--- title: "eventdefinitionconfig modify" slug: "eventdefinitionconfig-modify" updated: 2026-10-27T17:25:00Z published: 2026-10-27T17:25:00Z canonical: "docs.vastdata.com/eventdefinitionconfig-modify" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # eventdefinitionconfig modify This command configures [default and global action settings](/docs-5-3/docs/en/default-notification-actions) for events. To override actions for a specific event definition, use [eventdefinition modify](/docs-5-3/docs/en/eventdefinition-modify). ##### Usage ```plaintext eventdefinitionconfig modify [--smtp-host SMTP_HOST]                             [--smtp-port SMTP_PORT]                             [--smtp-user SMTP_USER]                             [--smtp-password SMTP_PASSWORD]                             [--smtp-enable-tls|--smtp-disable-tls]                             [--email-sender SENDER]                                                         [--email-subject SUBJECT]                             [--email-recipients RECIPIENTS]                             [--webhook-url URL]                             [--webhook-data PAYLOAD]                             [--webhook-method POST|GET|PUT|PATCH|DELETE]                             [--syslog-host SYSLOG_HOST]                             [--syslog-port PORT]                             [--syslog-protocol udp|tcp]                             [--syslog-enable-vms-audit|--syslog-disable-vms-audit]                             [--syslog-enable-shell-audit|--syslog-disable-shell-audit]                             [--syslog-enable-ipmi-audit|--syslog-disable-ipmi-audit]                             [-audit-logs-retention DAYS]                             [--disable-actions|--enable-actions]                             [--quota-email-suffix SUFFIX]                             [--quota-email-provider aggregated|ldap|ad]                             [--quota-email-interval INTERVAL]                             [--quota-email-hourly-limit LIMIT] ``` ##### Options | ` --smtp-host SMTP_HOST` | Sets the host name of the SMTP server from which to send alarm notification emails. Example: `--smtp-host mail.company.com` | | --- | --- | | ` --smtp-port SMTP_PORT` | Sets the port used by the SMTP server to send outgoing emails. | | `--smtp-user SMTP_USER` | Sets a user for SMTP host authentication. | | `--smtp-password SMTP_PASSWORD` | Sets the password for the SMTP user. | | `--smtp-enable-tls` | Enables sending alarm notification emails over a TLS connection. | | `--smtp-disable-tls` | Disables TLS for sending alarm notification emails (default). | | `--email-subject SUBJECT` | Optionally specifies a string that is used globally as the subject for all notification emails. By default, alarm info appears in the subject. Example: `--email-subject VAST Alarm` | | `--email-sender SENDER` | Specifies the sender email that appears in alarm notification emails. It is global for all alarm notification emails. Example: `--email-sender do_not_reply@company.com` | | `--email-recipients RECIPIENTS` | Sets default email recipients. These recipients receive notifications of all alarms except those triggered by events that have a different list of email recipients specified in the event definition or for which actions are disabled. Specify RECIPIENTS as a comma separated list of email addresses (no spaces). Example: `--email-recipients storage_admin@company.com,bsmith@company.com,abrown@company.com` | | `--syslog-host SYSLOG_HOST` | To send alarms to a syslog server, use this option to specify a remote syslog server's IP address. For example: `--syslog-host 192.0.2.0` | | `--syslog-port PORT` | Sets the syslog port number. Default: *514* | | `--syslog-protocol udp\|tcp` | If `--syslog-host` is set, use this option to set which protocol to use to communicate with the syslog server. Default: *udp*. | | `--syslog-enable-vms-audit` | Enables auditing of VMS operations. | | `--syslog-disable-vms-audit` | Disables auditing of VMS operations. | | `--syslog-enable-shell-audit` | Enables auditing of CNode and DNode shell commands. | | `--syslog-disable-shell-audit` | Disables auditing of CNode and DNode shell commands. | | `--syslog-enable-ipmi-audit` | Enables auditing of CNode and DNode IPMI commands. | | `--syslog-disable-ipmi-audit` | Disables auditing of CNode and DNode IPMI commands. | | `--audit-logs-retention DAYS` | Sets the number of days to store audit logs on the syslog server. | | `--webhook-url URL` | Include this option to configure a webhook to be triggered by default by all types of events. A webhook contacts an external application and invokes an HTTP method in the external application. This feature requires the external application to support webhooks. This option specifies the webhook URL of the external application that you want to trigger. Obtain the webhook URL from the external application. See also `--webhook-method`. | | `--webhook-method POST\|GET\|PUT\|PATCH\|DELETE` | Include this option if you are configuring a webhook. See `--webhook-url`. This option specifies which HTTP method to invoke when the webhook is triggered. If the method sends a payload, use `--webhook-data` to specify the payload. | | `--webhook-data PAYLOAD` | Include this option to specify a payload to send if you are configuring a webhook. Relevant depending on the webhook method. See first `--webhook-url` and `--webhook-method`. Specify the PAYLOAD in JSON format encapsulated with ''. Use the data structure supported by the external application. You can include the following variables: - `${vastdata_timestamp}` - The date and time of the event. - `${vastdata_object_type}` - The type of object being monitored for the event type. This could be the cluster, a hardware component such as a NIC, or a logical entity such as a snapshot. - `${vastdata_object_id}` - The ID of the specific object involved in the event. - `${vastdata_event_type}` - The type of change in the property value that triggered the event, such as object modified, when a property is changed to a given value, or threshold, when a property value crosses a given threshold, or rate, when a property value exceeds a value within a given time frame. - `${vastdata_severity}` - The severity of the alarm triggered by this event. Can be `critical`, `major`, `minor` or `N/A`. If `N/A`, no alarm is raised. - `${vastdata_mapped_severity}` - Mapped alternate name for the severity. - `${vastdata_event_name}` - The name of the event. - `${vastdata_property}` - The property involved in the event. - `${vastdata_object_name}` - The name of the object involved in the event. - `${vastdata_cluster_name}` - The name of the cluster on which the event occurred. - `${vastdata_event_origin}` - Indicates where the event originates. Can be `cluster` (for example, a failed CNode), `user` (user action), `security` (such as login, logout, failed login) or `management`. For example: `--webhook-data '"text":"${vastdata_event_name}"'` | | `--disable-actions` | Disables any configured email recipients, webhook and syslog server. | | ` --enable-actions` | Enables any configured email recipients, webhook and syslog server (default). | | `--quota-email-suffix SUFFIX` | Specifies a suffix to append to user names to form an email address. This is used as the email recipient address for sending a user an email if they exceed a user quota limit. It is used if an email address is not found for the user on a provider. | | `--quota-email-provider aggregated\|ldap\|ad` | Specifies the query context to used when querying providers for user email addresses in order to send users notifications of exceeding user quotas. Possible values: - `aggregated`. Performs an aggregated query of all providers, - `ldap`. Queries an LDAP server for user quota notification email addresses. - `ad`. Queries Active Directory for user quota notification email addresses. | | `--quota-email-interval INTERVAL` | Specifies the minimal interval time between quota notification emails sent to a user. Format: `<days> <hours>:<minutes>:<seconds>` For example, if you specify *1 00:00:00*, a user will not receive more than one email each day. Example: `--quota-email-interval '1 06:30:00'` | | `--quota-email-hourly-limit LIMIT` | Sets the maximum allowable number of all the quota notification emails sent to all the users, per hour. | ##### Example ```plaintext vcli: admin> eventdefinitionconfig modify --smtp-host mail.company.com --smtp-port 587  --smtp-user smtp-admin --smtp-password wh2tever --smtp-enable-tls --email-sender do_not_reply@company.com --email-recipients storage_admin@company.com,bsmith@company.com,abrown@company.com --syslog-host 192.0.2.0 ```