POST /events/monitors

Use this method to create an event forwarder.

You can create and enable up to 20 event forwarders to send events to specific recipients.

To forward email to a web-based email service (such as Gmail, Hotmail, or Yahoo), your SMTP server must support forwarding web mail.

Before setting up an event forwarder to a Gmail web service, review information in Setting up event forwarding to syslog, remote SNMP manager, or email.

Authentication

Authentication with username and password is required.

Request URL

POST https://{management_server_IP}/events/monitors

Query parameters

None

Request body

The attributes vary depending on the type of recipient.

Azure Log Analytics recipients
Email recipients
FPT recipients
REST recipients
SNMPv1 and SNMPv3 recipients
Syslog recipients

Table 1. Azure Log Analytics.
Attributes				Required / Optional	Type	Description
description				Optional	String	Description for the event forwarder
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values. true. The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server.
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
name				Required	String	User-defined name for the event forwarder. This name must be unique for all event forwarders.
outputFormat				Optional	String	Output format of the forwarded event Text between double square brackets are the fields that which are replaced with actual values. For a description of each field, use GET /events/monitors?format=formatKeys.
port				Optional	String	TCP/UDP port used for the connection. For Azure Log Analytics, this value is always 443.
primaryKey				Required	String	Primary key of the log-analytics device that is obtained from the Azure portal.
protocol				Required	String	Type of event forwarder. For Azure Log Analytics, this value is always oms_log_analytics.
requestTimeout				Optional	Integer	Amount of time, in seconds, that an event forwarder has to forward events before the request times out By default, the time-out value is 30 seconds.
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-forwarding schedules
			calendar	Optional	String	Schedule name
			daysOfWeek	Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
			endingDate	Optional	String	Date when the schedule ends
			endTime	Optional	String	Time when the schedule ends
			id	Optional	Integer	Schedule ID
			initialEndTime	Optional	String
			initialStartTime	Optional	String
			repeatable	Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
			seriesId	Optional	Integer	Schedule index
			startingDate	Optional	String	Date when the schedule starts
			startTime	Optional	String	Time when the schedule starts
			summary	Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.
workspaceID				Required	String	Workspace ID of the log-analytics device that is obtained from the Azure portal.

The following example creates an event forwarder for Azure Log Analytics.

{
   "description": null,
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY", "GENERAL"],
         "componentIDs": ["FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", "3B3C5CBDBE81446D9F27035A28E75745"],
         "sourceIDs": ["FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", "3B3C5CBDBE81446D9F27035A28E75745"],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "UNKNOWN"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "SWITCH"
         }]
      }
   },
   "forwardHidden": false,
   "ignoreExcluded": false,
   "ipAddress": "3268497b-7842-4a00-a9b8-8128e125e916.ods.opinsights.azure.com",
   "name": "Azure Log Analytics Forwarder",
   "outputFormat": "{\"Msg\":\"[[EventMessage]]\",\"EventID\":\"[[EventID]]\",
                     \"Serialnum\":\"[[EventSerialNumber]]\",\"SenderUUID\":\"[[EventSenderUUID]]\",
                     \"Flags\":\"[[EventFlags]]\",\"Userid\":\"[[EventUserName]]\",
                     \"LocalLogID\":\"[[EventLocalLogID]]\",\"SystemName\":\"[[DeviceFullPathName]]\",
                     \"Action\":\"[[EventAction]]\",\"FailFRUs\":\"[[EventFailFRUs]]\",
                     \"Severity\":\"[[EventSeverity]]\",\"SourceID\":\"[[EventSourceUUID]]\",
                     \"SourceLogSequence\":[[EventSourceLogSequenceNumber]],
                     \"FailSNs\":\"[[EventFailSerialNumbers]]\", \"FailFRUUUIDs\":\"[[EventFailFRUUUIDs]]\",
                     \"EventClass\":\"[[EventClass]]\",\"ComponentID\":\"[[EventComponentUUID]]\",
                     \"Mtm\":\"[[EventMachineTypeModel]]\",\"MsgID\":\"[[EventMessageID]]\",
                     \"SequenceNumber\":\"[[EventSequenceID]]\",\"TimeStamp\":\"[[EventTimeStamp]]\",
                     \"Args\":[[EventMessageArguments]],\"Service\":\"[[EventService]]\",
                     \"CommonEventID\":\"[[CommonEventID]]\",\"EventDate\":\"[[EventDate]]\",
                     \"LXCA\":\"[[LXCA_IP]]\"}",
   "port": "443",
   "primaryKey": "BA7qbCEy7tsTVJ0S3LMATXKXeoHrdPvOx4CfzcnsgM3qKYjZgph64oIKWH9FuSO1xakjmasW0VGeNAUiGSomuQ==",
   "protocol": "Azure Log Analytics_log_analytics",
   "requestTimeout": 30,
   "scheduler": {
      "enabled": false,
      "events": [],
      "showSummary": false
   },
   "workspaceID": "3268497b-7842-4a00-a9b8-8128e125e916"
}

Table 2. Email service using SMTP.
Attributes				Required / Optional	Type	Description
authenticationEmail				Optional	String	Authentication type. This can be one of the following values. Regular. Authenticates to the specified SMTP server using the specified user ID and password. NTLM. Uses the NT LAN Manager (NTLM) protocol to authentication to the specified SMTP server using the specified user ID, password, and domain name. OAUTH2. Uses the Simple Authentication and Security Layer (SASL) protocol to authenticate to the specified SMTP server using the specified user name and security token. Typically, the user name is your email address. Attention The security token expires after a short time. It is your responsibility to refresh the security token. None. No authentication is used.
connectionEmail				Optional	Array of strings	Connection type to secure connection to the SMTP server. This can be one of the following values. SSL. Use the SSL protocol while communicating. TLS. (default) Uses TLS to form a secure communication over an unsecure channel.
description				Optional	String	Description for the event forwarder
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values: true. (default) The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server.
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
name				Required	String	User-defined name for the event forwarder. This name must be unique for all event forwarders.
outputFormat				Optional	String	Output format of the forwarded event Text between double square brackets are the fields that which are replaced with actual values. For a description of each field, use GET /events/monitors?format=formatKeys.
port				Optional	String	TCP/UDP port used for the connection. For email, this value is always 25.
protocol				Required	String	Type of event forwarder. For email, this value is always email_alert.
recipients				Required	Array of strings	List of email addresses for the event forwarder, in the format `userid@domain` (for example, `XClarity1@company.com`)
requestTimeout				Optional	Integer	Amount of time, in seconds, that a event forwarderhas to forward events before the request times out By default, the time-out value is 30 seconds.
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-fowarding schedules
			calendar	Optional	String	Schedule name
			daysOfWeek	Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
			endingDate	Optional	String	Date when the schedule ends
			endTime	Optional	String	Time when the schedule ends
			id	Optional	Integer	Schedule ID
			initialEndTime	Optional	String
			initialStartTime	Optional	String
			repeatable	Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
			seriesId	Optional	Integer	Schedule index
			startingDate	Optional	String	Date when the schedule starts
			startTime	Optional	String	Time when the schedule starts
			summary	Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.
senderDomain				Optional	String	Sender domain (for example, company.com). If you do not specify the senderDomain or senderUserName, this is `LXCA.{source_identifier}@{smtp_host}` by default. If you specify the senderDomain but not senderUserName, the format of the sender address is `{LXCA_host_name}`@`{sender_domain}` (for example, `XClarity1@company.com`).
senderUserName				Optional	String	Sender name
subjectFormat				Optional	String	Email subject For a description of fields that can be specified in the subject format, use GET /events/monitors?format=defaultFormat.
useSupportContact				Optional	Boolean	Indicates to use the email address that is defined for the support contact that is assigned to the device. This can be one of the following values. true. Email forwarder uses the email address for the support contact. false. (default) Email forwarder uses the email addresses that are specified in the recipients attribute.

The following example creates an event forwarder for email services.

{
   "authenticationEmail": "none",
   "connectionEmail": ["SSL"],
   "description": "",
   "enable": "true",
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY","STATUS_CHANGE","STATUS_UPDATE","GENERAL"],
         "componentIDs": [],
         "eventID": "",
         "eventServices": ["none","support","user"],
         "excludedEventIDs": "",
         "negateFilter": false,
         "sourceIDs": [],
         "resourceGroupsUUIDs": [],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "UNKNOWN"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "AUDIT"
         }]
      }
   },
   "forwardHidden": false,
   "ignoreExcluded": false,
   "ipAddress": "192.0.2.20",
   "matchEverything": true,
   "name": "Email Forwarder",
   "port": "25",
   "protocol": "email_alert",
   "recipients": "user1@company.com",
   "requestTimeout": 30,
   "scheduler": {
      "enabled": false,
      "events": [],
      "showSummary": false
   },
   "senderDomain": "company.com",
   "senderUserName": "LXCA1",
   "subjectFormat": "[[DeviceIPAddress]]-[[EventSeverity]]-[[EventMessage]]",
   "useSupportContact": false
}

Table 3. FTP server.
Attributes				Required / Optional	Type	Description
authPasswordChanged				Optional	Boolean	Indicates a request to change the password. This can be one of the following values. true. Change the password false. Do not change the password
authUser				Required if ftpAuthentication is set to Regular	String	Authentication user ID if authentication is used
authPassword				Required if ftpAuthentication is set to Regular	String	Authentication password if authentication is used
characterEncoding				Optional	String	Character set. This can be one of the following values. UTF-8. (default) Big5
charactersToRemove				Optional	String	Sequence of characters to be removed from the file content
description				Optional	String	Description for the event forwarder
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values. true. (default) The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ftpAuthentication				Optional	String	Authentication type. This can be one of the following values. Regular. Authenticates to the specified SMTP server using the specified user ID and password. This is the same as basic authentication. None. (default) No authentication is used. This is the same as anonymous authentication.
ftpFileName				Optional	String	File-name format to use for the file that contains the forwarded event. The default format is event_[[EventSequenceID]].txt. Note Each file contains information for a single event.
ftpPath				Required	String	Path on the remote FTP server where the file is to be uploaded
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
name				Required	String	User-defined name for the event forwarder. This name must be unique for all event forwarders.
outputFormat				Optional	String	Output format of the forwarded event Text between double square brackets are the fields that which are replaced with actual values. For a description of each field, use GET /events/monitors?format=formatKeys.
port				Optional	String	TCP/UDP port used for the connection. For FTP, this value is always 21.
protocol				Required	String	Type of event forwarder. For FTP, this value is always ftp.
requestTimeout				Optional	Integer	Amount of time, in seconds, that an event forwarderhas to forward events before the request times out. By default, the time-out value is 30 seconds.
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-fowarding schedules
			calendar	Optional	String	Schedule name
			daysOfWeek	Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
			endingDate	Optional	String	Date when the schedule ends
			endTime	Optional	String	Time when the schedule ends
			id	Optional	Integer	Schedule ID
			initialEndTime	Optional	String
			initialStartTime	Optional	String
			repeatable	Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
			seriesId	Optional	Integer	Schedule index
			startingDate	Optional	String	Date when the schedule starts
			startTime	Optional	String	Time when the schedule starts
			summary	Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.

The following example creates an event forwarder for FTP servers.

{
   "charactersToRemove": null,
   "description": "",
   "enable": "true",
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY", "GENERAL"],
         "componentIDs": [],
         "eventID": "",
         "eventServices": [],
         "excludedEventIDs": "",
         "negateFilter": false,
         "sourceIDs": [],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "AUDIT"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "AUDIT"
         }],
      }
   },
   "forwardHidden": false,
   "ftpAuthentication": "None",
   "ftpFileName": "event_[[EventSequenceID]].txt",
   "ftpPath": "lxca_events",
   "ignoreExcluded": false,
   "ipAddress": "192.0.2.30",
   "matchEverything": true,
   "name": "FTP Forwarder",
   "port": "21",
   "protocol": "ftp",
   "requestTimeout": 30,
   "scheduler": {
      "enabled": false,
      "events": [],
      "showSummary": false
   }
}

Table 4. REST Web Services.
Attributes				Required / Optional	Type	Description
description				Optional	String	Description for the event forwarder
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values. true. (default) The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server.
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
name				Required	String	User-defined name for the event forwarder. This name must be unique for all event forwarders.
outputFormat				Optional	String	Output format of the forwarded event Text between double square brackets are the fields that which are replaced with actual values. For a description of each field, use GET /events/monitors?format=formatKeys.
port				Optional	String	TCP/UDP port used for the connection. For REST Web Services, this value is always 80.
protocol				Required	String	Type of event forwarder. For REST Web Services, this value is always rest.
requestTimeout				Optional	Integer	Amount of time, in seconds, that an event forwarder has to forward events before the request times out By default, the time-out value is 30 seconds.
restAuthentication				Optional	String	Authentication type. This can be one of the following values. basic. Authenticates to the specified server using the specified user ID and password. none. (default) No authentication is used.
restMethod				Optional	String	REST method. This can be one of the following values. POST. (default) PUT
restPath				Optional	String	Resource path on which the forwarder is to post the events (for example, /rest/test).
restProtocol				Optional	String	Protocol to use for forwarding events. This can be one of the following values. HTTP HTTPS. (default)
restRequestHeaders				Optional	Array of strings	REST header to use for forwarding events
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-fowarding schedules
			calendar	Optional	String	Schedule name
			daysOfWeek	Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
			endingDate	Optional	String	Date when the schedule ends
			endTime	Optional	String	Time when the schedule ends
			id	Optional	Integer	Schedule ID
			initialEndTime	Optional	String
			initialStartTime	Optional	String
			repeatable	Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
			seriesId	Optional	Integer	Schedule index
			startingDate	Optional	String	Date when the schedule starts
			startTime	Optional	String	Time when the schedule starts
			summary	Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.

The following example creates an event forwarder for REST Web Services.

{
   "description": "",
   "enable": "true",
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY", "GENERAL"],
         "componentIDs": [],
         "eventID": "",
         "excludedEventIDs": "",
         "eventServices": [],
         "negateFilter": false,
         "sourceIDs": [],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "AUDIT"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "AUDIT"
         }]
      }
   },
   "forwardHidden": false,
   "ignoreExcluded": false,
   "ipAddress": "192.0.2.40",
   "matchEverything": true,
   "name": "REST Forwarder",
   "port": "80",
   "protocol": "rest",
   "requestTimeout": 30,
   "restAuthentication": "NONE",
   "restMethod": "POST",
   "restPath": "lxca_events",
   "restProtocol": "HTTP",
   "scheduler": {
      "enabled": false,
      "events": [],
      "showSummary": false
   }
}

Table 5. Remote SNMPv1 or SNMPv3 manager.
Attributes				Required / Optional	Type	Description
authPasswordSet				Optional	String	Password string. This attribute is required if you specify authUser.
authProtocol					String	Authentication protocol. This can be one of the following value. MD5 SHA This attribute is required if you specify authUser.
authUser				Optional	String	Authentication user ID if authentication is used
community				Optional	String	(SNMPv1 only) The community password that is sent with every SNMP request to the device.
contactName				Optional	String	User-defined contact name for XClarity Administrator traps
description				Optional	String	Description for the event forwarder
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values. true. (default) The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server.
location				Optional	String	Location information, such as site, address, and geography
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
name				Required	String	User-defined name for the event forwarder . This name must be unique for all event forwarders.
outputFormat				Optional	String	Output format for the forwarded event
port				Optional	String	TCP/UDP port used for the connection. For SNMP, this value is always 162.
privacyPasswordSet				Optional	String	Privacy password. This attribute is required if encryption is used.
privacyProtocol				Optional	String	Privacy protocol. This can be one of the following value. AES DES This attribute is required if you specify privacyPassword.
protocol				Required	String	Type of event forwarder . For SNMP, this can be one of the following values. snmpv1. Events are forwarded to a remote SNMP manager using SNMPv1. snmpv3. Events are forwarded to a remote SNMP manager using SNMPv3. The trap formats for each event are defined in the lenovoMgrAlert.mib file.
requestTimeout				Optional	Integer	Amount of time, in seconds, that an event forwarder has to forward events before the request times out By default, the time-out value is 30 seconds.
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-fowarding schedules
			calendar	Optional	String	Schedule name
			daysOfWeek	Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
			endingDate	Optional	String	Date when the schedule ends
			endTime	Optional	String	Time when the schedule ends
			id	Optional	Integer	Schedule ID
			initialEndTime	Optional	String
			initialStartTime	Optional	String
			repeatable	Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
			seriesId	Optional	Integer	Schedule index
			startingDate	Optional	String	Date when the schedule starts
			startTime	Optional	String	Time when the schedule starts
			summary	Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.
version				Optional	String	Version of SNMP. This can be one of the following values. V1 V3

The following example creates an event forwarder for remote SNMP managers.

{
   "authPasswordSet": "false",
   "authProtocol": "NONE",
   "authUser": "",
   "community": "public",
   "contactName": "",
   "description": "",
   "enable": "true",
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY", "GENERAL"],
         "componentIDs": ["FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"],
         "sourceIDs": ["FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "UNKNOWN"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "SWITCH"
         }]
      }
   },
   "forwardHidden": false,
   "id": "SNMPv1:0",
   "ipAddress": "10.241.53.4",
   "location": "",
   "matchEverything": false,
   "name": "SNMP Forwarder",
   "port": "162",
   "privacyPasswordSet": "false",
   "privacyProtocol": "NONE",
   "protocol": "snmpv1",
   "requestTimeout": "500"
   "scheduler": {
      "enabled": false,
      "events": []
   },
   "version": "v1"
}

Table 6. Syslog.
Attributes				Required / Optional	Type	Description
communicationProtocol				Optional	String	Identifies the type of protocol that the syslog monitor uses to send messages. This can be one of the following values. TCP UDP. This is the default value.
description				Optional	String	Description for the event forwarder
dateFormat				Optional	String	Format for the timestamp in the syslog. This can be one of the following values. Default_Format. (default) The default format using local time, for example `Fri Mar 31 05:57:18 EDT 2017`. GMT. International standard (ISO8601) for dates and times, for example `2017-03-31T05:58:20-04:00`.
enable				Optional	Boolean	Indicates whether the event forwarder is enabled. This can be one of the following values. true. (default) The event forwarder is enabled. false. The event forwarder is disabled.
eventFilter				Required	Object	Information about the types of events to forward
	filter			Required	Object	Information about each event filter
		categories		Optional	Array of strings	Event categories. This can be one of the following values. BULLETIN. Sends notification about new bulletins. GENERAL. Sends notifications about audit events, based on the selected event classes and severities STATUS_CHANGE. Sends notifications about changes in status. STATUS_UPDATE WARRANTY. Send notifications about warranties.
		componentIDs		Optional	Array of strings	List of component IDs. If empty, all components are monitored.
		eventID		Optional	String	List of event IDs, separated by a comma, to be included
		eventServices		Optional	Array of strings	Service type. This can be one or both of the following values. none support user
		excludedEventIDs		Optional	String	List of event IDs, separated by a comma, to be excluded
		negateFilter		Optional	Boolean	Indicates whether to exclude events that match the specified filter. This can be one of the following values. true. Excludes (does not forward) events that match the specified filters. false. Includes (forwards) events that match the specified filters.
		resourceGroupsUUIDs		Optional	Array of strings	List of resource-group UUIDs to filter on
		sourceIDs		Optional	Array of strings	List of source IDs. If empty, all sources are monitored.
		typeSeverity		Required	Array of objects	Event severity and type. If both sourceIDs and componentsIDs are empty, all events that match the typeSeverity filter are forwarded.
			severity	Required	String	Event severity. This can be one of the following values. Unknown. The severity is unknown. Informational. Informational Warning. User can decide if action is needed. Minor. Action is needed, but the situation is not serious at this time. Major. Action is needed now. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result). Fatal. A non-recoverable error has occurred.
			type	Required	String	Event type. This can be one of the following values. Unknown Audit Cooling Power Disks. Storage Memory Processor System. Rack or tower server Test Adaptor. Adapter card Expansion. Expansion board IOModule. Flex System switch Blade. Flex System server Switch. switch
forwardHidden				Optional	Boolean	Specifies whether to forward hidden events. This can be one of the following values. true. Hidden events are forwarded. false. (default) Hidden events are not forwarded.
ignoreExcluded				Optional	Boolean	Specifies whether to disable the forwarding of excluded events. This can be one of the following values. true. Ignores excluded events. false. (default) Forwards excluded events.
ipAddress				Required	String	IPv4 or IPv6 address or hostname of the remote system that is the target to receive the events. For email, this is the SMTP server
name				Required	String	User-defined name for the event forwarder. This name must be unique for all event forwarders.
matchEverything				Optional	Boolean	Indicates whether the action is to be run against all managed devices. This can be one of the following values. true. The action is to be run against all managed devices false. The action is run against only the managed device that is specified by the target attribute.
outputFormat				Optional	String	Output format of the forwarded event Text between double square brackets are the fields that which are replaced with actual values. For a description of each field, use GET /events/monitors?format=formatKeys.
port				Optional	String	TCP/UDP port used for the connection. For syslog, this value is always 514.
protocol				Required	String	Type of event forwarder. For syslog, this value is always syslog.
requestTimeout				Optional	Integer	Amount of time, in seconds, that an event forwarderhas to forward events before the request times out By default, the time-out value is 30 seconds.
scheduler				Optional	Object	Information about times and days when you want the specified events to be forwarded to this event forwarder
	enabled			Required	Boolean	Indicates whether the schedule is enabled. This can be one of the following values. true. The schedule is enabled. Only events that occur during the specified time slot are forwarded. false. The schedule is disabled. Events are forwarded 24x7.
	events			Required	Array of objects	List of event-fowarding schedules
		calendar		Optional	String	Schedule name
		daysOfWeek		Optional	Array of strings	Days of the week. This can be one or more of the following values. 1. Monday 2. Tuesday 3. Wednesday 4. Thursday 5. Friday 6. Saturday 7. Sunday
		endingDate		Optional	String	Date when the schedule ends
		endTime		Optional	String	Time when the schedule ends
		id		Optional	Integer	Schedule ID
		initialEndTime		Optional	String
		initialStartTime		Optional	String
		repeatable		Optional	Boolean	Indicates whether the schedule is recurring. This can be one of the following values. true. The schedule is recurring. false. The schedule occurs only once.
		seriesId		Optional	Integer	Schedule index
		startingDate		Optional	String	Date when the schedule starts
		startTime		Optional	String	Time when the schedule starts
		summary		Optional	Boolean
	showSummary			Optional	String	Indicates whether the schedule summary is enabled. The summary includes the time slot for schedule and which schedules are repeatable. This can be one of the following values. true. The schedule summary is enabled. false. The schedule summary is disabled.

The following example creates an event forwarders for syslogs.

{
   "communicationProtocol": "UDP",
   "dateFormat": "Default_Format",
   "description": "",
   "enable": "true",
   "eventFilter": {
      "filter": {
         "categories": ["WARRANTY", "GENERAL"],
         "componentIDs": [],
         "eventID": "",
         "eventServices": [],
         "excludedEventIDs": "",
         "negateFilter": false,
         "sourceIDs": [],
         "typeSeverity": [{
            "severity": "INFORMATIONAL",
            "type": "AUDIT"
         },
         ...,
         {
            "severity": "FATAL",
            "type": "AUDIT"
         }]
      }
   },
   "forwardHidden": false,
   "ignoreExcluded": true,
   "ipAddress": "192.0.2.60",
   "matchEverything": true,
   "name": "syslog_forwarder",
   "port": "514",
   "protocol": "syslog",
   "requestTimeout": 30,
   "scheduler": {
      "enabled": false,
      "events": [],
      "showSummary": false
   }
}

Response codes

Code	Description	Comments
200	OK	The request completed successfully.
400	Bad Request	A query parameter or request attribute is missing or not valid, or the operation is not supported. A descriptive error message is returned in the response body.
401	Unauthorized	The user cannot be authenticated. Authentication has not been provided or has failed. A descriptive error message is returned in the response body.
500	Internal Server Error	An internal error occurred. A descriptive error message is returned in the response body.

Response body

Attributes			Type	Description
id			String	Event forwarder ID.

The following example is returned if the request is successful.

{
   "id": "AUG:SNMPv3:0"
}

Give documentation feedback

POST /events/monitors

Authentication​

Request URL​

Query parameters​

Request body​

Response codes​

Response body​