Tokens Available in LogicModule Alert Messages

Product Documentation

When defining alert messages or integrating alert data with external systems (e.g., ticketing or chat systems), tokens are available to customize the message or integration delivery to the current condition. These tokens are substituted at the time of generation so that the alert or integration delivery can include dynamic information.

The following article lists currently supported tokens and any available substitutions.

Note: Any tokens that reference dates and/or times are based on the time zone configured for the global LogicMonitor account (Settings > Account Information > Portal Settings). They are not based on the time zone configured in the alert recipient’s user account.

Token Types

Collector Down and Failover Tokens—Can be used in alert messages notifying you of a Collector down and failover to a backup Collector, if configured.
DataSource Tokens—Can be used in alert messages that originate from a datapoint defined by a DataSource.
Root Cause Analysis Tokens—Can be used in alert messages that undergo root cause analysis.
Website Tokens—Can be used in alert messages that originate from a monitored website.
JobMonitor Tokens—Can be used in alert messages that originate from a JobMonitor definition.
Cluster Alert Tokens—Can be used in alert messages that originate from a cluster alert (i.e., an alert that is triggered based on the status of a datapoint across multiple resources in a resource group).
EventSource Tokens—Can be used in alert messages that originate from an EventSource definition. The following types of EventSources have additional tokens available:
- Windows Event Log Tokens
- IPMI Event Tokens
- SNMP Trap Tokens
- Syslog Event Tokens
LM Integration Tokens—Can be used when integrating alert data with external systems, such as message tools or ITSM solutions.

Available Tokens

The following table lists the available alert message tokens, organized by LogicModule or function:

Token	Available For	Description
##<CUSTOMCOLLECTORPROPERTYNAME>##	Collector Down and Failover Tokens	Returns the value of any custom properties that are assigned to the Collector itself (not its host device). Property names cannot contain spaces or dashes.
##<DEVICEPROPERTYNAME>##	DataSource Tokens	Substituted with the value of the associated device or instance property (either a custom or a system property). Surround the property name in double hash marks to use as a token. Property names cannot contain spaces or dashes.
##ADMIN##	LM Integration Tokens	The user the alert was escalated to.
##AGENT_DESCRIPTION##	Collector Down and Failover Tokens	The name (description) of the Collector that has gone down.
##AGENT_DESCRIPTION##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The name (description) of the Collector that the device associated with the alert is assigned to
##AGENTID##	Collector Down and Failover	The ID of the Collector that has gone down.
##AGENTID##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The ID of the Collector that the device associated with the alert is assigned to
##ALERTDEPENDENCYROLE##	DataSource Tokens Root Cause Analysis Tokens	The role of the alert in the root cause incident.
##ALERTDETAILURL##	Cluster Alert Tokens Collector Down and Failover Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	The URL of the Alert Details page. From this page, the alert can be acknowledged, escalated, or put into SDT. By default, this URL is included at the top of all alert notifications sent via email or SMS.
##ALERTID##	Cluster Alert Tokens Collector Down and Failover Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	The LMDXXXX, LMSXXXX, etc. LogicMonitor alert ID. This ID is not unique per alert session. It is applied to all alerts triggered by a particular resource, website, LogicModule, instance, and datapoint combination.
##ALERTSTATUS##	DataSource Tokens	Reports whether the alert is active, clear, ack, update, or test.
##ALERTTYPE##	LM Integration Tokens	The type of alert: alert, eventAlert, batchJobAlert, hostClusterAlert, websiteAlert, agentDownAlert, agentFailoverAlert, agentFailBackAlert, alertThrottledAlert.
##AUTOFAILBACKENABLED##	Collector Down and Failover Tokens	Indicates whether the Collector that has gone down is configured to automatically resume operations when it becomes available again.
##BACKUPAGENT_DESCRIPTION##	Collector Down and Failover Tokens	The name (description) of the failover Collector (if configured) for the Collector that has gone down.
##BACKUPAGENT_DESCRIPTION##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The name of the failover Collector (if configured) for the primary Collector associated with the resource.
##BACKUPAGENTID##	Collector Down and Failover Tokens	The ID of the failover Collector (if configured) for the Collector that has gone down.
##BACKUPAGENTID##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The ID of the failover Collector (if configured) for the primary Collector associated with the resource.
##BJDESCRIPTION##	JobMonitor Tokens	The JobMonitor description.
##CHECKPOINT##	Website Tokens	The checkpoint associated with the alert. This value will be ‘Overall’ if the alert was triggered based on checks at multiple locations.
##CMDLINE##	JobMonitor Tokens	The job command line. Warning: If sensitive information is present in the command line, this token may expose that information in alert messages. LogicMonitor does not recommend using this token if sensitive information is present in the command line.
##COLLECTORGROUP##	Collector Down and Failover Tokens	The name of the Collector group to which the alerting Collector belongs.
##DATAPOINT##	Cluster Alert Tokens DataSource Tokens	The name of the Datapoint that is in alert.
##DATASOURCE##	Cluster Alert Tokens DataSource Tokens	The DataSource display name (not to be confused with ##DSNAME##, which resolves to the DataSource name). In the case of a multi-instance DataSource, this token resolves to the fully qualified instance name (<DATASOURCE DISPLAY NAME>-<INSTANCE NAME>)
##DATASOURCE##	EventSource Tokens	The EventSource that triggered the alert.
##DATASOURCE##	JobMonitor Tokens	The JobMonitor name.
##DATE##	EventSource (IPMI Event) Tokens	The date of the event, as reported by the IPMI event log.
##DATE##	Cluster Alert Tokens DataSource Tokens EventSource Tokens	The date the alert was sent.
##DATE##	JobMonitor Tokens	The date of the job execution.
##DEPENDENCYMESSAGE##	DataSource Tokens Root Cause Analysis Tokens	Represents all root cause details that accompany alerts that have undergone root cause analysis.
##DEPENDENTALERTCOUNT##	DataSource Tokens Root Cause Analysis Tokens	The number of alerts dependent on the current alert.
##DEPENDENTRESOURCECOUNT##	DataSource Tokens Root Cause Analysis Tokens	The number of resources dependent on the current alert.
##DETAIL##	Website Tokens	The details associated with the alert. For an alert notification at an individual location this will include the URL for the step that failed and the HTTP response for that step. For an overall alert this will include the number of checks that failed.
##DEVICEURL##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The URL link associated with the device. If not available, “null” is returned.
##DIRECTCAUSE##	DataSource Tokens Root Cause Analysis Tokens	The resources that are determined to be the direct cause of the current alert.
##DPDESCRIPTION##	DataSource Tokens	The description of the datapoint in the alert, from the DataSource definition (e.g., Percentage Used on the volume). If not available, “null” is returned.
##DSDESCRIPTION##	DataSource Tokens	The description of the DataSource in the alert (e.g., Monitors space usage on logical volumes). If not available, “null” is returned.
##DSDESCRIPTION##	JobMonitor Tokens	The JobMonitor description
##DSIDESCRIPTION##	DataSource Tokens	The description of the instance in the alert, as defined by Active Discovery or as manually set on the Instances tab of the Resource page. If not available, “null” is returned.
##DSNAME##	Cluster Alert Tokens DataSource Tokens	The DataSource name.
##DTALERTDESCRIPTION##	DataSource Tokens	When dynamic thresholds trigger an alert, this token returns the details of the dynamic threshold configuration that was exceeded (e.g., 100 percent of values of datapoint memory_usage_percentage for last 5 polls deviated from upper band or lower band by a factor of 2.00, triggering a warning alert). This token is automatically referenced as part of the value of the ##THRESHOLD## token.
##DURATION##	Cluster Alert Tokens DataSource Tokens EventSource Tokens	How long the alert has been in existence.
##END##	Cluster Alert Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	Displays the cleared date and time for alert clear messages.
##ENTERPRISEOID##	EventSource (SNMP Trap) Tokens	The ID of the Collector that sent the trap (v1 traps only).
##EVENTCODE##	EventSource (Windows Event Log) tokens	Windows event ID.
##EVENTSOURCE##	EventSource Tokens	The EventSource that triggered the alert.
##EXITCODE##	JobMonitor Tokens	Exit code of the job.
##EXTERNALTICKETID##	LM Integration Tokens	The ticket identifier, as created and returned by the external system.
##EXTERNALTICKETID##	Cluster Alert Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	A list of integration ticket Ids and the associated integration name for each.
##FACILITY##	EventSource (Syslog Event) Tokens	The syslog facility of the event.
##FINISH##	JobMonitor Tokens	The time the job finished.
##GENERALCODE##	EventSource (SNMP Trap) Tokens	The SNMP general code in the trap (v1 traps only).
##GROUP##	Cluster Alert Tokens DataSource Tokens EvenSource Tokens JobMonitor Tokens	Shows groups this host or resource is a member of.
##HOST##	DataSource Tokens EventSource Tokens JobMonitor Tokens	Substituted with the resource that is in the alert.
##HOSTDESCRIPTION##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The text description of the resource in the alert. If not available, “null” is returned.
##HOSTNAME##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The display name of the resource in the alert.
##INSTANCE##	DataSource Tokens	The name of the DataSource instance (e.g., “C:\”).
##INSTANCEGROUP##	DataSource Tokens JobMonitor Tokens	The name of the group to which the alerting instance belongs.
##INTERNALID##	LM Integration Tokens	Returns a unique alert ID (DSXXXXXXXX). This ID updates as alert severities change, even if severity change occurs within the same alert session. This token may be helpful in identifying and suppressing duplicate alert payloads that were incorrectly resent to your third-party event management system (usually as the result of a transmission timeout or failure).
##INTERNALID##	Cluster Alert Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	Returns a unique alert ID (DSXXXXXXXX). This ID updates as alert severities change, even if severity change occurs within the same alert session.
##LEVEL##	Cluster Alert Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	The severity of the alert.
##LIMITEDMESSAGE##	DataSource Tokens EventSource Tokens JobMonitor Tokens	DataSource – No Data \| Infinity \| value (double/int) EventSource & JobMonitor – The first 10 words of the generated message.
##LOGFILE##	EventSource (Windows Event Log) Tokens	The Windows event log file (System, Application, Security, etc.)
##MESSAGE##	LM Integration Tokens	The rendered text of the alert message. This token will also pass all relevant acknowledged information (e.g., the user that acknowledged the alert, ack comments, etc.).
##MESSAGE##	EventSource (IPMI Event) Tokens	The IPMI event log message.
##MESSAGE##	EventSource (Syslog Event) Tokens	The syslog message.
##MESSAGE##	EventSource (Windows Event Log) Tokens	The event log message.
##ORIGINATINGCAUSE##	DataSource Tokens Root Cause Analysis Tokens	The resources that are determined to be the originating cause of the current alert.
##ROUTINGSTATE##	DataSource Tokens Root Cause Analysis Tokens	The status of the current alert’s notification routing.
##SOURCENAME##	EventSource (Windows Event Log) Tokens	The Windows source subsystem (e.g., Microsoft-Windows-DistributedCOM)
##SPECIFICCODE##	EventSource (SNMP Trap) Tokens	The specific code in the trap (v1 traps only).
##START##	Cluster Alert Tokens Collector Down and Failover Tokens DataSource Tokens EventSource Tokens JobMonitor Tokens Website Tokens	The time the alert condition started.
##STARTEPOCH##	DataSource Tokens EventSource Tokens JobMonitor Tokens	The time (in unix epoch time) when this alert started. Useful for creating unique alert identifiers.
##STDERR##	JobMonitor Tokens	Standard error returned by the job.
##STDOUT##	JobMonitor Tokens	Standard out returned from the job.
##SYSUPTIME##	EventSource (SNMP Trap) Tokens	The uptime of the SNMP Collector sending the trap.
##THRESHOLD##	DataSource Tokens	The alert threshold that triggered the alert. The value of the ##THRESHOLD## token incorporates the value of the ##DTALERTDESCRIPTION## token to ensure threshold details are provided for both static and dynamic thresholds, when applicable.
##TIMESTAMP##	EventSource (IPMI Event) Tokens	The time of the event in the system event log in epoch format.
##TRAPOID##	EventSource (SNMP Trap) Tokens	Trap identification for v2c traps.
##TYPE##	EventSource (Windows Event Log) Tokens	The event level (error, information, etc.) as reported by Windows.
##URL##	Website Tokens	The default root URL that the Web Check is testing (as specified in the Default Root URL field found in the Web Check definition.
##USER##	EventSource (Windows Event Log) Tokens	The user associated with the event, if any, as reported by Windows.
##USERDATA##	JobMonitor Tokens	Other user data reported by the batch job.
##VALUE##	Cluster Alert Tokens DataSource Tokens	The value of the datapoint at the time the alert was generated.
##VALUE##	EventSource Tokens	The entire event message (the complete windows event log event, or complete IPMI event log, or SNMP trap contents)
##VALUE##	Website Tokens	For an overall alert this will reference the number of checks that failed. For an alert at an individual location, this will reference why the step failed (e.g., doesn’t match HTTP response, doesn’t include correct content, etc.)
##WEBSITE##	Website Tokens	The name of the website in the alert.
##WEBSITEDESCRIPTION##	Website Tokens	The description associated with the website.
##WEBSITEGROUP##	Website Tokens	The group the website is in.
##WEBSITEREQUEST##	Website Tokens	The full request sent at the time the alert was generated. This will function when alerting is configured for individual checkpoints, not for an overall status.
##WEBSITERESPONSE##	Website Tokens	The full response received at the time the alert was generated. This will function when alerting is configured for individual checkpoints, not for an overall status.
##WILDVALUE##	DataSource Tokens	The instance value.

Platform

Solutions

By Initiative

By Industry

About us

Get to know us

Services

Resources

Learn

Documentation

Support