for specified number of times. Following 3 parameters defines when action should be executed:
   
   Start when N consecutive Bad/Good results occur
   This parameter determines when to execute an action. For example you want to send a message to a network administrator's pager after three unsuccessful tests of the web server consecutively, set this parameter to 3. If you want to start action right after the test status was changed, set parameter to 1.
   
   Repeat: N times; or until status changes
   Defines the number of repeats of the action if the status of the test was not changed. For example if you want to send an e-mail to a network administrator only once when test status changes, set this parameter to 1. If you need to execute action every time when test failed, set this option to "until status changes".
   
   Action depends on "bad" one
   This optional parameter is available for "Good" actions only. You can set "Good" action dependable on a "Bad" action. Why do you need it? For example you defined "Bad" action to send an e-mail notification to the network administrator when test fails 3 times consecutively (start when 3 consecutive "Bad" results occur), also you defined «Good» action to send a notification when the test status changes to "Good". What will happen if test fails 1 or 2 times and after this it restores "Good" status? HostMonitor will not send a notification about failure (because test did not fail 3 times) but the program will send notification about restoring "Good" status. To avoid unnecessary "Good" action execution you can mark "Action depends on "bad" one" option and select "Bad" action. In this case HostMonitor will start "Good" action only if corresponding "Bad" action was executed.
   
   Several examples:
   
   Example 1: You want a fresh network stats report to be posted on your intranet web server every time the test finds the server to be up and running. This can be done simply by adding the following "Good" action to the action profile:
     Action: Generate reports
     Start when: 1 consecutive "good" result occur
     Retries: until status changes
   
   Example 2: When some critical service dies, you want the server to automatically reboot. If that does not help, an e-mail should be sent to the on-call technician. If, however, the server remains silent during the next three tests, the network administrator is to be paged until the server is brought back up. To implement this behavior, create an action profile with three "Bad" actions defined like these:

   1. Action: remote reboot
      Start when: 1 consecutive "bad" result occur
      Retries: 1
   2. Action: send e-mail
      Start when: 2 consecutive "bad" results occur
      Retries: 1
   3. Action: send message to pager
      Start when: 5 consecutive "bad" results occur
      Retries: until status changes
   
   

2. advanced mode
   Advanced mode allows you to use logical expression as a condition that triggers the alert action. An alert action is performed when a logical expression of a condition is true. In these expressions you can use:

   • numbers and strings (in quotes). Strings that contain a number plus one of the following unit specificators [ms, Kb, Mb, Gb, %] are compared as numbers, so that '900 Kb' is less than '9 Mb'
   • macro variables related to the current test or to any other test;
   • global macro variables;
   • logical operators [and, or, xor, not, <, >, >=, <=, ==, <>];
   • arithmetic operators [div, mod, +, -]

     div	(integer division)
     mod	(remainder)
     +	(addition)
     -	(subtraction)

     Note: the value of (x div y) is the value of x divided by y and then rounded in the direction of zero to the nearest integer; 'mod' operator returns the remainder obtained by dividing its operands (in other words, (x mod y) == x - (x div y) * y);
   • operator [in]. Expression 'Substr' in 'Str' searches for a sub string, Substr, in a string Str. Operator returns True when Str contains Substr; otherwise operator returns False
   • parentheses. In complex expressions, common rules of precedence determine the order in which operations are performed:

     Operators	Precedence
     not	first (highest)
     div, mod	second
     +, -, in	third
     <, >, >=, <=, ==, <>	fourth
     and, or, xor	fifth (lowest)

     An operator with higher precedence is evaluated before an operator with lower precedence, while operators of equal precedence associate to the left. You can use parentheses to override precedence rules. An expression within parentheses is evaluated first and then its result is treated as a single operand.
   
   Advanced mode is more complicated than standard but is very very flexible. Just several simple examples:
   • '%SimpleStatus%'<>'UP' - action will be executed every time the test is performed and status of the test is not "good";
   • '%Status%'<>'%LastStatus%' - action will be executed every time the test status changes;
   • ('%Status%'=='No answer') and ('%LastStatus%'=='Host is alive') - action will be executed when the test status changes from "Host is alive" to "No answer"
   • ('%SimpleStatus%'=='DOWN') and (%Recurrences%==5) - action will be executed if the fifth attempt of a test in a row fails
   • ('%SimpleStatus%'=='DOWN') and (%Recurrences% mod 3==1) - action will be executed after 1st, 4th, 7th, 10th, 13th, ... consecutive failed test
   • ((%Reply%>200) and (%Reply%<800)) or ('%::Main Router::SimpleStatus%'=='DOWN') - action will be executed when "Reply" value of the test is between 200 and 800 or status of the "Main Router" test is "No answer" or "Bad".
   
   Note: There are special buttons in Action Properties dialog that allow you to bring up "Expression editor" window for convenient expression editing.
   
   

3. on the schedule
   Unlike standard and advanced actions that are triggered by events related only to the tests, scheduled actions are conformable to the schedule. They also may be triggered by some "global" events (e.g. HostMonitor can start "scheduled" actions when user stops monitoring). There are several places where you can use scheduled actions:

   • The Scheduler itself - a tab in the Options dialog allows you to execute up to 5 alert profiles by a schedule. E.g. HostMonitor may execute one profile every 1 hour and execute another profile every Monday at 21:00;
   • Reports page in the Options dialog: now HostMonitor can execute alert profile after reports were generated;
   • Reports page in the Folder Properties dialog;
   • Statistics page in the Folder Properties dialog: HostMonitor can execute alert profile before resetting the statistics;
   • Pause dialog: HostMonitor can execute alert profiles every time user starts or stops monitoring or when the user enables/disables alerts.
   It is a good idea to create separate action profiles for standard/advanced actions and for scheduled actions.

Time restriction
Schedules can be applied to actions the same way they were used for tests. With schedules, actions can be customized per time of the day. For instance, an action profile can be set up to page both the IT manager and the network administrator during regular office hours, and to page the administrator alone the rest of the time, while doing nothing else but writing to the log on weekends. To make this possible, simply check the "Time restriction" option and select an appropriate schedule.

Deferred action
"Time restriction" option allows you to suppress action execution depending on time of the day and/or day of the week. Additional "Deferred action" option tells HostMonitor to delay action execution if specified schedule does not allow immediate execution of the action. HostMonitor will execute action at the beginning of "allowed" time frame on condition that status of the test is identical to status that triggered alert (see Note #3).
Note 1: If the same test triggers the same action several times within "restricted" time frame, HostMonitor will execute action just once at the beginning of "allowed" time frame.
Note 2: When HostMonitor starts deferred (delayed) action, macro variables will be resolved with using of current (up to date) test status, current date and time, current status of HostMonitor, etc.
Note 3: HostMonitor considers the following statuses as identical
 - Bad, Bad contents, No answer
 - Ok, Host is alive, Normal
 - Unknown, Unknown host
Also "Warning" status can be considered as identical to "Bad" when "Treat Warning status as Bad" option of the test item is enabled. The same is true for "Unknown" and "Unknown host" statuses when "Treat Unknown status as Bad" option is enabled.


Macros: You may use special macro variables in a command line to execute an external program, in e-mail's subject line, in the mail templates, etc. For more information, please, refer to Macros section of this document.

Executing this action, HostMonitor will display a popup window with information about state of the test. All settings for this window (position, time to display, etc) may be setup on the "Msg Window" page in the Options dialog.

See also common action parameters

This action designed to play a sound file (WAV, MID, etc). In addition to the common action parameters, the «Play sound» action has the following options:

Sound file
Specify full path to the sound file or click small button on the right side and select file from the Open File dialog.

Show WakeUP window and play sound repeatedly
With this option enabled HostMonitor will display a popup window with information about the event and will play a sound repeatedly until you click "Stop" button.

"Record HM log" action method allows you to store records in the log under some very specific circumstances. It also provides you with ability to manage flexibly which information should or should not be added into the logs.
E.g. you may add info about passed probes into one log (using "good" action) and save info about failed probes into another log file (using "bad" action). Or you may record results of some test item only when the "reply" is over 1500 ms (using "advanced" action with triggering expression '%Reply%'>'1500 ms').
Please use caution and do not create too many logs. Although Log Analyzer is capable of processing multiple log files together, it takes more time to analyze many small files rather then one big file.

In addition to common action parameters, the "Record HM log" action has the following options:

Add record into common log
Tells HostMonitor to record information about test result into common log file.

Add record into private log
Tells HostMonitor to record information about test result into private log file - log file that is assigned specifically for the test item that has triggered action execution. Even if "Use private log" test's property is not activated for this test item, record will be added when action is executed. However if there is no private log specified (file name is empty) for the test item, no record will be added.

Add record into specific log
Tells HostMonitor to record information about test result into some specific log file. You may provide path to html, text or dbf file, HostMontor will record data in appropriate format according to file extension.

HostMonitor can generate reports in HTML, DBF, WML, and Text formats. If you want to generate reports when some test changes status, add "Generate reports" action into action profile. In addition to common action parameters select one of the options:

Generate reports for the containing folder
With this option selected HostMonitor will create reports for the Folder in which the test causing actions are contained. This option useful when you want to assign one action profile to many different tests that located in different Folders. Each test will create reports for its own Folder.

"Generate reports for .."
Choose this option and select the Folder from drop-down list if you need to create reports for some specific Folder.

Recursive mode
This parameter defines whether HostMonitor includes subfolders to the report or not. Choose one of the following options:

- Single folder	Include specified folder only (no subfolders)
- Folder & all subfolders	Include specified folder and all descendant subfolders
- Folder & subfolders with inherited settings	Incude specified folder and subfolder which inherit reports' settings from the parent folder

Use report pool
This option tells HostMonitor that report generation can be deferred for 1-2 seconds. In some cases this option noticeably reduces resource usage, e.g. if you use "Generate reports" action for many test items that can change status at the same time. However you should not use this option if report must be processed immediately; e.g. you are using 2nd action to send reports by e-mail or you are using some script to publish report on your web site.

As you see you do not specify report to generate directly. That is because each Folder contains list of up to 6 reports or Folder can inherit this list from the Parent Folder. For more information about Folders, refer to "TestList & Windows" section of this documentation.
Also you can use "Execute HMS script" action to generate some specific reports. For more information about Reports, refer to "Log&Reports" section of this documentation.

Name of this action tells for it self, it launches specified external application. In addition to the common action parameters it has 2 more parameters:

Command line
Specify command line to launch external application. Macro variables may be used in the command line.

Window mode
This parameter specifies how the application window will be shown. Choose one of the possible options:

SW_SHOWNORMAL	-	displays an application window in its original size and position.
SW_HIDE	-	starts application without displaying its window.
SW_MAXIMIZE	-	displays an application window as a maximized window.
SW_MINIMIZE	-	displays an application window as a minimized window.
SW_SHOWMINNOACTIVE	-	displays an application window as a minimized window. The active window remains active.
SW_SHOWNOACTIVATE	-	displays an application window in its original size and position. The active window remains active.

Please note: Remote Monitoring Agent for Windows (RMA) starts applications using SW_HIDE flag.

HostMonitor can send e-mail notification (that includes the problem data) to a mailbox, a pager or a mobile phone using any SMTP server. On the Mailer settings page in the Options dialog setup the parameters of your Primary and Backup SMTP servers (address of the server, port, authentication method, login, password, etc).
In addition to the common action parameters, the «Send e-mail» action has the following parameters:

From
Specify the email address of the sender.

To
Specify a list of destinations for the mail message. A copy of the message is sent to each of them, and a "To" SMTP header is created containing the destination addresses. More than one destination addresses separating with a semicolon (;) Macro variables are supported in this field.

Priority
Priority option allows you to assign the message a priority so the recipient knows to either look at it right away (High Priority) or read it when time permits (Low Priority).

Subject
The subject of the mail message. Macro variables may be used in the subject line.

Mail template
Select one of the existing mail templates that will be used as a body of the mail (text) from drop down list or click button to bring up the Mail Templates dialog and create mail template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time. Also you can specify a particular character set for your mail templates.

Attach file
You can mark this option and select file that will be attached to the message. Enter the path manually or press button to select a file from the Open File dialog.

HostMonitor can send message to your alpha-numeric pager(s) using the TAP protocol. For this you need a modem and a phone line connected to the computer. On the Pagers page in Options dialog you can setup general modem settings.
In addition to the common action parameters, you will need to fill out some information about the paging company and pager of the person you wish to send a message to. These parameters can be different for each action.

What do you need to know about the paging company of the pager?

Access Number
You need to know the paging terminals alphanumeric paging access telephone number. This is the phone number of the modem at the paging company that will receive the message using the TAP protocol. This number is the same for everybody that has a pager from that company. Many carriers will offer 800 numbers - especially the nationwide guys like SkyPage or Mobilcomm. THIS IS DIFFERENT FROM THE PAGER TELEPHONE NUMBER. You may include dashes and commas like any other modem phone number (a comma usually pauses 2 seconds - i.e. 9,444-4444).
By putting "DIRECT" in this string, the program assumes a direct connection. No dialing takes place and DTR is NEVER dropped. If the phone number is in the format +1 (303) 799-0055 that is called canonical form, the access phone number will be TAPI converted to a dialable number. In this manner you can always send the area code and it will know if it is a local or long distance call. It will also dial the prefix digit (such as 9) to get outside line - etc.

Password
Does your paging carrier require a password? Most US companies DO NOT. In this case, the program sends six zeros as the password. This is the standard way of doing it. If you require a special password, define it in this field.

Max characters per block
This is the number of characters the paging company allows per message block. This number varies widely from company to company. Some are as small as 60 characters and some are as big as 1000 characters. The norms seem to be 80 and 230 characters per block. You will need to find out this information or learn this through trial and error. If the message you pass is bigger than the character per block limitation, the program automatically splits your message up into multiple blocks, so the recipient gets the entire message. However, he/she does get a different page for each block.

Parity
Specifies the parity, data bits, stop bits that the paging company's alpha access port communicates at. In very rare cases the paging terminal require N,8,1 rather than E,7,1.

What do you need to know about the Pager?

Pager ID
The only thing you need to know about the pager is the pager phone number or the Pager ID (Alpha PIN). DO NOT INCLUDE ANY DASHES in this number.
Macro variables may be used in this field.

Mail template
Select one of the existing mail templates (that will be used for the message generation) from drop down list or click button to bring up the Mail Templates dialog and to create the template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.

This action sends a message to a pager using the SNPP protocol; unlike TAP protocol, which employs the modem, SNPP is built on top of TCP/IP to send messages via an Internet connection.
In addition to the common action parameters, «Send message to pager (SNPP)» action has the following options:

PagerID
Specify the Pager ID (PID) number. Macro variables may be used in this field.

Mail template
Select one of the existing mail templates (that will be used for the message generation) from drop down list or click button to bring up the Mail Templates dialog and to create the template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.

Server
Specify the name or IP address of the SNPP server.

Port
The default SNPP port is 444, but you can specify a non-standard port.

Login as
This parameter allows for a session login ID to be specified. It is used to validate the person attempting to access the paging terminal. If this option is disabled, "anonymous" user status is assumed.

HostMonitor can send messages to "numeric only" pagers (beepers). TAP protocol is not used in these cases. The program simply takes the phone line off-hook, dials the pager phone number, waits specified number of seconds, touch tones the digits to be displayed on the pager and hangs up. This method does not guarantee delivery to the paging company. It just dials and hopes it works.
In addition to the common action parameters, the «Send message to beeper» action has the following options:

Beeper #
Enter the telephone number for the beeper. This is the number on the beeper that people call to touch tone in digits. You may use a comma in the number, the comma tells the modem to wait 2 seconds.
Macro variables may be used in this field.

Delay
Specify how many seconds to delay from the time the beeper number dialed and the display digits are dialed.

Send message
This parameter defines the digits that will appear on the pager. You may use macro variables (e.g. "%StatusID%", "%HostID%", "%CommentID%") and comma (for 2 seconds delay).

Termination string
Define the modem command used to terminate a call. Normally, this parameter is empty and HostMonitor uses a "#,H;" to finish the call. The # is normally used when you have finished touch-toning in the digits to send to the pager. The comma tells the modem to wait 2 seconds before hanging up. The "H" tells the modem to hang up when it is done. The semi-colon puts the modem in command mode and sends an OK to the computer when it has finished dialing.

Setup general paging settings on the Pagers page in Options dialog.

Sends a message through an ICQ server to the specified ICQ user. You should specify parameters of your primary and backup (optional) ICQ accounts on the ICQ page in the Options dialog.
In addition to the common action parameters, the «Send message to ICQ» action has the following options:

ICQ # (UIN)
Specify the ICQ# to whom the message will be sent. More than one destination addresses separating with a semicolon (;). Macro variables are supported in this field.

Message template
Select one of the existing mail templates (that will be used for the message generation) from drop down list or click button to bring up the Mail Templates dialog and create template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.

Please note: HostMonitor utilizes message queue, supports primary and backup ICQ accounts and uses some other tricks to make message delivery as reliable as possible. However ICQ servers use anti-spam technologies and may lock your account or do not accept your messages (temporarily). That's why you should not consider "Send message to ICQ" action as reliable way to notify network administrators about critical network problems.

This action sends a message through an Jabber server to the specified Jabber client. You should specify parameters of your primary and backup (optional) Jabber accounts on the Jabber page in the Options dialog.
In addition to the common action parameters, the "Send message to Jabber" action has the following options:

Jabber account
Specify the Jabber user (client) to whom the message will be sent. More than one destination addresses separating with a semicolon (;). Macro variables are supported in this field.

Message template
Select one of the existing mail templates (that will be used for the message generation) from drop down list or click button to bring up the Mail Templates dialog and create template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.

"Send SMS (GSM)" action sends SMS messages through a GSM modem (cell phone) connected to the system where HostMonitor is running. You should specify parameters of your primary and backup (optional) GSM modems on the GSM page in the Options dialog.
In addition to the common action properties, the "Send SMS (GSM)" action has the following parameters:

Destination phone
Provide phone number to which the message should be sent. More than one recipients separating with a semicolon (;). For example "+12063979723;+1555204090". Macro variables are supported in this field.

Message class
Choose class of the message:
 - 0..Display immediately
 - 1..ME (mobile equipment)
 - 2..SIM
 - 3..TE (terminal equipment)
The most of mobile phones support message class 0 and 2.

Message template
Select one of the existing mail templates that will be used as a body of the mail (text) from drop down list or click button to bring up the Mail Templates dialog and create mail template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.
If a message is longer than 160 characters, HostMonitor will split the message and send several SMS to the recipient. If this is not really necessary, we recommend using compact mail templates for "Send SMS (GSM)" action.

"Send SMS (SMPP/IP)" action sends SMS messages through a SMPP network service providers (SMSC) using TCP/IP connection. You should specify parameters of your primary and backup (optional) SMPP accounts on the "SMS: SMPP" page in the Options dialog.
In addition to the common action properties, the "Send SMS (SMPP/IP)" action has the following parameters:

Destination phone
Provide phone number to which the message should be sent. More than one recipients separating with a semicolon (;). For example "+12063979723;+1555204090". Macro variables are supported in this field.

Destination TON
Choose the Type of Number (TON) for the "Destination phone":

• Unknown
• International
• National
• Network Specific
• Subscriber Number
• Alphanumeric
• Abbreviated

• Unknown
• ISDN (E163/E164)
• Data (X.121)
• Land Mobile (E.212)
• National
• Private
• ERMES
• Internet (IP)

Message template
Select one of the existing mail templates that will be used as a body of the mail (text) from drop down list or click button to bring up the Mail Templates dialog and create mail template for your preferences. Macro variables are supported in message templates to be substituted with their actual values at the message generation time.
If a message is longer than 160 characters, HostMonitor will split the message and send several SMS to the recipient. If this is not really necessary, we recommend using compact mail templates for "Send SMS (SMPP/IP)" action.

Microsoft Windows NT/2000/XP/2003 supports an application type known as a service. HostMonitor can stop these applications on local or remote computers (if you have an account with privileges for starting/stopping services).
In addition to the common action parameters, the «Stop service» action has the following options:

Computer name
Provide the name of the target system (the target computer name must be prefixed by "\\") or select the "<local computer>" item to stop the service on a local machine. You may use the "Browse network" button to select a computer from the list. Also you can use macro variables (e.g. %ServiceComp%, %ServiceName%) in this field.

Service name
Name of the service to stop. You may select the service from the drop-down list. You can use macro variables in this field as well.

Parameters
Parameters string passed to the service.

Connect as
To stop a service on remote Windows system you may mark this options and provide a username and a password for a connection to the target computer.

Microsoft Windows NT/2000/XP/2003 supports an application type known as a service. HostMonitor can start these applications on local or remote computers (if you have an account with privileges for starting/stopping services).
In addition to the common action parameters, the «Start service» action has the following options:

Computer name
Provide the name of the target system (the target computer name must be prefixed by "\\") or select the "<local computer>" item to start the service on a local machine. You may use the "Browse network" button to select a computer from the list. Also you can use macro variables (e.g. %ServiceComp%, %ServiceName%) in this field.

Service name
Name of the service to start. You may select the service from the drop-down list. You can use macro variables in this field as well.

Parameters
Parameters string passed to the service.

Connect as
To start a service on remote Windows system you may mark this options and provide a username and a password for a connection to the target computer.

Microsoft Windows NT/2000/XP/2003 supports an application type known as a service. HostMonitor can restart these applications on local or remote computers (if you have an account with privileges for starting/stopping services).
In addition to the common action parameters, the «Restart service» action has the following options:

Computer name
Provide the name of the target system (the target computer name must be prefixed by "\\") or select the "<local computer>" item to restart the service on a local machine. You may use the "Browse network" button to select a computer from the list. Also you can use macro variables (e.g. %ServiceComp%, %ServiceName%) in this field.

Service name
Name of the service to restart. You may select the service from the drop-down list. You can use macro variables in this field as well.

Do not start service if it was stopped prior to execution of the action
This option is useful when you want to stop service (e.g. for maintenance purpose) without disabling the test.

Connect as
To restart a service on remote Windows system you may mark this options and provide a username and a password for a connection to the target computer.

HostMonitor can reboot or shut down remote Windows NT/2000/XP system. To shut down a remote computer, the calling process must have the SE_REMOTE_SHUTDOWN_NAME privilege on the target system. By default Administrators have this privilege.
In addition to the common action parameters, define the following options:

Computer name
Provide the name of the target system (the target computer name must be prefixed by "\\"). You may use the "Browse network" button to select a computer from the list. Also you can use macro variables (e.g. %HostAddr%) in this field.

Message to display
Provide a message to display on the remote system before shutdown.

Time to display
If time is not zero, system displays a dialog box on the specified computer. The dialog box displays the name of the user who called the function, displays the message, and prompts the user to log off. The dialog box beeps when it is created and remains on top of other windows in the system. The dialog box can be moved but not closed. A timer counts down the remaining time before a forced shutdown. If the user logs off, the system shuts down immediately. Otherwise, the computer is shut down when the timer expires.
If you set time to zero, the computer shuts down without displaying the dialog box.

Method
Select one of the 2 options:

• Reboot - shuts down the system and then reboots.
• Shutdown - shuts down the system to a point at which it is safe to turn off the power.

Force processes to terminate
During a shutdown or reboot operation, applications that are shut down are allowed a specific amount of time to respond to the shutdown request. If the time expires, the system displays a dialog box that allows the user to forcibly shut down the application, to retry the shutdown, or to cancel the shutdown request. If the "Forces processes to terminate" option is enabled, the program sets flag EWX_FORCE and the system always forces applications to close and does not display the dialog box. When this flag is set, the system does not send the WM_QUERYENDSESSION and WM_ENDSESSION messages. This can cause the applications to lose data. Therefore, you should only use this flag in an emergency.

HostMonitor can reboot local Windows 9x/ME/NT/2000/XP system. In addition to the common action parameters, choose 1 of 4 reboot Methods:

• Logout - Shuts down all processes running in the current security context, logs the user off.
• Reboot - Shuts down the system and then reboots.
• Shutdown - Shuts down the system to a point at which it is safe to turn off the power.
• Poweroff - Shuts down the system and turns off the power. The system must support the power-off feature.

Force processes to terminate
During a shutdown or log-off operation, applications that are shut down are allowed a specific amount of time to respond to the shutdown request. If the time expires, the system displays a dialog box that allows the user to forcibly shut down the application, to retry the shutdown, or to cancel the shutdown request. If the "Forces processes to terminate" option is enabled, the program sets flag EWX_FORCE and the system always forces applications to close and does not display the dialog box. When this flag is set, the system does not send the WM_QUERYENDSESSION and WM_ENDSESSION messages. This can cause the applications to lose data. Therefore, you should only use this flag in an emergency.
When you reboot a local Windows 2000/XP system HostMonitor uses another flag: EWX_FORCEIFHUNG. This flag forces processes to terminate only if they do not respond to the WM_QUERYENDSESSION or WM_ENDSESSION message.

Event logging in Microsoft Windows NT/2000/XP provides a standard, centralized way for applications (and the operating system) to record important software and hardware events. The event-logging service stores events from various sources in a single collection called an event log.
The Log Event action form allows you to add or edit an action that will log a record to the Event Log. Entries in the event log can be viewed with the Event Viewer or used by the other software utilities that perform centralized alerting from the event log.
In addition to the common action parameters, the "Log Event" action has the following parameters:

Computer
The UNC (Universal Naming Convention) name of the server on which the event should be recorded (the target computer name must be prefixed by "\\"). Type the UNC or select the "<local computer>" item. You can use macro variables (e.g. %HostAddr%) in this field.

Log
Provide name of the log file. This can be the Application, Security, System log file, or a custom registered log file.

Event source
Select source of the events from drop down list. You can use macro variables (e.g. %CommentLine2%) in this field.

Event type
Choose type of the event to be logged. This parameter can have one of the following values:

• Error
• Warning
• Information

Executes an SQL query against the specified ODBC data source. In addition to the common action parameters, the «SQL Query » action has the following parameters:

ODBC data source
Choose one of ODBC data sources available on your system (if action should be performed by RMA, HostMonitor will show ODBC sources list retrieved by the agent on remote host).

Login
Specify user identifier, if necessary.

Password
Specify password, if necessary.

SQL Query
Specify SQL query to execute. Macro variables are supported in the query to be substituted with their actual values at the action execution time.

Timeout
Specify the number of seconds to wait for a login request to complete.

Sends HTTP request to the specified Web server. In addition to the common action parameters, the «HTTP request» action has the following options:

Host
This is the domain name or the IP address of the target web server (e.g. www.mywebserver.com).

Port
A valid TCP port number (a value between 1 and 65535).

Request
Provide data to send to the host. Macro variables are supported. Usually you will use GET or POST requests.
E.g. "GET http://www.myserver.com/cgi-bin/alert?%TestName%&%Status% HTTP/1.0"

Please note: "HTTP request" action applies URL encoding rules to macro variables. E.g. if test status is "Host is alive", %Status% variable will be translated to Host%20is%20alive.
Also, HostMonitor adds <cr><lf><cr><lf> (empty line) after each request (according to HTTP protocol).

Sends data to the specified host using TCP or UDP protocol. In addition to the common action parameters, the «Send data to TCP/UDP port» action has the following options:

Server
This is the domain name or the IP address of the target host.

Port
A valid port number (a value between 1 and 65535) is required for the connection to take place.

Protocol
Select the protocol to use: TCP or UDP.

Init packet (string) to send
Provide data to send to the host. In this field you can use regular text; macro variables; and sequences formatted %XX where XX is a hexadecimal code of a character (byte). E.g. define this parameter like: «%TestName% %0D%0A %Status% %0D%0A %DateTime%» to send 3 text lines with the information about the test, its status, and current time.

Wait for answer
Specify how many seconds HostMonitor should wait for an answer before sending Final packet.

Final packet (string) to send
Provide this parameter if you need to send two information packets with the pause between them to the host. The same as for the Init Packet parameter, in this field you can use regular text; macro variables; and sequences formatted %XX where XX is a hexadecimal code of a character (byte).

This action sends data using the Syslog protocol. Syslog is the standard event logging subsystem for Unix, also you can find Syslog Daemon for Windows (e.g. Kiwi Syslog Daemon). Syslog Daemon receives standard UDP Syslog messages sent from routers, switches, UNIX hosts, HostMonitor, other network devices and can displays the details on screen, log to files, terminal devices, etc. Syslog also allows you to forward log entries to another machine for processing, in this way syslog functions as a distributed error manager.
In addition to the common action parameters, the «Syslog» action has the following parameters:

Server
This is the name or IP address of the Syslog server.

Port
The default SNPP port is 514, but you can specify a non-standard port.

Message
Provide text message to send. Macro variables are supported in the message to be substituted with their actual values at the action execution time.

Severity
Log messages are prioritized by a combination of facility and urgency level. Levels (severity) can be considered various levels of a problem (e.g. warning, error, emergency) whereas facilities are considered to be service areas (e.g. printing, email, network, etc). The levels available are the following:

-	Emergency	A panic condition. System is unusable.
-	Alert	A condition that should be corrected immediately, such as a corrupted system database.
-	Critical	Critical conditions, e.g., hard device errors.
-	Error	Errors.
-	Warning	Warning messages.
-	Notice	Conditions that are not error conditions, but should possibly be handled specially.
-	Info	Informational messages.
-	Debug	Messages that contain information normally of use only when debugging a program.

Facility
Facility is a number that considered as a service area. The various facilities are listed below:

0	kernel messages
1	user-level messages (messages generated by random user processes)
2	mail system
3	system daemons
4	security/authorization messages
5	messages generated internally by syslogd
6	line printer subsystem
7	network news subsystem
8	UUCP subsystem
9	clock daemon
10	security/authorization messages
11	FTP daemon
12	NTP subsystem
13	log audit
14	log alert
15	clock daemon
16-23	reserved for local use

Sets data on the local or remote system using the SNMP protocol. The Simple Network Management Protocol is the Internet standard protocol for exchanging management information between management console applications and managed entities (hosts, routers, bridges, hubs, etc). Using this protocol HostMonitor can change settings of your network devices.
In addition to the common action parameters, the «SNMP Set» action has the following parameters:

Agent address
Provide address of the target system. Specify either a dotted-decimal IP address or a host name that can be resolved to an IP address, an IPX address (in 8.12 notation), or an Ethernet address. You can use macro variables (e.g. %HostAddr%) in this field.

Community
Specify the SNMP community name used when communicating with the device specified in the Agent Address parameter. By default on SNMP systems this is "PUBLIC" but it can be different on your systems.

Timeout
This is the amount of time in seconds the program will wait for a response from the server before the request fails.

Retries
Specify the communications retries count.

OID
The name that uniquely identifies the object, the value of which you have to change. For example OID "1.3.6.1.2.1.2.1" represents the number of network interfaces on which system can send/receive IP datagrams; OID "1.3.6.1.2.1.6.9" represents the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT; etc. To get a list of valid OIDs for your SNMP enabled devices you should contact the vendor of the device. They should be able to give you a MIB file that contains all the OIDs for the device.

Set value
Define a new value for the object that HostMonitor has to set (please note some object can be read-only). Use "Get current value" button to retrieve current value of the object.

Sends a message to the Management Station using the SNMP protocol. The SNMP (Simple Network Management Protocol) is the Internet standard protocol for exchanging management information between management console applications and managed entities (hosts, routers, bridges, hubs, etc).
In addition to the common action parameters, the "SNMP Trap" action has the following parameters:

Destination address
Enter the domain name or IP address of the machine that will receive SNMP Trap messages. This machine should be running a SNMP console in order to receive the trap message. You can use macro variables (e.g. %HostAddr%) in this field.

Agent address
Provide IP address of the agent that generated the SNMP Trap. If you keep default value "localhost", HostMonitor will use IP address of the system where it is running. You can use macro variables (e.g. %HostAddr%) in this field.

Community
Specify the SNMP community name used for this trap. The default community for most systems is "public". The community string must match the community string used by the SNMP console.

Enterprise
Identifies the type of the object causing the trap. You can use macro variables (e.g. %CommentLine1%) in this field.

Trap type
Choose one of the generic trap types:

• Cold Start
• Warm Start
• Link Down
• Link Up
• Authentication Failure
• EGP Neighbor Loss
• Enterprise Specific

• NULL
• INTEGER
• OCTET STRING
• OBJECT IDENTIFIER
• IP ADDRESS
• UNSIGNED32
• COUNTER
• GAUGE32
• TIMETICKS
• OPAQUE
• COUNTER64

This action allows establishing dial-up connection to a network. E.g. HostMonitor can establish backup connection in case of primary channel malfunction. In addition to the common action parameters, the «Dial-up to the network» action has the following options:

Dial-up connection
Select from drop down list the remote access entry to establish the connection.

User name
Specify the user's name. This parameter is used to authenticate the user's access to the remote access server. If the user name is empty string (""), HostMonitor uses the user name of the current logon context for authentication. For a user-mode application, RAS uses the credentials of the currently logged-on interactive user. For a Win32 service process, RAS uses the credentials associated with the service.

Password
Specify the user's password. This parameter is used to authenticate the user's access to the remote access server. If the password is empty string (""), HostMonitor uses the password of the current logon context for authentication. For a user-mode application, RAS uses the credentials of the currently logged-on interactive user. For a Win32 service process, RAS uses the credentials associated with the service.

Save password
This option has sense only if Password parameter is not an empty string. Specifies whether to save the password (in the phone-book entry) for the user indicated by User Name parameter or not. If "Save password" option is disabled, the password will be removed. Disabling option is equivalent to checking the "Unsave Password" checkbox in Dial-Up Networking dialog.

Show dial-up dialog
With this option enabled HostMonitor will display a popup window when establishing the connection, and will display dial-up process information in it.

Retries
Set the number of times the dial-up connection is automatically redialed if the first attempt to connect fails.

Purpose of this action is to drop the specified dial-up connection (e.g. in case if the main channel will restore its functioning). In addition to the common action parameters, the «Disconnect from network» action has only one parameter:

Dial-up connection
Select from drop down list the remote access connection to terminate.

This action simply forces the program to perform the test one more time (not waiting until time of the test interval is elapsed). It does not have any extra parameters except common action parameters.

This action can be helpful in situations when the condition being checked is not stable. If, for some reason, the accuracy of the test is questionable, you can add this action into alert profile, and take the necessary measures based on the results of the follow-up test.

This action allows changing the test time interval. In addition to the common action parameters choose one of the options:

• Restore original value - restores the original test time interval that was defined by user using Test Propetries dialog
• Set to HH:MM:SS - set interval to the specific value
• Set to N% of the current value - increases or decreases the current test time interval by the specified amount of times.

Note: "Change test interval" action may set new interval for tests with irregular schedule as well. Action changes type of the schedule to "regular", keeps old type in memory so it can be restored by "Change test interval" action with "Restore original interval" option. However "Set to N% of the current value" option cannot be applied for tests with "irregular" schedule.

This is very flexible action because script file may contain various commands for the program and tests control. In addition to the common action parameters, the «Execute HMS script» action has only one parameter:
Script file - specify full path to the script file or click small button on right side and select file from the Open File dialog.

HostMonitor Script file (file extension .HMS) is a text file that contains commands for HostMonitor. You can create and edit script file using any text editor (e.g. notepad). Some examples when this action method can be useful:

1. Assuming that you have dynamically (real-time) database with list of servers to monitor. When database is changing HostMonitor can reload the list of tests or import new tests automatically. To implement this behavior add test to monitor changes in the database (e.g. "File Integrity" test or "ODBC Query" test), and add "Execute HMS script" action to the action profile that assigned to the test to run a script like:
   ExecuteProgram   10000   c:\database\generator.exe   c:\database\database.dbf   c:\HostMon\import1.txt
   NewTestList
   ImportFromFile   c:\HostMon\import1.txt
   SaveTestList   c:\HostMon\temp1.hml
   
   
2. Assuming that you need to monitor 200 web servers in the Internet, but your LAN uses just one router to access to the Internet. Of course if your router goes down, HostMonitor will start hundreds alerts. To avoid unnecessary alerts make next steps:
   - add ping test to check the router;
   - set interval for this test less than intervals for Internet tests (e.g. 30 sec for router and 5 min for each web server);
   - create 2 scripts: one for "Bad" action that will be executed when router will die, another for "Good" action that will be executed when router will restore operability.
   "Bad" script:
   DisableTest _AllTCP
   DisableTest _AllURL
   "Good" script:
   EnableAllTests
   
   If you use HostMonitor version 3.0 or higher, this is not a topical example. You do not need to disable/enable tests, you can just assign router ping test as a Master test for all web tests.

• You can put only one command in each line
• Comments: The program ignores all strings with a semicolon (;) as the 1st character
• Commands: commands are case insensitive (e.g. "LoadTestList" and "LOADTESTLIST" means the same)
• Parameters: parameters are case sensitive
• HostMonitor version 3.0 or higher supports macro variables (%HostName%, %Comment%, %Folder%, etc.). Please note:
  - if script is launched as a result of a test performance, the test's parameters are used for macros;
  - if script is launched manually (using menu File->Execute Script), parameters of the selected test are used for the macros (if no test is selected, macros are not translated)

 NewTestList
 LoadTestList    c:\list1.hml
 AppendTestList  c:\list2.hml
 ImportFromFile  c:\import1.txt  SkipDuplicates  WriteLog
 SaveTestList    c:\list3.hml

  _AllGood
  _AllBad
  _AllUnknown
  _AllWarning

  _AllPing        _AllFreeSpace       _AllProcess
  _AllTCP         _AllFolderSize      _AllService
  _AllURL         _AllFileExists      _AllNTLog
  _AllUNC         _AllFileContents    _AllCPU

  _AllInterbase   _AllPostgre         _AllDLL
  _AllMsSQL       _AllSybase          _AllODBC
  _AllMySQL       _AllSNMP            _AllSMTP
  _AllOracle      _AllExternalPrg     _AllPOP3

  _AllIMAP        _AllCountFiles      _AllUDP
  _AllDNS         _AllRAS             _AllNTP
  _AllLDAP        _AllPerfCounter     _AllRadius
  _AllTrace       _AllScript          _AllHTTP

  _AllTextLog     _AllTemp            _AllSNMPTrap
  _AllShell       _AllTraffic         _AllMailRelay
  _AllWMI         _AllDICOM           _AllDominantProcess
  _AllDHCP  
  

  SetCurrentFolder  Root
  IncludeSubfolders yes

  DisableTest  _AllTCP
  EnableTest   _AllPing
  RefreshTest  _AllUnknown

  RefreshTest  my router
  EnableTest   server1

  SetCurrentFolder   Root\Asia\Ping tests
  IncludeSubFolders  no
  SetTestParam       _AllPing  Timeout        2000
  SetCurrentFolder   Europe
  IncludeSubFolders  yes
  SetTestParam       _AllCPU   UserName       test1
  SetTestParam       _AllCPU   Password       pswd1
  SetTestParam       _AllRAS   Comment        my long ^M multulines ^M comment
  SetTestParam       _AllRAS   CommentLine02  address: 465 Lansdown Ave
  SetTestParam       _AllRAS   CommentLine03  phone: 567-9871
  ReplaceTestParam   _AllTCP   timeout        2000   5000

When defining some of the alert action's parameters you can use special macro variables. There are 6 groups of macro variables:

1. variables that represent parameters of the same test that had triggered an action
2. variables that represent parameters of some explicitly specified test
3. folder-related variables
4. HostMonitor status related macro variables
5. user defined variables (also known as global macro variables)
6. date & time variables

1. Variables that represent parameters of the same test that had triggered an action
   
   

   Macro variable	Description
   Test properties
   %TestName%	The name of the test. Has the same value as %HostName%, which has been retained for backward compatibility
   %HostName%	Represents the name of the test (obsolete, retained for backward compatibility. Please, use %TestName% macro instead)
   %HostID%	Represents all numbers in the name of the test. HostMonitor removes all characters from the test's name except decimal numbers and substitutes instead this macro. This macro can be useful when you need to send messages to numeric only pagers (beepers).
   %TestID%	Represents unique ID of the test. TestID is always unique within an HML file
   %Agent%	Represents a name of the remote agent that performs the test, this variable returns the string "HostMonitor" when the test is performed by HostMonitor
   %TestMethod%	Represents short description of a testing method
   %MethodID%	Returns integer number that represents test method (test that has triggered action execution) Ping TCP URL Disk free space  Folder size File Availability External DLL File Integrity Oracle UNC Interbase MS SQL MySQL PGSQL Sybase 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15  Process Service SNMP Get NT Event Log CPU Usage File Compare ODBC SMTP POP3 IMAP DNS LDAP Trace Count Files RAS Performance Counter 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31  Active Script UDP NTP Radius HTTP Text Log Shell Script Temperature Monitor Network Traffic SNMP Trap WMI Mail relay DICOM Dominant Process DHCP 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46
   %TestedObjectInfo%	Provides information about tested object, variable returns string value like 'MS SQL database "MainLog" on 192.168.10.15' or 'Win32 service "FAX" on 192.100.10.5'. This variable offers more information than %TestMethod% variable
   %Interval%	The time between two consecutive checks defined for the test (in hh:mm:ss format)
   %Interval_Sec% %Interval_Min%	Variables represent the period of time between two consecutive checks defined for the test in minutes and seconds correspondingly
   %ScheduleName%	Name of a schedule assigned to the test
   %AlertProfile%	Name of the action profile
   %AlertThreshold%	Represents condition to set "Bad" status. E.g. for Drive Free Space test this macro will represent minimum limit of free space defined for the test; for TCP test it will display timeout; for CPU Usage test it will show maximum limit for CPU usage value.
   %MasterTest%	Master test name
   %MasterTests%	Returns list of master tests (items separated by CRLF characters). If test item depends on single master test or does not depend on any test, %MasterTests% and %MasterTest% variables are equivalent
   %PrivateLog%	The specified private log file name
   %RelatedURL%	Related URL
   %TaskComment%	Test's comment (whole comment, all lines separated by CRLF)
   %CommentLine1%	Represents 1st line of test's comment
   %CommentLine2%	Represents 2nd line of test's comment
   ...	...
   %CommentLine99%	Represents 99th line of test's comment
   %CommentID%	This macro is similar to %HostID%, but uses a test's comment instead the test's name.
   %CreatedTime%	The time when the test was created
   %ModifiedTime%	The time when the test was last modified
   Current test state
   %DATE%	Current date
   %TIME%	Current time
   %DateTime%	Current date and time
   %LastTestTime%	Time when the test was last performed
   %Reply%	Represents reply value (depends on the test type, it can be reply time, disk's free space, message from NT Event Log, etc)
   %Reply_CStyle%	Represents Reply field with some characters replaced by special sequences conforming to C language standards: - characters ASCII 13 (line feed) and ASCII 10 (new line) replaced with \r and \n correspondingly; - characters ASCII 9 (tab) replaced with \t - characters ASCII 39 (quotation mark) replaced with \' - character ASCII 92 (back slash) replaced with \\ - and so on this variable could be useful for writing Java scripts (e.g. for Custom HTML report) or SQL Query for ODBC log.
   %Reply_Number%	Represents actual numeric value of Reply field as a real number. E.g. for the Reply field containing '12.01 Kb', %Reply_Number% will return '12298.24'. It returns zero when the content of the field is a string that can not be converted into a number
   %Reply_Integer%	Represents actual numeric value of reply field as an integer number. E.g. for the Reply field containing '12.01 Kb', %Reply_Integer% will return '12298'. It returns zero when the content of the field is a string that can not be converted into a number
   %Status%	Status of the test (text)
   %StatusID%	A 2 digits number that represents status of the test 00- Not tested 01- Host is alive 02- No answer 03- Unknown 04- Unknown host 05- Checking 06- Resolving 07- Ok 08- Bad 09- Disabled 10- Bad contents 11- Wait for Master 12- Out of schedule 13- Paused 14- Warning 15- Normal
   %SimpleStatus%	This macro may return one of the following text values: "UP" for good statuses (Host is Alive, Ok); "DOWN" for any bad status (No answer, Bad, Bad Contents); for Warning status when "Treat Warning as Bad" option is enabled; for Unknown status when "Treat Unknown as Bad" option is enabled "UNKNOWN" if status of the test is "Unknown" or "Unknown host" and "Treat Unknown as Bad" option is disabled; variable also returns "UNKNOWN" for statuses like WaitForMaster, OutOfSchedule, Paused "WARNING" when status of the test is "Warning" and "Treat Warning as Bad" option is disabled
   %CurrentStatusIteration%	The number of consecutive test probes resulting in the same status as the current one
   %Recurrences%	Similar to %CurrentStatusIteration% but this counter is resetted by HostMonitor when test status changes from "bad" to "good", from "good" to unknown or warning and vice versa. While changes between "Ok", "Host is alive" and "Normal" statuses do not reset the counter, changes between "Bad" and "No answer" do not reset the counter either. "Threat Unknown status as Bad" and "Treat Warning status as Bad" options determine behaviour of the counter for Unknown and Warning statuses. In other words: %CurrentStatusIteration% relates to %Status% while %Recurrences% relates to %SimpleStatus% This is important counter, you probably will use this counter for "advanced" actions.
   %CurrentStatusDuration%	Represents the duration of current (simple) status of the test, shows time interval in "[N days] HH:MM:SS" format
   %CurrentStatusDuration_sec%	Represents the duration of current (simple) status of the test, shows time in seconds
   The following variables may be used in the expressions that define Normal and Warning statuses (see Optional status processing section of the manual). These variables may be used as parameters of some actions as well, but usually this does not have sense.
   %SuggestedStatus%	Status that will be used for the test item, unless "normal" or "warning" options modify the status. Variable may return one of the following values: Host is alive, Ok, No answer, Bad, Bad contents, Unknown or Unknown host
   %SuggestedSimpleStatus%	Similar to %SimpleStatus% but provides information about "suggested" status (test probe already responded with some result but %Status%, %Reply% and other regular counters not modified yet)
   %SuggestedReply%	Represents reply value
   %SuggestedRecurrences%	Similar to %Recurrences% counter. Difference is HostMonitor sets this variable before Normal and Warning expressions processing. If you do not use optional status processing or both logical expressions return False, then %Recurrences% will be equivalent to %SuggestedRecurrences%
   %FailureIteration%	The number of consecutive failed test probes. Shows 0 when test returns "good" result. In contrast to other counters (like %Status%, %Recurrences%, %CurrentStatusIteration%, %FailedCnt%, etc) that depend on result of optional status processing (Normal and Warning expressions), this counter always tells you about REAL result of test probe. E.g. when test returns "bad" status, HostMonitor increments this variable even if "Use normal status..." option tells HostMonitor to change test status to Normal. See processing sequence for details
   Acknowledgement
   %AcknowledgedAt%	Represents the date and time when test status was acknowledged
   %AcknowledgedDate%	Represents the date when test status was acknowledged
   %AcknowledgedTime%	Represents the time when test status was acknowledged
   %AcknowledgedBy%	Shows the name of the operator who have acknowledged the test status
   %AckComment%	Shows the comment which was provided for "acknowledge" operation
   These 5 variables return empty string for non-acnowledged test items.
   %AckRecurrences%	Represents the number of test probes which have returned similar (bad or unknown) result after it was already acknowledged. Returns 0 for non-acknowledged test items. For example if the test returned "bad" status during five consecutive probes, then %Recurrences% variable will be equal 5. If the user has acknowledged the bad status after the second probe then %AckRecurrences% will be equal 3 (5-2=3). This variable is useful when you want to configure alert profile to launch different actions for "non-acknowledged" and "acknowledged" test items. E.g. if condition to trigger action execution looks like ('%SimpleStatus%=='DOWN') and (%AckRecurrences%==1), HostMonitor will start action when user confirmed status and test failed once again (after acknowledgement).
   Previous state
   To explain following variables we need to explain difference between terms "PreviousStatus" and "LastStatus". "PreviousStatus" is status which test had before current status. "LastStatus" is status which test had after previous check. For example for the last 5 probes test had following statuses: #1-Bad, #2-Unknown, #3-Ok, #4-Ok, #5-Ok (current status is #5-Ok). In this case "PreviousStatus" is #2-Unknown but "LastStatus" is #4-Ok.
   %LastStatus%	Status of the test after previous check ("LastStatus")
   %LastSimpleStatus%	Similar to %SimpleStatus% but provides information about last test status
   %LastReply%	Reply value returned by previous check
   %LastReply_CStyle%	Represents "Reply" value returned by previous check with some characters replaced by special sequences conforming to C language standards: - characters ASCII 13 (line feed) and ASCII 10 (new line) replaced with \r and \n correspondingly; - characters ASCII 9 (tab) replaced with \t - characters ASCII 39 (quotation mark) replaced with \' - character ASCII 92 (back slash) replaced with \\ - and so on this variable could be useful for writing Java scripts (e.g. for Custom HTML report) or SQL Query for ODBC log.
   %PreviousStatus%	The status, which the test had before last status change
   %PreviousStatusTime%	Represents time when "PreviousStatus" was assigned to the test
   %PreviousStatusDuration%	Represents the duration of the "PreviousStatus". Shows time interval in "[X days] HH:MM:SS" format.
   %PreviousStatusDuration_Sec%	Represents the duration of the "PreviousStatus" in seconds.
   Statistical information
   %StatusChangedTime%	The time when the status last changed
   %StatusChangesCnt%	The number of times the status has changed
   %TotalTests%	Overall tests performed
   %TotalTime%	The time the test has been in monitoring
   %FailedCnt%	The number of "Bad" tests
   %PassedCnt%	The number of "Good" tests
   %UnknownCnt%	The number of "Unknown" tests
   %AliveTime%	The overall time the test has had a "Good" status
   %DeadTime%	The overall time the test has had a "Bad" status
   %UnknownTime%	The overall time the test has had an "Unknown" status
   %AliveRatio%	"Good" to overall tests ratio, in percent
   %DeadRatio%	"Bad" to overall tests ratio, in percent
   %UnknownRatio%	"Unknown" to overall tests ratio, in percent
   %AverageReply%	The average value of the results obtained
   %MinReply%	The minimum value of the results obtained
   %MaxReply%	The maximum value of the results obtained
   Test specific macro variables
   %HostAddr%	Represents the host name (or IP address) of the target system for the following tests: Ping, TCP, URL, HTTP, Oracle, Interbase, MS SQL, MySQL, Sybase, Postgre, Process, Service, NT Log, CPU Usage, SNMP, SMTP, POP, IMAP, DNS, DHCP, LDAP, UNC, UDP, NTP, RADIUS, Temperature Monitor, Traffic Monitor, Dominant Process
   following variables have sense for "Service" test only, for other tests these macros return an empty string
   %ServiceComp%	The name of the target computer
   %ServiceName%	The name of the service
   following variables have sense for "Trace" test only, for other tests these macros return an empty string
   %TraceBrief%	Route to the host. Contains IP addresses only
   %TraceFull%	Route to the host. Contains hop number, IP address, and reply time for each hop
   the following variables have sense for "URL" and "HTTP" tests only, for other tests this macro returns an empty string
   %HostURL%	Represents URL used for the test
   %HttpPage%	Represents contents of the monitored web page (first 32768 (32K) characters of the web page if test was performed by HostMonitor; first 2048 (2K) characters of the page if test was performed by RMA). Variable may be empty if you setup URL test item to check HTTP response only, without checking content or CRC of the page. HTTP test returns an empty string if a HEADER request is used. It also returns an empty string when a monitored web server does not respond.
   the following variables provide information about result of "HTTP" test
   %HttpHeader%	Complete HTTP header received from the server
   %HttpCode%	HTTP status code received from the server. Also this variable may return winsock error codes in case web server is not accessible (e.g. you have specified incorrect server name)
   the following variables provide information about the results of DNS tests
   %DnsResult%	Provides information about all entities received from DNS server (items separated by CRLF characters)
   %DnsResults%	Provides information about 1st entity only
   the following variables provide information about the file detected by Folder/File Availability test method
   %FileName%	Name of the file (variable is useful when you setup the test using wildcards in filename)
   %FileSize%	Size of the file
   %FileTime%	Modification time
   the following variables have sense for "NT Event Log" test only, they represent parameters of the last "Bad" event detected:
   %NTEventSource%	Event source. Identifies the software that logged the event