Creating and Editing Event Rules

The Edit Rule page

Select a rule from the rules list to open it for editing.

 

Available Event Rule Types

A rule is defined by the type of event that triggers it. Each rule has a single event type associated with it. When that event occurs, any rules associated with that event type are triggered. The following rule event types are available:

Event Type	Event Description
File Transfer Event	This event is triggered whenever a user uploads a file to the server or downloads a file from the server through an authenticated Cerberus account. This event is not generated for public share file downloads. There is a separate event for public file downloads.
IP Blocked Event	This event is triggered whenever the server adds an IP address to the block list.
User Account Blocked Event	This event is triggered whenever a user account is locked out because of a policy violation (too many failed login attempts).
User Disable Date Elapsed	This event is triggered whenever a user account is disabled because the disable date for the account has elapsed, or because the account has exceeded the last login time threshold.
Account Password Expiring Event	This event is triggered when an account password is set to expire. The number of days before expiration that this event is sent is based on the password expiration policy settings.
New Account Request Event	This event is triggered when a new account request is submitted through the HTTP/S web client.
Login Event	This event is triggered whenever a user logs on to the server.
Logoff Event	This event is triggered whenever a user logs off the server.
Directory Created Event	This event is triggered whenever a user creates a directory on the server.
File Deleted Event	This event is triggered whenever a user deletes a file or folder on the server.
File Move/Copy Event	This event is triggered when a file or directory is moved or copied by a user.
Upgrade Available Event	This event is triggered whenever the server detects that a new version of Cerberus FTP Server is available.
Public File Share Event	This event is triggered whenever a public file share link is generated for a file by a user. A public file share link is generated whenever a user uses the Share or Email button in the HTTPS web client to generate a new public link.
Public File Transfer Event	This event is triggered whenever a file is uploaded to a public folder on the server, or downloaded from the server using a public link.
Backup Server Synchronized	This event is triggered after the server attempts to synchronize settings to a backup server.
File Scanned Event	This event is triggered for each file in the result set from a Scheduled Event: Scan a Folder action.

 

Adding New Rule or Editing an Existing Rule

Add a New Event Rule Dialog

To add a new rule:

1. Go to the Event Rules page of the Event Manager
2. Click the New button at the top of the page. The Add a New Rule dialog will appear.
3. Select the Rule Type for your new rule option. The rule type will determine what server event triggers this rule.
4. Enter a name for your rule in the Rule Name edit box.
5. Press the Add New Rule button on the Add A New Rule dialog to save and add the new Event Rule. The event rule will be selected and ready for editing on the Event Rules page.

To edit an existing rule:

1. Go to the Event Rules page of the Event Manager
2. Select the name of the existing rule you wish to edit from the event rules table. The event rule should appear and be ready for editing below the rule list.

 

Changing the Name of a Rule

You can change the name of an existing rule by selecting it in the rules table. You can then modify the Rule Name under the Rule Summary section. After entering the new Rule Name, press the Update button attached to the Rule Name text field.

 

Adding Rule Conditions

You can add a new condition to an event rule by pressing the New button in the Matches these Conditions footer section. The new condition section will appear below the header.

 

The Event Conditions section of an Event Rule

 

A rule’s actions are carried out whenever that rule’s event trigger happens. For example, a Login Event rule will be triggered whenever a user logs into the server. Conditions (also called filters) can be placed on rules to further modify if an event matches a rule. For example, a Login Event rule can have a filter placed on it that requires the username of the user logging in to match a specific name or be in a list of names before the rule’s actions are invoked. There are three modes that influence how conditions or filters are applied.

Rule Matching Modes

The three rule matching modes are:

Rule Variables

Each event type has specific variables that can be used as part of a condition or action. A rule condition consists of a variable, a comparison operation to perform on that variable, and a set of values to compare the variable to. For example, an IP Blocked event has an {{IP}} variable associated with it that contains the IP address that was blocked. You can use the variable in a condition to help decide if the event should trigger the rule.

You can determine what rule variables are available for each event type by looking in the Rule Variables combo box, or by pressing Variables button in the Rule Summary header.

Condition Operations

A condition is basically a comparison operation of an event variable to a set of values. The comparison operations you can perform are detailed below:

• > (Greater than or Equal To)
• ≥ (Greater than)
• < (Less than)
• ≤ (Less than or Equal To)
• = (Equal To)
• != (Not Equal To)
• Contains
• Starts with
• Ends with
• Regular Express match

Once a comparison operation is selected, you can enter the values to compare to. There is a text field labeled “Values” below the comparisons select control that you use to enter values to compare the rule variable to. Multiple values can be entered by separating the values with a comma. Each value is checked, and if any are a match then the condition is considered fulfilled (or true).

Press the plus button next to the Values text box to add the new rule condition to the event rule.

The new event condition will appear at the bottom of the Event Conditions section.

 

Deleting an Event Condition

You can delete an existing event condition by pressing the red button next to the event condition.

 

Rule Actions

Rule actions are the operations the administrator wishes the server to carry out in response to server events that match their rule conditions. Event actions can be of two types:

1. Normal top-level actions that get executed sequentially, or
2. Failure actions that get executed whenever the event action they are associated with fails

Actions are normally executed one after the other, in a sequential order. Failure actions are always associated with a top-level action, and only get executed if the action they are associated with fails. The failure action is executed right after the action it is associated with.

Each top-level action has a “Stop on Failure” option. If the “Stop on Failure” option is checked, no further actions will be executed for the event rule if the action fails (other than any failure action associated with the top-level action).

 

The Event Rule Actions Section

 

Adding Rule Actions

When an event matches all of the conditions of a rule then the rule actions are carried out. The current rule actions allow an administrator to:

• Send an email message detailing the event that occurred
• Send an email session report of all user activity when a user logs off
• Launch an external process
• Perform a file copy, move, delete or directory create or delete operation
• Zip and unzip files
• Perform a user or group delete or disable
• Send an HTTP/S POST message to an endpoint
• Send a file to another server using FTP, FTPS, SFTP, or HTTP/S PUT
• Retrieve a file from another server using FTP, FTPS, SFTP, or HTTP/S GET

Each action can have optional parameters such as the email name and address to send a message to or the path from and path to for a file move or copy operation. In addition, rule variables can be specified as parameters for the external processes command line or file operation parameters. You can use a rule variable as a parameter and when the rule is actually triggered, the variable’s value will be substituted for the variable. You specify variables by enclosing the variable in double brackets, i.e. {{U}}.

 

To add a new Action to a Rule:

These instructions assume you have selected a rule for editing from the rules tables.

1. Go to the Perform these Actions section of the event rule.
2. Press the New button in the section footer. The new action section will appear below the ACTIONs header.
3. Select an action from the Action drop-down list (i.e., Email someone)
4. Select any secondary actions associated with that action (i.e, an email server for emailing someone)
5. New fields will appear below the Actions drop-down lists based on the action and secondary action selected
6. Fill in the details for that action (i.e., an email address)
7. If you for the rule action list to stop executing if this action fails then select the “Stop on Failure” option for the action.
8. Press the plus button to add the new action to the rule

The new event action will be added to the bottom of the Actions section. New actions will be added to the bottom of the list and will be executed in the order they appear in the list.

 

Editing an Existing Rule Action

You can edit an existing rule action by selecting the Action button to the left of the event action. Selecting the Action button will bring up a menu of available operations you can perform on the event action.

Select the Edit Action button from the menu that appears to have the action selected in the Actions section.

 

The Action editing menu on the Event Rules page

 

Deleting an Existing Rule Action

You can delete an existing rule action by selecting the Action button to the left of the event action.

Select the Delete button from the menu that appears to have the action deleted from the event rule.

 

Changing the order an action is executed

You change the existing execution order of event actions by selecting the Action button of the event action you wish to change.

Select the Move Action Up or Move Action Down to swap positions with the action above or below the selected action.

 

Creating a Failure Action

Each action can have a failure action associated with it. Failure actions are additional actions that only get executed whenever the action they are associated with fails. For example, you can add an “Email Someone” failure action to an action to email the administrator whenever the top-level action the failure actions is associated with fails. Or, you can try the action a second time as your failure action.

The same action options are available as failure actions as are available for top-level actions.

To create a failure action, create a new action as you normally would for a top-level action. Use the Move Up or Move Down action options to place the new failure action below the top-level action you wish it to be associated with.

Once the action you wish to associate as failure action is below the top-level action, select the “Assign as Failure Action” option from the Actions button next to the failure action. You will now see the action become indented under the top-level action, and the text “if fail then” appear in front of the failure action.

Removing a failure action

Removing a failure action just requires pressing the Action button associated with the failure action’s top-level action, and then selecting the “Detach Failure Action” option from the menu that appears.

Detaching a failure option from a top-level action will make the failure action a normal top-level action again. You can then move it around, re-assign it as a failure action of another top-level action, or delete it.