$error_string for custom error messages

Setting Custom event messages
A VA2 Analyis Rule, properly configured, will generate an event if the rule associated with it returns a false value. The event fields are dictated by the Error Definition associated with the Analysis Rule.

The Event String property of an event can be customized. This can give administrators aditional information when an event is generated, and the property can be dynamically generated. In the picture below you can see the Event String property for events.

In a VA2 Analyis Rule, you can set a variable $error_string to create the Event String parameter of an event. There is a 254 Chr. Limit on error strings. For example:


$error_string = "Special event string"
$retval = 0;

This rule, as long as an error definition, would generate an event and you would be emailed a "Special event string" along with the event error.