Notification rules

Every modification in the knowledge graph topology, or whenever possible scenarios are discovered or invalidated, events are generated within CogTL. Those events can be intercepted by notification rules to trigger notifications or actions.

A notification rule therefore consists of a set of triggers (the event interceptors), and a set of channels (what to do when an event has matched a trigger).

Triggers

A trigger is a very simple condition, that can be of one of the following types:

Trigger type	Description
An entity was created/updated/deleted	Match if any entity of the selected entity type (or a child type) is created/updated/deleted. An optional expression can be set to restrict the entities concerned
A relation was created/updated/deleted	Match if any relation of the selected relation type is created/updated/deleted
An object was tagged	Match if a specific tag is applied to or removed from an entity or relation
Factor value for an entity has changed	Match if the selected factor has changed for an entity. You can specify a limit and an operator (greater or smaller), and whether the condition applies to the absolute value of the factor, or to the difference. An optional expression can also be set to restrict the entities concerned
A possible scenario was created/updated/deleted	Match if a possible scenario of the specified type is discovered / altered / disappeared. A minimal temporal probability for this scenario can be specified

Channels

A channel is a way of dispatching the events that matched one of the triggers of the rule.

Channels can be of one of the following types:

Channel type	Description
Notifications in UI	The events will be sent to the "Notifications" dashlet, visible in the dashboard. Visibility of the event will be conditioned by the users roles - if they cannot see concerned entity types, they won't see the associated notifications.
A log file	A log file with a specified name. You can also define the formatter that will be used to format the event
E-mail addresses	The events will be sent by mail to recipients. The formatter can be selected. To be able to use this channel you need to define the SMTP connection params in System > Properties
A syslog server	The event is sent to a syslog server. You can define the host and port to use, and the formatter that will be used (generally, a key=value formatter will be used to allow automated parsing).
CogTL database	The event is archived in CogTL database, in order to be accessible through the History view.

Formatters

A formatter is a way to present the information contained in the event that was intercepted. The following formatters are available:

Formatter	Description
Simple text formatter	A simple way of presenting, in a human-readable manner, the events that occurred (typically for usage in e-mails)
Key=value records	Format all the pertinent elements of the event under the form key1=value key2="value with spaces" (the quotes are only present if needed), with a timestamp formatted as an ISO date/time. This is typically used for automated parsing by log aggregation systems, in log files or with syslog messages.