There isn't really a list of parameters for email templates, as the parameters are really just placeholders for dynamic text from your alerts. For example, I could call a parameter "TGIF" and map that to any alert field from my rule. That said, I think this is the blog post you're referring to: http://thwack.solarwinds.com/message/147581#147581.
We also have a KB article with similar information: SolarWinds Knowledge Base :: Creating Email Templates in the LEM Console
Let me know if you're looking for something different.
Email Templates, ahh, email templates. I put up a post on Thwack that might help - Email Notifications How-To.
The bottom line is the fields you see in the template are fields that you (or we) put there - and you can call them whatever you want. What you put IN them from the correlation depends on what information is important to you that corresponds to that info and gets substituted in when the email is sent. (Whew) Basically, it's pretty dynamic, so there isn't really a static list.
Check out the How-To and see if that helps, come back with any questions!
Edit to add: Phil and I collided mid-stream and basically said the same thing
I think I have it now
You are saying that $TGIF does not get assigned to a variable until the e-mail template is assigned to rule and at this point it can be assigned to any field that the alert in the rule exposes
Is that correct?
1 of 1 people found this helpful
Yes, I think so. I'll do a quick example to be sure...
If you create an email template with variables:
Then make the email body:
"$FIRST" from "$SECOND" at "$THIRD"
They are placeholders for data you want to bring in from the rule, so that when it fires you know exactly what happened. In the template they don't really mean anything, yet. We named ours with useful names that match the fields in the rules so that it would be easy to use the defaults, but you don't have to do that (that's why you see them with $DetectionTime and $EventInfo - those match default fields that we'd suggest using to make the email make sense).
If your rule is "tell me anytime someone fails to log on", your correlation would be:
And you want to be emailed who the user was trying to log on as, from where, and what time, you'd add an email action and in it you'd:
- Drag UserLogonFailure.DestinationAccount for $FIRST
- Drag UserLogonFailure.SourceMachine for $SECOND
- Drag UserLogonFailure.DetectionTime for $THIRD
What it does is it pulls the values in memory for that instance of the rule firing, places them into the template, mashes it up, and sends you an email. So your email would look something like:
"DOMAIN\User" from "workstation" at "2012-05-11 14:25:00"